Linux kernel vulnerabilities

In the Linux kernel vsock/virtio driver, there is a bug in zerocopy handling for large messages fragmented into multiple skbs. The uarg object is allocated only for the last skb, causing missing completion notifications for earlier skbs and potential page leak if the loop breaks early.

In the Linux kernel, a memory leak exists in the hci_le_big_terminate() function. The function allocates iso_list_data but fails to free it in an early return path when neither pa_sync_term nor big_sync_term flags are set.

A vulnerability in kernel software running inside a Host VM allows sending improper commands to GPU firmware, potentially causing a memory write outside the allowed range for the host kernel. Additionally, a TOCTOU bug exists where a malicious driver can modify values in memory after firmware validation but before use.

Memory corruption occurs when processing multiple IOCTL calls with the same input buffer file descriptor.

The vulnerability causes memory corruption when processing multiple IOCTL calls with the same buffer file descriptor input, leading to access of already freed memory.

Memory corruption occurs when invoking device I/O control operations for mapping and unmapping persistent memory buffers due to improper synchronization.

In the Linux kernel's af_unix subsystem, a synchronization issue was found in the unix_gc() function. The gc_in_progress flag could be set to false while the garbage collector was still running, allowing another GC run to start prematurely. The unix_peek_fpl() function relies on this flag to avoid errors with MSG_PEEK.

A critical vulnerability in the Linux kernel's KVM/SEV component for AMD EPYC processors with SEV-SNP support. The lack of requiring the scratch area to reside in the GHCB v2+ shared buffer, combined with multiple validation flaws, allows a malicious SNP guest to perform out-of-bounds (OOB) reads and writes in the host kernel heap.

A use-after-free vulnerability was found in the Linux kernel's KVM shadow paging for x86. The bug occurs due to a role mismatch when a PDE mapping is changed from outside the guest, causing reuse of a kvm_mmu_page with an incorrect role. This leads to a dangling rmap entry after memslot deletion, and subsequent operations on the freed page cause memory corruption.

In the Linux kernel, a vulnerability exists in the Bluetooth L2CAP stack. The cleanup_listen() function closes channels directly, which can lead to lock inversion. The fix uses a channel timer to close channels asynchronously, ensuring correct lock ordering and preventing potential deadlocks.

A use-after-free (UAF) vulnerability was discovered in the Linux kernel's Bluetooth stack. The issue occurs in l2cap_sock_cleanup_listen() when closing a listening socket concurrently with an HCI disconnect, leading to l2cap_conn_del() freeing the child socket structure that is later used by cleanup_listen().

In the Linux kernel's drm/i915/gem driver, a bug was found in the pread/pwrite functions for physical buffer objects (phys BO). The sg_page() function returns a struct page pointer, not void*, causing incorrect offset scaling during read/write. As a result, with a non-zero offset, wrong parts of the buffer are accessed.

In the Linux kernel for ARM64, a mitigation was added for errata affecting TLBI instructions on certain Arm CPUs. The bug causes a TLBI;DSB sequence to complete before global observation of writes translated by an invalidated TLB entry. Although TLB invalidation is correct, memory access after invalidation may be incomplete.

In the Linux kernel, the WARN_ONCE() in hsr_addr_is_self() has been removed because it triggered a false positive when an HSR interface was being deleted. The self_node pointer is cleared before the network device is fully unregistered, causing an unnecessary warning.

A race condition in the Linux kernel's zap_other_threads() function fails to clear JOBCTL_PENDING_MASK for the calling thread during execve(). This causes a stale stop signal after execve completes, triggering a kernel warning and potential system instability.

A fix in the Linux kernel resolves a warning during core dump on RISC-V. The issue was using the wrong register note type for REGSET_CFI.

In the Linux kernel, a NULL pointer dereference occurs in the wm_adsp driver when removing firmware controls. The wm_adsp_control_remove() function attempts to clean up private data without checking if the priv pointer is NULL.

In the Linux kernel, a vulnerability in netfilter nf_conntrack causes nf_ct_helper_expectfn_unregister() to not remove pending expectations from the table, leaving a dangling pointer to freed module code. When the expected connection arrives, invoking this pointer results in a kernel crash.

