Linux kernel vulnerabilities

A vulnerability was found in the Linux kernel's set_pmd_migration_entry() function in mm/huge_memory.c. The function incorrectly uses pmd_write(), pmd_soft_dirty(), and pmd_uffd_wp() flags for device-private PMD entries, leading to incorrect marking of migration entries as writable. The issue was observed in the hmm.hmm_device_private.anon_write_child test, causing rmap state corruption and assertion failures.

A vulnerability in the Linux kernel's hugetlb reservation management was found. During hugetlb folio copy operations (e.g., UFFDIO_COPY or fork), error handling fails to restore the VMA reservation, causing a leak that can lead to SIGBUS on previously reserved addresses.

A vulnerability was found in the Linux kernel's list_lru mechanism during memcg reparenting. The xarray entry for a dying memcg is cleared before draining its per-node lists, allowing concurrent list_lru_del() operations to manipulate the same list items under different locks, causing list corruption.

In the Linux kernel MMC driver for old Rockchip controllers (rk2928, rk3066, rk3188), missing private data structure caused NULL-pointer dereference after adding memory clock auto-gating support. This affects Linux kernel.

In the Linux kernel, the Thunderbolt driver's validator accepts property entries with zero length, causing a buffer underflow when null-terminating the text. This can lead to out-of-bounds memory write.

In the Linux kernel's Thunderbolt driver, a vulnerability was found due to missing bounds check for root directory content offset and length against block size. This can cause out-of-bounds memory read when processing properties.

In the Linux kernel Thunderbolt driver, a vulnerability was found where the XDomain response data copy length is not validated against the allocated buffer size. A malicious peer can set a length field larger than data_length, causing memcpy to write past the kcalloc allocation.

In the Linux kernel, a vulnerability in the Thunderbolt driver allows out-of-bounds reads because tb_xdp_handle_request() casts received packet buffers to protocol-specific structs without verifying the allocation is large enough. An attacker can send a minimal XDomain packet that passes the generic header length check but is shorter than the target struct.

In the Linux kernel Thunderbolt subsystem, a vulnerability was found where tb_xdomain_copy() copies data from the XDomain response buffer without checking the actual frame size. A short response can cause reading beyond the valid DMA buffer area, exposing stale data from previous transactions.

In the Linux kernel DRM GEM subsystem, a race condition was found in the change_handle ioctl between gem_close and gem_change_handle operations. The fix introduces a two-stage approach using idr_replace and disables the ioctl until fully tested.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the DRM AMD KFD driver. The get_queue_ids() function returns NULL when usr_queue_id_array is NULL and num_queues is non-zero, causing a kernel panic.

A buffer overflow vulnerability was found in the Linux kernel's amdkfd driver for SDMA queue checkpoint/restore on GFX11. The v11 MQD manager incorrectly used CP-compute functions, causing 2048 bytes to be read/written instead of 512 bytes.

In the Linux kernel, a bug in the DRM/XE driver causes an oops during suspend or shutdown when the display is absent. The issue stems from improper handling of the probe_display flag, which is not reset after detecting missing display via fuses, leading to display code being called on uninitialized mode config.

In the Linux kernel DRM driver for V3D, a reference counting issue was found in the global performance monitor. Functions SET_GLOBAL, CLEAR_GLOBAL, and perfmon deletion fail to release references properly, causing memory leaks.

A vulnerability in the Linux kernel's DRM V3D driver causes a virtual address (vaddr) mapping leak when processing indirect CSD buffers. If the workgroup count read from the buffer is zero, the v3d_rewrite_csd_job_wg_counts_from_indirect() function exits early without releasing the mappings of both buffers.

In the Linux kernel, a vulnerability was found in the DRM V3D driver due to missing validation of zero workgroup counts in indirect CSD jobs. Submitting a dispatch with a zero count in any dimension is invalid and may cause unexpected hardware behavior.

In the Linux kernel graphics driver (drm/amd/display), a vulnerability was found due to unbounded iteration in VBIOS record-chain walk loops. A malformed VBIOS image missing the terminator record can cause infinite loops during probe, potentially leading to out-of-bounds memory reads.

In the Linux kernel, the AMD Display driver lacks clamping of the ReceiverID list read size during HDCP 2.x authentication over HDMI. A malicious HDMI repeater can advertise a message size larger than the destination buffer, causing an out-of-bounds write.

In the Linux kernel drm/amd/display driver, a vulnerability was found due to missing validation of HdmiRegNum and Hdmi6GRegNum fields in VBIOS tables. A malformed VBIOS can set these values up to 255, causing an out-of-bounds heap write during driver initialization.

In the Linux kernel, the AMD Display driver has a vulnerability involving NULL pointer dereference and buffer over-read in the dp_sdp_message_debugfs_write() function. The issue occurs when a connector is connected but not bound to a CRTC (e.g., after hot-plug before atomic commit), causing a kernel crash. Additionally, the function ignores the user-provided size and always copies 36 bytes, potentially reading past the user buffer.

A vulnerability in the Linux kernel's netfilter nft_fib module causes a leak of uninitialized kernel stack data to userspace. The issue occurs when the OIFNAME result register is declared with IFNAMSIZ length but only one register is written on lookup failure, leaving three registers stale. Additionally, the NFTA_FIB_F_PRESENT flag was accepted for incorrect result types, also leading to data leaks.

In the Linux kernel, a vulnerability in RDMA/umem was found where using iommu with large mapping blocks (>=4G) split across multiple SG entries caused overflow of 32-bit stack values, leading to incorrect DMA address calculation for blocks after truncation.

A vulnerability in the Linux kernel's vsock/virtio driver allows unbounded packet queuing. An attacker can send zero-length packets with the VIRTIO_VSOCK_SEQ_EOM flag, keeping rx_bytes at 0 and allowing the skb queue to grow indefinitely.

