Linux kernel vulnerabilities

In the Linux kernel, the WARN_ON_ONCE in wbt_init_enable_default() was removed because both failure paths (wbt_alloc() returning NULL under memory pressure and wbt_init() returning -EBUSY) are expected. Replaced with plain if-checks and added pr_warn() for diagnostics.

In the Linux kernel, a vulnerability was found in the mt76 driver for mt7925 chipsets, where a NULL pointer dereference could occur in the mt7925_tx_check_aggr() function. The missing NULL check for 'sta' before dereferencing it may lead to a system crash.

In the mt76 Wi-Fi driver for MT7921/MT7922 chipsets, configuring a station with an AID above 20 causes a firmware crash. The issue occurs in AP mode and can be triggered by a modified hostapd version.

A NULL pointer dereference vulnerability was found in the Linux kernel's AMD GPU driver (drm/amd/ras) in the ras_core_ras_interrupt_detected() function. The issue occurs when ras_core is NULL and the code attempts to access the dev field in the error path.

In the Linux kernel, a vulnerability was found in the AMD GPU driver (drm/amd/ras) where the ras_core_get_utc_second_timestamp() function can cause a NULL pointer dereference. The issue occurs when the ras_core pointer is NULL and the function tries to access the dev field in an error message. The patch adds an early NULL check and returns 0 if the pointer is invalid.

In the Linux kernel, a vulnerability was found in the padata mechanism where the CPU offline callback was placed in a section that does not allow errors. It has been moved to the ONLINE section where errors are permitted to prevent warnings and potential issues.

In the Linux kernel drm/amd/display driver, a NULL pointer dereference vulnerability was found in dc_dmub_srv_log_diagnostic_data() and dc_dmub_srv_enable_dpia_trace(). Incorrect condition ordering can cause a NULL dereference during error logging, leading to a system crash.

In the Linux kernel, a vulnerability was found in the IOMMU driver for RISC-V architecture on the invalidation path. When gather->end reaches ULONG_MAX, an overflow causes an infinite loop. Additionally, incorrect length calculation (moving +1 to the other side of <) may lead to operational errors.

In the Linux kernel, a vulnerability was found in the FUSE filesystem where fuse_dentry_revalidate() may be called with a dentry having uninitialized ->d_time field. The issue was discovered by KMSAN and could lead to reading uninitialized memory.

In the Linux kernel, a vulnerability in the SoC Tegra CBB subsystem uses an incorrect base address when looking up the target timeout for an error occurring on a different fabric, causing a kernel page fault and potential system crash.

In the Linux kernel, the max77705 driver leaks memory by not destroying the workqueue on remove() and has a flawed resource release order. Interrupt handlers registered via devm may schedule work on a freed workqueue, leading to use-after-free.

In the Linux kernel pinctrl subsystem (pinconf-generic), a vulnerability was found due to incomplete validation of the 'pinmux' property in the device tree. The pinconf_generic_parse_dt_pinmux() function assumes the 'pinmux' property is not empty when present, which can cause the allocator to return a special value instead of NULL, leading to a crash when accessing invalid memory.

In the Linux kernel's hvc_iucv driver, an off-by-one vulnerability was found in the number of supported devices. When the hvc_iucv_devices counter reaches 8, the code may access hvc_iucv_table[8], which is out of bounds (the array has 8 elements indexed 0-7).

A bug in the Linux kernel's USB Type-C PS883X driver causes an Oops when unbinding the device. The issue is due to missing i2c_set_clientdata() in the probe function, leading to a NULL pointer dereference in the remove function.

A vulnerability in the Linux kernel's SCSI sg driver allows a soft lockup by setting a negative value for the def_reserved_size parameter via sysfs. The issue stems from missing validation when the parameter is modified directly through /sys/module/sg/parameters/def_reserved_size.

In the Linux kernel, a vulnerability in the F2FS filesystem was found where f2fs_sbi_show() reads extension_list, extension_count, and hot_ext_count without holding sb_lock. Concurrent modification via sysfs can lead to inconsistent reads, potentially causing out-of-bounds access or displaying stale data.

