Linux kernel vulnerabilities

In the Linux kernel drm/gpusvm driver, an unbalanced unlock of the notifier lock was found in drm_gpusvm_scan_mm(). The first jump to the err_free label occurs before calling drm_gpusvm_notifier_lock(), causing an attempt to release a lock that was not acquired.

In the Linux kernel PCI driver for MediaTek Gen3, an IRQ domain leak was detected. IRQ domains are allocated before fetching the controller IRQ, and if the fetch fails, the function returns an error without freeing the already allocated domains.

In the SPI driver for MediaTek chips (mtk-snfi), the ECC engine was not unregistered during probe failure unwind and device removal. A devm cleanup action was added to ensure nand_ecc_unregister_on_host_hw_engine() is called correctly in both cases.

In the Linux kernel, a vulnerability in the RDMA/core subsystem was found related to NLA_STRING attributes that do not check for a null terminator. This can lead to incorrect string comparison and potential security issues.

In the Linux kernel, the airoha network driver was missing DMA TX descriptor reset in airoha_qdma_cleanup_tx_queue(). The fix adds the missing operations, similar to airoha_qdma_cleanup_rx_queue(), and resets TX_DMA_IDX to TX_CPU_IDX to notify the NIC that the QDMA TX ring is empty.

A vulnerability was found in the Linux kernel's netfilter nf_tables subsystem, related to incorrect hook deletion during device removal. The previous approach moving hooks from the base list to the transaction list caused read issues on the RCU-protected list in the netlink dump path. The patch restores the NFT_HOOK_REMOVE flag and introduces a new transaction object to track hook deletions without altering the hook_list during the preparation phase.

In the Linux kernel, a vulnerability was found in the AMDGPU driver for VCN v2.0 hardware. The encoder and decoder rings do not support 64-bit user fence writes, causing CS submissions with user fences to be rejected.

In the Linux kernel, the drm/amdgpu driver for VCN v2.5 lacked the no_user_fence flag for encoder and decoder rings. This caused CS submissions with user fences to be rejected, as these rings do not support 64-bit user fence writes.

In the Linux kernel, a vulnerability in the amdgpu driver for VCN v3.0 encoder and decoder rings was found where 64-bit user fence writes are not supported, causing CS submissions with user fences to be rejected. This can lead to malfunction or potential exploitation.

In the Linux kernel, a vulnerability was found in the AMDGPU driver for VCN v4.0. The encoder and decoder rings do not support 64-bit user fence writes, which may cause CS submissions with user fences to be rejected.

In the Linux kernel, in the AMDGPU graphics driver for VCN v4.0.3, a vulnerability was found where the VCN encoder and decoder rings do not support 64-bit user fence writes, causing CS submissions with user fences to be rejected.

In the Linux kernel, a vulnerability was found in the AMDGPU driver for VCN v4.0.5 hardware. The VCN encoder and decoder rings do not support 64-bit user fence writes, causing CS submissions with user fences to be rejected.

In the Linux kernel, the amdgpu driver for VCN v5.0.0 did not set the no_user_fence flag for encoder rings. This caused CS submissions with user fences to be accepted even though the hardware does not support 64-bit user fence writes.

In the Linux kernel, a vulnerability was found in the AMDGPU driver for VCN v5.0.1 hardware. The VCN encoder and decoder rings do not support 64-bit user fence writes, causing CS submissions with user fences to be rejected.

In the Linux kernel, a vulnerability was found in the AMDGPU graphics driver for JPEG v2.0 rings. The lack of support for 64-bit user fence writes on JPEG rings causes CS submissions with user fences to be rejected.

In the Linux kernel, the amdgpu driver for JPEG v2.5 rings lacks support for 64-bit user fence writes, causing CS submissions with user fences to be rejected.

In the Linux kernel, a vulnerability was found in the AMDGPU driver for JPEG v3.0 decoder. JPEG rings do not support 64-bit user fence writes, which may cause CS submissions with such fences to be rejected.