In the Linux kernel's OMFS filesystem, a missing lower-bound check for s_sys_blocksize allows a crafted image with a value smaller than OMFS_DIR_START (440) to cause an unsigned integer underflow in omfs_make_empty(). This triggers a memset() with a length near 4 GiB, overwriting kernel memory beyond the block buffer.

A use-after-free vulnerability was found in the Linux kernel's mbcache mechanism. The mb_cache_destroy() function fails to cancel the pending c_shrink_work work item before freeing memory, potentially leading to access of already freed memory.

In the Linux kernel, the DRBD driver has an RCU call imbalance in drbd_adm_dump_devices(). The function calls rcu_read_unlock() without a preceding rcu_read_lock(), which can lead to incorrect RCU behavior.

A fix in the Linux kernel for a memory leak in blk_revalidate_disk_zones(). On zone revalidation error, memory allocated for args.zones_cond was not freed.

In the Linux kernel blkcg_maybe_throttle_current() function, a missing put_disk() call on the error path causes a disk reference leak. The disk will never be freed.

A deadlock was discovered in the Linux kernel's sysfs mechanism during the RAID array clear operation (array_state=clear). The issue stems from incorrect reference release ordering, leading to recursive locking and a potential deadlock warning.

A fix in the Linux kernel for ublk where the per-IO canceled flag was not reset after fetch, potentially preventing cancellation on server failure.

In the Linux kernel, the md (RAID) module has a deadlock during raid456 reshape. I/O operations waiting for reshape progress can block array suspend because reshape is frozen and active IO references are not released.

A deadlock was discovered in the Linux kernel's Btrfs subsystem between a reflink operation and a transaction commit when the flushoncommit mount option is used. The issue occurs when reflink copies an inline extent beyond the destination file's current i_size, causing threads to block each other.

In the Linux kernel amd-pstate driver, the amd_pstate_epp_cpu_init() function has a memory leak. On failure to set epp, the cpudata object is not freed.

In the Linux kernel's PCI subsystem, a use-after-free (UAF) vulnerability was found related to the driver_override field. When a driver is probed via __driver_attach(), the bus's match() function is called without holding the device lock, allowing concurrent access to the driver_override field without synchronization, leading to UAF.

In the Linux kernel's platform/wmi subsystem, a use-after-free (UAF) vulnerability was found related to the driver_override field. When a driver is probed via __driver_attach(), the bus's match() function is called without holding the device lock, allowing concurrent access to the driver_override field without synchronization, leading to UAF.

In the Linux kernel, the vdpa subsystem has a use-after-free (UAF) vulnerability during driver matching. The match() function is called without holding the device lock, allowing unprotected access to the driver_override field.

In the Linux kernel, the s390/cio subsystem has a use-after-free (UAF) vulnerability during driver matching. The match() function is called without holding the device lock, allowing unprotected access to the driver_override field.

In the Linux kernel, in the s390/ap subsystem, a potential use-after-free (UAF) occurs during AP mask updates. __ap_revise_reserved() accesses the driver_override field without locking, racing with driver_override_store().

In the Linux kernel, the fsl-mc bus has a use-after-free (UAF) vulnerability during driver matching. The match() function is called without holding the device lock, allowing unprotected access to the driver_override field.

In the Linux kernel perf/amd/ibs driver, perf_allow_kernel() is called from NMI context, which is unsafe and can cause a crash. Permissions should be cached at initialization.

In the Linux kernel ath11k driver, memory leaks occur in ath11k_mac_setup_bcn_tmpl_ema() and ath11k_mac_setup_bcn_tmpl_mbssid(). Allocated beacon template memory is not freed on error.

In the rtlwifi driver in the Linux kernel, there is a use-after-free (UAF) vulnerability due to an unfinished irq_prepare_bcn_tasklet. When the card is detached or initialization fails, ieee80211_hw is freed, but the tasklet may still be running, leading to access to freed memory.

A null pointer dereference vulnerability was found in the Linux kernel's bpf_lwt_xmit_push_encap function. The issue occurs when skb->_skb_refdst is not initialized during BPF program test runs, leading to a kernel crash.

In the Linux kernel, the s390 BPF JIT subsystem lacks zero extension for BPF program return values and kfunc arguments. According to the s390x ABI, callers must zero-extend unsigned arguments and callees must zero-extend unsigned return values, which is currently not implemented.

A bug in the Linux kernel's pte_frag_destroy function for PowerPC causes a 'Bad page state' error when freeing PTE table fragments. The issue occurs when pt_frag_refcount reaches zero but the 'active' flag on the folio is not cleared before pagetable_free(), leading to a kernel panic during process exit.

A race condition in the Linux kernel during unmap operations on PMD migration entries has been fixed. The issue occurs when move_pages and munmap syscalls are executed concurrently, triggering a VM_BUG_ON in pmdp_huge_get_and_clear_full. The vulnerability affects PowerPC 64-bit architecture.

In the Linux kernel libertas driver, usb_kill_urb() is called from interrupt context, which can cause synchronization issues. Instead, the driver now checks for pending URBs.

A fix in the Linux kernel for potential deadlock in BPF local storage. Deleting selem in NMI context could deadlock, so an error check was added.

In the mt76 WiFi driver (mt7925 model), there is a bug in mt7925_mac_write_txwi where missing NULL check for 'vif' pointer can lead to NULL pointer dereference and kernel panic.

In the mt76 WiFi driver, there is a memory leak when destroying the device. Rx queues have an associated page_pool that is not destroyed in mt76_dma_cleanup, and pages are not returned to the pool when WED is not enabled.