Linux kernel vulnerabilities

In the Linux kernel's lm90 driver, a race condition exists between delayed work cancellation (alert_work, report_work) and hwmon device release. Under certain conditions, this can lead to a use-after-free vulnerability.

A vulnerability was found in the Linux kernel's cgroup/rstat mechanism, where the css_rstat_updated() function exposed as a BPF kfunc does not validate the CPU number provided by the caller. A BPF program with appropriate capabilities can pass an invalid CPU value, leading to an out-of-bounds array access.

A use-after-free vulnerability was found in the Linux kernel's bridge multicast implementation when removing a bridge port. The issue occurs when per-VLAN multicast snooping is enabled and global multicast snooping is toggled, causing both per-port and per-VLAN multicast contexts to be active simultaneously. When such a port is removed, the per-port context is not disabled, leading to use of freed memory.

A race condition was found in the Linux kernel's EROFS filesystem managed cache for unaligned extents. Two threads may simultaneously add the same folio to the cache, leading to an inconsistent state. This only affects data compression with the -E48bit option (e.g., zstd).

In the Linux kernel's mac80211 subsystem, a vulnerability was found due to missing bounds checking of the link_id in ieee80211_ml_epcs. An attacker WiFi 7 AP can send a crafted EPCS Enable Response frame with link_id=15, causing an out-of-bounds read and kernel crash.

In the Linux kernel ALSA sequencer UMP subsystem, a use-after-free vulnerability exists during output teardown. Lack of synchronization between event processing and rawmidi connection closing can lead to access to already freed memory.

In the Linux kernel, a vulnerability in the tracing subsystem causes hist_field_name() to return NULL instead of an empty string when the field name is truncated. This leads to NULL pointer dereference in strcat() and strcmp() calls, potentially causing a system crash.

A vulnerability in the Linux kernel's network shaping mechanism (net: shaper) arises from non-atomic storage of the VALID flag relative to the XArray entry, causing a data race. This can lead to a use-after-free (UAF) during rollback operations.

A vulnerability in the Linux kernel's rxrpc mechanism causes pagecache corruption when locally transmitting DATA packets via splice(). The fix copies data to a temporary buffer before decryption in recvmsg().

In the Linux kernel, the gpio: aggregator driver has a use-after-free vulnerability. On error, dev_id in aggr->lookups was freed before removing the entry from the lookup table, allowing a concurrent thread calling gpiod_find() to access freed memory via strcmp().

In the Linux kernel, a memory leak of the dynamic software node was found in the GPIO aggregator driver. The node is created for the aggregator platform device when using configfs but is not destroyed upon device deactivation.

In the Linux kernel's DRM xe driver, an exec_queue reference leak occurs when opening an OA stream. If the width parameter exceeds 1, the function returns an error without releasing the reference, causing permanent resource pinning.

A memory leak of dma_vec allocation was found in the Linux kernel's nvme-pci driver when using P2P memory. The allocation was not freed upon completion because P2P memory is not unmapped.

A DMA mapping leak was discovered in the Linux kernel's nvme-pci driver during data setup error handling. The leak occurs when allocation of the tracking descriptor for PRP or SGL fails, and also when an invalid bio_vec is detected during PRP mapping.

A use-after-free vulnerability was found in the Linux kernel's blk-mq mechanism. The issue occurs when a task sleeps after peeking a cached request but before popping it, leading to memory being freed and potential exploitation.

In the Linux kernel, a vulnerability was found in the key lookup mechanism where find_key_to_update() calls assoc_array_find() without holding the RCU read lock. This causes security issues, especially with persistent keys that use a different locking model than regular keys.

In the Linux kernel's usbtouchscreen driver, a vulnerability was found due to missing validation of data lengths from NEXIO devices. A malicious device can supply inflated header values, causing an out-of-bounds read beyond the allocated DMA buffer (up to 64 KiB) and potential kernel memory leak to userspace as touch events.

In the Linux kernel, a vulnerability in the ACPI Button driver causes a GPE handler leak during driver removal. This can lead to kernel crashes and failure to re-probe the device.

