Linux kernel vulnerabilities

In the Linux kernel, the EDAC/igen6 driver has an issue due to missing release() function for memory controller devices. When unloading the driver, a call trace appears with a warning that the device does not have a release() function.

In the Linux kernel, the liveupdate mechanism has an issue with proper reference counting for incoming FLB data. The liveupdate_flb_get_incoming() function does not increment the reference count, which can lead to use-after-free when a subsystem holds the data.

In the Linux kernel, the wlcore driver has an issue with the cipher set that causes the number of ciphers to decrease on every boot of too old firmware. On some wl128x chips, this leads to key setting errors and endless hardware recovery attempts.

In the Linux kernel, the cxlctl_get_supported_features() function has a false positive buffer overflow detection by Fortify, leading to a kernel panic. The issue is due to an uninitialized num_entries variable.

In the Linux kernel, the setup_xor_mapping() function has a false positive buffer overflow detection by Fortify, leading to a kernel panic. The issue is due to an uninitialized nr_maps variable.

In the Linux kernel, the OCFS2 filesystem has an out-of-bounds write in ocfs2_remove_refcount_extent, which can lead to a kernel panic. The issue occurs when unlinking a refcounted file and the last leaf block is removed.

In the Linux kernel, the netfilter synproxy module has an unaligned memory access issue when adjusting the timestamp. Using unsafe operations can cause performance degradation or crashes on strict alignment architectures.

In the Linux kernel, the netfilter conntrack module reverts the ct extension genid infrastructure because it is no longer used. The previous change could disable all ct extensions for unconfirmed connections, potentially leading to crashes.

In the Linux kernel, the wcn36xx driver has an out-of-bounds read due to a short trigger BA firmware response. Lack of length validation can lead to reading stale heap data and corrupting the BA session state.

In the Linux kernel, the iommufd module lacks the dma_resv lock before calling dma_buf_unpin() in the release path, causing a kernel warning. This occurs when destroying or unmapping IOAS.

In the Linux kernel, the mt76 (mt7996) driver has a NULL pointer dereference in mt7996_init_tx_queues() when MT76_NPU and CONFIG_NET_MEDIATEK_SOC_WED are enabled. The issue occurs when an NPU is detected.

In the Linux kernel, in the Btrfs filesystem's LZO decompression function, there is an out-of-bounds read vulnerability. The segment length validation does not account for the compressed data size, which can lead to a null-ptr-deref and system crash.

In the Linux kernel, in the OcteonTX2 AF driver for the NPC, there is an out-of-bounds write (slab-out-of-bounds) vulnerability. The issue arises from an incorrect size of the entry2cntr_map array, which can lead to memory corruption.

A vulnerability in the Linux kernel's ALSA SEQ OSS subsystem involves a race condition in the read queue reset path. The snd_seq_oss_readq_clear() function modifies queue state without holding q->lock, which can race with concurrent read/free operations, leading to stale records, dropped events, or incorrect readiness reporting.

In the Linux kernel for the MIPS architecture, in the maar_res_walk() function, there is an out-of-bounds write vulnerability. The function does not check if the array is full before writing, which can lead to memory corruption when there are many memory ranges.

In the Linux kernel, in the powerpc/perf driver for FSL EMB, there is a preempt count underflow vulnerability. The fsl_emb_pmu_del() function calls put_cpu_var() without a preceding get_cpu_var() under certain conditions, which can lead to a 'scheduling while atomic' bug.

In the Linux kernel, in the RDMA HNS driver, there is a memory leak vulnerability related to bonding resources. During concurrent driver removal and reset, resources may be allocated after they have been released, leading to memory leak and potential kernel panic.

In the Linux kernel, in the mfd cs42l43 driver, there is an out-of-bounds read vulnerability. The code does not check if the firmware size is larger than the header, which can lead to invalid memory access.

In the Linux kernel, in the coresight ete driver, there is a vulnerability due to not saving state on CPU power down. This can lead to operational errors and warnings when using Coresight with ACPI.

In the Linux kernel, in the tlclk driver, there is a use-after-free vulnerability in the tlclk_cleanup() function. The issue involves freeing memory before device operations are complete, which can lead to crashes or incorrect behavior.

In the Linux kernel's PCI dwc driver, dwc_pcie_rasdes_debugfs_deinit() can dereference a NULL pointer when the controller lacks RAS DES capability. Initialization succeeds but does not allocate rasdes_info, and the cleanup function tries to access it.

A vulnerability was found in the Linux kernel's PCI/MSI subsystem. A previous fix (commit 1a8d4c6ecb4c) caused a double iounmap() on a NULL pointer during an error path in msix_capability_init(), triggering a WARNING in iounmap. The issue was fixed by reverting that change and leaving the unmap to the existing __free(free_msi_irqs) cleanup.

In the Linux kernel's AppArmor module, the function aa_replace_profiles accessed udata->size after calling aa_put_loaddata(udata), potentially causing a use-after-free (UAF). The fix saves the size to a local variable before dropping the reference.

In the Linux kernel's amdkfd driver, there is a double-unpin of DOORBELL and MMIO BOs during GPU memory free. The function amdgpu_amdkfd_gpuvm_free_memory_of_gpu() unpins these objects before checking if they are still mapped, leading to a double unpin and a warning in ttm_bo_unpin.

In the Linux kernel's ieee802154 subsystem, cfg802154_switch_netns() calls WARN_ON() on memory allocation failure in dev_change_net_namespace() and device_rename(). This leads to unnecessary warnings during deliberate fault injections.

In the Linux kernel's tun_dst_unclone function, there is a false-positive memcpy overflow warning. The compiler with clang and source fortification estimates that options cannot fit into the structure, even though memory is actually allocated, causing a warning.

