Linux kernel vulnerabilities

In the Linux kernel, the drm/vc4 graphics driver added zeroing of the Tile State Data Array (TSDA) before each BIN job. Previously, binner slots were reused without clearing, which could cause the PTB to act on stale data and lead to GPU hangs.

In the Linux kernel, the drm/panthor graphics driver added rejection of firmware sections with oversized data. Previously, the data size to copy was not validated against the allocated section size, which could lead to heap buffer overflow and massive out-of-bounds zeroing of kernel memory.

In the Linux kernel, the drm/panthor graphics driver added validation of firmware interface structure sizes. The iface_fw_to_cpu_addr() function only checked that the MCU virtual address points inside the shared section, but did not check that the entire structure fits, which could lead to out-of-bounds accesses.

In the Linux kernel, the amdgpu driver has a use-after-free vulnerability in amdgpu_dpm_get_pp_table(). The function returns a pointer to the power table after dropping the mutex, and a concurrent pp_table write can free the memory during the copy, leading to use-after-free. The fix copies data into caller-provided storage while holding the mutex.

In the Linux kernel, the amdgpu display driver has a divide-by-zero vulnerability in calculate_mcache_setting when the viewport has zero area. This causes a kernel panic and potential underflow on num_mcaches. The fix changes the function to return bool and adds guards to reject the mode when values are zero.

In the Linux kernel, the amdkfd driver has a QID bit leak in pqm_create_queue(). When kernel memory allocation fails during the first queue creation, the function returns early without clearing the QID bit, causing a permanent leak of queue slots. The fix changes the error path to goto err_allocate_pqn to always call clear_bit.

In the Linux kernel, the amdkfd driver has a uint32_t overflow vulnerability in EOP ring buffer size alignment. A user-supplied size of 0xFFFFF001 wraps to 0, bypassing the size check and allowing acceptance of any BO. This can lead to out-of-bounds writes and GPU faults.

In the Linux kernel, the amdkfd driver has a race condition in kfd_criu_checkpoint_events(). The counting and walking of events are not protected by event_mutex, which can lead to out-of-bounds writes or use-after-free. The fix holds the mutex during both operations.

In the Linux kernel, the vmwgfx driver has a vulnerability where DX_BIND_QUERY is processed without checking for a DX context. A user can trigger a NULL pointer dereference, causing a kernel panic. The fix adds an early rejection when no DX context is present.

In the Linux kernel, the vmwgfx driver has a vulnerability where the DRAW_PRIMITIVES header size is not validated before division. A small header size causes unsigned subtraction to wrap, leading to an out-of-bounds read. The fix rejects undersized headers.

In the Linux kernel, the vmwgfx driver has a vulnerability where the DMA command body size is not checked against the suffix pointer. This can cause the suffix pointer to underflow and overwrite verified fields of a previous command, enabling a TOCTOU attack. The fix rejects the command if the body is too small.

In the Linux kernel, the vmwgfx driver has a vulnerability where destroy_workqueue(NULL) is called during vkms init failure when the workqueue was not created. This can cause a kernel panic. The fix removes the early return and adds a NULL check before destroying the workqueue.

A vulnerability in the Linux kernel USB Type-C UCSI driver causes a race condition during port unregistration, potentially leading to use-after-free and kernel crashes (NULL pointer dereference). The issue involves synchronization of partner work items with workqueue destruction.

In the Linux kernel, the drm/xe driver's exec IOCTL did not wait on kernel fences for external BOs, potentially causing a race and memory corruption during moves. The fix adds kernel fence dependencies for all objects locked by the exec.

In the Linux kernel's sun4i-ss driver, the insecure and unused RNG algorithm (sun4i_ss_rng) was removed. It had multiple vulnerabilities including missing locking, buffer overflow, and improper random byte generation. Since no users are known, the code was removed instead of fixed.

In the Linux kernel's uvcvideo driver, a deadlock occurs when uvc_status_stop is called from async_ctrl.work, causing a wait for a work item that is waiting for itself, leading to a system hang.

