Linux kernel vulnerabilities

In the mt7915 driver, there is a race condition when clearing the wcid mask in remove_interface(). The mask is cleared without holding the mutex and before clearing the RCU pointer, which can lead to wcid leaks, double allocation, or even removal.

In the mt7996 driver, there is a bug in the TLV walk in mt7996_mcu_get_chip_config. The loop advances by tlv->len without a minimum, so a zero-length TLV could cause an infinite loop, and an out-of-bounds read is also possible.

In mt76 drivers, the mmio_write_copy and mmio_read_copy functions iterate up to ALIGN(len,4), so a length not a multiple of four reads past the source buffer or writes past the destination.

In the Linux kernel, mt7915_add_interface() in the mt76 wifi driver fails to unwind state when adding an interface fails. When mt76_wcid_alloc() fails, the function returns without clearing the vif_mask/omac_mask bits it set, without removing the firmware dev info added earlier, and without clearing a monitor_vif pointer to a vif mac80211 is about to free. Since mac80211 does not call remove_interface() for a failed add, indices and the firmware dev entry leak permanently and testmode could dereference the stale monitor_vif.

In the Linux kernel, mt7996_mcu_beacon_cntdwn() in the mt76 wifi driver (mt7996) emits two bss_bcn_cntdwn_tlv entries (the CSA countdown and the CCA-abort BCC), but MT7996_BEACON_UPDATE_SIZE only reserved one. With MBSSID enabled and a near-maximum beacon template, the extra 8 bytes could push the offload command past MT7996_MAX_BSS_OFFLOAD_SIZE and trigger skb_over_panic().

In the Linux kernel, both mt76 wifi drivers cancelled dump_work on unregister but left reset_work and rc_work to be flushed only by destroy_workqueue() in mt76_free_device(), which runs after the hw is unregistered and the hardware stopped. A reset_work that fires in that window calls ieee80211_restart_hw() and re-arms mac_work on an unregistered hw, and rc_work touches station state being torn down.

In the Linux kernel, acpi_processor_driver_init() registers the cpufreq policy notifier before registering the ACPI processor driver and setting up CPU hotplug state. If driver_register() or cpuhp_setup_state() fails, the error path only unregisters the ACPI processor driver and the idle driver, leaving the cpufreq notifier registered even though initialization failed.

In the Linux kernel, MDP4/MDP5 MSM display drivers double-free KMS state during failed initialization, causing a use-after-free. The error path in msm_drm_init() calls cleanup again after the driver already destroyed the KMS, leading to a crash.

In the Linux kernel, the drm/msm/dsi driver calls dev_pm_opp_set_rate(0), which removes the vote specified in required-opps but does not actually park the clock, making it run without the necessary power backing. The fix drops the explicit call; every call site of ops->link_clk_disable() is followed by pm_runtime_put(), so the power vote will be rescinded if deemed safe.

In the Linux kernel, ath11k_service_ready_ext_event() in the ath11k wifi driver can allocate svc_rdy_ext.mac_phy_caps during TLV parsing. This is a temporary allocation freed on the success path but not on the error path — if parsing succeeds far enough to allocate mac_phy_caps and then fails on a later TLV, the allocation leaks.

In the Linux kernel, regulator_init_complete_work uses schedule_delayed_work() with system_wq, which is non-freezable, allowing it to run concurrently with system suspend. This work fires ~30s after boot to disable unused regulators via I2C; when it races with PM suspend, the I2C adapter may already be suspended, triggering a -ESHUTDOWN warning in __i2c_transfer().

In the Linux kernel, btf_distill_func_proto() builds the function model used for fentry/fexit/fmod_ret/fsession trampolines and struct_ops, having accepted a 16-byte __int128 return value since the trampoline was introduced. However, the BPF trampoline preserves only 8 bytes of the return value (RAX/R0), so for attach types that read the target's return value (fexit, fmod_ret, fsession plus their _multi variants, and struct_ops) the second half is neither saved nor restored, corrupting the value seen by the real caller.

