Linux kernel vulnerabilities

In the gpiolib library in the Linux kernel, the debugfs function gpiolib_seq_start() fails to initialize s->private before memory allocation, leading to invalid pointer dereference in gpiolib_seq_stop().

In the Linux kernel, a vulnerability in the Ceph filesystem's MDS authentication caps check was found in a multi-filesystem (multifs) setup. The lack of fsname validation causes permissions granted for one filesystem to be incorrectly applied to another, allowing a user to write or delete files on a filesystem where they should have only read access.

In the Linux kernel for RISC-V, KASAN falsely reported an out-of-bounds error when unwinding the stack of a non-current task. The issue was fixed by disabling KASAN checks for such tasks, similar to a previous x86 patch.

In the rockchip-sfc SPI driver in the Linux kernel, incorrect DMA-API usage occurs where virt_to_phys() is used instead of dma_map_single(). This causes DMA-API debug warnings and potential synchronization issues.

In the AMD display driver for the Linux kernel, the maximum link count was increased from 12 to 14 to match actual connections. A NULL pointer access for LINK_ENC on non-display endpoint DPIA devices was also fixed.

In the Linux kernel, the HFS+ filesystem lacks validation of record offset and length in the hfsplus_bmap_alloc function, potentially causing a slab-out-of-bounds read and system crash.

In the Linux kernel, in the ASoC Intel avs driver, a use-after-free vulnerability was found when closing a PCM stream. The avs_dai_fe_shutdown() function frees the DAI private context while the period-elapsed work may still be active, potentially leading to memory errors.

In the Linux kernel, the NVMe over Fabrics (nvme-fc) driver lacks synchronization when accessing port and rport state. The nvme_fc_unregister_remote function can remove a remote port during a reconnect attempt, causing a race condition.

In the Linux kernel, in the stmmac driver (network MAC controller), a vulnerability was found in the incorrect handling of checksum errors in the stmmac_rx function. Even when the hardware reports a checksum error, the packet was marked as CHECKSUM_UNNECESSARY, which could allow corrupt packets to be passed up the network stack.

In the Linux kernel's DRM subsystem (drm/gpusvm), improper use of the hmm_pfn_to_map_order() function was found. When the hmm range partially covers a huge page (e.g., 2 MB), memory outside the range may be mapped, leading to undesirable effects. The fix is based on the xe driver's userptr code.

In the Linux kernel's drm/amdgpu driver, a lack of validation of the virtual address and size of the userq object was found before use. It is necessary to verify that the userq object resides in a valid VM mapping.

In the Linux kernel, the SCTP protocol has a TOCTOU vulnerability in sctp_diag_dump. The address list may change between buffer allocation and write, leading to an out-of-bounds write.

In the Linux kernel, a potential use-after-free (UAF) vulnerability was found in the SMB client's smb2_close_cached_fid() function. The issue arises because find_or_create_cached_dir() could grab a new reference after kref_put() saw the refcount drop to zero but before cfid_list_lock is acquired. The fix switches to kref_put_lock() so cfid_release() is called with cfid_list_lock held, closing that gap.

In the Linux kernel's Bluetooth L2CAP module, a use-after-free was found in l2cap_disconnect_{req,rsp} functions. The issue occurs when a channel is freed and then referenced without proper protection.

In the Linux kernel, the ath11k driver had a crash when processing fragments from an uninitialized peer. When maximum virtual AP interfaces are configured in all bands with ACS and hostapd is restarted every 60 seconds, a crash may occur due to an uninitialized fragment list.

In the Linux kernel, in the RDS subsystem, a lockdep issue was found in the rds_tcp_reset_callbacks() function. The cancel_delayed_work_sync() function is called in a section protected by lock_sock(), which may lead to a deadlock.

In the Linux kernel, in the RDMA/rxe subsystem, a NULL pointer dereference error was found. When queue initialization in rxe_qp_init_req fails, the fields qp->req.task.func and qp->req.task.arg are not initialized, which may lead to a crash.

In the Linux kernel's ext4, a deadlock occurs due to mbcache entry corruption where the e_reusable bit is updated non-atomically, causing an infinite loop in ext4_xattr_block_set(). The fix uses atomic bit operations.

In the Linux kernel, the lib/mpi library's mpi_cmp_ui() function can dereference a null pointer when 1 is passed as the second parameter. An attacker can exploit this during NVMeTCP authentication by specifying the 8192-bit Diffie-Hellman group and a zeroed value.

In the Linux kernel, the NFC pn533 driver has a vulnerability causing a slab-out-of-bounds read. The issue is due to improper initialization of the nfc_target structure, which may contain garbage values, leading to an oversized sensb_res_len.

In the Linux kernel, the ath11k driver has a vulnerability causing a crash when bringing up an interface in monitor mode. The issue is due to packet type extraction for RAW packets in the MSDU delivery path, leading to a NULL pointer dereference. The fix skips this extraction for monitor packets by adding the RX_FLAG_ONLY_MONITOR flag.

In the Linux kernel, NFSD lacks handling for the new time_deleg FATTR4 attributes in GETATTR requests. The server may crash if a client sends an invalid GETATTR for these attributes. According to RFC specification, such usage is invalid, and NFSD will return nfserr_inval.

A use-after-free vulnerability was discovered in the Linux kernel's fbcon driver. During framebuffer unregistration, the mode list memory is freed but the pointer in fb_display[] is not set to NULL, leading to access of freed memory during subsequent operations on other framebuffers.