A vulnerability was found in the Linux kernel's AMDGPU driver for JPEG v4.0 rings. JPEG rings do not support 64-bit user fence writes, causing CS submissions with user fences to be rejected.

A vulnerability was found in the Linux kernel's AMDGPU driver for JPEG v4.0.3 rings. JPEG rings do not support 64-bit user fence writes, causing CS submissions with user fences to be rejected.

In the Linux kernel, a vulnerability was found in the AMDGPU driver for JPEG v4.0.5 rings. JPEG rings do not support 64-bit user fence writes, which may cause CS submissions with user fences to be rejected.

In the Linux kernel, a vulnerability was found in the AMDGPU driver for JPEG v5.0.0 rings. JPEG rings do not support 64-bit user fence writes, causing CS submissions with user fences to be rejected.

A vulnerability was found in the Linux kernel's AMDGPU driver for JPEG v5.0.1 hardware. JPEG rings do not support 64-bit user fence writes, causing CS submissions with user fences to be rejected.

A vulnerability was found in the Linux kernel's AMDGPU driver for JPEG v5.3.0 rings. JPEG rings do not support 64-bit user fence writes, causing CS submissions with user fences to be rejected.

A memory leak was discovered in the Linux kernel in the lwmi_dev_evaluate_int() function of the lenovo-wmi-helpers driver. The leak occurs when retval is NULL because output.pointer is not assigned to ret_obj, preventing its automatic release.

In the Linux kernel, a vulnerability was found in the ASoC rsnd audio driver where the component_dais[] array may be accessed out of bounds. Insufficient boundary checking can lead to reading non-zero memory beyond the array.

In the Linux kernel, the ena network driver (Amazon Elastic Network Adapter) sets the output timestamp without checking the return code of ena_com_phc_get_timestamp(). On error, uninitialized stack memory or invalid hardware values may be leaked to userspace via PTP ioctl.

In the Linux kernel, the batman-adv tp_meter module has a divide-by-zero vulnerability in batadv_tp_update_cwnd() due to 32-bit arithmetic overflow when cwnd reaches 0x20000000, causing a division by zero.

In the Linux kernel, a vulnerability in the batman-adv module causes a memory leak (skb leak) when a network interface is disabled. The batadv_v_ogm_iface_disable() function frees the aggregation list but does not prevent new packets from being queued by batadv_v_ogm_send_meshif(), leading to unreleased memory.

In the Linux kernel, the batman-adv tp_meter module has an unbounded unacked_list, allowing an attacker to send small packets with crafted sequence numbers and gaps, forcing the receiver to allocate excessive list entries, leading to out-of-memory or high CPU overhead.

In the Linux kernel, the NTFS3 filesystem allows unprivileged users to write to reserved $LX* extended attributes (UID, GID, MOD, DEV). An attacker can set root ownership and SUID flag on their file, leading to privilege escalation to euid 0 after inode reload.

In the Linux kernel, the mt76 driver lacks a check whether the WCID (Wireless Client ID) has already been published before reinitializing the poll_list. This causes corruption of the dev->sta_poll_list structure, potentially leading to system crashes.

In the Linux kernel's mac802154 subsystem, a vulnerability was found due to missing skb_cow_data() calls before in-place cryptographic operations. LLSEC encrypt/decrypt functions modify shared skb data buffers, leading to data corruption, use-after-free, and kernel crashes under concurrent 802.15.4 traffic with security enabled.

Vulnerability in the Linux kernel ip_gre driver allows a user with CAP_NET_ADMIN in one network namespace to modify a GRE tunnel in another namespace where they lack privileges. Missing CAP_NET_ADMIN check in the target namespace.

Vulnerability in the Linux kernel AppArmor module allows bypassing connect mediation by using MSG_FASTOPEN flag in sendmsg(). A profile allowing send but blocking connect can be bypassed.