In the mt76 wifi driver (mt7996), mt7996_mac_reset_vif_iter() queues non-default vif links for kfree_rcu while dev->wcid[] still holds pointers to the wcid embedded in each freed link. mt76_reset_device() then dereferences those entries and runs mt76_wcid_cleanup() on them; if a grace period elapses in between, the cleanup operates on freed memory.

In the mt76 wifi driver (mt7996), after a full chip reset the reset path frees link structures without clearing bits in mvif->valid_links, so mac80211's replayed setup never re-creates dev_info/bss_info/STA records and never re-registers the link wcid, leaving the device inoperative. The reset path also leaks every allocated MLD index, exhausting the index space on repeated resets.

In the mt76 wifi driver (mt7915), mt7915_pci_init_hif2() was called unconditionally and again inside the WED-inactive branch. This double-incremented the global hif_idx, wrote the PCIe RECOG_ID register twice, and leaked a device reference, since removal only drops one reference.

In the mt76 wifi driver (mt7915), the hif2 reference obtained by mt7915_pci_init_hif2() is only released on error paths that key off dev->hif2, which is not assigned until after the IRQ setup. If pci_alloc_irq_vectors() or the primary devm_request_irq() fails, the reference leaks.

In the mt76 wifi driver (mt7996), if the WED attach for the primary PCIe function fails, the probe path still attaches wed_hif2 for the secondary function, leaving the device in an inconsistent half-WED configuration that crashes later. The hif2 call also re-enabled hwrro_mode, which the failed primary attach had just turned off.

In the mt76 wifi driver, mt76_vif_link() indexes mvif->link[] without validating link_id, but callers pass mvif->deflink_id / msta->deflink_id, which hold IEEE80211_LINK_UNSPECIFIED (0xf) until the first link has been added. Since IEEE80211_MLD_MAX_NUM_LINKS is 15, that reads one element past the end of the array, aliasing mt76_vif_data.offchannel_link.

In the mt76 wifi driver (mt7996), when mac80211 leaves the link unspecified, mt7996_tx() substitutes the primary link id of the station or vif. That value is IEEE80211_LINK_UNSPECIFIED (0xf) until the first link has been added, and it is then used unchecked to index vif->link_conf[], mvif->mt76.link[] and sta->link[], all of which hold 15 entries.

In the Linux kernel's ath10k driver for SNOC (WCN3990), copying the MSA region to a crash dump uses plain memcpy() which performs unaligned accesses on a MEMREMAP_WT mapping. This causes an alignment fault and kernel crash during devcoredump collection, and zeroes the dump buffer.

In the Linux kernel's nl80211_color_change() function there is a memory leak when processing beacon_next data. If beacon_next parsing fails, allocated parameters (such as mbssid_ies and rnr_ies) are not freed because the function returns an error directly instead of using the out: cleanup path.

In the Linux kernel's brcmfmac driver there is an issue with handling P2P action frames when no P2P device vif exists. Some paths assume the vif is always available, which is not true for public action frames sent through the primary interface or when action-frame abort runs before P2P vif creation.

In the Linux kernel's mac80211 subsystem there is an erroneous handling of channel zero during CSA (Channel Switch Announcement) parsing. The refactor incorrectly equated channel zero with no information, so an AP advertising a switch to invalid channel 0 did not trigger a disconnect, which could lead to firmware crashes on some Intel devices.

In the Linux kernel's BPF arena, there is a potential deadlock on mmap_lock when arena_vm_fault() fails to take the arena spinlock. The function returns VM_FAULT_RETRY without having dropped mmap_lock, causing it to be taken twice on retry and leading to a deadlock.

