Linux kernel vulnerabilities

A race condition in the Linux kernel between pressure write and cgroup file release leads to a use-after-free vulnerability in the priv member of struct kernfs_open_file.

In the Linux kernel, an inode reference leak occurs in fsnotify_recalc_mask() because the return value of __fsnotify_recalc_mask() (an inode pointer) is discarded, preventing iput() and fsnotify_put_sb_watched_objects() from being called. This leads to a hung task during filesystem unmount.

In the Linux kernel netfilter/nf_tables subsystem, a vulnerability was found where new hooks are published unsafely into the basechain/flowtable list during the commit phase. The lack of splice_list_rcu() can cause race conditions between netlink dump traversal and concurrent ruleset updates.

In the Linux kernel, the amdgpu driver has a double call to drm_exec_fini() in the userq validation function. When new_addition is true, exec is finalized first, and then on error from amdgpu_ttm_tt_get_user_pages(), drm_exec_fini() is called again, causing a double free. The issue was found by a static analysis tool and confirmed by code review.

In the Linux kernel, a vulnerability in the netdevsim module was found where the nsim_dev_trap_skb_build function does not zero-initialize the IP header structure in a dummy sk_buff. This can lead to uninitialized data leaks detected by KMSAN.

In the Linux kernel's net/sched: netem subsystem, a vulnerability was found where the queue limit check only counted packets in the internal tfifo, ignoring packets placed in sch->q by the reorder path (__qdisc_enqueue_head). This allowed the total queue occupancy to exceed sch->limit during reordering.

In the Linux kernel, a vulnerability was found in the airoha network driver causing a BQL (Byte Queue Limits) imbalance in the TX path. The issue stems from incorrect TX queue indexing, where inflight packets are accounted only for a limited number of queues, while completions are accounted for all queues.

In the Linux kernel, the neigh_xmit function leaks an skb when called with an uninitialized neighbor table (e.g., NEIGH_ND_TABLE with IPv6 disabled). The function did not free the packet in that case, and its return value was ignored by callers like MPLS. The fix ensures full skb ownership and removes the last code path that neither transmits nor frees the packet.

A vulnerability in the Linux kernel's CFS scheduler causes a newly forked task to inherit an incorrect rel_deadline flag. This leads to a deadline miscalculation, vruntime overflow, and a subsequent NULL pointer dereference when sched_yield() is called.

In the Linux kernel's PSP (Packet Security Protocol) module, a vulnerability was found due to missing check for device unregistration when creating an association. The psp_assoc_device_get_locked() function may obtain a reference to a device that has been unregistered in the meantime, leading to a use-after-free condition.

In the Linux kernel, a vulnerability was found in the PSP (Platform Security Processor) module where dev-set and key-rotate operations modify shared device state (PSP version configuration and cryptographic key material) without requiring CAP_NET_ADMIN privileges. The only access control is psp_dev_check_access(), which only checks network namespace membership.

A vulnerability in the Linux kernel's futex subsystem can cause a live lock during requeue-PI operations. The race condition occurs when a task leaves the queue due to a signal or timeout while a higher-priority task holds the lock, leading to an infinite loop.

Two bugs were found in the drm/xe graphics driver's xe_exec_queue_create_ioctl() function. The first leaves a dangling pointer when xe_hw_engine_group_add_exec_queue() fails. The second fails to remove the queue from the engine group after xa_alloc() failure, causing a use-after-free.

A data race was found in the Linux kernel's bonding 802.3ad (LACP) implementation due to missing RCU protection for the port->aggregator pointer. The fix adds the __rcu qualifier and proper RCU API usage.

A memory leak was discovered in the Linux kernel's TLS subsystem. During a failed attempt to switch TLS RX to hardware offload, the cleanup function did not free the anchor skb allocated by strparser. The issue was introduced after a change to the strparser implementation.

A vulnerability in the Linux kernel futex subsystem where need_futex_hash_allocate_default() incorrectly required CLONE_THREAD for proper hash allocation. This caused a use-after-free bug when sharing memory (mm) in non-thread ways, such as via child processes.

In the Linux kernel, the af_alg crypto subsystem now caps the AEAD associated data length to 0x80000000 to prevent arithmetic overflows when checking the TX buffer size.

In the Linux kernel, a use-after-free vulnerability was found in the ena driver's get_timestamp function. The issue is caused by missing synchronization when checking the active flag and reading the DMA memory pointer, potentially leading to NULL pointer dereference.