In the Linux kernel, the EIP93 crypto driver's eip93_hmac_setkey() function allocated a temporary ahash transform using the CRYPTO_ALG_ASYNC mask, which excludes async algorithms. Since EIP93 algorithms are inherently async, the lookup always failed, leaving digest fields uninitialized and causing a NULL pointer dereference and kernel panic.

In the Linux kernel, a vulnerability was found in the reset driver for Amlogic T7 SoCs. Missing reset operations cause a null pointer dereference in the kernel, potentially leading to system crashes. Currently, reset is not used on this SoC.

A use-after-free vulnerability was found in the Linux kernel's enetc network driver, related to DMA buffer handling in the NTMP mechanism. The bug can lead to silent memory corruption when a freed DMA buffer is reused by hardware.

In the Linux kernel, a vulnerability was found in the airoha network driver. Early initialization of the ndesc variable in airoha_qdma_init_tx_queue() causes a NULL pointer dereference in airoha_qdma_cleanup_tx_queue() when queue entry list allocation fails.

In the Linux kernel network driver for Airoha chips, a NULL pointer dereference vulnerability was found. It occurs when queue entry or DMA descriptor list allocation fails in airoha_qdma_init_rx_queue(), and then airoha_qdma_cleanup() tries to delete RX queue NAPI even though netif_napi_add() was never called. The issue is caused by early initialization of the ndesc variable, which is used to check if the queue is properly initialized.

In the Linux kernel, the MANA network driver is vulnerable to a double invocation of mana_remove(). If PM resume fails, mana_probe() calls mana_remove(), which nullifies context pointers. On subsequent driver unbind, a second mana_remove() call dereferences a NULL pointer, causing a kernel panic.

In the Linux kernel, the mailbox-test driver fails to free channels on probe error, causing a memory leak and potential use-after-free (UAF) scenarios because the client structure is removed automatically by devm.

A sanity check for the channel array was added in the Linux kernel mailbox driver. Without it, a missing channel array could cause a NULL pointer dereference and kernel OOPS, especially during early initialization.

In the Linux kernel, the mailbox-test driver has a double-free vulnerability when the RX channel is aliased to the TX channel with different MMIO. Freeing both channels triggers the bug.

In the Linux kernel, multiple bugs were found in the amdgpu driver's AMDGPU_INFO_READ_MMR_REG function. Issues include incorrect lock ordering (reset semaphore and mm_lock), memory allocation while holding the reset semaphore, and using down_read_trylock() instead of waiting for reset completion.

A vulnerability in the Linux kernel's Phonet subsystem causes a kernel BUG in pn_socket_autobind() when socket binding fails. The issue occurs when pn_socket_bind() returns -EINVAL due to invalid socket state with a zero port, leading to a kernel panic from a user-triggerable path.

In the Conexant audio driver for the Linux kernel, the return value of the jack detection registration function is not checked. If memory allocation fails, the driver continues with an unregistered callback, potentially causing a kernel crash.

In the Linux kernel, a use-after-free vulnerability was found in the DRM driver for Intel Xe GPUs. The xe_eu_stall_stream_close() function called drm_dev_put() before disabling the stream and freeing resources, potentially accessing freed memory.

In the Linux kernel's ice driver, a NULL pointer dereference vulnerability was found in ice_reset_all_vfs(). When VSI rebuild fails (e.g., during NVM firmware update), txq_map and rxq_map remain NULL, and subsequent ice_vf_post_vsi_rebuild() call causes a kernel panic.

In the Linux kernel for ARM64 architecture, a vulnerability was found due to insufficient reserved pages for early kernel mapping. This can cause a buffer overflow and potentially compromise system stability.

A copy-paste error in the Linux kernel's audit_log_capset() function causes CAPSET audit records to report the effective capability set in the inheritable field instead of the actual inheritable set. This bug has been present since 2008.

In the Linux kernel's idpf driver, a vulnerability causes double free and use-after-free in auxiliary device error paths. When auxiliary_device_add() fails, the error handling code incorrectly falls through, freeing the same iadev structure twice and accessing freed memory.

In the Linux kernel, a bug in the AMD Display driver (DCN32) causes a kernel crash when allocating memory for phantom planes. The issue occurs because dcn32_enable_phantom_plane() calls kvzalloc() within a softirq-disabled region, triggering BUG_ON(in_interrupt()).