In the Linux kernel's pinctrl (generic) subsystem there is a memory leak in the pinctrl_generic_to_map() function. If any subsequent step (mux, group, config) returns an error, the *maps pointer may contain partially allocated entries that are not freed, causing memory leaks for all drivers relying on this function.

In the Linux kernel for PowerPC, a vulnerability was found in syscall handling after enabling GENERIC_ENTRY. When seccomp or ptrace intercepts a syscall and sets a return value, system_call_exception() did not handle the -1 sentinel, overwriting the set value with -ENOSYS. The fix introduces a thread flag to track explicit return value setting and prevents overwriting.

A vulnerability exists in the Linux kernel's amba-pl011 serial console driver. The pl011_console_write_atomic() function runs in nbcon atomic context and calls clk_enable(), which under PREEMPT_RT can sleep, triggering a "sleeping function called from invalid context" bug. This affects arm32 and arm64 Device Tree SoCs where the UART uses a common-clk managed clock.

In the Linux kernel's serial core, a vulnerability exists where memory allocations for uport->tty_groups and uport->name are performed after console registration, leading to dangling pointers if allocation fails. This can cause NULL dereference (PL011 console) or use-after-free (i.MX console).

In the Linux kernel's uart_register_driver(), on failure of tty_alloc_driver(), drv->state remains pointing to freed memory, and on failure of tty_register_driver(), drv->tty_driver also retains a stale pointer. Drivers using drv->state as an 'already registered' flag may skip registration and pass freed state to uart_add_one_port().

In the Linux kernel's TTY subsystem, a vulnerability exists where TTY device registration can fail before a cdev is allocated. The serial core keeps the port, so setserial can still use it, and later removal passes a NULL cdev pointer to cdev_del(), causing a NULL-pointer dereference.

In the Linux kernel's tty_cdev_add(), on cdev_add() failure, the cdev reference is dropped but driver->cdevs[index] remains pointing to freed memory. Later tty_unregister_device() passes that stale pointer to cdev_del(), causing a use-after-free.

In the Linux kernel's dm-integrity module, a vulnerability exists where a block tag of all 0xf6 bytes (DISCARD_FILLER) is treated as proof of discard and skips HMAC verification. An attacker with raw write access to the backing device, but without the integrity key, can stamp any block with such a tag and have it served as authentic.

In the Linux kernel's HID driver for ASUS devices, multiple issues exist: unchecked size in asus_raw_event(), unclean teardown in asus_probe on failure, possible use-after-free in asus_probe, multiple workqueues used where one sufficed, sleeping calls in atomic context, and packets of incorrect size sent to the keyboard controller.

In the Linux kernel's Logitech HID++ driver, a vulnerability exists where in hidpp_ff_init(), if allocations of private data, effect ID array, or workqueue fail after input_ff_create() succeeds, the function returns an error without destroying the FF device, leading to resource leaks.

In the Linux kernel, the HID driver for the Steam Controller (HID: steam) trusted the message size reported within the FEATURE report itself instead of verifying the actual read length. This led to a potential issue with short reads.

In the Linux kernel, the pep_getsockopt() function in the phonet module clamped the reported length to the caller's buffer using min_t(), but then stored the value with put_user(), which always writes sizeof(int) bytes. A getsockopt() call with an optlen smaller than sizeof(int) thus reported the clamped length yet wrote a full int, one to three bytes past the user buffer.

In the Linux kernel, the ublk module with UBLK_F_AUTO_BUF_REG can fail on invalid sqe->addr after ublk_fill_io_cmd() has set UBLK_IO_FLAG_ACTIVE. The uring_cmd is completed while the tag stays active, which can hang teardown.

In the Linux kernel, the ocfs2/cluster module has a bug in local node state management. When local=0 clears the live local-node state but leaves cl_has_local set, o2nm_this_node() returns invalid node number 255, causing a KASAN slab-out-of-bounds in o2hb_do_disk_heartbeat().

