Linux kernel vulnerabilities

In the Linux kernel, the amdgpu driver fixed an issue with stale wptr mapping access that could lead to a security issue during queue creation.

In the Renesas VSP1 driver in the Linux kernel, a NULL pointer dereference occurs when unloading the module on gen 4. The cleanup code calls vsp1_drm_cleanup() instead of vsp1_vspx_cleanup() for the appropriate IP version. The fix checks the IP version and calls the correct function.

In the Linux kernel's DRM driver for Intel GPUs (xe), there is missing validation of the PAT index for CPU cached memory. Using XE_COH_NONE coherency mode with CPU cached memory can lead to data leakage.

In the Linux kernel Mediatek pmdomain driver, the function scpsys_get_bus_protection_legacy() calls of_node_put() on a device node before checking for an error from syscon_regmap_lookup_by_phandle(). If an error occurs, dev_err_probe() dereferences the already freed node, leading to a use-after-free vulnerability.

In the Linux kernel, the ath5k driver has an out-of-bounds array access. The index 'ts->ts_final_idx' can be 3 on 5212 hardware, causing a write beyond the 'rates' array of size 4. The issue was reported by UBSAN. The patch adds a check to ensure the index is less than the array size before setting the sentinel.

A vulnerability was found in the Linux kernel's flow_dissector, which mishandles PPPoE frames with Protocol Field Compression (PFC). Sending a crafted PPPoE PFC frame to a network interface on MIPS architecture can cause an unaligned access exception, leading to a system crash.

In the rtl8723bs driver in the Linux kernel, the return value of kzalloc_flex() is used without checking for allocation failure, potentially leading to a NULL pointer dereference and system crash.

In the Linux kernel, a vulnerability was found in the NVMe over Fabrics (NVMe-oF) target subsystem where nvmet_ctrl_free() calls flush_work on the same nvmet-wq workqueue, potentially causing a deadlock and triggering a lockdep recursive locking warning.

A vulnerability was found in the Linux kernel's ISO 9660 filesystem (isofs) related to Rock Ridge extension validation. The rock_continue() function reads the extent block number from the CE record without checking if it is within the mounted volume bounds, potentially leading to out-of-range reads or reads from adjacent filesystems. Although no memory safety violation occurs, it may enable information leakage via readlink().

In the Linux kernel, the restriction preventing multiple opens of /sys/fs/selinux/policy was removed, which previously allowed any process to block others from reading the SELinux policy. The fix eliminates the policy_opened flag and shrinks the critical section.

In the Linux kernel topcliff-pch SPI driver, a use-after-free vulnerability occurs during driver unbind. The SPI queue is not flushed before releasing DMA buffers, which can lead to use of already freed memory.

In the Linux kernel HFS+ filesystem, a held lock is freed without release on an error path in hfsplus_fill_super(). The function fails to release tree->tree_lock before jumping to the out_put_root label after a failed hfsplus_cat_build_key() call, triggering a held lock freed warning.

In the Linux kernel, a race condition in the pseries/papr-hvpipe module can cause a deadlock when interrupts fire during ioctl or release handlers.

In the libwx driver in the Linux kernel, request_threaded_irq() was used with a primary handler but no threaded handler, along with the IRQF_ONESHOT flag. This combination triggers a kernel warning. The fix switches to request_irq() and removes the unnecessary flag.

In the s3c64xx SPI driver in the Linux kernel, a NULL pointer dereference occurs on driver unbind. A change moving DMA channel allocation from probe() to s3c64xx_spi_prepare_transfer() did not remove the corresponding deallocation from remove(). The fix drops the bogus DMA channel release from remove().

A bug was found in the Linux kernel's KVM for x86, where __kvm_apic_update_irr skips scanning IRR when PID.ON is set but PIR is empty. This triggers a false WARNING in vmx_check_nested_events() and causes unnecessary L2 VM-Enter/VM-Exit cycles.

In the Linux kernel, a buffer overflow was found in the retrieve_status function in the dm-ioctl driver. The bug is due to missing overflow check when aligning the outptr pointer to an 8-byte boundary, potentially leading to out-of-bounds write. However, the vulnerability has no security implications because only root can issue device mapper ioctls and libraries use 8-byte aligned buffers.

