Linux kernel vulnerabilities

In the Linux kernel, a vulnerability was found in the MACB (Cadence MACB/GEM) driver where napi_consume_skb() was called in an IRQ-disabled context, causing a warning and potential synchronization issues. The fix replaces it with dev_consume_skb_any().

In the Linux kernel, a bug in futex_lock_pi() was found where the local pointer to an exiting thread was not cleared on retry. This caused a WARN_ON_ONCE() when a stale pointer was passed to wait_for_owner_exiting().

In the Linux kernel bonding driver, a NULL pointer dereference vulnerability was found in bond_debug_rlb_hash_show. The function iterates over RLB hash table entries without checking if the slave field is NULL, potentially causing a system crash.

A vulnerability in the Linux kernel's module loader lacks bounds checking for the ELF section index in simplify_symbols(). An out-of-bounds st_shndx value (e.g., 0xffff) can cause a kernel panic due to invalid memory access.

A vulnerability was found in the Linux kernel's ESP over TCP (espintcp) implementation with async crypto. When the transmit queue is full, esp_output_tail_tcp returns an error but does not free the skb buffer, causing a memory leak. With synchronous crypto, the issue does not occur because the xfrm code drops the packet automatically.

In the Linux kernel, the af_key module's pfkey_send_migrate() function fails to validate address families (old/new), causing a skb buffer overflow (skb_over_panic) and system crash. The issue was reported by syzbot.

In the Linux kernel's openvswitch module, a vulnerability allows releasing a network device before its unregistration completes. The issue occurs when ovs_netdev_detach_dev() clears the IFF_OVS_DATAPATH flag and gets preempted (e.g., on PREEMPT_RT kernels), enabling netdev_destroy() to finish and free the device prematurely.

In the Linux kernel's SMC (Shared Memory Communications) module, a double-free vulnerability was found in smc_spd_priv structure when duplicating a pipe buffer via tee(). The .get callback for pipe buffers did not handle the smc_spd_priv pointer, causing both original and cloned buffers to share the same object. When both pipes were released, kfree() was called twice on the same object, leading to use-after-free (UAF) and kernel panic.

A vulnerability was found in the Linux kernel's fanout mechanism for packet sockets. The `packet_release()` function does not zero `po->num` within the `bind_lock` section, allowing a concurrent `NETDEV_UP` event to re-register the closing socket into the fanout group's `arr[]` array. This leaves a dangling pointer in the array, leading to a Use-After-Free condition.

A vulnerability in the Linux kernel's UDP implementation causes wildcard bind conflict checks to be skipped when the hash bucket count exceeds 10. The issue occurs because the code switches to the hash2 table (keyed by address and port) instead of the hash table (keyed by port only), allowing a wildcard bind to succeed despite existing specific-address binds on the same port.

In the Linux kernel, a type confusion vulnerability in team_setup_by_port() for non-Ethernet ports. Copying header_ops pointers from a lower port can lead to incorrect interpretation of the net_device private structure, causing a crash.

In the Linux kernel, a vulnerability in the netfilter module allowed displaying connection expectations from other network namespaces via the /proc interface. The fix adds filtering to skip expectations not belonging to the current netns.

In the Linux kernel netfilter subsystem, a vulnerability in ctnetlink allowed accepting invalid values for TCP protocol attributes, potentially causing undefined behavior when used as shift counts. The fix replaces manual range and mask validations with netlink policy annotations, rejecting invalid values early.

In the Linux kernel's macb network driver, a vulnerability was found causing an out-of-bounds (OOB) write when retrieving statistics via ethtool. The issue arises from a mismatch between the number of active queues and the maximum number of queues used when copying statistics data.

A vulnerability has been identified in the Linux kernel related to double reference release in the SPI controller removal function. The issue occurs in meson_spicc_remove(), where calling spi_controller_put() again leads to a double-put error.

In the Linux kernel, the amdgpu driver has a memory leak and use-after-free vulnerability during DSC validation in atomic mode. The issue occurs when a DSC configuration change is processed together with an unrelated mode change, causing incorrect reset of the mode_changed flag.

