Linux kernel vulnerabilities

A vulnerability has been identified in the Linux kernel related to improper lock management in EEH event handling. Changes made to the EEH driver inadvertently moved the pci_lock_rescan_remove() function outside its intended scope, leading to issues with PCI error reporting and improper EEH event triggering.

A vulnerability has been identified in the Linux kernel related to incorrect memory access flagging in BPF helper function prototypes. The absence of appropriate MEM_RDONLY or MEM_WRITE flags leads to incorrect assumptions by the verifier, potentially resulting in correctness issues.

A use-after-free vulnerability in the power_supply_changed() function has been fixed in the Linux kernel. The issue arose from improper ordering of allocation and registration of the power supply handle, leading to a race condition where the interrupt handler could be invoked with a freed handle.

A vulnerability has been identified in the Linux kernel related to the use of commit_mutex in the reset path in netfilter. This issue leads to a circular lock dependency between commit_mutex, nfnl_subsys_ipset, and nlk_cb_mutex when nft reset, ipset list, and iptables-nft with '-m set' rule are run simultaneously.

A vulnerability has been identified in the Linux kernel related to accessing the regions array before setting the number of regions. This issue leads to an array index out-of-bounds error.

A vulnerability has been identified in the Linux kernel related to improper removal of PASID entries in the Intel VT-d table. During the teardown of an entry, there is a risk that hardware may read an inconsistent value, leading to unpredictable system behavior.

A vulnerability has been identified in the Linux kernel related to use-after-free in the power_supply_changed() function. This issue occurs when the power_supply handle is freed before the interrupt handler is registered, potentially leading to system crashes or memory corruption.

A vulnerability has been identified in the Linux kernel related to use-after-free in the power_supply_changed() function. This issue occurs when the power_supply handle is freed before the interrupt handler is registered, potentially leading to system crashes or memory corruption.

A vulnerability has been identified in the Linux kernel related to use-after-free in the power_supply_changed() function. This issue occurs when the interrupt handler is registered before the power_supply handle is registered, leading to the function being called with a freed handle.

A vulnerability has been identified in the Linux kernel related to use-after-free in the `power_supply_changed()` function. The issue occurs when the interrupt handler is registered before the `power_supply` handle is registered, leading to a race condition where an interrupt can call the function with a freed handle.

A use-after-free vulnerability has been identified in the Linux kernel within the caif_serial ldisc_close() function. The issue arises when handle_tx() accesses ser->tty after it has been freed, leading to a dangling pointer.

A vulnerability in the Linux kernel related to the PASID table has been resolved, which could be used incorrectly by IOMMU hardware. The issue was due to the improper order of flushing the cache before writing the address of a newly allocated PASID table.

A vulnerability in the Linux kernel has been resolved in netfilter, which caused packets to be dropped instead of queued when an application did not set the 'F_GSO' flag and received a GSO packet with an unconfirmed nf_conn entry.

A vulnerability has been identified in the Linux kernel in the ib_uverbs_post_send() function, which does not validate the wqe_size value before use. This allows reading beyond the allocated buffer, potentially leaking sensitive kernel information.

A vulnerability has been identified in the Linux kernel in the amdgpu_gmc_get_nps_memranges() function, which uses kfree() to free memory allocated by vmalloc(). This may lead to memory corruption.

In the Linux kernel, a double free vulnerability was found in the RDMA/rxe driver's rxe_srq_from_init function. The queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space, and if copy_to_user() fails, a second rxe_queue_cleanup() is triggered, causing a double free.

A vulnerability has been identified in the Linux kernel within the reserve_unaccepted() function, which incorrectly calculates the memory reservation size for the unaccepted memory table. This issue can lead to the table being overwritten or inaccessible, resulting in a kernel panic.

A vulnerability in the Linux kernel related to stack-out-of-bounds access in the is_bprm_creds_for_exec() function has been fixed. This issue was caused by incorrect offset calculation using the *file pointer.

