Linux kernel vulnerabilities

In the Linux kernel, the ksmbd module has a vulnerability in the smb2_set_ea function that incorrectly validates buffers for extended attributes (EA). The omission of the null terminator (+1 byte) in the EA name length can lead to validation errors.

In the Linux kernel, a vulnerability in the FUSE module was found due to list corruption in the io-uring mechanism for requests terminated before being committed. Not removing the request from the queue list leads to use-after-free issues.

In the Linux kernel's NFSD subsystem, when an NFSv4 client creates a file with an ACL containing a named principal, the server fails to apply that ACL. Instead, after file creation, the client retrieves a default ACL based on mode bits, violating RFC 8881 section 6.4.1.3.

A use-after-free vulnerability was found in the Linux kernel's mlxsw (Mellanox Spectrum) driver. The issue occurs because a neighbour pointer is stored without holding a reference, leading to access to freed memory. The fix simplifies the reference counting scheme.

In the Linux kernel, a use-after-free vulnerability was found in the mlxsw (Mellanox Spectrum) driver during multicast route stats update. Missing mutex synchronization when deleting a route entry from the list can lead to accessing freed memory.

In the Linux kernel, the caif module has an integer underflow vulnerability in the cffrml_receive() function. When FCS is disabled, the function subtracts 2 from the packet length without checking if the length is at least 2, leading to underflow.

A vulnerability was found in the Linux kernel's AMD PMU driver. A subtle race condition between NMI handling and throttle can cause cpuc->events[idx] to become NULL, leading to a NULL pointer dereference and general protection fault (GPF) in amd_pmu_enable_all(). This issue is AMD-specific.

A vulnerability in the Linux kernel's ethtool mechanism can cause a userspace buffer overflow during stats queries due to a race condition between three ioctl calls when the number of stats changes dynamically (e.g., device reconfiguration). The mitigation prevents overflow by not returning data on size mismatch, but may result in temporary stats unavailability.

In the Linux kernel, a use-after-free (UAF) vulnerability was found in the amdgpu driver during GPU recovery. The race condition between the timeout callback and the TDR work queue allows access to the job's pasid field after the job has been freed.

In the Linux kernel, the tpm2-sessions module has an out-of-range indexing vulnerability in the 'name_size' field. Lack of range validation can lead to memory corruption when using unknown TPM_ALG_ID values.

A vulnerability in the Linux kernel's fsnotify mechanism allowed generating ACCESS/MODIFY events for special files (e.g., /dev/null) during read/write by other users. The fix disables these events for special files, closing potential side-channels for information exfiltration.

A memory leak was discovered in the Linux kernel's nr_sendmsg() function of the NET/ROM network stack. When nr_output() returns NULL due to a failed buffer allocation by sock_alloc_send_skb(), the original skb is not freed, causing a memory leak.

In the Linux kernel's openvswitch module, a vulnerability was found due to missing validation of the middle attribute in the push_nsh() action. An attacker can send a crafted Netlink packet that bypasses validation and causes a slab-out-of-bounds read during action execution.

In the Linux kernel, a vulnerability was found in the SCSI target subsystem where a NULL pointer dereference occurs in the error path when allocation of t_task_cdb fails. The fix resets the NULL pointer to the default fixed-size buffer.

In the Linux kernel, the prp_get_untagged_frame() function in the HSR/PRP module lacks a NULL check after __pskb_copy(). If memory allocation fails, calling skb_clone() with a NULL pointer causes a NULL dereference and system crash.

In the Linux kernel's HFS+ filesystem, a vulnerability was found due to a missing hfs_bnode_get() call in __hfs_bnode_create(). When sync() and link() are called concurrently, two threads may attempt to create the same B-tree node, leading to a double-free and triggering a BUG_ON assertion.

In the Linux kernel, the fsl-cpm SPI driver lacks length parity verification before switching to 16-bit mode, causing a buffer overrun on odd-length transfers. This can lead to system instability or crashes.

