Linux kernel vulnerabilities

In the Linux kernel's L2TP module, a vulnerability was found where l2tp_session_get_by_ifname() uses plain refcount_inc() instead of refcount_inc_not_zero(). This can cause a race condition returning a pointer to a session with a zero reference count, leading to a use-after-free.

A vulnerability in the Linux kernel's VTI6 (Virtual Tunnel Interface for IPv6) driver was found. After moving a VTI6 interface between network namespaces (netns), the vti6_changelink() and vti6_update() functions use a stale network reference (dev_net instead of t->net), leaving a stale entry in the original namespace's hash table. This causes a kernel BUG when cleaning up that namespace, allowing an attacker in an unprivileged container to crash the system.

A vulnerability was found in the Linux kernel's HID driver for Wacom tablets. The wacom_hid_set_device_mode() function assumes that the HID_DG_INPUTMODE usage is always in the first field of the report, which can lead to an out-of-bounds (OOB) write if the usage is located in a different field.

In the Linux kernel, an out-of-bounds read vulnerability exists in the NFC HCI stack within nfc_hci_recv_from_llc() and nci_hci_data_received_cb(). A malicious NFC peer can send a zero-length HCP frame, causing an out-of-bounds heap read and potentially a skb_over_panic during reassembly.

In the Linux kernel, a vulnerability was found in the XFRM (IPsec) migration mechanism. Functions sending migration notifications (xfrm_send_migrate and pfkey_send_migrate) incorrectly routed them to the default network namespace (init_net) instead of the caller's namespace. This caused IKE daemons in other namespaces to never receive their own migration notifications, while daemons in init_net received notifications from all namespaces.

A vulnerability in the Linux kernel's netfilter conntrack TCP module allows an RST packet with an invalid sequence number to force a connection into the CLOSE state without proper direction validation. This can prematurely terminate active NAT entries.

In the Linux kernel, the xfrm iptfs module has a vulnerability due to improper cloning of runtime state when copying Security Associations (SAs). The iptfs_clone_state() function copies runtime objects such as skb queues, timers, and spinlocks that should not be shared with the original SA, leading to use-after-free and double-free memory issues.

A use-after-free (UAF) vulnerability was found in the Linux kernel's dma_buf_fd() function related to a tracepoint. After FD_ADD() returns, the file descriptor becomes live in the descriptor table, allowing another thread to close it before DMA_BUF_TRACE() executes, causing a use-after-free of the dma_buf structure.

In the Linux kernel's ksmbd filesystem, a regression causes an out-of-bounds (OOB) read in the ACE-walk loop of smb_check_perm_dacl(). The flaw stems from a transposed bounds check that never breaks the loop, allowing a 2-byte heap OOB read past the allocated pntsd buffer during SMB2_CREATE operations.

In the Atmel maXTouch touchscreen driver (atmel_mxt_ts) in the Linux kernel, a boundary check flaw was found in the mxt_prepare_cfg_mem function. When a config file provides an object larger than expected, the processing loop incorrectly skips the last byte, causing adjacent memory overwrite.

In the Linux kernel UIO driver, a double free of devm_kzalloc() memory was found. The probe() and remove() functions explicitly call kfree() on a structure that is automatically freed by the devres mechanism, causing a double free.

A use-after-free vulnerability was found in the Linux kernel's USB MUSB driver for the OMAP2430 platform. The omap2430_probe() function calls of_node_put(np) before the last access to the node, potentially leading to use of freed memory.

A use-after-free vulnerability was found in the Linux kernel's USB/IP vudc driver. During device removal (vudc_remove), a race condition can cause the timer to still be active while the vudc structure is freed, leading to access to freed memory.

In the Linux kernel, a vulnerability in the USB USBTMC driver fails to check the actual_length of URB data for interrupt-IN notifications. This can lead to out-of-bounds reads or use of stale data.

In the Linux kernel's belkin_sa USB serial driver, the interrupt callback lacks validation of the received data length. Short interrupt packets can cause out-of-bounds reads (slab-out-of-bounds) when parsing LSR/MSR status fields.

In the Linux kernel's cypress_m8 USB serial driver, a vulnerability allows out-of-bounds read due to missing validation of interrupt packet headers. The cypress_read_int_callback() function did not check if the received packet contains the required header before reading it, which can lead to out-of-bounds memory access on short transfers.

