Linux kernel vulnerabilities

A race condition in the Linux kernel's dquot_scan_active() function during quota deactivation was discovered. Under memory pressure, it can lead to use-after-free, causing system instability.

In the GFS2 filesystem of the Linux kernel, a NULL pointer dereference can occur in gfs2_log_release() during unmount when sdp->sd_jdesc is NULL. The previous patch missed this case.

In the Linux kernel, the efi/capsule-loader module has an incorrect sizeof in phys array reallocation, leading to a potential heap buffer overflow on 32-bit PAE systems.

In the Linux kernel, a vulnerability in the soc/tegra: cbb driver uses incorrect ARRAY_SIZE in fabric lookup tables, potentially causing out-of-bounds access during target timeout lookup.

In the Linux kernel, a vulnerability was found due to incorrect class initialization ordering in the fwctl driver. When the CXL module is loaded before fwctl, the fwctl class registration is not yet complete, causing the knode_class initialization to be skipped. On device removal, a NULL pointer dereference occurs.

In the Linux kernel, a bug was found in the OCFS2 filesystem's listxattr() function. When an inode has both inline and block-based extended attributes and the inline names exactly fill the caller's buffer, the function may return a size larger than the buffer, causing a kernel panic (BUG).

In the Linux kernel, a vulnerability in the OCFS2 filesystem lacks validation of the bg_bits field during freefrag scan in the non-coherent path (OCFS2_INFO_FL_NON_COHERENT). A crafted filesystem can cause an out-of-bounds memory read (use-after-free) when processing the OCFS2_IOC_INFO ioctl.

In the Linux kernel, the OCFS2 filesystem has a vulnerability due to missing input validation before caching in the OCFS2_IOC_GROUP_ADD operation. An attacker can trigger a BUG_ON in ocfs2_set_new_buffer_uptodate(), causing a system crash.

A vulnerability in the Linux kernel causes an out-of-bounds read in the hash_algo_name array during IMA initialization. The issue occurs when the TPM 2.0 module supports a hash algorithm (e.g., SHA3-256) not yet defined in the kernel, leading to memory access errors and potential system crash.

A deadlock vulnerability was found in the Linux kernel's hid_post_reset() function in the HID USB driver. The issue occurs when a USB device includes both a HID component and a storage/UAS component that are reset together. Memory allocations in hid_pre_reset() and hid_post_reset() may perform blocking I/O, leading to a deadlock on the mutex held during device reset.

In the Linux kernel, an off-by-one error was found in the check_imm function used by the ARM64 BPF JIT to validate immediate values for conditional and unconditional branches. The flaw allows values one bit wider than the signed N-bit field can hold, potentially causing incorrect instruction encoding and reversing branch direction.

A deadlock vulnerability was discovered in the Linux kernel's BPF sockmap mechanism during AF_UNIX socket iteration. The issue occurs when bpf_iter_unix_seq_show() takes the fast path of lock_sock_fast() and the iter program attempts to update a sockmap, causing recursive locking of the same slock-AF_UNIX lock.

A vulnerability was found in the Linux kernel's sockmap mechanism for AF_UNIX sockets. During connect(), the socket state is set to TCP_ESTABLISHED before the peer socket is assigned, allowing a race condition with sockmap updates that leads to a NULL pointer dereference.

A race condition in the Linux kernel's BPF sockmap for af_unix sockets causes a use-after-free when a BPF iterator updates a sockmap. The fix adds a state lock to ensure socket stability during the update.

In the Linux kernel, a vulnerability in the BPF subsystem causes a NULL pointer dereference in map_kptr_match_type() when a scalar register is stored into a kptr slot. The code accesses reg->btf without first checking if the register has a BTF type, leading to a crash.

A vulnerability was found in the Linux kernel in the arena_alloc_pages() function within the BPF subsystem. The function accepts a node_id as a plain int and forwards it through the allocation chain without any bounds checking.

In the Linux kernel, a memory leak was found in the i3c driver for Renesas platforms. The xfer structure allocated by renesas_i3c_alloc_xfer() was never freed in the renesas_i3c_i3c_xfers() function.

In the Linux kernel's NTFS3 filesystem (ntfs3), a vulnerability was found involving the use of an uninitialized 'lcn' variable in the ntfs_iomap_begin() function. The issue occurs when the block length (len) is zero, causing 'lcn' to be used before initialization.