In the Linux kernel netfilter subsystem, a reference leak of an expectation object was found in nft_ct_expect_obj_eval(). The function allocates an expectation but never releases the local reference before returning.

A vulnerability was found in the Linux kernel's KVM subsystem in the kvm_reset_dirty_gfn() function. Missing overflow check when adding offset and mask allows bypassing range validation via integer wrap. An attacker can exploit this for out-of-bounds memory access.

In the Linux kernel, a vulnerability in the KVM subsystem for s390 architecture causes double-scaling of pointer arithmetic when indexing the GAIT table. Functions kvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and aen_host_forward() manually multiply the index by sizeof(struct zpci_gaite), leading to out-of-bounds access for aisb >= 32.

In the Linux kernel, the SMB/client subsystem has a vulnerability causing an infinite loop and out-of-bounds read in the symlink_data() function. On 32-bit architectures, an invalid ErrorDataLength value can make the next pointer point to the beginning of the structure or beyond it.

A logical error was found in the Linux kernel's DRM subsystem within the change handle logic. Incorrect replacement of the IDR pointer with a new object caused a warning and potential resource leak during file close.

In the Linux kernel DRM TTM subsystem, a bug causes an infinite LRU walk when swapout fails. After ttm_tt_swapout() failure, restoring the resource's LRU position leads to the same resource being found again, resulting in an infinite loop.

In the Linux kernel, a vulnerability was found in the USB MIDI 2.0 parser that does not properly validate descriptor lengths when scanning endpoint extra data. This could allow out-of-bounds reads by a malicious USB device.

In the Linux kernel, the ALSA USB-audio driver has a vulnerability where the MIDI endpoint descriptor scan is not properly bounded. The snd_usbmidi_get_ms_info() function fails to check if the endpoint descriptor size exceeds the remaining bytes in the endpoint-extra scan, potentially leading to out-of-bounds reads.

A buffer leak was discovered in the __ceph_setxattr() function in the Ceph filesystem within the Linux kernel. During retries, the old_blob variable stores the ci->i_xattrs.prealloc_blob value but is never freed via ceph_buffer_put(), causing a memory leak.

A kernel BUG_ON crash in __ceph_build_xattrs_blob() was discovered in the Linux kernel's Ceph filesystem. The issue is a race condition introduced by commit d93231a6bc8a, which moved blob size calculation before __build_xattrs(), allowing handle_cap_grant() to modify the blob concurrently.

In the Linux kernel, a vulnerability was found in the Ceph filesystem where folios not suitable for writeback were not released properly. The function removing folios from the batch did not call `folio_put`, causing a memory leak.

In the Linux kernel's sev-guest driver, a vulnerability was found where a host-controlled value is used to compute the page order when freeing a buffer. The host may return an expected buffer size, which is then used to calculate the page order, potentially leading to corruption in the page allocator.

In the Linux kernel's libceph library, a null pointer dereference vulnerability was found during decoding of choose_args in the CRUSH map. The issue occurs when a received message contains a bucket_index pointing to a non-existent (NULL) bucket, potentially causing a system crash.

In the Linux kernel's libceph, a potential out-of-bounds access vulnerability was found in __ceph_x_decrypt(). An attacker can send a crafted authentication frame causing a read beyond the allocated buffer, potentially leading to information disclosure or system crash.

In the Linux kernel's libceph, the decode_choose_args() function lacks proper error handling for rbtree insertion. A corrupted CEPH_MSG_OSD_MAP message with duplicate choose_args indices triggers an assertion leading to a kernel BUG.

A vulnerability in the Linux kernel's iommu/vt-d driver causes an Oops when killing a QEMU process. The issue is due to out-of-scope access to the global static blocked domain, which lacks a proper dmar_domain structure.

A vulnerability in the Linux kernel IOMMU subsystem causes a false WARN_ON during device reset due to improper domain attachment blocking for multi-device groups sharing a RID. This can lead to a use-after-free condition.

In the Linux kernel, a vulnerability was found in the DRM driver for Intel Xe GPUs related to DMA-BUF buffer handling. The issue involves race conditions leading to use of an uninitialized buffer object (empty bo) and Use-After-Free (UAF) in the invalidate_mappings hook. An attacker could exploit these races to cause system crashes or potentially escalate privileges.

In the Linux kernel, the DRM xe driver (dma-buf) has a use-after-free vulnerability in a retry loop. After an error, the buffer object is freed, and the retry loop accesses freed memory, potentially leading to security issues.

