Linux kernel vulnerabilities

In the Linux kernel DRM driver for Meson (Amlogic) SoCs, DRM bridges added by meson_encoder_hdmi_init and meson_encoder_cvbs_init were not removed at module unload time, leaving dangling references to freed memory in the global bridge_list. Reloading the modules caused a use-after-free condition, as revealed by KASAN.

In the Linux kernel's NFSD module, a use-after-free was found during inter-server copy operations. The issue occurs when copy state (cpntf_state) is freed before being removed from the list, leading to UAF when the cleanup process tries to free it.

In the Linux kernel, the ARM64 Poly1305 implementation lacked a SIMD usability check, which could corrupt other tasks' registers or compute incorrect MACs. The fix restores this check.

In the Linux kernel, the ARM Poly1305 implementation lacked a SIMD usability check, which could corrupt other tasks' registers or compute incorrect MACs. The fix restores this check.

In the Linux kernel, the btrfs_copy_root() function lacked transaction abort on unexpected extent buffer generation. Instead of aborting and returning an error, it only issued a warning, potentially allowing metadata with an incorrect generation to persist.

In the Linux kernel, a vulnerability was found in the blk_stack_limits() function in the block layer, where the chunk_sectors check could cause an unsigned integer overflow when converting to bytes. The fix changes the check to be sector-based.

In the Linux kernel's io_uring/memmap subsystem, nr_pages was not cast to size_t before shifting, potentially causing overflow for allocations exceeding 4 GB. This issue primarily affects root users, as memory accounting is not performed for them.

A vulnerability in the Linux kernel's device mapper (DM) for zoned devices has been fixed. The issue was that DM targets (e.g., dm-crypt) could incorrectly split write BIOs, leading to deadlocks or incorrect sector values during zone append emulation. The patch ensures large BIOs are split before being passed to the map() function, preventing device limit violations.

In the Linux kernel, a conditional IBPB mitigation was added for the VMSCAPE vulnerability, which exploits weak branch predictor isolation between a guest and userspace hypervisor (e.g., QEMU). The patch issues an IBPB after VMexit before returning to userspace, improving security but potentially impacting performance in workloads with frequent hypervisor-userspace switches.

In the Linux kernel's dm-crypt driver, a vulnerability was found in the handling of write BIO splitting for zoned targets. This splitting causes deadlocks and data corruption in XFS and Btrfs filesystems due to incorrect sector reporting for zone append operations. The fix prevents write BIO splitting for zoned targets, ensuring data integrity.

A vulnerability was found in the Linux kernel's MHI host driver (bus: mhi: host), where a remote device can send an event pointing to an unexpected TRE (Transfer Ring Element). This can lead to a double-free memory buffer when the host processes events in an incorrect order.

In the Linux kernel's AEGIS crypto implementation for x86, error checks after skcipher_walk calls are missing. These functions can allocate memory and fail, potentially leading to incorrect behavior.

In the Linux kernel's Qualcomm MDT loader (mdt_loader), the firmware buffer size is not validated before reading the ELF header, potentially causing an out-of-bounds read.

In the ad7173 ADC driver in the Linux kernel, there is a channel indexing error when accessing the syscalib_mode attribute. Using an incorrect index may lead to an out-of-bounds array access.

In the Linux kernel's hisilicon/hibmc graphics driver, a local variable is passed to request_irq as the interrupt name. After going out of scope, the variable is freed, causing a use-after-free error and IRQ registration failure.

A vulnerability was found in the Linux kernel's JBD2 filesystem in the jbd2_log_do_checkpoint() function. The function does not explicitly call cond_resched(), which can lead to a soft lockup during prolonged checkpoint list processing.

In the Linux kernel's sched_ext mechanism, invalid task state transitions can occur during class switching, causing warnings and potential issues. The fix skips dead tasks during class switching.

In the Linux kernel, a bug was found in Btrfs subpage handling. The btrfs_subpage_set_writeback() function prematurely cleared the PAGECACHE_TAG_TOWRITE tag even when the folio still contained dirty blocks. This broke write ordering guarantees, causing an ASSERT and kernel panic in zoned configurations.

In the Linux kernel, the debug_vm_pgtable test fails to clear manually allocated page table entries in destroy_args(), leaving stale entries. Another process reusing the same mm_struct address may encounter these stale entries, causing warnings, RSS counter bugs, and negative pgtables_bytes.

A vulnerability in the Linux kernel causes a soft lockup in br_multicast_query_expired(). When multicast_query_interval is set to an extremely large value, a local variable overflows, causing the timer to expire immediately and creating an infinite loop.

