Linux kernel vulnerabilities

A vulnerability has been identified in the Linux kernel related to memory management concerning the BYE packet sent by a node. The nameserver does not free the node memory after processing the packet, leading to a memory leak.

A vulnerability in the Linux kernel related to validating ICMP reply types before using ICMP pointers has been resolved. Extended echo replies use ICMP_EXT_ECHOREPLY, which is outside the range covered by icmp_pointers[].

A vulnerability has been identified in the Linux kernel that allows re-entry into the rmqueue() function from NMI context in UP systems, leading to corruption of the free page lists. This issue occurs when spin_trylock() always returns success, even when the lock is already held.

A vulnerability has been identified in the Linux kernel that allows for a NULL pointer dereference in the interrupt trigger path. This issue has been resolved by adding validation to ensure that MSI is configured before accessing the cdx_irqs array.

A vulnerability in the Linux kernel's authencesn cryptographic mechanism allows using an undersized hash digest (1-3 bytes) during instance creation, leading to an out-of-bounds memory access when handling the ESN sequence number.

A vulnerability has been identified in the Linux kernel within KVM that occurs during nested #VMEXIT when loading L1's CR3 fails. In this case, the nested_svm_vmexit() function returns an error code that is ignored by most callers, leading to L1 continuing to run in a corrupted state.

A vulnerability has been identified in the Linux kernel related to a device_node leak in the mc_probe() function. The original code did not free the r5_core_node reference, leading to a memory leak.

A vulnerability has been identified in the Linux kernel that allows re-entry into the slab allocator in NMI context, leading to slab state corruption. This issue occurs in uniprocessor (UP) systems and can be triggered by the kmalloc_nolock() function.

A vulnerability has been identified in the Linux kernel related to the algif_aead algorithm, affecting asynchronous AEAD requests. The issue arises from the use of a socket-wide IV buffer, which can lead to inconsistent IV handling due to later socket activity.

A vulnerability in the Linux kernel has been resolved in the smc_clc_wait_msg function. The issue involved handling connection declines during the early handshake stage, which could lead to incorrect updates of the link group synchronization state.

A vulnerability in the Linux kernel has been fixed that could lead to memory leaks or deadlocks due to a race condition between damon_call() and kdamond_fn(). The introduction of an additional field in damon_ctx and proper mutex locks helps avoid these issues.

A vulnerability has been identified in the Linux kernel related to integer overflow in the create_dirty_log() function. It allows bypassing argument validation, leading to out-of-bounds reads on the argv array.

A vulnerability has been identified in the Linux kernel that allows for out-of-bounds read in the ibmasm_handle_mouse_interrupt() function. The issue occurs when the reader or writer indices exceed the allowed queue size, potentially leading to unintended reads from device registers.

A vulnerability has been identified in the Linux kernel related to improper management of thermal zones. Issues with thermal governor cleanup may lead to memory leaks and use-after-free errors.

A vulnerability has been identified in the Linux kernel that allows improper memory access due to lack of validation of the node identifier in the si_meminfo_node() function. Privileged users can exploit the DAMON tool to trigger this error.

A vulnerability has been identified in the Linux kernel related to a memory leak in the atmel_aes_buff_cleanup function. This function only frees one page of memory while leaving three pages unreturned, leading to a memory leak.

A vulnerability in the Linux kernel related to race conditions in the split queue during migration has been fixed. The issue involved improper management of the queue state, which could lead to incorrect marking of memory as partially mapped.

A vulnerability has been identified in the Linux kernel related to socket migration in the SO_REUSEPORT group, which may lead to blocking of waiting threads. After socket migration, the new listener does not notify waiters about the availability of a connection, potentially causing them to remain asleep indefinitely.

A vulnerability has been identified in the Linux kernel within the put_folios function that may lead to incorrect processing of physical addresses. The issue arises from an incorrect PFN to physical address conversion and missing checks in the cleanup loop.

A vulnerability in the Linux kernel that led to memory leaks in the rxkad_verify_response() function has been fixed. The changes ensure proper resource deallocation in all circumstances, preventing leaks.

A vulnerability has been identified in the Linux kernel affecting the mtk_jpeg_release() function. The issue arises from freeing the context (ctx) without first canceling any pending or running work, leading to race conditions and potential access to freed memory.

A vulnerability in the Linux kernel related to error handling in the rxgk_extract_token() function has been fixed. If rxgk_decrypt_skb() returns -ENOMEM, the function should return that error instead of continuing, which could lead to an abort.

A vulnerability has been identified in the Linux kernel related to duplicate resource teardown in the epf_ntb_epc_destroy() function. This may lead to system errors when the .allow_link operation fails or during the .drop_link execution.

A vulnerability has been identified in the Linux kernel that may lead to deadlocks in the damos_walk() function due to a race condition with the kdamond_fn() function. The issue arises from improper context management, potentially resulting in infinite waiting for request handling.

In the Linux kernel, a vulnerability related to a resource leak in the xfs_alloc_buftarg() function has been fixed. In the error path, fs_put_dax() is called to drop the DAX device reference.

