Linux kernel vulnerabilities

In the Linux kernel, the RDMA/bnxt_re module's bnxt_re_mmap() rejects VM_WRITE for the DBR_PAGE and TOGGLE_PAGE mmap flags, but a read-only mapping can still retain VM_MAYWRITE and later be upgraded with mprotect(PROT_WRITE). This bypasses the write check that only runs at mmap time. The fix clears VM_MAYWRITE before vm_insert_page() in the shared DBR/toggle-page branch.

In the Linux kernel, ext4_init_orphan_info() leaks a buffer_head reference. When ext4_bread() succeeds but orphan block magic or checksum validation fails, the out_free loop starts releasing buffers from i-1, skipping the current buffer_head at index i.

In the Linux kernel, the amd_pstate_ut module does not check whether the amd-pstate driver is active, causing a NULL pointer dereference when modprobe is run on Intel platforms. The lack of state detection leads to a kernel crash.

In the Linux kernel, the cpufreq/amd-pstate driver's amd_pstate_power_supply_notifier() and amd_pstate_profile_set() do not handle cpufreq_cpu_get() returning NULL. This can lead to a NULL pointer dereference during a race with CPU hotplug or driver teardown.

In the Linux kernel, scmi_protocol_table_register() can leave earlier requests registered when a later entry in the same ID table fails. Each request retains a pointer to the driver's ID table, so a failed module load can leave a dangling pointer after the module storage is released.

In the Linux kernel, scmi_driver_register() requests protocol devices before registering the driver. If driver_register() fails, those requests remain in the global IDR and retain pointers to the module's ID table, leading to dangling pointers after the failed module load releases that storage.

In the Linux kernel, the exfat filesystem zeroes the page-cache gap below the new valid_size when a shared writable mapping has its valid_size extended by a buffered write or page fault. A store through the mapping can race with this zeroing and be overwritten.

In the Linux kernel, BPF subprograms use the bpf_callback_t ABI, but task work invokes the callback through a three-argument function pointer. This trips kCFI.

In the Linux kernel, the error path in find_pos_and_ways() releases its reference to a switch decoder before logging an error that includes the decoder name. If the released reference is the last one, the decoder can be freed before the error message accesses its name, leading to a use-after-free.

In the Linux kernel, the liveupdate (LUO) mechanism did not remember the status of a failed retrieve() attempt on an FLB, causing the FLB's retrieve() callback to be called again on a retry. The retry is problematic because the FLB may be in a very different state (e.g. some KHO pages may have already been restored and freed).

In the Linux kernel, the pinctrl: mediatek driver registered the gpio_chip with the non-managed gpiochip_add_data() even though the memory was allocated with device-managed memory. Once the drivers can be built as modules and unbound/rmmod'd, devm frees the gpio_chip's memory while it is still registered, causing a use-after-free.

In the Linux kernel, mtk_eint_do_init() creates an IRQ domain, populates it with mappings and installs a chained handler, but never releases them. Now that the drivers can be built as modules and unbound/rmmod'd, this leaves behind a dangling IRQ domain, interrupt mappings whose chip data points at freed memory, and a chained handler that keeps firing into that freed data.

In the Linux kernel, the scsi: ufs: core driver improperly validated string descriptors. It passed a byte count instead of a UTF-16 code-unit count to utf16s_to_utf8s(), which could read beyond the descriptor buffer, and copying bLength bytes could read beyond the response buffer.

In the Linux kernel, the single-doorbell completion path can call ufshcd_compl_one_cqe() with a NULL CQE. If no command is associated with the completion tag, the warning message dereferences the CQE while reporting the error.

In the Linux kernel, the scsi: ufs: core driver did not validate connected lane counts. The connected lane count is used by TX equalization code to index arrays sized by UFS_MAX_LANES, which can lead to out-of-bounds indexing.

In the Linux kernel, ufs_saved_err_write() copies user input into a zero-initialized stack buffer and passes it to kstrtoint(). A write that fills the entire buffer overwrites its only terminator.

In the Linux kernel, kmb_ocs_aes_probe() requests the device IRQ before initializing irq_completion. Once the handler is registered it can run immediately, and ocs_aes_irq_handler() unconditionally calls complete(), using an uninitialized completion.

