Linux kernel vulnerabilities

In the Linux kernel, the mt7925 driver (mt76) has a potential deadlock in mt7925_roc_abort_sync. It calls cancel_work_sync() while roc_work() holds dev->mt76.mutex, causing a lockup. This occurs during station removal.

In the Linux kernel, in the mt76 driver, mt76_connac_mcu_alloc_sta_req() allocates an skb that should be freed by mt76_mcu_skb_send_msg(). However, if an intermediate function (mt76_connac_mcu_sta_wed_update() or mt76_connac_mcu_sta_key_tlv()) fails before sending, the allocated skb leaks.

In the Linux kernel, a potential deadlock was found in the mt76 mt7921 WiFi driver in the mt7921_roc_abort_sync function. This function can deadlock on cancel_work_sync() when roc_work() holds dev->mt76.mutex and the caller already owns the same mutex. The deadlock occurs during station removal in the path mt76_sta_remove -> mt7921_mac_sta_remove -> mt7921_roc_abort_sync.

In the Linux kernel, the mt76 driver has a deadlock in mt76_remain_on_channel() and mt76_roc_complete(). They call mt76_set_channel() while already holding dev->mutex, causing a lockup.

In the Linux kernel, the configuration option was switched from CONFIG_CFI_CLANG to CONFIG_CFI, as it is now compiler-agnostic. Using the old name results in the code being compiled out, meaning CFI failures for btf_dtor_kfunc_t would still trigger.

In the mt76 (mt7915) WiFi driver in the Linux kernel, a use-after-free bug was found in mt7915_mac_dump_work(). During PCI device detachment, crash_data is freed before pending work is canceled, leading to dereference of freed memory.

In the Linux kernel's mt76 (mt7996) WiFi driver, a use-after-free bug occurs during PCI chip detachment. The mt7996_mac_dump_work() function may dereference already freed crash_data because dump_work is not canceled before memory deallocation.

In the Linux kernel, dev_map_redirect_multi() for DEVMAP_HASH used unsafe hlist_for_each_entry_safe() instead of RCU-safe hlist_for_each_entry_rcu(). On weakly-ordered architectures (ARM64, POWER), this can lead to observing a partially-constructed node.

A vulnerability in the Linux kernel regarding abuse of kprobe_write_ctx via freplace programs. Uprobe programs can modify struct pt_regs, and through kprobe+freplace they can affect kernel function arguments. The fix disallows attaching freplace programs to kprobe with different kprobe_write_ctx values.

In the Linux kernel, a vulnerability in BPF leaves the offload->prog pointer stale after JIT compilation with constant blinding, pointing to a freed program. This causes a page fault when the network namespace is destroyed.

In the Linux kernel, the brcmfmac driver for Broadcom Wi-Fi cards has a bug where the return value of brcmf_chip_add_core() is not checked for error pointers. This can lead to dereferencing an error pointer and potentially cause system instability.

In the Linux kernel's BPF subsystem, adjust_reg_min_max_vals() incorrectly tracks register delta when src_reg == dst_reg (e.g., rX += rX). Modifying dst_reg before reading src_reg sets an incorrect delta, causing a verifier-vs-runtime mismatch.

In the Linux kernel, a vulnerability was found in the qdisc_pkt_len_segs_init() function, which did not ensure that GSO packet headers are in the skb->head buffer. This can cause errors in network drivers that expect headers in this buffer. Added proper checking and early rejection of malicious packets.

In the Linux kernel, a vulnerability was found in the BPF verifier regarding ld_{abs,ind} instructions in subprograms. The verifier did not simulate the failure path of packet data load, which could lead to incorrect analysis. Added simulation of both success and failure paths, similar to tail calls.

In the Linux kernel, in the BPF subsystem, a use-after-free (UAF) occurs when filling info for offloaded maps or programs. bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns() use get_net() on a netdev's netns that may already be destroyed.

In the Linux kernel, the bcmgenet driver has a bug leaking free buffer descriptors (free_bds) when reclaiming the TX queue. Dropped frames are not returned to the pool, potentially leading to resource exhaustion.

