Linux kernel vulnerabilities

A vulnerability has been identified in the Linux kernel that leads to a null pointer dereference in the papr_hvpipe_dev_create_handle() function. A change introduced by commit 6d3789d347a7 caused the src_info pointer to be reused for adding it to the global list after calling retain_and_null_ptr(src_info), leading to a kernel panic.

In the Linux kernel, the RDMA/mana driver removed a user-triggerable WARN_ON() call. Specifying multiple work queues (WQs) sharing the same completion queue (CQ) via the uAPI would trigger WARN_ON() and then corrupt the kernel.

A use-after-free vulnerability was found in the Linux kernel's __xfrm_state_delete() function during xfrm state deletion. The issue arises from inconsistent checks for presence on byseq/byspi hash lists, leading to double deletion and write via LIST_POISON pointer.

A vulnerability has been identified in the Linux kernel related to the hns_roce_qp_remove() function, which requires the caller to hold locks. In the error flow of hns_roce_create_qp_common(), these locks are not held, risking memory corruption.

A vulnerability related to Bluetooth in the Linux kernel has been fixed, which could lead to a use-after-free error in the create_big_sync function. An additional check, hci_conn_valid(), was introduced to detect stale connections before BIG creation.

A vulnerability has been identified in the Linux kernel related to a memory leak in the ulpi_register() function. If errors occur in ulpi_of_register() or ulpi_read_id() before device_register() is called, allocated memory is leaked.

A vulnerability has been identified in the Linux kernel related to a memory leak in the strp_abort_strp() function. When the stream parser is aborted, it may still hold a reference to a partially assembled message, leading to a memory leak.

A vulnerability was found in the Linux kernel's seg6 and rpl lightweight tunnels for IPv6. The seg6_input_core() and rpl_input() functions use a NOREF dst pointer after calling ip6_route_input(), which on PREEMPT_RT systems can lead to a race condition and use-after-free.

In the Linux kernel, a vulnerability was found in the vmalloc memory allocation mechanism. The decay_va_pool_node() function can be invoked concurrently from two paths: during pool purging and via the shrinker, leading to races and potential memory leaks.

In the Linux kernel, a vulnerability was found in the rtw88 WiFi driver. The lack of checking for the existence of a PCI upstream bridge before using it can cause a crash during device initialization when the card is directly connected to the root bus. This primarily affects 8821CE cards in non-standard hardware configurations.

In the Linux kernel, a use-after-free (UAF) vulnerability was found in the ALSA aloop driver during format change. The issue occurs when loopback_check_format() stops capture while a concurrent close can free the runtime, leaving a stale peer substream pointer in the playback trigger path.

A vulnerability has been identified in the Linux kernel that allows inconsistent reads of local FDB entries in bridges. The issue arises from multiple loads of the `f->dst` value, which can lead to a NULL pointer dereference.

A vulnerability in the Linux kernel related to handling misaligned crypto length in rxrpc packets has been fixed. The changes include improving error handling during decryption and removing a warning that could be remotely triggered.

A vulnerability has been identified in the Linux kernel related to improper RX steering management after WQ objects are destroyed. After destroying the RSS QP, the RX steering configuration remains active, which may lead to errors in delivering RX completions to new TX objects.

A vulnerability related to resource leaks during SPI device setup failure has been fixed in the Linux kernel. It is important to call the controller cleanup() if spi_setup() fails.

A vulnerability in the Linux kernel has been resolved that affects KVM and SVM. The issue was that the INVLPGA instruction did not trigger a #UD error when EFER.SVME was set to 0.

A vulnerability has been identified in the Linux kernel in the acomp_save_req() function, which stores an incorrect pointer leading to memory corruption. The issue occurs during asynchronous request completion in hardware implementations like the QAT driver.

A vulnerability was identified in the Linux kernel that led to a null pointer dereference when device_add_disk() failed after device_add() succeeded. This issue has been resolved by correctly managing the device removal order.

A vulnerability has been identified in the Linux kernel regarding the handling of nameoff pointers for trailing dirents in the EROFS filesystem. The issue arises from incorrect calculations that may lead to reading past the directory block.

A vulnerability in the Linux kernel has been resolved in KVM, which involved improper handling of VMMCALL calls when L1 did not want to intercept them. In such cases, KVM generates a #UD exception, allowing L2 to make hypercalls without L1's interaction.

A vulnerability related to memory leaks on probe failures has been fixed in the Linux kernel. In case of errors, it is necessary to deregister the controller, disable pins, and kill and free the RX URB to avoid memory leaks and use-after-free.

A vulnerability in the Linux kernel related to the missing call to usb_kill_urb() on signal interrupt has been fixed. This bug led to reading from an invalid transfer buffer when no data was received from the device.

A vulnerability has been identified in the Linux kernel within the run_unpack() function, which does not validate buffer boundaries before reading data. As a result, a crafted NTFS image can lead to out-of-bounds memory reads, potentially allowing unauthorized access to memory.

A vulnerability in the Linux kernel related to KVM and nSVM has been resolved, concerning the improper clearing of VMCB_LBR in vmcb12. The svm_copy_lbrs() function always marked VMCB_LBR as dirty in the destination VMCB, leading to architecturally undefined behavior.

A vulnerability has been identified in the Linux kernel regarding the validation of payload size before accessing journal metadata in RAID5. The functions r5c_recovery_analyze_meta_block() and r5l_recovery_verify_data_checksum_for_mb() do not validate payload sizes, which can lead to out-of-bounds reads.

