Linux kernel vulnerabilities

In the Linux kernel, the drm/bridge synopsys dw-dp driver initializes and registers the DisplayPort AUX channel during dw_dp_bind(), but never unregisters it. This may lead to resource leaks and/or use-after-free. The fix adds the missing dw_dp_unbind() function to allow cleanup.

In the Linux kernel, the drm/rockchip dw_dp driver initializes and registers core resources such as the DisplayPort AUX channel during dw_dp_bind(), but never unregisters them. This leads to memory leaks and/or use-after-free, as shown in a KASAN report. The issue is fixed by using the exported dw_dp_unbind() function in the component's unbind() callback and in its bind() error path.

In the Linux kernel, the drm/rockchip analogix_dp driver has an OF node reference leak in rockchip_dp_drm_encoder_enable(), because of_get_child_by_name() does not call of_node_put() symmetrically. The fix uses __free(device_node) to automatically manage reference release.

In the Linux kernel, the drm/v3d driver does not clear queue->active_job when v3d_fence_create() fails. The run_job() callbacks for BIN, RENDER, TFU and CSD assign the job to queue->active_job before calling v3d_fence_create(); on failure they return NULL, leaving a dangling pointer. The fix adds a failure path clearing active_job.

In the Linux kernel, smack_msg_queue_msgrcv() incorrectly checks permissions of the 'current' task instead of the 'target' task. In the pipelined_send() optimization path, the sender checks on behalf of the receiver, so an unauthorized receiver can get the message, violating Smack MAC policy. The fix checks permissions on the 'target' task.

In the Linux kernel, cros_typec_register_partner_pdos() copies partner PDOs from the EC TYPEC_STATUS response into the fixed caps_desc.pdo[PDO_MAX_OBJECTS] array (7 entries) without validating the count. If source_cap_count or sink_cap_count exceeds 7, memcpy writes past the stack array — a count of 255 overflows it by about 1 KB. The fix validates the counts and skips PDO registration when exceeded.

In the Linux kernel, the HID roccat driver uses an 8-bit, device-supplied profile index without a range check, even though the profiles array has only 5 elements. A malicious USB device claiming the Roccat Kone id can send a switch-profile event with an out-of-range value, causing an out-of-bounds read that is exposed via the actual_dpi sysfs attribute.

In the Linux kernel, the ASoC SOF functions sof_ipc4_widget_setup_comp_src() and sof_ipc4_widget_setup_comp_asrc() print an error and jump to the cleanup label when the number of input or output formats is zero, but 'ret' is still 0. As a result, the function returns success even though the widget setup actually failed.

In the Linux kernel, the cxl/mbox CXL_MEM_SEND_COMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, which is then used in kvzalloc(). A large out.size drives a huge allocation, above INT_MAX it warns and taints the kernel, and with panic_on_warn=1 it panics.

In the Linux kernel, the ASoC rt700-sdw driver has a vulnerability where rt700_sdw_remove() drains jack_detect_work and jack_btn_check_work only when the hw_init flag is set. This flag is cleared when the SoundWire device becomes UNATTACHED, potentially leaving active work objects and causing DEBUG_OBJECTS to report an active timer after removal.

In the Linux kernel, the ASoC fsl_audmix component leaves the AUDMIX block powered off and suspended after pm_runtime_enable() until the first runtime resume. Register writes issued between probe() and the first resume target unpowered hardware and cause a system hang.

In the Linux kernel, the drm/lima driver calls lima_vm_create() before va_start and va_end are set up, so both are 0. When DRM_DEBUG_MM is enabled, the DRM_MM_BUG_ON check in drm_mm_init() fires a kernel BUG, as seen on exynos4412-odroid-u2.

A vulnerability was fixed in the Linux kernel scheduler (sched/fair) involving a u32 overflow in update_tg_cfs_runnable(). The overflow corrupts runnable_sum, leading to a divide-by-zero in propagate_entity_load_avg() and a kernel crash. The issue can be triggered by workloads such as hackbench.

In the Linux kernel, the perf/x86/intel/uncore code has incorrect ordering of uncore_box_ref()/uncore_box_unref() relative to uncore_change_context(). In uncore_event_cpu_online(), uncore_box_ref() runs while box->cpu is still -1, so the box is never initialized on the first CPU in a die, and in the offline path the box is torn down on the second-to-last CPU.

In the Linux kernel, the drm/panthor driver has a NULL pointer dereference (NPD) issue during partial unmap of an evicted buffer object (BO). When BO pages are released on eviction, the 'bo->backing.pages' pointer is set to NULL, and the logic for handling GPU mapping splits did not completely skip this case for the VMA of an evicted BO, leading to a NULL dereference and kernel crash.

