Linux kernel vulnerabilities

In the cedrus_init_ctrls() function of the Linux kernel media cedrus driver, the V4L2 control handler is initialized before allocating memory for ctx->ctrls. If this allocation fails, the function returns -ENOMEM without freeing the previously allocated handler resources, leading to a memory leak.

In the Linux kernel media cobalt driver, snd_cobalt_card_create() stores cobsc in sc->private_data and installs snd_cobalt_card_private_free() as sc->private_free. If cobalt_alsa_init() fails, the err_exit_free path calls snd_card_free(sc) and then kfree(cobsc), causing a double free of the same object.

In the Linux kernel media cx23885 driver, netup_ci_exit() frees a netup_ci_state while its work item netup_read_ci_status() may still be pending or running on the system workqueue. The worker obtains the state via container_of() and dereferences it, so it must not outlive the state.

In the Linux kernel media em28xx driver, the audio-only path registers extensions while probing the primary device, which for a dual-TS board happens before dev_next is created. The duplicate device inherits is_audio_only and is independently inserted into em28xx_devlist, potentially leading to a use-after-free during disconnect.

In the Linux kernel media em28xx driver, when a device with has_dual_ts=1 takes the is_audio_only path, both dev and dev->dev_next are added to the global em28xx_devlist. During disconnect, em28xx_close_extension(dev) only removes dev->devlist, leaving dev->dev_next->devlist linked in the global list, which after dev_next is freed leads to a dangling pointer and list corruption.

In the Linux kernel media go7007 driver, go7007_snd_init() takes a v4l2_device reference for the ALSA side, but go7007_snd_remove() drops it immediately after calling snd_card_free_when_closed(). This is too early when a userspace process still has the capture PCM open, potentially leading to a use-after-free.

In the Linux kernel media i2c imx415 driver, the VBLANK path returned immediately when programming VMAX failed after pm_runtime_get_if_in_use() had taken a runtime PM reference. This leads to a runtime PM reference leak.

In the Linux kernel media i2c ov02a10 driver, ov02a10_check_hwcfg() calls fwnode_handle_put(ep) immediately after allocating and parsing the endpoint, but subsequently uses the same 'ep' handle in fwnode_property_read_u32(), leading to a use-after-free. Additionally, reading the optional 'ovti,mipi-clock-voltage' property overwrote the 'ret' variable, causing probe to fail entirely.

In the Linux kernel media i2c ov7740 driver, ov7740_remove() had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler that relies on that mutex, leading to a use-after-destroy kernel panic. Additionally, the driver called v4l2_ctrl_handler_free() and mutex_destroy() sequentially, then called ov7740_free_controls() which invokes both again, resulting in a double-free.

In the Linux kernel, isys_notifier_init() in the media intel/ipu6 driver leaks resources. When endpoint parsing or adding fails partway through the loop, the function returns without calling v4l2_async_nf_cleanup(), leaving previously added v4l2_async_connection entries on the notifier's waiting list.

In the Linux kernel, the media platform mtk-mdp3 driver's mdp_probe() mishandles SCP device reference counting. The fallback path drops the reference obtained via __get_pdev_by_id() too early, and scp_put() later drops it again, resulting in a double reference release.

In the Linux kernel, the media platform mtk-mdp3 driver lacks a sanity check after looking up the SCP device. If the SCP driver has not yet been bound, a NULL-pointer dereference can occur.

In the Linux kernel, the media rc sunxi-cir driver does not unregister the rc device on probe failures after rc_register_device() succeeds. Only rc_free_device() is called, leaving the registered rc device and its resources behind.

In the Linux kernel, the media rkvdec HEVC decoder's st_ref_pic_set_prediction() computes the reference RPS index as st_rps_idx - (delta_idx_minus1 + 1) using u8 operands. When delta_idx_minus1 + 1 exceeds the current index, the subtraction wraps and the array access at calculated_rps_st_sets[ref_rps_idx] reads far out of bounds.

In the Linux kernel, the rtl2832_sdr driver's rtl2832_sdr_start_streaming() function failed to release previously allocated DMA buffers and URB structures when allocation or submission of URBs failed. This led to a DMA memory leak and an out-of-bounds read of urb_list[] on the next streaming attempt, potentially passing garbage pointers to usb_free_urb().

