Linux kernel vulnerabilities

A vulnerability related to TX queue manipulation in the kaweth_set_rx_mode() function has been resolved in the Linux kernel. This function incorrectly invokes TX queue flow control operations that are unrelated to RX.

A vulnerability has been identified in the Linux kernel that has been resolved. The issue concerns the xen_9pfs_front_free function, which can be called concurrently by the xenwatch thread, leading to a general protection fault due to double invocation.

A vulnerability has been identified and resolved in the Linux kernel. The issue concerns the fbcon_open() function, which, if it fails, does not set the info->fbcon_par pointer, leading to later dereferencing of a NULL pointer.

A vulnerability in the Linux kernel has been resolved that allowed two query interface operations to concurrently update interfaces. A locking mechanism has been introduced to prevent these races.

A vulnerability has been identified in the Linux kernel related to the failure to free memory in case of an error. Specifically, the screen buffer fbi->fb.screen_buffer is allocated using dma_alloc_coherent() but is not freed if an error occurs.

A vulnerability in the Linux kernel related to RDS connections lacking a proper shortcut in case of connection errors has been resolved.

In the Linux kernel, a vulnerability related to use-after-free bugs has been fixed, which occurs during the detachment of the FarSync T-series card. These issues may arise in the fst_remove_one() function, where fst_card_info is deallocated, but fst_tx_task or fst_int_task may still be active.

A vulnerability has been identified in the Linux kernel related to the registration of the omap_mpuio_driver in the omap_gpio_probe() function. This issue has been resolved in commit 11a78b794496.

In the Linux kernel, a vulnerability in the mshv_vtl component occurs when registering VTL0 memory via MSHV_ADD_VTL0_MEMORY, where the computed vmemmap_shift may exceed MAX_FOLIO_ORDER, leading to incorrect behavior.

A vulnerability has been identified in the Linux kernel related to resource leaks during early registration failures. A recent commit fixed most cases, but for some reason, it left out the first error path, which still leaks resources.

A vulnerability related to error handling after finding a match in an async connection has been fixed in the Linux kernel. Once a match with an fwnode is found, a sub-device may be registered, and its bound operation is called.

In the Linux kernel, a vulnerability was found in the SMB client related to directory separator handling in SMB1 UNIX mounts. The issue occurs when @cifs_sb->mnt_cifs_flags is read or updated before calling reset_cifs_unix_caps(), potentially causing incorrect behavior.

A vulnerability has been identified in the Linux kernel in the ceph_zero_partial_object function, which was missing proper snapshot context for OSD write operations. This could lead to data inconsistencies in snapshots.

A vulnerability was found in the Linux kernel's KVM for AMD SEV. It fails to reject attempts to synchronize vCPU state with an already encrypted VMSA after the VM has been launched.

In the Linux kernel, a double accounting race was fixed in Btrfs when btrfs_run_delalloc_range() fails. The issue occurs when block size is smaller than page size and can lead to kernel crash.

In the Linux kernel, a fake timeout has been removed to avoid request leaks. This change requires drivers to be responsible for calling blk_should_fake_timeout() at appropriate code paths.

A vulnerability has been identified in the Linux kernel that has been resolved. In the tw9906_probe() function, there was a potential memory leak because memory allocated in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() was not freed.

A vulnerability has been identified in the Linux kernel related to a regmap leak on probe failure. The allocated mmio regmap is never freed, which can lead to memory issues.

A vulnerability in the Linux kernel related to out-of-bounds access in the vfe_isr_reg_update() function has been resolved. The issue occurs during iteration in the vfe_isr() function, where an incorrect loop bound is used, potentially leading to unauthorized memory access.

In the Linux kernel, an overflow in the ring-buffer's __rb_map_vma function was fixed, which occurred when calculating the number of pages (nr_pages). A check was added before the calculation to avoid the issue.

A vulnerability related to double dma_buf_unpin in failure path has been fixed in the Linux kernel. In the function ib_umem_dmabuf_get_pinned_with_dma_device(), a failure may occur during the call to ib_umem_dmabuf_map_pages(), leading to improper memory management.

A vulnerability in the Linux kernel related to GSO frame transmission errors has been resolved. The udpgro_frglist.sh and udpgro_bench.sh tests are the most unstable tests in NIPA, leading to their failures.

A vulnerability in the Linux kernel related to validating rounded allocations in DRM_BUDDY_CONTIGUOUS_ALLOCATION has been resolved. The issue involved the requested size being rounded up to the next power of two, which could lead to errors.

A vulnerability has been identified in the Linux kernel related to improper resource release in the most_register_interface() function. In cases of early failure before device registration, resources were not correctly released.

In the Linux kernel, a vulnerability was found in the F2FS filesystem involving uninitialized value access in the f2fs_sanity_check_node_footer function. The issue was reported by syzbot and may lead to unpredictable system behavior.

A vulnerability has been identified and resolved in the Linux kernel. It concerns the HID Magic Mouse, which can cause system crashes when the input pointer is missing.