A NULL pointer dereference vulnerability was found in the Linux kernel's ASoC SDCA driver during function unregistration. When a function registration fails partially or device cleanup races with probe deferral, func_dev entries may be NULL, causing a kernel oops with BUG message.

In the Linux kernel, the virtio-gpu driver has an issue during driver removal when KMS is disabled. DRM atomic and modesetting are not initialized, leading to access of uninitialized data and kernel crash.

In the Linux kernel for ARM64 in Rust code, a bug was found related to the LLVM uwtable module flag. Due to a rustc bug, the -Cforce-unwind-tables=y flag does not emit the uwtable annotation for the module, causing compiler-generated functions (e.g., asan.module_ctor) to lack the annotation. When CONFIG_UNWIND_PATCH_PAC_INTO_SCS is enabled, this leads to boot failures due to incorrect patching of paciasp/autiasp instructions.

In the Linux kernel, a false positive WARN was removed when marking a page as dirty while the VM is dying. The issue affected SEV-ES guests where KVM kept a writable mapping of a guest page after an exit to userspace and tried to unmap it during vCPU destruction, triggering a warning about missing active vCPU.

A fix in the Linux kernel for the pinctrl mcp23s08 driver. Initialization of mcp->dev and mcp->addr was too late, causing a NULL pointer dereference during regmap init.

In the Linux kernel for ARM architecture, there is an issue in __switch_to() related to KASAN VMAP stack shadow. The ldr instruction was used to read the stack shadow, which is byte-granular and may not be word-aligned, causing an alignment fault on ARMv5.

In the Linux kernel on ARM64, the pagetable_dtor() call was missing when freeing hot-removed page table pages, causing bad page states, PTL allocation leaks, and incorrect NR_PAGETABLE stats. The fix adds the missing call in free_hotplug_pgtable_page().

A use-after-free (UAF) vulnerability was found in the Linux kernel's may_decode_fh() function in the fhandle mechanism. The issue arises from reading the mount::mnt_ns field without proper locking, allowing a race condition during unmount and namespace deallocation. The fix adds rcu_read_lock() around the mnt_ns access.

In the i2c-imx driver in the Linux kernel, there is an inconsistency between clock and pinctrl state in runtime PM. During suspend, the clock is disabled before switching pinctrl state, and a pinctrl failure leaves the clock disabled, causing a crash on subsequent hardware access.

In the i2c-qcom-cci driver in the Linux kernel, there is a NULL pointer dereference in cci_remove(). When only one of two I2C masters is initialized, calling cci_halt() for the uninitialized master causes a kernel crash during device unbinding or driver removal.

In the Linux kernel, the airoha network driver lacks a NULL check for the result of of_reserved_mem_lookup(). This can lead to a NULL pointer dereference and system crash when a device tree entry is misconfigured.

In the Linux kernel bonding driver, a NULL pointer dereference occurs in bond_do_ioctl() because slave_dbg() is called before the NULL check for slave_dev. This can cause a system crash when a non-existent interface is specified.

In the Linux kernel NVMEM onie-tlv driver, an infinite loop occurs when encountering an unknown entry type (e.g., 0x41), causing a system hang.

In the Linux kernel, the mm/damon/lru_sort module has a vulnerability due to missing error handling for context allocation. The damon_lru_sort_enabled_store() function assumes allocation always succeeds, leading to a NULL pointer dereference on failure.

In the Linux kernel, the DAMON_RECLAIM module has a NULL pointer dereference bug. The damon_reclaim_enabled_store() function assumes that the damon_ctx allocation will always succeed, which can lead to using an uninitialized pointer.

In the Linux kernel mincore_swap() function, there is an ordering issue in entry checks. On builds without CONFIG_SWAP but with CONFIG_MIGRATION or CONFIG_MEMORY_FAILURE, migration/poison entries are incorrectly treated as swap, causing false warnings and incorrect results.

In the Linux kernel's slimbus qcom-ngd-ctrl driver, callbacks are registered before the NGD (Next Generation Device) is created. When remoteproc starts in parallel with driver probing, callbacks operate on uninitialized data, causing system crashes.