In the Linux kernel's Btrfs filesystem, a bug was found where the dirty_pages io tree was prematurely cleared after a failed write during transaction commit. This caused dirty extent buffers to not be properly cleaned up during unmount, leading to warnings and potential data loss.

In the Linux kernel AMD IOMMU driver, a missing bounds check for the device ID (devid) in __rlookup_amd_iommu() caused an out-of-bounds read and a general protection fault (GPF) at boot when a PCI device was not described in the IVRS table.

A vulnerability was found in the Linux kernel's kexec mechanism. After recent changes, in a non-kjump kexec path the return address is no longer pushed onto the stack, causing purgatory code to attempt reading a non-existent address, leading to a fault and potential system hang.

In the Linux kernel IOMMU subsystem for Intel VT-d, a vulnerability was found causing NULL pointer dereference or refcount corruption. The issue occurs when teardown operations are executed without checking if the dev_pasid structure exists, potentially leading to system crashes or memory safety violations.

A vulnerability in the Linux kernel's pci_dev_reset_iommu_done() function was found where the IOMMU group domain pointer can be NULL if default domain allocation fails during first probe. This leads to a NULL pointer dereference and system crash when attempting to re-attach the device to the domain.

In the Linux kernel, the gma500 DRM driver for Oaktrail LVDS displays has a bug causing a hang during initialization. The LVDS init code retrieves an I2C adapter via i2c_get_adapter() and on failure attempts to deregister and free also that adapter, which was not allocated by the driver. Since i2c_get_adapter() increments the reference count, the deregistration waits indefinitely for the reference to be released, resulting in a permanent hang.

In the Linux kernel ARM MPAM subsystem, a NULL pointer dereference vulnerability was found in __destroy_component_cfg(). The issue occurs when the function is called from mpam_disable() before the configuration array is allocated, leading to a system crash.

A vulnerability was found in the Linux kernel's KVM for ARM64, where page table walk functions in fault injection and AT emulation did not hold the SRCU lock, potentially leading to a race condition during memslot changes.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth ISO stack. The iso_sock_rebind_bc() function caches a pointer to the hci_conn structure and then releases the socket lock, allowing a concurrent close() to free the memory, leading to use-after-free.

A use-after-free vulnerability was found in the Linux kernel when processing MLD queries. A pointer to the multicast group address is retrieved during initial packet parsing but is not reloaded after skb header reallocation, leading to use-after-free.

A logic flaw in the Linux kernel's __smc_setsockopt() function allows a local unprivileged user to cause a Denial of Service (DoS) by holding the socket lock indefinitely. The issue arises from calling copy_from_sockptr() while holding lock_sock, which combined with userfaultfd-monitored memory can halt execution and exhaust kernel worker threads.

A use-after-free vulnerability was found in the Linux kernel's OP-TEE driver. The issue occurs when the client exits before the supplicant, leading to a race condition and use of freed memory.

A use-after-free vulnerability was found in the Linux kernel's EROFS filesystem. The issue occurs when z_erofs_decompress_kickoff() is called asynchronously after I/O completion and can race with the filesystem unmount process, leading to access to already freed sbi structure memory.

In the Linux kernel, the ksmbd module is vulnerable to a remotely triggerable NULL-dereference bug. The functions smb2_oplock_break_noti() and smb2_lease_break_noti() read the opinfo->conn pointer without READ_ONCE() or NULL check, allowing a concurrent SMB2 LOGOFF to set it to NULL and cause a kernel oops.

In the Linux kernel IPVS module, a vulnerability was found where during service editing (ip_vs_edit_service), the pointer to the old scheduler (svc->scheduler) was cleared only after the scheduler module initiated RCU callbacks. This could lead to using the old scheduler after its data (sched_data) was freed after the RCU grace period, causing errors or crashes.

In the Linux kernel, a vulnerability was found in the synproxy mechanism due to missing synchronization when registering netfilter hooks on demand. When multiple users add the first iptables rules or nftables expressions concurrently, a race condition can occur in the reference counter. A mutex has been added to serialize access to the reference count control blocks from both frontends.