Linux kernel vulnerabilities

In the Linux kernel's MANA network driver, a vulnerability was found where mana_detach() is called unconditionally on an already-detached port, causing a NULL pointer dereference during queue teardown.

A race condition in the Linux kernel's SCTP sctp_wait_for_connect() function allows another thread to peel off the association to a new socket while waiting, causing incorrect lock usage. The fix adds a check to detect migration and return an error.

Vulnerability in the Linux kernel in the vsock/virtio driver related to incorrect uarg binding before filling zerocopy skb. Can lead to improper memory management and potential data leak.

A vulnerability in the Linux kernel's rt6_fill_node() function for IPv6 can cause an infinite loop. The issue arises from a race condition between list_del_rcu() operations under tb6_lock and concurrent list traversal by a softirq handler, leading to a CPU stall.

A vulnerability in the Linux kernel's fib6_select_path() function for IPv6 can cause an infinite loop. The issue arises from a race condition between list_del_rcu() operations on the fib6_siblings list and concurrent softirq readers, preventing the loop terminator from being reached.

In the ST_LSM6DSX IMU driver in the Linux kernel, a stack data leak was found in the tagged FIFO buffer path. The stack-allocated structure is not initialized, causing uninitialized bytes to be copied to userspace.

In the ADIS16550 driver for the Linux kernel, a stack data leak was discovered in the trigger handler. The scan data array declared on the stack is not initialized, and memcpy fills only the first 28 bytes, leaving bytes 28-31 uninitialized, causing data leak to userspace on every trigger.

In the Linux kernel BMP280 driver, a stack leak was found in the BMP580 trigger handler. The scan buffer declared on the stack without initialization causes two uninitialized bytes to be pushed to userspace per scan.

In the Linux kernel's USB Type-C UCSI CCG driver, a vulnerability exists due to missing validation of firmware image headers. If the firmware image lacks a ':' character, strnchr() returns NULL, leading to a NULL pointer dereference and system crash (oops).

In the Linux kernel, a vulnerability in the USB Type-C TCPM driver lacks validation of the VDO count in Discover Identity ACK handlers, potentially causing out-of-bounds array access. An attacker via USB-C could supply a malformed VDO count, leading to kernel memory disclosure.

In the Linux kernel USB Type-C TCPM driver, a vulnerability was found due to missing bounds checking of the altmode_desc[] array inside the loop of svdm_consume_modes(). An untrusted device can send unsolicited ACK responses, causing out-of-bounds memory write.

A vulnerability was found in the Linux kernel's DisplayPort alternate mode driver for USB Type-C. A broken or malicious device can send an incorrect count in a status update VDO, causing the kernel to read uninitialized stack data and forward it elsewhere.

In the Linux kernel USB Type-C driver, a vulnerability was found where wcove_read_rx_buffer() writes past the pd_message structure. A malicious device can send a 31-byte PD frame, causing out-of-bounds write on the IRQ thread stack.

In the Linux kernel, the USB Type-C TCPM/TCPCI Maxim driver lacked validation of the number of data objects advertised in the frame header against the actual received byte count. A broken or malicious port could send a CRC-valid frame with a header claiming up to seven data objects but with fewer bytes, leading to reading from uninitialized stack memory.

In the Linux kernel, the UCSI (USB Type-C) driver lacks validation of the connector number in ucsi_connector_change(). The 7-bit connector number from the PPM is used to index the ucsi->connector[] array without checking against the number of connectors reported at init. A buggy or malicious PPM can trigger schedule_work() on out-of-bounds memory.

A vulnerability in the Linux kernel's USB safe_serial driver allows user-controlled slab corruption when a malicious device reports a bulk-out buffer size smaller than 8 bytes. The fix ensures the buffer size is at least 8 bytes.

A vulnerability in the Linux kernel's cypress_m8 USB serial driver can cause memory corruption or NULL-pointer dereference. The issue occurs when a malicious device reports a too small interrupt-out endpoint max packet size.

In the Linux kernel, __get_vm_area_node() incorrectly triggers a BUG() when bottom halves (BH) are disabled, causing a kernel panic during normal bridge operations like FDB entry addition.