In the Linux kernel's rxrpc subsystem, rxrpc_verify_data does not always allocate the rx_dec_buffer, which can lead to a call to skb_copy_bits with a NULL destination and a NULL pointer dereference. The fix ensures allocation is always attempted when the buffer is NULL.

In the Linux kernel's rxrpc subsystem, rxrpc_recvmsg() does not drop the reference it holds on an already-released call when MSG_PEEK is in force, leading to a memory leak.

In the Linux kernel's rxrpc subsystem, rxrpc_recvmsg() may enter an infinite loop because the wait does not check the OOB queue. The fix adds a check for the OOB queue in the wait loop.

A vulnerability was found in the Linux kernel's rxrpc subsystem, involving improper handling of ACKALL packets. A forged ACKALL packet can be accepted for a new server call in an invalid state, leading to a NULL pointer dereference and system crash.

In the Linux kernel, the rxrpc subsystem fixed an issue with receiving a reply packet before data transmission. The function rxrpc_receiving_reply() did not check if the call had been exposed, which could lead to an oops in rxrpc_rotate_tx_window(). Additionally, the do...while loop was changed to a while loop to handle an empty transmission queue.

In the Linux kernel, the AFS subsystem fixed a NULL pointer dereference in afs_get_tree(). When ctx->dyn_root is not null, as->cell and as->volume are null, and trace_afs_get_tree() dereferences them.

In the Linux kernel, the AFS subsystem fixed handling of CB.InitCallBackState3 requests without a server record. It checks whether a server record was attached, and if not, the request is ignored, matching existing behavior for other unmatched callback requests.

In the Linux kernel, the fbcon subsystem fixed a NULL pointer dereference for a console without vc_data. fbcon_new_modelist() assumed a console with a mode set has vc_data, which is not always true. The fix keeps the mode only while vc_data exists.

In the Linux kernel, the accel/amdxdna driver fixed a memory leak when pinning ubuf pages. When pin_user_pages_fast() returns fewer pages than requested, previously pinned pages are not released. The fix unpins partially pinned pages before returning failure.

In the Linux kernel, the drm/rockchip inno-hdmi driver fixed a use-after-free issue. The internal structure containing the encoder was allocated with devm_kzalloc(), and during encoder cleanup via drmm_encoder_alloc_release(), accessing the freed structure caused an error. The fix switches to drmm_kzalloc().

In the Linux kernel, the drm/rockchip dw_dp driver fixed a use-after-free issue. The internal structure containing the encoder was allocated with devm_kzalloc(), and during encoder cleanup via drmm_encoder_alloc_release(), accessing the freed structure caused an error. The fix switches to drmm_kzalloc().

In the Linux kernel, the drm/gpusvm subsystem failed to reject VMAs marked with VM_IO or VM_PFNMAP when creating SVM ranges. Such regions are not backed by struct page, causing repeated get_pages() failures and potentially leading to an infinite loop in a driver's page-fault handler.

In the Linux kernel, the accel/amdxdna driver did not limit the amount of data returned to user space by the buffer size provided by the application. If the buffer was smaller than the data size, it returned an error instead of only the fitting portion.

In the Linux kernel, the dma-fence tracepoints trace_dma_fence_signaled, trace_dma_fence_wait_end, and trace_dma_fence_destroy could dereference a null fence->ops pointer after it was reset on signaling. The fix uses safe string getters and moves the signal tracepoint before ops are cleared.

In the Linux kernel, the drm/radeon driver's radeon_align_pitch() had a signed integer overflow during alignment round-up and the 'aligned * cpp' calculation. This could lead to returning an invalid pitch or creating a zero-sized dumb buffer.

In the Linux kernel, the drm/radeon driver's radeon_ring_restore() did not free the data buffer (allocated by radeon_ring_backup()) when radeon_ring_lock() failed. This caused a memory leak on every failed GPU reset.

