Linux kernel vulnerabilities

In the Linux kernel, in drm_syncobj_find_fence() there is a memory leak because drm_syncobj_find() takes a reference to syncobj, but the early return does not drop the reference. The fix drops the reference before the early return.

In the Linux kernel, dm_poll_bio() passed polling flags unchanged to clones, which could cause long spinning and RCU CPU stall. The fix forces one-shot polling for target bios.

In the Linux kernel, in the tracing module, synthetic field helpers used strcat() to build names and commands in fixed buffers, which could lead to out-of-bounds write. The fix uses seq_buf and propagates -E2BIG when MAX_FILTER_STR_VAL is exceeded.

In the Linux kernel, the irdma_copy_user_pgaddrs function has an out-of-bounds write vulnerability. The issue occurs when palloc->total_cnt is zero, causing the loop to potentially go beyond the fixed size of the pgaddrmem array (4 elements) in the lvl==0 case. This can lead to buffer overflow.

In the Linux kernel, the RDMA HNS driver has a log flood issue after hns_roce_cmd_mbox() failure. When hardware is abnormal, unlimited error messages can cause log flood and even system crash.

A use-after-free (UAF) vulnerability was found in the Linux kernel's ALSA OSS sequencer subsystem. The issue occurs when SysEx data is processed and the sequencer port is closed before the event is dispatched, leading to use of freed memory. The patch extends the refcounting mechanism to protect resources until the event is dispatched.

In the Linux kernel's ALSA SEQ MIDI subsystem, a use-after-free and NULL pointer dereference vulnerability was found. The issue stems from missing synchronization between the event processing path and MIDI output teardown, which can lead to system crashes.

In the Linux kernel, the nvmet-tcp module has a memory leak in the error path. When a connection is closed during allocation, the page fragment cache is not drained, leading to memory leak on each failed connection.

In the Linux kernel, the nvmet-tcp module does not check the return value of nvmet_tcp_set_queue_sock(). If it fails, socket callbacks are not properly set, leading to queue and socket leakage.

In the Linux kernel, the nvme-pci driver has an out-of-bounds access in nvme_setup_descriptor_pools. On non-NUMA kernels, hctx->numa_node is -1, but the parameter is declared as 'unsigned', causing the index to become UINT_MAX and walk off the array, leading to a page fault.

In the Linux kernel, the cls_bpf module has unbounded recursion in cls_bpf_offload_cmd, which can lead to stack overflow. The issue occurs when tc_setup_cb_replace() fails and the rollback attempt also fails, causing recursive calls.

In the Linux kernel, the host1x module has an issue where BO cache entries cannot be freed. Cached mappings hold a reference to the buffer object, preventing its release, leading to memory leak.

In the Linux kernel, the gpu: host1x driver has been fixed to correctly check the return value of iommu_map_sgtable(). The function now returns ssize_t with negative values on error, not size_t with zero. Additionally, pin_job() was incorrectly assigning to 'int', which could cause overflows into negative values.

In the Linux kernel, the dax/kmem subsystem has been fixed to handle partial discontiguous resources during removal. When dev_dax_kmem_probe() partially succeeds but a subsequent range fails, dev_dax_kmem_remove() may attempt to remove a non-existent resource, leading to NULL pointer dereference.

In the Linux kernel, the RDMA/rxe driver has been fixed for a TOCTOU heap overflow in get_srq_wqe(). The function reads num_sge from the shared receive queue buffer mapped into userspace, validates it, but then re-reads the same field to calculate memcpy size, allowing a concurrent thread to modify it and cause a heap buffer overflow.

In the Linux kernel, the RDMA/rxe driver has been fixed for the non-SRQ receive path, where WQE fields were read directly from the shared queue buffer mapped into userspace. This allowed a malicious user to modify fields during processing, leading to out-of-bounds reads.

In the Linux kernel, the md/raid1 and md/raid10 drivers have been fixed for a deadlock in the read error recovery path. Resubmitting a split md cloned bio can lead to a deadlock if the array is suspended, because trying to acquire another active_io reference via percpu_ref_tryget_live() may block.

