Linux kernel vulnerabilities

In the Linux kernel, the dax/fsdev module's fsdev_dax_probe() sets pgmap->ops and pgmap->owner but never clears them on unbind. For a static device the pgmap is shared and long-lived, so after fsdev unbinds a static device the stale fsdev_pagemap_ops survives on the shared pgmap. A subsequent memory_failure can then dispatch through the stale, possibly freed handler.

In the Linux kernel, the dax module's dax_holder_notify_failure() reads dax_dev->holder_ops twice without READ_ONCE() — once for the NULL check and once for the indirect notify_failure() call. A concurrent fs_put_dax() can clear holder_ops between the two reads, so the check observes a non-NULL pointer while the call dereferences NULL.

In the Linux kernel, the irqchip/renesas-irqc driver leaks resources on driver removal. The driver allocates domain generic chips at probe, but on removal they are not automatically freed because the domain flags do not include IRQ_DOMAIN_FLAG_DESTROY_GC. This leaks the structures and leaves them on the global list, where they may later be accessed by generic interrupt chip suspend, resume, or shutdown callbacks after the driver has been removed.

In the Linux kernel, the media bcm2835-unicam driver failed to free the asc structure allocated by v4l2_async_nf_add_fwnode_remote() in error and module removal paths. This caused a memory leak detected by kmemleak after rmmod.

In the Linux kernel OPP subsystem, the initialization order of pointers was changed so that *opp_table was initialized after *opp. This altered the cleanup function order and caused use-after-free errors when _opp_kref_release accessed the already freed opp->opp_table.

In the Linux kernel drm/amd/display driver, a teardown race exists with DM I2C adapters. Adapters can remain visible to userspace during DM teardown, and a concurrent i2c-dev transfer may call amdgpu_dm_i2c_xfer() after DM state is destroyed, leading to a NULL pointer dereference.

In the Linux kernel drm/bridge tc358767 driver, tc_aux_transfer() did not clamp the AUX read size to the request size. The controller could report up to 255 bytes, overflowing the 16-byte auxrdata stack buffer and the caller buffer.

A use-after-free vulnerability was found in the Linux kernel's PAT (Page Attribute Table) mechanism for x86. The issue occurs during concurrent module loading/unloading on multiple CPUs, when the large-page collapse operation is not protected by the proper lock, leading to a write to freed memory and system crash.

In the Linux kernel wifi iwlwifi driver, the loop counter 'count' in iwl_fwrt_dump_error_logs was declared as u8 while num_pc is u32. If firmware advertises more than 255 PC entries, the counter wraps and the loop never terminates, potentially causing an infinite loop or reading past the pc_data array.

In the Linux kernel wifi iwlwifi mvm driver, iwl_mvm_frob_txf_key_iter() had an off-by-one error in calculating the start offset for key sanitization. This zeroed one byte before the match and left the final key byte unsanitized.

In the Linux kernel wifi iwlwifi driver, iwl_dbg_tlv_alloc_fragments could cause a division by zero when num_frags was 0. Missing checks on the required size and fragment count allowed this situation.

In the Linux kernel, the host1x driver's debug output helpers used vsnprintf(), which returns the length the formatted string would have reached with an unbounded buffer. This value was passed as the number of bytes to emit, potentially causing a read past the end of the output buffer if the string exceeded 256 bytes. The issue affected debugfs files and was unlikely in practice.

In the Linux kernel, the drm/msm/adreno driver's a6xx_gpu_init() function has a use-after-free bug on the error path. The a6xx_destroy() function frees 'a6xx_gpu', and then 'adreno_gpu' points to freed memory. The fix preserves the error code before freeing the memory.

In the Linux kernel, the drm/msm driver's recover_worker function leaks a reference to the task_struct. get_pid_task() increments the reference count, but the corresponding put_task_struct() is missing in the else branch, leaking a reference on every GPU hang recovery.

In the Linux kernel, the drm/msm driver's msm_ringbuffer_new() destroys a partially initialized ring through msm_ringbuffer_destroy() when an allocation or scheduler setup step fails. If drm_sched_init() fails before finishing initialization, the failure path still calls drm_sched_fini(), which assumes initialized scheduler state. The fix tracks successful scheduler initialization and calls drm_sched_fini() only after drm_sched_init() returned 0.

In the Linux kernel, the scsi: ufs: core driver has a potential memory reclaim deadlock in the TX EQTR context. Functions ufshcd_tx_eqtr(), __ufshcd_tx_eqtr(), and ufs_qcom_get_rx_fom() allocate memory with GFP_KERNEL, which can trigger direct reclaim that depends on I/O to the UFS device, while the queue is quiesced, leading to deadlock. The fix uses memalloc_noio_save/restore() in ufshcd_tx_eqtr() to cover all allocations in the call tree.

In the Linux kernel, the usb: gadget: f_uac1_legacy driver's UAC1_STR_ATTRIBUTE macro defines show/store handlers for the fn_play, fn_cap, and fn_cntl string options. The store function contains an inverted null check on the kstrndup() return value, causing every write attempt to return -ENOMEM on success and dereference a NULL pointer on allocation failure. The attributes have been broken and unused for years. The fix removes the macro and the three attributes.

