Linux kernel vulnerabilities

In the Linux kernel, ufs_saved_err_write() copies user input into a zero-initialized stack buffer and passes it to kstrtoint(). A write that fills the entire buffer overwrites its only terminator.

In the Linux kernel, kmb_ocs_aes_probe() requests the device IRQ before initializing irq_completion. Once the handler is registered it can run immediately, and ocs_aes_irq_handler() unconditionally calls complete(), using an uninitialized completion.

In the Linux kernel, set_user_buf_size() in the RDMA/mlx5 driver computes the QP buffer size by left-shifting user-supplied rq.wqe_cnt and rq.wqe_shift values as signed integers. A sufficiently large rq.wqe_cnt causes signed integer overflow, yielding a small or negative buf_size, causing ib_umem_get() to map a buffer smaller than the hardware will actually write into.

In the Linux kernel, the zisofs_fill_pages() function (isofs filesystem) left the last block pointer buffer_head referenced on the success path. This causes a buffer reference leak when reading the zisofs compressed block pointer table.

In the Linux kernel, the SPI oc-tiny driver allocated the controller with the non-managed spi_alloc_host() while registering the interrupt with devm_request_irq(). During removal the controller was freed before free_irq() ran, allowing a late or latched interrupt to dereference freed memory (use-after-free).

In the Linux kernel, the sched_ext scheduler's scx_hardlockup() deferred the abort via irq_work, which does not work in NMI context and prevented recovery from self-detected hardlockups. It also returned true even when the abort was refused, suppressing the kernel's hardlockup report.

In the Linux kernel, the remoteproc subsystem lacked synchronization between rproc_crash_handler_work() and rproc_del(), allowing a driver to be removed while crash-handler work was scheduled or executing, leading to use-after-free. A "deleting" flag and cancellation/synchronization of the work before removal were introduced.

In the Linux kernel, the iommu/tegra241-cmdqv driver's tegra241_vintf_init_lvcmdq() published the vcmdq pointer into vintf->lvcmdqs[] before tegra241_vcmdq_alloc_smmu_cmdq() initialized vcmdq->cmdq. A latched LVCMDQ error in that window caused a zeroed arm_smmu_cmdq to be passed to __arm_smmu_cmdq_skip_err(), dereferencing NULL pointers.

In the Linux kernel, the iommu/tegra241-cmdqv component has a synchronization flaw between the error interrupt handler (ISR) and VINTF initialization/deinitialization. Missing memory ordering and synchronization can lead to a NULL pointer dereference or use-after-free during a concurrent error. The vulnerability is fixed by using smp_store_release/smp_load_acquire barriers and synchronize_irq().

In the Linux kernel, the iommu/tegra241-cmdqv driver's __tegra241_cmdqv_probe() requested the error IRQ before allocating the cmdqv->vintfs array and setting cmdqv->num_vintfs. A latched CMDQV error inherited across a kexec caused the ISR to walk an uninitialized array.

In the Linux kernel, the iommu/tegra241-cmdqv driver's __tegra241_cmdqv_probe() used devm_krealloc() to grow @smmu, which freed the original pointer upon relocation. A failure after that returned NULL, and the caller dereferenced the freed @smmu on its fallback path.

In the Linux kernel, the iommu/tegra241-cmdqv driver's tegra241_cmdqv_remove() tore down each VINTF first and only then called free_irq(). An error in that window caused the ISR to read a stale slot and dereference a NULL or freed pointer.

In the Linux kernel, the iommu/tegra241-cmdqv driver's tegra241_vintf_init_vsid() mapped a guest vSID to a single physical Stream ID from master->streams[0], only warning when the device did not have exactly one stream. A device with several streams had only its first mapped, and a device with none made master->streams a ZERO_SIZE_PTR, causing an out-of-bounds read.

In the Linux kernel, the iommu/tegra241-cmdqv driver leaks VINTF0 on the init-failure path. When tegra241_cmdqv_init_vintf() fails or a later VCMDQ preallocation fails, VINTF0 is not properly freed because the ownership decision relies on an incorrectly read hardware state.

In the Linux kernel, the RDMA/rxe module has a use-after-free (UAF) in the ODP init error-handling path. When rxe_odp_init_pages() fails, mr->umem is not reset to NULL, causing a later ib_umem_release() call to read already-freed fields.