In the Linux kernel, the md/raid1 and md/raid10 drivers have been fixed to detect the error path using md_cloned_bio() instead of relying on r1_bio or r10_bio->read_slot, which may be NULL or -1 after splitting and resubmitting a failed bio. The previous logic could lead to using GFP_NOIO instead of (GFP_NOIO | __GFP_HIGH), potentially causing a deadlock under memory pressure.

In the Linux kernel, the md/raid1 and md/raid10 drivers have been fixed for bio accounting of split md cloned bios. Instead of relying on r1bio_existed in raid1 or the io_accounting flag in raid10, md_cloned_bio() is used to control accounting, avoiding double accounting or missing accounting.

In the Linux kernel, the raid1 driver has been fixed for an nr_pending leak in the REQ_ATOMIC bad-block error path. In raid1_write_request(), each loop iteration increments rdev->nr_pending, but if a badblock is encountered, the code jumps to err_handle without decrementing the counter for the current mirror, leading to a permanent leak and preventing rdev removal.

A vulnerability in the Linux kernel's BPF_PROG_QUERY causes an out-of-bounds write when writing the 'query.revision' field to userspace. This occurs when userspace passes a smaller bpf_attr structure (e.g., 40 bytes, before the revision field was added), leading to a write beyond the allocated buffer. The fix propagates the user-provided attribute size to cgroup query handlers and conditionally skips writing the revision field when the buffer is too small.

In the Linux kernel, a TOCTOU race in luo_session_retrieve() of the liveupdate mechanism has been fixed. The rwsem_read lock scope was extended to overlap with the session mutex acquisition, preventing a concurrent thread from releasing and freeing the session between lookup and mutex lock.

In the Linux kernel, a use-after-free vulnerability in luo_file_unpreserve_files() and luo_file_finish() of the liveupdate mechanism has been fixed. The patch reorders module_put() and xa_erase() to ensure the file handler module remains pinned while its operations are accessed, preventing use of freed memory.

In the Linux kernel, a memory leak in the ath12k WiFi driver has been fixed in ath12k_wifi7_dp_rx_h_verify_tkip_mic(). When NWIFI header length validation fails, the function aborts with an error and the corresponding MSDU is never freed, leading to a memory leak.

In the Linux kernel, issues in ath12k_mac_vdev_create() of the ath12k WiFi driver have been fixed, which left the arvif object in an inconsistent state on error paths. The patch adjusts the control flow to ensure proper cleanup on vdev creation failures.

A vulnerability in the ath12k Wi-Fi driver causes a NULL pointer dereference during link operations when a channel validation fails and the driver is not properly initialized. This leads to a kernel crash when subsequent operations attempt to use uninitialized structures.

In the Linux kernel, a vulnerability in the BTT (Block Translation Table) mechanism for NVDIMM has been fixed, related to preemption during lane acquisition. The previous spinlock-based recursion model was invalid after lanes became preemptible, potentially leading to silent data corruption. The fix replaces the spinlock with a dynamically allocated per-lane mutex array.

In the Linux kernel, a vulnerability in the BPF mechanism has been fixed that allowed bypassing the exclusivity guarantee of BPF maps. Exclusive maps (created with excl_prog_hash) could be inserted into outer maps (map-of-maps) and mutated by unrelated programs, bypassing program compatibility checks.

In the Linux kernel, a use-after-free vulnerability in the bpffs filesystem has been fixed. A previous patch moved inode cleanup from free_inode() to destroy_inode(), removing the RCU delay and allowing access to freed memory during concurrent RCU pathwalk. The fix restores RCU-delayed freeing of the inode and the i_link buffer.

In the Linux kernel, a vulnerability in the ext2 filesystem has been fixed where the return value of generic_write_sync() was ignored in ext2_dio_write_iter(). The fix ensures error propagation, preventing write(2) from returning success when the sync failed.

In the Linux kernel, a vulnerability was found in the bpf_map_elem iterator mechanism. These iterators bind their target map at attach time, bypassing the exclusivity check for maps, allowing access to maps intended only for a single program. Additionally, the iterator exposes the map value as a writable buffer.

In the Linux kernel, configfs_lookup() has a bug that leaves a dangling ->s_dentry pointer when inode allocation fails. This leads to a use-after-free during subsequent getdents(2) operations in the directory.

