Linux kernel vulnerabilities

In the Linux kernel, the net/sched/sch_fq_codel module has a vulnerability where qdisc_tree_reduce_backlog is called during peek before restoring the qlen counter. This can lead to incorrect deactivation of the parent class and, consequently, to a wild memory access in the qfq scheduler, manifesting as a general protection fault.

In the Linux kernel's airoha network driver, there is a heap buffer overflow in the foe_check_time function. The array is declared as a u16 pointer but allocated with only ppe_num_entries bytes instead of ppe_num_entries * sizeof(u16), leading to out-of-bounds writes.

In the Linux kernel, a vulnerability was found in the LWT (Lightweight Tunnels) mechanism. During LWT encapsulation, skb metadata (passed between XDP and TC) located in the packet headroom is overwritten or cleared, leading to warnings and errors, especially for forwarded packets carrying XDP metadata. The issue affects all LWT encapsulation types (mpls, seg6, ioam6, BPF) and all LWT redirect modes.

In the Linux kernel, the qede driver had an out-of-bounds check issue in cqe->len_list[], where the index check was performed after element access. The fix moves the index check before the access.

In the Linux kernel, the parse_dcc() function in netfilter nf_conntrack_irc had an off-by-one error leading to an out-of-bounds read. It treated the end pointer as inclusive, while the caller passed a pointer one past the last valid byte. The fix changes the loop to strict less-than, consistent with the caller's convention.

In the Linux kernel, the batman-adv dat module does not reassign the ARP hardware source pointer after pskb_may_pull() reallocates the buffer. This can lead to a use-after-free condition.

A vulnerability in the Linux kernel block subsystem was found where the timeout timer is not stopped when releasing a disk that was never added (e.g., after a failed probe). This leads to a use-after-free in the timer mechanism, potentially causing system crashes or privilege escalation.

In the Linux kernel's MPTCP module, a vulnerability was found due to lack of rejection of mutually exclusive incoming MPTCP suboptions. An attacker can send a packet with a combination of suboptions that according to RFC 8684 cannot coexist, potentially leading to unexpected network stack behavior. The fix introduces validation consistent with outgoing rules, ignoring invalid combinations.

In the Linux kernel's MPTCP module, a remote peer can send a malformed DSS with an incorrect size, causing the first suboption to be ignored but leaving some fields written, potentially leading to inconsistency or access to uninitialized data. The fix explicitly resets fields that could have been modified in case of unexpected size.

In the Linux kernel's MPTCP module, mptcp_fastopen_subflow_synack_set_params() set the is_mptfo flag before checking for queued SYN data. This caused data-less TFO SYNs to trigger a WARN and leave stale MPTFO state, potentially leading to a state-confusion bug in check_fully_established(). The fix marks the subflow as MPTFO only after confirming that an SKB was queued.

In the Linux kernel, the decode_locker() function in cls_lock_client.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads. Missing bounds checks before copying the name, an unchecked pointer advance, and an uncapped length value can lead to memory corruption. The fix replaces unsafe operations with safe variants and returns -EINVAL on any bounds violation.

In the Linux kernel, libceph may use invalid OSD indices from primary_temp in a corrupted osdmap, leading to out-of-bounds reads. The fix adds validation of indices in get_temp_osds().

In the Linux kernel, libceph's decode_watchers() lacked a bounds check before reading a 32-bit value, leading to an out-of-bounds read when struct_len=0. The fix uses the safe variant ceph_decode_32_safe.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is no limit on the number of channel program segments. Processing is recursive, which can lead to exceeding the global limit and potential issues.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a lack of verification that the first IDAW remains constant between reads. This can lead to an inconsistent set of IDAWs.

In the Linux kernel, the ovpn driver's crypto completion callbacks hold references to the key slot and peer. If the peer reference is released before the callback finishes, it can lead to use-after-free or scheduling an RCU callback after rcu_barrier has run, risking a crash.

In the Linux kernel's SCTP protocol, the COOKIE_ECHO state restoration does not properly validate AUTH fields (RANDOM, HMACS, CHUNKS) originating from peer-controlled cookie bytes. Forged lengths or identifiers can lead to out-of-bounds reads and even a write past a buffer, potentially enabling local privilege escalation.

