Linux kernel vulnerabilities

In the Linux kernel, init_nfsd() calls nfsd_debugfs_init() before nfsd4_init_slabs(). If slab allocation fails, the early return bypasses nfsd_debugfs_exit(), leaving orphan debugfs files with stale fops pointers into freed module text.

In the Linux kernel's nfsd module, a client could send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD request with an out-of-range nseconds field for atime/mtime (tv_nsec >= NSEC_PER_SEC). The value passed protocol-level validation but was not normalized, leading to on-disk metadata corruption on ext4 and XFS filesystems (incorrect seconds and year). The fix rejects such requests with NFS3ERR_INVAL before any changes are made.

In the Linux kernel, the NFSv2 attribute decoder (svcxdr_decode_sattr) converts wire useconds to nanoseconds by multiplying by 1000 and storing the result in tv_nsec. On 32-bit (ILP32) architectures, an out-of-range useconds value such as 4294968 overflows and produces an incorrect tv_nsec value (e.g., 704) that passes later range checks. The vulnerability affects NFSv2 SETATTR and CREATE operations and was fixed by rejecting useconds values greater than 1000000 during decoding.

A use-after-free vulnerability was found in the Linux kernel nfsd subsystem related to copy-notify stateids. The _free_cpntf_state_locked() function only unlinked an entry once its refcount reached zero, so revoke paths (parent-stid drain, OFFLOAD_CANCEL, and laundromat expiry) could drop a reference without unlinking, leaving the entry discoverable to a concurrent reader. The fix adds revoke_cpntf_state_locked(), which unhashes the entry from the IDR and sc_cp_list first and defers the final free to any holder.

In the Linux kernel, writing a filesystem path to /proc/fs/nfsd/unlock_filesystem runs nfsd4_cancel_copy_by_sb() before nfsd_mutex is held and before confirming nn->nfsd_serv is set. After shutdown, nn->conf_id_hashtbl was freed but the pointer remained, causing a use-after-free read.

In the Linux kernel, the libceph module has a vulnerability due to missing validation of OSD extent maps before cursor advance. The osd_sparse_read() function does not verify that each extent is monotonic and within the request range, allowing a malicious OSD to advance the cursor beyond the buffer and trigger BUG_ON. This leads to a Ceph client crash.

In the Linux kernel, the Ceph subsystem's ceph_cap_reclaim_work() repeatedly re-queued itself whenever ceph_trim_dentries() returned -EAGAIN, creating a CPU-consuming busy loop with no progress. The issue was worsened by touching valid directory leases (TOUCH) instead of leaving them in place (KEEP), preventing the walk from terminating naturally. The fix adjusts lease reclaim logic and the conditions for returning -EAGAIN.

A leaked inode reference in the Linux kernel Ceph filesystem was fixed for the writeback abort path during umount. When ceph_inc_osd_stopping_blocker() fails during umount, the write request is aborted and the wrbuffer claim (i_wrbuffer_ref) is never released, so the inode cannot be evicted and the kernel reports "Busy inodes after unmount of ceph".

In the Linux kernel, btrfs_recover_relocation() leaks reloc_root references on recovery failure. When loading or adding a later root fails, or the first transaction commit fails, the out_unset path does not drop references held by fs_root->reloc_root, leaving them behind. The fix keeps temporary references to fs roots and drops them on failure.

In the Linux kernel, btrfs_dio_iomap_begin() leaks an extent map on direct I/O writes into a NOCOW range. If btrfs_create_dio_extent() fails (e.g., ordered extent allocation fails), the function returns an error without dropping the input extent map. The fix checks the error before replacing the map and drops it on failure.

In the Linux kernel, cifs_setsize() omits pagecache_isize_extended() when extending a file. It calls truncate_pagecache() but skips zeroing the tail of the page straddling the old EOF, so dirty bytes in that region can be written back to the server, exposing stale data in the newly extended range. The fix adds pagecache_isize_extended() before truncate_pagecache().