In the Linux kernel, the clk: mediatek: pllfh driver leaks IO-mapped memory on the PLL registration error path. The mtk_clk_register_pllfhs function does not free the IO memory mapped on the fhctl node when PLL registration fails.

In the Linux kernel, the PCI subsystem has a use-after-free (UAF) when a probe runs concurrently with dynamic ID removal. The pointer to a dynamic ID can be freed by remove_id_store() while pci_match_device() still uses it.

In the Linux kernel, the nilfs2 filesystem has an infinite loop in nilfs_clean_segments(). When nilfs_segctor_construct() repeatedly returns -EROFS (e.g., after an I/O error and remounting the device read-only), the cleaner thread loops forever.

In the Linux kernel, the nilfs2 filesystem has an out-of-bounds read when parsing the super-root block. The super-root inode metadata size is trusted before nilfs_read_inode_common() is called, allowing a malformed filesystem image to read past the super-root block.

In the Linux kernel, the nilfs2 filesystem has a BUG in nilfs_copy_dirty_pages() triggered by a dirty state mismatch. When a dirty page unexpectedly loses its dirty status after the filesystem transitions to read-only mode, the kernel triggers a BUG.

In the Linux kernel, the RDMA/cxgb4 module has an skb leak and double free in write_tpt_entry(). When the device is in a fatal error state, write_tpt_entry() returns an error before handing off the skb, leading to a leak in c4iw_dereg_mr() or a double free in c4iw_get_dma_mr().

In the Linux kernel, the RDMA/mlx5 module has a stack out-of-bounds read in the cc_params debugfs. The get_param() function formats a u32 value as a signed number into an 11-byte buffer, causing a one-byte read past the buffer for values like 0x80000000.

In the Linux kernel, the RDMA/cxgb4 module leaks a STAG index when a TPT entry write fails. The write_tpt_entry() function allocates a STAG index but on write_adapter_mem() failure does not release it or reverse the statistics, leading to a leak until device teardown.

In the Linux kernel, cros_ec_debugfs_probe() registers notifier_panic with the EC panic notifier chain, but the remove path does not unregister it. A later panic notification can call back into the removed instance and queue work that accesses released data.

In the Linux kernel, the last error path in rtl_pci_probe() skips cleanup functions due to a wrong goto label. Additionally, successful calls to rtl_init_rfkill(), ieee80211_register_hw(), and rtl_debug_add_one() are not reverted.

In the Linux kernel, mhi_register_controller() adds the controller device before creating the optional trigger_edl sysfs file. If sysfs_create_file() fails, the error path only drops the device reference and leaves the device registered.

In the Linux kernel, REQ_NOWAIT support in md personalities that can block internally is fundamentally incomplete. For writes, one mirror may succeed while another returns -EAGAIN, so md cannot distinguish queue pressure from a real device failure, potentially leaving mirrors with divergent data.

In the Linux kernel's md (RAID) subsystem, a race condition exists between the raid10d thread and normal I/O operations. Spare device configuration changes can occur without suspending the array, leading to a NULL pointer dereference and kernel crash.

In the Linux kernel, ath12k_wmi_mac_phy_caps_parse() allocates the mac_phy_caps buffer as tot_phy_id * len, where len is clamped, but memcpy() advances the destination by the full struct size per slot. When firmware sends short TLVs, the second and later slots are written past the end of the allocation.

In the Linux kernel, ath11k_wmi_tlv_mac_phy_caps_parse() allocates the mac_phy_caps buffer as tot_phy_id * len, where len is clamped, but memcpy() advances the destination by the full struct size per slot. When firmware sends short TLVs, the second and later slots are written past the end of the allocation.

In the Linux kernel, qcom_scm_probe() calls devm_request_threaded_irq() before smp_store_release(&__scm, scm). Two paths can dereference __scm before it is published, both causing a NULL pointer dereference.

In the Linux kernel, a failed integrity mapping holds a dio reference, causing a leak. The full bio ending must be performed in case there were previously submitted bios in the sequence.

In the Linux kernel, the USB notifier and initial VBUS detection can schedule isp->work in the isp1704_charger driver. The remove path unregisters the notifier and power supply but does not wait for queued or running work before tearing down the power supply state.

In the Linux kernel, the sc2731_charger power supply driver does not cancel scheduled work on device removal. The USB notifier and initial charger detection can schedule info->work, but the remove path unregisters the notifier without cancelling queued or running work before the devm-allocated driver data is released. The issue was found by a static analysis tool.

