Linux kernel vulnerabilities

In the Linux kernel, the AMD KFD driver (drm/amdkfd) lacked authorization checks in KFD_IOC_DBG_TRAP_DISABLE, allowing users with /dev/kfd access to terminate another process's debug session without proper ownership or ptrace authorization.

In the Linux kernel, the VMware driver (drm/vmwgfx) had two sites in vmwgfx_resource.c that assigned boolean literals to the guest_memory_size field, which is an allocation-size field, instead of the adjacent guest_memory_dirty bitfield. This caused guest_memory_size to hold 0 or 1 instead of the actual allocation size, leading to errors in dirty page range calculations and buffer allocation.

In the Linux kernel's DRM vmwgfx driver, a vulnerability exists due to missing cursor size validation for the MOB path (SVGA_CAP2_CURSOR_MOB). An attacker with DRM master privileges can use DRM_IOCTL_MODE_CURSOR2 to set an oversized cursor, leading to a call to vmw_bo_map_and_cache(NULL) and a kernel oops.

In the Linux kernel, the VMware driver (drm/vmwgfx) function vmw_external_bo_copy() did not validate bounds for copy operations on imported dma-buf buffers. Lack of validation could lead to out-of-bounds reads or writes, especially with crafted plane state data.

In the Linux kernel, KVM for ARM64 (vgic) had an issue of double-deactivation of interrupts in the nested context. The physical interrupt was already deactivated via the HW bit in the LR, and the extra deactivation could trigger an errata on AmpereOne processors, causing loss of pending interrupt state and blocking future interrupts.

In the Linux kernel, the DMA Engine driver (idxd) had a double-free issue for wq, engine, and group structures. The release callbacks called kfree() on the enclosing struct, and additionally error paths and cleanup functions also called kfree() after put_device(), leading to double free.

In the Linux kernel, the EROFS filesystem had a bug where backing files for page cache sharing had an invalid f_path (left as NULL). This caused a kernel NULL pointer dereference during mincore, crashing the system in the erofs/028 test.

In the Linux kernel, the hwmon ltc4282 driver had a missing return statement when reading the minimum alarm voltage for the VGPIO channel, causing an out-of-bounds access.

In the Linux kernel, the hwmon sht3x driver had unaligned memory accesses when reading 16-bit temperature and humidity values. Using be16_to_cpup() on odd offsets causes alignment faults on strict-alignment architectures (e.g., ARMv5, SPARC), leading to kernel panic.

In the Linux kernel, the Bluetooth subsystem (hci_sync) had a theoretical use-after-free (UAF) vulnerability in hci_connect_acl/le_sync() callbacks. If the connection (conn) is freed while the hci_sync task is running, it could lead to use of freed memory.

In the Linux kernel, the SCSI target iblock driver had a bug in iblock_execute_pr_out() where the NULL check for PREEMPT, PREEMPT_AND_ABORT, and RELEASE operations was incorrect. This allows unimplemented hooks (ops->pr_clear) to be called, leading to NULL pointer dereference.

In the Linux kernel, the SCSI UFS core driver had a bug where the hba->rpmbs list was not initialized in ufshcd_alloc_host(). If ufs_rpmb_probe() fails, a NULL pointer dereference could occur during device teardown.

In the Linux kernel, the tracing/mmiotrace subsystem lacked a NULL check for mmio_trace_array in __trace_mmiotrace_rw() and __trace_mmiotrace_map(). If these functions are called while mmio_trace_array is NULL (e.g., before initialization or after disabled), accessing tr->array_buffer.buffer results in a NULL pointer dereference crash.

In the Linux kernel for RISC-V, the function vec_check_unaligned_access_speed_all_cpus was marked as __init, placing its code in the .init.text section which is freed after boot. This function runs in a kernel thread that may not finish before the memory is freed, leading to a page fault when trying to execute code from the freed region.

In the Linux kernel's iommufd/viommu subsystem, in iommufd_vdevice_alloc_ioctl(), after a failed vdevice_size validation, jumping to out_put_idev skips releasing the igroup lock, causing a deadlock for subsequent vDEVICE operations on that group.

In the Linux kernel's migrate_vma_collect_pmd(), pte_pfn() and pte_dirty() may be called on non-present PTEs (e.g., device-private entries), leading to potential crashes or incorrect dirty folio accounting. The fix adds pte_present() checks.

