Linux kernel vulnerabilities

In the Linux kernel, the net: mana driver's mana_gd_query_max_resources() sizes gc->num_msix_usable from resp.max_msix and the CPU count but never from the device MSI-X table. On a 1792 vCPU M-series VM this yields 1793 while the table has 1024 entries, causing an out-of-bounds access and a page fault.

In the Linux kernel, net/rds rds_cong_map_updated() uses waitqueue_active() without the required memory barrier, leading to a store-buffering pattern. The updater can observe an empty wait queue while the waiter still sees the port as congested, so no wake-up is issued.

In the Linux kernel, the octeontx2-pf driver lacks NULL checks before calling test_bit() on the af_xdp_zc_qidx pointer. This pointer is only allocated for AF_XDP zero-copy paths, while representors and other paths leave it NULL, causing a NULL dereference when switching devlink eswitch mode.

In the Linux kernel, the octeontx2-af driver leaks memory and mishandles resource teardown when rvu_mbox_init() is called repeatedly. Each call allocated a new ng_rvu object, overwriting the previous pointer, and error paths freed resources incorrectly, leaving mailbox memory in use.

In the Linux kernel, the net/sched act_skbmod module has header length calculation errors. The tcf_skbmod_act() function calls skb_network_header_len() without guaranteeing transport_header is set and calls skb_mac_header_len() on L3 devices, causing warnings and incorrectly dropping valid short packets.

In the Linux kernel, the copy_net_ns() function has a resource leak in its error handling path. When preinit_net() fails, the code jumps to the dec_ucounts label, skipping the release of resources allocated by net_alloc(), such as key_remove_domain() and net_passive_dec().

In the Linux kernel, the net/sched fq module has an integer overflow when computing quantum and initial_quantum. A device with a huge MTU makes psched_mtu() return 0x80000000, and multiplication by 2 and 10 wraps to zero, causing an infinite loop in fq_dequeue() and a soft lockup.

In the Linux kernel, the net/sched fq_codel module fails to clamp quantum and mtu values. A device with a huge MTU overflows the signed flow->deficit to INT_MIN, causing an infinite loop and soft lockup, and also silently disables the CoDel mechanism.

In the Linux kernel, the net/sched fq_pie module fails to clamp the default quantum value. A device with a huge MTU overflows the signed flow->deficit to INT_MIN in fq_pie_qdisc_dequeue(), causing an infinite loop and soft lockup.

In the Linux kernel, the net/sched hhf module lacks an overflow check when setting quantum. A device with a huge MTU overflows the signed deficit in hhf_dequeue(), causing an infinite loop, and also causes -EINVAL when adding qdisc with options.

In the Linux kernel, the net/sched sfq module fails to clamp the quantum value. A device with a huge MTU makes slot->allot equal INT_MIN, and INT_MIN + INT_MIN toggles between INT_MIN and 0, causing an infinite loop in sfq_dequeue() and a soft lockup.

In the Linux kernel, the net/sched: sch_teql module has a vulnerability where teql_master_xmit() sets skb->dev to the slave device before calling ndo_start_xmit(), but does not restore it when transmission fails. This causes the packet with a stale skb->dev to be queued on the ARP queue, and after the slave device is deleted, a use-after-free (UAF) occurs.

In the Linux kernel, st33zp24_status() ignores the transport read result and returns data even when no byte was received. In the I2C transport, when the register-select write is short or fails, i2c_master_recv() is skipped, leaving data uninitialized. The resulting stack value can be interpreted as TPM_STS flags and let status checks complete spuriously.

In the Linux kernel, ACOMP_REQUEST_ON_STACK() reserves only enough storage for the synchronous fallback. When an async implementation is selected, acomp_request_clone() copies only the stack-sized object, so the clone has no storage for the async provider request context. Providers such as QAT write past the allocation through acomp_request_ctx(), reported by KASAN as a slab OOB write.

In the Linux kernel, snd_soc_dapm_put_enum_double() rejects item[0] once it reaches e->items, but lets item[1] be equal to it. Both go to snd_soc_enum_item_to_val(), which indexes e->values with no bound of its own, so an enum with a value table reads one element past the end. Only adav80x pairs a value table with two shifts.

In the Linux kernel, ftrace_direct_multi_init() assigns kthread_run()'s return value to simple_tsk without an IS_ERR() check. When kthread_run() fails it returns ERR_PTR(-ENOMEM), but init still returns 0, so the module loads with simple_tsk holding an error pointer. On unload, ftrace_direct_multi_exit() passes that ERR_PTR to kthread_stop(), leading to a null-pointer-dereference.

In the Linux kernel, IPPROTO_SMC sockets create an internal TCP sock ("clcsock") from the proto->init hook. When socket creation fails after proto->init has run — e.g. a cgroup BPF program attached to BPF_CGROUP_INET_SOCK_CREATE denies the socket — sk_common_release() only invokes sk_prot->destroy if it is set, but neither smc_inet_prot nor smc_inet6_prot defines it, and smc_destruct() returns early. As a result, every failing socket(AF_INET, SOCK_STREAM, IPPROTO_SMC) call leaks one tcp_sock.