In the Linux kernel, a vulnerability in the HPFS filesystem causes a crash when hpfs_map_dnode_bitmap fails. The issue is calling hpfs_brelse4 on an uninitialized quad buffer head, leading to memory corruption.

A memory leak was found in the Linux kernel's migrate_vma_insert_huge_pmd_page function. When a PMD check fails, the previously allocated page table (pgtable) is not freed, causing a memory leak. A free_abort label was added to release the pgtable in the error path.

In the Linux kernel, a vulnerability in memfd allows SEAL_WRITE to be implied via SEAL_EXEC before checking for existing writable mappings, breaking the write-seal contract. This enables an attacker to pass a memfd that appears write-sealed but remains modifiable.

A use-after-free vulnerability was found in the Linux kernel's zram subsystem in the zram_writeback_endio function. A race condition between the bio completion handler and the writeback task can cause a kernel crash.

In the Linux kernel, a vulnerability in try_to_unmap_one in mm/rmap fails to initialize nr_pages at the start of each loop iteration, allowing reuse of a stale value from a previous folio_unmap_pte_batch() call. This can corrupt folio refcount/mapcount when combining MAP_DROPPABLE, MADV_FREE, and HMM_DMIRROR_EXCLUSIVE, leading to a kernel crash.

In the Linux kernel, an out-of-bounds (OOB) read vulnerability exists in the auxdisplay line-display driver when writing zero bytes to the 'message' sysfs attribute. The linedisp_display() function reads msg[count - 1] before checking if count is zero, causing a read at msg[-1] which can lead to kernel panic on KASAN-enabled systems or silent adjacent data reads on stock kernels.

A reference leak in the Bluetooth L2CAP stack of the Linux kernel was found. The l2cap_chan_timeout() function fails to release a reference taken by __set_chan_timer() when the connection (chan->conn) is NULL, causing a memory leak.

In the Linux kernel Bluetooth HIDP subsystem, missing length validation in hidp_input_report() allows an out-of-bounds read when a paired device sends a truncated packet. This can cause phantom key presses or spurious mouse movements.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's Bluetooth ISO stack in the iso_recv_frame function. It reads the socket pointer under a lock but uses it after releasing the lock, allowing a concurrent iso_sock_kill() to free the memory.

In the Linux kernel's Bluetooth ISO subsystem, a race condition was found in iso_sock_clear_timer(). The function reads the connection pointer without holding the socket lock, which can lead to a NULL pointer dereference or use-after-free (UAF) when the socket is being closed concurrently.

In the Linux kernel Bluetooth subsystem, a use-after-free (UAF) vulnerability was found in hci_le_create_cis_sync. The conn pointer is dereferenced after releasing RCU and hci_dev_lock locks, allowing a concurrent disconnect to free memory before read. The cancellation mechanism in hci_conn_del() fails because queue and dequeue data mismatch.

In the Linux kernel xpad driver, an out-of-bounds access vulnerability was found in the Share button handling. A controller can send a crafted GIP_CMD_INPUT packet shorter than 18 bytes, causing memory reads beyond the allocated buffer.

A race condition was found in the Linux kernel's parport subsystem between port and client registration. Ports are registered before full initialization, allowing clients like lp to attach to incomplete ports, causing system crashes.

A vulnerability was found in the Linux kernel's KVM for ARM64, related to incorrect capping of the ZCR_EL2 register by a guest hypervisor. The issue occurs when the guest updates ZCR_EL2 via ZCR_EL1 without proper sanitization, allowing L2 guests to access unauthorized vector lengths (VL).

In the Linux kernel, a vulnerability was found in the KVM SEV component due to missing READ_ONCE() when reading entries/indices from the guest-accessible Page State Change (PSC) buffer. This allows a TOCTOU (Time-of-Check Time-of-Use) attack by a malicious guest.

In the Linux kernel MT6359 ADC driver, the return value of regmap_read() in mt6358_read_imp() is not checked. If the read fails, val_v remains uninitialized and its random stack content is reported as a measurement result.

