Linux kernel vulnerabilities

In the Linux kernel IOMMU SVA subsystem, a bug in iommu_sva_unbind_device() caused a use-after-free. After iommu_domain_free() freed the mm structure, accessing domain->mm->iommu_mm resulted in a crash.

In the logicvc DRM driver in the Linux kernel, a device node reference leak occurs in logicvc_drm_config_parse(). The of_get_child_by_name() function does not release the reference to the found 'layers' node.

In KVM for ARM64, a fix addresses the initialization of ID registers for non-protected pKVM guests. In protected mode, the hypervisor copied the KVM_ARCH_FLAG_ID_REGS_INITIALIZED flag without initializing the id_regs data, causing ID registers to be zeroed. This led to errors in feature detection, such as TCR2_EL1, and potential state corruption.

In the Linux kernel's accel/amdxdna driver, the command header payload count field is not validated. This could allow specifying a payload size exceeding the available buffer, leading to out-of-bounds read/write.

In the Btrfs filesystem in the Linux kernel, a memory leak occurs in btrfs_uring_read_extent(). The 'pages' object is not freed in error paths when previous allocations fail or when btrfs_encoded_read_regular_fill_pages() does not return -EIOCBQUEUED.

In the Linux kernel's dpaa2-switch driver, after receiving an invalid if_id in the IRQ handler, the interrupt status is not cleared, leading to an interrupt storm.

In the Linux kernel drm/xe/configfs driver, a memory leak occurs. xe_config_device_release() only frees ctx_restore_post_bb but not ctx_restore_mid_bb, causing a leak when the configfs device is removed.

In the wlcore Wi-Fi driver in the Linux kernel, a locking bug was detected where wl->mutex is unlocked without being locked first.

In the Linux kernel, a circular locking dependency was found in rds_tcp_tune, where calling sk_net_refcnt_upgrade() while holding the socket lock can cause a deadlock. The fix moves this call outside the critical section.

In the Linux kernel drm/xe/reg_sr driver, a memory leak occurs. When xa_store() fails, the newly allocated entry is not freed, causing a memory leak on the error path.

A memory leak was found in the Linux kernel's TLS module related to the async_hold queue. The tls_decrypt_async_wait() function did not purge this queue, causing skb buffers to be retained after AEAD operations completed. The patch moves the purge operation into this function, centralizing management and preventing leaks.

In the Linux kernel KVM subsystem for x86, a vulnerability was found where an existing shadow-present SPTE is not dropped before installing an emulated MMIO SPTE. This can cause a warning and potential misbehavior when host userspace modifies guest memory.

A NULL pointer dereference vulnerability was found in the Linux kernel's icmp_tag_validation() function. When hardened PMTU mode is enabled (ip_no_pmtu_disc=3) and an ICMP Fragmentation Needed packet with an inner IP header containing an unregistered protocol number is received, a kernel panic occurs in softirq context.

In the Linux kernel, a vulnerability was found in the nfnetlink_osf module where missing validation of individual option lengths in TCP fingerprints can lead to NULL pointer dereference or out-of-bounds reads. An attacker can supply a malicious fingerprint with zero-length options or an invalid MSS option length, causing a system crash (Oops) or potentially other impacts.

In the Linux kernel netfilter/nf_tables subsystem, a use-after-free vulnerability was found in the error path during flowtable registration. After hook registration fails, the flowtable is freed without RCU grace period synchronization, potentially allowing access to freed memory via packet path or nfnetlink_hook control plane.

A vulnerability was found in the Linux kernel's netfilter xt_CT module, where templates can be removed while packets are still pending in the nfqueue. This can cause issues on helper module removal or timeout policy deletion. The patch flushes these enqueued packets when the template rule is removed.

In the Linux kernel netfilter/nf_tables subsystem, a vulnerability was found due to unnecessary set cloning during flush operations. A memory allocation failure with GFP_KERNEL triggers a WARN splat and may cause system instability.