A vulnerability has been identified in the Linux kernel that has been resolved. In the error path, the function cx88_alsa_dma_unmap() has been added to release resources acquired by cx88_alsa_dma_map().

In the Linux kernel's fork function, a race condition exists between fork and hugetlbfs file operations. The fix defers linking the file VMA until the VMA is fully initialized.

In the Linux kernel, in the Bluetooth subsystem (hci_conn), the function disable_delayed_work_sync is used instead of cancel_delayed_work_sync, which not only cancels ongoing work but also disables new submissions, which is desirable.

A vulnerability has been identified in the Linux kernel that leads to a memory leak when the cfg80211_inform_bss_frame() function fails. If this function returns NULL, the allocated buffer 'buf' is not freed, resulting in a memory leak.

A vulnerability in the Linux kernel related to the cpumask_of_node() function has been resolved. This function could not properly handle the NUMA_NO_NODE index, potentially leading to system errors.

A vulnerability has been identified in the Linux kernel related to the asynchronous creation of sub-groups in the PCI context. This could lead to a NULL pointer dereference if the driver directory is removed before the work completes.

In the Linux kernel, a vulnerability related to a reference leak in mtk_mdp_remove() has been fixed. The issue was resolved by adding platform_device_put() to prevent the reference leak.

In the Linux kernel, the bnge driver has a vulnerability where a return statement is missing after auxiliary_device_uninit() in the error path. After auxiliary_device_add() fails, execution continues, potentially leading to use-after-free.

A vulnerability in the Linux kernel has been fixed that caused sporadic user-space crashes and heap corruption on Alpha systems during memory compaction.

A vulnerability in the Linux kernel related to swapped parameters in the pci_{primary/secondary}_epc_epf_unlink() functions has been resolved.

A vulnerability in the Linux kernel related to double free in the pruss_clk_mux_setup() function has been resolved. The issue occurred during the call to devm_add_action_or_reset(), which triggered pruss_of_free_clk_provider() on error.

In the Linux kernel's F2FS filesystem, there is potential corruption when moving a directory, similar to an issue in ext4. The fix addresses this problem.

A vulnerability has been identified in the Linux kernel related to use-after-free in tasklets during device removal. The issue occurs when the PCA-200E or SBA-200E adapter is being detached, potentially leading to unexpected system behavior.

In the Linux kernel's IPVS, there is an issue with propagating the one-packet flag to synced connections, which can lead to stale hash entries and use-after-free.

In the Linux kernel, the mtk_eth_soc network driver had a bug where the wrong pointer (net_device instead of mtk_eth) was passed to mtk_handle_irq_rx in mtk_poll_controller. This could cause a system crash when using CONFIG_NET_POLL_CONTROLLER.

In the Linux kernel, the idpf driver had a bug where idpf_get_reg_intr_vecs() fills the reg_vals[] array without bounding it to the actual number of allocated vectors. A reply from the controller (PF or hypervisor) with a sum of vectors exceeding the allocated count leads to an out-of-bounds write.

In the Linux kernel's KVM subsystem for s390, airq_iv_create() can return NULL, but its return value is not checked. On failure, zdev->aibv will be NULL, leading to a NULL dereference in kvm_zpci_set_airq(). The fix adds a NULL check and frees previously allocated resources.

In the Linux kernel's vxlan subsystem, after calling route_shortcircuit(), the Ethernet header pointer may point to freed memory because the function can reallocate the skb buffer. This leads to a use-after-free when reading the destination address.

A vulnerability was found in the Linux kernel's NTFS filesystem. Attribute lists for base inodes were not properly validated when resident, allowing out-of-bounds reads of the buffer. A validation function was added to check each entry's header and length before use.

In the Linux kernel's NTFS filesystem, ntfs_external_attr_find() improperly bounds-checks the next attribute-list entry, potentially leading to a slab out-of-bounds read with a crafted disk. The fix adds validation of the entry before dereferencing.

In the perf sched tool in the Linux kernel, register_pid() has several issues when processing untrusted perf.data: integer overflow, heap buffer overflow via strcpy, BUG_ON on allocation failure, and memory leak on realloc. The fix caps pid, uses strlcpy, adds NULL checks, and uses safe realloc patterns.

In the perf tool in the Linux kernel, machine__resolve() does not validate the CPU index from untrusted perf.data before accessing env->cpu array, potentially leading to an out-of-bounds heap read. The fix uses perf_env__get_cpu_topology() and adds bounds checking.

In the Linux kernel's netfilter subsystem (nf_conntrack_expect), the timer API for expectations has been replaced with a GC worker approach. This change addresses a race condition where an expectation could access a stale exp->master pointer after it was freed, and introduces the NF_CT_EXPECT_DEAD flag for safe reaping.

In the Linux kernel, the netfilter flowtable module has an underflow of num_encaps when untagging VLAN on a bridge, which can lead to an out-of-bounds stack read. This only happens with a malformed bridge path stack.