Linux kernel vulnerabilities

A use-after-free vulnerability was found in the Linux kernel's MACB (Cadence) driver. The PTP clock is registered on interface open and destroyed on close, but can be accessed via ethtool get_ts_info while the interface is present, leading to a read-after-free.

In the Linux kernel's bnxt_en driver, an out-of-bounds access vulnerability exists in the DBG_BUF_PRODUCER async event handler. The firmware-supplied 'type' field is used as an array index without bounds validation, potentially leading to out-of-bounds kernel memory access.

In the Linux kernel mac80211 subsystem, a crash occurs during channel switch (CSA) for stations on AP_VLAN interfaces (e.g., 4addr WDS clients). ieee80211_chan_bw_change() uses sta->sdata pointing to VLAN without channel reservation, causing a NULL pointer dereference.

In the Linux kernel, the Bluetooth L2CAP stack has an out-of-bounds read vulnerability in l2cap_information_rsp() due to insufficient payload length validation. This can lead to reading adjacent kernel memory.

In the Linux kernel's SMB client, a bug was fixed where the SMB session from the first mount was reused for subsequent mounts with different usernames when using Kerberos. Now the client correctly matches the username option in match_session() even for Kerberos.

In the Linux kernel, in the atmel-sha204a crypto driver, a ->tfm_count leak has been detected. If memory allocation fails, the counter is not decremented, which can block future reads.

In the Linux kernel drm/xe driver, a memory leak occurs in xe_vm_madvise_ioctl. When check_bo_args_are_sane() validation fails, previously allocated resources are not freed, causing a memory leak.

In the Linux kernel's SPI driver, a use-after-free vulnerability exists during controller registration. If per-CPU statistics allocation fails, deregistration from the driver core is not performed, leading to use-after-free and uncontrolled register accesses.

In the Linux kernel, in the SPI subsystem, per-CPU statistics are allocated only after the controller is registered with the driver core, leaving a window where accessing sysfs attributes can trigger a NULL-pointer dereference. The fix moves statistics allocation to controller allocation time.

In the Linux kernel, a bug in the RedBoot partition table parser causes a buffer overflow warning and oops when CONFIG_FORTIFY_SOURCE is enabled with a recent compiler. The issue is due to using memcmp() instead of strcmp() for string comparison.

In the Linux kernel, a vulnerability in the serial core driver causes an infinite loop in handle_tx() for PORT_UNKNOWN ports. The uart_write_room() function returns a value greater than zero while uart_write() returns 0 when the transmit buffer (xmit_buf) is uninitialized, leading to a system hang.

In the Imagination DRM driver in the Linux kernel, a deadlock occurs during soft reset because disable_irq() is called from the IRQ handler context, causing a self-wait.

In the Linux kernel, the DRM driver for Imagination GPUs lacks interrupt synchronization before GPU suspend. The runtime PM suspend callback does not check if the IRQ handler is running on another CPU core and does not wait for it to finish. This can cause kernel crashes when trying to access GPU registers after suspension.

In the Linux kernel, in the drm/amdgpu driver, a limit of 128k entries per BO list has been introduced to prevent resource exhaustion. Userspace could pass an arbitrary number of entries, leading to excessive memory allocation and long processing times.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the i915/DMC driver during initialization. The issue occurs when intel_dmc_update_dc6_allowed_count() is called before DMC initialization, potentially causing a system crash (oops).

In the Linux kernel DRM/XE driver, GGTT MMIO access protection relied on hotplug (drm_dev_enter), which failed on driver load failure. An open-coded flag protected by the GGTT lock was added to disable MMIO access during teardown.

In the Linux kernel, in the btrfs filesystem, a bug has been found in logging new dentries when logging the parent directory of a conflicting inode. If the parent directory is later fsynced without new changes, new dentries may be lost after a power failure.

In the Linux kernel, in the soc: microchip: mpfs driver, a memory leak has been detected in the mpfs_sys_controller_probe() function. If of_get_mtd_device_by_node() fails, the function returns without freeing the allocated memory for sys_controller, leading to a memory leak.

