Linux kernel vulnerabilities

In the Linux kernel, in the NTFS3 filesystem, errors returned by attr_set_size() when truncating files are silently ignored, which can leave the inode in an inconsistent state.

In the Linux kernel, the ASoC SOF driver for IPC4 topology has a memory allocation bug for bytes controls. The allocation did not account for the control structure size, leading to insufficient memory.

A race condition in the Linux kernel's rpmsg subsystem in driver_override_show() was found. It reads the driver_override string without holding the device_lock, while the store function frees it under that lock, leading to a use-after-free.

In the Linux kernel Bluetooth stack (hci_sync), there is a data race on the hdev->req_status field. Multiple functions read/write this field without proper locking, potentially causing errors.

In the Linux kernel, in the SMB/CIFS client filesystem, an out-of-bounds read exists in the cifs_sanitize_prepath function. When called with an empty string or a string containing only delimiters, it attempts to check *(cursor2 - 1) before cursor2 advances, leading to an out-of-bounds read.

A vulnerability has been identified in the Linux kernel within PF_KEY export paths, where the last 4 bytes of the sockaddr_in6 structure remain uninitialized. This issue affects only certain PF_KEY messages that are not properly zeroed before being filled.

A vulnerability in the Linux kernel related to not releasing the workqueue when freeing an object for a DSA/IAA device has been fixed.

Memory corruption occurs when copying data from a freed source during a performance counter deselect operation. The flaw arises when data is copied from a memory area that has already been freed, potentially leading to unpredictable system behavior.

A vulnerability in the Linux kernel's GSO fallback for tunneled traffic with IPV6_CSUM flag was found. Incorrect network header length checking caused tunneled packets with IPv6 extension headers to not fall back to software checksumming, potentially leading to processing errors.

In the Linux kernel, when processing user options in IPv6 Router Advertisement (RA) messages, the nduseroptmsg structure sent in RTM_NEWNDUSEROPT netlink message does not zero its padding fields, potentially leaking kernel memory. The fix initializes these padding fields to zero.

A vulnerability in the Linux kernel leaks kernel heap memory to userspace via the tc_chain_fill_node() function, which fails to initialize the tcm_info field of the tcmsg structure before sending netlink messages, exposing 4 bytes of uninitialized memory.

In the Linux kernel, the crypto authencesn module has a vulnerability where high-order sequence bits (hiseq) are unnecessarily placed at the end of the destination buffer during out-of-place decryption (src != dst), causing incorrect hashing data arrangement.

In the Linux kernel, a vulnerability was found in the regsafe() function related to pointers to packets. The bug may cause a state with a valid packet range not to be explored, leading to potential security issues.

In the Linux kernel, the netfilter x_tables module lacks validation that names are nul-terminated. This flaw can cause invalid data to be passed to functions expecting C strings, potentially leading to errors or security breaches.

In the Linux kernel netfilter subsystem, a use-after-free vulnerability was found in nf_conntrack_helper_unregister(). When destroying expectations for a helper being unregistered, a NULL pointer was passed instead of the helper pointer, so expectations were not removed and the freed helper structure was still referenced.

In the Linux kernel, a vulnerability in netfilter ctnetlink causes uninitialized saved_addr and saved_proto fields in expectation structures when CTA_EXPECT_NAT is missing, leaking stale data from previous slab allocations to userspace.

A vulnerability in the Linux kernel netfilter ctnetlink module fails to validate the helper for new expectations, allowing an attacker to supply an arbitrary helper from userspace, leading to a slab-out-of-bounds read and potential kernel memory leak.

A vulnerability was found in the Linux kernel's netfilter nf_tables subsystem, allowing an immediate NF_QUEUE verdict. This verdict is not used by userspace nftables tools, and the ARP family lacks queue support, potentially leading to unexpected behavior.

A vulnerability has been identified and resolved in the Linux kernel. It concerns a potential use-after-free (UAF) in the set_cig_params_sync function related to Bluetooth connections.

