Linux kernel vulnerabilities

In the Linux kernel, the RDMA/cma module has a bug that triggers a WARN_ON in res_to_rt() during asynchronous address resolution. The issue occurs when cma_acquire_dev_by_src_ip() fails, yet the resource is still added to restrack with a NULL device pointer. The fix ensures the resource is only added when device acquisition succeeds.

In the Linux kernel, the BPF verifier's iterator type comparison during state pruning does not distinguish MEM_RCU from PTR_UNTRUSTED. This can let the verifier prune an unsafe path and accept a dangerous BPF program.

In the Linux kernel, the UBI subsystem's ubi_init_attach() rolls back failed initializations by scanning ubi_devices[0..i-1], assuming the mtd= parameter index matches the UBI device number. With an explicit ubi_num this assumption is wrong and a successfully attached device can be missed during rollback.

In the Linux kernel, the UBI subsystem's ubi_detach_mtd_dev() obtains a device reference via ubi_get_device() before checking whether the device is busy. The -EBUSY return path drops ubi->ref_count but not the device reference, preventing later release.

In the Linux kernel, the ASoC xilinx formatter_pcm driver's xlnx_formatter_pcm_open() allocates stream_data and assigns the stream pointer before further validation. If a later step fails, ALSA does not call close, so stream_data leaks and the pointer dangles to a freed substream.

In the Linux kernel, the firewire subsystem's build_tree() leaves allocated node instances in a local linked list on the error path. When an invalid value is detected in the self ID sequence, these instances are not freed, causing a memory leak.

In the Linux kernel on arm64, a bug in EFI runtime services handling occurs when software PAN (CONFIG_ARM64_SW_TTBR0_PAN) is enabled. The fpsimd context management code called from __efi_fpsimd_begin() can be voluntarily preempted, causing an incorrect TTBR0_EL1 value upon return to EFI code and leading to a kernel memory access fault. The fix reorders the fpsimd switch so it occurs before the page-table change.

In the Linux kernel on s390, the fetch destination register is not cleared on a faulting arena atomic RMW operation in BPF. When an atomic operation with BPF_FETCH faults on an unmapped arena page, the program resumes with an incorrect register value instead of zero, unlike other BPF_PROBE_* accesses. The fix fills probe->reg from bpf_atomic_load_reg().

In the Linux kernel, a use-after-free exists in bpf_trampoline_multi_attach_free when a BPF trampoline update fails. When bpf_trampoline_update() fails before modify_fentry_multi()/unregister_fentry_multi() is called, cur_image remains unchanged and ftrace still calls into it, so freeing old_image causes a UAF. The fix only frees old_image when it differs from cur_image.

In the Linux kernel, a deadlock occurs during unregistering an s390dbf debug area while one of the associated debugfs files is being written to. The debugfs writing thread waits for debug_mutex held by debug_unregister(), which waits for debugfs_file_put(), causing a deadlock. The fix splits debug_unregister() into an s390dbf and debugfs part, running only the s390dbf part with debug_mutex locked.

In the Linux kernel, the samsung_pwm clock driver uses a regular spinlock, which under PREEMPT_RT on ARM is converted to a sleeping (mutex-based) lock. Such a lock must not be used in atomic context such as hard interrupt handlers. The fix switches samsung_pwm_lock to a raw_spinlock, which remains a true non-sleeping spinlock even under PREEMPT_RT.

A vulnerability in the Linux kernel's ALSA sequencer MIDI rawmidi input teardown involves a race condition during rawmidi substream closing. The snd_midi_input_event() function may run concurrently with the closing, leading to a NULL pointer dereference and kernel crash. The issue is fixed by serializing the teardown with event_input using RCU.

A race condition in the Linux kernel's nvmet subsystem between configfs modification of the max_qid limit and controller allocation can lead to out-of-bounds memory access and potential memory corruption. The fix synchronizes allocation with a semaphore and copies max_qid into the controller structure, eliminating the unsafe dependency.

In the Linux kernel, a vulnerability in the OCFS2 filesystem was found due to missing validation of the orphan slot during inode read. A corrupted dinode with OCFS2_ORPHANED_FL can carry an invalid orphan slot number, leading to out-of-bounds memory access (use-after-free) during inode wipe operations.

In the Linux kernel, the ocfs2 filesystem has a use-after-free due to missing validation of the i_dio_orphaned_slot field during inode read. A corrupted append-DIO dinode can carry an out-of-range slot value for the mounted filesystem, leading to an invalid pointer and a UAF in ocfs2_get_system_file_inode(). The fix rejects an active i_dio_orphaned_slot outside the slot range during dinode validation.