A NULL pointer dereference vulnerability was found in the Linux kernel's bridge br_do_suppress_nd() function. It occurs when IPv6 is disabled via ipv6.disable=1 and an ICMPv6 Neighbor Discovery packet reaches the bridge, causing a kernel crash.

In the Linux kernel, the ETS (Enhanced Transmission Selection) network scheduler has a divide-by-zero vulnerability in the offload path. The issue is caused by unsigned integer overflow when computing WRR weights, potentially leading to a kernel panic.

In the Linux kernel, the net/sched/act_ife module has a vulnerability where replacing the metalist appends new metadata instead of replacing old data. This unbounded growth can cause a slab-out-of-bounds error during the encode operation, as shown by a KASAN report.

In the Linux kernel, the dell-wmi-sysman driver's set_new_password() function hex dumped the entire buffer containing plaintext passwords. The hex dump has been removed to prevent credential leakage.

An AB-BA deadlock was discovered in the Linux kernel during PHY LED trigger registration. The issue occurs when both LEDS_TRIGGER_NETDEV and LED_TRIGGER_PHY are enabled, causing mutual blocking when accessing the trigger list and the RTNL mutex.

In the Linux kernel, the kalmia USB driver lacks validation of USB endpoints. A malicious USB device without the expected endpoints can cause a kernel crash when the driver blindly accesses them.

A vulnerability related to MAC comparison was identified in the Linux kernel, which could lead to timing attacks. It has been resolved by replacing the memcmp() function with the appropriate crypto_memneq() function.

In the Linux kernel, a stack-out-of-bounds write vulnerability was found in the get_upper_ifindexes() function in devmap. The function iterates over all upper network devices and writes their indices into an array without bounds checking, potentially causing a stack buffer overflow.

A Use-After-Free vulnerability was found in the Linux kernel's netfilter pipapo set type. The issue arises from prolonged garbage collection (GC) in a non-preemptible context under a large number of expired elements, causing soft lockups and RCU stalls. The fix splits GC into unlink and reclaim phases to prevent access to freed memory.

A vulnerability has been identified in the Linux kernel in the ioremap_prot() function, which may lead to memory read errors from the kernel level on arm64 systems with PAN enabled. The issue lies in returning a new user mapping that is inaccessible to the kernel.

A vulnerability in the Linux kernel's XDP subsystem causes incorrect calculation of tailroom due to mismatched frag_size in network drivers (e.g., ixgbevf). Negative tailroom is stored as unsigned, leading to uncontrolled tail growth and memory corruption, resulting in segfaults and general protection faults.

In the Linux kernel, a vulnerability was found in the network queuing (qdisc) mechanism for lockless queues. When shrinking the number of real TX queues, qdisc_reset_all_tx_gt() can run concurrently with the dequeue process, leading to a use-after-free (UAF) and potential system compromise.

In the Linux kernel irdma driver, a kernel stack leak was found in irdma_create_user_ah(). The reserved field of the response structure is not zeroed before being sent to userspace, leaking 4 bytes of stack memory.

A vulnerability was found in the Linux kernel's MPTCP (Multipath TCP) endpoint management. It triggers a warning when removing an endpoint with both 'signal' and 'subflow' flags while the MPTCP subflow limit is set to 0. The issue stems from incorrectly marking the endpoint as used, leading to state inconsistency.

A use-after-free (UAF) vulnerability was discovered in the Linux kernel's bpf_trampoline_link_cgroup_shim function. The issue is a race condition where after the shim_link refcount drops to zero, the resource remains accessible via the tr->progs_hlist list while its cleanup is deferred. An attacker can exploit this window to access freed memory.

A vulnerability in the Linux kernel allows changing the transmission hash policy to vlan+srcmac while an XDP program is loaded on a bond in 802.3ad or balance-xor mode. This can lead to incompatibility and errors when destroying bonds.

A NULL pointer dereference vulnerability was found in the Linux kernel's ip6_rt_get_dev_rcu() function. It occurs when a slave device is being un-slaved from a VRF, causing l3mdev_master_dev_rcu() to return NULL and leading to a system crash.