In the Linux kernel, the rapidio subsystem's rio_alloc_net() stores the newly allocated rio_net in mport->net before rio_scan_alloc_net() registers the device. If rio_add_net() fails, put_device() releases the rio_net, but mport->net is left pointing at the freed object, potentially leading to double free.

In the Linux kernel, fat_rebuild_parent() uses a directory entry to rebuild the parent inode but fails to release sinfo.bh after a successful scan. This causes a buffer head leak in the nostale_ro NFS export path.

In the Linux kernel, the legacy I/O and memory sysfs handlers did not check security_locked_down(LOCKDOWN_PCI_ACCESS). As a result, root could write arbitrary I/O ports and map legacy I/O and memory spaces even when the kernel was locked down.

In the Linux kernel, rsc_table_for_each_entry() stored a firmware-supplied u32 offset into a signed int. A crafted offset such as 0xFFFFFFF0 became -16, bypassing the availability check and allowing an out-of-bounds read of hdr->type.

In the Linux kernel, after a failed cgroup BPF program replacement (BPF_F_REPLACE in multi-attach mode), __cgroup_bpf_attach overwrote pl->storage with new storage but failed to restore the old one on the error path. The still-active prog1 holds dangling storage pointers, causing invalid access in bpf_get_local_storage.

A vulnerability was found in the Linux kernel thermal/hwmon subsystem. The issue is that a hwmon class device is registered only for the first thermal zone of a given type, and sysfs attributes from other zones are attached to it. Removing the thermal zone that holds the hwmon device can block the removal process due to attributes belonging to other zones.

In the Linux kernel on ARM, PREEMPT_RT was enabled without selecting HAVE_POSIX_CPU_TIMERS_TASK_WORK, leaving CONFIG_POSIX_CPU_TIMERS_TASK_WORK disabled so CPU timers expired in hard IRQ context. On PREEMPT_RT this made run_posix_cpu_timers() take the sleeping sighand->siglock, triggering a "sleeping function called from invalid context" bug. The fix selects the option to defer POSIX CPU timer expiry to task context.

In the Linux kernel on ARM, do_DataAbort()/do_PrefetchAbort() called force_sig_fault() with interrupts disabled when the unhandled user fault hook returned non-zero. PREEMPT_RT requires interrupts enabled when sending signals, and this could be triggered by user programs executing the bkpt instruction with CONFIG_PERF_EVENTS=n. The fix enables interrupts in these paths.

In the Linux kernel on ARM, with CONFIG_DEBUG_USER=y and cmdline "user_debug=31", a user fault may trigger show_pte() without any lock. A concurrent munmap() in the same process can free page table pages while show_pte() traverses them, causing use-after-free, and with CONFIG_ARM_LPAE=y even a kernel panic. The fix acquires mmap_write_lock() around show_pte() for user faults and restricts it to user-space addresses (addr < TASK_SIZE).

In the Linux kernel, a race condition in the OCFS2 filesystem during o2net teardown was found. Heartbeat callbacks may remain registered while the teardown destroys the o2net_wq workqueue, leading to a use-after-free in __queue_work(). The issue was detected by KASAN.

In the Linux kernel, the bpf_get_task_stack and bpf_get_task_stack_sleepable helpers using __bpf_get_task_stack declare buf as ARG_PTR_TO_UNINIT_MEM, which should be initialized on every return path. A missing memset on error paths left the buffer with uninitialized data. The fix adds buffer zeroing to provide deterministic contents.

In the Linux kernel, when CONFIG_FUNCTION_ERROR_INJECTION is disabled, the BPF verifier does not check whether the target symbol is a kernel function or a BPF program, so a sleepable tracing program can attach to a target whose name has an '__x64_'-like prefix. For example, a sleepable fentry program attached to a '__x64_sys_nop' XDP program and using bpf_copy_from_user() can trigger a "sleeping function called from invalid context" bug. The fix disallows sleepable programs when the target BTF is not the kernel's BTF.