Linux kernel vulnerabilities

A use-after-free (UAF) vulnerability was identified in the Linux kernel's rlb_arp_recv function, which may lead to a null pointer dereference during rapid bond up/down cycles.

A vulnerability has been identified in the Linux kernel within the ps_gamepad_create() function, which calls input_ff_create_memless() without verifying its return value. This can lead to incorrect behavior or potential crashes when FF effects are triggered.

A vulnerability in the Linux kernel has been fixed, concerning the map_direct_value_addr() function. This function incorrectly adds an offset to the address, potentially leading to system malfunction.

A vulnerability in the Linux kernel related to invalid dereferencing of rawdata when the export_binary parameter is unset has been fixed. When a profile is replaced, rawdata is set to NULL, leading to an error during dereferencing.

A vulnerability has been identified in the Linux kernel related to a kref leak in the error path of the gss_alloc_msg function. The issue arises from the lack of a kref_put() call when the kstrdup_const() function fails, leading to the gss_auth structure not being freed.

A vulnerability has been identified in the Linux kernel affecting the ublk_ctrl_cmd_dump() function. The issue arises from the lack of validation of the SQE128 flag before accessing memory, which could lead to unauthorized out-of-bounds memory access.

In the Linux kernel, two memory leak issues in the gfs2_fill_super function have been resolved. These issues occur during error handling when transitioning a filesystem to read-write mode fails.

A vulnerability has been identified in the Linux kernel in the hfs_bnode_create function, which returns an existing node without incrementing its reference count. This can lead to reference count inconsistency and kernel panic when the node is later freed.

A vulnerability in the Linux kernel has been fixed that could lead to system crashes due to incorrect usage of the cleanup function kfree. The issue stemmed from incorrectly annotating a local pointer variable, resulting in the wrong address being passed to kfree.

A vulnerability has been identified in the Linux kernel that allows direct dereferencing of a user pointer in the vidi_connection_ioctl() function. This enables access to kernel memory from user space.

A vulnerability was identified in the Linux kernel that led to an infinite loop in the rcu_read_unlock() function due to IRQ work. It has been fixed by introducing a flag before calling raise_softirq_irqoff().

A vulnerability has been identified in the Linux kernel within the vidi_connection_ioctl() function, which may lead to errors such as null pointer dereferences and out-of-bounds errors. The issue arises from incorrectly obtaining the vidi context pointer from the wrong master device.

A vulnerability has been identified in the Linux kernel related to the llbitmap_suspend_timeout() function. When a timeout occurs, this function fails to resurrect the percpu_ref, leading to its permanent blocking.

A vulnerability has been identified in the Linux kernel within the au1200fb_drv_probe() function, leading to a memory leak if the platform_get_irq function fails. The issue has been resolved by introducing a goto label to ensure proper resource cleanup.

A vulnerability has been identified in the Linux kernel related to a potential use-after-free of BTF objects. The issue involves incorrect refcounting in the check_pseudo_btf_id() function, which may lead to calling __check_pseudo_btf_id() with a zero refcount.

A vulnerability related to a memory leak in the starfive_aes_aead_do_one_req() function has been identified in the Linux kernel. This function allocates memory but fails to free it in case of errors, leading to memory leaks.

A vulnerability has been identified in the Linux kernel related to a race condition in the hwrng module. The issue arises from the hwrng_fillfn() thread not being properly stopped, leading to use-after-free situations and thread management errors.

A vulnerability has been identified in the Linux kernel within the ext4_ext_shift_extents() function, leading to a memory leak. The issue occurs when the extent pointer is NULL, preventing resource release.

A vulnerability has been identified in the Linux kernel related to a memory leak in the amdgpu_acpi_enumerate_xcc() function. If amdgpu_acpi_dev_init() returns -ENOMEM, the function does not free the allocated xcc_info memory, leading to a memory leak.

A vulnerability has been identified in the Linux kernel related to use-after-free in the power_supply_changed() function. This issue occurs when the power_supply handle is freed before the interrupt handler is registered, leading to the function being called with a freed handle.

In the Linux kernel, a race condition was found in the Intel VT-d driver during PASID table entry replacement. Due to the 512-bit entry size, which hardware may read in smaller chunks, directly overwriting an active entry (with Present bit set) can lead to an inconsistent state, resulting in unpredictable behavior or spurious faults.

In the Linux kernel, the iommu/vt-d driver has a race window when tearing down a context entry, where hardware may fetch a torn entry with the Present bit still set, leading to unpredictable behavior or spurious faults.

A vulnerability has been identified in the Linux kernel that may lead to a NULL pointer dereference when reading inline data for compressed ztailpacking pclusters. This issue occurs when pclusters are added to I/O chains without prior validation.

A vulnerability has been identified in the Linux kernel related to the get_burstcount() function, which can return -EBUSY on timeout. In this case, the function does not release the locality, potentially leading to locality leaks.

A vulnerability has been identified and resolved in the Linux kernel. The issue affects GMAC4, where in rare cases, with split header enabled, the hardware does not fill buf2 of the first descriptor with payload, leading to incorrect length calculations for buf2 of the second descriptor.