A vulnerability in the Linux kernel's BPF subsystem allowed attaching sleepable kprobe.multi programs to atomic/RCU contexts. The bpf_kprobe_multi_link_attach() function lacked validation of the sleepable flag, enabling sleepable helpers like bpf_copy_from_user() to be called from non-sleepable context, causing a kernel splat.

In the Linux kernel, the ti-adc161s626 ADC driver used stack memory for spi_read(), which is not DMA-safe. A dedicated DMA-safe buffer has been added, and conversion functions updated accordingly.

In the Linux kernel, the MPU3050 gyroscope IIO driver called iio_device_register() before completing device initialization, potentially causing race conditions. The fix moves registration to the end of the probe function and adjusts unregistration accordingly.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the USB cdns3 gadget driver's ep_queue function. When the endpoint is disabled or not configured, the ep->desc pointer can be NULL, causing a kernel crash when __cdns3_gadget_ep_queue() is called.

A vulnerability was found in the Linux kernel's bridge br_nd_send() function, which processes Neighbor Discovery (ND) options. Lack of option length validation may allow out-of-bounds read or use of a too-short source LLADDR option.

In the Linux kernel, the ftgmac100 driver had a memory leak vulnerability during ring allocation on network interface open failure. The ftgmac100_alloc_rings() function did not free previously allocated resources (rx_skbs, tx_skbs, rxdes, txdes, rx_scratch) on error, causing memory leaks.

In the Linux kernel, a resource leak was found in gpiochip_add_data_with_key() on error paths. After commit aab5c6f20023, `gdev->dev.release` is unset, so the reference count to `gdev->dev` is not dropped on errors. The fix drops the reference and reorders code to prevent double-free.

A vulnerability has been identified in the Linux kernel that leads to a NULL pointer dereference in the eth_get_drvinfo function. The issue occurs when a userspace tool queries the interface while the device is detached.

A vulnerability has been identified in the Linux kernel within the smb_check_perm_dacl() function, allowing for out-of-bounds (OOB) reads due to improper ACE size validation. An attacker can exploit this flaw to access memory, potentially leading to kernel state corruption.

A vulnerability has been identified in the Linux kernel that leads to a leak of the active connection count on transport allocation failure in the ksmbd_tcp_new_connection() function. This issue can be exploited by an unauthenticated remote attacker to induce memory pressure, resulting in the rejection of all subsequent connection attempts.

In the Linux kernel, a vulnerability was found in the CIFS implementation where build_sec_desc() and id_mode_to_cifs_acl() improperly validate the DACL structure from the server. A malicious server can supply a truncated DACL with a fake ACE count, causing an out-of-bounds read during security descriptor rewrite.

A vulnerability has been identified in the Linux kernel that allows for out-of-bounds read in the smb2_ioctl_query_info function. The issue arises when a server returns a buffer length greater than the actual QUERY_INFO response, potentially exposing kernel memory to userspace.

In the Linux kernel, a use-after-free vulnerability exists in inode_switch_wbs_work_fn() in the writeback mechanism. The processing loop can cause a wb object to be freed while a pending work item still exists, leading to use-after-free.

A vulnerability has been identified in the Linux kernel in the tpacket_snd() function, allowing for a TOCTOU race condition using mmap'd vnet_hdr. As a result, a user-space thread can modify vnet_hdr fields between validation and use, bypassing all safety checks.

In the Linux kernel FUSE filesystem, a vulnerability exists due to missing validation of directory entry (dirent) size before copying into the page cache. A malicious FUSE server can send a dirent exceeding PAGE_SIZE, causing a buffer overflow during memcpy() that overwrites adjacent kernel pages.

A race condition vulnerability in the kernel could allow an attacker to trigger a kernel heap overflow, potentially leading to local privilege escalation and system-level access.

In the Linux kernel, a vulnerability was found in the IPv6 flowlabel mechanism. The `ip6fl_seq_show()` function reads from the global flowlabel hash under RCU protection, but exclusive flowlabels freed `fl->opt` immediately when `fl->users` dropped to zero, while the `ip6_flowlabel` structure remained visible in the hash table. This race condition allowed a concurrent read of `/proc/net/ip6_flowlabel` to access freed memory, causing a system crash.

