Linux kernel vulnerabilities

In the Linux kernel, the mt76 wifi driver (mt7615) acquires the mt76 mutex in mt7615_suspend() and then calls cancel_delayed_work_sync() on mac_work. Since mt7615_mac_work() also acquires the same mutex, if mac_work is already running and blocked on the mutex, the suspend path deadlocks.

In the Linux kernel, the mt76 wifi driver (mt7915) copies a fixed EFUSE block into dev->mt76.eeprom.data at the offset reported by the MCU (res->addr) in mt7915_mcu_get_eeprom() without checking it against the buffer size. A malicious or malfunctioning device can report an arbitrary address and drive a 16-byte out-of-bounds write past eeprom.data.

In the Linux kernel, the mt76 wifi driver (mt7925) queues mlo_pm_work with a 5 second delay during multi-link power-save setup and never cancels it on the stop path. If the device is torn down within that window, the work outlives the teardown and its timer fires afterwards, trying to queue onto a workqueue that is already gone.

A vulnerability in the Linux kernel's VLAN mechanism involves dynamically changing hard_header_len when toggling hardware VLAN TX offload. This causes a data race in lockless TX paths, potentially leading to skb_under_panic and a mismatch between allocated headroom and header creation.

In the Linux kernel, in the crypto: krb5 module, crypto_krb5_prepare_encryption() and crypto_krb5_prepare_checksum() free the buffer holding freshly derived keys with plain kfree(), leaving the key material behind in the freed slab object. This can lead to sensitive data leakage.

In the Linux kernel, in the xhci: dbgtty driver, if tty_register_driver() fails, it drops the reference but fails to set the global dbc_tty_driver to NULL, causing the unregister to be called again when the module exits. This leads to a use-after-free condition.

In the Linux kernel, in the crypto: qcom-rng module, the random number generator does not allow zero as an output, making its output distinguishable from truly random. Zero is a valid random number and should be allowed.

In the Linux kernel, in KVM: s390 vsie, when shadowing crypto access bits from a format0 apcb (crycb 0 or 1), bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested guest potential access to a device no longer available. Zero out the remaining bits.

In the Linux kernel, in io_uring, eventfd signaling is done inline when adding the first entry to the work list, which can cause issues when the addition is done from a wakeup handler context. The fix adds the IOU_F_TWQ_IN_WAKE flag to force deferral of signaling via call_rcu_hurry() instead of inline signaling.

In the Linux kernel, in HID: core, there is a number/pointer type confusion on long items. When fetch_item() is called by hid_scan_report() on an item with HID_ITEM_TAG_LONG, it stores a pointer to the item data in item->data.longdata instead of storing a value directly. Functions item_udata() and item_sdata() incorrectly assume short format, leading to the lower part of a kernel pointer being printed as a number in dmesg.

A vulnerability in the Linux kernel causes a NULL pointer dereference in the PCI host-generic driver on 32-bit systems using CAM mode. During PCI bus enumeration, the first config read uses an uninitialized mapping, leading to a kernel panic. The issue stems from missing add_bus/remove_bus callbacks in the CAM operations, which are necessary for proper mapping of the config space.

A vulnerability in the Linux kernel's KCOV mechanism causes data corruption and race conditions on PREEMPT_RT systems. The issue stems from storing temporary KCOV state in per-CPU areas, which can be overwritten by nested softirq preemption. Additionally, under certain initialization conditions, it may lead to kernel panic or memory leaks.

In the Linux kernel, a use-after-free vulnerability in the Bluetooth ISO subsystem was fixed in iso_conn_ready. The issue occurred when the listening socket was closed concurrently, leading to use of freed memory when creating a child socket.

In the Linux kernel, a vulnerability in SELinux has been fixed: every boolean value must be defined. The number of booleans (p_bools.nprim) comes from the policy image independently of how many booleans follow it, and cond_index_bool() fills bool_val_to_struct[] at value - 1, so a count larger than the values present leaves NULL entries. Every user of that array walks it by index and dereferences each entry, which can lead to issues. The fix rejects a boolean value that no boolean defines, once, where the array is built.

