Linux kernel vulnerabilities

In the Linux kernel, procfs lacks proper RCU protection when accessing task->real_parent in do_task_stat() while reading /proc/[pid]/stat, leading to a use-after-free (UAF). The fix replaces task_tgid_nr_ns() with task_ppid_nr_ns().

In the Linux kernel, the linehandle_create() function has a NULL pointer dereference after calling retain_and_null_ptr(lh). A debug print tries to read from the already nulled pointer, causing a crash.

In the Linux kernel on ARM32 platforms, when SP804 is not registered as sched_clock, read_current_timer() calls sp804_read on an uninitialized sched_clkevt, causing a kernel Oops.

In the Linux kernel, the LOCALIO mechanism (NFS loopback optimization) is vulnerable to recursive deadlock during direct reclaim. Page cache allocations can trigger nfs_writepages, causing a deadlock.

In the Linux kernel fsl-edma DMA driver, the fsl_edma_remove() function manually disables clocks that are already automatically managed by devm_clk_get_enabled(). This triggers warnings on driver removal about attempting to disable an already disabled clock.

In the Linux kernel, the AppArmor module has a vulnerability where DFA (Deterministic Finite Automaton) tables from kernel or userspace are not guaranteed to be 8-byte aligned, causing unaligned memory accesses on various architectures. This triggers warnings and potential kernel panics.

In the Linux kernel, a buffer overflow vulnerability was found in the persistent_ram_save_old() function of the pstore/ram subsystem. The function can be called multiple times for the same zone, and when the buffer size changes between calls, it leads to an out-of-bounds write (OOB write) and subsequent out-of-bounds read (OOB read).

In the Linux kernel, in the regulator core, the error path of regulator_resolve_supply() lacked proper locking, causing a lockdep warning. The fix uses regulator_put() instead of _regulator_put() and adds appropriate locking.

In the Linux kernel on MIPS architecture, a bug was found in LLVM compiler that incorrectly restores the $gp register used as a global register variable. After kernel relocation, $gp points to unrelocated code, causing an early crash during CPU initialization.

In the Linux kernel, in the octeontx2-af driver, a bug causes the PF driver to crash during kexec booting. During a kexec reboot, hardware state persists, and the PF driver may incorrectly assume AF is ready, leading to a crash.

In the Linux kernel, in the ath12k wifi driver, a bug occurs where stale link mappings in ahvif->links_map are not cleared. When arvif initialization in non-AP STA mode fails before creation, a stale entry remains, potentially triggering a WARN_ON when the same link ID is used.

In the Linux kernel, the Qualcomm GFX3D clock driver crashes when determining the clock rate due to a missing parent field in the parent request map. This regression was introduced by a change in the divider algorithm that now requires proper parent mapping.

In the pm8916_lbc power supply driver in the Linux kernel, there is a use-after-free vulnerability in extcon_set_state_sync(). The order of IRQ and extcon registration is incorrect, leading to use of a freed pointer.

In the Linux kernel, the amdgpu display driver had a NULL pointer dereference vulnerability in the amdgpu_dm_hpd_init() function. The code assumed dc_link was always valid, leading to a crash when setting up HPD interrupts for connectors without a valid link.

In the Linux kernel, in the panthor GPU driver, a bug occurs where failures in panthor_gpu_flush_caches() are not recovered from. When flush operations never complete, the driver does not schedule a reset, potentially leading to a hang. The fix adds reset scheduling and skipping subsequent flush operations after timeout.

In the Linux kernel PCI Endpoint subsystem, there is a missing NULL check for alloc_workqueue(). If allocation fails, a NULL pointer dereference may occur when queue_work() is called in epf_ntb_epc_init().

Memory corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer.

In the Linux kernel, a vulnerability in the SMB client was fixed that allowed userspace to create cifs.spnego keys with authority-bearing fields (such as pid, uid, creduid, upcall_target) via request_key(2) or add_key(2). Now only kernel-originating descriptions are accepted.

A use-after-free (UAF) vulnerability was found in the Linux kernel's eventpoll (epoll) mechanism. The bug occurs in ep_remove() which, after clearing the file->f_ep pointer, may still use the file structure while a concurrent __fput() can free it, leading to writes into freed memory. An attacker can exploit this to trigger a controlled kmem_cache_free() on the wrong slab cache.

The SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT statement in zcan_sendto_ctx() before dereferencing it in socketcan_to_can_frame(). In production builds where assertions are disabled, a userspace application that controls the length passed to a sendto syscall can supply an incomplete or truncated frame, causing socketcan_to_can_frame() to dereference fields beyond the end of the buffer. This results in an out-of-bounds read that can cause denial-of-service crashes or, because the parsed frame contents are transmitted on the network, leak adjacent memory.

In the Linux kernel, a vulnerability related to use-after-free on SPI mpc52xx controller registration failure has been fixed. The issue was due to not disabling and freeing interrupts, which could lead to resource leaks.

A vulnerability has been identified in the Linux kernel related to use-after-free in the iris_release_internal_buffers() function. A recent change introduced a regression that may lead to accessing a freed buffer.

A vulnerability related to the Xbox Remote controller has been resolved in the Linux kernel, concerning the violation of DMA coherency rules. The buffer for IO must not be part of the device structure, which could lead to data integrity issues.

In the Linux kernel, a vulnerability related to the lack of checks for return values from ioremap in the saa7164_dev_setup() function has been resolved. In case of failure, already allocated PCI memory regions are released and the device is removed from the global list.