In the Linux kernel's emac driver, there is a NULL pointer dereference in emac_probe. The function devm_request_irq() is called before devm_platform_ioremap_resource(), which can cause an interrupt to hit emac_irq() before dev->emacp is mapped, leading to a crash.

In the Linux kernel's veth driver, there is a NAPI leak in the XDP enable error path. The rollback loop skips calling netif_napi_del() for the failed index, leaving a dangling napi_struct in the device's NAPI list, leading to use-after-free (UAF) during device destruction.

In the Linux kernel, ACPI LPI entry functions were not marked as __cpuidle, causing RCU warnings when function tracing or Kprobes were enabled during idle entry. The fix annotates these functions with __cpuidle, disabling ftrace instrumentation on this sensitive path.

In the Linux kernel, the enetc driver had a potential divide-by-zero when num_vsi was zero, which occurs on i.MX94 platforms without SR-IOV support. The fix adds an explicit check and early return when num_vsi is zero.

In the Linux kernel, the accel/amdxdna driver had a race condition regarding the iommu domain lifetime during device removal. In force_iova mode, accessing xdna->domain after device removal could lead to use-after-free. The fix moves domain freeing to a managed release action, ensuring its validity until all resources are released.

In the Linux kernel, the parse_btf_arg function in tracing/probes contained a WARN_ON_ONCE that users could easily trigger by adding a kprobe event based on a raw address with BTF parameter. Since this is not an unexpected condition, the warning was removed.

In the Linux kernel, a vulnerability was found in the DRM driver for Intel GPUs (xe). With CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y enabled, xe_pt_svm_userptr_pre_commit() calls vma_check_userptr() with notifier_lock held in read mode, while the test path requires write mode. This triggers an assertion and a WARNING in drm_gpusvm_unmap_pages(), potentially destabilizing the system.

In the Linux kernel, the HID picolcd driver had a potential NULL pointer dereference in picolcd_send_and_wait() due to an integer overflow of the signed loop counter. Changing the counter type to unsigned int prevents the overflow and eliminates the out-of-bounds access.

In the Linux kernel, the hid_get_report function in HID core had an out-of-bounds read issue for numbered reports when the data size was 0. The fix moves the minimum size validation before calling hid_get_report, preventing out-of-bounds pointer dereference.

A vulnerability in the Linux kernel's perf subsystem for AMD processors leaks kernel addresses to user space. Even when PERF_SAMPLE_BRANCH_USER is requested, the branch stack may contain entries with branch-from addresses in the kernel (e.g., for SYSRET/ERET). The issue affects AMD processors with X86_FEATURE_AMD_LBR_V2, where the hardware filter only considers the privilege level of the branch target.

In the Linux kernel, the batman-adv gw module does not reassign the ethernet header pointer after pskb_may_pull() reallocates the buffer. This can lead to a use-after-free condition.

In the Linux kernel, the batman-adv batadv_dat_get_vid() function does not verify that the proto field of the ethernet header is accessible before reading it. This could lead to an out-of-bounds read.

In the Linux kernel, the NTFS3 filesystem's decompress_lznt() function does not validate array index bounds before accessing the decompression table. A corrupted NTFS3 image with invalid compressed data can trigger an out-of-bounds read.

In the Linux kernel, the mtd maps vmu-flash driver does not link the device structure to its parent, causing a NULL pointer dereference during MTD initialization.

In the Linux kernel, the ims-pcu driver exposes sysfs attributes on all interfaces, but only supports them on the control interface. Accessing these attributes on data interfaces can lead to unexpected behavior or crashes.

In the Linux kernel, the ims-pcu driver processes response data from device buffers without verifying that the device actually sent enough data. This can lead to out-of-bounds reads or processing stale data.

In the Linux kernel, the ims-pcu driver does not verify that the bLength of each descriptor is at least 2 when parsing CDC union descriptors. A malicious device could provide a descriptor with bLength=0, leading to an infinite loop.

In the Linux kernel, the hwmon asus_atk0110 driver's atk_ec_present() function does not check that the sub-package is non-empty before reading its first element. This can lead to an out-of-bounds read.

A vulnerability in the Linux kernel's DAMON mtier sample module can trigger a WARN_ONCE() in damon_new_region() when address range parameters are invalid. This occurs if the module is enabled before node{0,1}_{start,end}_addr are initialized or if a node is memoryless. The fix adds early validation of parameters before region creation.

In the Linux kernel, a vulnerability was found in the f2fs filesystem's f2fs_listxattr() function. Lack of validation of xattr entries before reading their fields may result in returning a partial result instead of an error when an entry is outside the valid storage area.

A vulnerability in the Linux kernel's IP fragmentation stack allows an attacker to send IP fragments with GSO metadata (e.g., via tun/tap), causing a kernel panic (BUG_ON in skb_segment) after reassembly. It affects IPv4, IPv6, nf_conntrack, and 6lowpan reassembly paths.

In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX path errors. After commit 9db5b3cec4ec ("mptcp: borrow forward memory from subflow"), errors in the receive path prior to queueing skbs into the receive queue do not trigger forward-allocated memory reclaiming. Prevent forward memory from growing unboundedly in pathological drop scenarios by explicitly reclaiming memory when skbs are dropped.

In the Linux kernel's s390/qeth driver, qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by a user-supplied length without checking a lower bound, leading to out-of-bounds write. The fix rejects buffers smaller than udata_offset before allocation.

In the Linux kernel's ASoC lpass-tx-macro driver, tx_macro_dec_mode_get() and tx_macro_dec_mode_put() access the control value via ucontrol->value.integer.value[0] instead of ucontrol->value.enumerated.item[0], leading to out-of-bounds access for enum types. The fix uses the correct field.