Linux kernel vulnerabilities

In the Linux kernel orangefs filesystem, orangefs_devreq_write_iter() frees op->downcall.trailer_buf with vfree() when copy_from_iter_full() fails but does not clear the pointer before goto Efault. This causes a deterministic double-free on the readdir side when a client sends a downcall with trailer_size exceeding the supplied bytes.

In the Linux kernel orangefs filesystem, orangefs_prepare_cdm_array() sizes each client debug keyword buffer with strcspn(cds_head, " ") but parses it with %s, which skips leading whitespace. If a client debug entry starts with a space, the allocation can be too small and sscanf() writes past the buffer.

A vulnerability was fixed in the Linux kernel's ocfs2/cluster module, in the o2hb_region_pin() function. The function was called while holding the o2hb_live_lock spinlock but invoked the sleeping configfs_depend_item() function, triggering a BUG under CONFIG_DEBUG_ATOMIC_SLEEP, causing a lock order inversion leading to deadlock, and leaking the o2hb_dependent_users counter on partial pinning failure.

The Linux kernel has a NULL pointer dereference vulnerability in the SCTP implementation when completing a stream reconfiguration request that has not yet been transmitted. When a request is already published in asoc->strreset_chunk but has no assigned transport (chunk->transport == NULL), stopping the reconf timer dereferences NULL and panics the kernel. It can be triggered locally by an unprivileged process or remotely via a crafted RECONF packet.

In the Linux kernel, a cached SCTP RECONF chunk may contain more than one request parameter. A duplicate response can process the same ADD_OUT request again, rolling back the outcnt counter twice and potentially underflowing it. The fix tracks outstanding request types as bits and ignores later responses.

In the Linux kernel, in the power: supply: bq24257 driver the STAT-pin interrupt is devm-managed and stays armed until devm cleanup after remove() returns. remove() cancels bq->iilimit_setup_work while the threaded handler can still fire and reschedule it, dereferencing freed memory. The fix uses devm_delayed_work_autocancel() and registers the work before the interrupt request.

In the Linux kernel, in the power: supply: bq256xx driver the USB-PHY notifier queues usb_work, whose handler calls power_supply_changed(bq->charger). The reset devm action is registered before the power supplies, so devm frees bq->charger before the action runs, and a still-queued usb_work can dereference it. The fix registers the reset action after the supplies and initializes usb_work before the notifiers.

In the Linux kernel, in the power: supply: bq25890 driver bq25890_fw_probe() acquires a reference to a secondary charger via power_supply_get_by_name(), but does not release it on later probe failures or on driver detach. The fix registers a device-managed cleanup action immediately after acquiring the reference.

In the Linux kernel, the charger-manager (power: supply) driver has a use-after-free vulnerability. Regulators are freed (regulator_put) before sysfs entries are unregistered (power_supply_unregister), and sysfs entries are registered before regulators are acquired, allowing a race condition and access to freed handles.

In the Linux kernel, in the power: supply: cros_usbpd-charger driver cros_usbpd_charger_probe() reads two port counts from the EC and uses num_charger_ports as the loop bound when populating the fixed-size ports[] array of 8 entries. Without validation against EC_USB_PD_MAX_PORTS, a malfunctioning or malicious EC can report up to 255, causing a slab out-of-bounds write. The fix rejects a port count larger than the array can hold.

In the Linux kernel, in the power: supply: cros_usbpd-charger driver the probe iterates based on the raw charger port count returned by the embedded controller. The only check is against the number of USB PD ports also defined by the EC, so a malicious EC could return an inaccurate count (up to 255), causing an out-of-bounds write and memory corruption. The fix limits port counts to EC_USB_PD_MAX_PORTS.

In the Linux kernel, in the power: supply: lp8727 driver lp8727_release_irq() cancels pchg->work before freeing the IRQ, so an IRQ delivered in between can re-arm the work through the threaded handler. After .remove returns, the devm layer frees pchg while lp8727_delayed_func() may still run and dereference it. The fix frees the IRQ first, then cancels the work.

In the Linux kernel, the lp8788-charger driver has a use-after-free on device removal. lp8788_charger_remove() flushes charger_work before unregistering IRQs, so an IRQ thread can queue work after flush_work() returns, and the work then dereferences freed pchg memory.

In the Linux kernel, the qcom_battmgr driver has a use-after-free. qcom_battmgr_pdr_notify() queues enable_work when the PMIC GLINK service comes up, and the PMIC GLINK client stays on the client list until devres release, allowing PDR notifications to keep queueing work that accesses freed battmgr memory.

In the Linux kernel, the qcom_battmgr driver's qcom_battmgr_sc8280xp_strcpy() copies firmware strings without guaranteeing a terminator when the firmware does not use Pascal-style strings. Fields model_number, serial_number, and oem_info may lack a null terminator, causing out-of-bounds reads when printed to userspace.

In the Linux kernel, the rt9455 power supply driver contains a use-after-free bug. During driver removal (rt9455_remove), delayed works are cancelled in the wrong order — batt_presence_work can queue max_charging_time_work after it has been cancelled, causing a dereference of the freed rt9455_info structure. The issue also occurs in the probe error path when rt9455_hw_init() fails after the IRQ has been requested.

