Linux kernel vulnerabilities

In the Linux kernel, blk-cgroup has a race between policy activation and blkg destruction. When switching an IO scheduler, blkcg_activate_policy() may race with concurrent blkcg deletion, leading to use-after-free and memory leak issues. Additionally, blkg_free_workfn() frees pd before removing the blkg from q->blkg_list, allowing allocation of a new pd for a blkg being destroyed.

In the Linux kernel, blk-cgroup's blkcg_activate_policy() can race with concurrent blkcg deletion when switching IO schedulers, leading to a use-after-free in rcu_accelerate_cbs. The issue occurs when a blkg is being destroyed while blkcg_activate_policy() tries to get a reference to it.

In the Linux kernel, the ublk module's import_ubuf() can fail if the address range provided by the userspace ublk server is outside the allowed user address space. In that case, an uninitialized struct iov_iter is passed to ublk_copy_user_pages().

In the Linux kernel, the ublk module with UBLK_F_AUTO_BUF_REG can fail on invalid sqe->addr after ublk_fill_io_cmd() has set UBLK_IO_FLAG_ACTIVE. The uring_cmd is completed while the tag stays active, which can hang teardown.

In the Linux kernel, the ocfs2/cluster module has a bug in local node state management. When local=0 clears the live local-node state but leaves cl_has_local set, o2nm_this_node() returns invalid node number 255, causing a KASAN slab-out-of-bounds in o2hb_do_disk_heartbeat().

In the Linux kernel, a vulnerability in the OCFS2 filesystem was found due to missing validation of inline extended attribute (xattr) bounds in the inode block. Corrupted metadata can lead to out-of-bounds memory access (use-after-free) during getxattr() or listxattr() calls.

In the Linux kernel, the ocfs2 filesystem's ocfs2_validate_xattr_block() checks the xattr block header but does not verify that a non-indexed block's xh_count and entry offsets fit inside the block. Indexed buckets likewise reach list/get consumers without an entry-bounds check, leading to use-after-free in ocfs2_xattr_list_entries().

In the Linux kernel, the rapidio subsystem's rio_alloc_net() stores the newly allocated rio_net in mport->net before rio_scan_alloc_net() registers the device. If rio_add_net() fails, put_device() releases the rio_net, but mport->net is left pointing at the freed object, potentially leading to double free.

In the Linux kernel, fat_rebuild_parent() uses a directory entry to rebuild the parent inode but fails to release sinfo.bh after a successful scan. This causes a buffer head leak in the nostale_ro NFS export path.

In the Linux kernel, in sleepable BPF programs a spin lock can be the only RCU protection for a kptr. After the final bpf_spin_unlock() the verifier leaves the pointer valid, allowing another CPU to free the object before use, causing a use-after-free (e.g. in __bpf_get_task_stack()).

In the Linux kernel, the drm/omap DSI driver copied the ISR table to allow unregistering interrupt handlers. Since stack-allocated objects are passed to these ISRs, there is a use-after-free risk if IRQs are unregistered while being handled.

In the Linux kernel, the legacy I/O and memory sysfs handlers did not check security_locked_down(LOCKDOWN_PCI_ACCESS). As a result, root could write arbitrary I/O ports and map legacy I/O and memory spaces even when the kernel was locked down.

In the Linux kernel, rsc_table_for_each_entry() stored a firmware-supplied u32 offset into a signed int. A crafted offset such as 0xFFFFFFF0 became -16, bypassing the availability check and allowing an out-of-bounds read of hdr->type.

In the Linux kernel, after a failed cgroup BPF program replacement (BPF_F_REPLACE in multi-attach mode), __cgroup_bpf_attach overwrote pl->storage with new storage but failed to restore the old one on the error path. The still-active prog1 holds dangling storage pointers, causing invalid access in bpf_get_local_storage.