A vulnerability in the Linux kernel's USB digi_acceleport driver can cause memory corruption due to missing bulk-out buffer size validation. A malicious USB device could report smaller buffers than expected, leading to out-of-bounds memory access or slab corruption.

In the Linux kernel, the USB serial keyspan driver lacks a sanity check on the size of usa49wg indat transfers, potentially parsing stale or uninitialized slab data.

In the Linux kernel, a vulnerability in the mxuport USB serial driver can cause slab memory corruption when a malicious device reports a too small bulk-out endpoint max packet size. The fix ensures the packet size is at least eight bytes.

In the Linux kernel's mct_u232 driver, a vulnerability causes memory corruption when a USB device reports a smaller bulk-out endpoint max packet size than expected (32 bytes). The driver overrides the maximum transfer size, potentially leading to slab corruption.

In the Linux kernel, a vulnerability was found in the mct_u232 USB serial driver. It lacks a sanity check on the size of interrupt-in transfers, which could lead to parsing stale or uninitialized slab data and leaking it to user space.

In the Linux kernel, a vulnerability in the USB gadget composite driver's WebUSB GET_URL handler causes an integer underflow. When the host supplies a wLength smaller than the URL descriptor header, the unsigned subtraction wraps, leading to a massive out-of-bounds memory copy (nearly 4 GB).

In the Linux kernel USB gadget FunctionFS (f_fs), a vulnerability was found where the entire allocated buffer for a control OUT request is copied to userspace instead of only the actually received bytes. On a short packet transfer, this leaks uninitialized kernel memory (slab residue) to the FunctionFS daemon process.

In the Linux kernel, a use-after-free vulnerability exists in the USB gadget f_fs subsystem. The ffs_epfile_dmabuf_io_complete() function frees a USB request without clearing the priv->req pointer, leading to usb_ep_dequeue() being called on freed memory. The fix moves the deallocation to ffs_dmabuf_cleanup() with proper locking.

In the Linux kernel Thunderbolt driver, a vulnerability was found where a 32-bit sum wraps during property entry validation. A malicious XDomain peer can exploit this to read memory beyond the allocated block, leading to data leakage.

In the Linux kernel's Thunderbolt driver, a vulnerability was found due to insufficient validation of entry->length in __tb_property_parse_dir(). When length is less than 4, an out-of-bounds read and size_t underflow occur, potentially leading to system crash or code execution.

In the Linux kernel Thunderbolt driver, a vulnerability was found due to missing recursion depth limit in __tb_property_parse_dir(). An unauthenticated remote attacker can send a crafted PROPERTIES_REQUEST that chains DIRECTORY entries into a back-reference loop, exhausting the kernel stack and causing a crash.

A vulnerability was found in the Linux kernel's FCoE driver (fcoe_ctlr.c). The FIP CVL frame handler did not validate that the descriptor length (fip_dlen) was sufficient, allowing an unauthenticated L2 attacker to send a frame with a zero-length descriptor of type FIP_DT_NON_CRITICAL. This caused an infinite loop in the work thread, blocking all subsequent FIP frames on the controller.

A vulnerability in the Linux kernel's SCSI Fibre Channel (FC) transport subsystem allows an attacker with FC fabric access to send a crafted FPIN ELS frame, causing an infinite loop in the FC transport driver and resulting in a denial of service (DoS). The issue stems from using an 8-bit counter for a 32-bit pname_count field, which wraps at 256 and keeps the loop condition true indefinitely.

In the Linux kernel, a race condition in the DRM GEM driver between change_handle and handle_delete operations was fixed. During the window between releasing and re-acquiring the IDR table lock, a concurrent delete of the old handle could decrement the reference count to zero and free the GEM object while the new handle still references it in the IDR.

In the Linux kernel i915 driver, a use-after-free (UAF) vulnerability was found during TTM object purge. The issue arises because the bo->ttm pointer may be changed by ttm_bo_validate(), leading to dereference of an invalid object and general protection faults.

A race condition in the Linux kernel's qcom_geni serial driver causes a kfifo underflow when uart_flush_buffer() runs before the DMA completion IRQ. This results in stale buffer data being transmitted on the next DMA transfer.

In the Linux kernel, a NULL pointer dereference bug in the amdkfd driver in svm_range_set_attr. Process_info can be NULL if user doesn't call kfd_ioctl_acquire_vm before kfd_ioctl_svm.