In the Linux kernel, the Squashfs filesystem fails to check whether a block offset read from disk is negative. A negative offset (e.g., into the decompressed fragment block) causes an out-of-bounds access in squashfs_copy_data(). The fix checks if the offset is negative and returns 0, matching existing behavior for offsets beyond the block.

In the Linux kernel's SCSI subsystem (mpt3sas), the _base_release_memory_pools() function incorrectly frees unallocated PCIe SGL buffers, which can lead to a "bad dma" warning on debug kernels or a NULL pointer dereference.

A Use-After-Free vulnerability exists in the Linux kernel's __page_pool_release_netmem_dma function in the page_pool subsystem. A race between page_pool_scrub() and page return via page_pool_put_netmem() on another CPU causes the cmpxchg loser to free the page before the winner finishes accessing its fields, resulting in use of freed memory.

Vulnerability in the ntfs3 filesystem driver in the Linux kernel. In the mi_enum_attr() function, insufficient validation of the end virtual cluster number (evcn) can lead to integer overflow, allowing invalid attributes to be accepted. The fix adds a range check for evcn, rejecting values outside the range, except for U64_MAX which is used as a sentinel for empty attributes.

A use-after-free vulnerability was found in the Linux kernel's snd_card_do_free() function in the ALSA subsystem. The issue occurs when a devres-managed sound card is unbound while a user-space application still holds an open file descriptor. After waking up the unbind thread, the user thread reads the 'managed' field from already freed memory, triggering a KASAN error.

In the Linux kernel's HID haptic driver, the fill_effect_buf() function writes an uninitialized value to unhandled usages, which can result in random data being written to the effect's report buffer.

In the Linux kernel's ASoC SOF subsystem, there is a lack of validation of the topology volume range before allocation. An inverted range or a maximum >= INT_MAX can lead to unsafe allocation and indexing.

In the Linux kernel for RISC-V (RV64), the JIT does not perform sign-extension for 1-byte and 2-byte kfunc arguments, violating the ABI. After a change in liveness analysis, these issues are exposed.

In the Linux kernel's ACPI scan subsystem, when device_add() fails after allocating an instance ID, the rollback does not clean up bus-ID entries, leaving an unavailable instance number.

In the Linux kernel's qcom-cpucp mailbox driver, the IRQ handler calls mbox_chan_received_data() while holding chan->lock. With PREEMPT_RT, this leads to a self-deadlock.

In the Linux kernel, the qcom-cpucp mailbox driver (qcom_cpucp_mbox_send_data) blindly dereferenced the data pointer, which can be NULL. mailbox_clear_channel() calls mbox_send_message() with NULL to notify the remote side, causing a NULL pointer dereference kernel panic, particularly under PREEMPT_RT.

In the Linux kernel, the riscv-sbi-mpxy driver did not validate the RPMI notification length returned by SBI before copying data from shared memory into the notification buffer. Additionally, the event walker used a reversed loop condition and could inspect a short event record.

In the Linux kernel, the null_blk module initialized its mutex (mutex_init(&lock)) after registering the configfs subsystem, so a racing mkdir() into /sys/kernel/config/nullb/ could call mutex_lock() before the mutex was initialized. This triggered DEBUG_LOCKS_WARN_ON and a WARNING in kernel/locking/mutex.c.

In the Linux kernel, a flaw exists in the null_blk module where the configfs subsystem is registered before default devices are created. A race condition from userspace (mkdir + poweron) can trigger a WARN_ON in __add_disk and, in the error path, a use-after-free (UAF).

In the Linux kernel, the null_blk module with shared_tags enabled allocates a global tag_set via null_init_global_tag_set(). If device creation later fails, the err_dev path never frees the global tag_set, and since module init failed, null_exit() is never invoked — the tag_set's tags and maps are permanently leaked.

In the Linux kernel, the null_blk module allocates the dev->zones array when a zoned device is powered on (null_init_zoned_dev()), but null_del_dev() never frees it on power-off — it is only freed later in null_free_dev() when the configfs directory is removed. Powering the device off and on again overwrites the dev->zones pointer, leaking the previous allocation on each power cycle.

In the Linux kernel's null_blk module, configfs attributes (submit_queues, poll_queues) are stored without proper synchronization. Concurrent stores via separate file descriptors can cause device state inconsistencies, such as a mismatch between submit_queues and the live queue count or an out-of-bounds access to dev->zones[].

In the Linux kernel, a vulnerability in the null_blk driver allows concurrent writes to configfs attributes during device setup, leading to inconsistent device configuration. This can trigger WARN_ON_ONCE warnings, cause device setup failures with -EIO, and in worst cases lead to NULL pointer dereference on write operations.