In the Linux kernel, the open-coded task_vma BPF iterator has a use-after-free (UAF) vulnerability. The iterator reads task->mm locklessly and does not call mmget(), allowing the mm_struct to be freed during concurrent process exit.

In the Linux kernel task_vma iterator, there is a lock ordering issue. Holding the VMA lock during BPF program execution can lead to deadlocks. The fix takes a VMA snapshot and releases the lock before returning.

In the Linux kernel, the bpf_fd_array_map_clear() function is missing a cond_resched() call in its loop, which can cause RCU stalls and system crashes when clearing PROG_ARRAY maps with many entries.

In the 6pack (hamradio) driver in the Linux kernel, the sixpack_receive_buf() function does not skip bytes with TTY error flags, leading to processing of uninitialized data and KMSAN reporting an uninit-value read.

In the Linux kernel's BPF subsystem, a vulnerability was found due to inconsistent ID mapping for scalar registers with the BPF_ADD_CONST flag. The regsafe() function fails to verify that underlying base IDs are consistent with existing mappings, potentially leading to incorrect verifier state pruning.

In the Linux kernel, a vulnerability in the cls_fw classifier allows a filter to be published to the datapath before the change() function is called, leading to a NULL pointer dereference when an invalid filter is processed.

A memory leak was found in the Linux kernel in the deferred packet drop mechanism of qdiscs. When the root qdisc does not implement the TCQ_F_DEQUEUE_DROPS flag, packets to be freed are not released and remain on a local list.

In the Linux kernel, in BPF sock_ops programs, when the destination register is the same as the source, the SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros fail to zero the destination register in the !fullsock / !locked_tcp_sock path. This leads to stack out-of-bounds read and kernel pointer leak.

In the Linux kernel, the use of RDS/IB is now restricted to the initial network namespace. The RDS/IB code does not work correctly in other namespaces, which could lead to errors or unexpected behavior.

In the Linux kernel, an out-of-bounds read occurs in pcpu_init_value when copying data from a CGROUP_STORAGE map to a pcpu map with the same value size not rounded up to 8 bytes. The issue arises when the source has less than 8 bytes and the copy is rounded up.

In the Linux kernel, the ppp driver lacks a requirement for CAP_NET_ADMIN in the target network namespace for unattached ioctls. A local unprivileged user can create a new user namespace, gain CAP_NET_ADMIN only in that namespace, and then issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against an inherited network namespace.

In the Linux kernel, bpf_prog_test_run_skb() calls eth_type_trans() and then uses skb->protocol to initialize sk family and address fields for the test. For IPv4/IPv6 packets, it may access ip_hdr(skb) or ipv6_hdr(skb) even when the test input only contains an Ethernet header. The fix rejects the input earlier if the Ethernet frame carries IPv4/IPv6 EtherType but the L3 header is too short.

A vulnerability in the Linux kernel in the Bluetooth HCI UART driver (hci_ldisc). When hci_register_dev() fails, the HCI_UART_PROTO_INIT flag is not cleared, potentially leading to recv being called after resources are freed. The fix clears the flag before closing.

In the Linux kernel, a vulnerability was found in the Bluetooth stack where hci_conn_request_evt() calls hci_connect_cfm() without holding the hdev->lock when the protocol sets HCI_PROTO_DEFER. This can lead to a use-after-free (UAF) if the connection is deleted concurrently.

In the Linux kernel, missing channel lock in l2cap_ecred_reconf_rsp allows a remote BLE device to send a crafted L2CAP ECRED reconfiguration response, potentially corrupting the channel list while another thread iterates it.

A vulnerability in the Linux kernel's SCTP over UDP implementation fails to disable BH before calling tunnel xmit functions, causing unbalanced recursion counters and potential packet drops.

A null-pointer dereference vulnerability was found in the Linux kernel's xdp_master_redirect() function when redirecting XDP traffic to a master interface that has not been brought up. The issue occurs when a bond interface in round-robin mode is never opened (bond_open()), leaving the per-CPU rr_tx_counter uninitialized, leading to a kernel panic.

