Linux kernel vulnerabilities

A reference count leak was discovered in the Linux kernel's bpf_prog_test_run_xdp() function. The issue occurs when the error handling path fails to call xdp_convert_buff_to_md(), causing a network interface (e.g., sit0) to remain stuck and preventing its release.

In the Linux kernel's libceph library, an error from ceph_auth_handle_reply_done() is not properly propagated from mon_handle_auth_done(). This causes higher layers to react to authentication issues while msgr2 still tries to proceed with the session in the background, potentially leading to a WARN in setup_crypto() and a NULL pointer dereference in prepare_auth_signature() in secure mode.

A crash occurs in the ocelot network driver (Microsemi) when adding an interface to a LAG group. The bug is a NULL pointer dereference in ocelot_set_aggr_pgids() for unregistered ports (ocelot_vsc7514.c frontend).

In the Linux kernel's NFSD subsystem, a race condition was found when writing to the v4_end_grace file, potentially leading to use-after-free in the reclaim_str_hashtbl. The fix adds locking with a client_tracking_active flag and spinlock protection.

A memory leak in the Linux kernel's skb_segment_list() function used for GRO packet segmentation. The leak stems from outdated truesize accounting after commit ed4cccef64c1 changed fragment orphaning, preventing socket deallocation.

In the Linux kernel, a vulnerability in dm-verity's recursive forward error correction (FEC) was found. Recursive calls can cause denial-of-service due to up to 4 billion iterations and overwrite shared buffers, breaking correction logic.

In the Linux kernel's GPIO MPSSE driver, the IRQ worker is not properly torn down when the device is unplugged. A running IRQ worker causes a crash on unplug, as the hardware was not originally hotpluggable.

In the Linux kernel, a reference count leak was found in the ksmbd module during session lookup. When a session is found but its state is not SMB2_SESSION_VALID, the reference count acquired by the session lookup is not decremented.

A leak of the ct (connection tracking) object was found in the netfilter nf_conncount module of the Linux kernel in error paths. Some error paths skipped the reference check and returned immediately, causing a leak.

A vulnerability in the Linux kernel causes a system panic when copying sk_buff.cb data to userspace via sock_recv_errqueue. The issue stems from the skbuff_fclone_cache lacking a usercopy whitelist, triggering a BUG() when CONFIG_HARDENED_USERCOPY is enabled. The fix uses a local stack variable as a bounce buffer to bypass the hardened usercopy check.

In the adv7842 driver in the Linux kernel, a possible out-of-bounds array access was found in the adv7842_cp_log_status() function. The cp_read() and hdmi_read() functions may return -EIO, which is then used as an array index.

A problem with interrupt context was found in the smc91x driver for the Linux kernel with PREEMPT_RT. The smc_special_trylock() function disabled IRQs even on PREEMPT_RT, but smc_special_unlock() did not restore them correctly, causing a workqueue error.

In the Linux kernel, a vulnerability in the seqiv module was found where req->iv is dereferenced after crypto_aead_encrypt returns. Since the underlying request may be freed by an asynchronous completion, this leads to use-after-free.

In the Linux kernel DRM subsystem for Intel GPUs (i915), a vulnerability was found due to uninitialized eb.vma array in i915_gem_do_execbuffer. Missing initialization can lead to NULL pointer dereference during error handling in eb_lookup_vmas(), causing system crash.

In the Linux kernel, a bug was found in the ERSPAN code for GRE tunnels where the options_len field is not initialized before referencing the flexible array member options in the ip_tunnel_info structure. This causes a kernel panic when compiled with GCC 15+ and FORTIFY_SOURCE enabled.

A vulnerability in the Linux kernel's mac80211 subsystem allows accepting Beacon frames sent to a non-broadcast address. According to IEEE 802.11, Beacon frames must be sent to the broadcast address only, and unicast Beacons can be used in CSA attacks to move stations to a rogue channel. The issue is critical when Beacon protection (BIGTK) is enabled, as the current logic fails to drop unicast frames with the protection bit set, allowing bypass of protection.