In the Linux kernel, cifs_file_set_size() has a use-after-free. When the else branch finds a writable file handle via find_writable_file(), it borrows tcon and server from the handle, attempts the handle-based set_file_size() RPC, then releases the handle with cifsFileInfo_put(). If set_file_size() fails, execution falls through to the path-based fallback, which reuses the borrowed tcon and server even though cifsFileInfo_put() may have freed tcon. The fix sets tcon = NULL after cifsFileInfo_put() to force the safe cifs_sb_tlink() path.

In the Linux kernel SMB client (cifs.ko), writing to a file with the setuid/setgid bit set did not clear that bit on the server when mounted with cifsacl, modefromsid, or POSIX/Unix extensions. The VFS requested clearing the bit, but the cifs driver unconditionally skipped the mode change (ATTR_MODE), so the cleared mode was never sent to the server.

The corsair-void HID driver did not check the size of incoming status and firmware events. Malformed events could cause an out-of-bounds read.

In the picolcd HID driver, picolcd_debug_eeprom_read() trusted a device-supplied length byte without checking how much data was actually received. A device returning a length of 0xff could cause an out-of-bounds read and expose adjacent memory through the debugfs file.

In the roccat HID driver, roccat_report_event() duplicates reports into a circular buffer, but device destruction paths did not free these copies. This caused a memory leak on each device removal.

In the HID sensor custom driver, hid_sensor_custom_add_attributes() did not remove previously created sysfs groups when a subsequent sysfs_create_group() call failed. This left invalid structures and potential access to freed memory.

A use-after-free vulnerability exists in the Linux kernel's HID: sony driver for GHL (Guitar Hero Live) dongles. During driver unbind, sony_remove() uses timer_delete_sync() which does not prevent timer re-arming, and usb_free_urb() does not cancel an in-flight URB. As a result, the ghl_poke_timer can be re-armed on freed memory and fire after the sc structure is freed.

In the Linux kernel, universal_pidff_probe() starts the device with hid_hw_start() but, if force-feedback initialization fails, returns the error without stopping the device. This leaves the registered hidraw device alive after the driver is cleared, leading to a use-after-free write when /dev/hidrawX is opened.

In the mcp2221 HID driver, the cleanup callback mcp2221_hid_unregister() did not stop device I/O before hardware teardown began. Incoming HID reports could race with device destruction, leading to a use-after-free.

In the mcp2221 HID driver, mcp_i2c_smbus_read() stored a buffer pointer in mcp->rxbuf but never cleared it after the transfer completed. A delayed or spurious MCP2221_I2C_GET_DATA report could write data into freed memory.

In the mcp2221 HID driver, mcp2221_raw_event() did not validate the size of incoming HID reports. In the MCP2221_I2C_GET_DATA path it trusted the device-supplied data[3] as the copy length, which could lead to a read past the report buffer.

In the Linux kernel, ecryptfs_exorcise_daemon() dropped queued messages from a dying daemon without holding ecryptfs_msg_ctx_lists_mux, but ecryptfs_msg_ctx_alloc_to_free() requires that lock. This created a race with other users of the global message context list.

In the Linux kernel, ecryptfs_parse_packet_set() calculated the remaining packet buffer size as PAGE_SIZE - 8, even though for version 1 headers the packet set starts later in the header. This could overstate the available buffer and lead to parsing errors.

In the Linux kernel, parse_tag_3_packet() fails to bound encrypted_key_size against ECRYPTFS_MAX_KEY_BYTES (64). When encrypted_key_size exceeds 64, decrypt_passphrase_encrypted_session_key() performs two out-of-bounds writes, corrupting the ecryptfs_auth_tok and ecryptfs_crypt_stat structures. Only AES-192 (cipher code 0x08) triggers this because it sets crypt_stat->key_size = 24 independently of encrypted_key_size.