In the Linux kernel for RISC-V, the ZBB-optimized strnlen loop may read one word past the count boundary when the start address is aligned and count is a multiple of word size. This can cause a page fault if the next page is unmapped.

In the Linux kernel, the netfilter flowtable module has a vulnerability where the original-direction tuple node is published before the reply node, allowing the garbage collector to observe and free a flow while it is still being installed. This can lead to slab-use-after-free in the flowtable/rhashtable path, detected by KASAN.

In the Linux kernel, ipvlan interfaces do not inherit needed_headroom and needed_tailroom from the physical device, which can lead to insufficient space reservation for headers and trailers. This results in buffer overflows, headroom underflows, or KASAN slab-use-after-free crashes.

In the Linux kernel, macvlan interfaces do not inherit needed_headroom and needed_tailroom from the lower device, which can lead to insufficient space reservation for headers and trailers. This results in buffer overflows, headroom underflows, or KASAN slab-use-after-free crashes.

In the Linux kernel, the am65-cpsw-nuss driver has a bug in extracting the port ID from the source tag. It uses the full 16 bits, while only the lower 8 bits represent the port ID, which can lead to out-of-bounds memory access and system crash.

In the Linux kernel, in NFS, the FREE_STATEID operation could be delayed, leading to a use-after-free of the 'struct nfs_server' object. The fix bumps the refcount of this object for the duration of the FREE_STATEID call to prevent cleanup while operations are in flight.

A race condition in the Linux kernel's ovpn subsystem between peer deletion and rehashing operations can resurrect already-removed peers in hash tables, leading to a use-after-free (UAF) vulnerability.

A vulnerability in the Linux kernel's btrfs filesystem was found in LZO decompression for inline extents. A crafted btrfs image can trigger an out-of-bounds read (KASAN: slab-out-of-bounds) when reading a file, leading to a system crash or potential security compromise.

In the Linux kernel, a vulnerability in the vdpa/mlx5 driver leads to a slab-out-of-bounds read. The issue is caused by incorrect calculation of the input buffer size in create_direct_keys(), resulting in reading 16 bytes beyond the allocated region.

In the Linux kernel, __skb_udp_tunnel_segment() has a potential use-after-free vulnerability. It gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb->head, the saved UDP header pointer becomes invalid.

In the Linux kernel, the SCTP protocol has a use-after-free vulnerability. sctp_make_heartbeat_ack() caches a pointer to the transport without taking a reference, and when the transport is removed, a queued control chunk may retain a dangling pointer, leading to memory corruption.

In the Linux kernel, IPVS does not clear IPv4 options after rebasing tunnel ICMP errors, potentially leading to a stack out-of-bounds write via __ip_options_echo().

In the Linux kernel, generic XDP fragment adjustment leaves skb->len stale, causing skb_headlen() to be larger than the actual linear area. In the UDP receive path, this can copy data beyond the linear area to userspace.

In the Linux kernel inet_frag_create(), the fragment queue timer is armed before the queue is published in the hash table. If the fragment timeout is zero or negative, the timer can run before publication, causing a race and leaving a stale hash node.

In the Linux kernel, the X.25 protocol has a use-after-free vulnerability of the socket by its timers. Timers are armed with mod_timer() and cancelled with timer_delete(), so a pending timer holds no reference on the socket and a cancel does not wait for a callback already running on another CPU. x25_heartbeat_expiry() also rearms unconditionally, which can lead to use-after-free.

In the Linux kernel, the dibs module initializes the dibs->lock too late, only in dibs_dev_add(), while interrupts can occur earlier. This can lead to use of an uninitialized lock in interrupt handling.

In the Linux kernel, xdpf_clone() creates clones of XDP frames but does not sufficiently check whether data fits within the skb_shared_info tailroom. This can lead to data corruption when converting a clone to an skb.

A vulnerability in the Linux kernel's veth interface was found where skb length accounting was incorrect after XDP fragment adjustment, leading to copying data beyond the actual linear area, including kernel pointers, to userspace. Additionally, bpf_xdp_pull_data() could trigger SKB_LINEAR_ASSERT() due to improper tail pointer management.