In the Linux kernel, the spi: atcspi200 driver initializes DMA resources after SPI controller registration. During driver unbind, a use-after-free can occur when DMA is torn down while the controller is still alive and triggers DMA transfers.

In the Linux kernel, the hfsplus filesystem has a duplicate dirty marking of the attribute inode, leading to a null-ptr-deref during setxattr when the attributes file is not loaded during mount.

In the Linux kernel, the wifi: rtw89 driver's AER handlers (io_error_detected and io_resume) retrieved the pointer stored by pci_set_drvdata() as a net_device, while it was actually an ieee80211_hw pointer. This caused operations on wrong offsets of the structure.

In the Linux kernel, the wifi: rtw88 driver's AER handlers (io_error_detected and io_resume) retrieved the pointer stored by pci_set_drvdata() as a net_device, while it was actually an ieee80211_hw pointer. This caused operations on wrong offsets of the structure.

A vulnerability in the Linux kernel's rtw89 WiFi driver causes an infinite loop during 6 GHz band scanning. A data type error for the scan index leads to CPU soft lockup and system panic.

In the Linux kernel, the rtw88 driver (PCIe) lacks validation of the data size received from firmware, which can lead to an out-of-bounds read from the DMA buffer. An attacker could exploit this to disclose kernel memory.

In the Linux kernel, the rtw89 driver lacks a bounds check on the mac_id field from firmware, which can lead to an out-of-bounds array access. An attacker could exploit this to leak kernel memory.

In the Linux kernel, the ath9k driver lacks a bounds check on the qid field from firmware, which can lead to an out-of-bounds array access. An attacker could exploit this to leak kernel memory.

A vulnerability in the Linux kernel's ath11k Wi-Fi driver can cause a kernel crash during reboot if it overlaps with firmware crash recovery (SSR). The issue is a NULL pointer dereference in the MHI teardown path while freeing DMA contexts. It affects PCI/MHI-based devices only.

In the Linux kernel, the OPP subsystem has a race between adding and looking up entries, which can lead to refcount corruption and premature free. An attacker could exploit this to crash the system.

In the Linux kernel, snp_filter_reserved_mem_regions() has an off-by-one error that can lead to a heap buffer overflow. An attacker could exploit this to execute code in the kernel.

In the Linux kernel, __snp_alloc_firmware_pages() lacks proper error checking for page allocation, which can lead to dereferencing an invalid pointer. An attacker could exploit this to crash the system.

In the Linux kernel, the atmel-sha204a driver has a bug in the blocking and non-blocking RNG logic, causing it to fail to provide valid entropy. This can weaken cryptographic security.

In the Linux kernel, BPF functions bpf_set_dentry_xattr and bpf_remove_dentry_xattr did not check if inode is NULL, leading to NULL pointer dereference with negative dentries. Added NULL check and return -EINVAL. Also removed WARN_ON warnings that could cause DoS with panic_on_warn enabled.

In the Linux kernel, evm_read_xattrs() did not initialize the buffer, leading to out-of-bounds read by strlen() when no xattrs are configured. The fix explicitly terminates the buffer, uses snprintf(), and passes the actual length to simple_read_from_buffer().

In the Linux kernel, in the mlx5_ib driver, mlx5_ib_alloc_transport_domain() leaked the allocated transport domain when mlx5_ib_enable_lb() returned an error. The fix adds deallocation of TD on error, explicit return 0 in the no-loopback-capability branch, and moves lb mutex initialization to mlx5_ib_stage_init_init().

In the Linux kernel, in the RDMA/mlx5 driver, mlx5r_umr_update_xlt() leaked the XLT buffer and DMA mapping when mlx5_odp_populate_xlt() returned an error, and also left the emergency mutex locked. The fix breaks out of the loop to execute the common cleanup path.

In the Linux kernel, in the RDMA/mlx5 driver, MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT() linked event_sub into the list before initializing fields used in the error path, leading to NULL dereference and incorrect XA cleanup. The fix adds devx_key_in_sub_list() and calls subscribe_event_xa_dealloc() only for the last matching pending entry.