In the Qualcomm slimbus driver (qcom-ngd-ctrl), a potential deadlock was detected due to an ABBA locking order between tx_lock and ctrl->lock. During SSR/PDR down notification, tx_lock is acquired before ctrl->lock, while other code paths take them in reverse order, leading to a possible system hang.

In the Linux kernel's drm/amd/display driver, an out-of-bounds read was found in the dp_get_eq_aux_rd_interval() function. The aux_rd_interval array in struct dc_lttpr_caps has size MAX_REPEATER_CNT - 1 (7 elements), but the offset parameter can be up to MAX_REPEATER_CNT (8) when a sink reports 8 LTTPR repeaters. This leads to an out-of-bounds array read.

In the Linux kernel's AMD Display driver (drm/amd/display), dal_vector_reserve() uses uint32_t arithmetic for allocation size, which can wrap and allocate a smaller buffer than expected, leading to heap overflows.

A WARN warning was triggered in the Linux kernel's scx_cgroup_move_task() function during task migration by the sched_ext scheduler. The issue occurs when systemd modifies subtree_control and cgrp_moving_from is NULL, which is a legitimate CSS-based migration, not an error. The fix removes the warning while keeping ops.cgroup_prep_move() and ops.cgroup_move() paired.

In the Linux kernel, the debugobjects module has an issue on RT-enabled systems. The fill_pool() function calls rtlock_lock(), which asserts if current->pi_blocked_on is set, potentially causing a kernel panic.

A fix in the Linux kernel for debugobjects where calling fill_pool() in hardirq context during early boot could cause a deadlock.

In the Linux kernel AMD64 AGP driver, a vulnerability was found due to incorrect error checking of the return value from cache_nbs(). When no physical AMD northbridge is present (e.g., in virtualized environments), the function returns -ENODEV, but the code only checks for -1, masking the error and leading to a NULL pointer dereference in amd64_fetch_size().

A use-after-free vulnerability was found in the Linux kernel audio drivers. When an audio device is closed, the audio buffer may be freed while the memory mapping remains valid, allowing access to freed kernel memory.

In the kernel handler for IPV6_MSFILTER, a use-after-free vulnerability exists. The handler drops a serializing lock while copying the source-filter list from userspace, then reacquires the lock. During this window, another thread can free the multicast filter structure, leaving the handler with a stale pointer to freed memory.

An integer overflow vulnerability was found in the dsp_mmap_single() function during validation of memory mapping requests. A large offset and length can cause the sum to wrap around, bypassing the check and allowing mapping beyond the audio buffer into unrelated kernel memory.

In the Linux kernel's MANA network driver, a vulnerability was fixed that caused a race condition when creating debugfs directories. The previous implementation used a hardcoded "0" for Physical Functions (PFs) and pci_slot_name() for Virtual Functions (VFs), leading to a NULL pointer dereference for VFs in environments like VFIO passthrough or nested KVM, as well as name conflicts (-EEXIST errors) when multiple PFs or VFs from different PCI domains were present.

A deadlock was discovered in the Linux kernel's DSA subsystem when using ethtool. The issue is caused by redundant netdev_lock_ops() calls in the DSA wrappers for the conduit device's ethtool operations, leading to a lockup. The bug was reproduced, e.g., when booting qemu with fbnic and CONFIG_NET_DSA_LOOP=y.

In the Linux kernel, a vulnerability in the vfio/pci driver causes DMABUFs not to be cleaned up before the PCI function is disabled during device shutdown. This creates a race window where after clearing the MSE bit, BARs remain accessible via DMABUF.

In the Linux kernel's io_uring/napi subsystem, there was no cap on the maximum polling time when no events were found, which could trigger kernel complaints about a stuck task due to missing conditional rescheduling. A 10 ms limit has been added to prevent this issue.

In the Linux kernel, a vulnerability was found in the nilfs2 filesystem where nilfs_ioctl_mark_blocks_dirty() fails to reject a zero bd_oblocknr value. An attacker can send a crafted ioctl request with bd_oblocknr set to 0, bypassing the dead block check and calling nilfs_bmap_mark() on a non-existent block, triggering a WARN_ON(ret == -ENOENT).