In the Linux kernel's snapshot_page(), __page_2 is read for order-1 folios, but it should only be read when nr_pages > 2. This can cause a page fault during DLPAR memory removal on ppc64le systems.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth SCO subsystem. The issue stems from incorrect reference counting for the sco_conn structure, where the socket did not hold its own reference, leading to a double-free race condition between socket close and disconnection event handling.

In the Linux kernel for RISC-V, a bug was found in the calculation of vmemmap_start_pfn alignment. The issue uses alignment expressed in bytes of struct page storage instead of physical address bytes, causing a warning and potential memory initialization problems on systems like QEMU virt.

In the Linux kernel's i2c amd-mp2 driver, on adapter registration failure, the I2C context is freed by devres, but the PCI driver may still dereference the stale pointer in IRQ and sleep callbacks. The fix unregisters the callback before returning the error.

In the Linux kernel's s390/dasd driver, in dasd_release_space(), using the logical AND operator instead of OR leads to calling is_ese() even when the function pointer is NULL, causing a NULL pointer dereference.

In the Linux kernel's i2c imx driver, there is a race during slave registration and error handling. Assigning the slave pointer before pm_runtime_resume_and_get() can leave it non-NULL after an error, and a race with the interrupt handler can cause a NULL dereference. The fix defers the assignment until after successful resume and performs it inside the slave_lock critical section.

In the Linux kernel, dev_has_sync_state() reads dev->driver twice without holding device_lock(), which can lead to a race during concurrent unbind. The fix reads dev->driver exactly once with READ_ONCE(), pairing with WRITE_ONCE() in device_set_driver().

In the Linux kernel, the vmbus driver accesses the driver_override field without a lock during match() from __driver_attach(), potentially leading to use-after-free. The fix uses the generic driver_override infrastructure that handles locking internally.

In the Linux kernel NTFS driver, a vulnerability was found where the restart-area length is truncated to u16, allowing the bounds check to be bypassed. A crafted NTFS image can cause an out-of-bounds read during filesystem mount.

In the Linux kernel, BPF LSM programs can currently attach to the xfrm_decode_session() hook, which may return an error, but security_skb_classify_flow() calls it from a void path and triggers BUG_ON() on error. The fix disables BPF attachment to this hook to prevent a system panic.

In the Linux kernel, the mlx5 driver for LAG and MPESW was missing a complete() call in the error path when mlx5_lag_get_devcom_comp() returned NULL. A process waiting for the work to finish could block indefinitely. The fix routes the early return through a 'complete' label to always wake the waiter.

A vulnerability in the Linux kernel Bluetooth SCO subsystem causes a deadlock in sco_sock_timeout(). The issue arises from acquiring the same lock (lock_sock) twice when the socket is closing while the timer runs asynchronously. The fix moves disable_delayed_work_sync() outside the locked section.

In the Linux kernel, KVM for ARM64 in nested virtualization mode, kvm_handle_vncr_abort() assumed that -EFAULT from kvm_translate_vncr() always indicates an abort. However, 'late' failures on the output of S1 translation are possible, e.g., a GFN outside memslots. The fix prepares an external abort before returning from kvm_translate_vncr() and removes the BUG_ON() in the fault injection path.

In the Linux kernel, netfilter xt_nat SNAT and DNAT target handlers assume IP-family conntrack state and can dereference a NULL pointer when instantiated from an unsupported family through nft_compat. A bridge-family compat rule can trigger a NULL-dereference in nf_nat_setup_info(). The fix rejects non-IP families in xt_nat_checkentry() so unsupported targets cannot be installed, while keeping NFPROTO_INET allowed.

In the Linux kernel, the intel-speed-select tool (tools/power/x86) daemon uses a fixed pidfile path under /tmp. A local unprivileged user can pre-create a symlink at that path and cause a root-run daemon instance to write into an attacker-chosen file. The fix opens the pidfile with O_NOFOLLOW and validates it with fstat() before locking/writing.

In the Linux kernel, a vulnerability was found in the CXL subsystem where CXL_HEADERLOG_SIZE was defined as 512 bytes, while the actual Header Log register size in the RAS Capability structure is 64 bytes. This caused an out-of-bounds read (by 448 bytes) during data copying, and in the CPER caller path led to leaking 448 bytes of kernel stack memory into the trace event ring buffer, readable by userspace via tracefs.