In the Linux kernel's blk-iolatency mechanism, delay state is not cleared when freeing policy data. A blk-cgroup can remain permanently marked as congested, causing readahead to be cut and throttling to be scheduled on anonymous folio allocation.

In the Linux kernel's blk-iocost mechanism, delay state is not cleared when freeing policy data. A blk-cgroup can remain permanently marked as congested, causing readahead to be cut and throttling to be scheduled on anonymous folio allocation.

In the Linux kernel's mtip32xx driver, ioctl handlers are not synchronized with device removal. The REMOVE_PENDING bit is checked before entering mtip_hw_ioctl(), but removal can set it immediately afterwards and free dd->port while an ioctl still dereferences it, leading to a use-after-free.

In the Linux kernel BPF verifier, the pointer type for atomic RMW operations is recorded only when the current destination is PTR_TO_ARENA. A second path can reach the same instruction with an ordinary pointer without comparing it against the saved arena type, leading to incompatible use of the instruction.

In the Linux kernel, the rdma_accept_failed error path of smbdirect_accept_connect_request() destroyed memory pools before destroying the QP. This left an outstanding recv_io object at kmem_cache_destroy() time, triggering a "Slab cache still has objects" warning and later a NULL-pointer dereference in mempool_free_bulk.

A vulnerability in the Linux kernel's SMB Direct (smbdirect) module releases pending child sockets before destroying the listener's cm_id, leading to a use-after-free in _cma_cancel_listens(). This can cause a kernel crash or potential privilege escalation.

In the Linux kernel, the SMB server (ksmbd) has a null pointer dereference vulnerability in ksmbd_ipc_tree_connect_request(). The issue occurs when the share name allocation (share->name) fails and the code does not check for this error before using the name in strlen().

In the Linux kernel, the SMB server (ksmbd) has an invalid pointer dereference vulnerability in ksmbd_stop_durable_scavenger(). When thread creation (kthread_run) fails, dh_task contains an ERR_PTR error, and a later call to kthread_stop() on that pointer leads to an invalid dereference.

In the Linux kernel, the SMB server (ksmbd) function ksmbd_server_init() does not abort initialization when ksmbd_proc_init() fails. ksmbd_proc_init() returns void, so allocation errors are not detected, leading to use of invalid pointers during later calls to ksmbd_proc_reset() and creation of entries in /proc.

In the Linux kernel, the SMB server (ksmbd) during module initialization, when a later initializer fails, ksmbd_proc_cleanup() is not called, leading to resource leaks (proc tree and per-CPU counters).

In the Linux kernel, the SMB server (ksmbd) has a Use-After-Free and double-free vulnerability in smb2_lock(). Granted locks are published to conn->lock_list and fp->lock_list immediately after vfs_lock_file() succeeds, but they also remain on the rollback_list. If a later element in the request array fails, the rollback loop may free an already-freed object, as a concurrent UNLOCK request can remove it.

In the Linux kernel, the EROFS filesystem has an out-of-bounds read vulnerability in the case of invalid interlaced ztailpacking pclusters. Filesystem images can contain invalid clusters, leading to a read from a kmap'd page and copying irrelevant kernel memory into userspace-visible page cache.

In the Linux kernel, the lwt_bpf module has a vulnerability due to incorrect headroom checking after an LWT_XMIT BPF program runs. The check uses hard_header_len, which does not account for alignment required by the neighbour cached-header path (neigh_hh_output), potentially leading to packet drops.

In the Linux kernel, the BPF mechanism has a vulnerability where bpf_setsockopt() and bpf_getsockopt() can be called in cgroup UNIX getname hooks (BPF_CGROUP_UNIX_GETPEERNAME and BPF_CGROUP_UNIX_GETSOCKNAME) without holding the socket lock, leading to a sock_owned_by_me() warning.

In the Linux kernel, the m68k nfcon driver has a deadlock caused by calling console_is_registered() in nfcon_device(), when the .device() method is called while holding the console_list_lock, and console_is_registered() tries to acquire it again.

In the Linux kernel, the BPF mechanism has a vulnerability where a BPF program in the cgroup getsockopt hook can set a negative ctx->optlen, which is accepted and propagated to the TCP getsockopt code, leading to a hardened usercopy warning (bytes > INT_MAX).

In Linux kernel BPF/XDP subsystem, program checks were moved into dev_xdp_install() to prevent swapping a normal XDP program for an offloaded/device-bound one via BPF_LINK_UPDATE, which previously bypassed verification and allowed execution on the software path.