Linux kernel vulnerabilities

In the Linux kernel, the bdev pseudo-filesystem registration was removed to prevent userspace mounting. The vulnerability caused a NULL pointer dereference when accessing files via move_mount() due to empty inode_operations structures.

In the Linux kernel, a bug was found in __cgroup_bpf_run_filter_sysctl() where a temporary buffer allocated by kvzalloc() was freed using kfree() instead of kvfree(). This can cause memory corruption on large allocations.

In the Linux kernel's KVM subsystem for x86, a vulnerability was found where the base GFN of a shadow page is not verified to be within the target memslot before querying the maximum mapping level. This can cause an out-of-bounds read in the lpage_info structure, resulting in a host page fault and potential system instability.

In the Linux kernel KVM component, a vulnerability allows a guest to trigger a kernel panic (BUG_ON) when writing to an ioeventfd with datamatch enabled. The issue occurs when a guest write crosses a page boundary and the second page contains a datamatch-enabled ioeventfd – an unaligned pointer dereference triggers the BUG_ON.

A bug in the Linux kernel's NX crypto driver (nx_crypto_ctx_exit) caused an incorrect argument type to be used. The nx_crypto_ctx_shash_exit function passed a context pointer (nx_crypto_ctx *) instead of a crypto_tfm * pointer, leading to a memory access violation and system crash (oops).

A use-after-free vulnerability was found in the Linux kernel's GFS2 filesystem in the gfs2_qd_dealloc function. During unmount, an RCU callback may access a freed superblock object, leading to potential security issues.

A use-after-free vulnerability was found in the Linux kernel's hdlc_ppp driver. PPP protocol timers (LCP/IPCP/IPV6CP) were not synchronized before freeing the HDLC state structure, allowing code execution in freed memory.

A use-after-free vulnerability was found in the Linux kernel's __blkcg_rstat_flush() function in the blk-cgroup subsystem. It occurs when multiple blkgs in the same blkcg are released concurrently, causing a race condition and access to freed memory.

In the Linux kernel, a use-after-free vulnerability exists in the TIPC module's tipc_aead_decrypt_done function. Missing netns reference protection before asynchronous decryption can lead to reading freed memory after network namespace teardown.

A vulnerability in the Linux kernel's CID (Concurrency ID) mechanism in the scheduler causes an out-of-bounds (OOB) clear_bit operation when CID is MM_CID_UNSET, leading to kernel memory corruption.

In the Linux kernel irqchip/imgpdc driver, a resource leak and missing chained handler cleanup on driver removal were found. Generic chips allocated during probe are not freed and chained handlers are not removed, potentially causing use-after-free and kernel crash.

Vulnerability in the rpmsg_char driver in the Linux kernel causes a use-after-free during error handling in rpmsg_chrdev_probe(). Incorrect initialization order may lead to a callback with a stale pointer.

In the Linux kernel OCFS2 filesystem, a vulnerability was found due to missing validation of the physical bitmap size in group block descriptors. A malicious descriptor can claim a bitmap size exceeding the available block space, leading to an out-of-bounds read (use-after-free) during bitmap scanning.

In the Linux kernel, a vulnerability was found in the sev_dbg_crypt() function in KVM for AMD SVM, where during encryption (ENCRYPT path) the transfer length is not bounded by the destination page offset (d_off). When d_off > s_off, the intermediate buffer (dst_tpage) of 4096 bytes can be written out of bounds, leading to page overflow and potential memory corruption.

A vulnerability was found in the Linux kernel's NTFS filesystem due to missing synchronization of volume label accesses. A race condition between setting and reading the label can lead to a use-after-free condition.

In the Linux kernel fbdev subsystem, fb_new_modelist() fails to ensure the current display mode (info->var) remains in the modelist after a user-space mode list change. This causes a null-ptr-deref in fb_videomode_to_var() during a later console takeover.

In the Linux kernel's fbdev/fbcon driver, the fbcon_do_set_font() function on error (e.g., memory allocation) fails to restore hi_font_mask and screen buffer. This causes terminal desynchronization and an out-of-bounds read of the font array, potentially disclosing kernel memory.