In the Linux kernel's SPI driver for Freescale LPSPI (spi-fsl-lpspi), a teardown order issue causes a use-after-free (UAF). The SPI controller was registered using devm_spi_register_controller(), delaying its unregistration, while fsl_lpspi_remove() immediately tore down DMA channels, leading to a NULL pointer dereference during active SPI transfers.

In the Linux kernel's CAN ISO-TP subsystem, a use-after-free vulnerability was found in isotp_sendmsg(). Improper synchronization of so->tx.buf access allows the buffer to be freed during socket close while another thread is still using it.

A use-after-free (UAF) vulnerability in the dst_ops structure was found in the Linux kernel's virtio_net driver. It occurs when IFF_XMIT_DST_RELEASE is cleared and napi_tx is disabled, leading to freed memory access during transmit buffer cleanup.

In the Linux kernel, a vulnerability was found in softleaf_to_folio() in mm/huge_memory.c. Missing memory barrier (smp_rmb) causes a race condition between folio splitting and zap_nonpresent_ptes(), leading to VM_WARN_ON_ONCE or BUG_ON.

A vulnerability has been identified in the Linux kernel that occurs during the splitting of a PUD entry in the walk_pud_range() function. It may lead to a kernel bug when a thread attempts to read the numa_maps of a process while VFIO-PCI is setting up DMA.

A vulnerability in the Linux kernel's ext4 filesystem occurs when truncate() grows a file beyond inline data capacity without converting to extent-based storage. This leaves the inline flag set while the file size exceeds inline capacity, causing a BUG_ON() on subsequent write attempts.

In the Linux kernel, the ext4 filesystem replaces BUG_ON() with proper error handling in ext4_read_inline_folio. When inline data size exceeds PAGE_SIZE, instead of kernel panic, an error is logged, buffer head is released, and -EFSCORRUPTED is returned.

In the Linux kernel ext4 filesystem, a vulnerability was found where the jinode pointer is published before full initialization. This can lead to dereferencing an uninitialized i_vfs_inode field, causing a kernel panic during fast commit operations.

A vulnerability has been identified in the Linux kernel in the ext4_ext_correct_indexes function, which does not validate the p_idx pointer before accessing indices. This can lead to out-of-bounds reads if the on-disk extent header is corrupted.

In the Linux kernel, a vulnerability was found in the ext4 filesystem that causes rejection of mounting partitions with bigalloc enabled when s_first_data_block is non-zero. This configuration is unsupported and may lead to filesystem instability.

In the Linux kernel, a use-after-free vulnerability was found in the ext4 filesystem's update_super_work function when racing with unmount. The issue occurs after moving ext4_unregister_sysfs() before flushing s_sb_upd_work, causing sysfs_notify() to access a freed kernfs_node.

A memory leak vulnerability was found in the Linux kernel's idxd driver during workqueue reset. The issue occurs because the workqueue type is set to NONE before its resources are released.

In the Linux kernel's netfilter nfnetlink_log, an uninitialized heap memory leak was found in the NFULA_PAYLOAD attribute. The __build_packet_message() function manually constructs the attribute, copying only payload data without zeroing the padding bytes, leaking kernel heap contents to userspace.

In the Linux kernel, the netfilter nf_conntrack_sip module has a vulnerability due to the use of an uninitialized rtp_addr variable in the process_sdp function. When the SDP body lacks active media descriptions, the variable remains uninitialized, causing SIP session addresses to be overwritten with arbitrary stack data.

In the Linux kernel, a vulnerability in the netfilter x_tables subsystem allows xt_match and xt_target extensions registered with NFPROTO_UNSPEC to be loaded by the ARP protocol family. Due to mismatched hook masks (NF_INET_* vs NF_ARP), validation passes incorrectly, leading to NULL pointer dereference and kernel panic.

In the Linux kernel, the HFSC network scheduler (sch_hfsc) is vulnerable to a divide-by-zero in rtsc_min(). The issue occurs when the difference of two 64-bit scaled values exceeds 2^32 and is stored in a 32-bit variable, truncating it to zero and causing a division error.

A vulnerability was found in the Linux kernel's flow classifier (cls_flow) for shared QoS blocks. The flow_change() function calls tcf_block_q() and dereferences q->handle, which is NULL for shared blocks, causing a NULL pointer dereference and system crash.