In the Microchip MPFS-CCC clock driver in the Linux kernel, there is an out-of-bounds access during PLL output registration. The hws array is too small, leading to read/write beyond allocated memory.

In the Linux kernel, the PM domain (genpd) framework is missing a pm_runtime_disable() call when detaching virtual devices. This leaves runtime PM enabled for those devices, potentially causing critical errors like NULL pointer dereference or unnecessary performance state votes.

In the Linux kernel, the CAAM cryptographic driver's hash_digest_key() function uses print_hex_dump() to display HMAC keys, potentially leaking sensitive data when CONFIG_DYNAMIC_DEBUG is enabled. The fix changes this to print_hex_dump_devel(), which is safer.

A vulnerability was found in the Linux kernel's handling of page faults during EFI runtime calls. A change in FPU code (d02198550423) causes kernel_fpu_begin() to disable softirqs via local_bh_disable(), setting SOFTIRQ_OFFSET in preempt_count. This makes efi_crash_gracefully_on_page_fault() incorrectly treat the context as an interrupt, leading to a panic() instead of graceful EFI_ABORTED recovery, resulting in a hard system freeze.

In the Linux kernel, a use-after-free (UAF) bug was found in the of_unittest_changeset() function in unit tests. The variable 'parent' points to the same device as 'nchangeset', and calling of_node_put(nchangeset) can free memory that is later accessed by 'parent'. The bug only affects test code but may mask more serious issues.

In the txgbe driver for copper NICs with external PHY, a missing RTNL lock during PHY disconnection on module removal triggers an RTNL assertion warning in phylink_disconnect_phy().

In the Linux kernel, the QCOM LPG LED driver lacks an array bounds check when selecting high-resolution values. A 3-bit register field is used to index an array with only 5 elements, potentially causing out-of-bounds reads and setting incorrect values.

In the MTD docg3 driver in the Linux kernel, there is a use-after-free vulnerability in docg3_release(). The docg3 pointer is used after memory is freed, leading to a dangling pointer dereference.

In the Linux kernel, the hugetlb module crashes during early boot if kernel command-line parameters (hugepages, hugepagesz, default_hugepagesz) are specified without the '=' separator. This passes NULL to hugetlb_add_param(), which dereferences it in strlen(), causing a system crash.

In the Linux kernel, the TPM driver's tpm_dev_release() function uses kfree() instead of kfree_sensitive() to free the auth structure containing sensitive cryptographic data (HMAC session keys, nonces, passwords). Other code paths use kfree_sensitive(), leading to inconsistency and leaving sensitive data in memory.

In the Linux kernel, the IIO ADMV1013 driver may leave the str variable uninitialized if device_property_read_string() fails. The code then calls strcmp(str, ...) on an uninitialized pointer, leading to a NULL pointer dereference.

In the Linux kernel, a buffer overflow was found in the vrealloc_node_align() function in the vmalloc allocator. When shrinking an allocation (size < old_size), the code copies old_size bytes into the new buffer, causing an out-of-bounds write. The bug was introduced in commit 4c5d3365882d.

In the Linux kernel HMM test (test_hmm), there is a use-after-free vulnerability. When closing the file, device pages are not migrated back to system memory, leaving a dangling zone_device_data pointer.

In the Linux kernel, a vulnerability was found where allocation tags (codetags) are not initialized for pages allocated before the page_ext structure is set up. This causes warnings and potential errors when such pages are freed, especially in configurations with memory allocation profiling debugging enabled.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the Imagination (powervr) DRM driver when updating the ftrace mask. The issue is caused by passing incorrect data to a debugfs entry, leading to a segfault and system crash.

In the Linux kernel mm/zone_device, after calling ->folio_free() on a device folio, its contents can immediately change (the folio may be reallocated by a driver with a different order). The code touched the folio again after freeing to extract the pgmap, which is unsafe. The fix uses a local stack variable to store the pgmap before calling ->folio_free().

In the Linux kernel, the AMDGPU driver on RDNA4 (GFX 12) cards lacks GDS, GWS, and OA memory. The function amdgpu_ttm_init_on_chip() is called with zero size, leading to drm_mm_init(mm, 0, 0) and triggering a DRM_MM_BUG_ON assertion, causing a kernel crash during amdgpu module load.