A vulnerability was found in the Linux kernel's BPF verifier. When handling load-acquire operations where source and destination registers are the same, the verifier does not properly check the pointer type, allowing access to unconverted kernel objects, potentially leading to data leaks or type confusion.

A vulnerability was found in the Linux kernel thermal/hwmon subsystem. The issue is that a hwmon class device is registered only for the first thermal zone of a given type, and sysfs attributes from other zones are attached to it. Removing the thermal zone that holds the hwmon device can block the removal process due to attributes belonging to other zones.

In the Linux kernel, the RDMA/erdma driver's EQ handlers look up CQs from dev->cq_xa and invoke callbacks outside the xarray lock. erdma_destroy_cq() can erase the CQ and free its queue buffer and doorbell record while a previously scheduled EQ handler is still using it, causing a use-after-free.

A use-after-free vulnerability exists in the Linux kernel RDMA/erdma driver. The AE QP fatal event and iWARP CM paths load QP pointers from dev->qp_xa and use them outside the xarray lock, so erdma_destroy_qp() can free QP resources while such a lookup is in flight. The fix adds erdma_qp_get_by_qpn() to acquire a kref under the xarray lock and removes the QP from the xarray before dropping the destroy-path reference.

In the Linux kernel on ARM, the stub hw_breakpoint_cfi_handler() was removed so it no longer steals breakpoint type 0x03 (ARM_ENTRY_CFI_BREAKPOINT) unless CFI is actively used. When CFI is not instrumented or a breakpoint is issued from userspace, hw_breakpoint_pending() now returns 1 (unhandled fault), allowing userspace to use the breakpoint.

In the Linux kernel on ARM, PREEMPT_RT was enabled without selecting HAVE_POSIX_CPU_TIMERS_TASK_WORK, leaving CONFIG_POSIX_CPU_TIMERS_TASK_WORK disabled so CPU timers expired in hard IRQ context. On PREEMPT_RT this made run_posix_cpu_timers() take the sleeping sighand->siglock, triggering a "sleeping function called from invalid context" bug. The fix selects the option to defer POSIX CPU timer expiry to task context.

In the Linux kernel on ARM, do_DataAbort()/do_PrefetchAbort() called force_sig_fault() with interrupts disabled when the unhandled user fault hook returned non-zero. PREEMPT_RT requires interrupts enabled when sending signals, and this could be triggered by user programs executing the bkpt instruction with CONFIG_PERF_EVENTS=n. The fix enables interrupts in these paths.

In the Linux kernel on ARM, with CONFIG_DEBUG_USER=y and cmdline "user_debug=31", a user fault may trigger show_pte() without any lock. A concurrent munmap() in the same process can free page table pages while show_pte() traverses them, causing use-after-free, and with CONFIG_ARM_LPAE=y even a kernel panic. The fix acquires mmap_write_lock() around show_pte() for user faults and restricts it to user-space addresses (addr < TASK_SIZE).

In the Linux kernel, a race condition in the OCFS2 filesystem during o2net teardown was found. Heartbeat callbacks may remain registered while the teardown destroys the o2net_wq workqueue, leading to a use-after-free in __queue_work(). The issue was detected by KASAN.

In the Linux kernel, the bpf_get_task_stack and bpf_get_task_stack_sleepable helpers using __bpf_get_task_stack declare buf as ARG_PTR_TO_UNINIT_MEM, which should be initialized on every return path. A missing memset on error paths left the buffer with uninitialized data. The fix adds buffer zeroing to provide deterministic contents.

In the Linux kernel, when CONFIG_FUNCTION_ERROR_INJECTION is disabled, the BPF verifier does not check whether the target symbol is a kernel function or a BPF program, so a sleepable tracing program can attach to a target whose name has an '__x64_'-like prefix. For example, a sleepable fentry program attached to a '__x64_sys_nop' XDP program and using bpf_copy_from_user() can trigger a "sleeping function called from invalid context" bug. The fix disallows sleepable programs when the target BTF is not the kernel's BTF.