In the Linux kernel, the drm/amd/powerplay module had a flaw in the loop parsing the VoltageObjectInfo table. A malformed VBIOS could supply an invalid object size, leading to an infinite loop or heap out-of-bounds read.

In the Linux kernel, the drm/amdgpu/pm/powerplay module lacked bounds checks on vddInd and vddcInd indices from VBIOS-parsed tables. Invalid indices could cause out-of-bounds access to voltage lookup tables.

In the Linux kernel, the drm/amdgpu/pm/powerplay module lacked bounds checks on vddInd, vddciInd and mvddInd indices from VBIOS-parsed tables across nine sites. Invalid indices could cause out-of-bounds access to vddc, vddci and vddmem lookup tables.

In the Linux kernel, the drm/amd/display module's amdgpu_dm_plane_drm_plane_reset() freed the old state before allocating a new one. If kzalloc() failed, the state pointer was left dangling to freed memory.

In the Linux kernel, the drm/amd/display module's amdgpu_dm_crtc_reset_state() freed the old state before allocating a new one. If kzalloc() failed, the state pointer was left dangling to freed memory.

In the Linux kernel's BPF subsystem, copy_map_value_long() failed to copy the padding between map->value_size and round_up(map->value_size, 8) for per-CPU maps. As a result, UAPI LOOKUP_ELEM paths could return stale heap contents to user space.

In the Linux kernel's BPF/LSM subsystem, security_bpf_prog_free() called from softirq context (via __bpf_prog_put_rcu) triggered a "sleeping function called from invalid context" BUG when a sleepable LSM program was attached to the hook. The fix drops bpf_prog_free from sleepable_lsm_hooks.

In the Linux kernel's mm/mm_init, a missing allocation failure check for pgdat->per_cpu_nodestats in free_area_init_core_hotplug led to a NULL dereference when offsetting into the per-CPU area. The fix propagates -ENOMEM and leaves per_cpu_nodestats pointing at boot_nodestats.

In the Linux kernel's leds: lp5860 driver, lp5860_device_init() would double-unlock an already unlocked mutex if lp5860_init_dt() failed. The fix reworks how the lock is taken and released.

In the Linux kernel's dmaengine: xilinx_dma driver, a race condition existed in the AXIDMA and MCDMA interrupt handlers. The channel could be incorrectly marked idle and start spurious transfers while descriptors were still being processed, leading to descriptor corruption or missed completions.

In the Linux kernel, zynqmp_dma_remove() disabled runtime PM only after checking state and performing a manual suspend, which can race with runtime PM in the remove/unbind (rmmod) path. The fix disables runtime PM first, then suspends only if the device is not already suspended, preventing further runtime PM transitions.

In the Linux kernel, the dmaengine xilinx_dma driver's xilinx_dma_poll_timeout function, when called with delay_us=0 and a condition that is never fulfilled, caused the CPU to busy-wait for a prolonged time. Instead of timing out after approximately XILINX_DMA_LOOP_COUNT microseconds, the timeout occurred after several minutes, leading to a CPU stall. The fix introduces the XILINX_DMA_POLL_DELAY_US constant and uses delay_us=10.

In the Linux kernel, the syscall trace path reloads syscall arguments from pt_regs before calling the handler. On C-SKY ABIv2, the code adjusts sp before loading LSAVE_A4 and LSAVE_A5, so the wrong slots are fetched and traced syscalls using the 5th or 6th argument (e.g., mmap2) receive corrupted arguments. The fix loads a4/a5 from pt_regs before changing sp.

In the Linux kernel, the rtw89_ppdu_str() function in the rtw89 Wi-Fi driver uses a '>' comparison instead of '>=', which can lead to an out-of-bounds access. The fix changes the operator to '>=' to avoid the invalid memory access.

In the Linux kernel, in the platform/chrome sensorhub module, max_response and sensor_num come from different EC commands. With malfunctioning EC firmware, the number of read bytes can be less than expected, causing an overread of the resp->fifo_info buffer in cros_ec_sensorhub_ring_handler(). The fix checks the return value of cros_ec_cmd_xfer_status() and aborts on length mismatch.

A vulnerability in the Linux kernel's uprobes mechanism on x86 has been fixed. Optimized uprobes could clobber the user stack redzone area because the call instruction stored a return address on the stack while user code might keep temporary data there without adjusting rsp. The fix moves optimized uprobes from the nop5 to the nop10 instruction, allowing an additional lea instruction to adjust rsp before the call.

In the Linux kernel, hwrng_register() adds rng to the global rng_list and may then try to set it as current_rng. If that step fails, it returns an error but does not remove rng from the list, causing a dangling reference and potential use-after-free if the caller frees rng. The fix adds a list_del_init() cleanup step.

