Linux kernel vulnerabilities

A vulnerability has been identified in the Linux kernel that allows for an out-of-bounds read in the spi_nor_params_show() function. The issue arises from incorrect size calculations of an array of pointers, leading to improper bounds checking in the spi_nor_print_flags() function.

In the Linux kernel's RDMA driver for VMware virtual machines (vmw_pvrdma), a double free vulnerability was found on the error path of pvrdma_alloc_ucontext(). The pvrdma_uar_free() function is called both before and inside pvrdma_dealloc_ucontext(), causing a double free.

A vulnerability has been identified in the Linux kernel due to a lack of NULL checks after calling the napi_build_skb() function. In case of allocation failure, the result can lead to a NULL pointer dereference.

A vulnerability has been identified in the Linux kernel related to a race condition in thread management. The issue occurs when kthread_complete_and_exit() is called before kthread_stop(), leading to the use of a kthread object after it has been freed.

A vulnerability in the Linux kernel related to division by zero in USB handling functions has been fixed. A missing sanity check for bNrChannels in detect_usb_format() could lead to a kernel crash.

A vulnerability has been identified in the Linux kernel that allows users to read and write to the damon_sysfs_quot_goal->path structure without proper protection. This can lead to situations where a user reads an already freed buffer, posing a risk to system stability.

A vulnerability in the Linux kernel was identified that allowed uninitialized stack memory bytes to leak to userspace. The issue was related to the papr_hvpipe_hdr structure, where not all fields were initialized, potentially leading to data exposure.

In the Linux kernel, the RDMA/mlx4 driver misuses RCU in mlx4_srq_event(). The radix_tree is RCU-safe, but the mlx4_srq struct is never freed with RCU and is not accessed within an RCU critical section. Delivering an event before the SRQ object is fully initialized can cause a system crash.

A vulnerability in the Linux kernel related to a potential use-after-free issue when stopping the watchdog task has been resolved.

A vulnerability has been identified in the Linux kernel that allows pointer operations on unconfigured streams. The issue arises from dividing the I/O frame position by values that default to 0, potentially leading to a divide by zero error.

A vulnerability in the Linux kernel related to resource leak in mlx4_ib_create_srq() has been fixed. The issue was that mlx4_srq_free() was not called during error unwind, leading to resource leaks.

A vulnerability in the Linux kernel related to limits on event and message requests has been resolved. The driver could continuously fetch events, potentially causing issues with BMCs that never signal completion. A limit of 10 fetches at a time has been introduced.

In the Linux kernel's mlx5 driver, a bug in mlx5_ib_dev_res_srq_init() causes fall-through after s1 allocation failure, assigning freed s0 and an ERR_PTR to data structures. This leads to use-after-free, ERR_PTR dereference, and double-free.

In the Linux kernel, a vulnerability was found in AMD Zen2 processors due to improper isolation of shared resources in the op cache. This can lead to instruction corruption and potential security breaches.

A vulnerability has been identified in the Linux kernel that allows preemption of a TASK_DEAD task during its exit. This can lead to serious memory issues, such as use-after-free or double-free of the task's stack.

A vulnerability has been identified in the Linux kernel in the xfrm6_rcv_encap() function, which improperly manages references to dst entries in case of errors during IPv6 route lookups. As a result, repeated packets can lead to dst entry leaks.

A vulnerability has been identified in the Linux kernel related to a memory leak in the KVM vector context for RISC-V architecture. If the second memory allocation fails, the first allocation is not freed, leading to a leak.

A vulnerability has been identified in the Linux kernel related to the use of lock_sock_fast() in atomic context when setting timestamps. This change can lead to system panic due to scheduling while atomic.

In the Linux kernel, a vulnerability was found in the mac80211 subsystem due to unsafe list iteration in the radar detect work function. Calling ieee80211_dfs_cac_cancel can free and remove the iterated chanctx from the list, leading to a slab-use-after-free error.

A vulnerability has been identified in the Linux kernel that leads to a double free in the create_space_info_sub_group() function on error. The issue occurs when kobject_init_and_add() fails, resulting in the sub_group object being freed twice.

A vulnerability has been identified in the Linux kernel that leads to a double free in the ice_sf_eth_activate() function on error. The issue occurs when the auxiliary_device_add() call fails, resulting in improper resource deallocation.

A vulnerability has been identified in the Linux kernel that leads to a divide-by-zero error in the setup_geo() function when the far_copies parameter is zero. This issue has been resolved by implementing validation of nc and fc values after extraction.

A vulnerability has been identified in the Linux kernel related to the missing last_unlink_trans update when removing a directory. This can lead to incorrect fsync behavior when the directory is removed and then synced by an open file descriptor.

A vulnerability has been identified in the Linux kernel within the btrfs_ioctl_space_info() function, which can lead to information leakage. The issue involves a TOCTOU race condition between two passes over the block group RAID type lists, resulting in the copying of uninitialized bytes to user space.

A vulnerability has been identified in the Linux kernel related to the retransmission of ADD_ADDR in the MPTCP protocol, where the socket reference (sk) was not properly released. This issue has been resolved by ensuring that the reference is always decreased at the end of the operation.