A use-after-free vulnerability was found in the Linux kernel's fbdev omap2 driver. The omapfb_mmap() function has a race condition with the OMAPFB_SETUP_PLANE ioctl, allowing concurrent memory mapping and freeing, leading to use-after-free.

In the Linux kernel's I2C subsystem, there is a race condition during adapter registration. The adapter can be looked up via i2c_get_adapter() before its struct device is fully initialized, leading to access to uninitialized data and potential NULL-pointer dereference or use-after-free.

A memory leak was discovered in the Linux kernel's NFS server (nfsd) during SETACL decode failure handling. The decoder calls nfs_stream_decode_acl() twice for access and default ACLs, but if the second call fails, the first allocated posix_acl is not freed. The fix adds dedicated release functions (nfsaclsvc_release_setacl and nfs3svc_release_setacl) that properly clean both ACL fields.

In the Linux kernel, the nfsd4_create_file() function in the NFSD server has two vulnerabilities: a posix_acl memory leak and ignored errors during NFSv4-to-POSIX ACL conversion. These bugs can cause memory exhaustion and violate RFC 7530/8881.

In the Linux kernel NFSD subsystem, a dead ACL conflict guard in nfsd4_create() checked nulled pointers instead of stolen values, causing memory leak of posix_acl objects when both ACL and POSIX ACL attributes are requested in the same CREATE operation.

In the Linux kernel NFSD module, a memory leak was found related to pre-allocated openowner structures. The issue occurs in find_or_alloc_open_stateowner() during a race condition with unconfirmed open owners in NFSv4.0.

In the Linux kernel's NFS server (nfsd), the write verifier is not rotated after detecting a deferred writeback error. This causes the NFS client to receive an unchanged verifier and incorrectly assume data is durable, leading to silent data loss.

In the Linux kernel, the NFSv4/flexfiles driver lacks validation for a zero filehandle version count. An attacker can supply a malformed flexfiles layout, causing a NULL pointer dereference and kernel panic.

A vulnerability in the Linux kernel's nfs4_decode_mp_ds_addr() function in NFSv4/pNFS fails to properly handle zero-length r_addr fields in GETDEVICEINFO responses, leading to a NULL pointer dereference and kernel panic. An attacker can exploit this via a malicious or compromised metadata server.

In the Linux kernel's ksmbd filesystem, an out-of-bounds read vulnerability was found in smb_check_perm_dacl(). Missing ACE size validation before reading SID sub-authorities allows an authenticated client on a share using ACL xattrs to trigger a heap out-of-bounds read past the allocated buffer.

A use-after-free vulnerability was found in the Linux kernel's TCP-AO implementation. In the del_async path of key deletion, the current_key and rnext_key pointers are not cleared, causing a reference to freed memory after the RCU grace period.

In the Linux kernel FUSE subsystem, a vulnerability was found due to missing re-locking of the request after successful fuse_try_move_folio(). This can lead to a use-after-free issue when accessing the fuse_io_args structure.

In the Linux kernel VEML6075 light sensor driver, a missing bounds check on the `veml6075_it_ms` array index could cause an out-of-bounds access. The index from the configuration register can be 0-7 but the array has only 5 elements. A validation was added returning -EINVAL for invalid values.

In the Linux kernel, the ti-ads1298 ADC driver lacked bounds checking for the pga_settings array index. The ADS1298_MASK_CH_PGA mask can yield values 0-7, but the array has only 7 elements (indices 0-6). Value 7 causes an out-of-bounds read. A bounds check was added, returning -EINVAL for invalid indices.

A null-ptr-deref bug was found in the Linux kernel's vcs_notifier() due to a race condition in vcs_write(). When the console lock is temporarily dropped, the vc_data pointer may become stale; after re-acquiring the lock and detecting NULL, calling vcs_scr_updated() causes a null pointer dereference.

In the Linux kernel, ksmbd module fails to validate session state in compound requests. An invalid IN_PROGRESS session can be used to trigger a remote NULL pointer dereference, causing a kernel Oops and crashing the SMB server.