In the Linux kernel, the Bluetooth L2CAP stack lacks a NULL check in the l2cap_sock_get_sndtimeo_cb() function, which can lead to a NULL pointer dereference.

In the Linux kernel, the Bluetooth L2CAP stack lacks a NULL check in the l2cap_sock_new_connection_cb() function, which can lead to a NULL pointer dereference.

In the Linux kernel, a null-ptr-deref bug in the function l2cap_sock_state_change_cb() in the Bluetooth L2CAP stack has been fixed. A missing NULL check was added, similar to that in l2cap_sock_resume_cb() and l2cap_sock_ready_cb().

In the Linux kernel, during skb coalescing in skb_try_coalesce(), the SKBFL_SHARED_FRAG marker is not propagated, breaking an invariant for later in-place writers. This can cause ESP processing errors where data is decrypted in place over page-cache backed frags.

A vulnerability was found in the Linux kernel's network packet fragment transfer helpers. Functions __pskb_copy_fclone() and skb_shift() fail to propagate the SKBFL_SHARED_FRAG flag, causing the destination socket buffer to not report shared pages. This can lead to writing into the page cache of read-only files by an unprivileged user.

In the Linux kernel's net/rds subsystem, there is an issue with zerocopy send cleanup before the message is queued. Incorrect zerocopy state discrimination can lead to improper cleanup of user pages.

In the Linux kernel, the remove_waiter() function in rtmutex uses current instead of waiter::task, causing issues during proxy-lock rollback in rt_mutex_start_proxy_lock() called from futex_requeue(). This leads to missing pi_lock, uncleared pi_blocked_on state (UAF risk), and incorrect rt_mutex_adjust_prio_chain() behavior.

In the Linux kernel, a vulnerability in the accel/ivpu driver is fixed by preventing re-exporting of imported GEM objects. Re-exporting causes loss of buffer flags settings, leading to incorrect device access and data corruption.

In the Linux kernel's fbdev udlfb driver, vm_ops are added to dlfb_ops_mmap to prevent use-after-free. Lack of vm_ops allowed stale memory mappings after buffer replacement, leading to access to freed pages.

In the Linux kernel network subsystem, a vulnerability was found in the RED queuing discipline. When RED has children (e.g., qfq) and a parent (e.g., tbf) calls dequeue after peek, a null pointer dereference and kernel panic can occur. The fix replaces the direct dequeue call with qdisc_dequeue_peeked().

In the Linux kernel, in the WWAN t7xx driver, the t7xx_port_enum_msg_handler() function uses the modem-supplied port_count field as a loop bound without checking that the message buffer contains sufficient data. Sending port_count=65535 in a 12-byte buffer triggers a slab-out-of-bounds read of up to 262140 bytes. Appropriate size checks have been added.

In the Linux kernel, in the RDS stack, when iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), pages are released but rm->data.op_nents is not reset. Later, rds_message_purge() iterates over the incorrect non-zero op_nents and frees them again, leading to a double free.

The ptrace(PT_SC_REMOTE) function fails to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls, allowing a user with debugging capabilities to trigger arbitrary code execution in the kernel, even if the target process has no special privileges. This missing validation enables an unprivileged local user to escalate privileges and potentially gain full control of the system.

A vulnerability in the setcred(2) system call in the Linux kernel. Before checking the caller's privileges, the user-supplied supplementary groups list is copied into a fixed-size kernel stack buffer without length validation. This can lead to a stack buffer overflow, exploitable by an unprivileged local user.

A vulnerability was found in the Linux kernel's ptrace mechanism related to the 'get_dumpable()' logic. This function, used for access permission checks, behaved incorrectly for threads without a memory descriptor (mm), potentially allowing unauthorized access to kernel thread details.