In the Linux kernel, bpf_netns_link_update_prog performs checks for old_prog and prog type locklessly before acquiring netns_bpf_mutex. This creates a race condition that can lead to a use-after-free (UAF) when two threads concurrently execute BPF_LINK_UPDATE on the same netns link. The fix moves the checks inside the netns_bpf_mutex critical section.

In the Linux kernel, bpf_link_show_fdinfo and bpf_link_get_info_by_fd access link->prog without holding any locks. If the prog is concurrently replaced via bpf_link_update, the old prog can be freed, leading to a potential use-after-free (UAF). The fix accesses link->prog under RCU protection.

In the Linux kernel, lib/test_hmm's dmirror_fault() returns 0 when mmget_not_zero() fails, even though no page was faulted and no device page table entry was installed. This causes the caller to retry the same address, hit -ENOENT again, and loop forever. The fix returns -EFAULT instead.

In the Linux kernel, md/bitmap's backlog_store() suspends the array before checking whether a write-mostly device exists. If no such device exists, the error path only unlocks reconfig_mutex and leaves the array suspended, blocking subsequent I/O. The fix uses mddev_unlock_and_resume().

In the Linux kernel, the md subsystem stores a memalloc_noio_save() token in mddev->noio_flags, allowing one task to save the token and another to restore it. With concurrent suspend sysfs writes, task A can enter PF_MEMALLOC_NOIO and return to userspace still in that scope, and task B can later restore A's saved token. The fix scopes PF_MEMALLOC_NOIO to allocation critical sections only.

In the Linux kernel, the iommu/dma non-blocking, non-coherent allocation path uses dma_alloc_from_pool(), which returns the allocated page and fills cpu_addr only on success. The code relies on cpu_addr to detect allocation failure, which is incorrect. The fix checks the returned page directly before using it for IOMMU mapping.

In the Linux kernel, swiotlb_alloc_tlb() can allocate from the DMA atomic pool when a decrypted pool is needed from atomic context. With CONFIG_DMA_DIRECT_REMAP, the atomic pool uses remapped virtual addresses that differ from direct-map addresses. swiotlb_init_io_tlb_pool() reconstructs the virtual address from the physical address, storing the wrong address in pool->vaddr for atomic-pool allocations, causing swiotlb_free_tlb() to fail.

In the Linux kernel, the i3c dw driver on an empty bus has ENTDAA assign nothing, so cmd->rx_len equals master->maxdevs. The GENMASK() index master->maxdevs - cmd->rx_len - 1 becomes -1, causing a shift-out-of-bounds and tripping UBSAN. This occurs on every boot on a Gigabyte/AMD server.

In the Linux kernel, md/raid1 skips creating rdev->serial when a new rdev is added to an existing RAID1 array with serialize_policy enabled, due to a condition in mddev_create_serial_pool(). wait_for_serialization() assumes rdev->serial is initialized, leading to an Oops on access to the uninitialized structure. The fix creates the serial pool when adding the rdev.

In the Linux kernel, the iomap mechanism fails to release the folio batch during zero-range operations when errors occur in the iomap_begin and iomap_end callbacks. The fix ensures cleanup is invoked on error paths and updates the helper's behavior.

In the Linux kernel, the sgi-gru driver removes dangerous page-table walks performed in interrupt context. The GRU TLB miss handler previously walked page tables without proper locking, potentially leading to races and security issues.

In the Linux kernel, the mt76x02 driver removes a WARN_ON_ONCE for rx descriptors with invalid lengths. In monitor mode with fcsfail filter, corrupted frames could trigger a kernel panic if panic_on_warn is set.

In the Linux kernel, the mt76 driver fixes handling of channel context switches with different bands in mt76_switch_vif_chanctx. Previously, rapid switches on different radios could cause incorrect behavior.

In the Linux kernel, the mt792x driver has a use-after-free vulnerability in mt76_rx_poll_complete due to a race condition. The wcid pointer may reference an already removed STA, causing invalid memory access.

In the SDIO TX path of the mt76 driver, a memory leak occurs. When tx_prepare_skb() returns an error, the skb buffer is not freed, potentially leading to memory exhaustion. This happens when zero-length frames (e.g., WNM NULL frames) are dropped to prevent hardware hangs.

In the RX data handling of RRO 3.0 in the mt76 driver, there is incorrect queuing. Frames released from the RRO data queue should be placed in the indicator queue, but they are put into the data queue, causing delays and reordering of received packets.