In the Linux kernel, a vulnerability in the TTM (Translation Table Manager) driver causes an infinite loop during LRU list traversal in the ttm_bo_shrink() function when backup fails. The fix moves the bulk_move deletion to occur only after successful backup completion.

In the Linux kernel, the i2c-dev driver's I2C_TIMEOUT ioctl improperly validates the timeout argument, allowing integer overflow when multiplied by 10. This results in a negative timeout value, corrupting the SMBus state machine and causing a local denial of service.

In the Linux kernel's qrtr module, a vulnerability was found where the socket reference count is decremented before the port is removed from the XArray and before the RCU grace period ends. This creates a race condition where an RCU reader can obtain a pointer to a socket with a zero reference count, leading to refcount saturation and potential Use-After-Free (UAF).

A SOFTIRQ-unsafe lock order deadlock was found in the Linux kernel's send_sigio() and send_sigurg() functions when signaling a process group (PIDTYPE_PGID). The use of read_lock(&tasklist_lock) combined with write_lock in fork()/exit() and softirq interrupts (e.g., TCP URG) causes a deadlock. The fix replaces tasklist_lock with rcu_read_lock().

In the Linux kernel, a commit enabling threaded NAPI by default in the WireGuard driver was reverted because it caused complete decryption stalls for specific peers in Kubernetes environments with Cilium. The issue occurred rarely but led to permanent blocking of E/W traffic between pods and certain nodes.

In the Linux kernel's ksmbd (SMB) filesystem, a missing access control for FSCTL_SET_SPARSE was found. The fsctl_set_sparse() function modifies the sparse attribute of a file without checking if the share is read-only or if the client has proper permissions (FILE_WRITE_DATA or FILE_WRITE_ATTRIBUTES).

A vulnerability was found in the Linux kernel's pskb_carve_inside_header() and pskb_carve_inside_nonlinear() functions, which copy the skb_shared_info structure without incrementing the reference count for the destructor_arg pointer (uarg) used by MSG_ZEROCOPY. This leads to premature freeing of ubuf_info_msgzc memory, potentially allowing privilege escalation.

A vulnerability was found in the Linux kernel's netfilter logging (nf_log), where dump_mac_header() fails to verify the MAC header is set before reading it. An attacker can send a crafted packet via AF_PACKET with PACKET_QDISC_BYPASS, causing an out-of-bounds read (slab-out-of-bounds) and potential data leak into kernel logs.

In the Linux kernel, a vulnerability in the SMC (Shared Memory Communications) subsystem causes a NULL pointer dereference in the smc_msg_event tracepoint. The tracepoint unconditionally dereferences conn->lnk, which is NULL for SMC-D connections, leading to a kernel crash on the first sendmsg() or recvmsg() call on an SMC-D socket when tracing is enabled.

In the Linux kernel, the tun_put_user() function declares an on-stack struct virtio_net_hdr_v1_hash_tunnel without zeroing it. For non-tunnel packets, only the first 10 bytes are initialized, leaving bytes 10..23 as stack garbage. An unprivileged user can set the vnet header size to 24 bytes, causing 14 bytes of kernel stack data to be leaked to userspace on every read of a non-tunnel packet.

In the Linux kernel, a vulnerability in the RDS/IB driver causes a NULL pointer dereference in rds_ib_send_cqe_handler() when handling masked atomic completions. The rds_ib_send_unmap_op() function lacks handling for masked atomic opcodes (IB_WR_MASKED_ATOMIC_CMP_AND_SWP and IB_WR_MASKED_ATOMIC_FETCH_AND_ADD), returning NULL and triggering a kernel panic in softirq context.

A NULL pointer dereference vulnerability was found in the Linux kernel's BPF subsystem within bpf_sk_storage_clone and bpf_sk_storage_diag_put_all functions. A concurrent RCU reader can observe a storage element (selem) still on the list after its smap pointer has been cleared by bpf_selem_unlink_nofail(), leading to a crash.

In the Linux kernel, a stack info leak was found in the tap driver via the SIOCGIFHWADDR ioctl. The tap_ioctl() function copies 16 bytes of an uninitialized sockaddr_storage structure to userspace, while netif_get_mac_address() only writes 6 bytes of the MAC address, leaving 8 bytes uninitialized. These 8 bytes may leak sensitive kernel data, including pointers, defeating KASLR.