In the fbdev (bitblit) subsystem of the Linux kernel, a missing bounds check for the font glyph index was found. This could lead to an out-of-bounds read of the built-in font array.

In the Linux kernel, a race condition in the BPF ring buffer could queue irq_work before buffer freeing, causing use-after-free. The fix synchronizes irq_work before freeing the buffer.

In the Linux kernel's Bluetooth stack (hci_sync), a race condition in hci_cmd_sync_dequeue_once allowed double list deletion and use-after-free (UAF). The fix holds the lock across both lookup and cancel operations.

A bug in the Linux kernel's regmap initialization for the SLIMbus bus uses an incorrect bus_context pointer. The issue was exposed after a change in the WCD934x codec driver, causing a memory page fault during audio playback on the Dragonboard 845c board.

A use-after-free vulnerability was discovered in the Linux kernel's Bluetooth SCO driver. The sco_conn_free function can be called on already freed memory, leading to a security breach.

In the Linux kernel's exfat filesystem, cluster allocation bits in the bitmap were not validated. An attacker could craft an exfat image with an invalid bitmap, causing overwrite of existing entries during directory creation. The fix adds validation that bitmap clusters are marked as in-use.

In the Linux kernel's OrangeFS (orangefs) filesystem driver, a buffer overflow vulnerability was found in extended attribute (xattr) handling. The helper function `xattr_key()` incorrectly checks the loop condition, causing an infinite loop and potential system hang. Additionally, incorrect use of the `hash_add` macro led to memory leaks and unfreed allocations.

In the fbdev (bit_putcs) subsystem of the Linux kernel, missing bounds checking when rendering text near screen edges was found. This could lead to out-of-bounds writes to the framebuffer.

In the Linux kernel, a vulnerability in Btrfs allows dirty metadata to be written back after an error, causing use-after-free with RAID56 metadata. The issue occurs because metadata writes are not discarded when the filesystem is in an error state, leading to queued work on already stopped workqueues.

In the Linux kernel, the videobuf2 driver lacks protection against calling the remove_bufs ioctl while legacy fileio mode is active. This could overwrite pointers used by fileio and corrupt the internal queue state.

In the Linux kernel's Bluetooth stack (hci_event), the skb length was not checked before reading data for an unknown opcode in command complete events, potentially using uninitialized memory. The fix adds a length check.

In the Linux kernel's network bridging subsystem (net/bridge), a use-after-free was found when deleting an expired FDB entry. The issue is due to a race condition between FDB learning and port deletion when MST is enabled and VLAN filtering is disabled. MST bypasses the port state, allowing FDB learning at an inappropriate time.

In the virtio-net driver of the Linux kernel, an incorrect length check for received big packets was found. This could lead to a NULL pointer dereference and system crash.

In the Linux kernel's io_uring subsystem, the number of segments calculated by io_estimate_bvec_size was truncated, causing data corruption. The fix checks that the value does not overflow int range.

In the Linux kernel, a vulnerability in the XSK (AF_XDP) mechanism stores the descriptor number in the skb control block, causing data corruption. After transmission, other subsystems can overwrite this block, leading to a NULL pointer dereference and kernel panic.

In the Linux kernel's Bluetooth stack (MGMT), the mesh_send_done timer was not canceled when the hdev was removed, causing use-after-free when the timer fired. The fix cancels the timer on hdev removal.

In the Bluetooth btusb driver in the Linux kernel, a use-after-free (UAF) vulnerability was found during device disconnection. The issue is due to incorrect resource cleanup order.

In the Linux kernel, the Bluetooth 6lowpan stack is missing a skb_reset_mac_header() call on the uncompressed IPv6 receive path. This causes a kernel crash when receiving packets via AF_PACKET SOCK_RAW sockets.

In the Linux kernel, the drm/panthor driver fails to flush shmem writes before mapping buffers as CPU-uncached. This may leave dirty cache lines, leading to potential data leaks or buffer corruption.

A use-after-free vulnerability was found in the Linux kernel's KVM guest_memfd, where bindings between a memslot and a guest_memfd instance are not properly removed when the memslot is deleted before the file is fully released. This leads to writing to freed memory.

In the Linux kernel, a vulnerability in NFSD causes the copynotify stateid not to be freed when the parent stateid is released in nfs4_free_ol_stateid(). This leads to a warning and potential list corruption when the laundromat later tries to free it, possibly resulting in a system crash (Oops).

In the Linux kernel, the secretmem mechanism has a use-after-free bug in the fault handler. Concurrent page faults can cause a folio to be freed before restoring the direct map, leading to a supervisor page fault.

In the Linux kernel, the VMA readahead mechanism for swap has a potential Use-After-Free (UAF) vulnerability. During swap device switching, a freed memory reference may occur when VMA readahead tries to read swap entries from another device without proper reference.

In the ALSA USB-audio driver in the Linux kernel, the PCM packet size may exceed the wMaxPacketSize limit from the USB descriptor, causing a transfer buffer overflow. There is no validation of the packet size before use.

In the Linux kernel, KVM for ARM64 lacks offset validation in the FF-A memory share operation. An untrusted large offset can cause out-of-bounds access in the hypervisor buffer.

In the Linux kernel's s390/ctcm driver, a double-free was detected in the ctcmpc_unpack_skb function. The mpc_rcvd_sweep_req function frees the passed mpcginfo pointer, and then ctcmpc_unpack_skb frees it again, leading to a double-free.

In the Linux kernel, the gpio/cdev driver has a use-after-free risk. A GPIO event may be emitted after the file descriptor's reference count reached zero but before .release() is called.