Linux kernel vulnerabilities

A vulnerability has been identified in the Linux kernel related to the xfs_attr_leaf_hasname function, which may return a NULL buffer on attribute read errors. This issue has been resolved.

A vulnerability related to double dma_buf_unpin in failure path has been fixed in the Linux kernel. In the function ib_umem_dmabuf_get_pinned_with_dma_device(), a failure may occur during the call to ib_umem_dmabuf_map_pages(), leading to improper memory management.

In the Linux kernel, a page fault occurs in the vfio/xe driver when resetting VF devices that do not support migration. The fix reorganizes initialization to decouple migration from reset.

A vulnerability in the Linux kernel leads to a General Protection Fault (GPF) in the write_page() function during array resize. This issue is caused by a use-after-free race between bitmap_daemon_work().

A vulnerability in the Linux kernel related to error handling in the pci_slot_trylock() function has been resolved. The fix adds missing bridge locks to the pci_bus_lock() function, improving PCI device lock management.

A vulnerability in the Linux kernel related to GSO frame transmission errors has been resolved. The udpgro_frglist.sh and udpgro_bench.sh tests are the most unstable tests in NIPA, leading to their failures.

A vulnerability has been identified in the Linux kernel related to the registration of the omap_mpuio_driver in the omap_gpio_probe() function. This issue has been resolved in commit 11a78b794496.

In the Linux kernel, the JFS filesystem now checks for read-only mode before performing truncation in jfs_truncate_nolock(). This avoids errors related to writing to a read-only filesystem.

In the Linux kernel's fork function, a race condition exists between fork and hugetlbfs file operations. The fix defers linking the file VMA until the VMA is fully initialized.

A vulnerability has been identified in the Linux kernel within the kfd_event_page_set() function, which allows for out-of-bounds writes. This function writes data without checking the buffer size, potentially enabling unauthorized access by unprivileged users.

A vulnerability in the Linux kernel related to out-of-bounds access in the vfe_isr_reg_update() function has been resolved. The issue occurs during iteration in the vfe_isr() function, where an incorrect loop bound is used, potentially leading to unauthorized memory access.

In the Linux kernel, a vulnerability was found in the SMB client related to directory separator handling in SMB1 UNIX mounts. The issue occurs when @cifs_sb->mnt_cifs_flags is read or updated before calling reset_cifs_unix_caps(), potentially causing incorrect behavior.

In the Linux kernel's F2FS filesystem, there is potential corruption when moving a directory, similar to an issue in ext4. The fix addresses this problem.

A vulnerability in the Linux kernel related to the dma_free_coherent() function has been fixed, which was using an incorrect DMA handle in the error path. This could lead to improper unmapping of the buffer.

A vulnerability has been identified in the Linux kernel related to improper resource release in the most_register_interface() function. In cases of early failure before device registration, resources were not correctly released.

A vulnerability in the Linux kernel related to double free in the pruss_clk_mux_setup() function has been resolved. The issue occurred during the call to devm_add_action_or_reset(), which triggered pruss_of_free_clk_provider() on error.

A vulnerability related to error handling after finding a match in an async connection has been fixed in the Linux kernel. Once a match with an fwnode is found, a sub-device may be registered, and its bound operation is called.

In the Linux kernel, a vulnerability was found in the F2FS filesystem involving uninitialized value access in the f2fs_sanity_check_node_footer function. The issue was reported by syzbot and may lead to unpredictable system behavior.

A vulnerability has been identified in the Linux kernel in the ceph_zero_partial_object function, which was missing proper snapshot context for OSD write operations. This could lead to data inconsistencies in snapshots.

A vulnerability has been identified in the Linux kernel related to improper reference counting management in the 'xfrm_state' structure. The issue occurs during the NETDEV_UNREGISTER event, leading to reference count leaks.

A vulnerability has been identified in the Linux kernel that has been resolved. In the tw9906_probe() function, there was a potential memory leak because memory allocated in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() was not freed.

In the Linux kernel, in the RDMA/hns driver, a soft lockup issue under heavy CEQE load was fixed by moving CEQE handling to the BH (bottom half) context.

A vulnerability in the Linux kernel has been fixed related to the imx_rproc_elf_find_loaded_rsc_table() function, which could incorrectly report a loaded resource table even when the current firmware does not provide one.

A vulnerability in the Linux kernel has been resolved that allowed two query interface operations to concurrently update interfaces. A locking mechanism has been introduced to prevent these races.

In the Linux kernel, a vulnerability was found in the mechanism preventing timer interrupt starvation. Missing resets of the next_event_forced flag in several places, such as when the clock event state changes, may cause incorrect behavior.