In the Linux kernel, in the drm/xe driver, having scratch enabled does not make a VM capable of handling recoverable page faults. Allowing scratch VMs through the ASID lookup also admits dma-fence mode VMs. If such a VM faults on an already valid VMA, the handler reports success without fixing the fault, causing the GPU to retry indefinitely.

In the Linux kernel, in virtio-net the user can specify any gso_size in a packet crafted with an AF_PACKET PACKET_VNET_HDR socket, even smaller than TCP_MIN_GSO_SIZE = 8. Since GSO_MAX_SIZE = 8 * GSO_MAX_SEGS = 8 * 65535, with gso_size < 8 there is a risk of overflowing the 16-bit gso_segs field when dividing the SKB length by gso_size.

In the Linux kernel, in netfilter nf_tables the hardware offload step is performed before building the chain blob. Allocating the chain blob before the ruleset offload reduces the chance of entering an inconsistent state where the offloaded ruleset in the NIC and the software ruleset differ.

In the Linux kernel, in netfilter nf_tables both the dynset and newsetelem path clone the existing set expressions when setting set element expressions if no override expressions are provided. This results in a double clone. The fix adds an override_exprs flag to annotate override expressions and conditionally releases expressions, also fixing a module refcount imbalance for the connlimit expression.

In the Linux kernel's ALSA control layer, there is a NULL pointer dereference vulnerability. A write-only control element without a get callback can be created, leading to a kernel Oops in snd_ctl_led_notify().

Vulnerability in the Linux kernel net/sched component allows causing a soft lockup via crafted size table (stab) in DRR and ETS schedulers. An attacker with CAP_NET_ADMIN in a namespace can trigger a huge qdisc_pkt_len value (~1 GiB), leading to a loop in the scheduler and system hang.

In the Linux kernel's slip driver, there is a use-after-free vulnerability in slip_receive_buf() when racing against a TTY hangup. slip_hangup() only calls slip_close(), causing concurrent access to freed memory.

In the Linux kernel's FEC driver, fec_ptp_stop() is called unconditionally on error and removal paths, but fec_ptp_init() is only called when bufdesc_ex is available. This can stop PTP that was never initialized.

A bug in the Linux kernel's usbatm (USB ATM) module was found where the ci_range fields vpi_bits and vci_bits were initialized to ATM_CI_MAX (-1). These values are used as bit shift counts in net/atm/common.c, causing undefined behavior (shift-out-of-bounds) and UBSAN warnings. The fix sets vpi_bits to 8 and vci_bits to 16.

In the Linux kernel's TCP implementation, there is corruption of urgent data on multi-segment retransmission. The retransmit path lacks a guard against multi-segment TSO, causing wrong urg_ptr copying and the receiver treats in-band data as urgent.

In the Linux kernel, htb_classify() in net/sched/sch_htb did not bound the number of hops between HTB inner classes selected by filters. A filter on an inner class can point back to itself or form a cycle, causing an infinite loop in the packet classification path with the qdisc lock held and BH disabled — a single packet triggers a soft lockup or kernel panic. The fix introduces a hop counter bounded by TC_HTB_MAXDEPTH and drops the packet with a rate-limited warning once the limit is exceeded.

In the Linux kernel's TCP implementation, devmem TX without zero-copy is not enforced. When NETIF_F_SG is absent, the copy path may attempt invalid iovec access, causing errors or breaking invariants.

In the Linux kernel, free_pages_nolock() uses spin_trylock() in NMI context on uniprocessor (UP) systems, which is unsafe. The bug affects the page freeing path and can crash the kernel. It is likely exploitable by local attackers for privilege escalation.

In the Linux kernel USB gadget ffs driver, the io_data structure stores a pointer to the submitting task's mm_struct but does not hold a reference while async requests are pending. This can cause a use-after-free if the task exits before completion handling finishes. The fix takes a reference with mmgrab() when queuing and releases it with mmdrop() on completion.

In the Linux kernel USB gadget f_fs driver, a use-after-free exists in the AIO error path. When ffs_epfile_io() fails with an error other than -EIOCBQUEUED, the io_data structure is freed, but the kiocb cancel function remains armed and points to the freed pointer. A concurrent cancel (e.g., sys_io_cancel()) can cause a use-after-free. The fix safely disarms the cancellation via kiocb->ki_complete() and returns -EIOCBQUEUED.

In the Linux kernel zram module, the slot lock bit is set in the wrong position on 64-bit big-endian systems. Instead of landing in the flags field, it lands in ac_time, so with ZRAM_TRACK_ENTRY_ACTIME enabled, storing the access time wipes out the held lock bit and lets another CPU take the same slot lock. An access time value with that bit set can make the slot appear locked forever. The fix shifts the lock bit into the flags half on big-endian 64-bit.

In the Linux kernel, the HID sony driver fails to remove a controller from the device list when HID core input device registration fails. The devres-managed sony_sc is freed while its list node remains linked, leading to use-after-free when the next matching controller is handled.