In the Linux kernel, the amdkfd driver has an integer overflow vulnerability in the get_queue_ids() function. The array size calculation as num_queues * sizeof(uint32_t) can overflow on 32-bit systems, leading to potential security issues.

In the Linux kernel's amdgpu driver, a lock leak was found in the AMDGPU_GEM_OP_GET_MAPPING_INFO function. The error occurs on memory allocation failure (ENOMEM), causing three tracked resources, including the dma_resv lock on the VM root page directory, to be leaked. This permanently blocks subsequent operations on the same GPU VM, leading to a local denial of service (DoS).

In the Linux kernel, a bug in the amdgpu_hmm_range_get_pages function of the amdgpu driver was fixed. The notifier sequence was read multiple times, which could lead to working with invalid pages. The coding style was also improved by removing the pre-initialized return value and using the common define for the 2G range.

In the Linux kernel's amdgpu driver, a vulnerability was found due to missing bounds check on user-supplied num_entries in GEM_OP GET_MAPPING_INFO. An attacker can supply an excessively large num_entries, causing massive memory allocation, a kernel WARNING, and panic on systems with CONFIG_PANIC_ON_WARN=y.

A vulnerability was found in the Linux kernel's DZ serial driver for DECstation platforms. During initialization of the first serial port, a NULL pointer dereference occurred, causing a kernel panic. The issue was fixed by converting the driver to use a platform device.

In the Linux kernel, the Z85C30 serial driver (DECstation) crashes during initialization of the first serial port due to a null pointer dereference. The fix converts the driver to use a platform device, preventing the crash.

In the Linux kernel for ARM64 architecture, a vulnerability was found in the TLB walk cache invalidation mechanism. The tlb_flush() function did not check the unshared_tables flag, causing the wrong instruction (VALE1IS instead of VAE1IS) to be used after PMD table unsharing (huge_pmd_unshare), leaving stale non-leaf entries in the walk cache. This could lead to incorrect page table walks.

A race condition was found in the Linux kernel's MCTP USB driver between URB completion and cancellation of the rx_retry work. This can cause a URB to be submitted after the network interface has been stopped.

In the Linux kernel, a reference leak of mm_struct was found in the aie2_populate_range() function of the accel/amdxdna driver. Jumping to the 'again' label without calling mmput(mm) causes a kernel memory leak.

A data-race vulnerability was found in the Linux kernel's Bluetooth ISO subsystem. Functions iso_connect_bis(), iso_connect_cis(), iso_listen_bis(), and iso_conn_big_sync() read iso_pi fields (dst, src, src_type) without holding lock_sock(), while these fields can be concurrently modified by connect() or setsockopt() calls.

A vulnerability was found in the Linux kernel's 6LoWPAN stack for IEEE 802.15.4 networks. The lowpan_xmit() function accepts non-IPv6 packets (e.g., ETH_P_AOE), leading to the use of uninitialized data in the lowpan_addr_info structure. An attacker could exploit this for potential information disclosure or system instability.

In the Linux kernel's mac80211 subsystem, a vulnerability was found where the antenna index from the radiotap header is used directly as a shift count in a bit operation. This can cause undefined behavior reported by UBSAN.

A vulnerability was found in the Linux kernel's GARP (Generic Attribute Registration Protocol) attribute parser. The bug is caused by reversed operands in data length calculation, leading to an unsigned integer underflow. As a result, received Join/Leave events are ignored, breaking protocols like GVRP.

In the Linux kernel MPTCP subsystem, a TOCTOU (time-of-check time-of-use) race condition was found while computing the receive window (rcv_wnd). The MPTCP output path reads the acknowledgment sequence (ack_seq) without locking, which may cause inconsistencies between the data_ack value in the DSS option and the calculated receive window in the same packet.

In the Linux kernel, a vulnerability in the mt76 driver for mt7996 chipsets was found where the WCID pointer is not cleared when removing a station link in mt7996_mac_sta_deinit_link(), potentially leading to a use-after-free condition.

In the Linux kernel, two LSM hooks (task_to_inode and inet_conn_established) have been removed from the list of hooks usable by sleepable BPF programs. The bpf_lsm_task_to_inode() hook is called under rcu_read_lock(), and bpf_lsm_inet_conn_established() is called from softirq context, making them unsafe for sleepable programs.

In the Linux kernel, a vulnerability in the BPF subsystem was found where the return value of visit_tailcall_insn() is not checked. This could lead to undefined behavior.