In the Linux kernel USB Type-C driver, an error pointer dereference was found. The function does not properly check the partner registration result, which can lead to ERR_PTR dereference and potential system crash.

In the NTFS3 file system in the Linux kernel, a bug was found where the run load for VCN0 is missing in the attr_data_get_block_locked() function. This can lead to incorrect reads and trigger a WARN_ON(1) warning.

In the Linux kernel NFSD subsystem, a bug in nfsd4_add_rdaccess_to_wrdeleg causes an extra increment of the nfs4_file access count when fp->fi_fds[O_RDONLY] is already set by another thread. This prevents the nfsd_file object from being freed, leading to a BUG in kmem_cache_destroy() when stopping the nfs-server service.

A use-after-free vulnerability was found in the Linux kernel's greybus raw driver. It occurs when a raw bundle is disconnected while an application still has its character device (cdev) open. When the application closes the file, it accesses freed memory, causing a kernel panic.

A use-after-free vulnerability was found in the Linux kernel's Greybus RAW driver. If a user writes to the character device after disconnect has been called, a NULL pointer dereference occurs causing a kernel panic. The issue is due to missing synchronization between write operations and connection destruction.

In the Linux kernel's NTFS3 filesystem, a vulnerability was found where the volume label is not properly null-terminated after UTF-16 to UTF-8 conversion. The ntfs_fill_super() function fails to add a trailing NUL, potentially causing out-of-bounds read when the label is displayed via ntfs3_label_show().

In the Linux kernel, the dell-wmi-sysman driver for x86 platforms has a vulnerability where firmware-provided strings are aggregated into fixed 512-byte buffers using strcat() without checking remaining space. This could lead to a buffer overflow if the combined strings exceed the buffer size.

In the Linux kernel, an integer overflow vulnerability was found in the sbc_execute_unmap() function of the SCSI target subsystem. The lack of protection against LBA + range wrapping on 64-bit overflow can lead to incorrect bounds checking.

A potential race condition was found in the Linux kernel during TLB synchronization. The issue arises from missing page table lock while traversing and modifying page tables. The fix disables split page table lock for simplicity.

In the Linux kernel, the ccu_mix driver for Spacemit SoCs has an inverted condition in ccu_mix_trigger_fc() that skips frequency change triggering. This causes kernel panics during cpufreq scaling.

In the Linux kernel F2FS filesystem, a bug causing a crash (BUG) during garbage collection (GC) was found. The issue occurs when an already updated page is re-read from disk, triggering a VM_BUG_ON_FOLIO assertion.

A vulnerability in the Linux kernel's F2FS filesystem causes data loss when fsync on a newly created file runs concurrently with a checkpoint operation. Incorrect use of nat_entry flags leads to premature assumption that the checkpoint has completed, resulting in data loss after a power failure.

In the Linux kernel, the CCP (crypto: ccp) subsystem has a vulnerability where the IV buffer is overwritten during AES encryption in RFC3686 mode. The ccp_aes_complete() function restored 16 bytes (AES_BLOCK_SIZE) to the IV buffer, while the RFC3686 algorithm uses only an 8-byte IV, causing a buffer overrun.

In the Linux kernel, the EROFS filesystem vulnerability was found where the `lcn` variable was typed as `unsigned long`, which is only 32 bits wide on 32-bit platforms. This causes truncation of the `(lcn << lclusterbits)` shift beyond 4 GiB, potentially leading to block addressing errors.

In the Linux kernel's net/sched/act_mirred module, a bug was found in the tcf_blockcast_redir function. When iterating block ports to redirect packets to multiple devices, the mac_header_xmit flag was queried from the wrong device (the next in iteration, not the one being sent to). This causes incorrect decisions about pushing or pulling the MAC header, leading to skb header corruption and, in worst cases, a kernel panic due to headroom exhaustion.

In the Linux kernel's macvlan driver, the macvlan_get_size() function does not reserve space for the IFLA_MACVLAN_BC_CUTOFF attribute. This causes -EMSGSIZE errors and a WARN_ON in rtnetlink when dumping the interface if bc_cutoff is set to a value other than 1.