A vulnerability in the Linux kernel's SFB network scheduler can cause a kernel panic when SFB has child qdiscs (e.g., QFQ) with qdisc_peek_dequeued() peek callback. The parent scheduler (e.g., TBF) calls dequeue() directly instead of using qdisc_dequeue_peeked(), leading to a null-pointer dereference.

A use-after-free vulnerability was found in the Linux kernel's NFC LLCP stack in the llcp_sock_release() function. The issue occurs when a socket in the connecting state is removed from the wrong list, potentially leading to memory corruption.

A race condition in the Linux kernel's NFC LLCP stack during CC packet processing can cause a use-after-free of a socket when handled concurrently with socket release.

A vulnerability in the Linux kernel's xfrm_state_mtu function can cause an out-of-bounds write in the ESP component. An unprivileged attacker can install an IPv4 ESP tunnel with a large authentication key, small interface MTU, and large XFRMA_TFCPAD, triggering an arithmetic underflow that results in writing a massive amount of zeros to memory.

In the Linux kernel's rocket driver, a use-after-free (UAF) vulnerability was found due to a dangling GEM handle left after a failed buffer object creation. The bug occurs when rocket_ioctl_create_bo() creates a GEM handle before performing fallible operations, and on error frees the object without removing the handle from the IDR.

In the Linux kernel's netfilter nf_tables subsystem, a vulnerability was found where destination (dst) data gets corrupted during bit shift operations (lshift/rshift) on the same register. When source (src) and destination (dst) point to the same memory location, the carry value is incorrectly calculated using already modified data, leading to incorrect operation results.

In the Linux kernel, a vulnerability was found in the SMC (Shared Memory Communications) module. The smc_init() function unnecessarily and dangerously re-initializes the smc_v*_hashinfo.ht hashtables, which can corrupt the hash list if entries already exist and are in use.

A vulnerability in the Linux kernel's locking mechanism for the .getsockopt function in AF_IUCV sockets was found. Missing proper locking allows a race condition between recvmsg() and getsockopt(SO_MSGSIZE), leading to a NULL pointer dereference and system crash.

In the Linux kernel SCSI subsystem, a vulnerability was found where scsi_run_host_queues() failed to run queues for devices in SDEV_CANCEL state, potentially causing the device removal process to hang. The issue stems from using the shost_for_each_device() macro which skips devices being removed, leaving requeued requests unhandled.

In the Linux kernel, a vulnerability in IPv4 frees net->ipv4.sysctl_local_reserved_ports too early before unregister_net_sysctl_table(). This can cause a use-after-free when accessing /proc/sys/net/ipv4/ip_local_reserved_ports.

In the Linux kernel's ALSA PCM OSS subsystem, a use-after-free (UAF) vulnerability was found during proc file write. The function snd_pcm_oss_proc_write() links a new setup entry into the list before duplicating the task name, and on memory allocation failure, it frees the already linked entry, leaving a dangling pointer. A subsequent OSS device open can traverse the stale entry, leading to freed memory dereference.

A memory leak vulnerability was found in the Linux kernel's ethtool RSS functionality. The rss_prepare_get() function allocates buffers for the indirection table and hash key but fails to free them if the ops->get_rxfh() call fails.

In the Linux kernel, a vulnerability was found where ethnl_ops_complete() is skipped on module flash errors via ethtool. When validate() fails, the completion function is not called even though ethnl_ops_begin() was already invoked.

In the Linux kernel, a vulnerability was found in the module_flash_fw_schedule() function of ethtool, which fails to undo the 'in_progress' flag and release the netdev reference on module flash errors. Delaying these acquisitions prevents the device from disappearing while holding rtnl_lock.

In the Linux kernel, a vulnerability in the ethtool cmis module allows a malicious SFP module to respond with a reply length (rpl_len) larger than expected by cmis_cdb_process_reply(), causing an out-of-bounds (OOB) write. This affects potentially malicious hardware as well as buggy or corrupted modules.

In the Linux kernel's ethtool driver for CMIS modules, a vulnerability was found due to missing validation of the data size received from the module. A malicious module can return an inflated start_cmd_payload_size value, leading to an out-of-bounds (OOB) write in cmis_fw_update_start_download().