In the Linux kernel, in TLS RX, during optimistic TLS 1.3 zero-copy attempt, the msg_iter pointer is not restored after a failed attempt, which can lead to overwriting data in the receiver's buffer.

In the Linux kernel, in the SMB client, cifs_try_adding_channels() can use-after-free an interface when channel creation fails and the interface list is refreshed concurrently.

In the Linux kernel, the ip6ip6_err() function clones an outer IPv6 ICMP error skb and passes it to icmpv6_send() without clearing the outer packet's metadata in skb->cb. This can lead to out-of-bounds access on the quoted inner packet and corruption of skb_shared_info.

A vulnerability was found in the Linux kernel's __filemap_add_folio() function in mm/filemap. During retries of inserting a folio into the xarray, the index was not restored to its original value, potentially placing the folio at an incorrect (rounded-down) index. This caused rare SIGILL and SIGSEGV errors in production, as executable text was found in the wrong page.

In the Linux kernel, the SCTP protocol has a bug where a chunk's transport pointer is not updated when moved to another transport's list. This can lead to use-after-free when the transport is removed and the pointer becomes stale. The fix sets chunk->transport during the move.

In the Linux kernel, the SCTP protocol has a use-after-free vulnerability in the ASCONF mechanism. The cached ASCONF chunk is not properly cleared after release, leading to access to stale memory. The fix clears the addip_last_asconf pointer after release and protects against a race with T4 expiry.

A use-after-free vulnerability was found in the Linux kernel's SCTP subsystem. An authenticated remote SCTP peer can add and remove a transport within a single ASCONF chunk, leaving the new_transport pointer dangling. Subsequent operations (e.g., sending a HEARTBEAT) may read freed memory, as shown by a KASAN report in sctp_outq_select_transport.

In the Linux kernel, the fib6_rule_suppress() function (IPv6 routing) does not clear the res->rt6 pointer after dropping a route, which can lead to use of a freed rt6_info object and trigger rcuref_put_slowpath() during release.

In the Linux kernel, the iommu/arm-smmu-v3-iommufd subsystem has a vulnerability where arm_vsmmu_vsid_to_sid() maps a guest's vSID to a single physical Stream ID, assuming a device has exactly one stream. Devices with multiple streams get only the first one mapped, so vSID invalidations cannot reach the others' ATC and IOTLB entries; devices with none cause an out-of-bounds read. The fix adds an arm_vsmmu_vdevice_init() op to reject the vDEVICE with -EOPNOTSUPP when master->num_streams is not one.

In the Linux kernel, the NTFS filesystem has a vulnerability related to unsafe size calculations during runlist reallocation. A shared helper was added to safely convert runlist element counts to byte sizes with overflow checks, used in ntfs_rl_realloc() and ntfs_rl_realloc_nofail().

In the Linux kernel, the netfilter nf_conntrack_sip module has a vulnerability due to an s16 overflow in the size change counter during NAT rewriting. A single SIP message can grow by more than 32767 bytes, causing the counter to wrap and leading to an out-of-bounds read (use-after-free).

In the Linux kernel's KVM/arm64 VGIC subsystem, a race condition exists between releasing an LPI structure and re-registering it. This can lead to deletion of a newly registered LPI from the xarray or to a memory leak of the old structure. The issue is triggered by guest operations such as DISCARD and MAPTI.

In the Linux kernel, the libiscsi_tcp module lacked a check on the data segment size in SCSI responses, which could lead to overflow of the conn->data buffer (8192 bytes) by a malicious iSCSI server. The vulnerability affects the ISCSI_OP_SCSI_CMD_RSP path, where the data segment (sense/response data) was copied without proper bounds.

In the Linux kernel, the rtase driver has a double free of multi-frag skb on DMA map failure. When the head buffer DMA mapping fails after fragments are mapped, the error path frees the skb twice, leading to a crash.

In the Linux kernel's SMB server (ksmbd), a vulnerability was found in the comparison of ClientGUIDs. ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. Using strncmp() stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equal.