Linux kernel vulnerabilities

In the pci_endpoint_test driver of the Linux kernel, adding NO_BAR (-1) to the pci_barno enum changed it from unsigned to signed int, allowing a user to pass a negative value in ioctl, leading to an array underflow in pci_endpoint_test_bar().

In the Linux kernel for SPARC architecture on Niagara processors, a bug was found in copy_from_user and copy_to_user functions. Exception handling had incorrect calculations and a broken epilogue, potentially leading to wrong return values and crashes.

In the Linux kernel, a Use-after-free vulnerability was found in the vmwgfx graphics driver during validation. A node stored in the validation duplicates hashtable was not properly cleared because its resource was destroyed prematurely.

A vulnerability in the Linux kernel causes a leak of disconnected dentries during filesystem unmount. When open_by_handle_at() creates a disconnected dentry and reconnection fails, flags become inconsistent, preventing immediate memory reclamation. This leads to a "Busy inodes after unmount" error and potential system instability.

In the Linux kernel, the ixgbevf driver has a mailbox API compatibility issue between PF and VF drivers for Intel 10G network adapters. API versions 1.4 and 1.5 introduced features (IPsec, ESX support) not supported by all drivers, causing crashes and regressions. The patch adds a new mailbox op to query PF for supported features, enabling negotiation of IPsec and ESX-specific support.

In the Linux kernel, a vulnerability was found in the ALSA HDA cs35l41 driver. The function cs35l41_get_acpi_mute_state() calls acpi_evaluate_dsm() without checking for NULL return, leading to a NULL pointer dereference and potential crash.

A double-free vulnerability was found in the Linux kernel's DRM scheduler in the function drm_sched_job_add_resv_dependencies. When adding dependencies fails due to xarray expansion error, the fence reference is freed twice, leading to memory corruption.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the USB gadget f_rndis driver. After a bind/unbind cycle, the notify_req field becomes stale, and if a subsequent bind fails, attempting to free this request causes a crash.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the USB gadget f_acm driver. After a bind/unbind cycle, the notify_req field becomes stale, and if a subsequent bind fails, attempting to free this request causes a crash.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the USB gadget f_ecm driver. After a bind/unbind cycle, the notify_req field becomes stale, and if a subsequent bind fails, attempting to free this request causes a crash.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the USB gadget f_ncm driver. After a bind/unbind cycle, the notify_req field becomes stale, and if a subsequent bind fails, attempting to free this request causes a crash.

A deadlock vulnerability was found in the Linux kernel's ksmbd module when accessing the RPC handle list. The issue occurs when a client attempts to open a named pipe, causing hung connections and system tasks.

A slab-out-of-bounds read vulnerability was discovered in the Linux kernel's HFS+ filesystem within the hfsplus_strcasecmp() function. This flaw can be triggered by a local attacker to cause a system crash or potentially escalate privileges.

In the Linux kernel, a vulnerability was found in the ksmbd transport_ipc component due to missing payload size validation before reading a handle. The handle_response function dereferences the payload as a 4-byte handle without verifying the declared size, which can lead to an out-of-bounds read.

A slab-out-of-bounds read vulnerability was discovered in the Linux kernel's hfsplus_uni2asc() function in the HFS+ filesystem. The issue occurs when the function is called from hfsplus_listxattr() for extended attributes, where the data structure has a different size than the standard one, causing a read beyond the allocated buffer.

A vulnerability was found in the Linux kernel's NBD (Network Block Device) driver, allowing the use of unsupported socket types. The fix restricts accepted sockets to TCP and UNIX stream only.

A vulnerability in the Linux kernel's BPF implementation for RISC-V architecture causes improper sign extension of struct ops return values, leading to a kernel panic during the ns_bpf_qdisc selftest due to invalid memory access.

In the Linux kernel, a vulnerability was found in the BPF mechanism where explicit access checks to implicit padding in the bpf_sock_addr structure were missing. Syzkaller triggered a kernel warning when reading from offset 60, causing a context access conversion error.

In the Linux kernel, the tcp_metrics module replaced three dst_dev() calls with the lockdep-enabled helper dst_dev_net_rcu(). This is a security fix related to proper lock usage.

In the Linux kernel, a vulnerability was found in the PPS (Pulse Per Second) mechanism where pps_register_cdev() fails to set the release hook before device registration. On registration failure, put_device() may trigger a warning and potential double-free.

In the Linux kernel, in the DRM MSM driver, there is an object reference leak in the VM_BIND error path. If a handle lookup fails, previously obtained object references are not dropped.

In the NTFS3 subsystem of the Linux kernel, an integer overflow was found in the run_unpack function. A malformed runlist in an MFT record can lead to arbitrary disk data access or destruction, bypassing access controls.

In the Linux kernel, the NTFS3 driver lacks validation of the $BITMAP bitmap during index allocation. If the bitmap is empty while index blocks exist, on-disk corruption may occur.

A use-after-free vulnerability was discovered in the Linux kernel's SMC module in the __pnet_find_base_ndev() function. The issue occurs during connection setup when a network device is accessed after being freed, potentially causing system crashes.

In the Linux kernel crypto compression subsystem, there is a mismatch in the order of alloc_ctx and free_ctx operations in scomp_alg and crypto_acomp_streams structures. Structure layout randomization can cause the function pointer order to be inconsistent, leading to errors.

In the Linux kernel, the RDMA/rxe driver has a race condition in do_task() during draining, potentially leading to a use-after-free due to incorrect task state overwriting.