In the Linux kernel, the security_get_classes() function in SELinux did not validate whether a class value is defined by the policy, leaving a NULL pointer in the array, which could lead to a system crash when creating directory entries.

In the Linux kernel ASoC SOF subsystem, the error path in sof_widget_setup_unlocked() has a bug where cleanup functions are called twice on failure, leading to double decrement of use_count and double invocation of core_put.

In the Linux kernel lpass-wsa-macro codec driver, enum controls (such as 'EAR SPKR PA Gain' and 'WSA RX* Mux') are incorrectly handled; get/put callbacks access the value via integer field instead of enumerated, causing -EINVAL on every read on 64-bit kernels with CONFIG_SND_CTL_DEBUG enabled.

In the Linux kernel drm/amdgpu driver, there is a lack of validation for the number of H.265 references in UVD messages, which could lead to overflow when calculating the minimum DPB buffer size.

In the Linux kernel drm/amdgpu driver, there is a lack of validation for dimensions above 4096 in UVD messages, which could lead to overflow in DPB size calculations.

In the Linux kernel drm/amdgpu driver, the minimum DPB size calculation for H.264 uses the maximum number of references derived from the level instead of the actual number from the decode message, potentially leading to incorrect memory allocation.

A vulnerability in the Linux kernel's packet_parse_headers() function affects sending VLAN-tagged frames. Incorrect call order leaves transport_header uninitialized, potentially causing incorrect network stack behavior.

In the Linux kernel net: tap driver's tap_get_user_xdp() function, when processing a VLAN-tagged frame, the transport header is not set correctly, leaving transport_header uninitialized, which could lead to errors in further packet processing.

In the Linux kernel net/tls subsystem, tls_sw_splice_read() does not check for errors after a failed async decrypt. Unlike other read functions, splice may continue delivering data on a connection that should be closed due to authentication failure.

In the Linux kernel drm/xe/oa driver, xe_oa_emit_oa_config() does not release sync entries on failure before the point of no return, leading to memory leaks and fence references that become unreachable.

In the Linux kernel, in the sun6i-dma DMA driver, active descriptors are not properly reclaimed when terminating DMA transfers. Only cyclic descriptors were handled, causing non-cyclic descriptors and their LLI chains to be permanently leaked. The fix uses vchan_terminate_vdesc() and adds a check to prevent double-adding completed descriptors.

In the Linux kernel, IPVS lacks checksum validation for ICMPv6 packets from clients and for ICMPv6 responses from real servers (missing pseudo-header calculation). The fix introduces a helper ip_vs_checksum_common_check() and uses nf_checksum() for validating ICMP, TCP, and UDP, with correct IP offset for debugging. Checksum validation is performed only on LOCAL_IN, not on LOCAL_OUT or FORWARD.

In the Linux kernel, in ASoC SDCA, the UMP message size check may pass incorrectly if the message offset is larger than the buffer length. The fix refactors the check to be more robust against invalid sizes.

In the Linux kernel, the fscache backend for the EROFS filesystem has been entirely removed. This feature was deprecated for almost two years, and equivalent functionality is now provided by EROFS file-backed mounts and fanotify pre-content hooks. The removal also eliminates implementation issues that were not worth further investigation.

In the Linux kernel, in netfs, when a copy-to-cache append operation fails, the PG_private_2 flag on the folio is not cleared, leading to a held reference. The fix clears the flag and releases the reference immediately upon append failure.

In the Linux kernel, in netfs, when I/O iterator preparation fails, readahead folios that have already been batched are not released, causing held references. The fix releases the batch before returning the error.

In the Linux kernel, in mshv, there is a race in mshv_irqfd_deassign due to missing pt->pt_irqfds_lock during list traversal and deactivation. Additionally, using hlist_del() instead of hlist_del_init() leaves the node not marked as unhashed after removal, potentially leading to double deletion. The fix adds the lock and uses hlist_del_init().

In the Linux kernel's mshv module, a race condition exists between publishing a VP pointer in pt_vp_array and the irqfd fast assertion path. On weakly-ordered architectures, a reader may observe a non-NULL pointer before the VP struct is fully initialized, leading to use of partially initialized fields.

