Linux kernel vulnerabilities

In the Linux kernel, in the hisilicon/hpre cryptographic driver, the hpre_remove() function may return directly after a failed sriov disable operation, leading to resource leak. The fix continues to release remaining resources even after an error.

In the Linux kernel, a UBSAN shift-out-of-bounds warning in the drm/amdkfd driver was fixed. When the number of SDMA queues or XGMI SDMA queues is 0, the shift operation is undefined. The fix sets the value to ULLONG_MAX if the count is >= number of bits in the operand.

In the Linux kernel's i2c driver for RTL9300, there is no check for data transfer length. A length of 0 causes an underflow and writes 16 bytes instead of a quick SMBus operation, potentially damaging SFP modules.

In the Linux kernel, a race condition was found in the Ceph filesystem when validating r_parent before applying state changes. Insufficient validation may cause stale parent directory information to be used, leading to incorrect inode operations.

In the Linux kernel's EROFS filesystem, the algorithm check for encoded extents is invalid. Current tests do not cover new extent types, potentially leading to inconsistencies.

In the Linux kernel's mt76 WiFi driver (MT7996 chipset), there is no check whether wcid entries belong to stations. Passing a global entry to rx functions can cause memory corruption via incorrect pointer casting.

In the Linux kernel, the mt76 Wi-Fi driver has a linked list corruption. Scheduled wcid entries are left on a temporary on-stack list, leading to an incorrect state.

In the Linux kernel, the dev_ioctl functions for hardware timestamps (hwtstamp) lack the device operation lock. This can lead to warnings and incorrect behavior, as shown in the stack trace with MLX5.

In the Linux kernel's AMD display driver, the OEM i2c adapter is not removed after GPU unbinding. This leads to a null pointer dereference when applications try to access the invalid device.

In the Linux kernel's SLUB allocator, the object_err() function attempted to access object metadata (e.g., freelist pointer, redzone) even when the pointer was invalid, potentially causing a crash. The fix checks if the pointer is NULL or invalid, and in such cases only prints the pointer value, skipping metadata access.

In the i40e Linux kernel driver, read access to the 'command' and 'netdev_ops' debugfs files has been removed. Reading these files was useless, and for 'netdev_ops' could lead to out-of-bounds buffer read, potentially exposing kernel memory. The issue was fixed by completely removing read access to these files.

In the Linux kernel's axienet (Xilinx) network driver, proper error checking is missing when retrieving the RX metadata pointer. The dmaengine_desc_get_metadata_ptr() function can return an error pointer, leading to crashes or undefined behavior.

In the Linux kernel, a vulnerability in the netfilter/br_netfilter module was found where the confirmed bit is checked in br_nf_local_in() after connection confirmation. Hash collisions in the conntrack table can trigger a WARN_ON_ONCE warning when a broadcast packet is sent to a TAP device added to a bridge.

In the Linux kernel's DRM driver for MediaTek SoCs, a potential use-after-free vulnerability was found. The for_each_child_of_node() loop incorrectly decrements the reference count, potentially leading to use of freed memory.

A use-after-free (UAF) vulnerability was found in the Linux kernel's PSI (Pressure Stall Information) monitoring mechanism. The issue occurs when cgroup.pressure is disabled and re-enabled during ongoing epoll monitoring, leading to access to freed memory.

In the Linux kernel's Xilinx CAN driver, xcan_write_frame() called can_put_echo_skb(), which takes ownership of the SKB and may free it, but then continued to use the SKB, leading to a use-after-free. The fix moves the can_put_echo_skb() call after all SKB operations are complete, preventing the bug.

In the Linux kernel, the HSR protocol function hsr_get_port_ndev does not hold RCU lock or device reference, potentially leading to use-after-free in the caller.

In the Linux kernel, the idxd (DMA Engine) driver had an improper idxd_free() call causing a duplicate put_device(), leading to a reference count underflow and potential use-after-free during device removal or module unload.

In the Linux kernel's TI EDMA DMA driver, a critical memory allocation bug was found for queue_priority_map. Using too small a size (sizeof(s8) instead of sizeof(*queue_priority_map)) leads to out-of-bounds writes and kernel crashes.

A use-after-free vulnerability was found in the Linux kernel's __mark_inode_dirty() function. It occurs when one thread updates an inode's timestamp while another thread concurrently switches the writeback structure, leading to a race condition and access to freed memory.

In the Linux kernel's cfg80211 subsystem, the cmp_bss() function suffered from a use-after-free due to a memory management issue in cfg80211_update_known_bss(). The fix adjusts this function to free the last beacon frame elements only if they are not shared via the 'hidden_beacon_bss' pointer, preventing the bug.

In the Linux kernel, the mt7915 Wi-Fi driver (part of mt76) has list corruption after hardware restart. Stations are recreated, but wcid lists are not cleared, leading to re-adding unready entries.

A use-after-free vulnerability was found in the l2cap_sock_cleanup_listen() function of the Bluetooth stack in the Linux kernel. The issue is caused by a race condition between threads during socket list iteration in bt_accept_dequeue(), potentially leading to use of freed memory.

In the Linux kernel's SMC subsystem, a NULL pointer dereference was found in smc_ib_is_sg_need_sync(). When using a software RoCE device, ibdev->dma_device is NULL, leading to a kernel crash.

A NULL pointer dereference (NPD) vulnerability was found in the Linux kernel's VXLAN implementation when refreshing an FDB entry that points to a nexthop group. The issue occurs when learning is enabled and a packet tries to refresh an FDB entry without a remote destination, leading to a system crash.

In the Linux kernel, the ax25_kiss_rcv() function lacks a check for shared skbs before modification, potentially causing skb->dev to become NULL and a system crash.

