Linux kernel vulnerabilities

In the Linux kernel, the jitterentropy crypto mechanism replaced a long-held spinlock with a mutex. Previously, the spinlock was held during expensive entropy generation and SHA3 conditioning, causing CPU stalls for parallel readers.

In the Linux kernel's xfrm/espintcp module, a vulnerability was found where the partial send state (ctx->partial) is reused before completion. The espintcp_sendmsg() function may overwrite an active send state, leading to a stale offset in a new message and a potential out-of-bounds memory read.

In the Linux kernel's batman-adv module, a buffer overflow vulnerability was found in TVLV packet processing. The function calculating the TVLV container list size used u16 type, causing integer wrap when the total exceeded 65535 bytes, leading to undersized buffer allocation and out-of-bounds write.

In the Linux kernel, a vulnerability was found in the io_uring/poll mechanism where a signed comparison in io_poll_get_ownership() prevented the slowpath from being taken when the cancel flag (IO_POLL_CANCEL_FLAG) was set. This caused cancel operations to be mishandled.

In the Linux kernel xfrm/ipcomp module, a vulnerability was found where destination pages are not freed on asynchronous compression (acomp) errors. This causes a memory leak because the destination SG list is not cleaned up on failure.

A vulnerability was found in the Linux kernel's IPC Shared Memory (shm) subsystem. The orphan cleanup function (shm_destroy_orphaned) does not properly synchronize reading the shm_nattch counter with update operations, potentially leading to premature removal of a shared memory segment.

In the Linux kernel, a vulnerability in SCTP stream handling causes incomplete rollback when ADD_OUT_STREAMS is denied. Leftover metadata from removed streams can trigger a null-pointer dereference in the scheduler when the stream is re-added.

A vulnerability was found in the Linux kernel's AF_UNIX socket implementation. The SIOCATMARK ioctl, which reports the urgent data mark position (MSG_OOB), was accessible for all socket types, even though MSG_OOB is only supported for SOCK_STREAM. For SOCK_DGRAM and SOCK_SEQPACKET sockets, which reject MSG_OOB, the call now returns -EOPNOTSUPP.

In the Linux kernel, a vulnerability was found in the ebtables module where the compat_mtw_from_user() function lacks proper validation of user-supplied match_size/target_size. This can cause an out-of-bounds read when converting ebtables extensions from 32-bit user structures to kernel native structures.

In the Linux kernel's batman-adv module, a vulnerability exists where the currently selected gateway pointer is not cleared during mesh teardown, leaving stale state that can break subsequent mesh recreation.

In the Linux kernel VRF subsystem, a potential NULL pointer dereference (NPD) was found when removing a port from a VRF. RCU readers may assume a net device is a VRF port and call l3mdev operations on a new master device (e.g., a bridge) that lacks them, leading to NULL dereference.

In the Linux kernel, a vulnerability exists in the SysV IPC ID allocation mechanism. The `ipc_idr_alloc()` function in the checkpoint/restore path can allocate an ID beyond the valid range (`ipc_mni`), causing incorrect IDR mapping and dangling pointers. This can lead to memory corruption and potential code execution via freed memory dereference.

In the Linux kernel, the batman-adv module (Distributed ARP Table) fails to check the return value of pskb_copy_for_clone(). A failed memory allocation leads to a NULL pointer dereference in batadv_send_skb_prepare_unicast_4addr(), causing a system crash.

In the Linux kernel netfilter/ipset subsystem, a vulnerability was found in IPv4 range iteration for hash:ip,mark, hash:ip,port, hash:ip,port,ip, and hash:ip,port,net sets. The 32-bit iterator may advance past the end of the requested range after processing the last address, causing a later retry to continue from an unintended position.

A vulnerability was found in the Linux kernel's netfilter xt_policy module, affecting strict mode inbound policy matching. The match_policy_in() function processes sec_path entries in reverse order, causing inconsistent matching of multi-element inbound rules.