In the Linux kernel, a vulnerability was found in the netfilter ip6t_rt module where the lack of validation of the addrnr field in rt match rules can lead to an out-of-bounds read of the rtinfo->addrs[] array. An attacker could install a malicious rule that, during IPv6 packet processing, accesses memory beyond the allowed range.

An information leak was discovered in the build_report() function in the xfrm_user subsystem of the Linux kernel. The xfrm_user_report structure contains unzeroed padding bytes that are copied to userspace, potentially exposing kernel memory.

A vulnerability in the Linux kernel's rfkill mechanism allows userspace to create an unlimited number of rfkill events without consuming them from the file descriptor, potentially leading to an out-of-memory condition.

A use-after-free vulnerability was found in the Linux kernel's netfilter module during timeout object destruction. The nft_ct_timeout_obj_destroy() function frees the object memory without waiting for an RCU grace period, allowing concurrent access to freed memory by other CPU cores.

In the Linux kernel, a vulnerability in the build_polexpire() function of the xfrm subsystem fails to clear trailing padding bytes after the 'hard' field in the xfrm_user_polexpire structure, leaking uninitialized heap memory to userspace via netlink multicast.

In the Linux kernel, a vulnerability was found in the xfrm subsystem where, after async crypto completion, xfrm_input_resume() immediately released the device reference (dev_put()) before the skb reached transport_finish and NF_HOOK. This caused a race condition with device teardown, as skb->dev was used after the reference was dropped.

In the Linux kernel, the altera-tse driver had a memory leak. The tse_start_xmit() function did not free the skb buffer after a DMA mapping failure, causing memory leak on every DMA error.

In the Linux kernel, a NULL-pointer dereference vulnerability was found in the vub300 driver for MMC/SD cards over USB during device disconnect. The issue occurs because the controller is not deregistered before dropping the driver data reference, potentially causing a crash.

In the Linux kernel's RxRPC subsystem, a heap buffer overflow vulnerability was found in RxGK token loading. The function rxrpc_preparse_xdr_yfs_rxgk() incorrectly rounds key and ticket lengths, causing values >= 0xfffffffd to wrap to zero and bypass validation, allowing ~4 GB of data to be copied into a small buffer. The flaw can be triggered by an unprivileged user via the add_key() syscall.

A reference count leak was discovered in the Linux kernel's rxrpc_server_keyring() function. The issue occurs when the rx->securities field is already set, leading to improper memory management.

In the Linux kernel, a vulnerability was found in AMD Zen1 processors where the hardware divider can leave partial results from previous operations, which can be leaked by an attacker thread. The fix applies a chicken bit to mitigate the issue.

In the Linux kernel, the USB f_ncm gadget driver (CDC NCM network function) lacks validation of the minimum block_len in ncm_unwrap_ntb(). When block_len is smaller than the NDP size, arithmetic underflow occurs, bypassing bounds checks and allowing a malicious USB host to copy adjacent kernel memory into the network skb.

In the Linux kernel, a vulnerability was found in ksmbd (kernel SMB server implementation) involving a mechToken memory leak when SPNEGO decode fails after token allocation. The ASN.1 BER decoder calls action callbacks as it processes data. When ksmbd_decode_negTokenInit() reaches the mechToken element, it allocates memory for conn->mechToken. If a later element in the blob is malformed, the decoder returns an error but the memory remains allocated. The decode_negotiation_token() function sets conn->use_spnego = false, and cleanup in smb2_sess_setup() is gated on use_spnego, so the memory is not freed. Untrusted clients can cause slow memory leaks on the server.

A deadlock vulnerability was found in the Linux kernel's RDMA/irdma driver during netdev reset with active RDMA connections. The netdev reset triggers removal of the irdma auxiliary driver, causing a circular dependency where uverbs_client waits for QP reference count to reach zero while cma_client holds the final reference, leading to an indefinite wait in iWARP mode.