A vulnerability in the Linux kernel has been resolved regarding the introduction of locking when enabling/disabling SR-IOV, which led to deadlocks.

A vulnerability in the virtio-gpu module of the Linux kernel involves an incorrect overflow check when allocating 2D images. This flaw can lead to a buffer overflow, potentially enabling privilege escalation or system crash.

In the Linux kernel, a double accounting race was fixed in Btrfs when btrfs_run_delalloc_range() fails. The issue occurs when block size is smaller than page size and can lead to kernel crash.

A vulnerability has been identified in the Linux kernel related to the dwc3_gadget_vbus_draw() function, which can be called from atomic context. This leads to invoking power-supply APIs that may cause synchronization issues as some operations may require sleeping.

A vulnerability has been identified in the Linux kernel that could lead to a map leak in the fastrpc_put_args function. A failure in the copy_to_user() function could cause an early return without cleaning up the file descriptor list, which has been fixed.

A vulnerability has been identified in the Linux kernel related to the btree repair functions for free space and inode. The issue involves a lack of checking for deleted cursors when revalidating two btrees, which may lead to filesystem malfunctions.

In the Linux kernel's networking subsystem, a dangling sk pointer is left when socket creation fails, potentially leading to use-after-free when __sock_release() is called with an fentry probe.

In the Linux kernel, in the sc16is7xx serial driver, a TX FIFO corruption was fixed that could occur when a packet was received on channel A at almost the same time as a packet was about to be transmitted on channel B.

A vulnerability in the Linux kernel related to V3D rendering has been resolved, which occasionally caused segment size mismatch warnings when CONFIG_DMA_API_DEBUG was enabled.

A vulnerability has been identified in the Linux kernel, resolved by moving the ext4_percpu_param_init() function before ext4_mb_init().

A vulnerability has been identified in the Linux kernel related to the kexec_load_purgatory() function, which derives the start image from the SHF_EXECINSTR section. The issue occurs when the purgatory object contains multiple executable sections with overlapping addresses.

In the Linux kernel, the bnge driver has a vulnerability where a return statement is missing after auxiliary_device_uninit() in the error path. After auxiliary_device_add() fails, execution continues, potentially leading to use-after-free.

A vulnerability in the Linux kernel related to the rio_scan_alloc_net() function has been resolved. In case of idtab allocation failure, memory is released using kfree() instead of rio_free_net().

In the Linux kernel, the drm/amdgpu driver changed the handling of the vm->task_info object. The object is now dynamically allocated and reference-counted, improving safety and stability.

A vulnerability in the Linux kernel related to parameter validation for packet data in communication with nci NFC chips has been resolved. The introduced fix has caused issues with communication with these chips.

A vulnerability has been identified and resolved in the Linux kernel. The issue concerns the pwlan variable, which may be NULL when passed to the rtw_free_network_nolock() function, leading to dereferencing of this variable.

A vulnerability has been identified in the Linux kernel related to the failure to free memory in case of an error. Specifically, the screen buffer fbi->fb.screen_buffer is allocated using dma_alloc_coherent() but is not freed if an error occurs.

A vulnerability has been identified in the Linux kernel that has been resolved. It concerns improper management of bio pointers in cloned requests, leading to issues with use-after-free.

A vulnerability has been identified in the Linux kernel related to resource leaks during early registration failures. A recent commit fixed most cases, but for some reason, it left out the first error path, which still leaks resources.

A vulnerability in the Linux kernel related to the SDMA block has been fixed, which caused a NULL pointer issue in buffer functions when the SDMA block was not enabled.

A vulnerability has been identified in the Linux kernel related to the logic in GHES/CPER, which does not detect if the section length is too large. This may lead to improper processing of CPER records for ARM processors.

A vulnerability related to APEI/GHES has been resolved in the Linux kernel, which could lead to the allocation of overly large records. The logic in the ghes_new() function checks that records do not exceed the maximum size of GHES_ESTATUS_MAX_SIZE, currently set at 64KB.

A vulnerability has been identified in the Linux kernel regarding the allocation of property blobs in DRM_IOCTL_MODE_CREATEPROPBLOB. This allows users to allocate blobs of arbitrary size, potentially leading to uncontrolled memory usage.

A vulnerability in the Linux kernel related to freemap adjustments when adding extended attributes (xattrs) to leaf blocks has been resolved. This issue caused an assertion failure in the freemap adjustment code after approximately 20 minutes of running on virtual machines.

A vulnerability has been identified and resolved in the Linux kernel. It concerns the HID Magic Mouse, which can cause system crashes when the input pointer is missing.