In the Linux kernel, NFSD admin state-revocation handlers (unlock_filesystem, NFSD_CMD_UNLOCK_FILESYSTEM, NFSD_CMD_UNLOCK_EXPORT) only check nn->nfsd_serv, which is set before nn->conf_id_hashtbl is allocated. This leads to a NULL dereference when the server has not yet started.

In the Linux kernel, get_estimated_bw() in the drm/amd/display driver divides by bw_granularity, which is zeroed and only populated after DP_TUNNELING_BW_ALLOC_CAP_CHANGED is handled. If a USB4/DPIA device reports an estimated-bandwidth change before a capability change, the DPCD interrupt handler triggers a division by zero.

In the Linux kernel, the usb image mdc800 driver uses kmalloc() for irq_urb_buffer and download_urb_buffer in usb_mdc800_init(). If a shorter message is received in mdc800_usb_irq() or mdc800_usb_download_notify(), stack data may leak.

In the Linux kernel, snd_usbmidi_us122l_output() in ALSA usb-audio picks a count of 2 for anything slower than high speed without relating it to ep->max_transfer. With a device declaring a one-byte bulk endpoint, the memset computes 1 - 2 in int and wraps to SIZE_MAX, causing an out-of-bounds write.

A null-pointer dereference vulnerability exists in the Linux kernel's USB gadget MIDI 2.0 function, specifically in f_midi2_free_ep_reqs(). When configuring a MIDI 2.0 gadget via configfs with block direction set to SNDRV_UMP_DIR_INPUT, the midi1_ep_out endpoint is not initialized, leaving usb_ep->card as NULL. When the host later sets the alternate setting, f_midi2_free_ep_reqs() is called for the uninitialized endpoint, causing a kernel crash.

In the Linux kernel, f_midi2_opts_str_show() in the USB gadget driver has a use-after-free. Callers dereference the opts->info.<field> pointer before taking the lock, racing with f_midi2_opts_str_store(), which frees the old string under the lock. A concurrent attribute write can cause a read of a freed pointer.

In the Linux kernel, f_midi_alloc() does not initialize the work structure if f_midi_bind() is never called. The condition in f_midi_free then becomes true, causing a warning in __flush_work due to work->func = 0. The fix moves INIT_WORK from f_midi_bind() to f_midi_alloc().

In the Linux kernel, gadget_dev_ioctl() reads dev->gadget before acquiring dev->lock, while dev->state is checked after acquiring the lock. A concurrent bind can change the device state, leaving a stale NULL gadget pointer and causing a NULL pointer dereference at gadget->ops->ioctl.

In the Linux kernel, usb_put_function_instance() attempts to dereference fd inside the fi struct in the uvc_alloc_inst() error path. However, fd is not allocated until later in try_get_usb_function_instance(), so it is guaranteed to be NULL in the error path. The fix adds a NULL check for fi->fd.

In the Linux kernel, the staging rtl8723bs driver's rtw_action_frame_parse() does not check the frame_len parameter before indexing into the frame body. Reading frame_body[0] and frame_body[1] requires frame_len >= 26, so a shorter frame (e.g. 24 bytes) causes a 1-2 byte out-of-bounds read. This is reachable from rtw_cfg80211_monitor_if_xmit_entry() and cfg80211_rtw_mgmt_tx().

In the Linux kernel, the staging rtl8723bs driver's rtw_restruct_wmm_ie() scans the in_ie buffer for a WMM IE. When the 'i + 5 < in_len' check fails near the end of the buffer, execution falls through to 'i += (in_ie[i + 1] + 2)', which at i == in_len - 1 causes a 1-byte out-of-bounds read. A previous fix added the guard only to the match condition, not to the advance.

In the Linux kernel, the newly added show_event_filters and show_event_triggers files do not take a reference to the trace_array they display. Without this reference, the trace_array may be freed via 'rmdir' while a task is reading the file, causing a use-after-free. The fix makes opening both files take the reference via trace_array_get().

A use-after-free vulnerability was found in the Linux kernel tracing mechanism. Opening an options file did not take a reference to the trace_array structure, which could lead to use of freed memory when one process opened the file while another removed the instance. The issue was fixed by adding the trace_array_options_get() function that takes a reference before use.

In the Linux kernel, the scsi bsg completion copies scmd->sense_len to the user response buffer without honoring max_response_len. After a valid sense, the midlayer sets sense_len to the real length (up to SCSI_SENSE_BUFFERSIZE), overrunning a smaller user buffer.

In the Linux kernel, the scsi bsg function scsi_bsg_uring_cmd() reads bsg_uring_cmd from the shared mmap'd SQE, allowing userspace to change a field between check and use (TOCTOU). request_len can grow past sizeof(scmd->cmnd) after the bound check and overflow scmd->cmnd in copy_from_user().

In the Linux kernel, the scsi pm8001 driver function pm8001_request_msix() uses index i instead of j in the rollback loop when request_irq() fails, passing the wrong IRQ/dev_id pair to free_irq(). Earlier registered handlers remain installed.