In the Linux kernel, ecryptfs_parse_tag_70_packet() subtracted fixed metadata fields from the parsed packet body size to derive the encrypted filename size. A malformed packet with a body smaller than those fixed fields could underflow that size calculation.

In the Linux kernel, ecryptfs_send_message_locked() moved a message context from the free list to the allocated list before sending the request to the userspace daemon. If ecryptfs_send_miscdev() failed, the context was left on the allocated list and could not be reused.

In the Linux kernel, statfs() on the efivarfs mount point may be called by unprivileged users, which may result in a flood of calls to the QueryVariableInfo() runtime service. On x86 systems where the variable store is backed by SMM, each SMM entry requires a rendez-vous of all CPUs, making these calls disproportionately costly.

In the Linux kernel, in the erofs filesystem, z_erofs_gbuf_nrpages is advanced only after every global buffer has been grown. If a resize fails after some buffers were enlarged, a retry revisits those enlarged buffers, which can lead to allocation errors or pointer array overflow.

In the Linux kernel, ext2_setsize() and ext2_xattr_set2() contained a construct that for IS_SYNC inodes called sync_inode_metadata() instead of marking the inode dirty. Since sync_inode_metadata() only acts if the inode is already dirty, inode updates could be lost.

A use-after-free vulnerability exists in the Linux kernel's fanotify subsystem regarding file range information. A pointer to the range position stored on the triggering task's stack is saved in a heap-allocated permission event, and when a signal interrupts the triggering task, the stack frame is unwound while the event reader still dereferences that pointer. This causes a stale stack value to be copied to userspace.

In the Linux kernel's fbdev omapfb panel-dsi-cm driver, the ddata->lock mutex is initialized after the display is registered. Once omapdss_register_display() publishes the display, another consumer can invoke a dsicm callback that takes this uninitialized mutex. This can lead to improper operation or a crash.

In the Linux kernel, the fbdev ssd1307fb driver performed synchronous I2C transfers from damage callbacks, which may run from fbcon while printk has disabled preemption. This caused a "scheduling while atomic" bug and kernel warnings on systems such as RK3566. The issue was resolved by deferring I2C transfers from the damage callbacks.

In the Linux kernel's fbdev uvesafb driver, uvesafb_init() registers the v86d connector callback before registering the platform driver. If platform_driver_register() fails, the function returns the error without unregistering the connector callback, leaving it registered. The later platform-device failure path already performs this unregistration.

A race condition in the Linux kernel fsnotify subsystem was fixed, affecting event mask updates for marks. Concurrent updates to different marks on the same object could leave the object mask stale, causing events such as FAN_MODIFY or IN_MODIFY to be missed despite correct configuration. The issue affected fanotify and inotify.

In the Linux kernel's hsi omap_ssi_core driver, the OMAP SSI driver uses a synthetic HSI controller device allocated via hsi_alloc_controller(), which does not go through the normal OF/platform device initialization path. As a result, the embedded struct device does not have a DMA mask initialized by default. After recent DMA API hardening changes, dma_map_sg() and related helpers require a valid dma_mask, otherwise the driver may crash or trigger warnings.

In the Linux kernel's hugetlb subsystem, __unmap_hugepage_range can adjust reservations since commit df7a6d1f6405. When a folio is mapped in both a parent and a child, and the parent unmaps the range first, the reservation adjustment causes an underflow of the reserved count. Once the child unmaps the range, the count is restored. The fix checks the mapcount before adjusting the reservation.

In the Linux kernel's accel/rocket driver, rocket_job_push() allocates a temporary array to hold input and output GEM object pointers. Two bugs exist: a missing NULL check after a failed kvmalloc_array() causing a NULL pointer dereference, and an integer overflow when summing in_bo_count and out_bo_count (both u32) that can wrap to a smaller value, leading to an undersized allocation and subsequent out-of-bounds accesses on the temporary array.