In the Linux kernel, ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() were defined to ensure proper page table synchronization when calling p*d_populate_kernel(). The fix addresses intermittent boot failures on systems with 4-level paging and large persistent memory, as well as a crash in vmemmap_set_pmd() caused by accessing vmemmap before sync_global_pgds().

In the Linux kernel, the batman-adv module has an out-of-bounds read/write vulnerability in the network-coding decode function. The batadv_nc_skb_decode_packet function trusts coded_len and only checks skb->len, allowing out-of-bounds read and small write.

In the Linux kernel, in the ath11k WiFi driver (mhi), the ath11k_mhi_register() function may fail to free memory allocated by mhi_alloc_controller() when ath11k_mhi_read_addr_from_dt() fails. The fix adds a call to mhi_free_controller() on error.

In the Linux kernel, in the hisilicon/qm cryptographic driver, the local 'val' buffer is only 32 bytes, while the maximum QoS configuration buffer length is 256 bytes. The sscanf function does not check the destination memory length, which may lead to a stack overflow.

In the Linux kernel's SCTP module, a potential overflow was found when processing ifwdtsn packets. During iteration over skipped chunks, there was no check whether remaining data was sufficient for safe structure dereference, which could lead to out-of-bounds read.

In the Linux kernel, a vulnerability in the amdgpu driver involves using an unlocked iterator in the SDMA update function, which can trigger a warning in dma_resv_iter_next. The issue occurs when called from an unlocked context, potentially causing incorrect behavior.

In the Linux kernel's Bluetooth L2CAP module, a use-after-free was found. The issue occurs after calling __l2cap_get_chan_blah(), when the channel may be freed and then used without proper protection.

A use-after-free vulnerability was found in the Linux kernel DRM driver for Amlogic Meson graphics. The bug occurs during driver unloading (rmmod) due to an incorrect deinit sequence, causing a reference to already freed memory. The issue was fixed by reordering the driver deinit sequence.

In the Linux kernel, in the OrangeFS filesystem (orangefs), there is a memory leak during debugfs initialization (orangefs_{kernel,client}_debug_init). The fix uses a global variable as a buffer instead of dynamic allocation, eliminating the leak.

In the Linux kernel's ksmbd (SMB server) module, a race condition was found during concurrent SMB2 tree disconnects. This could lead to use-after-free (UAF) when accessing tcon structures concurrently.

In the Linux kernel, the RDMA/cxgb4 driver has a potential NULL pointer dereference in pass_establish(). If get_ep_from_tid() fails to find an entry, the ep pointer is later dereferenced without a check. The fix adds a simple sanity check.

In the Linux kernel, a vulnerability in skb_segment can cause a kernel BUG when handling GSO packets with frag_list if a program uses BPF_FUNC_skb_pull_data to read beyond the head skb headlen. The issue arises from improper accounting of tail adjustment during pull operations. The fix marks such skbs as GSO_DODGY so segmentation can handle tail updates correctly.

In the Linux kernel's ROSE (X.25 network) subsystem, a vulnerability was found due to incorrect reference counting in rose_neigh structures. Separate counters for nodes and sockets caused premature memory freeing, leading to a use-after-free condition. The patch merges both counters into one, ensuring proper deallocation only after all references are released.

In the Linux kernel's ROSE (Radio Amateur) subsystem, the 'use' field in struct rose_neigh was converted from unsigned short to refcount_t. The previous implementation lacked atomicity, leading to race conditions and potential use-after-free.

In the SMB client of the Linux kernel, a race condition was found during rename operations that allows concurrent opens on the target file. The rename process involves closing deferred closes and marking handles as deleted, widening the race window.

In the Linux kernel's efivarfs filesystem, the efivarfs_d_compare() function fails to validate filename length before computing the GUID offset, potentially causing a slab-out-of-bounds read.

In the Intel QuickI2C driver in the Linux kernel, a vulnerability was found due to incorrect length calculation of ACPI DSD ICRS/ISUB data, causing a stack-out-of-bounds write and kernel crash.

A vulnerability in the Linux kernel HID multitouch driver (mt_report_fixup) allows a malicious HID device to trigger a slab out-of-bounds read. The issue is due to missing bounds check before accessing byte offset 607 of the report descriptor.

In the Linux kernel's NTFS3 filesystem (fs/ntfs3), a missing null pointer check in attr_load_runs_vcn can lead to a null pointer dereference (NPD) when mounting a malformed NTFS image, causing a kernel crash.

A memory leak (kobjects) was found in the orangefs_sysfs_init() function of the OrangeFS module in the Linux kernel. When inserting and removing the orangefs module, kobject objects are not freed, leading to memory exhaustion.

In the Linux kernel DRM/AMDKFD subsystem, a vulnerability allows double release of a PASID identifier. If kfd_process_device_init_vm fails after setting the PASID, the same PASID may be freed twice, leading to a WARNING and NULL pointer dereference.

In the Linux kernel's lockd module, an issue was found where the file_lock structure is not fully initialized when unlocking files. Missing fields such as fl_file could lead to a crash (Oops) in NFSv3 re-export scenarios.

In the Linux kernel, a vulnerability was found in the F2FS filesystem during recovery. Missing validation of the destination block address (blkaddr) in the SIT table can lead to inconsistency, triggering a warning or kernel panic when CONFIG_F2FS_CHECK_FS is enabled. The issue was reported by Wenqing Liu and affects filesystem images with corrupted metadata.

In the Linux kernel's NTFS3 driver, the record_size field in the NTFS boot record lacks proper validation. When negative, it is treated as a shift value, and the lack of sanity checks can lead to a calculated size below 256 bytes, causing a NULL pointer dereference when mounting a crafted NTFS image.