In the Linux kernel, the media s2255 driver's s2255_fillbuff() memcpy()s vc->jpg_size bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc->jpg_size is taken verbatim from the S2255_MARKER_FRAME header sent by the device and is never bounded, allowing an out-of-bounds write.

In the Linux kernel, the media s2255 driver's s2255_probe() reads a 4-byte marker and version from the last 8 bytes of the firmware blob. If the firmware file is shorter than 8 bytes, fw_size - 8 underflows and the access reads out of bounds.

In the Linux kernel, the media saa7164 driver's saa7164_dev_setup() adds the device to the global saa7164_devlist before requesting the PCI BAR memory regions. When get_resources() fails, the device remains on the list while the probe error path frees it, leaving a dangling entry.

In the Linux kernel, the media tda18250 driver has a possible integer overflow when the variable exp equals zero. The shift operation 1 << (exp - 1) may then lead to undefined behavior.

In the Linux kernel, the VPE (Video Processing Engine) driver for TI platforms has a vulnerability due to missing synchronization between the FIFO overflow recovery worker and IRQ handling during stream teardown. This can lead to use-after-free of stream resources when an interrupt or worker runs after the stream is released.

In the Linux kernel, the media v4l2-async module incorrectly deletes an unlinked ASC entry on link creation error. Calling list_del() on an entry that was never inserted can dereference NULL instead of returning the original link creation error.

In the Linux kernel, the media v4l2-ctrls module lacks validation of HEVC EXT SPS RPS counts. Decoder drivers may index beyond dynamic arrays if SPS values exceed HEVC limits (64 short-term sets, 32 long-term references) or exceed the DPB maximum.

In the Linux kernel, the v4l2_fwnode_parse_link() function in the media v4l2-fwnode module leaks an fwnode reference. The remote endpoint reference acquired via fwnode_graph_get_remote_endpoint() is not released on the success path.

In the Linux kernel, the media video-i2c driver leaves a kthread error pointer in kthread_vid_cap on failure. This causes a subsequent start_streaming() call to return success without starting the thread, and stop_streaming() to call kthread_stop() on the error pointer, leading to a kernel crash.

In the Linux kernel, the media zoran driver double-frees a registered video_device. The zoran_exit_video_devices() function calls video_unregister_device() and then kfree() on the same object already freed by the zoran_vdev_release() callback.

In the Linux kernel, the media qcom iris driver uses disable_irq_nosync() during power-off, which does not wait for an in-flight threaded IRQ handler to complete. The handler may still run after the VPU is powered down and access hardware registers.

In the Linux kernel, the media chips-media wave5 driver's stop_streaming function may enter an infinite loop in some cases. A bounded poll of the queue status with a VPU_DEC_STOP_TIMEOUT limit was added.

In the Linux kernel, the media chips-media wave5 driver's device_run() defers job_finish() even when no DEC_PIC was queued, leaking the shared v4l2_m2m job slot. This stalls all decoder instances at EOS, e.g. in GStreamer.

In the Linux kernel, the media chips-media wave5 driver sets the EOS flag by communicating with firmware via send_firmware_command(), which accesses VPU registers. The STREAMOFF and V4L2_DEC_CMD_STOP paths can run while the device is runtime suspended, causing register accesses to powered-down hardware and an asynchronous SError that panics the kernel.

In the Linux kernel, the scsi qla2xxx driver's FRU/I2C bsg handlers use a 256-byte DMA buffer that is not zeroed and initialize only a few leading bytes. qla2x00_write_sfp() can override the transfer length with a user-supplied value (up to 255 bytes), causing reads of uninitialized heap memory and writes to device flash.

In the Linux kernel, the scsi qla2xxx driver's I2C bsg handlers use the i2c->length field (16-bit) without bounds checking, while the buffer is a fixed 64 bytes. This can lead to stack and heap overflows and memory leaks when the length exceeds the buffer size.

In the Linux kernel, the scsi qla2xxx driver's qla_chk_edif_rx_sa_delete_pending() function dereferences a NULL pointer when the SCSI command has already been returned or aborted. This can lead to a kernel crash in interrupt context.

In the Linux kernel, the scsi qla2xxx driver's qla28xx_validate_flash_image() function returns QLA_SUCCESS unconditionally, causing the FC BSG transport to not complete the job on error. This leads to block layer resource leaks and the request dangling until timeout.

In the Linux kernel, the scsi qla2xxx driver's qla24xx_report_id_acquisition() function has a use-after-free because the virtual port is used after dropping the vport_slock without taking a reference. Concurrent qla24xx_deallocate_vp_id() can free the port, leading to memory corruption.