In the Linux kernel, the DRM komeda driver had an integer overflow vulnerability in AFBC framebuffer size validation. The minimum required buffer size calculation added AFBC payload size to the framebuffer offset without overflow checking, potentially allowing an undersized GEM object and out-of-bounds memory access.

In the Linux kernel PCI endpoint subsystem, a vulnerability was found in pci_epf_alloc_doorbell(). After a failed MSI vector allocation, the doorbell message array is freed but EPF structure pointers still point to freed memory, potentially causing a double-free. Additionally, missing checks for already allocated doorbells allow memory leaks or overwriting existing allocations.

In the Linux kernel, the DRM sun4i backend driver has an error pointer dereference bug. The function drm_atomic_get_plane_state() can return an error pointer that is not checked before use, potentially causing a system crash.

In the Linux kernel, the ASoC STI driver never frees regmap_field objects allocated during player init, potentially leaking resources when the driver is removed. The fix switches to devm_regmap_field_alloc() to automatically manage allocation lifetimes.

In passthrough mode of the dm-cache driver in the Linux kernel, a NULL pointer dereference occurs. When invalidating a cache entry and the bio prison cell lock fails due to a concurrent write to the same block, mg->cell remains NULL. The invalidate_complete() function attempts to unlock and free the cell without checking its validity, causing a system crash.

In the Linux kernel, the dm cache module has a bug in passthrough mode causing write hangs. The invalidate_remove() function mishandles write hit bios after cache invalidation, dropping the bio without submission.

In the Linux kernel, the SMQ cache policy for dm-cache devices lacks locks when invalidating cache blocks in passthrough mode. Concurrent invalidation operations from multiple workers can cause data races on the allocated blocks counter and use-after-free issues in internal data structures.

In the Linux kernel, the dm-cache module has a vulnerability in dirty mapping checking when switching to passthrough mode. The bug arises from an assumption that table reload occurs after suspension, which is broken by LVM's preload mechanism. This can lead to loading dirty mappings into passthrough mode, causing data loss.

A memory leak was discovered in the Linux kernel's dm_cache_metadata_abort function within the dm-cache module. When the root_lock cannot be acquired because the block manager is read-only, the temporary block manager created before the lock is not released, causing a memory leak.

In the Linux kernel, a vulnerability in the dm log module causes an out-of-bounds write due to a 32-bit integer overflow in region_count. The variable cannot hold the 64-bit result of sector division, leading to undersized buffer allocation and subsequent heap memory corruption.

In the Linux kernel graphics driver (cdns-mhdp8546-core), the connector pointer is not set early enough in atomic_enable(). During error recovery paths this can lead to a NULL pointer dereference and system crash.

A missing TLB and context cache invalidation after updating DDT/PDT entries was found in the Linux kernel's RISC-V IOMMU driver. The RISC-V IOMMU specification (Sections 6.3.1 and 6.3.2) mandates these invalidations to ensure address translation consistency.

In the Linux kernel, the drm/msm/dpu driver has a mismatch between voltage and frequency during runtime resume. Calling dev_pm_opp_set_rate(dev, 0) drops the MMCX rail to MIN_SVS while the core clock remains at highest frequency, potentially causing instability or system crash.

In the Linux kernel, a locking bug was found in the drm/msm driver's VM_BIND UNMAP operation. An incorrect argument caused objects involved in UNMAP operations not to be always locked. The issue affected non-_NO_SHARE buffer objects.

In the Linux kernel, a vulnerability was found in the AMD IOMMU subsystem's clone_alias() function. It incorrectly assumed the first argument (pdev) always points to the original device, while it could be an alias. This caused the wrong devid to be used when copying DTE entries, leading to incorrect or stale entries being propagated to the alias device.

In the ASoC audio driver for Qualcomm platforms (qdsp6), the widget type is not checked before accessing private data. A virtual widget may lack an associated DSP graph, leading to incorrect memory access.

In the Linux kernel, the PCI driver for Tegra194 has a CBB timeout caused by DBI register access before core power-on. When PERST# is deasserted twice, pci_epc_deinit_notify() and dw_pcie_ep_cleanup() are called before reset_control_deassert(), causing a timeout.