In the qbman driver for Freescale SoCs in the Linux kernel, a race condition in qman_destroy_fq can trigger a false WARN_ON when creating a queue with QMAN_FQ_FLAG_DYNAMIC_FQID set.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's Bluetooth HIDP subsystem. The issue is caused by not releasing the l2cap_conn reference when the user->remove callback is invoked, potentially leading to system crashes.

In the Linux kernel, the Bluetooth L2CAP subsystem has a use-after-free vulnerability in l2cap_unregister_user. Missing locking (conn->lock) between l2cap_conn_del() and registration functions causes a race condition leading to use-after-free and list corruption.

In the Linux kernel, in the ROSE protocol, there is a NULL pointer dereference in rose_transmit_link on reconnect. When rose_connect() is called a second time while the first connection is in progress (TCP_SYN_SENT), it overwrites rose->neighbour, and if rose_get_neigh() returns NULL, the socket is left with rose->neighbour == NULL. Closing the socket leads to a NULL pointer dereference. A check for TCP_SYN_SENT is missing.

In the Linux kernel, the iptunnel_xmit_stats() function has a vulnerability due to missing support for NETDEV_PCPU_STAT_DSTATS. It assumed tunnels only use NETDEV_PCPU_STAT_TSTATS, causing syncp offset differences between pcpu_sw_netstats and pcpu_dstats, leading to corruption or hangs on 32-bit kernels.

A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in the ctnetlink_dump_exp_ct() function. The conntrack pointer is stored in netlink callback data but its reference is dropped immediately after dump start, causing a use-after-free on subsequent recvmsg() calls.

In the Linux kernel, the netfilter nf_conntrack_sip module has a vulnerability where Content-Length is truncated from unsigned long to unsigned int in sip_help_tcp(). On 64-bit systems, values exceeding UINT_MAX are silently truncated, causing incorrect SIP message boundary calculation and potentially processing trailing data as a second SIP message.

An out-of-bounds read vulnerability exists in the Linux kernel's netfilter nf_conntrack_h323 module in the decode_int() function's CONS case. Missing boundary check allows reading 1-4 bytes beyond the allocated buffer via a crafted H.323/RAS packet.

In the Linux kernel's MANA driver, a use-after-free vulnerability exists in mana_hwc_destroy_channel(). The teardown order frees hwc->caller_ctx before destroying CQ and EQ queues, allowing interrupt handlers to access freed memory.

In the Linux kernel, in the TI ICSSG PRUETH network driver, there is a memory leak in the XDP_DROP path for non-zero-copy mode. Page recycling was removed from the XDP_DROP path in emac_run_xdp() to avoid conflicts with AF_XDP zero-copy mode, but this causes a memory leak when running XDP programs that drop packets in non-zero-copy mode (standard page pool mode). Pages are never returned to the page pool, leading to OOM conditions. The fix handles cleanup in the caller, emac_rx_packet(), which now recycles the page back to the page pool when emac_run_xdp() returns ICSSG_XDP_CONSUMED for XDP_DROP.

A race condition was found in the Linux kernel's power management runtime (PM runtime). The pm_runtime_work() function may dereference the dev->parent pointer after the parent device has been freed, leading to a use-after-free. The fix adds a flush_work() call in pm_runtime_remove().

In the Linux kernel, a potential infinite loop in bond_header_parse() occurs when a stack of two bonding devices is set up. A 'dev' parameter was added to the parse() method in header_ops to bound recursion and ensure the correct leaf method is called.

A double-free vulnerability was found in the Linux kernel's TEQL (trivial link equalizer) network scheduler. The issue occurs because qdisc_reset is called without proper locking when a TEQL device uses a lockless root qdisc, leading to a race condition and double memory free.

In the cdc_ncm driver (Linux kernel), the cdc_ncm_rx_verify_ndp16() function omitted ndpoffset in the second bounds check for the DPE array. When the NDP is near the end of the buffer, out-of-bounds read may occur.