In the Linux kernel, in iommufd, during device replacement, the new hwpt is passed to iommufd_auto_response_faults instead of the old one, causing incorrect fault group processing. The fix passes the old hwpt, as originally implemented.

A vulnerability in the Linux kernel's hugetlb mechanism causes corruption of swap entries during fork(). The copy_hugetlb_page_range() function incorrectly clears the uffd-wp bit at the present-PTE bit position, which for migration or hwpoison entries modifies the encoded PFN by two pages. The issue occurs even without userfaultfd, requiring only a plain fork() with an in-flight migration entry or a poisoned hugetlb page.

In the Linux kernel, the EROFS filesystem LZMA stream pool size is now capped by a new configuration option. By default, the pool is limited to 16 streams, preventing small EROFS images from pinning excessive vmalloc memory on high-CPU systems.

In the Linux kernel for KVM on s390, validation of AIBV and AISB addresses is added before pinning guest pages. Requests with AIBV crossing a page boundary or with unaligned AISB address are rejected.

In the Linux kernel's SCTP protocol, cookie validation is tightened. Expired cookies are rejected when verification tags do not match the current association, preventing unauthorized restart of the association.

In the Linux kernel, a vulnerability in the CAN ISO-TP module was fixed, addressing incorrect timer drain order, wakeup handling, and tx_gen ordering. These flaws could lead to race conditions during concurrent send and socket release operations, potentially causing hangs, state corruption, or data integrity issues.

In the Linux kernel's DRM vmwgfx driver, during import of a foreign prime fd, a dma_buf reference was not released, leading to memory leak. The fix ensures the reference is dropped on the error path.

In the Linux kernel's DRM vmwgfx driver, an unsigned integer overflow occurred when validating shader size and offset. The fix uses check_add_overflow to detect the overflow.

In the Linux kernel, a fix was made in the NTB driver to store the original DMA address for future release. The DMA API requires that dma_free_attrs receive the exact dma_handle originally returned by the allocation function. The fix prevents modifying it.

In the Linux kernel, a fix was made in the Tegra graphics drivers (gr2d/gr3d) to initialize the address register map before the HOST1X client is registered. Previously, client registration occurred before initialization, potentially allowing userspace to submit jobs before initialization. The fix moves register initialization before client registration.

In the Linux kernel, the AFS filesystem has a memory leak related to an ungot volume. The afs_lookup_volume_rcu() function does not release a dying volume when afs_try_get_volume() fails.

In the Linux kernel's TIPC subsystem, tipc_exit_net() contains a busy-wait loop waiting for UDP bearer cleanup works to complete. Under certain conditions (e.g., high-priority task or non-preemptive kernel), the loop can run for a long time, wasting CPU cycles and leading to soft lockups. The fix replaces the loop with wait_var_event().

In the Linux kernel, the RDMA/rxe subsystem has a use-after-free vulnerability when modifying the IB_QP_MAX_DEST_RD_ATOMIC attribute. A local unprivileged user can race the free/realloc to cause a use-after-free in rxe_receiver(), leading to a local denial of service.

In the Linux kernel, in the RDMA/rxe subsystem, a vulnerability was found involving an out-of-bounds read/write in the free_rd_atomic_resources() function. The issue arises from updating the max_dest_rd_atomic attribute before freeing the old array, causing the freeing loop to walk past the allocated area, which can lead to memory corruption (detected by KASAN).

In the Linux kernel, the nvme-tcp driver has an issue with incorrect usage of page_frag_cache in a multi-threaded environment, leading to incorrect refcounting and premature free of pages. This can cause network warnings and random system panics.

In the Linux kernel, a vulnerability exists in the USB xHCI driver where xhci_gen_setup() reads the controller's capability register even when the controller is inaccessible (e.g., after power failure or bus removal). The read returns 0xFFFFFFFF, leading to an incorrect calculation of operational register addresses and causing an alignment fault on ARM64, resulting in a kernel oops. This affects controllers like Renesas uPD720201 that fail to resume from D3cold.

In the Linux kernel, the FUSE filesystem has a race between interrupt and resend that can trigger WARN_ON and potentially cause issues.

In the Linux kernel, the FUSE filesystem lacks a memory barrier when checking io-uring readiness, which can lead to a lock-order inversion deadlock.