A deadlock was discovered in the Linux kernel's MPTCP implementation during fallback. The issue occurs when the packet scheduler attempts reinjection after receiving MP_FAIL before the infinite map is transmitted, causing a double-lock attempt on fallback_lock.

In the Linux kernel's ext4 filesystem, a vulnerability was found in the parse_apply_sb_mount_options() function due to improper string copying. Using strscpy_pad() on a non-null-terminated string can cause an out-of-bounds read and trigger a kernel warning.

In the Linux kernel's SUNRPC subsystem, a NULL pointer dereference vulnerability was found in the gss_read_proxy_verf function. A zero-length GSS token results in empty memory pages, and accessing page_address(in_token->pages[0]) causes a NULL dereference even when the copy length is 0.

In the Linux kernel VIA watchdog driver (via_wdt), a vulnerability causes a critical system hang during boot. The issue arises because the allocated MMIO resource lacks a name, resulting in a "<BAD>" entry in the kernel resource tree.

In the Linux kernel's af_alg crypto mechanism, a vulnerability was found due to missing zero-initialization of memory allocated via sock_kmalloc(). Uninitialized context and request structures can lead to use of garbage values; specifically, the newly added 'inflight' field causes random -EBUSY errors in multi-threaded AIO requests.

In the Linux kernel, the HNS3 network driver lacks VLAN ID validation before use. Receiving a configuration mailbox from a VF with an invalid VLAN ID can cause out-of-bounds memory access.

In the Linux kernel for MIPS architecture, the ftrace mechanism has a memory corruption vulnerability when the kernel is located beyond 32 bits. The UASM_i_LA_mostly macro can generate more than 2 instructions, but ftrace code assumes at most 2, causing a buffer overflow and corruption of variables in the __read_mostly section.

A vulnerability in the Linux kernel's KVM for x86 causes a hard lockup of the virtual machine after prolonged inactivity with a periodic HV timer. The issue arises from incorrect calculation of the APIC timer expiration in periodic mode, leading to excessive timer interrupts and potential host lockup.

In the hp-bioscfg driver in the Linux kernel, an out-of-bounds array access vulnerability was found during ACPI package parsing. The hp_populate_*_elements_from_package() functions do not properly validate indices when accessing array elements with an offset.

A vulnerability was found in the Linux kernel's ip6gre_header() function in the ip6_gre driver. The bug causes a kernel panic (kernel BUG) due to insufficient skb headroom, which can be exploited by an attacker to crash the system.

A reference count leak was discovered in the Linux kernel when deleting nexthop objects for IPv4 error routes (e.g., blackhole). Error routes were not flushed with the dead nexthop, keeping references on the nexthop object and device, preventing their release.

In the NFS server (nfsd), an nfsd_file reference leak was found in nfsd4_add_rdaccess_to_wrdeleg(). Overwriting a pointer without releasing the previous one and improper reference management leads to memory leaks and potential file open conflicts. During server shutdown, a BUG() in kmem_cache_destroy() may occur.

A race condition in the Linux kernel's MPTCP implementation during simultaneous connection setup leads to an inconsistent fallback status, triggering a WARNING and potential system crash.

In the Linux kernel ROSE subsystem, a vulnerability was found due to an invalid array index in rose_kill_by_device(). The loop uses cnt instead of i, causing uninitialized or out-of-bounds reads.

A bug in the Linux kernel's calipso_skbuff_setattr() function for IPv6 causes a kernel oops via BUG_ON in pskb_expand_head(). The issue stems from an implicit integer cast in __skb_cow() that allows a negative headroom value to be passed to skb_cow() when headroom exceeds INT_MAX.

In the Bluetooth btusb driver in the Linux kernel, the use of devm_kzalloc has been reverted. Using devm_kzalloc tied the lifetime of btusb data to one interface (INTF), causing issues when releasing other interfaces (ISOC, DIAG).

In the Linux kernel, a bug was found in the rt6_get_pcpu_route() function for IPv6 that causes a BUG on PREEMPT_RT kernels. After rt6_get_pcpu_route() returns NULL, the task can be preempted, and another task may install a pcpu_rt entry, causing cmpxchg() to fail and triggering BUG_ON.