In the Linux kernel, the crypto qat driver queues SR-IOV re-enable work using a work_struct and completion embedded in an on-stack adf_sriov_dev_data. If the completion wait times out, the reset worker can return while device_sriov_wq still holds or executes the stack-backed work item. The fix cancels the work on device_sriov_wq on timeout before the stack frame unwinds.

In the Linux kernel, qat_alg_xts_reverse_key() expands the forward XTS AES key on the stack, and the key schedule contains key material that can remain in the stack frame. The fix clears the temporary crypto_aes_ctx with memzero_explicit() after the copy.

In the Linux kernel, the hardware ECDH path in atmel_ecdh_compute_shared_secret() uses the private key stored in the device, but the public key is cached only after atmel_ecdh_set_secret() successfully generated that private key for the current tfm. The fix adds a check for a missing cached public key to prevent using a private key not generated for the current tfm.

In the Linux kernel, the crypto: atmel-sha204a driver failed to free the work_data structure when an I2C transfer failed in the nonblocking RNG path. The pointer remained in rng->priv, so subsequent reads could interpret stale state as valid RNG completion data, causing a heap information leak.

In the Linux kernel, sa_ul_probe() in the crypto: sa2ul driver ignored the return value of sa_init_mem(), which creates the DMA pool for security context buffers. If pool creation failed, probe continued with DMA setup and algorithm registration even though later request setup depends on that pool.

In the Linux kernel, xtrng_readblock32() in the hwrng: xilinx-trng driver returned the number of bytes read even when the first poll timed out. The caller treated a zero return as a short successful read, and partial reads for full 32-byte blocks could make the tail copy use a fixed block offset instead of the amount already produced.

In the Linux kernel, rk_hash_run() in the crypto: rk3288 driver waited for RK_CRYPTO_HASH_STS to become idle after the final DMA transfer but ignored the poll result. If the hash engine never became idle, the driver still read the digest registers and finalized the request with the previous success value.

In the Linux kernel, register_aes_algs() in the crypto: keembay driver registered AEAD algorithms before skcipher algorithms. If skcipher registration failed, the function unwound the earlier AEAD registration passing ARRAY_SIZE(algs) (the skcipher table size) instead of ARRAY_SIZE(algs_aead).

In the Linux kernel, the RDMA/irdma driver did not prevent userspace from deregistering the MRs backing QP/CQ/SRQ rings. The fix adds refcounting to user ring MRs by bumping the MR's refcount upon association.

In the Linux kernel, __wait_for_resp() in the RDMA/bng_re driver ignored wait_event_timeout() expiry. If the response slot remained in use after the timeout and the polled CREQ service attempt, the loop started another full timeout period and could repeat forever.

In the Linux kernel, apple_nvme_init_queue() in the nvme-apple driver initialized queue state and then marked the queue enabled. The old wmb() after WRITE_ONCE(enabled, true) did not publish the earlier initialization before enabled became visible, potentially racing with interrupt and request paths.

A resource leak exists in the Linux kernel's nvmet-rdma module. When an NVMe target with RDMA transport is removed while I/Os are in flight, a response can be posted but its send completion is never delivered before the connection is torn down, so nvmet_rdma_send_done() and nvmet_rdma_release_rsp() are never called, leaking the allocated RDMA read/write context and request SGLs.

In the Linux kernel, the nr_deadline_tasks variable in the cpuset structure could be modified concurrently by inc_dl_tasks_cs() under rq->lock and by cpuset_attach() under cpuset_mutex. Simultaneous updates could corrupt the variable, leading to incorrect operations.

In the Linux kernel, the mac80211_hwsim driver has a vulnerability where a NULL pointer can be passed to ieee80211_free_txskb() during queue stop. The issue arises from separating the empty queue check from the dequeue operation, which is unsafe under concurrent TX status handling.

In the Linux kernel's BPF subsystem, there is a vulnerability allowing out-of-bounds memory access for MEM_ALLOC BTF pointers. During BTF struct walks, the size limit is not properly enforced for statically allocated objects, potentially leading to reads/writes beyond the allocated area.

In the Linux kernel's BPF subsystem for s390 architecture, there is an issue with the 'ly' instruction that does not zero the upper bits of a 64-bit register when loading a 32-bit value. The 'llgf' instruction should be used instead, as it correctly zeroes the upper bits.

In the Linux kernel's proc_timens_set_offset() function, there is a lack of validation for the tv_nsec field, which should be in the range [0, 999999999]. Invalid values can lead to incorrect calculations or unexpected behavior when adding times.

In the Linux kernel's qcom gdsc clock driver, there is an issue with improper removal of genpd domains during unregistration. The gdsc_unregister() function does not call pm_genpd_remove() for registered domains, leaving entries on the global list and causing errors on re-registration.