Linux kernel vulnerabilities

In the Linux kernel's ext4/jbd2 filesystem, a vulnerability was found where BUG_ON is triggered in jbd2_journal_get_create_access() when the filesystem is corrupted. Inconsistent data (e.g., unset block bitmap) can cause a block being committed to be reallocated, leading to a kernel crash.

A data race was detected in the do_raw_write_lock function in the Linux kernel. The issue is due to inconsistent use of WRITE_ONCE() for both debug_write_lock_before and debug_write_lock_after parts. This can lead to unpredictable behavior under concurrent lock access.

In the Linux kernel, the page pool manager now adds GFP_NOWARN by default for ATOMIC allocations. This prevents annoying OOM messages when network Rx hits page allocation failures during out-of-memory conditions.

In the Linux kernel, a bug was found in the lan966x driver where a mutex was used in an atomic context, causing a warning about sleeping in an invalid context. The fix replaces the mutex with a spinlock.

In the Linux kernel, io_uring/zctx has an issue with chaining notification contexts. Send zc should only link ubuf_info for requests from the same context. There are ambiguous syz reports, so a check is added on notification completion.

In the Linux kernel, the drm/msm driver did not update last_fence in the vm-bind path, causing resources to be freed while in use on context close, leading to faults. Added last_fence update in the vm-bind path.

In the Linux kernel for AMD Zen5 processors, there is an issue with the RDSEED instruction in 16-bit and 32-bit variants returning a value of 0 with an incorrect success signal (CF=1). A fix is added that checks microcode revisions.

A vulnerability in the Linux kernel's Bluetooth subsystem (hci_sock) involves a race condition between socket write and bind operations, potentially leading to a use-after-free in mgmt_pending_remove as reported by syzbot. The fix synchronizes both operations using hci_dev_lock.

A use-after-free (UAF) vulnerability was found in the Linux kernel's Bluetooth stack in the packet RX path. Improper locking when looking up the hci_conn structure allows concurrent modification or deletion, potentially causing a system crash.

A memory corruption bug was found in the Intel PUNIT IPC driver in the Linux kernel. Instead of passing the pointer to the punit_ipcdev structure, the address of the pointer was passed, causing writes to an incorrect memory address.

A potential NULL pointer dereference was found in the sxgbe network driver in the Linux kernel in the sxgbe_rx() function. When skb is NULL, an error is printed but then skb is dereferenced, potentially causing a kernel panic.

In the Linux kernel's AFS filesystem, a vulnerability exists due to delayed allocation of a cell's anonymous key. This can cause an oops when a key lookup uses an uninitialized key description. The issue is exacerbated by a previous fix for dynamic lookup failure.

A vulnerability in the Linux kernel related to a race condition in fbcon setup has been resolved, which could lead to out-of-bounds access in the fbcon_remap_all() function. The change involves protecting the vga_switcheroo_client_fb_set() function with a console lock.

In the Linux kernel's io_uring/net subsystem, a bug exists where vectored registered buffer imports use the wrong 'req' object instead of 'sr->notif'. This can lead to lifetime management issues.

In the Linux kernel, the mptcp_do_fastclose() function for MPTCP failed to initialize rcv_mss before calling tcp_send_active_reset(), causing a divide-by-zero in __tcp_select_window(). The issue was reported by syzbot and is analogous to a previous vulnerability in plain TCP (CVE-2025-68291).

In the Linux kernel, the amdgpu driver for AMD displays lacks a NULL pointer check before dereferencing in the dc_stream_get_scanoutpos function. This causes a NULL pointer dereference during the IGT kms_cursor_legacy test, leading to a system crash.

In the libceph library in the Linux kernel, BUG_ON was replaced with bounds checking for map->max_osd. OSD indexes come from untrusted network packets, so validation was added to prevent potential crashes.

In the Linux kernel, a vulnerability in the BFS filesystem was found where the S_IFMT bits of inode->i_mode can become corrupted when loading from disk. This is due to uninitialized upper 23 bits of the 'mode' field and lack of validation of the 'attributes' field, potentially leading to incorrect file type detection.

A use-after-free vulnerability was discovered in the Linux kernel's NVMe driver. The issue stems from improper lifetime management of the controller's admin request queue, which namespaces may access after controller teardown. The fix moves the controller reference release after all namespace references are freed.

A race condition was found in the ext4 filesystem in the Linux kernel regarding inline data size. The cached ei->i_inline_size value can become stale during write operations, leading to a system crash (BUG_ON).

A vulnerability in the Linux kernel ext4 filesystem lacks i_data_sem protection during inline data destruction, causing a race condition between inode modification and block mapping. This can trigger a kernel BUG and system crash.

A data race on the death_list in the Linux kernel's Rust Binder driver was found. An unsafe remove operation can run concurrently with moving items to a local list, corrupting prev/next pointers and causing system crashes.

An out-of-bounds read was found in the rtw_get_ie() IE parser in the staging rtl8723bs driver in the Linux kernel. The IE length was not validated, allowing reads beyond the frame buffer or infinite loops on malicious frames.

In the staging rtl8723bs driver in the Linux kernel, a stack buffer overflow was found during Association Request frame parsing. The Supported Rates IE length from the frame was used directly as the memcpy() length when copying into a fixed-size 16-byte stack buffer, allowing a malicious station to cause a stack overflow by advertising an IE length larger than 16 bytes.

An out-of-bounds read was found in the Extended Supported Rates (ESR) IE parsing in the OnBeacon function in the staging rtl8723bs driver in the Linux kernel. Lack of bounds checking can cause kernel panics on malicious beacon frames.

