Linux kernel vulnerabilities

In the Linux kernel, a vulnerability was found in the SMC (Shared Memory Communications) module. The smc_rx_splice() function calls get_page() on DMB buffers allocated by kzalloc(), which are not page-backed, triggering a WARN_ON_ONCE() and potentially leading to use-after-free.

In the Linux kernel, a vulnerability in the hugetlb mechanism was found where a race condition between migration and fallocate can occur. The remove_inode_single_folio function checks if the folio is mapped without holding the folio lock, leading to incorrect removal of a still-mapped folio and triggering a BUG in filemap_unaccount_folio.

In the rtw89 driver for Realtek WiFi chips, a use-after-free bug was found in rtw89_core_tx_kick_off_and_wait(). It is caused by a race condition between the waiting and signaling threads, leading to access of a freed skb buffer.

In the Linux kernel, the target_lu_gp_members_show function in target_core_configfs.c has a buffer overflow vulnerability. snprintf may return a value larger than the buffer size (256 bytes), causing overflow when copied by memcpy.

In the xc5000 tuner driver in the Linux kernel, a use-after-free vulnerability exists in xc5000_release(). Using cancel_delayed_work() does not guarantee that the delayed work item timer_sleep has finished, leading to a race condition where memory is freed while the work item still runs.

A use-after-free vulnerability was found in the iMON remote control driver in the Linux kernel. The issue is caused by improper synchronization between imon_disconnect() and active write operations, leading to access to a freed usb_device pointer.

In the BPF verifier of the Linux kernel, the function get_helper_proto may return NULL when a helper function is disabled by a config option, which can lead to NULL pointer dereference. The fix adds a validity check for the helper function pointer.

The etas_es58x CAN driver in the Linux kernel lacks the ndo_change_mtu() implementation, allowing an attacker to set an invalid MTU (e.g., 9999) on a CAN interface. By sending a crafted CAN XL frame via a PF_PACKET socket, the attacker bypasses standard checks and triggers a 247-byte buffer overflow.

In the Linux kernel's hi311x CAN driver, the missing ndo_change_mtu() implementation allows an attacker to set an invalid MTU (e.g., 9999) and send a malicious CAN XL frame via a PF_PACKET socket. This causes a buffer overflow in hi3110_hw_tx() when copying frame data, as the driver misinterprets the CAN XL frame as a regular CAN frame.

The sun4i_can driver in the Linux kernel lacks the ndo_change_mtu() implementation, allowing an attacker to set an arbitrarily large MTU. By using a PF_PACKET socket, a crafted CAN XL frame can bypass checks and trigger a 247-byte buffer overflow in the xmit() function.

The mcba_usb driver in the Linux kernel lacks the ndo_change_mtu() implementation, allowing an attacker to set an invalid MTU (e.g., 9999) and send a malicious CAN XL frame via a PF_PACKET socket. The frame bypasses standard checks and causes a 247-byte buffer overflow because the driver misinterprets the flags field as data length.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's Bluetooth stack in the hci_conn_tx_dequeue function. The issue occurs when processing HCI_EV_NUM_COMP_PKTS events due to missing proper locking of the hdev structure, leading to reading freed memory.

A use-after-free (UAF) vulnerability was discovered in the Linux kernel's Bluetooth subsystem in functions hci_acl_create_conn_sync and hci_le_create_conn_sync. The issue occurs when a pending connection (conn->state == BT_OPEN) is freed before the operation completes, leading to a write to freed memory.

A Use-After-Free (UAF) vulnerability was discovered in the Linux kernel's Bluetooth MGMT stack. The issue occurs when the mgmt_pending structure is freed while still being processed, potentially leading to access to freed memory. The fix introduces the mgmt_pending_valid function and additional locking with mgmt_pending_lock.

A vulnerability in the Linux kernel's nexthop mechanism allows changing the FDB status of a nexthop while it is part of a group, leading to a NULL pointer dereference (NPD) during packet routing. This can cause a system crash.