A vulnerability has been identified in the Linux kernel that allows for unlimited node registration by the nameserver. This can lead to memory exhaustion if a malicious client starts registering random nodes.

A vulnerability in the Linux kernel has been fixed in the pt5161l_read_block_data() function, which could lead to buffer overrun and incorrect return values on length mismatch.

A vulnerability related to RESPONSE packet handling at the connection level has been fixed in the Linux kernel. Security issues could lead to decrypted packet data being exposed to packet sniffers.

A vulnerability has been identified in the Linux kernel within the z_erofs_lz4_handle_overlap() function, which may lead to improper memory access during LZ4 decompression. Specifically crafted images can cause out-of-bounds access, resulting in data access errors.

In the Linux kernel, a use-after-free (UAF) vulnerability was found in the rxrpc module after a failed skb_unshare() call. If skb_unshare() fails to duplicate a packet due to an allocation error, the skb pointer in the parent function (rxrpc_io_thread()) is set to NULL, which may cause a system crash when trace_rxrpc_rx_done() is called.

A vulnerability in the Linux kernel has been fixed related to the missing put_disk() call when device_add(&disk_dev) fails. This bug resulted in the scsi_disk being freed while the gendisk remained referenced.

A vulnerability related to the use of the user_struct in the io_free_rbuf_ring() function has been fixed in the Linux kernel. The issue was that this structure was being freed before the ring was destroyed, which could lead to improper memory management.

A vulnerability has been identified in the Linux kernel within the command_file_write function, leading to out-of-bounds reads due to missing size checks. An attacker can exploit this flaw to leak kernel memory.

A vulnerability has been identified in the Linux kernel related to the LoongArch architecture, concerning the syscall dispatch table. The lack of an array_index_nospec() boundary allows access to syscall function pointers beyond the allowed range.

A vulnerability has been identified in the Linux kernel related to improper management of partition descriptors in UDF images. Repeatedly appending the same descriptors can lead to out-of-bounds writes, potentially causing security issues.

A vulnerability has been identified in the Linux kernel's krealloc() function that may lead to data loss and buffer overflow during object resizing. These issues arise from improper size management during NUMA migration and when shrinking objects.

A vulnerability has been identified in the Linux kernel within the testdrv_probe() function, leading to a use-after-free error. The issue arises from an incorrect release of the 'dn' pointer, which may result in the use of a freed object.

A vulnerability has been identified in the Linux kernel related to KVM, concerning the synchronization of interrupt state in nested virtual machines. The issue arises when KVM_SET_VCPU_EVENTS is called before KVM_SET_NESTED_STATE, potentially leading to a hang of the vCPU in L2.

A vulnerability related to a memory leak in the cc_mac_digest() function has been identified in the Linux kernel. A fix has been implemented that adds the cc_unmap_result() function in case cc_map_hash_request_final() fails.

A use-after-free vulnerability was discovered in the Linux kernel's GFS2 filesystem inline data write path. The metadata buffer head (dibh) is released prematurely in gfs2_iomap_begin() while iomap->inline_data still points to its data, leading to a write to freed memory. This can compromise system integrity.

A vulnerability has been identified in the Linux kernel related to NFSv4 request handling. Delays in idmap upcall responses can lead to request rejections, resulting in client session errors.

In the Linux kernel, a vulnerability related to NULL pointer dereference in the acpi_ev_address_space_dispatch() function has been fixed. A new check has been added to cover a missed execution path.

A vulnerability in the Linux kernel related to device lifecycle handling in the `css_alloc_subchannel()` function has been fixed. The issue was that in case of a DMA mask setup failure, the subchannel structure was freed without proper reference management to the device model.

A vulnerability has been identified in the Linux kernel related to job scheduling in hardware context during resource release. This can lead to use-after-free errors and system crashes.

A vulnerability has been identified and resolved in the Linux kernel. The issue concerns the gb_lights_light_config() function, which stores the channel count before allocating the channels array, potentially leading to a NULL pointer dereference.

A vulnerability related to a memory leak in the amdgpu_ras_init() function has been identified in the Linux kernel. If the amdgpu_nbio_ras_sw_init() function fails, the allocated con structure is not freed, leading to a memory leak.

A vulnerability has been identified in the Linux kernel related to accessing the ublksrv_ctrl_cmd structure, which may reside in userspace-mapped memory. The issue involves a race condition when reading its fields, potentially leading to unpredictable behavior.

A vulnerability in the Linux kernel related to invalid leaf access in the btrfs_quota_enable() function when the reference key is not found has been resolved. The issue occurred when btrfs_search_slot_for_read() returned 1, indicating that no key greater than or equal to the requested key was found.

A vulnerability in the Linux kernel causes the driver to hang indefinitely in LAG mode during firmware reset. This issue arises from a race condition leading to an infinite wait for UMR completion during device unload.

A vulnerability in the Linux kernel related to BPF programs has been resolved by limiting the size of BPF program signatures. Allowing larger sizes can lead to abuse, forcing the kernel into costly memory allocations.