In the Linux kernel, the twl4030_charger driver has a use-after-free. twl4030_bci_remove() does not cancel two workers (bci->work and bci->current_worker) that dereference the devm-allocated bci structure, potentially accessing freed memory after device removal.

In the Linux kernel, the ucs1002 driver has a use-after-free on removal. The driver has no remove callback, so unbind runs through devm, but devm frees the alert IRQ without cancelling the health_poll delayed work, which can then run after driver data is freed.

In the Linux kernel, the max17040 driver's max17040_get_vcell() and max17040_get_soc() ignore errors from regmap_read(). When an I2C transfer fails, the uninitialized register value is converted and reported to userspace as valid voltage or state of charge, and the polling worker can replace the cached state with a bogus value.

In the Linux kernel, the max17040 driver has a work cancellation synchronization issue on suspend. max17040_work() requeues itself after every poll, and cancel_delayed_work() does not wait for an already running callback, potentially continuing to access the fuel gauge after suspend completes.

In the Linux kernel on s390, a vulnerability in the cpum_cf (CPU performance counter) subsystem causes a kernel panic when a CPU is brought online during a perf stat run. The per-CPU data structure is not initialized if the CPU was offline when the perf event was created, leading to a NULL pointer dereference in cpumf_pmu_add().

In the Linux kernel on s390, the MVIY_PERCPU() macro generates an assembler macro invocation with whitespace-separated quoted arguments, which older binutils (before 2.39) misparse, skipping the mviy instruction. As a result, the interrupted per-CPU sequence is not marked in lowcore and the exception return path cannot repair the per-CPU address register after migration.

In the Linux kernel, the s390/dasd driver's dasd_int_handler() marked an NRF read of an unallocated ESE track as successful (DASD_CQR_SUCCESS) without checking the return value of ese_read(). When dasd_eckd_ese_read() returned an error before zeroing the destination buffer, the block layer received stale, uninitialized memory instead of zeros.

In the Linux kernel, several s390/dasd sysfs show/store handlers call a discipline callback that dereferences device->private. During dasd_generic_set_online() the discipline is assigned before check_device() allocates device->private, so an unprivileged read of one of these world-readable attributes in that window dereferences a NULL pointer and panics the kernel.

In the Linux kernel, the s390/dasd driver's dasd_default_erp_postaction() copies timing and device state from the finished ERP request back to the original request but drops proc_bytes. A partially completed request (an ESE read of a not-yet-allocated track returns fewer bytes than requested) that is then recovered through the ERP chain loses its partial-completion length, so __dasd_cleanup_cqr() sees proc_bytes == 0 and completes the whole request instead of requeueing the remainder, silently returning zeroed data for the part that was never read.

In the Linux kernel, the PCI plda driver's plda_pcie_irq_domain_deinit() removes pcie->event_domain via irq_domain_remove(), but the per-event IRQs mapped from that domain are requested with devm_request_irq() in plda_init_interrupts(). The actual free_irq() for a devm-managed IRQ is deferred by devres until after the calling probe()/remove() returns, so irq_domain_remove() can free the domain's internal data before the deferred free_irq() for IRQs still mapped into it has run, leading to a use-after-free of the already-freed domain.

In the Linux kernel, the PCI plda driver's plda_init_interrupts() initializes IRQ domains and creates IRQ mappings but does not unwind them when a later step fails. If platform_get_irq() or either irq_create_mapping() fails, the domains are never deinitialized and port->intx_irq stays initialized, leading to IRQ domain leaks.

In the Linux kernel, the iommu/amd driver's iommu_call_iopf_notifier() looks up the requester with pci_get_domain_bus_and_slot(), which returns a PCI device with its reference count incremented. Neither the successful iommu_report_device_fault() path nor the abort path drops that reference, so every handled PPR request leaks a PCI device reference.

In the Linux kernel, the iommu/msm driver's msm_iommu_probe() adds its devm-managed IOMMU object to qcom_iommu_devices before adding the IOMMU sysfs device and registering it with the IOMMU core. If iommu_device_sysfs_add() or iommu_device_register() fails, the object remains on qcom_iommu_devices while the driver core releases the devm allocation, leaving a dangling list entry that later list walks may dereference.

In the Linux kernel, the iommu/sva driver's iommu_attach_device_pasid() installs the new SVA attach handle in the group PASID lookup before iommu_sva_bind_device() returns. A concurrent bind can therefore find and reuse the same handle after iommu_sva_lock is dropped. handle->dev was initialized after dropping iommu_sva_lock, leaving a window where a racing bind can return a handle whose dev pointer is still NULL, and a subsequent iommu_sva_unbind_device() can dereference it via handle->dev->iommu_group.

In the Linux kernel, the iommu/tegra241-cmdqv driver's tegra241_vintf_init_vsid() programs the guest-provided vSID into SID_MATCH, whose VIRT_SID field spans bits [20:1] with bit 0 as the match-enable flag, so the hardware matches only a 20-bit Stream ID. The bound check rejects only virt_sid > UINT_MAX, admitting a value far wider than the field; the write "virt_sid << 1 | 0x1" then drops every bit above 20, so a virt_sid of 0x80000000 lands as SID_MATCH = 0x1, a valid match on vSID 0, aliasing the wrong Stream ID. Because vdev->virt_id is guest-controlled, a VMM can trigger it.