A vulnerability has been identified in the Linux kernel related to a memory leak in the ni_usb_init() function. If ni_usb_setup_init() fails, the function returns -EFAULT without freeing the allocated buffer, leading to a memory leak.

A vulnerability has been identified in the Linux kernel related to use-after-free in the power_supply_changed() function. This issue occurs when the power_supply handle is freed before the interrupt handler is registered, potentially leading to system crashes or memory corruption.

A vulnerability has been identified in the Linux kernel that has been resolved. The issue involved multiple unregistrations of the same hash algorithm during driver detach due to a wrong iterator.

A vulnerability has been identified in the Linux kernel related to use-after-free in the power_supply_changed() function. This issue occurs when the power_supply handle is freed before the interrupt handler is registered, potentially leading to system crashes or memory corruption.

A vulnerability has been identified in the Linux kernel within the 'DeleteIndexEntryRoot' function that may lead to a heap buffer overflow. The issue arises from inadequate bounds checking when calculating the entry size, potentially resulting in out-of-bounds reads.

A vulnerability has been identified in the Linux kernel within the sync_linked_regs() function, which may lead to errors in register ID propagation. The issue arises when registers are linked, and their IDs are incorrectly assigned, potentially resulting in verification errors and division by zero.

A vulnerability in the Linux kernel has been fixed that allowed BPF_PROG_DETACH on tcx or netkit devices to be executed by any user when no program fd was provided. The fix adds a capability check for CAP_NET_ADMIN or CAP_SYS_ADMIN.

A vulnerability has been identified in the Linux kernel that leads to a crash in the iommu_sva_unbind_device() function due to accessing the mm structure after it has been freed. The issue has been resolved by holding a reference to the mm structure throughout the device bind/unbind operation.

A vulnerability has been identified in the Linux kernel regarding improper initialization of data in nlmsg responses. The issue occurs with the RTM_GETNEIGH message, which may return uninitialized data in the pad bytes.

A vulnerability has been identified in the Linux kernel that leads to a memory leak on codec_info allocation failure. The functions wave5_vpu_open_enc() and wave5_vpu_open_dec() do not free the previously allocated instance, resulting in a memory leak.

A vulnerability has been identified in the Linux kernel's BPF mechanism, allowing the hash of a map to be calculated and cached regardless of its frozen state. This can lead to a TOCTOU bug where a user can modify the map's contents before freezing it.

A vulnerability in the Linux kernel related to a potential memory leak during PWM chip initialization has been resolved. If __pinned_init() fails, the allocated pwm_chip would leak due to not calling pwmchip_put() on the error path.

A vulnerability has been identified in the Linux kernel related to a reference leak in the thermal_of_cm_lookup() function. The tr_np value is obtained via of_parse_phandle() but is never released, leading to a memory leak.

A vulnerability has been identified in the Linux kernel related to a memory leak in the GET_DATA_DIRECT_SYSFS_PATH function. If the length of the device path exceeds the output buffer length, memory is not freed, leading to a memory leak.

A vulnerability has been identified in the Linux kernel related to a memory leak in the mtd_parser_tplink_safeloader_parse() function. The issue occurs when buffer allocation fails, and the buffer is not freed, leading to a memory leak.

A vulnerability has been identified in the Linux kernel that leads to an infinite self-interrupt loop on CPU0 when overloaded. The issue occurs during RT task load balancing, potentially causing CPU lockup.

A vulnerability has been identified in the Linux kernel related to route management for closing network devices. The issue involves a race condition between the event notification and the code that caches route information, potentially leading to leaked device references.

A use-after-free vulnerability was identified in the power_supply_changed() function in the Linux kernel. The issue occurs when the power_supply handle is freed before the interrupt handler is registered, potentially leading to system crashes or memory corruption.

A vulnerability has been identified in the Linux kernel related to directory removal in FAT file systems. The flaw may lead to incorrect decrementing of the parent link count, resulting in filesystem errors.

A vulnerability has been identified in the Linux kernel related to updating the number of mdb entries in VLAN contexts. The issue arises from conditionally increasing the entry count, leading to situations where this count is not properly updated, potentially resulting in warnings during bridge operations.

A vulnerability in the Linux kernel has been resolved related to mtk_gate, where these structs were used not only for initialization but also at runtime. The __initconst annotations have been dropped from gates.

A vulnerability has been identified in the Linux kernel related to a memory leak in the amdxdna_ubuf_map() function. This function allocates memory for sg and internal sg table structures but fails to free it if subsequent operations fail.

A vulnerability in the Linux kernel was identified that led to deadlocks between devlink and netdev instance locks. The issue stemmed from incorrect lock ordering during the recovery process, which could cause system failures.

A vulnerability has been identified in the Linux kernel related to use-after-free in the `power_supply_changed()` function. The issue occurs when the interrupt handler is registered before the `power_supply` handle is registered, leading to a race condition where an interrupt can call the function with a freed handle.

A vulnerability has been identified in the Linux kernel within the icmp_route_lookup function, which may lead to incorrect routing of ICMP messages. The issue occurs when the destination address becomes local between the check and the ip_route_input call, resulting in a call to the ip_rt_bug function.