In the Linux kernel, a vulnerability occurs when an IPv6 nexthop is replaced with an IPv4 nexthop without updating the has_v4 flag in all groups containing this nexthop. This allows IPv6 routes to reference groups with only AF_INET members, causing a NULL pointer dereference and system panic.

In the Linux kernel, a use-after-free vulnerability was found in the taprio network scheduler's advance_sched() function during schedule switching. After switch_schedules() is called, the old oper schedule is freed via call_rcu(), but the 'next' pointer still points to an entry in the old schedule, causing a use-after-free.

A double-free vulnerability was found in the Intel ice network driver's ice_xmit_frame_ring() function. When ice_tso() or ice_tx_csum() fails, the skb is freed but the tx_buf pointer remains set, leading to a second free during transmit queue cleanup.

A race condition was found in the Linux kernel's ice driver during TX timestamp ring cleanup. Lack of proper synchronization between ice_free_tx_tstamp_ring() and ice_tx_map() can lead to a NULL pointer dereference.

In the Linux kernel's ice driver, a potential NULL pointer dereference was found in the error path of ice_set_ringparam(). The issue occurs because tstamp_ring is nullified without clearing the ICE_TX_RING_FLAGS_TXTIME flag, leading to a NULL dereference in ice_free_tx_tstamp_ring() if ice_setup_tx_ring() fails.

A vulnerability was found in the Linux kernel's SOCKMAP mechanism for AF_UNIX sockets. SOCKMAP can hide an inflight file descriptor from the garbage collector (GC), leading to memory leaks and potential use-after-free. An attacker could exploit this to escalate privileges or destabilize the system.

A vulnerability in the Linux kernel's sctp_getsockopt_peer_auth_chunks function fails to properly validate the user buffer size before writing data. Missing the 8-byte header of the sctp_authchunks structure leads to an out-of-bounds write that can overwrite adjacent user data.

A vulnerability in the Linux kernel's PPPoE driver allows dropping frames with Protocol Field Compression (PFC). An attacker can send a crafted frame with a 1-byte protocol field, shifting the payload by one byte and potentially causing unaligned access exceptions on some architectures.

A vulnerability in the Linux kernel netfilter xtables module incorrectly uses NFPROTO_UNSPEC in the xt_mac, xt_owner, xt_physdev, and xt_realm extensions. This causes filtering rules to be applied to unexpected protocol families, potentially leading to firewall misconfiguration.

In the Linux kernel's netfilter/nat subsystem, a vulnerability was found where NAT hook registration structures (ops) were not freed using kfree_rcu. This can cause use-after-free when userspace dumps active hooks via nfnetlink_hook (introduced in v5.14).

In the Linux kernel, a vulnerability was found in the netfilter nfnetlink_osf module, where the nf_osf_ttl() function accessed skb->dev without verifying the device pointer, potentially causing a NULL pointer dereference. The TTL check logic also incorrectly assumed packets from the same subnet would not have a decremented TTL, which is false in container and virtual switching environments.

In the Linux kernel's dualpi2 queuing discipline (net/sched), a vulnerability was found in the draining of both C-queue and L-queue during configuration change. The dualpi2_change() function incorrectly handled cases where packets were only in the L-queue, leading to a NULL pointer dereference.

In the Linux kernel, a durable file descriptor leak was found in ksmbd during durable v2 open when ClientGUID mismatches. The reference obtained from ksmbd_lookup_fd_cguid() is not released in the mismatch path, causing resource leaks.

In the Linux kernel's RDS subsystem, a vulnerability was found where the per-item info buffer is not zeroed before being passed to visitor functions. This leads to kernel stack data leakage to user space when the RDS connection is not in RDS_CONN_UP state.

In the Linux kernel, the vsock/virtio driver had a bug in virtio_transport_init_zcopy_skb() that used an already-consumed iterator (iter->count) for pinned-pages accounting, skipping RLIMIT_MEMLOCK enforcement on the last skb. This could lead to uncontrolled memory usage.

In the Linux kernel, a vulnerability in the ADFS filesystem lacks validation of the zone count (nzones) in adfs_validate_bblk(), leading to an out-of-bounds write. A crafted disk image with zero zones triggers kmalloc_array(0, ...) returning ZERO_SIZE_PTR, followed by a write before the allocated buffer.