A vulnerability has been identified in the Linux kernel within the mwifiex_adapter_cleanup() function that may lead to a use-after-free error. The issue arises when timer_delete() is called before the adapter structure is freed, potentially allowing access to freed adapter fields by an executing callback.

A vulnerability has been identified in the Linux kernel related to bounce buffer leaks in the nx842_crypto_{alloc,free}_ctx functions. The issue is due to improper buffer release, which should use free_pages() instead of free_page().

A vulnerability has been identified in the Linux kernel that allows users to set the 'damos_quota_goal->nid' value without proper validation. This can lead to unauthorized memory access outside the allocated range.

A vulnerability has been identified in the Linux kernel related to incorrect counting of operations when buffer allocation fails for encrypted files in CephFS. When buffer allocation fails, the operation count is incremented, leading to a kernel panic.

A vulnerability in the Linux kernel related to disconnecting deferred I/O from the lifecycle of the fb_info structure has been resolved. A new fb_deferred_io_state structure has been introduced to hold the state of deferred I/O, preventing issues with accessing graphics memory after device hot-unplug.

A vulnerability has been identified in the Linux kernel within the ibmasm_send_i2o_message() function, which may lead to a heap over-read. A root user can exploit unvalidated header fields, resulting in reading data beyond the allocated memory area.

A vulnerability has been identified in the Linux kernel that may lead to deadlock during sigreturn operations in the context of the shadow stack. The issue arises when the kernel attempts to access shadow stack memory, potentially leading to a situation where two processors try to acquire locks, resulting in a deadlock.

A vulnerability in the Linux kernel related to integer overflow in the run_unpack() function during volume boundary checks has been resolved. This issue occurred due to the use of raw addition, which could bypass validation for large lcn and len values.

A vulnerability has been identified in the Linux kernel that leads to deadlock in the jbd2_journal_cancel_revoke() function. A change introduced in commit f76d4c28a46a breaks lock ordering, which can lead to an ABBA situation when the filesystem blocksize is smaller than the pagesize.

A vulnerability has been identified in the Linux kernel related to improper IRQ cleanup during device initialization failure. When adf_dev_up() partially completes and fails, IRQ handlers are not detached before MSI-X vectors are released.

A vulnerability has been identified in the Linux kernel caused by a race condition between the m2m job_abort and device_run functions, leading to kernel panic. The issue occurs when v4l2_m2m_ctx_release() frees m2m_ctx while v4l2_m2m_try_run() attempts to call device_run with the same context.

A vulnerability in the Linux kernel related to the inheritance of LOG_SUBDOMAINS_OFF during fork() operations has been resolved. The issue was that the Landlock security blob was not copied when the source credential had no assigned domain, leading to unexpected audit results in child processes.

A vulnerability related to Bluetooth event handling has been fixed in the Linux kernel, which could lead to a potential use-after-free (UAF) in SSP key handling.

A vulnerability in the Linux kernel's SELinux module was found, involving incorrect access checks for mmap() and mprotect() operations on overlayfs filesystems. The enforcement of access controls for backing files was missing during these operations.

A vulnerability in the Linux kernel related to improper resource management in the __rds_rdma_map() function has been fixed. The issue occurred when copying the generated cookie back to user space failed, which could lead to improper resource freeing.

A vulnerability in the Linux kernel has been fixed in the retry_aligned_read() function, which could lead to an infinite loop and soft lockup when encountering an overlapped stripe.

A vulnerability has been identified in the Linux kernel that leads to deadlock during RAID10 array check operations when NOWAIT requests are simultaneously executed. The issue arises from improper management of the nr_pending value, resulting in underflow and blocking of the sync thread.

A vulnerability has been identified in the Linux kernel related to a usb_dev reference leak during ALSA: caiaq device initialization failure. The issue is that the create_card() function does not release the reference, leading to a leak of the usb_device structure and its allocations.

A vulnerability has been identified in the Linux kernel related to use-after-free in the driver removal function. The issue occurs when a packet arrives after destroy_workqueue() is called but before sock_release(), leading to a use-after-free error.

A vulnerability has been identified in the Linux kernel related to the missing brelse() call in the ext4_xattr_inode_dec_ref_all() function. The commit c8e008b60492 introduced a refcount leak when block_csum is false.

A vulnerability has been identified in the Linux kernel that allows reading bitmap data from spare disks that are not fully synchronized. The lack of an In_sync flag check may lead to reading stale or uninitialized bitmap data.

A vulnerability has been identified in the Linux kernel regarding improper management of kthread threads in the event of an error occurring after their creation. The ssif thread will not be stopped, potentially leading to undesirable effects.

A vulnerability has been identified in the Linux kernel related to memory leaks in the weighted_interleave_auto_store() function. These issues occur when a user inputs 'true' or 'false', leading to memory not being freed.

A vulnerability has been identified in the Linux kernel related to the hdlc_tx_frames() function, which calls usleep_range() in an atomic context, which is illegal. The issue has been resolved by moving the buffer-space wait outside the spinlock context.

A vulnerability has been identified in the Linux kernel related to a watch count leak in inotify when the fsnotify_add_inode_mark_locked() function fails. In this case, the dec_inotify_watches() function is not called, leading to a watch count leak and potentially reaching the max_user_watches limit.