Linux kernel vulnerabilities

In the Linux kernel for the nios2 architecture, memblock.current_limit is not set before determining memory limits. This can lead to kernel paging failures and system panic.

An uninitialized value bug was discovered in the __hfsplus_ext_cache_extent() function of the HFS+ filesystem in the Linux kernel. Reported by KMSAN, it can cause a kernel panic during write operations on an HFS+ partition.

A vulnerability was found in the Linux kernel's HFS filesystem, where the hfs_find_set_zero_bits() function reads uninitialized memory from the bitmap buffer. The issue is caused by using kmalloc() instead of kzalloc() for bitmap allocation, potentially leading to unpredictable behavior.

In the Linux kernel's GFS2 filesystem, there is a race condition in gdlm_put_lock. Between setting the DFL_UNMOUNT flag and releasing the lockspace, DLM may call callbacks on a freed glock object, leading to use-after-free.

In the Linux kernel, the EROFS filesystem lacks validation of encoded extents. Crafted images can cause integer wraparound and out-of-bounds access in compressed_bvecs[], leading to a system crash.

In the Linux kernel's SCTP protocol, a NULL pointer dereference vulnerability exists. When chunk->skb is NULL but chunk->head_skb is not, the code checks frag_list instead of skb, potentially causing a system crash.

In the Linux kernel's OCFS2 filesystem, a vulnerability exists where the extent map cache is not cleared after moving or defragmenting extents. This leads to stale extent flags being used, triggering a BUG_ON.

A race condition was found in the Linux kernel between SR-IOV enable/disable and hotplug operations. The previous fix using locks in sriov_del_vfs() and sriov_add_vfs() caused deadlocks when removing physical functions (PFs) with SR-IOV enabled. The new patch moves the lock to sriov_numvfs_store(), fixing the race without deadlock risk.

In the Linux kernel, io_uring/rsrc has an issue with calculating the offset of the first page in a folio after coalescing. The code uses incorrect bit mask logic that does not account for the lack of guaranteed alignment of user pointers.

In the Linux kernel, the xfrm/IPsec subsystem fails to delete fallback states (ipcomp) from lists/hashtables when the last user state is deleted, only when the last reference is gone. This can trigger a WARN in xfrm_state_fini and potential memory leak.

A vulnerability has been identified in the Linux kernel that allows for incorrect identification of socket states in the context of garbage collection. The issue arises from the lack of initialization of the SCC index in the unix_add_edge() function, leading to incorrect grouping of sockets in cyclic references.

In the Linux kernel's Bluetooth MGMT stack, crashes occur in set_mesh_sync and set_mesh_complete functions. The first is due to a stack out-of-bounds read, the second due to a double list_del.

In the Linux kernel, the NFS server (NFSD) removed the limit on operations per NFSv4 COMPOUND request, allowing an attacker to specify an arbitrarily large operation count. This causes massive memory allocation (e.g., 1.2 TB) and system crash.

In the Linux kernel's netfilter, validation of objref and objrefmap expressions is missing. Referencing a synproxy object from the OUTPUT hook causes infinite recursion and a kernel crash.

In the Linux kernel's Btrfs filesystem, the btrfs_encode_fh() function can write data out of bounds. This occurs when the file handle size is larger than originally reported.

In the Linux kernel, the listmount() function calls path_put() under the namespace semaphore, which can lead to a deadlock or crash if it is the last reference.

In the Linux kernel's IPMI driver, there is a problem with the user message limit, leading to incorrect counting and use-after-free. Code restructuring fixes these issues.

In the Linux kernel's sys_prlimit64(), there is a race condition when using task_lock(tsk->group_leader). A process can exit or exec, leading to use-after-free or taking the wrong lock.

In the Linux kernel's page_pool, the PP_MAGIC_MASK is too wide on some 32-bit architectures, causing false positives in page_pool_page_is_pp() and system crash.

In the Linux kernel's ext4 filesystem, the parse_apply_sb_mount_options() function may read beyond the buffer (buffer over-read). The s_mount_opts field in the superblock may not be NULL-terminated.

A bug in the Linux kernel quota mechanism causes a kernel panic when panic_on_warn is enabled. The issue occurs when the 'events_unbound' workqueue (without WQ_MEM_RECLAIM flag) is used for quota_release_work and then flushed by the 'writeback' workqueue with WQ_MEM_RECLAIM flag, triggering a WARN_ONCE due to dependency mismatch.

In the Linux kernel, the ext4 filesystem lacks protection against EA inode refcount underflow. This can lead to underflow and filesystem errors.

In the Linux kernel, the SCTP protocol in sctp_sf_do_5_1D_ce() can dereference a NULL pointer. When the ai_ev variable remains zero, it is passed to sctp_ulpevent_free(), causing a crash.

A vulnerability was found in the Linux kernel's TCP Fast Open (TFO) implementation. When a listening socket is closed while a TFO connection is being processed, a double-free of the request socket (reqsk) and a refcount underflow on the listener socket occur, potentially leading to use-after-free.

In the Linux kernel, a metadata_dst leak was found in __bpf_redirect_neigh_v{4,6} functions. The issue occurs when BPF uses bpf_redirect_neigh() to forward packets after VXLAN decap in collect md mode. VXLAN allocates metadata_dst and attaches it via a fake dst entry to the skb, but bpf_redirect_neigh() sets a new dst entry via skb_dst_set() without dropping the existing one first, leading to an ever-increasing memory leak.

In the Linux kernel's crypto skcipher, using cra_reqsize instead of crypto_skcipher_set_reqsize() causes memory corruption and crash. Initialization functions do not set reqsize correctly.