In the Linux kernel, the zisofs_fill_pages() function (isofs filesystem) left the last block pointer buffer_head referenced on the success path. This causes a buffer reference leak when reading the zisofs compressed block pointer table.

In the Linux kernel, the SPI oc-tiny driver allocated the controller with the non-managed spi_alloc_host() while registering the interrupt with devm_request_irq(). During removal the controller was freed before free_irq() ran, allowing a late or latched interrupt to dereference freed memory (use-after-free).

In the Linux kernel, the sched_ext scheduler's scx_hardlockup() deferred the abort via irq_work, which does not work in NMI context and prevented recovery from self-detected hardlockups. It also returned true even when the abort was refused, suppressing the kernel's hardlockup report.

In the Linux kernel, the remoteproc subsystem lacked synchronization between rproc_crash_handler_work() and rproc_del(), allowing a driver to be removed while crash-handler work was scheduled or executing, leading to use-after-free. A "deleting" flag and cancellation/synchronization of the work before removal were introduced.

In the Linux kernel, the iommu/tegra241-cmdqv driver's __tegra241_cmdqv_probe() requested the error IRQ before allocating the cmdqv->vintfs array and setting cmdqv->num_vintfs. A latched CMDQV error inherited across a kexec caused the ISR to walk an uninitialized array.

In the Linux kernel, the iommu/tegra241-cmdqv driver's tegra241_cmdqv_remove() tore down each VINTF first and only then called free_irq(). An error in that window caused the ISR to read a stale slot and dereference a NULL or freed pointer.

In the Linux kernel, the iommu/tegra241-cmdqv driver leaks VINTF0 on the init-failure path. When tegra241_cmdqv_init_vintf() fails or a later VCMDQ preallocation fails, VINTF0 is not properly freed because the ownership decision relies on an incorrectly read hardware state.

In the Linux kernel, the clk: mediatek: pllfh driver leaks IO-mapped memory on the PLL registration error path. The mtk_clk_register_pllfhs function does not free the IO memory mapped on the fhctl node when PLL registration fails.

In the Linux kernel, the PCI subsystem has a use-after-free (UAF) when a probe runs concurrently with dynamic ID removal. The pointer to a dynamic ID can be freed by remove_id_store() while pci_match_device() still uses it.

In the Linux kernel, the nilfs2 filesystem has an infinite loop in nilfs_clean_segments(). When nilfs_segctor_construct() repeatedly returns -EROFS (e.g., after an I/O error and remounting the device read-only), the cleaner thread loops forever.

In the Linux kernel, the nilfs2 filesystem has a BUG in nilfs_copy_dirty_pages() triggered by a dirty state mismatch. When a dirty page unexpectedly loses its dirty status after the filesystem transitions to read-only mode, the kernel triggers a BUG.

In the Linux kernel, the RDMA/cxgb4 module has an skb leak and double free in write_tpt_entry(). When the device is in a fatal error state, write_tpt_entry() returns an error before handing off the skb, leading to a leak in c4iw_dereg_mr() or a double free in c4iw_get_dma_mr().

In the Linux kernel, the RDMA/mlx5 module has a stack out-of-bounds read in the cc_params debugfs. The get_param() function formats a u32 value as a signed number into an 11-byte buffer, causing a one-byte read past the buffer for values like 0x80000000.

In the Linux kernel, the RDMA/cxgb4 module leaks a STAG index when a TPT entry write fails. The write_tpt_entry() function allocates a STAG index but on write_adapter_mem() failure does not release it or reverse the statistics, leading to a leak until device teardown.

In the Linux kernel, cros_ec_debugfs_probe() registers notifier_panic with the EC panic notifier chain, but the remove path does not unregister it. A later panic notification can call back into the removed instance and queue work that accesses released data.

In the Linux kernel's md (RAID) subsystem, a race condition exists between the raid10d thread and normal I/O operations. Spare device configuration changes can occur without suspending the array, leading to a NULL pointer dereference and kernel crash.

In the Linux kernel, qcom_scm_probe() calls devm_request_threaded_irq() before smp_store_release(&__scm, scm). Two paths can dereference __scm before it is published, both causing a NULL pointer dereference.