In the cdc_ncm driver (Linux kernel), the cdc_ncm_rx_verify_ndp32() function omitted ndpoffset in the bounds check for the DPE array, allowing out-of-bounds read when the NDP32 is near the end of the buffer.

In the Linux kernel, the aqc111 driver (net: usb) calls a power management (PM) function in its suspend callback, leading to a task hung in rpm_resume. The issue occurs when aqc111_suspend calls the PM variant of its write_cmd routine, causing a wait for a status change that never happens, blocking another task holding rtnl_lock and the entire networking stack.

In the igc driver (Linux kernel), during TX queue shutdown with XDP and timestamp requests, xsk_meta pointers were not cleared, causing a page fault in the interrupt handler when accessing them.

In the Linux kernel, ieee80211_tx_prepare_skb() (mac80211) had an error path that did not free the skb, causing a memory leak. Added missing kfree_skb() and removed redundant frees in callers (ath9k, mt76, mac80211_hwsim).

In the Linux kernel, in the ACPI processor module, a previous fix for acpi_processor_errata_piix4() introduced a use-after-free issue. Device pointers may be dereferenced after dropping references to the device objects. Additionally, debug messages about enabling errata may be printed when errata flags are unset. The fix moves message printing to the points where errata flags are set.

In the Linux kernel, SRv6 IPv6 paths lack NULL checks for the idev pointer returned by __in6_dev_get(). This can lead to a NULL pointer dereference when a network device has no IPv6 configuration.

In the mlx5e driver in the Linux kernel, a race condition exists when accessing the ASO context for IPsec because the spinlock is released before WQE completion, allowing overwriting of the shared DMA context.

A race condition was found in the MLX5 driver in the Linux kernel during ESN (Extended Sequence Number) update in IPSec full offload mode. The driver acknowledged the ESN wrap event too late, which could lead to reprocessing the same event and incorrect increment of ESN high-order bits.

In the Linux kernel, the udp_sock_create6 function returns success (0) without creating a socket when CONFIG_IPV6 is disabled. This leads to a NULL pointer dereference in callers like fou_create, causing a kernel crash.

In the Linux kernel's mvpp2 driver for Marvell PP2/CP11X, a NULL pointer dereference vulnerability exists. The mvpp2_bm_switch_buffers() function unconditionally calls flow control update without checking if the CM3 SRAM resource is available, causing a kernel panic on MTU changes.

In the Linux kernel net: shaper, late read accesses to the hierarchy after converting a reference to a locked net_device did not check if the device was unregistered. This can lead to use-after-free.

In the Linux kernel's network shaper mechanism, there is a race condition between Netlink operations and network device unregistration. This can lead to a shaper hierarchy leak if the hierarchy is created after a flush has already run.

A bug was found in the Linux kernel's PMU (Performance Monitoring Unit) handling for AMD EPYC processors. The issue is that the event pointer setup in x86_pmu_enable() occurs too late, leading to a race condition and a NULL pointer dereference in the NMI (Non-Maskable Interrupt) handler. This results in a kernel crash.

In the Linux kernel, the MTD NAND driver lacked serialization of lock/unlock operations against other NAND operations. nand_lock() and nand_unlock() called controller operations without holding the device lock, potentially racing with concurrent UBI/UBIFS erase/write operations.

In the Linux kernel arm_mpam driver, a null pointer dereference occurs when restoring memory bandwidth counters. When an MSC is brought offline and online, mpam_restore_mbwu_state() does not set mbwu_arg.val, causing a kernel oops.

In the Linux kernel's mshv driver, a use-after-free vulnerability exists in the error path of mshv_map_user_memory(). Calling vfree() directly leaves the MMU notifier registered, which accesses freed memory after userspace unmaps it.

In the Amlogic SPI driver (amlogic-spisg) in the Linux kernel, a memory leak occurs in aml_spisg_probe(). After allocating a controller via spi_alloc_target() or spi_alloc_host(), several error paths fail to call spi_controller_put().

In the vmwgfx graphics driver (for VMware) in the Linux kernel, a memory leak occurs due to overwriting the surface dirty tracker in KMS mode.