A use-after-free vulnerability was found in the rawdata deduplication loop of the AppArmor module in the Linux kernel. The issue occurs when an entry on the rawdata_list has a zero reference count and aa_get_profile_loaddata() performs an unsafe kref_get(), leading to a reference to freed memory.

A use-after-free vulnerability was found in the store_modes() function of the fbdev driver in the Linux kernel. After replacing the framebuffer's modelist, pointers fb_display[i].mode and fb_info->mode still reference the freed list, causing a read-after-free.

In the Linux kernel, a vulnerability in keyctl_pkey_params_get_2() was found where incorrect output buffer length calculation can cause overflow when a too small buffer is provided. The fix allocates internal output with the size of the maximum cryptographic primitive length.

A use-after-free vulnerability was found in the Linux kernel's key management subsystem. A race condition between request_key() and KEYCTL_INSTANTIATE_IOV can cause use of freed request_key_auth payload memory.

In the Linux kernel's ath11k Wi-Fi driver, a double-free vulnerability occurs in dp->tx_ring[i].tx_status buffers during device unbinding. The issue arises when firmware initialization fails, causing the buffers to be freed again upon unbind, triggering a warning in the memory allocator.

In the rtw88 driver for Realtek WiFi chips in the Linux kernel, memory leaks occur on USB write failures. When rtw_usb_write_port() fails to submit a URB, the functions rtw_usb_write_data() and rtw_usb_tx_agg_skb() do not properly free socket buffers (skbs) or transaction control blocks (txcb), leading to memory leaks.

In the Linux kernel, a bug in the F2FS filesystem's f2fs_read_data_large_folio() function can cause a read bio to remain unsubmitted when a later folio encounters an error. This leaves earlier folios waiting indefinitely for read completion, potentially causing system hangs.

In the Linux kernel F2FS filesystem, a vulnerability was found due to missing sanity checks in f2fs_get_node_folio_ra(). This can trigger a kernel BUG_ON during file truncation when a corrupted node has mismatched inode and nid in its footer.

In the Linux kernel's F2FS filesystem, the orphan inode recovery function trusts the entry_count from the checkpoint block. A corrupted value larger than F2FS_ORPHANS_PER_BLOCK causes an out-of-bounds read and interprets subsequent data as inode numbers, leading to a kernel panic.

In the Linux kernel's F2FS filesystem, is_meta_ino() unconditionally treats F2FS_COMPRESS_INO() as a meta inode even when compress_cache is disabled. This allows creating a fake internal inode with an out-of-range number, bypassing normal validation.

Vulnerability in the Linux kernel F2FS filesystem leads to a use-after-free (UAF) of f2fs_inode_info.atomic_inode during garbage collection. Missing reference counting can result in accessing freed memory.

In the Linux kernel's F2FS filesystem, a vulnerability was found due to missing validation of i_inline_xattr_size for inodes without the FI_INLINE_XATTR flag. An attacker can exploit a crafted filesystem image to set this value arbitrarily, leading to an out-of-bounds read when processing inline directories.

In the Linux kernel F2FS filesystem, a vulnerability was found due to missing validation of ACL entry sizes in f2fs_acl_from_disk(). A malformed ACL can cause an out-of-bounds read, confirmed by a KASAN report.

The Linux kernel reverts commit 9609dd704725 that removed non-uptodate folios from the page cache in move_data_block. The revert fixes kernel panics reported on nearly full f2fs partitions, caused by a race condition that corrupts the LRU list and frees pages with active LRU links.

In the Linux kernel's F2FS filesystem, a vulnerability was found in the __destroy_extent_node() function where setting the FI_NO_EXTENT flag does not reset the largest extent length to zero or update the inode folio, causing stale cached data and triggering a sanity check error.

In the Linux kernel's F2FS filesystem, a vulnerability was found in reading COW data during atomic writes. The bug uses the wrong inode (COW instead of original) for read operations, causing a NULL pointer dereference in fscrypt_decrypt_pagecache_blocks and a system crash.