In the Linux kernel, the UFS core driver trace events in drivers/ufs/core/ufs_trace.h used a pointer to the hba structure in TP_printk(), which is not allowed because TP_printk() is executed when the trace file is read, potentially much later when the pointer may be stale. The fix saves the device name at the time the tracepoint is called and places it into the ring buffer, eliminating the risk of dereferencing a freed pointer.

A vulnerability in the Linux kernel's hwmon (OCC) subsystem involves a lock ordering inversion between the OCC mutex and sysfs callbacks during hwmon device unregistration. This can lead to a deadlock, as confirmed by lockdep reports. The issue was discovered via static analysis and manually reviewed.

In the Linux kernel, the MMC vub300 driver had a deadlock caused by recursive acquisition of cmd_mutex during USB device reset after a command response timeout. The fix defers the reset until the mutex is released.

In the Linux kernel, the DRM driver for Rockchip (dw_dp), dw_dp_remove() attempts to access driver data via platform_get_drvdata(), which can lead to a null pointer dereference if the bind() callback was not executed. The fix removes the unnecessary call to platform_get_drvdata() and instead references the target device structure via platform_device.

In the Linux kernel, the accel/amdxdna driver lacked NULL checks before using the management mailbox channel pointer. Cleanup functions could be called after the channel was destroyed, leading to NULL pointer dereference. Added checks to safely return instead.

In the Linux kernel, the HFS+ filesystem lacked validation of B-tree node size. A corrupted HFS+ image with an invalid node size could lead to reading uninitialized memory during mount. Added a sanity check based on the technical specification.

In the Linux kernel, the soc: xilinx driver had a race condition in event registration. Work structures were initialized after registration, which could lead to NULL pointer dereference if firmware triggered an event immediately. Fixed by initializing before registration.

In the Linux kernel, the soc: xilinx driver had an error in rx mailbox channel cleanup. Due to incorrect condition, the channel was not shut down or freed, leading to use-after-free. Fixed by checking rx_chan correctly.

In the Linux kernel, the scsi: hisi_sas driver lacked a slave_destroy interface, causing warnings during simultaneous link reset and module removal. The fix adds this interface to ensure proper link removal after workqueues are flushed.

In the Linux kernel, the crypto CCP driver (AMD) mishandled a zero-length certificate chain buffer during PDH export. Instead of treating it as a query for blob lengths, the kernel attempted to get the physical address of the ZERO_SIZE_PTR, triggering a BUG_ON() when CONFIG_DEBUG_VIRTUAL=y. This leads to a kernel oops and can be triggered by an unprivileged user via ioctl.

In the Linux kernel, the crypto: ccp/sev-dev-tsm driver had a NULL pointer dereference when pdev->bus is NULL. dsm_create() checked the condition but later used the pointer without checking, potentially causing a crash. Fixed by returning -ENODEV early.

In the Linux kernel, the media: atomisp: gc2235 driver had error handling bugs leading to use-after-free and memory leak. The fix replaces gc2235_remove() calls in error paths with explicit unwind labels that free only initialized resources.

In the Linux kernel, the scmi_power_name_get() function in firmware: arm_scmi lacked validation of the domain number, which could lead to out-of-bounds access. Fixed by returning "unknown" for invalid domains, like scmi_reset_name_get() does.

In the Linux kernel, the pinctrl: spacemit driver had a NULL check error in spacemit_pin_set_config. It checked the pin variable instead of the spin pointer, causing valid pin 0 to be rejected and PAD configuration skipped. Fixed by checking spin, restoring configuration and preventing NULL deref.

In the Linux kernel, the RDMA/hns driver has an issue in direct mode poll CQ. CQs allocated by ib_alloc_cq() always have a comp_handler, which although not expected to be called in direct mode, is called during driver reset, triggering a WARN_ONCE().

In the Linux kernel, there is a possible NULL pointer dereference in __in6_dev_stats_get(). The dev_get_by_index_rcu() function can return NULL if the original physical device is unregistered.

In the Linux kernel, the rapidio/tsi721 driver has an issue in tsi721_db_dpc(). In a list_for_each() loop, the 'found' variable is not reset at the start of each iteration, which can lead to incorrectly marking all items as found after the first correct doorbell, and if the item is not found, it may dereference invalid memory.

A vulnerability in the Linux kernel's OCFS2 filesystem causes a BUG_ON crash when mounting a corrupted filesystem image. A specially crafted image can trigger a kernel panic instead of a clean mount failure. The issue is in ocfs2_journal_toggle_dirty, which should return an error instead of crashing.