A vulnerability has been identified in the Linux kernel within the vsock_update_buffer_size() function, allowing the buffer size to exceed the maximum limit. The issue stemmed from an incorrect order of checking minimum and maximum values, potentially violating socket memory boundaries.

A vulnerability has been identified in the Linux kernel related to the HID PlayStation device, allowing for reading data beyond the bounds of the touch_reports array. This issue occurs in the dualshock4_parse_report function, where the number of touch reports may be incorrectly reported by the device.

A vulnerability has been identified in the Linux kernel related to VRAM allocation in KFD. The absence of the AMDGPU_GEM_CREATE_VRAM_CLEARED flag allowed freshly allocated VRAM to contain stale data, leading to crashes in RCCL P2P transport.

In the Linux kernel SCTP stack, a vulnerability was found due to improper revalidation of the list cursor in sctp_sendmsg() for the SCTP_SENDALL path. While iterating over associations, the list can be modified by another thread, leading to use-after-free or type confusion.

A vulnerability related to SPI controller deregistration has been fixed in the Linux kernel. The issue involved not properly releasing resources like DMA before deregistering the controller during driver unbind.

A vulnerability related to SPI controller deregistration has been fixed in the Linux kernel. The issue was that the controller was not properly deregistered before releasing resources like DMA during driver unbind.

A vulnerability related to memory leak in the xe_dma_buf_init_obj() function has been fixed in the Linux kernel in case of allocation failure. On error, the previously allocated memory is not freed, which can lead to memory leaks.

A vulnerability in the Linux kernel related to cgroup has been resolved, which could lead to system deadlock during the removal of a control group. The issue stemmed from improper management of tasks during their removal, potentially causing processes to be unable to terminate due to waiting for resource release.

A vulnerability has been identified in the Linux kernel due to missing checks for connected devices in pads, which may lead to a NULL pointer dereference when enabling the stream.

A vulnerability has been identified in the Linux kernel related to a memory leak of the device name. The device name allocated via kzalloc() in init_one_mc() is not freed on the normal removal path, leading to a memory leak.

A vulnerability in the Linux kernel has been resolved by replacing BUG_ON() calls in the sdma_v4_0_ring_emit_fence() function with WARN_ON() calls. This allowed unprivileged users to trigger a kernel panic through misaligned fence writeback addresses.

A vulnerability in the Linux kernel related to bounds checking in the uvd/vce/vcn code has been resolved, which accesses the IB at predefined offsets.

A vulnerability in the Linux kernel has been resolved by adding a NULL check for media_gt in the intel_hdcp_gsc_check_status() function. When media GT is disabled, the lack of allocation for media_gt leads to a kernel pagefault error.

A race condition was found in the Linux kernel DRM driver in the change_handle function. During handle swap, a single object briefly had two IDR entries, allowing a concurrent gem_close to delete the object and leave a dangling handle, leading to a use-after-free.

A vulnerability has been identified in the Linux kernel related to the leak of the accepted connection count on transport mismatch. The issue occurs when the vsock_assign_transport() function fails or selects a different transport, leading to a permanent increment of sk_ack_backlog.

A vulnerability has been identified in the Linux kernel within the msm_ioctl_gem_info_get_metadata() function, which always returns 0, ignoring errors. This causes userspace to incorrectly interpret that the ioctl call succeeded when it did not.

A vulnerability has been identified in the Linux kernel related to the use-after-free of the fmt_src object during Macro Blocks Per Frame (MBPF) checks. The issue occurs when multiple instances run in parallel, leading to a race condition between threads.

A vulnerability has been identified in the Linux kernel related to inconsistent plane dimension calculations in the drm_gem_fb_init_with_funcs() function. This flaw leads to incorrect GEM object size validation, potentially resulting in memory access beyond the object's bounds.

A vulnerability has been identified in the Linux kernel related to improper data copying for non-linear buffers. The issue was that during the copying of the original payload to a new buffer, the copy length was set to zero, resulting in no data being copied.

A vulnerability in the Linux kernel has been resolved by disallowing all private IOCTLs. IOCTLs are not as safe as one might assume, hence they have been temporarily disabled.

A vulnerability in the Linux kernel related to unclocked register access during driver unbind has been fixed. The issue involves ensuring the controller is runtime resumed before disabling it.

In the Linux kernel, a vulnerability related to dma-buf attachment leak in the function xe_gem_prime_import() has been fixed. The issue occurs when xe_dma_buf_init_obj() fails, and the attachment is not detached.

A vulnerability related to the deregistration of the SPI controller in mpc52xx has been fixed in the Linux kernel. The issue was that the controller was not properly deregistered before disabling and releasing resources such as interrupts and GPIOs.

A vulnerability in the Linux kernel has been resolved, concerning the validation of the nattr field in the SVM ioctl against the buffer size. This prevents out-of-bounds buffer access via user-controlled attribute count.

A vulnerability has been identified in the Linux kernel related to tracepoints that occurs during the failure of the func_add() function in tracepoint_add_func(). In the event of an error, the function does not call the corresponding unregfunc(), leading to an incorrect reference state.

A vulnerability has been identified in the Linux kernel related to out-of-bounds access to the font buffer during console rotation failure. The fbcon_rotate_font() function does not clear the font buffer, which may lead to buffer overflow when printing to the rotated console.