In the Linux kernel Bluetooth 6lowpan stack, send_mcast_pkt() does not check the return value of skb_clone(). If memory allocation fails, skb_clone() returns NULL, leading to a NULL pointer dereference in send_pkt() when accessing skb->data.

A vulnerability in the Linux kernel allows enslaving a CAN interface (e.g., vxcan) to a bonding master. This process corrupts CAN data structures, causing a null-pointer dereference and system crash. The issue stems from missing device type validation before enslaving.

A bug in the Linux kernel bridge caused a sleeping function (dev_set_promiscuity()) to be called in an atomic context. The issue occurred during Netlink-based bridge port configuration when the bridge lock was held longer than necessary, covering operations that do not require it.

A bug was found in the Linux kernel's brport_store() function in the bridge sysfs path, causing a call to a sleeping function (dev_set_promiscuity()) in an atomic context. The issue stemmed from unnecessarily holding the bridge lock while processing many port attributes that do not require it. The fix reduces the lock scope to only STP-related attributes that actually need it.

In the Linux kernel, a vulnerability in ethnl_update_profile() in ethtool allows out-of-bounds write because the index 'i' used to write to new_profile array is not bounded, while the number of Netlink nest entries is user-controlled. The destination buffer is allocated for NET_DIM_PARAMS_NUM_PROFILES (5) entries.

In the Linux kernel, a vulnerability in the ethtool tsinfo function passes an ERR_PTR to genlmsg_cancel on dump preparation failure, potentially causing a system crash.

In the Linux kernel, the Netlink fallback path for reading module EEPROM lacked validation that the requested range (offset + length) stays within the total EEPROM size. Additionally, the buffer passed to drivers was not zeroed, potentially leading to data leaks.

A vulnerability was found in the Linux kernel's netem packet duplication mechanism. When netem duplicates a packet, it re-enqueues the copy at the root qdisc, which can cause an infinite duplication loop if another netem is present in the tree. The fix uses the tc_depth field in the skb structure to prevent multiple duplications of the same packet.

In the Linux kernel, a vulnerability in the mirred mechanism (net/sched) causes loss of loop state information when redirecting traffic to ingress. As a result, loops between interfaces (e.g., ethx:ingress -> ethy:egress -> ethx:ingress) are not detected, potentially leading to system overload.

In the Linux kernel, a vulnerability in the mirred action's blockcast mechanism (net/sched/act_mirred) lacks recursion counter increment before calling tcf_blockcast(), enabling an unbounded recursion loop between network devices that leads to kernel stack overflow.

A vulnerability was found in the Linux kernel's handshake mechanism for TLS connections. The handshake_req_cancel() function can be called from softirq context by the NVMe over TCP driver, causing a deadlock when acquiring the hn_lock with plain spin_lock(). The fix converts all hn_lock operations to use spin_lock_bh/spin_unlock_bh to disable softirqs.

In the Linux kernel, the change_work mechanism in the dpll zl3073x driver was removed due to a race condition during device teardown. It was replaced with a direct call to __dpll_device_change_ntf(), preventing use-after-free on a freed dpll_dev pointer.

In the Linux kernel's Bluetooth L2CAP stack, a vulnerability exists where chan->ident is not cleared after a successful ECRED reconfiguration. This allows a remote attacker to replay a failure response with the stale ident, causing the kernel to destroy an already-established channel.

A vulnerability in the Linux kernel's Bluetooth L2CAP stack may cause a system crash when handling ECRED connection response. The issue occurs when a destination channel ID (dcid) is already assigned, and attempting to delete the channel can corrupt the list structure used for iteration.

In the Linux kernel Bluetooth subsystem, a vulnerability was found where the HCI_CMD_DRAIN_WORKQUEUE flag is not set during device close. This can cause unnecessary timeouts to be queued during reset, leading to incorrect behavior.

In the Linux kernel's MANA network driver, NULL pointer guards are missing in the teardown path after a partial queue allocation failure. Freed pointers are later dereferenced in functions like mana_chn_setxdp(), mana_destroy_vport(), mana_fence_rqs(), and mana_dealloc_queues(), causing a kernel panic.