A data race vulnerability was found in the Linux kernel around the sk->sk_data_ready and sk->sk_write_space pointers. The skmsg layer (and possibly others) modifies these pointers while other CPUs may read them concurrently, leading to undefined behavior.

A vulnerability in the Linux kernel causes a system panic when an IPv4 route references an IPv6 nexthop object configured on a loopback interface. The issue stems from misclassifying such an object as a reject route, skipping initialization of the nhc_pcpu_rth_output structure, leading to a NULL pointer dereference.

A vulnerability in the Linux kernel's VXLAN driver causes a NULL pointer dereference in the IPv6 neighbor table (nd_tbl) when booting with the 'ipv6.disable=1' parameter. An attacker can send a crafted IPv6 packet to a VXLAN interface, triggering route_shortcircuit() and leading to a kernel Oops and potential system crash.

The pegasus USB driver in the Linux kernel lacks validation of USB endpoints. A malicious USB device can crash the driver by not providing the expected endpoints.

In the Linux kernel, the irqchip/sifive-plic driver has a vulnerability causing interrupt freezing. The issue occurs when changing interrupt affinity while a hart is still handling the interrupt, leading the PLIC controller to ignore the completion message. This results in a complete stall of interrupts for the affected device.

In the Linux kernel, a vulnerability was found in the mtk_eth_soc driver where the eBPF program pointer in mtk_xdp_setup() is not reset to old_prog on error in mtk_open, and its ref-count is incorrectly decreased.

In the Linux kernel, a vulnerability was found in the netfilter nf_tables subsystem, where not all pending catchall elements were processed during transaction handling. When the map holding these elements was also being removed, only the first viable candidate was toggled, leading to a warning and potential error in nft_data_release.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the TEQL (Trivial Equalizer) network scheduler. The teql_master_xmit() function fails to update skb->dev before calling netdev_start_xmit(), causing gretap tunnels to use the wrong master device teql0 which lacks allocated tstats, resulting in a page fault.

In the Linux kernel netfilter xt_IDLETIMER module, a vulnerability allows revision 0 rules to reuse ALARM timer labels, calling mod_timer() on an uninitialized timer_list, leading to debugobjects warnings and potential kernel panic when panic_on_warn=1.

In the Linux kernel, a race condition was found in the error path of macvlan_common_newlink() in the macvlan driver. When creating a macvlan interface in source mode, the network device may become visible before an error is detected and then freed without respecting an RCU grace period. This leads to a use-after-free in macvlan_forward_source(), which can be exploited to compromise system security.

In the Linux kernel netfilter nf_tables subsystem, a vulnerability was found where a new element is published in a full set before being removed, without waiting for the RCU grace period. This can cause an RCU reader to process the already published element, leading to potential misbehavior.

A race condition was found in the Linux kernel's perf event handling. The __perf_event_overflow() function can be called with only preemption disabled but IRQs enabled, racing against perf_event_exit_event(). This can lead to use-after-free of structures like BPF programs.

A vulnerability was found in the Linux kernel's act_ct (Connection Tracking) module for the network scheduler (net/sched). The issue arises from allowing act_ct in the egress path, which can lead to a Use-After-Free (UaF) due to improper handling of the TC_ACT_CONSUMED state by most qdiscs. The patch restricts act_ct binding to clsact/ingress qdiscs and shared blocks only.

In the Linux btrfs filesystem, when creating an inline extent fails with -ENOSPC and falls back to COW, the reserved qgroup data was incorrectly freed. The fix frees it only when no fallback occurs (ret <= 0).

In the Linux btrfs filesystem, the function __cow_file_range_inline() did not free reserved qgroup data when path allocation or transaction join failed, causing a leak.

A vulnerability has been identified in the Linux kernel regarding TCP source port leakage via a SYN cookie side-channel. A fix has been implemented that brings back TCP ports to the timestamp offset randomization.