In the Linux kernel, the blocker tracking mechanism assumed lock pointers are at least 4-byte aligned to use their lower bits for type encoding. On architectures like m68k that only guarantee 2-byte alignment for 32-bit values, this assumption is broken, causing WARN_ON_ONCE warnings. The fix adjusts runtime checks to silently ignore locks that are not 4-byte aligned, disabling the feature in such cases.

In the Linux kernel's ksmbd module, a socket leak occurs when the per-IP connection limit is exceeded. The accepted socket is not closed, enabling a remote DoS attack.

In the NFS client (Linux kernel), a missing check of the cert_serial and privkey_serial fields in nfs_match_client() was found when using the TLS security policy of type RPC_XPRTSEC_TLS_X509. This could lead to incorrect client identification.

In the Linux kernel, a race condition in the IPv4 routing subsystem allows rt_bind_exception() to bind a new dst to a stale fnhe entry that is about to be freed, causing a permanent dst reference leak and device reference leak, visible as a hang during net device unregistration (e.g., sit interfaces).

In the Linux kernel, in the io_uring subsystem for network commands, the skb_queue_splice() function received transposed arguments when retrying timestamp retrieval. This caused packets to be spliced in the wrong direction, into the on-stack list instead of the socket queue. The fix reverses the arguments to restore correct behavior.

A race condition in the Linux kernel's veth driver can permanently stall the TX queue, observed on ARM64 systems (Ampere Altra Max). This leads to a complete halt of network traffic.

In the Linux kernel's SMB client, an incomplete backport of a fix misses a kref_put() call in cfids_invalidation_worker(). This can lead to a use-after-free (UAF) vulnerability.

A lockdep WARN was found in the NVMe multipath driver in the Linux kernel due to partition scan work. The dependency among open_mutex, kblockd workqueue, and partition scan can lead to a deadlock.

In the Linux kernel ice driver, a vulnerability was found due to improper cleanup of PTP resources during driver removal in an error path. Missing calls to ice_ptp_cleanup_pf and deinitialization of the 'ps_lock' mutex cause a warning and call trace when freeing the ice_adapter object.

In the Linux kernel's statmount_string() function, an uninitialized 'offp' pointer exists for STATMOUNT_MNT_UIDMAP and STATMOUNT_MNT_GIDMAP flags, which can lead to dereferencing uninitialized memory.

In the Linux kernel, the widen_imprecise_scalars() function in BPF fails to account for differences in stack depth between states, potentially causing out-of-bounds stack memory access.

In the DRM driver for Intel Xe GPUs (drm/xe/guc), a missing synchronization during device unbind allows the Dead CT worker to run after resources are freed, leading to a use-after-free condition.

In the Linux kernel netfilter subsystem, a vulnerability was found where the seqadj extension is missing for NATted connections when a conntrack helper is assigned. This causes kernel warnings and incorrect NAT translation for FTP traffic in PASV/EPSV modes, potentially leading to connection drops.

In the Linux kernel for AMD Zen5 CPUs, a missing terminator in the zen5_rdseed_microcode array causes an out-of-bounds read when running x86_match_min_microcode_rev().

In the Linux kernel, a vulnerability in the DRM driver for MSM (Qualcomm) chipsets has been fixed, which caused a warning (splat) when freeing imported DMA buffers (dma-buf). The issue occurred when msm_gem_free_object incorrectly handled the _NO_SHARE case for objects with an external reservation (resv).

In the Linux kernel DRM driver for Mediatek, a bug was found in AFBC (ARM Frame Buffer Compression) support. This feature, added in commit c410fa9b07c3, causes VBlank timeouts and garbled rendering on MT8188 (Genio 700 EVK) when AFBC is used by default by Mesa since v25.0. As a result, AFBC support has been disabled until a fix is available.

In the Linux kernel, a bug in the IMA module caused the IMA_DIGSIG flag to be cleared when setting or removing extended attributes (xattr) other than security.ima. In IMA and EVM fix mode, this replaced the IMA signature with a plain hash, preventing the generation of a valid reference signature.

In the iwlwifi driver in the Linux kernel, a potential use-after-free (UAF) exists in iwl_mld_remove_link(), where the 'fw_id' field is read after freeing the 'link' structure.

In the radeon DRM driver, calls to drm_put_dev() were removed but remained in error and device removal paths, causing double-free and use-after-free warnings.

On s390 architecture, enabling HVO optimization (ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP) causes crashes because kernel page table modifications violate architecture requirements – replacing entries without special instructions leads to data corruption.

In the Linux kernel driver for NXP i.MX8 ISI, a vulnerability was found where the release function incorrectly calls stream cleanup even when the stream is active. This causes kernel errors and warnings when device parameter queries (e.g., via v4l2-ctl) are performed during an active video stream.

In the Linux kernel's amd/amdkfd driver, a race condition was found between kfd_process release and partition switching, causing a division by zero in kfd_get_num_sdma_engines. The fix introduces an atomic counter kfd_processes_count to synchronize KFD process creation and teardown.

In the Linux kernel, during signal delivery to a non-AMX task preempted by an AMX task, the XFD state in the CPU is not synchronized, causing a warning and potential issues.

In the radeon DRM driver, the rdev structure is managed by devres, but kfree() was called in error paths, causing double-free and crashes.

In the JFS filesystem transaction manager in the Linux kernel, an uninitialized waitqueue was found. This causes a system crash when unmounting a read-only mounted filesystem.