In the Linux kernel, a NULL pointer dereference was found in the cls_fw classifier when using filters on shared blocks. The issue occurs when an empty cls_fw filter is attached to a shared block and a packet with a nonzero skb mark is classified, causing a system crash.

A use-after-free vulnerability was found in the Linux kernel's bond_xmit_broadcast() function in the bonding driver. During RCU-protected slave list iteration, concurrent slave add/remove can change which slave is last, causing double-free of the original skb. The fix replaces the bond_is_last_slave() call with a stable index comparison.

In the Linux kernel, in the netfilter: ipset subsystem, a vulnerability was found in the mtype_del function that incorrectly handles logically empty buckets. The function failed to release a bucket when all entries were removed but the n->pos pointer still pointed past deleted slots.

A vulnerability in the Linux kernel's X.25 protocol allows overflow of the `fraglen` counter when accumulating packets. Missing checks can lead to unpredictable system behavior.

In the Linux kernel, in the netfilter subsystem (nfnetlink_log), a bug was found in the size calculation of NLMSG_DONE messages. The netlink header size is not accounted for, which can trigger a WARN splat and drop the message.

A vulnerability in the Linux kernel's ip6_datagram_send_ctl() function for IPv6 allows a 16-bit opt_flen accumulator to overflow when multiple IPV6_DSTOPTS control messages are sent. This causes header size underestimation and triggers a kernel panic via skb_under_panic(), leading to a local DoS.

A vulnerability in the Linux kernel's ATM driver (sigd_send path) allows an unvalidated vcc pointer from userspace to be dereferenced, causing a crash. A malicious process can forge the pointer via sendmsg(), leading to memory corruption.

Fix in the Linux kernel for ksmbd: uses volume UUID in FS_OBJECT_ID_INFORMATION. For filesystems without UUID, falls back to stfs.f_fsid from vfs_statfs().

In the Linux kernel, the ksmbd module has a vulnerability where the conn->binding flag is not cleared after a failed multichannel session binding request. This leaves the connection in a binding state, causing all subsequent ksmbd_session_lookup_all() calls to fall back to the global sessions table, potentially leading to authorization errors.

In the Linux kernel, the Bluetooth SCO subsystem has a use-after-free vulnerability in sco_recv_frame(). The function reads conn->sk under sco_conn_lock() but releases the lock without holding a socket reference, allowing a concurrent close() to free the socket before accessing sk->sk_state.

In the Linux kernel, missing netlink attribute validation in netfilter conntrack for SCTP and ctnetlink. An attacker can cause an out-of-bounds read (slab-out-of-bounds) by supplying an invalid SCTP state or direction value.

In the Linux kernel, a vulnerability exists in xfrm_nat_keepalive_net_fini() where after canceling delayed work, xfrm_state_fini() can reschedule nat_keepalive_work. This leads to a race condition where the work may execute on already freed network structure, potentially causing use-after-free.

In NFSD (Linux kernel), a missing reference to the network namespace (struct net) when opening /proc/fs/nfs/exports. After the namespace is torn down (e.g., container removal), reading from the open file descriptor leads to use-after-free in the export cache.

A buffer overflow vulnerability in the hid_hw_request function in the Linux kernel's HID BPF. The return value can be arbitrarily large because it comes from dispatch_hid_bpf_raw_requests(), which calls struct_ops without guarantees. This could lead to a buffer overflow.

In the Linux kernel, a memory leak has been found in the cache_release function in the sunrpc subsystem. When a reader's file descriptor is closed while reading a cache_request (rp->offset != 0), cache_release() decrements the readers count but never checks whether it should free the request. This can lead to a memory leak if CACHE_PENDING is clear and readers drop to zero.

In the Linux kernel's nvdimm/bus subsystem, there is a potential use-after-free vulnerability during asynchronous initialization. If device_add() fails, accessing freed memory may occur.

In the Linux kernel, a vulnerability in move_pages_huge_pmd() handling UFFDIO_MOVE for THP and huge zero pages was found. For zero pages, src_folio is set to NULL, causing folio_mk_pmd(NULL) to create a PMD pointing to non-existent physical memory (SPARSEMEM_VMEMMAP) or a NULL dereference (other models). Additionally, PMD reconstruction in the zero branch drops pmd_special(), allowing vm_normal_page_pmd() to treat the moved zero page as normal and corrupt its refcount.