In the Linux kernel, the UDF filesystem's udf_symlink_filler() can enter udf_pc_to_char() with a partial pathComponent header. The fix adds validation that enough input remains for a complete header before accessing it, rejecting malformed symlink data that would otherwise cause an out-of-bounds read.

In the Linux kernel, the speakup: keyhelp driver's help_init() builds letter_offsets[] by using the first byte of each function name as an index via `(start & 31) - 1`. If function names are overridden from sysfs (root) with a name starting outside [a–z], the index underflows or exceeds the array, leading to OOB write. The fix checks the first letter in help_init() and returns an error if it is not in the [a–z] range.

In the Linux kernel, the misc: bcm-vk driver has an ordering issue with msgq_inited. bcm_vk_sync_msgq() fills the message queue information and then sets msgq_inited. Readers call bcm_vk_drv_access_ok() before accessing the queues. atomic_set()/atomic_read() do not order those accesses, so a reader can see msgq_inited set while still seeing stale queue information. The fix uses release when publishing the initialized queues and acquire when checking the gate.

In the Linux kernel, the ad525x_dpot driver created sysfs files manually in probe, causing issues with rolling back partial sysfs state on error and with removing files on device detach. The vulnerability was fixed by moving device attributes into driver core dev_groups and adding an is_visible() callback that exposes only attributes supported by the probed device.

In the Linux kernel, the ipack ipoctal driver had three issues when a device was removed while a tty session was active: a use-after-free of struct ipoctal, a NULL dereference in ipoctal_write_tty(), and a use-after-free in ipoctal_cleanup(). Fixes introduce kref-based lifetime management, a NULL check for xmit_buf, and a "removed" flag checked in tty operations.

In the Linux kernel, in the mtdswap module, a debugfs setup failure after successful blktrans registration could free the mbd_dev structure twice. The fix clears the local pointer after deregistration so the common cleanup path does not free the blktrans object twice.

In the Linux kernel, mtd_add_partition() did not reject the special offset value MTDPART_OFS_RETAIN (-3), leading to a WARN_ON in add_mtd_device() when called through the BLKPG ioctl on NAND devices. The RETAIN value relies on cur_offset being the end of the previous partition, but in the dynamic partition path cur_offset equals the offset argument itself, causing undefined behavior.

In the Linux kernel, in the drm/v3d driver, the BO list was only attached to the last job in a chain, so when the last job was a trailing CACHE_CLEAN job, the job actually consuming the BOs had no implicit dependencies. This could allow one context to read a BO while another was still writing it, causing data corruption. The fix attaches BOs to the consuming job and adds a has_implicit_dep flag.

In the Linux kernel, the BPF interpreter does not support arena-related instructions, yet interpreter fallback was allowed for them, leading to a BUG_ON() hit in ___bpf_prog_run() at runtime. The fix sets jit_required to true when an arena map is used in the program to disallow interpreter fallback.

In the Linux kernel, the BPF interpreter does not recognize the BPF_JMP|BPF_JA|BPF_X instruction used for the insn_array map, leading to a BUG_ON() hit in ___bpf_prog_run() at runtime. The fix sets jit_required to true when an insn_array map is used in the program to disallow interpreter fallback for the gotox instruction.

In the Linux kernel, the dw-edma dmaengine driver's dw_edma_abort_interrupt() drops vc.lock before updating request and channel status. In that window issue_pending() can observe the old busy state and skip starting queued descriptors, after which the abort handler overwrites the channel status as idle, permanently stranding the new descriptors.

In the Linux kernel, the dw-edma dmaengine driver's pause() and resume() read and update channel state without holding vc.lock, while interrupt handlers update the same state under it. This can record a pause request on an already idle channel that no further interrupt will acknowledge, permanently wedging the channel.

In the Linux kernel, the iio dac ad5686 driver is missing a NULL check on the chip_info pointer. If a user binds the driver via sysfs driver_override with a device name not present in the id_table or of_match_table, the match data will be NULL.

In the Linux kernel, the irqchip gic-v3-its driver's its_vpe_irq_domain_alloc() fails to invoke its_vpe_teardown() in the error path when its_irq_gic_domain_alloc() fails. This leaks the resource associated with the corresponding interrupt.

In the Linux kernel, the RDMA nldev module's RDMA_NLDEV_ATTR_STAT_HWCOUNTERS is a nested attribute whose children are consumed directly with nla_get_u32(). The top-level policy validates only the container, not the fixed shape of each child.

In the Linux kernel, the ACPI PCI module's acpi_pci_root_add() assigns the freshly allocated root to device->driver_data before dmar_device_add() and pci_acpi_scan_root(). Only the pci_acpi_scan_root() path clears driver_data before freeing root, so when dmar_device_add() fails a dangling pointer remains. acpi_pci_root_remove() has the same problem.