In the Linux kernel, the ext4 filesystem has a bug in the wait/wake bit mapping for fast commit on 64-bit architectures. The wait and wake functions used raw EXT4_STATE_* values instead of the appropriate +32 offset, causing incorrect synchronization.

In the Linux kernel, a vulnerability in the amdgpu driver causes a slab-out-of-bounds write during coredump generation after a GPU reset. The issue stems from a race condition between two loops processing GPU rings, where the ring count can change between counting and copying.

In the Linux kernel, the vhost subsystem's vhost_get_avail_idx returns an incorrect value, indicating all entries consumed instead of an index update. This can lead to host livelock when the guest is not making progress, as vhost immediately disables notifications and retries.

In the Linux kernel, the iommu/vt-d subsystem has a bug causing RB-tree corruption in the probe error path. If a device does not support ATS, the RB node remains zeroed, and on a subsequent probe failure, the removal misinterprets it as a tree root, corrupting the tree.

In the Linux kernel, a vulnerability in the zap_pages() function in BPF was fixed, which required holding mmap_lock. Previously, improper locking could lead to synchronization issues and potential use-after-free during memory map operations.

In the Linux kernel, a problem in the amdkfd graphics driver was fixed where good queues were not properly restored after a failed suspend_all. Now resume_all is always executed after suspend_all, and remove_queue is performed even on failure.

In the Linux kernel, a use-after-free vulnerability in the reserved memory mechanism was fixed. When alloc_reserved_mem_array() fails, the global pointer reserved_mem still references memory in the __initdata section, which after initialization can lead to dereferencing freed memory.

In the Linux kernel, a use-after-free vulnerability was found in the OCFS2 debugfs locking_state iterator. The iterator copies the ocfs2_lock_res structure, but the LVB pointer (sb_lvbptr) still points to the original object, which can be freed before the data is read, leading to access to freed memory.

In the Linux kernel, a vulnerability in the OCFS2 filesystem was fixed where FITRIM accepted ranges shorter than the cluster size, leading to arithmetic underflow and potential trimming beyond the requested range. Now ranges shorter than the cluster size are rejected.

In the Linux kernel, a use-after-free vulnerability was found in the OCFS2 filesystem's debugfs locking_state mechanism. The debug_lockres_open() function ignores the return value of dlm_grab(), allowing a raw pointer to a freed dlm_ctxt structure to be stored and later used in debug_lockres_release() after domain unregistration. This leads to a slab-use-after-free condition reported by KASAN.

In the Linux kernel, a vulnerability in the netfilter cttimeout module was fixed by changing reference counting for timeout policies. Now the refcount is only used for conntrack entries, allowing immediate removal of policies from nfnetlink_cttimeout.

In the Linux kernel, a vulnerability in the RDMA/irdma driver was fixed that caused an out-of-bounds read during CQ memory registration. The issue was due to improper setting of the cqmr->split field, leading to an out-of-bounds read for GEN_2 and newer hardware.

In the Linux kernel BPF mechanism, when freeing bpf_rb_root, the red-black tree node pointers are not cleared. If the object survives the free, it may contain stale pointers to the freed structure, which upon address reuse can lead to incorrect tree removal.

In the Linux kernel kernfs mechanism, there is a race in xattr operations when multiple superblocks with different namespaces share the same kernfs_node. xattr operations are not properly serialized, which can lead to a race in simple_xattr_set().

A vulnerability in the Linux kernel's kernfs subsystem causes a NULL pointer dereference when a new node is created, because the parent and root pointers are not yet initialized when the LSM security hook runs. This leads to a kernel panic, reproducible deterministically on SELinux-enabled systems during the first cgroup mkdir by systemd.

In the Linux kernel wifi driver wcn36xx, there is a heap overflow due to lack of validation of the HAL response length from firmware. A response larger than 4096 bytes can overflow the hal_buf buffer.

In the Linux kernel wifi driver wcn36xx, there is an out-of-bounds read caused by lack of validation of the firmware-controlled count field in the PRINT_REG_INFO message. An overly large count can lead to reading beyond the buffer.

In the Linux kernel ALSA seq, snd_seq_read() copies a variable-length event header to userspace without clearing the data.ext.ptr pointer, which can leak the kernel address of the extension cell.