A vulnerability has been identified in the Linux kernel within the loongson_gpu_fixup_dma_hang() function, which may lead to improper memory access. The issue occurs when a platform installs a discrete GPU, resulting in access to a random memory address.

A vulnerability has been identified in the Linux kernel regarding the reading of the scx_root pointer in the context of cgroup operations. The issue arises because the pointer may become stale by the time the operation is executed, potentially leading to use-after-free conditions.

A vulnerability has been identified in the Linux kernel related to the management of egress QoS priority mappings in the 8021q protocol. The issue is that cleared priority mappings are kept as 'tombstones', leading to memory leaks during set/clear cycles.

In the Linux kernel, ieee80211_invoke_fast_rx() had a static variable causing a race condition under concurrent RX. Threads overwrote each other's results, leading to incorrect packet handling.

A vulnerability has been identified in the Linux kernel that could lead to false positives in permission events related to fanotify. The issue was that fsnotify_get_mark_safe() could return false for a mark on an unrelated group, resulting in bypassing the permission check.

A vulnerability has been identified in the Linux kernel within the tg_pt_gp_members_show() function, which may lead to reading data beyond the allocated stack buffer. The issue arises from an improper length check on the data returned by snprintf(), potentially resulting in copying adjacent stack data.

A vulnerability has been identified in the Linux kernel in the convert_chmap_v3() function, which may lead to a potential endless loop due to a lack of validation of the descriptor length. A proper size check has been added to prevent this situation.

In the Linux kernel, the RDMA/mana driver lacked validation of the rx_hash_key_len value from userspace. This allowed unbounded memcpy, potentially causing kernel memory corruption.

A vulnerability in the Linux kernel related to the mana_ib_create_qp_rss() function has been fixed, which could lead to a leak in mana_ib_cfg_vport_steering().

A vulnerability related to illegal access to the WX_CFG_PORT_ST register by VF has been fixed in the Linux kernel. Attempting to read this register during VF initialization leads to a system hang.

In the Linux kernel, the Bluetooth btmtk driver lacks validation of WMT event response SKB length before accessing its structure. A short firmware response can cause out-of-bounds reads from the SKB tailroom.

A vulnerability has been identified in the Linux kernel related to Bluetooth event handling, which may lead to out-of-bounds reads and an infinite loop. The issue occurs in the hci_le_create_big_complete_evt() function, which does not check if the index remains within the bounds of the array during iteration.

A vulnerability has been identified in the Linux kernel related to the lack of mutex initialization in Thunderbolt registration. Improper mutex management leads to a NULL dereference, potentially causing system crashes.

A vulnerability has been identified in the Linux kernel that allows a system panic to be triggered by receiving an unauthorized UDP packet with an unknown opcode. This issue affects the processing of packets in the Soft RoCE driver, where insufficient checks lead to out-of-bounds memory reads.

A vulnerability has been identified in the Linux kernel within the rtnl_fill_vfinfo function that may lead to stack information leakage. The ifla_vf_broadcast structure was not initialized before use, resulting in the disclosure of up to 26 bytes of unallocated kernel stack memory.

A vulnerability has been identified in the Linux kernel related to checking nEPT/nNPT in slow hypercall flushes. The issue lies in the incorrect checking of guest mode, which may lead to improper functioning of address translation features.

A vulnerability has been identified in the Linux kernel within the dm-verity-fec function, which incorrectly assumes that parity bytes are not split across blocks. As a result, during decoding, it may read data outside the allocated buffer, potentially leading to unexpected system behavior.

A vulnerability has been identified in the Linux kernel that leads to a double free in the create_space_info() function on error. The issue occurs when kobject_init_and_add() fails, resulting in improper memory management.

A vulnerability has been identified in the Linux kernel related to the incorrect checking of the data size of the event message buffer response in the IPMI interface. The issue is that the size check occurs later, which may lead to improper processing of empty messages returned by some BMCs.

A vulnerability has been identified and resolved in the Linux kernel. The issue concerns a faulty reference to the uctx pointer in the ocrdma_copy_pd_uresp() function during error handling, which can lead to system crashes.

A vulnerability in the Linux kernel related to the mana_destroy_wq_obj() function in queue object management has been resolved. The issues pertain to bugs in the error unwind flow concerning the WQ table.

In the Linux kernel's mac80211 subsystem, a vulnerability was found where a station is not removed after a failed MLO connection preparation. When MLO connection preparation fails, the interface is reset to non-MLD mode, but the existing station associated with the removed link is not deleted, leading to a use-after-free in debugfs.

A vulnerability has been identified in the Linux kernel within the isofs_fh_to_dentry() and isofs_fh_to_parent() functions, which pass an attacker-controlled block number from the NFS file handle to isofs_export_iget(). Although block 0 is rejected, an attacker can force the read of any in-range block, leading to the exposure of unrelated data in dentry metadata.

A vulnerability has been identified in the Linux kernel that allows a race condition between reading and writing the 'memcg_path' and 'path' files in the DAMON sysfs interface, leading to a use-after-free situation. A patch has been introduced to protect these operations from concurrent access.

A vulnerability has been identified in the Linux kernel within the ip6erspan_changelink() function, which uses an outdated network context, leading to memory-related errors. This issue can result in use-after-free conditions reported by KASAN.