In the Linux kernel, the bnxt_en driver has a vulnerability in the XDP_TX path. Incorrect clearing of event flags can cause the driver to not ring the TX doorbell, leading to RX ring stall and packet loss.

A vulnerability has been identified in the Linux kernel that led to occasional deadlocks related to semaphore operations. The issue occurred during the loading of modules like ipvlan, resulting in task blockage.

In the Linux kernel, a vulnerability was found where automounted NFS filesystems do not inherit user-set mount flags such as 'ro', 'noexec', 'nodev', and 'sync'. This lack of inheritance can lead to security policy violations regarding read-only or execution restrictions.

In the Linux kernel, the HFS filesystem function hfs_correct_next_unused_CNID() calls hfs_bnode_put(node) before using the node pointer, potentially causing a use-after-free. Fixed the order of operations.

In the Linux kernel, the ALSA firewire-motu driver lacked a bounds check in the put_user loop for DSP events. This could lead to writing beyond the allocated buffer when the user buffer size is not aligned to 4 bytes.

A vulnerability has been identified in the Linux kernel that leads to a NULL pointer dereference in the blk-iocost function. This issue occurs when blkg_policy_data is installed before its initialization, potentially causing system crashes.

In the Linux kernel, a vulnerability in the RDMA/rxe driver causes a NULL pointer dereference in rxe_qp_do_cleanup() when socket creation in rxe_qp_init_req() fails. This can be triggered when mounting CIFS over RDMA. The fix moves the rxe_qp_do_cleanup() call after the NULL pointer check.

In the Linux kernel, tcp_add_backlog() has a signed integer overflow bug. The variables sk_rcvbuf and sk_sndbuf are of type int, and the limit calculated as their sum plus 64 * 1024 may exceed the maximum int value. The fix reduces the limit by halving sndbuf.

In the Linux kernel, a vulnerability in the NFSD server causes sending unnecessary garbage data beyond the end of the reply message for NFSv2 GETACL requests. This is due to leftover code that set the page_len of the send buffer, which is no longer needed after the XDR stream encoder conversion. Clients typically ignore this data, but NFSD should not send it as it leaks stale memory contents.

A race condition during BO unbinding in the ivpu accelerator in the Linux kernel was found. ivpu_gem_bo_free() removes the BO from the list before unmapping it, causing a 'Memory manager not clean during takedown' warning.

In the Linux kernel, the drm/panthor driver has a use-after-free (UAF) race between device unplug and firmware event processing. The panthor_fw_unplug() function frees firmware memory sections, but pending events may try to access the freed memory.

In the Linux kernel, the drm/panthor driver has a use-after-free (UAF) vulnerability on kernel BO VA nodes. When the MMU is down, panthor_vm_unmap_range() may return an error, but the code does not continue cleanup, leaving the va_node in drm_mm, leading to UAF when adjacent nodes are removed.

In the Linux kernel, the spi-tegra210-quad driver has a vulnerability in timeout handling. When the CPU handling QSPI interrupts is overloaded, a transfer timeout can occur, and the curr_xfer field points to stale memory, potentially leading to errors.

A vulnerability in the Linux kernel's BPF subsystem causes invalid memory access when update_effective_progs fails due to fault injection. After failure, the program is replaced with a dummy one, and a subsequent softirq accessing its stats leads to a crash.

A vulnerability related to the handling of disconnected directories has been fixed in the Linux kernel. The issue was that access rights to files or directories opened through a disconnected directory were collected without considering the mount point, which could lead to inconsistent access results.

In the Linux kernel, the drm/panthor driver has a use-after-free vulnerability in the GROUP_CREATE function. A malicious user can call GROUP_DESTROY from another thread before GROUP_CREATE completes, leading to use of freed memory.

A vulnerability has been identified in the Linux kernel related to reading extended attributes in the NTFS file system. The ntfs_read_ea function fails to return a proper error code for inconsistent attributes, which may lead to unpredictable memory accesses.