In the Linux kernel, the iommu/vt-d driver has an issue with dirty page tracking when the page walk is incoherent. Dirty page tracking relies on the IOMMU atomically updating the dirty bit in the paging-structure entry, which requires coherent memory between IOMMU and CPU. If the page walk is incoherent, the operation can result in a non-recoverable fault. The fix marks SSADS as supported only when both ecap_slads and ecap_smpwc are supported.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's F2FS filesystem in the f2fs_merge_page_bio() function. The issue is caused by a race condition where a bounce page used for encryption is freed before being accessed, leading to a NULL pointer dereference and kernel panic.

In the D-Link network driver in the Linux kernel, a missing memory allocation failure handling was found in the copy_thresh function. A failed skb allocation can lead to NULL pointer dereference and system crash.

In the Linux kernel's uio_hv_generic driver, the default interrupt mask setting was removed because it should be fully controlled by userspace. Concurrent mask changes by the driver and user application could cause missed interrupts and system hangs.

In the Linux kernel, the io_waitid_wait() function (io_uring module) had an issue with removing the wait queue entry. On successful return, the entry should always be removed from the wait queue list. Previously this was skipped if a cancellation was in progress, which could race with another invocation of the wait queue entry callback.

In the Linux kernel, the io_uring/zcrx subsystem has a bug causing overshooting of the receive limit. Double counting of buffers in frag lists allows a request to receive more data than requested.

In the Linux kernel, the wcd937x audio codec driver (ASoC) had an issue where the SoundWire port for HPHL_COMP and HPHR_COMP was incorrectly set to zero. This can lead to memory corruption by accessing the -1th element of the port_map array.

In the Linux kernel, a vulnerability in the UDF filesystem allows an out-of-bounds read when handling Allocation Extent Descriptors. Malformed on-disk data can cause udf_update_tag() to call crc_itu_t() on out-of-bounds memory, triggering a KASAN use-after-free read.

In the NFC NCI subsystem of the Linux kernel, a missing packet data validation was found. The nci_valid_size() function did not validate data properly, potentially leading to processing of uninitialized memory and information leak.

In the Linux kernel for LoongArch architecture, a vulnerability was found in the BPF mechanism where return values from struct operations were not properly sign-extended. This caused pointers to be treated as 32-bit values, leading to a kernel panic during the ns_bpf_qdisc selftest.

A vulnerability in the Linux kernel's ksm_madvise function incorrectly clears the upper 32 bits of vma->vm_flags when handling the VM_MERGEABLE flag. This causes inconsistency in userfaultfd leading to a kernel panic (BUG) or warning.

In the Linux kernel, the ksmbd SMB server has a race condition in RPC handle list access. ksmbd_session_rpc_open() incorrectly used a read lock instead of write lock, and ksmbd_session_rpc_method() ran without any lock.

In the Linux kernel KVM for SVM, a vulnerability exists where fastpath handlers for WRMSR and HLT are executed even when the next RIP is invalid (e.g., with nrips=false). This causes an attempt to read guest memory via the emulator, leading to a 'sleeping function called from invalid context' error because the operation runs with IRQs disabled.

In the Linux kernel, the binder driver has a double-free vulnerability in dbitmap_free(). When a process fails to expand its bitmap, the old bitmap is freed but later freed again upon process termination.

A double removal of a request from the list was found in the p9_fd_cancelled function of the 9p/trans_fd driver in the Linux kernel. The bug is caused by a race condition between p9_read_work and p9_fd_cancelled threads concurrently modifying the req_list, leading to memory corruption and a KASAN error.

A vulnerability in the Linux kernel's KVM for x86 was found, where L1 intercepts are rechecked when completing userspace I/O emulation. This can cause an access to be incorrectly treated as intercepted even after emulation, leading to a WARN warning and potential disruption.

In the Linux kernel's F2fs filesystem, a vulnerability was found due to missing sanity check on the node footer for non-inode dnodes. This can cause a kernel panic during hole punching (fallocate) when a crafted filesystem image contains inconsistent data.

In the Linux kernel, the vhost subsystem lacks a reference to the task_struct. A task may exit early, and an attempt to wake it via vhost_task_wake() could access freed memory.

In the Linux kernel's cryptographic subsystem (af_alg), a bug was found where incorrect boolean values were assigned to 1-bit bitfields of type u32. The 'more' and 'merge' fields received values greater than 1, which were truncated modulo 2 in 1-bit bitfields, resulting in 0 being set instead of the intended 1.

In the Linux kernel, the IPVS module had a use-after-free (UAF) vulnerability in __ip_vs_ftp_exit() during netns cleanup. The issue is that __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leading to UAF. The fix introduces an exiting_module flag that defers ip_vs_ftp unregistration during netns cleanup until all connections are flushed.

In the Linux kernel's NFS filesystem, there is a potential data corruption vulnerability. During request retransmission, subrequests must be rejoined to the head request, but in some cases they are not, leading to data corruption.

A vulnerability in the Linux kernel causes a kernel crash when probing devdax devices on PowerPC with hash translation. The vmemmap optimization for devdax did not account for architecture-specific memory mappings, leading to an invalid data access.

In the Linux kernel, there is an out-of-bounds access vulnerability in ipv6_find_tlv(). The option length (optlen) is fetched without checking if there is more than one byte to parse, which can lead to out-of-bounds access.

In the Linux kernel DRM driver for Meson SoCs (drm/meson), there is a use-after-free vulnerability. When unloading the meson_drm module, component_master_del is not called, leaving the aggregate device on the global list. Reloading the meson_dw_hdmi module dereferences freed memory, triggering a KASAN error.