In the Linux kernel mlx5 network driver, there is a use-after-free (UAF) bug when releasing a flow counter. When deleting an HWS rule, the counter action may already be freed, and its structure lacks initialized refcount and mutex.

In the Linux kernel, a use-after-free vulnerability was found in the octeontx2-pf driver's otx2_tc_add_flow() function. The issue arises from calling kfree_rcu() before dereferencing the new_node pointer, potentially leading to memory corruption.

A use-after-free vulnerability was found in the Linux kernel's futex subsystem during requeue-PI operations. The race condition occurs because futex_q::task is read without proper synchronization before updating the requeue state, allowing access to freed memory.

In the Linux kernel, in futex_hash_allocate_default(), the wrong error exit label is used in copy_process(). On allocation failure, bad_fork_core_free is used, which unlocks locks that were never acquired (tasklist_lock, siglock), instead of the correct bad_fork_cancel_cgroup label.

In the Linux kernel i40e driver, the ring_len parameter from a virtual function (VF) lacks validation and is directly assigned to hardware memory context (HMC), potentially causing incorrect Tx/Rx queue configuration.

In the Linux kernel i40e driver, VF state validation in get resources incorrectly used I40E_VF_STATE_ACTIVE, which is not the only active state. The fix uses I40E_VF_STATE_RESOURCES_LOADED, set only during resource retrieval and cleared on reset.

In the Linux kernel, the fbcon driver has an integer overflow vulnerability in the fbcon_do_set_font function. Font size calculations can overflow with user-controlled parameters, leading to undersized allocations and buffer overflow.

In the Linux kernel iommufd subsystem, a use-after-free (UAF) vulnerability was found during file descriptor allocation abort. The fput() function does not call release() synchronously, causing premature freeing of the iommufd_object before file operations complete.

In the Linux kernel xfrm subsystem, xfrm_alloc_spi can assign SPI value 0, which is invalid (meaning no SPI). This adds the state to the byspi list, but __xfrm_state_delete does not remove it, leading to use-after-free on subsequent list traversal.

A vulnerability in the Linux kernel's af_alg mechanism allowed concurrent writes to the same af_alg socket, causing unpredictable data interleaving and potential inconsistencies in internal socket state.

In the Linux kernel, a race condition was found in the AMD IOMMU driver when increasing page table levels. The fetch_pte() function in the unmap path reads root pointer and table level without lock, potentially causing inconsistency and unmap failures in extreme corner cases.

In the Linux kernel's mac80211 WiFi subsystem, the S1G capability element is not accounted for in scan_ies_len. This causes a buffer length validation failure in ieee80211_prep_hw_scan() and a WARN in __ieee80211_start_scan(), preventing hardware scanning.

In the Linux kernel's igc driver, igc_probe() failed when igc_led_setup() failed, causing a kernel panic in free_netdev() due to missing unregister_netdev(). Since LED support is not mandatory, the fix treats LED setup failures as non-fatal and continues with a warning, preventing the panic.

A vulnerability was found in the Linux kernel's TCP Fast Open implementation. The tcp_disconnect() function did not clear the fastopen_rsk pointer, causing a retransmit timer to fire incorrectly after socket reuse (e.g., connect(AF_UNSPEC) followed by a new connect()), leading to a warning and potential network disruption.

In the Linux kernel, the netfilter conntrack module has an error in calculating the ct->timeout value. For unconfirmed connections, this value is incorrectly modified (adding/subtracting nfct_time_stamp), leading to incorrect timeout values.

In the Linux kernel, in the AMD display driver (drm/amd/display), the dm_resume function may dereference a NULL pointer if 'aconnector->dc_link' is null. The fix adds a check at the beginning of the loop to avoid this issue.

In the Linux kernel, in the AMDGPU driver, the amdgpu_bo_validate_size() function does not check whether the TTM domain manager for the requested memory exists, which can lead to a kernel oops when dereferencing 'man'. The fix adds a check that the manager pointer is not NULL.

A vulnerability in the Linux kernel has been resolved regarding the failure to release device resources during unregistration. The issue affects bus-less or driver-less devices that may not be freed if a managed resource holds a reference to the device.