A memory leak exists in the Linux kernel's iommu_mock_device_add() function. When the subsequent device_add() call fails, the error path only frees fwspec but leaves the dev->iommu structure allocated. The fix replaces iommu_fwspec_free() with dev_iommu_free() in the failure path.

In the Linux kernel, iommufd_access_notify_unmap() skips internal accesses but calls iommufd_lock_obj() first; on success the loop skips the matching iommufd_put_object(), leaking the object reference. The fix checks for internal accesses before locking.

In the Linux kernel, iommufd_take_all_iova_rwsem() takes an object reference and write lock before storing the IOAS in the xarray; if xa_store() fails, the current IOAS is not released, causing a leak. The fix releases the current IOAS before unwinding previously stored entries.

In the Linux kernel, the IOMMUFD selftest TRIGGER_IOPF borrows an attach handle from group->pasid_array without synchronizing against PASID detach, so a concurrent iommu_report_device_fault() can dereference a freed handle, causing a UAF. The fix adds an iopf_rwsem in mock_dev for synchronization.

In the Linux kernel, set_attribute() in dell-wmi-sysman populates the BIOS attribute request buffer with the admin password and then dumps the whole buffer via print_hex_dump_bytes(), exposing the password in the kernel log. The fix removes this dump.

In the Linux kernel, isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() use the user-provided level as an index into perf_levels[] without validation, allowing out-of-bounds reads. The fix adds bounds checks and rejects disabled SST-PP levels.

In the Linux kernel, isst_if_clos_assoc() validates socket_id with '>' instead of '>=', allowing indexing past the sst_inst[] array; additionally, a missing NULL check for unbound packages leads to a NULL dereference. The fix rejects socket_id >= topology_max_packages() and NULL sst_inst.

In the Linux kernel, the mmc via-sdmmc driver does not cancel carddet_work on device removal; already queued work can run after the host is freed, causing a use-after-free. The fix cancels carddet_work after freeing the IRQ and before cancelling finish_bh_work.

In the Linux kernel, the mmc via-sdmmc driver registers and enables the card-detect interrupt before mmc_add_host(); if mmc_add_host() fails, the interrupt stays registered and runs against the freed host, causing a use-after-free. The fix adds a probe-error path that disables and frees the interrupt and cancels carddet_work.

In the Linux kernel, ISST lacked a NULL check for isst_common.sst_inst[] on failed socket loading, potentially leading to a NULL dereference. The fix adds a NULL check for consistency with other places.

In the Linux kernel, the platform/x86 ISST driver lacked validation of the logical CPU ID and CLOS ID used by the core power feature. Values exceeding the supported maximum were not rejected even though they are used to calculate the MMIO offset.

In the Linux kernel, the platform/x86 int1092 driver did not free the memory allocated for device_mode_info in parse_package() on some error paths in sar_probe(). This caused a memory leak.

In the Linux kernel, the panasonic-laptop driver has an out-of-bounds write past the pcc->sinf[] array. The function acpi_pcc_retrieve_biosdata() writes a sentinel value at index equal to the SINF package count, which when num_sifr equals that count results in a one-element overflow (a silent 4-byte heap overflow). This occurs on hardware where HKEY.SQTY returns 37 and HKEY.SINF()'s package has 38 elements.

In the Linux kernel, the platform/x86 think-lmi driver's multi-certificate support allows the system authentication object to store ->signature and ->save_signature, which leak when the driver is removed. This causes a memory leak.

In the Linux kernel, the platform/chrome sensorhub driver did not validate the EC-reported sensor number (in->sensor_num) in cros_ec_sensorhub_ring_handler(). A value equal to or greater than sensor_num caused an out-of-bounds read and write of the batch_state[] array.

In the Linux kernel, the platform/x86/amd/pmc driver's amd_stb_s2d_init() discarded the return values of several S2D SMU commands and the S2D_PHYS_ADDR_LOW/HIGH values. On failure the physical address was left uninitialized and passed to devm_ioremap(), potentially mapping physical address 0.

In the Linux kernel, the platform/x86/amd/pmc driver's amd_pmc_probe() registered the LPS0 s2idle handler and created the debugfs directory before calling amd_stb_s2d_init(). When the latter failed, the error path did not unregister the handler or remove the debugfs directory, leading to list corruption and a kernel BUG on module reload.

In the Linux kernel, the platform/x86 hp-bioscfg driver's sk_store() and kek_store() stripped a trailing newline before allocating the key buffer, but passed the original count instead of length to hp_wmi_perform_query(). This caused a one-byte read past the allocated buffer.

In the Linux kernel, the platform/x86 hp-bioscfg driver's validate_password_input() computed length = strlen(buf) and checked buf[length - 1] without first ensuring length is nonzero. Writing an empty string (a bare '\n') to current_password or new_password caused a read of buf[-1], one byte before the heap allocation.