In the Linux kernel's accel/rocket driver, rocket_ioctl_submit_job() releases rjob via rocket_job_put() on allocation error paths. rocket_job_cleanup() unconditionally calls rocket_iommu_domain_put(job->domain), but job->domain is assigned only after task copying and BO lookups. A failure before that assignment can clean up a job with a NULL domain pointer. Additionally, rjob->tasks is not cleared after freeing in rocket_copy_tasks(), potentially leading to a double free.

In the Linux kernel, the rocket_job_run() function in the accel/rocket driver has error path bugs. The fence reference held by job->done_fence is never released, and pm_runtime_get_sync() increments the usage counter even on failure, preventing the NPU from suspending. Additionally, an unsignaled fence is returned to the DRM scheduler, triggering a WARN.

A deadlock exists in the Linux kernel's CXL CPER error handling within acpi/apei/ghes. The cxl_cper_work_lock and cxl_cper_prot_err_work_lock were used as plain spinlocks, which could deadlock when a GHES interrupt arrived on the same CPU. The fix converts them to raw_spinlock_t, adds WARN_ONCE checks, and restructures the unregister functions.

In the Linux kernel, the ghes_handle_arm_hw_error() function (ACPI APEI GHES) reduces the remaining length by sizeof(err) (pointer size) instead of sizeof(*err) (structure size) after skipping the cper_sec_proc_arm header. This overestimates the bytes left for cper_arm_err_info records and can cause the parser to read past the CPER section when err_info_num is large enough.

In the Linux kernel, the query_capability() function (ACPI pfr_update) copies four ACPI buffer objects returned by firmware _DSM into fixed-size u8[16] fields in struct pfru_update_cap_info using memcpy with the firmware-supplied length. If the firmware returns buffer.length > 16, memcpy writes past the destination array, causing a stack buffer overflow.

The Linux kernel has a bug in ata_format_dsm_trim_descr(), which builds the ATA TRIM descriptor in a 2048-byte buffer. On devices with a logical sector size larger than 2048 bytes (e.g. 4Kn with 4096-byte sectors), the function can never return the expected sector size, so every TRIM is rejected with a parameter list length error and triggers WARN_ON() splats.

In the Linux kernel, in the auxdisplay charlcd driver, with CONFIG_CHARLCD_BL_FLASH enabled, charlcd_init() schedules bl_work before charlcd_register() calls misc_register(). If registration fails, the caller frees the charlcd object while delayed work still contains its address, leading to a use-after-free.

The Linux kernel did not validate user space vector alignment when building a bio from iov_iter. Bio-based block drivers did not necessarily check the alignment split, potentially causing incorrect behavior. The fix validates vectors against the device's dma_alignment and rejects misaligned ones with -EINVAL.

The Linux kernel's eir_get_service_data() function in the Bluetooth EIR module contains an out-of-bounds read. Incorrect recalculation of eir_len when skipping fields causes the pointer to walk past the le_per_adv_data[] buffer into the rest of struct hci_conn. The fix recomputes eir_len from the end of the buffer each iteration.

The Linux kernel's bnx2x driver contains a double free in the error path of bnx2x_init_firmware(). The pointers init_ops, init_data, and init_ops_offsets are not set to NULL after being freed, so a later call to bnx2x_release_firmware() frees them again. The fix sets each pointer to NULL after kfree().

A bug in the Linux kernel's BPF x86 JIT was fixed regarding per-CPU address resolution into an extended register. The REX prefix was built using REX.B instead of REX.R, causing the high register bit to be lost and the per-CPU address to be written to the wrong register (e.g. R5 instead of R8). This led to dereferencing an invalid pointer and a kernel panic.

A vulnerability was fixed in the Linux kernel's __bpf_get_stack function. The per-CPU perf_callchain_entry buffer returned by get_perf_callchain() is not protected against reuse after being returned, so a preemptible BPF program can be scheduled out between obtaining the buffer and copying it, allowing another task on the same CPU to overwrite trace->nr with a larger value. This causes copy_len to be computed from the inflated value and leads to an out-of-bounds write in memcpy() and in the build_id path.