A vulnerability has been identified in the Linux kernel related to attribute validation in the vdpa_nl_policy structure. The lack of proper policy for the max vqp attribute may lead to illegal nlattr pointers, which could result in out-of-bounds reads.

In the Linux kernel, the NTFS3 filesystem (fs/ntfs3) lacked validation of the data run offset. This could lead to use-after-free or unexpected memory access when mounting a specially crafted NTFS image.

In the Linux kernel, a potential memory leak was found in the drm/amd driver. The issue occurs when the function returns NULL at the end, leaving allocated memory for clk_src unreleased. The fix replaces free with kfree.

A hung task vulnerability was found in the Linux kernel during LTP cgroup testing with repeated mount/unmount of perf_event and net_prio controllers. The issue occurs when work items are queued in a single cgroup_destroy_wq workqueue, causing a deadlock. The fix splits the workqueue into three dedicated ones: cgroup_offline_wq, cgroup_release_wq, and cgroup_free_wq.

In the Linux kernel, the wilc1000 WiFi driver has a buffer overflow vulnerability during WID string configuration. The wilc_wlan_parse_response_frame function copies data without size checking, which could lead to buffer overflow.

In the Linux kernel's virtio_uml driver, a use-after-free vulnerability was found. When register_virtio_device() fails, the code incorrectly sets vu_dev->registered = 1, potentially leading to use of freed memory.

In the Linux kernel QED driver, a vulnerability allows the firmware to return too many GRC elements during a protection override dump, causing a write past the allocated buffer and a kernel panic. The issue occurs in qed_grc_dump_addr_range and can be triggered by qede or qedf drivers.

A use-after-free vulnerability was found in the Linux kernel's cnic driver. The cnic_delete_task function can be invoked after the cnic_dev structure is freed because cancel_delayed_work() does not guarantee completion of the cyclic delayed work, and flush_workqueue() does not wait for tasks submitted after its call. This leads to a race condition where freed memory is still accessed.

A use-after-free vulnerability was found in the Linux kernel's octeontx2-pf driver in the otx2_sync_tstamp() function. The issue arises from using cancel_delayed_work() instead of cancel_delayed_work_sync(), which does not ensure the delayed work completes before freeing the otx2_ptp structure. This can lead to dereferencing freed memory.

A race condition during concurrent writes to the same zram index in the Linux kernel's zram driver was found. It leads to leaked zsmalloc handles because zs_free() is called too early.

In the Linux kernel's CCP driver (crypto: ccp), a NULL pointer dereference vulnerability occurs when __sev_platform_shutdown_locked() is called with a NULL argument. This issue manifests on the shutdown path during suspend to disk, causing an Oops error and potential system crash.

In the Linux kernel's crypto subsystem (af_alg), a vulnerability was found where on error in af_alg_sendmsg, the ctx->merge variable may contain a garbage value from the previous loop iteration. This can cause a system crash on the next call when it attempts an invalid merge.

A vulnerability in the Linux kernel related to a memory leak in the smbd_negotiate() function during error handling for SMB client has been resolved.

A vulnerability in the Linux kernel related to SCSI command handling in the ufshcd_queuecommand() function has been fixed. The issue was that this function could be called twice in a row before the command was completed, leading to incorrect behavior.

In the Linux kernel, the __no_stack_protector function attribute was added to start_kernel to prevent issues with stack protection. Without this attribute, calling boot_init_stack_canary can lead to mismatched canary values, resulting in a call to __stack_chk_fail and a kernel panic.

In the Linux kernel, in the NTFS3 filesystem (fs/ntfs3), there is a memory leak on the error path in ntfs_fill_super(). The fix frees mount options on error, eliminating the leak.

In the Linux kernel's NTFS3 filesystem (fs/ntfs3), there was a missing validation of buffer length while parsing index buffers. The indx_read function did not check the legitimacy of the returned index buffer length, which could lead to out-of-bounds memory access. The issue was reported as a KASAN slab-out-of-bounds error in hdr_find_e.