In the Linux kernel, a failed integrity mapping holds a dio reference, causing a leak. The full bio ending must be performed in case there were previously submitted bios in the sequence.

In the Linux kernel, the USB notifier and initial VBUS detection can schedule isp->work in the isp1704_charger driver. The remove path unregisters the notifier and power supply but does not wait for queued or running work before tearing down the power supply state.

In the Linux kernel, the sc2731_charger power supply driver does not cancel scheduled work on device removal. The USB notifier and initial charger detection can schedule info->work, but the remove path unregisters the notifier without cancelling queued or running work before the devm-allocated driver data is released. The issue was found by a static analysis tool.

In the Linux kernel, bpf_netns_link_update_prog performs checks for old_prog and prog type locklessly before acquiring netns_bpf_mutex. This creates a race condition that can lead to a use-after-free (UAF) when two threads concurrently execute BPF_LINK_UPDATE on the same netns link. The fix moves the checks inside the netns_bpf_mutex critical section.

In the Linux kernel, lib/test_hmm's dmirror_fault() returns 0 when mmget_not_zero() fails, even though no page was faulted and no device page table entry was installed. This causes the caller to retry the same address, hit -ENOENT again, and loop forever. The fix returns -EFAULT instead.

In the Linux kernel, md/bitmap's backlog_store() suspends the array before checking whether a write-mostly device exists. If no such device exists, the error path only unlocks reconfig_mutex and leaves the array suspended, blocking subsequent I/O. The fix uses mddev_unlock_and_resume().

In the Linux kernel, the md subsystem stores a memalloc_noio_save() token in mddev->noio_flags, allowing one task to save the token and another to restore it. With concurrent suspend sysfs writes, task A can enter PF_MEMALLOC_NOIO and return to userspace still in that scope, and task B can later restore A's saved token. The fix scopes PF_MEMALLOC_NOIO to allocation critical sections only.

In the Linux kernel, the i3c dw driver on an empty bus has ENTDAA assign nothing, so cmd->rx_len equals master->maxdevs. The GENMASK() index master->maxdevs - cmd->rx_len - 1 becomes -1, causing a shift-out-of-bounds and tripping UBSAN. This occurs on every boot on a Gigabyte/AMD server.

In the Linux kernel, md/raid1 skips creating rdev->serial when a new rdev is added to an existing RAID1 array with serialize_policy enabled, due to a condition in mddev_create_serial_pool(). wait_for_serialization() assumes rdev->serial is initialized, leading to an Oops on access to the uninitialized structure. The fix creates the serial pool when adding the rdev.

In the Linux kernel, the iomap mechanism fails to release the folio batch during zero-range operations when errors occur in the iomap_begin and iomap_end callbacks. The fix ensures cleanup is invoked on error paths and updates the helper's behavior.

In the Linux kernel, the mt76x02 driver removes a WARN_ON_ONCE for rx descriptors with invalid lengths. In monitor mode with fcsfail filter, corrupted frames could trigger a kernel panic if panic_on_warn is set.

In the SDIO TX path of the mt76 driver, a memory leak occurs. When tx_prepare_skb() returns an error, the skb buffer is not freed, potentially leading to memory exhaustion. This happens when zero-length frames (e.g., WNM NULL frames) are dropped to prevent hardware hangs.

In the RX data handling of RRO 3.0 in the mt76 driver, there is incorrect queuing. Frames released from the RRO data queue should be placed in the indicator queue, but they are put into the data queue, causing delays and reordering of received packets.

There is an issue with the MLD ID in TXD and HIF TXP in the mt7996 driver. When the MLD_ID field is neither the primary nor the secondary link ID, it can lead to a firmware busy loop when the third link is in power saving mode. The fix remaps frames to the primary link wcid.

There is an error in non-AQL packet accounting for MLO stations in the mt76 driver. The function overrides the wcid passed by the driver, causing the counter to be updated on the wrong wcid. Once the limit is exceeded, the scheduler may permanently refuse to service the station.

In the mt7996 driver, there is a missing validation of the band_idx field in the RX descriptor. The field (2 bits) can be invalid and cause out-of-bounds access to the phys[] array or a NULL dereference, potentially leading to crashes.