In the Linux kernel, the batman-adv module's tp_meter counter underflows during shutdown due to multiple callers of batadv_tp_sender_shutdown(). This causes a use-after-free when the interface is removed while a zombie sender thread loops indefinitely.

A vulnerability was found in the Linux kernel's Bluetooth stack due to unsynchronized access to the accept_q queue. The bt_sock_poll() function walks the queue without locking, while child socket teardown can concurrently unlink and release the last reference, causing a race condition. This issue has existed since the initial Bluetooth implementation.

In the Linux kernel, a vulnerability in the SCTP sock_diag mechanism allows the dump_one function to process stale associations. After blocking on lock_sock() and sctp_association_free() completes, the association is marked dead and its bind address list is freed, leading to an out-of-bounds memory read.

In the Linux kernel, the batman-adv module is vulnerable to recursive processing of BATADV_UNICAST_FRAG packets. A malicious sender can craft a packet whose reassembled payload is itself a BATADV_UNICAST_FRAG packet, causing unbounded recursion and kernel stack exhaustion.

In the Linux kernel, the netfilter ip6t_hbh module lacks validation of the Hop-by-Hop options list size. Userspace can supply an optsnr value larger than allowed (IP6T_OPTS_OPTSNR = 16), causing an out-of-bounds access on the opts array. The issue was reported by UBSAN as an array-index-out-of-bounds error.

In the Linux kernel, the batman-adv module has a NULL pointer dereference vulnerability. When a network interface is disabled, its mesh_iface pointer is set to NULL, but batadv_v_ogm_send_meshif() may still dispatch OGMv2 packets through the disabled interface, causing a crash due to accessing NULL.

A use-after-free vulnerability was found in the Linux kernel's netfilter queue (NFQUEUE) for bridged packets. br_pass_frame_up() changes skb->dev to the bridge master before queuing, but NFQUEUE does not hold a reference to this device, leading to a use-after-free when the packet is reinjected after the bridge is removed.

In the Linux kernel, a vulnerability in ksmbd was found where the conn->binding flag remained set after SESSION_SETUP, allowing global session lookup for connections not bound to that session. The fix tightens the global lookup to require the session to have the connection registered in its channel xarray.

A vulnerability was found in the Linux kernel's BPF reuseport group mechanism. The cBPF program was freed immediately without waiting for the RCU grace period, leading to an out-of-bounds read (use-after-free) in reuseport_select_sock during socket selection.

In the Linux kernel, a vulnerability was found in the ip6_vti driver where the fallback device (ip6_vti0) does not have the netns_immutable flag set. Other similar tunnel drivers (e.g., ip6_tunnel, sit) correctly set this flag to prevent the device from being moved to another network namespace.

In the Linux kernel, a vulnerability was found in the MR re-registration mechanism in RDMA drivers. When changing access permissions from read-only (RO) to read-write (RW), the consistency of the user memory mapping (umem) was not verified, potentially leading to improper page pinning.

Vulnerability in the Linux kernel net/sched pedit module causes page cache corruption due to incomplete COW during packet editing.

A use-after-free vulnerability in the Linux MANA driver allows an authorized attacker to elevate privileges locally.

In the Linux kernel, the rockchip rkcif media driver fixed off-by-one errors that could cause out-of-bounds array access.

In the Linux kernel's 9p filesystem, a vulnerability was found where access mode flags are ORed instead of replaced. When mounting with 'access=user', both V9FS_ACCESS_CLIENT and V9FS_ACCESS_USER flags are set, preventing proper operation of privileged commands like chown.

In the Linux kernel, in the DAMON subsystem, a missing check for power-of-two min_region_sz in damon_start() can lead to invalid region address ranges. The issue has been fixed by adding the appropriate check.

In the Linux kernel, in the Nouveau driver (drm/nouveau), failure of aperture_remove_conflicting_pci_devices() during probe causes a leak of the nvkm_device object because the error path does not free it before returning. The issue has been fixed by jumping to the fail_nvkm label.