In the Linux kernel, the BPF queue and stack pop/peek helpers did not zero the output buffer on a failed lock acquisition. BPF programs could observe uninitialized stack contents. The fix clears the buffer before returning -EBUSY.

In the Linux kernel on RISC-V, a memory leak occurs in the BPF JIT. When JIT compilation fails for a later subprogram, bpf_jit_free() does not free the context offset array, causing a leak. The fix adds the missing kfree.

In the Linux kernel on RISC-V, exception handling for BPF load_acquire operations is missing an extable entry, causing a kernel oops on a faulty memory access. Additionally, the rd register is not cleared on fault, allowing data leakage through a map. The fix checks ret >= 0 before adding the handler and passes rd for LOAD_ACQ to zero it on fault.

In the Linux kernel's BPF, the offset check for the BPF_RES_SPIN_LOCK instruction incorrectly uses the offset for BPF_SPIN_LOCK instead of res_spin_lock_off. The fix corrects this to use the proper field.

In the Linux kernel's BTF, btf_find_struct_field() initializes a fresh seen mask on every recursive descent, so unique special fields at different levels of the same aggregate do not see each other. Duplicate fields can reach btf_parse_fields(), triggering an invariant WARN_ON_ONCE(). A crafted user BTF can trigger the warning before capability checks. The fix initializes the mask once and passes the same pointer through the entire traversal.

In the Linux kernel, the RDMA/erdma driver has a use-after-free in the CEQ tasklet during device removal. free_irq() does not drain a tasklet already scheduled by the interrupt handler, so the tasklet can access freed EQ buffers (eq->qbuf or eq->dbrec) after erdma_eq_destroy().

In the Linux kernel, the RDMA/mana_ib module has a use-after-free during partial table insertion of a QP. mana_table_store_ud_qp() publishes a QP before inserting the receive-queue id, dropping the XArray lock, allowing a concurrent completion handler to take a transient reference; when the second insertion fails, rollback erases only the send-queue entry, leaving references outstanding and causing a use-after-free.

A use-after-free vulnerability has been found in the Linux kernel in the ib_query_qp() function within the RDMA/core subsystem. The issue arises from improper synchronization when querying a QP via netlink while the QP is being destroyed, potentially leading to access to freed memory.

In the Linux kernel, the RDMA/core subsystem has a potential use-after-free in counter_release(). rdma_restrack_del() is invoked too late, leaving the counter accessible through restrack while vendor-specific resources are already being freed.

In the Linux kernel, the firmware arm_scmi subsystem has a race during requested device removal. scmi_protocol_device_unrequest() drops scmi_requested_devices_mtx while notifying listeners but retains the list head; when two SCMI drivers for the same protocol unregister concurrently, one thread can free the list head while the other dereferences it after reacquiring the mutex, potentially freeing it twice.

In the Linux kernel, the iommu/amd subsystem has undefined behavior in the devid_write debugfs function. When the for_each_pci_segment() loop completes without finding a matching segment, pci_seg is not NULL but points to the list head, and accessing pci_seg->id after the loop causes undefined behavior.

A fix was applied in the Linux kernel for an ABBA deadlock in ext4_xattr_inode_cache_find() triggered by concurrent extended attribute (xattr) workloads using the ea_inode mount option. The deadlock occurred between a transaction holding a reference to an mbcache entry and the eviction thread evicting the same EA inode. The fix introduces a new EXT4_IGET_NOWAIT flag that performs a non-blocking inode lookup and returns -ENOENT instead of waiting for eviction or creation to complete.

A race condition in the Linux kernel's ext4 filesystem inline data write path has been fixed. During concurrent writes and page faults, the inline data state could change between write_begin and write_end, leading to NULL pointer dereferences or data loss. The fix passes the write state via the fsdata parameter and replaces a critical BUG_ON with graceful error handling and retry.

A vulnerability in the Linux kernel's ext4 filesystem was fixed, where a corrupted directory could trigger a use-after-free (reported by KASAN) during ext4_readdir(). The ext4_dir_llseek() function invalidates the directory cookie, causing a rescan of directory entries, and a corrupted rec_len field can point to an offset where the block lacks space for a complete directory entry. This leads to an out-of-bounds read and potential access to freed memory.

In the Linux kernel, the wifi ath6kl driver's WMI event handlers ath6kl_wmi_scan_complete_rx(), ath6kl_wmi_addba_req_event_rx(), and ath6kl_wmi_delba_req_event_rx() read from the event buffer without first verifying that the message is large enough. The fix adds length checks to prevent overreads.

In the Linux kernel, the wifi ath12k driver's ath12k_wmi_op_rx() reads the firmware buffer without first verifying that it contains enough data to hold a header. This could result in a buffer overread. The fix adds a check that the buffer holds at least a wmi_cmd_hdr before reading.

In the Linux kernel, the wifi ath11k driver's ath11k_wmi_tlv_op_rx() reads the firmware buffer without first verifying that it contains enough data to hold a header. This could result in a buffer overread. The fix adds an upfront length check before dereferencing skb->data as a wmi_cmd_hdr, placed before the trace_ath11k_wmi_event() call to preserve existing trace semantics.