In the NXP SAR ADC driver in the Linux kernel, there is no validation of the sampling frequency value before using it as a divisor. Writing zero or a negative value to the sampling_frequency sysfs attribute triggers a division by zero. Additionally, when the computed cycle count is smaller than NXP_SAR_ADC_CONV_TIME, an unsigned integer underflow occurs, wrapping inpsamp to a huge value.

In the Linux kernel driver for the ITG3200 gyroscope, a bug in itg3200_read_all_channels() passes the address of a local pointer instead of the caller's buffer to i2c_transfer(). This causes sensor data to be written to the stack and lost, while uninitialized stack contents are pushed to userspace via /dev/iio:deviceX.

In the ADIS16260 gyroscope driver in the Linux kernel, there is no validation of the sampling frequency value before using it as a divisor. Writing zero to the sampling_frequency sysfs attribute triggers a division by zero in the kernel.

In the Linux kernel driver for the MH-Z19B sensor (iio: chemical: mhz19b), a buffer overflow vulnerability was found. The mhz19b_receive_buf() function copies serial data into a fixed buffer without checking if the reply size exceeds available space, potentially causing a buffer overflow.

In the Linux kernel, the SCD30 driver for IIO chemical sensors has a division by zero vulnerability. A user can trigger a kernel crash by writing a zero fractional part to the sampling_frequency sysfs attribute.

A use-after-free vulnerability was found in the Linux kernel's IIO hardware consumer error path. The list_for_each_entry() macro accesses freed memory after iio_buffer_put() releases a buffer during cleanup in iio_hw_consumer_alloc().

A memory leak was discovered in the Linux kernel's IIO (Industrial I/O) subsystem during DMA buffer enqueue. The iio_buffer_enqueue_dmabuf() function failed to release a reference to the struct iio_dma_fence object, causing a permanent leak of 104 bytes per enqueue operation.

A vulnerability in the Linux kernel's USB serial omninet driver can cause memory corruption when a malicious device reports a smaller endpoint max packet size than expected, leading to controlled slab corruption.

In the Linux kernel, a use-after-free vulnerability was found in the USB dwc2 driver's debug code. The issue occurs because the 'urb' structure is dereferenced after calling usb_hcd_giveback_urb(), which is not allowed.

In the Linux kernel, a bug was found in the BPF sockmap's bpf_msg_push_data() function. When inserting data into a scatterlist entry, the right fragment offset was incorrectly advanced by the global insertion point instead of the local offset within the entry, causing split layout inconsistency.

In the Linux kernel's macsec module, a vulnerability bypasses replay protection at XPN lower-PN wrap. When PN reaches 0xFFFFFFFF, incrementing overflows to 0, failing to update next_pn_halves, allowing an attacker to replay a captured frame indefinitely.

In the Linux kernel, the octeontx2-af driver has a vulnerability allowing out-of-bounds memory write. The rvu_mbox_handler_rep_event_notify function does not validate the pcifunc field in the request, enabling an attacker to write past the allocated PF/VF structure array.

In the Linux kernel VTI (Virtual Tunnel Interface) driver for IPv6, a vulnerability allows an unprivileged user in a network namespace to hijack a VTI tunnel from another namespace. The issue stems from using dev_net(dev) instead of t->net in the tunnel lookup within vti6_siocdevprivate(), enabling hash table manipulation after tunnel migration.

In the Linux kernel, a vulnerability in IPv6 extension header handling allows an unprivileged user to trigger a slab-out-of-bounds read via nftables payload-write, as the header length is not re-validated before copying to cmsg.

A vulnerability was found in the Linux kernel's xfrm module related to transport-mode packet processing. During deferred transport reinjection, a pointer to the network namespace (netns) stored in skb->cb may become invalid if the namespace is removed before the callback executes.

In the Linux kernel's L2TP module, a vulnerability was found where l2tp_session_get_by_ifname() uses plain refcount_inc() instead of refcount_inc_not_zero(). This can cause a race condition returning a pointer to a session with a zero reference count, leading to a use-after-free.