In the Linux kernel, a vulnerability in the vidtv driver causes a NULL pointer dereference in vidtv_mux_push_si due to missing NULL check on vidtv_mux_get_pid_ctx() return value, leading to a general protection fault. The root cause is insufficient error handling in vidtv_mux_pid_ctx_init() for PMT section PIDs.

A use-after-free (UAF) vulnerability was found in the Linux kernel's virtiofs when unmounting submounts. The issue occurs when iput() called from fuse_release_end() accesses a superblock that has already been destroyed.

In the Linux kernel, the rzv2h-ivc driver had a race condition where `list_del()` was called without holding the spinlock, allowing concurrent modification of the buffer list. This could lead to undefined behavior.

In the Linux kernel, the OV8856 camera driver has a vulnerability where the control handler is not freed if adding controls fails in the ov8856_init_controls() function.

A vulnerability in the Linux kernel's DRM driver was found due to improper blob property reference tracking in the colorop state lifecycle. This caused memory leaks during state duplication, destruction, and reset operations because blob references were not released before freeing memory.

In the Linux kernel DRM driver for MSM (Qualcomm Adreno), a bug was fixed where the GPU recovery mechanism would not trigger if there were no pending jobs. This left the GPU in a hung state, leading to repeated timeouts.

In the Linux kernel, the drm/amdkfd driver lacked an upper bound check for num_of_nodes in kfd_ioctl_get_process_apertures_new. This could lead to an out-of-bounds memory read.

In the Linux kernel, in the DRM driver for AMD GPUs (amdgpu) within the VCE component, a vulnerability was found due to incomplete address patching. When only one part (low or high) of the address is valid, patching may result in writing a bad address to the firmware.

In the Linux kernel, the amdgpu driver has a vulnerability where the GART table is not zero-initialized upon allocation. After writing a single PTE entry, the TLB may speculatively load uninitialized, potentially valid-looking data from the same cache line, which can lead to the GPU using stale PTE entries.

In the Linux kernel, a vulnerability was found in the mmap_prepare mechanism where attempting to unmap a VMA during error handling in the mmap() function can cause warnings and an invalid state. The issue occurs when mmap_prepare is invoked from the mmap() hook of 'stacked' drivers (e.g., overlayfs, shm) because the VMA is not fully established in the maple tree.

In the Linux kernel, a vulnerability in the iommu/vt-d driver causes loss of dirty tracking when attaching PASID to a nested domain. The kernel lacks dirty tracking support for such configurations, potentially losing information about modified memory pages.

In the Linux kernel, the RDMA/ionic driver has a vulnerability where hca_type_show() uses unbounded "%s" to display node_desc, which may not be NUL-terminated, causing an out-of-bounds read into adjacent fields of struct ib_device.

In the Linux kernel, the perf/x86/intel subsystem had incomplete validation and configuration of ACR (Adaptive Cache Replacement) masks. Issues included missing checks for indices belonging to other event groups, premature iteration exit on invalid masks, and failure to clear stale hardware masks before setting new ones.

In the Linux kernel, a vulnerability in the UDF filesystem allows udf_read_tagged() to skip CRC verification when the CRC length exceeds the block size. A crafted UDF image can set an oversized CRC length to bypass validation entirely, accepting the descriptor based solely on a weak 8-bit tag checksum.

In the Linux kernel, an inconsistency in the F2FS filesystem was found during fsck due to incorrect use of flags in NAT entries. The issue stems from a lack of mutual exclusion when reading flags by f2fs_need_dentry_mark() relative to the checkpoint path, leading to incorrect inode block marking.

In the Linux kernel, the SELinux module had a bug in the avdcache auditing mechanism. It incorrectly saved and reused the audit vector instead of recomputing it based on current permissions, causing some access checks (e.g., directory write after a cached search check) to be missed.

In the Linux kernel, in __ip_append_data() for IPv4, there is an error in alloclen and pagedlen calculations on the paged allocation path, leading to undersized linear area and oversized pagedlen. This may cause packet handling errors.