In the Linux kernel, the drm/sun4i driver's of_find_device_by_node() takes a device reference for the TCON TOP device that is not dropped after mux configuration completes. This results in a device reference leak.

In the Linux kernel, the drm/sun4i driver's sun4i_crtc_init() returns plain NULL on layer initialization failure, while other error paths return an error pointer. The caller sun4i_tcon_bind() checks with IS_ERR(), so it continues with tcon->crtc set to NULL, leading to a NULL dereference in drm_crtc_mask() and an oops.

In the Linux kernel, the imx6q cpufreq driver allocates the imx6_soc_volt array via devm_kcalloc() against cpu_dev, which is never unbound, so its devres list is never released and the remove function does not free the array. Every probe adds an allocation that persists for the system lifetime.

In the Linux kernel, the imx6q cpufreq driver allocates the imx6_soc_volt array fresh on every probe, but fills it through soc_opp_count, which has static storage and is never reset. A second bind after an unbind keeps indexing from where the first stopped, writing past the end of the new array.

In the Linux kernel's IB/isert subsystem, a vulnerability exists where the final Login Response is sent before the session is registered. An initiator that issues a SCSI command immediately after receiving the response can cause it to be executed against a session with a NULL se_tpg pointer, leading to a NULL dereference and system crash.

In the Linux kernel, a vulnerability in IB/isert was resolved where full-feature receive buffers were posted before session registration. An initiator that did not wait for the final Login Response could cause a SCSI command to be executed against a session with a NULL se_tpg, leading to a kernel oops at target_submit. The fix moves buffer posting into isert_get_rx_pdu() and performs it before sending the response.

In the Linux kernel, the RDMA/siw module's siw_accept() looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP. The cleanup assumes the current call installed the association, but qp->cep can point to the CEP of an existing connection, leading to freeing the incoming CEP and a use-after-free.

In the Linux kernel, the kmod dups code uses RCU to ensure a kmod_dup_req instance is freed only after it is no longer referenced. However, parallel users in kmod_dup_request_exists_wait() do not enter an RCU read-side critical section, which can result in a use-after-free.

In the Linux kernel on arm64, swsusp_arch_suspend() returns with DAIF masked when swsusp_mte_save_tags() fails, which is unexpected. The fix restores the saved DAIF state before returning from the error path.

In the Linux kernel, the drm/amd/display driver's AMDGPU_DM_MAX_DISPLAY_INDEX constant is 31, suggesting a maximum of 32 connectors, but it is used like MAX_DISPLAY_COUNT. This causes an off-by-one relative to the DRM core, which supports a maximum of 32 connectors. The fix renames the constant and increases the HDCP per-connector array size to 32.

In the Linux kernel, the Renesas R-Car Gen2 PHY driver has a double of_node_put() in the error path during PHY creation. The for_each_child_of_node_scoped() macro automatically releases the node reference, and the explicit of_node_put() drops it twice. The fix removes the redundant call, letting the scoped cleanup handle it.

In the Linux kernel, the Sunplus PHY driver has improper error handling in sp_uphy_init(). The error paths do not correctly undo operations: on clk_prepare_enable() failure it returns directly, on reset_control_deassert() failure it releases only the clock, and on update_disc_vol() failure it jumps to err_reset to release clock and reset. The fix cleans up these paths.

In the Linux kernel, the AMDGPU DRM driver for GFX6 lacks PFP (pre-fetch parser) usage on compute queues. On GFX6, compute queues use the same CP path as graphics but without draw command support. The fix adds PFP usage for register writes, pipeline sync, and after VM flush to prevent execution issues.

In the Linux kernel, the QLogic SCSI driver (qla2xxx) has a redundant VPD flash read in the sysfs read path. qla2x00_sysfs_read_vpd() calls read_optrom() a second time after releasing optrom_mutex. This repeated read is redundant and runs without the mutex, exposing flash access to concurrent operations. The fix removes the duplicate call.