In the Linux kernel, the greybus gb-beagleplay driver has a buffer overflow vulnerability in cc1352_bootloader_rx() due to missing bounds check before memcpy, which could lead to buffer overflow and potential code execution.

In the Linux kernel, TCP ULP support for SMC was reverted because the implementation violated VFS invariants, creating a risk of use-after-free and system instability.

In the Linux kernel, in the EROFS filesystem, I/O requests beyond the end of the filesystem for file-backed mounts are not zeroed out, which could lead to data leakage. The issue has been fixed by properly zeroing such requests.

In the Linux kernel, the AppArmor module fixed rlimit handling for POSIX CPU timers by conditionally updating the timers.

In the Linux kernel's device mapper, a vulnerability was found in the dm_blk_report_zones function, which checks the device's suspended state without holding a lock. The device could be suspended right after the check, leading to a race condition.

In the Linux kernel, in the MPRLS0025PA pressure driver (iio: pressure), the spi_transfer struct was not zeroed before use. This can lead to unpredictable behavior or errors during SPI communication.

In the Linux kernel, the netfilter nf_tables subsystem functions nft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks did not use list_del_rcu() when removing elements from the netlink hooks list. Since this list can be concurrently traversed by dumpers, the lack of RCU synchronization could lead to a data race.

In the Linux kernel, a vulnerability in the GRO (Generic Receive Offload) mechanism allows merging zerocopy packets without checking the SKBFL_MANAGED_FRAG_REFS flag, potentially leading to use-after-free (UAF). The issue occurs when either the last packet in the GRO chain or the source packet is zerocopy.

In the Linux kernel, in the tun driver, a memory leak was found in tun_xdp_one() on build_skb() failure. The page allocated by vhost_net_build_xdp() was not freed, leading to memory exhaustion. Each failure in a batch leaks a page-frag chunk.

In the Linux kernel, in the tun driver, a memory leak was found in tun_xdp_one() when rejecting frames shorter than ETH_HLEN. The page allocated by vhost_net_build_xdp() was not freed, leading to memory exhaustion. A local attacker can exploit this to trigger an OOM panic.

In the Linux kernel, a memory leak occurs in tap_get_user_xdp() because pages are not freed on error paths, leading to page-frag leaks.

In the Linux kernel, a use-after-free (UAF) vulnerability was found in the net/sched: act_ct module during flow table lookup. The rhashtable_lookup_fast() function releases the RCU lock before incrementing the reference count, allowing concurrent freeing of the ct_ft object and leading to privilege escalation.

In the Linux kernel, a patch for hugetlbfs was reverted because it incorrectly handled VMA lock allocation at the mmap_prepare stage, potentially causing a lock leak. The revert restores previous behavior to allow redesign.

In the Linux kernel, KVM for ARM64 has a use-after-free vulnerability in the nested_mmus array. The array is reallocated without proper locking, which can lead to referencing freed memory by other threads.

In the Linux kernel, the IORING_OP_WAITID operation does not initialize the result structure before copying it to userspace. If the operation completes without reporting a child event, stale data from previous memory usage may be exposed.

In the Linux kernel, a vulnerability in the v3d graphics driver allows an infinite loop. A local user can craft a self-referential ioctl extension with zero sync counts, bypassing existing guards and causing a kernel thread to hang and a CPU core to be pegged indefinitely.

In the Intel IPU6 driver in the Linux kernel, an error pointer dereference occurs in an error path. The variable isp->psys is an error pointer, not NULL, leading to dereferencing it. The fix sets isp->psys to NULL before cleanup.

In the Linux kernel, the videobuf2 subsystem lacked setting VMA flags (VM_DONTEXPAND and VM_DONTDUMP) in vb2_dma_sg_mmap, causing a WARN_ON during dma-buf memory mapping in the Apple ISP driver. The fix adds these flags for consistency with vb2_dma_contig.