In the Linux kernel, Bluetooth HCI UART driver vulnerabilities lead to Use-After-Free (UAF) and data races. The issue stems from improper workqueue and synchronization management during close and init paths, potentially causing system crashes.

In the Linux kernel, a use-after-free (UAF) bug was found in io-wq in the io_wq_remove_pending() function. When cancelling hashed work in bucket 0, if the predecessor on the list is not hashed, a pointer to it is stored in wq->hash_tail[0], leading to write through freed memory after deallocation.

In the Linux kernel, the custom vblank timer in the DRM vkms driver was replaced with the DRM implementation. The corresponding hrtimer in struct vkms_output was removed, and timeout code is now called via DRM.

In the Linux kernel, the ibmveth driver has an issue with GSO segmentation for packets with small MSS (below 224 bytes). Attempting to send such packets freezes the adapter, stopping all traffic until manual reset.

A race condition in the Linux kernel's CoreSight TMC-ETR driver occurs when sysfs and perf modes are used simultaneously, triggering a WARN_ON() when hardware is enabled while the buffer is already initialized by perf mode.

In the Linux kernel, the ath12k Wi-Fi driver causes firmware crash on WCN7850 when WoW offloads are enabled on both primary and secondary links in multi-link connections. Fixed by enabling WoW only on the primary link.

In the rt9455 power supply driver in the Linux kernel, there is a use-after-free vulnerability in power_supply_changed(). The order of IRQ and power_supply registration is incorrect, leading to use of a freed pointer.

In the Linux kernel pinctrl driver for Canaan K230, a NULL pointer dereference occurs during device tree parsing. The k230_pinctrl_parse_functions() function attempts to access the device pointer via info->pctl_dev->dev, but info->pctl_dev is initialized only after DT parsing completes, causing a crash.

In the Linux kernel PCI P2PDMA subsystem, the p2pmem_alloc_mmap() function uses an incorrect warning condition. After changing the initial page refcount from 1 to 0, the condition VM_WARN_ON_ONCE_PAGE(!page_ref_count(page)) falsely triggers a warning when the page has a refcount of 0.

In the Linux kernel, the NFC HCI SHDLC subsystem fails to stop timers and work before freeing context, leading to use-after-free (UAF) and other shutdown races.

In the Linux kernel, a problem was detected in the RDMA hns driver where during a reset triggered by sunrpc, the hns_roce_irq_workq workqueue is flushed but lacks the WQ_MEM_RECLAIM flag, causing a warning and potential memory allocation issues. The issue occurs during QP destruction, leading to memory leaks.

In the Linux kernel DRM driver for Intel Xe (xe), a vulnerability was found in the sysfs initialization for SR-IOV PF. On devm_add_action_or_reset() failure, the cleanup action was called on an uninitialized kobject, leading to kernel warnings and potential use-after-free. The fix separates kobject_init() and kobject_add() calls and registers the cleanup action only after full kobject initialization.

In the Linux kernel graphics driver (drm/amd/display), an out-of-bounds access vulnerability was found in the stream_enc_regs[] array. The eng_id index can be negative or equal to 5 (ENGINE_ID_DIGF), while the array has only 5 elements (indices 0-4). Missing bounds check before indexing leads to memory access beyond the array.

In the Linux kernel, a patch for ASoC fsl_xcvr that attempted to add a missing lock in fsl_xcvr_mode_put() was reverted. The original patch caused a deadlock and hung task because the function is already called with the lock held.

In the Linux kernel, a potential NULL pointer dereference was found in the wpcm_fiu_probe() function of the SPI wpcm-fiu driver. platform_get_resource_byname() can return NULL, causing a crash when passed to resource_size(). The fix moves the fiu->memory_size assignment after the error check for devm_ioremap_resource() to prevent the issue.

In the Linux kernel, an out-of-bounds read vulnerability was found in the fib6_add_rt2node() function. The issue occurs when adding an IPv6 route with RTA_NH_ID, where the fib6_info structure lacks the trailing fib6_nh. Missing check of the iter->nh pointer before accessing iter->fib6_nh leads to a KASAN error and potential security compromise.