In the Linux kernel, the firmware_loader has an issue with queueing completed sysfs fallback requests. fw_load_sysfs_fallback() calls device_add() before adding fw_priv to pending_fw_head. This allows a userspace helper to complete the request before it is queued, leading to queueing an already-completed request and potential fault on the next request. The fix checks if the request is already done and does not queue it.

In the Linux kernel, hugetlbfs has an issue with subpool release on fill_super failure. hugetlbfs_fill_super() allocates a hugepage subpool, and if root dentry creation fails, the error path frees the subpool with kfree(), bypassing hugepage_put_subpool() and potentially leaving min_size reservations. The fix uses hugepage_put_subpool() on the failure path.

In the Linux kernel, the qcom qmp-usb-legacy PHY driver has a flaw where the runtime suspend callback may run after pm_runtime_enable() but before pm_runtime_forbid(). This causes a dereference of the uninitialized qmp->phy pointer and a crash. It can also occur if a user re-enables runtime-pm via sysfs before the PHY is initialized.

In the Linux kernel, the qcom snps-femto-v2 PHY driver enables runtime PM before creating the PHY, while runtime PM callbacks dereference the not-yet-ready hsphy instance. This leaves a window where a suspend callback can trigger a NULL pointer dereference. The fix takes a runtime PM usage reference with pm_runtime_get_noresume() before enabling runtime PM and releases it once the PHY is created.

In the Linux kernel, the qcom qmp-usb PHY driver has a flaw where the runtime suspend callback may run after pm_runtime_enable() but before pm_runtime_forbid(). This causes a dereference of the uninitialized qmp->phy pointer and a crash. It can also occur if a user re-enables runtime-pm via sysfs before the PHY is initialized.

In the Linux kernel, the md/raid5 subsystem's raid5_bitmap_sector_map() aligns the array range to full RAID5 stripe widths before converting to component sectors. That width is not always a power of two, so the old round_down()/round_up() logic produces incorrect ranges. The fix uses sector_div()-based arithmetic so the rounded range matches the actual RAID5 stripe width.

In the Linux kernel, the md subsystem's __md_stop() destroyed the bitmap before calling mddev_detach(), causing mddev_detach() to skip bitmap_ops->wait_behind_writes(). With llbitmap, RAID1 behind-write completions could then run after llbitmap storage had been freed. The fix calls mddev_detach() before md_bitmap_destroy().

In the Linux kernel, the md/md-llbitmap subsystem's llbitmap_create() publishes mddev->bitmap before reading the bitmap superblock. If llbitmap_read_sb() fails, the old cleanup freed llbitmap before clearing mddev->bitmap, so readers such as /proc/mdstat could observe a stale pointer. The fix clears mddev->bitmap while holding bitmap_info.mutex.

In the Linux kernel, the md/md-llbitmap subsystem's llbitmap_destroy() deletes pending_timer before flushing md_llbitmap_io_wq, but daemon_work can still be queued or running and rearm pending_timer. If this happens during teardown, the timer can remain armed after llbitmap is freed and later dereference freed memory. The fix adds a BITMAP_SHUTDOWN bit and uses timer_shutdown_sync().

In the Linux kernel, the md/raid1 subsystem's raid1_takeover() sets conf->array_frozen = 1 on the newly allocated r1conf and never clears it, so every I/O to the array stalls permanently once _wait_barrier() sees it stuck at 1. This used to be harmless because level_store() called mddev_resume(), but commit b39f35ebe86d removed that call. The fix simply does not set array_frozen in raid1_takeover().

In the Linux kernel, the coresight etm4x driver's use of (nrseqstate - 1) in the loop initializing or setting TRCSEQEVR<n> can cause an underflow when TRCIDR5.NUMSEQSTATE is 0b000. The fix introduces an nr_seq_ctrls field and an ETM_MAX_SEQ_TRANSITIONS macro and applies them to TRCSEQEVR<n> field setup.