A deadlock was discovered in the Linux kernel between nfc_unregister_device and rfkill_fop_write due to inverted lock ordering of device_lock and rfkill_global_mutex, causing thread blockage.

In the Linux kernel with hash MMU, a vulnerability in the SLB preload mechanism can cause an SLB multi-hit error. The issue occurs when a process migrates between CPU cores without executing switch_mmu_context(), leading to desynchronization between the hardware SLB buffer and the software preload cache.

In the Linux kernel aic94xx driver, a use-after-free vulnerability was found in the device removal path. The asd_pci_remove() function fails to synchronize with pending tasklets before freeing the asd_ha structure, leading to a race condition. Adding tasklet_kill() before freeing the structure fixes the issue.

A race condition between file open and removal in the Linux kernel's functionfs subsystem was found. ffs_epfile_open() could succeed even though the file was already removed, leading to a use-after-free.

In the Linux kernel, the shmem filesystem has a recovery issue after failed rename operations. Maple tree insertion errors can lead to an inconsistent state, and shmem_whiteout() assumes no further failures after its success.

In the Linux kernel, a vulnerability in the ublk module was found due to a reference count leak for ublk requests when the ublk server process closes the char device file. This affects the UBLK_F_USER_COPY data copy mode, leading to incorrect copy operations and warnings.

In the Linux kernel, a race condition exists in the ETS (Enhanced Transmission Selection) network scheduler between `ets_qdisc_dequeue` and `ets_qdisc_change`. This leads to a use-after-free (UAF) on a `struct Qdisc` object, potentially allowing an attacker to hijack the execution flow.

In the HNS3 network driver for the Linux kernel, a vulnerability was found due to incorrect resource allocation in the VF driver. The hdev->htqp and kinfo->tqp arrays were allocated with different sizes, leaving some elements uninitialized.

A use-after-free vulnerability was found in the Linux kernel's ALPS touchpad driver. The issue is caused by a race condition where the delayed work item dev3_register_work can be scheduled after the device is disconnected, leading to use of freed memory.

In the Linux kernel ext4 filesystem, a null pointer dereference vulnerability was found in ext4_raw_inode(). If ext4_get_inode_loc() fails (e.g. due to filesystem corruption), the buffer head remains NULL, and missing error checking in ext4_xattr_inode_dec_ref_all() leads to a kernel crash.

In the dtv5100 driver (dvb-usb) in the Linux kernel, there is an out-of-bounds read vulnerability in dtv5100_i2c_msg(). The rlen value is user-controlled and not checked, allowing it to be set larger than the st->data buffer size, leading to memory corruption.

A patch for the qla2xxx driver in the Linux kernel that introduced lockless command completion in the abort path has been reverted. Missing command type check (sp->cmd_type) caused a NULL pointer dereference in target mode, leading to a system crash.

In the Linux kernel, the MLX5 driver (fw_tracer) lacked validation of format string parameters. Invalid format specifiers (%s, %p, %n) from firmware could cause crashes or undefined behavior.

In the Linux kernel's ETS (Enhanced Transmission Selection) network scheduler, a bug occurs when changing a DRR (Deficit Round Robin) class to strict mode: the class is not removed from the active list. This causes a double addition to the list when later reverting to DRR, triggering a 'list_add double add' warning and potentially destabilizing the system.

In the Linux kernel, a memory leak was found in the io_uring subsystem within the __io_openat_prep() function. When a struct filename is allocated via getname() and the file is installed in the fixed file table with O_CLOEXEC flag, the function returns early without setting the REQ_F_NEED_CLEANUP flag, preventing the allocated memory from being freed.

A vulnerability in the Linux kernel's KVM allows disabling the KVM_MEM_GUEST_MEMFD flag on an existing memslot, leading to a use-after-free condition. The issue stems from missing validation when toggling the flag, enabling an attacker to trigger a critical error.

In the vidtv driver in the Linux kernel, there is a use-after-free and double-free vulnerability in vidtv_channel_si_init(). After transferring memory ownership to PAT/SDT/EIT tables, local pointers are not nullified, leading to freeing already freed memory on error paths.