In the Linux kernel, the scsi qla2xxx driver's qla_nvme_fcp_abort() and qla_nvme_ls_abort() functions call INIT_WORK() before schedule_work(), which on repeated aborts of the same command can corrupt the workqueue list and lead to crashes or a looping worker.

In the Linux kernel, the scsi qla2xxx driver's qla2x00_do_dport_diagnostics() function allocates the response buffer without zeroing and copies the full structure size back to user space, exposing uninitialized fields and leaking kernel heap contents.

In the Linux kernel, the scsi qla2xxx driver's qla2x00_update_fru_versions() function copies the user-supplied BSG request into a fixed 256-byte stack buffer and iterates list->count times without bounds, potentially reading past the buffer and sending kernel stack memory to the device.

In the Linux kernel, the scsi: qla2xxx driver's qla2x00_fw_state_show() re-issued the qla2x00_get_firmware_state() mailbox command outside optrom_mutex even when the chip was down or EEH was busy. This could hang the adapter during ISP reset or PCI error recovery.

In the Linux kernel, the scsi: qla2xxx driver's qla2x00_status_entry() allowed non-SCSI SRB entries into the SCSI fast path, where sp->u.scmd.cmd was dereferenced. An unexpected STATUS_TYPE IOCB for a non-SCSI handle could yield a garbage pointer and a wild pointer dereference.

In the Linux kernel, the scsi: qla2xxx driver's qla2xxx_delete_qpair() deleted the request queue before the response queue, leaving a window where the response MSI-X interrupt could dereference the freed rsp->req. This results in a use-after-free.

In the Linux kernel, the scsi: qla2xxx driver's qla2x00_error_entry() read ha->req_q_map[que] twice, so a concurrent NULL store by qla25xx_free_req_que() could result in a NULL pointer dereference.

In the Linux kernel, the scsi: qla2xxx driver's qla24xx_report_id_acquisition() format-1 path called qla_update_host_map() without holding vport_slock, allowing races with concurrent host_map updates and btree corruption.

In the Linux kernel, the scsi: qla2xxx driver's bsg handlers staged requests/replies in an uninitialized 256-byte stack buffer and copied the full structure back, leaking stale stack data. This affected qla2x00_read_fru_status() and qla2x00_read_i2c() among others.

In the Linux kernel, the scsi: qla2xxx driver's qla_nvme_xmt_ls_rsp() unconditionally called qla_nvme_ls_reject_iocb() even when firmware was not started, ringing the doorbell and queuing an IOCB that stopped firmware could not consume, and touching MMIO during the reset/EEH window.

In the Linux kernel, the f2fs filesystem's redirty_blocks() could run an extra cleanup loop iteration when read_cache_folio() failed before pinning any folios, causing folio_put_refs(folio, 2) to drop one reference too many. This led to "BUG: Bad page state" on later drop_caches or reclaim.

In the Linux kernel, f2fs F2FS_IOC_MOVE_RANGE checks the source range but not the destination end before updating i_size. A source hole can expose this: __clone_blkaddrs() skips NULL_ADDR entries and returns success, so the caller can still extend the destination inode with unchecked pos_out + len.

In the Linux kernel, f2fs f2fs_xattr_advise_set() calls inode_owner_or_capable() with &nop_mnt_idmap instead of the idmap the VFS passes to the ->set() handler. On idmapped mounts this checks the caller's fsuid against the unmapped on-disk owner rather than the mapped owner.

In the Linux kernel, f2fs stores recovery filenames as a length plus a fixed-size i_name buffer that is not NUL-terminated, but recover_inode() and recover_dentry() print it with %s. For a 255-byte filename, recovery logging can read past i_name into the following raw inode fields.

In the Linux kernel, f2fs find_in_level() gets a dentry folio with f2fs_find_data_folio() before calling find_in_block(). If find_in_block() returns an error, the function stores the error in res_folio and breaks out of the loop without dropping the dentry folio, leaking the folio reference.

In the Linux kernel, a race condition exists in the f2fs file system's f2fs_get_read_data_folio() function, which calls f2fs_folio_put() before folio_nr_pages() when invalidating a large folio from the page cache. This allows a concurrent truncate or folio split to shrink or free the folio before the invalidate range is computed, leading to stale xarray entries and bad page state.