In the Linux kernel, a vulnerability was found in the bonding mechanism where bond_setup_by_slave() directly copies the header_ops pointer from a slave device (e.g., GRE tunnel) to the bond device. This causes a type confusion because header functions like ipgre_header() use netdev_priv() to access device-specific private data, and when called on the bond device, they retrieve the bonding structure instead of the expected IP tunnel structure, leading to reading garbage values and kernel crashes.

A vulnerability in the Linux kernel related to the lifecycle of the network device has been fixed, where the network device outlived its parent gadget device during disconnection, leading to sysfs link issues and null pointer dereference problems.

A vulnerability was found in the Linux kernel's bh1780 light sensor driver, causing a PM runtime reference count leak on the error path. The issue occurs because pm_runtime_put_autosuspend() is not called when a read operation fails, leading to improper power management state.

A vulnerability has been identified in the Linux kernel related to the processing of SIDs in the context of NFS. The issue lies in the parse_dacl() function potentially reading data beyond the bounds of the ACE, which could lead to unauthorized access.

A vulnerability has been identified in the Linux kernel related to the load_segments() function, which invalidates the GS base relied upon by KCOV. When CONFIG_KCOV is enabled, calls to instrumented C code can lead to kernel crashes in an endless loop.

In the Linux kernel netfilter flowtable subsystem, the maximum number of hardware offload actions is insufficient for IPv6, causing errors. The patch raises the limit to 24 and adds strict checking.

A vulnerability has been identified in the Linux kernel related to the call of the generic_handle_irq() function in a non-interrupt context. This issue occurs when resuming the system from suspend on Tegra platforms, leading to a warning in the logs.

A vulnerability in the Linux kernel has been resolved by clearing the page->private value in the free_pages_prepare() function. This issue led to a use-after-free in the swap subsystem, potentially causing system crashes.

In the Linux kernel, the panthor DRM driver violates dma-fence safe access rules. The drm_sched_fence_get_timeline_name function can race with group_free_queue, leading to potential use-after-free.

In the Linux kernel, a commit adding an OP-TEE node to the ZynqMP device tree is reverted. Manually defining the optee node in zynqmp.dtsi blocks U-Boot's automatic injection of the reserved-memory node, causing memory access violations at runtime.

A vulnerability has been identified and resolved in the Linux kernel. The issue occurs when the second-stage kernel is booted via kexec with limiting parameters, potentially leading to a kernel panic due to memory range errors.

In the Linux kernel, a vulnerability in the cpsw_new network driver may cause an attempt to unregister a network device that has not been registered yet. This occurs when an error happens during the registration of the first MAC, leaving the second MAC unchanged, potentially leading to an incorrect unregister_netdev() call.

In the Linux kernel, a lock was dropped in skb_may_tx_timestamp() that could lead to a deadlock when handling TX timestamps in interrupt context. The function could acquire sock::sk_callback_lock, which must not be used in IRQ context. The fix removes the lock and uses READ_ONCE() to read pointers, adding WRITE_ONCE() when clearing them.

In the Linux kernel, a vulnerability in the do_procmap_query() function in procfs can cause a double mmput() on the mm_struct. The issue occurs when a user provides an incorrectly sized buffer for the build ID, triggering an -ENAMETOOLONG error after locks are released and mmput() is called, leading to a second mmput() in the error path.

A vulnerability was found in the Linux kernel's KVM implementation for nested SVM (nSVM). The VMLOAD/VMSAVE emulation for L2 guests incorrectly used vmcb02 instead of vmcb01, potentially causing incorrect virtual machine state.

A vulnerability has been identified in the Linux kernel that occurs when booting the second-stage kernel via kexec with a limiting command line. The issue is that the IMA buffer from the previous kernel may fall outside the addressable RAM, leading to a page fault.

In the Linux kernel, the JFS filesystem has an nlink overflow during rename. When a directory's nlink is at maximum (-1), renaming a subdirectory causes a wrap to 0 and triggers a warning.