In the Linux kernel, the Bluetooth HIDP driver has a race condition in hidp_session_thread that can lead to use-after-free. The issue occurs when the timer is active while hidp_del_timer is called, and after session release, a kernel panic may occur. The fix is to use del_timer_sync instead of del_timer.

In the Linux kernel, there is a NULL pointer dereference vulnerability in subflow_syn_recv_sock() during early fallback to TCP in the fastopen path. The subflow context is deleted, and the fastopen path does not handle it, leading to a crash.

In the Linux kernel, the accel/ivpu driver has a page fault in ivpu_bo_unbind_all_bos_from_context(). BO is added to vdev->bo_list in ivpu_gem_create_object(), but when drm_gem_shmem_create() fails, the BO is not fully created and ivpu_gem_bo_free() is not called, leaving a deleted BO on the list.

A vulnerability was found in the Linux kernel's BPF test infrastructure that allowed generating invalid GSO (Generic Segmentation Offload) packets and sending them to the network stack. The issue occurred when a BPF program used bpf_clone_redirect() to redirect a packet to the loopback interface, triggering a skb_warn_bad_offload() warning and disabling GSO features.

A vulnerability in the Linux kernel's asymmetric_key_generate_id function can cause integer overflow when adding binary blob lengths and the size of an asymmetric_key_id structure. An attacker could exploit this by providing malicious X.509 certificate fields, such as ASN.1 INTEGER serial numbers or issuer names, leading to a potential buffer overflow.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the RDMA/rxe driver. It occurs when ibv_modify_srq() is called twice in succession under specific error conditions – the first call may set srq->rq.queue to NULL, and the second call crashes when accessing that pointer.

In the Linux kernel, a race condition in the smartpqi driver was found where a LUN reset work item could execute after device removal, causing use-after-free and improper resource access.

In the Linux kernel, the coresight tmc driver lacks the event handle in the path. The handle is essential for retrieving the AUX_EVENT of each CPU in perf mode. This causes an oops when using perf record with cs_etm.

In the Linux kernel, the ntfs3 filesystem has a vulnerability due to missing initialization of the run_lock for the $Extend inode. After setting the inode mode to a regular file, a truncate call can lead to an uninitialized lock error.

In the Linux kernel, the NTFS3 filesystem (ntfs3) does not initialize allocated memory before use. The __getname() function uses kmem_cache_alloc() without zeroing, leading to uninitialized values and potential security issues.

A vulnerability was found in the Linux kernel's BPF helper `bpf_skb_check_mtu`. When the `BPF_MTU_CHK_SEGS` flag is used, the helper requires the `transport_header` field in the `skb` structure to be set, which is not always the case. Missing this setting triggers a WARN_ON_ONCE warning and may cause incorrect behavior, especially during tests with `bpf_prog_test_run`.

A bug in the Linux kernel mt76 WiFi drivers causes a system crash when using the wed_hif2 interface (e.g., for 6GHz link). The issue stems from incorrect WED device references in callbacks, which always assumed the primary WED device.

In the SPI driver for the CH341 chip in the Linux kernel, an out-of-bounds memory access vulnerability was found. The issue stems from incorrect calculation of copied data length, which includes the command header byte, leading to buffer overflow.

A vulnerability in the Linux kernel's NFSv4/pNFS filesystem causes a crash when attempting to reference a null layout in pnfs_layoutcommit_inode. The issue is due to not clearing the NFS_INO_LAYOUTCOMMIT flag, leading to a NULL pointer dereference.

In the Linux kernel, in the ALSA firewire-motu driver, a buffer overflow vulnerability was found in the hwdep_read() function when handling DSP events. If a user provides a buffer smaller than 8 bytes, more data than requested may be written, potentially leading to data disclosure or a crash.

A vulnerability has been identified in the Linux kernel that occurs when adding a port device to a team device while the port is already active. Modifying the team device header can lead to incorrect private data pointing, resulting in system errors.