In the Linux kernel on x86, switch_mm_irqs_off() lacks a memory barrier (smp_mb()) between the loaded_mm store and the tlb_gen load. This can cause context switching to miss a tlb_gen update and fail to flush TLBs, leading to stale data usage.

In the Linux kernel's IPv6 tunnel (ip6_tunnel), there is no limit on headroom growth, leading to perpetual tunnel expansion. A similar issue in IPv4 has already been fixed.

In the accel/qaic driver of the Linux kernel, the function find_and_map_user_pages() may return 0 before allocating an sgt when the DMA request length is 0 or when the device requests continuation after all bytes have been transferred. This leads to a general protection fault when accessing the uninitialized sgt.

In the Linux kernel's NVMe over Fabrics subsystem (nvmet-fc), a reference leak occurs for the target port (tgtport). When multiple LS commands are in flight, only one work item is queued, leading to unreleased references.

In the Linux kernel's networking stack, the sk_setup_caps() function uses unprotected access to dst->dev, which can lead to use-after-free (UAF). The fix introduces RCU protection for the access.

In the BPF verifier of the Linux kernel, the check_alu_op() function accepts negative values for the 'offset' field in ALU instructions because the condition 'insn->off > 1' passes all negative values. The fix tightens validation to require offset to be exactly 0 or 1.

In the Linux kernel, the SMC subsystem function smc_clc_prfx_match() uses sk_dst_get(sk)->dev without proper RCU or RTNL locking, potentially leading to use-after-free on the device structure.

In the Linux kernel's ext4 filesystem, there is no validation for an invalid combination of INLINE_DATA and EXTENTS flags in an inode. This combination can lead to a BUG_ON in ext4_es_cache_extent() due to integer underflow.

In the drm/xe/guc driver of the Linux kernel, during forced driver unbind, an exec queue may still be running and deregistration via GuC fails because CT communication is already disabled. This leads to resource leaks and memory management errors.

In the Linux kernel, a vulnerability in the NXP i.MX8 ISI (Image Sensor Interface) M2M driver causes improper streaming cleanup. Imbalanced streamon/streamoff calls (e.g., when exiting an application with Ctrl+C) prevent the usage_count from reaching zero, leaving the ISI channel unfreed. Additionally, an input line width over 2K triggers a WARN_ON().

A vulnerability in the Linux kernel related to the use of smp_processor_id() in preemptible code has been fixed. The bug report concerned a warning generated by dhcpcd, indicating improper use of this function in a preemptible context.

In the XSK (AF_XDP) subsystem of the Linux kernel, the xdp_desc validation functions do not reject certain invalid values, such as desc->len close to U32_MAX with non-zero tx_metadata_len, which can lead to integer overflows and transmission of invalid frames.

In the Linux kernel, the IPv6 stack's ip6_output() function did not use RCU, allowing a use-after-free (UAF) when accessing the device via dst_dev_rcu(). The fix adds RCU and removes unnecessary rcu_read_lock/unlock pairs from ip6_finish_output2().

In the Linux kernel iommu/vt-d driver in legacy mode, the page table dump logic incorrectly accesses an uninitialized SSPTPTR register when the Translation Type (TT) is not 00b or 01b, causing a general protection fault and kernel oops.

In the Linux kernel for LoongArch architecture, a vulnerability was found in the BPF implementation that does not support struct arguments in trampoline programs. Running the 'tracing_struct' bpf selftest causes an Oops error and potential system hang.

In the Linux kernel, a vulnerability was found in the TLS mechanism where get_netdev_for_sock() called during setsockopt() was not under RCU, potentially causing a use-after-free (UAF) via sk_dst_get(sk)->dev. The fix replaces calls with __sk_dst_get() and dst_dev_rcu() to ensure safe access to the destination structure.

In the Linux kernel, the rtl8150 USB driver's rtl8150_set_multicast function calls netif_stop_queue and netif_wake_queue, disrupting TX queue synchronization. This can lead to double URB submission and a warning in rtl8150_start_xmit.

In the SMC subsystem of the Linux kernel, the function smc_clc_prfx_set() uses sk_dst_get(sk)->dev without RCU or RTNL protection, which can lead to a use-after-free (UAF) during connect() calls.

In the Linux kernel, the ip6_xmit() function lacked RCU protection, leading to a potential use-after-free (UAF) vulnerability. The fix introduces RCU to safely access the network device structure.

In the Linux kernel's MPTCP subsystem, the mptcp_active_enable() function may use sk_dst_get(sk)->dev without RCU protection, leading to a use-after-free (UAF) vulnerability.

In the Linux kernel, a null pointer dereference (NPD) was found in xdr_stream_decode_opaque_auth() (sunrpc module) when the checksum length is zero. When checksum.len is 0, checksum.data is set to NULL, triggering an NPD when accessing checksum.data in gss_krb5_verify_mic_v2(). The fix ensures checksum.len is not less than XDR_UNIT.

In the Linux kernel for SPARC architecture on UltraSPARC III, a bug was found in copy_from_user and copy_to_user functions. Exception handling incorrectly calculated remaining bytes to copy, potentially returning impossibly large values and causing BUG_ON in filesystems like ext4.

A vulnerability was found in the Linux kernel's BPF subsystem where bpf_prog_test_run_xdp() can cause a NULL pointer dereference. The issue arises from missing enforcement of expected_attach_type during tailcalls, allowing BPF programs to access unauthorized data.

In the Linux kernel's pm80xx SCSI driver, an out-of-bounds array access was found during module removal (rmmod). For devices behind an expander, the attached_phy ID can exceed the number of local phys, causing indexing beyond the phy array.