In the Linux kernel, a vulnerability was found in the Generic Segmentation Offload (GSO) mechanism for IPv6. When an IPv6 packet contains extension headers and the egress device only supports NETIF_F_IPV6_CSUM, the kernel incorrectly requests hardware checksum offload, violating the feature's contract. This triggers a skb_warn_bad_offload warning and causes network throughput collapse.

In the Linux kernel netfilter subsystem (ctnetlink), reference counting was removed from expectation dumpers. The fix prevents a double refcount increment and memory leak that could occur during dump resumption.

In the Linux kernel's ath12k Wi-Fi driver, the ath12k_dp_rx_peer_frag_setup() function fails to decrement the TID counter before cleanup on error, potentially causing an out-of-bounds access in peer->rx_tid[].

A vulnerability was found in the Linux kernel where file descriptor table allocations are not limited to INT_MAX. When sysctl_nr_open is set to a very high value (e.g., 1073741816 by systemd), processes using file descriptors near this limit can trigger memory allocation attempts exceeding INT_MAX, causing a warning in mm/slub.c and potential system overload.

In the Linux kernel's ath12k Wi-Fi driver, the ath12k_dp_rx_peer_tid_setup() function increments the TID counter before actual allocation on error, leading to freeing unallocated TIDs and potential out-of-bounds access.

In the Linux kernel, a vulnerability in the BPF verifier causes a range invariant violation after a JSET instruction, leading to inconsistent bounds on unreachable program paths and a potential kernel warning.

In the DRM driver for Intel GPUs (xe) in the migration function, a potential use-after-free (UAF) was detected. On the error path, the previous fence was released before waiting, potentially leading to UAF. The fix reorders operations so that release occurs after waiting.

A vulnerability in the Linux kernel's Btrfs filesystem can cause transaction aborts during balance operations when encountering partially dropped subvolumes. The issue stems from missing orphan items for such subvolumes, leading to extent tree errors and transaction failure.

In the ath11k Wi-Fi driver in ath11k_mac_op_set_bitrate_mask(), a sleeping-in-atomic-context issue was detected. The function passed as iterator to ieee80211_iterate_stations_atomic() may sleep, causing a BUG warning. The fix changes to ieee80211_iterate_stations_mtx().

In the Linux kernel, the crypto/ccp driver (sev-dev.c) has a bug where an uninitialized error pointer is dereferenced in __sev_platform_init_locked(). This can lead to unpredictable system behavior.

In the Linux kernel netfs subsystem, a bug was found in unbuffered write error handling. When all subrequests in an unbuffered write stream fail, the stream->transferred variable is not updated and retains its initial LONG_MAX value. This causes ->write_iter() to return LONG_MAX instead of an error, potentially leading to a kernel oops when cleaning pipe buffers.

A use-after-free vulnerability was found in the Linux kernel's QAT (QuickAssist Technology) drivers. Repeated loading/unloading of a device-specific driver (e.g., qat_4xxx) in a tight loop can cause a crash when a power management interrupt fires just before driver unload, leaving a pending work item in the shared `qat_misc_wq` queue. Executing that item after driver removal dereferences freed memory, leading to a kernel panic.

In the ksmbd SMB server in the Linux kernel, a refcount leak was detected that prevents memory release. When ksmbd_conn_releasing() returns true, the refcount is not properly decremented, leading to a leak and resource not being freed.

In the vsock/virtio driver in the Linux kernel, there was no validation of the length in the packet header before calling skb_put(). If the host advertises an excessive length, it could cause SKB buffer overflow. The fix adds length validation before skb_put().

In the Linux kernel, a vulnerability was found in the open_tree_attr(2) function that allowed changing idmappings for a mounted filesystem without using the OPEN_TREE_CLONE flag. This bypass could lead to security issues such as use-after-free (UAF) and locking problems.

In the Linux kernel's USB TV driver (usbtv), the resolution is not locked during streaming. Changing the TV standard (e.g., NTSC to PAL) while playing can cause a video buffer overflow and system crash.

In the Linux kernel, the ACE and CSI drivers are missing a mei_cldev_disable() call in their remove() function, causing a use-after-free vulnerability during shutdown. The MEI client remains on the device file list after its memory is freed, leading to a crash.

In the Linux kernel's Venus (multimedia codec) driver, the packet size read from shared memory is not validated against available data, potentially causing an out-of-bounds memory read.

In the Linux kernel, the venus driver lacks protection against spurious interrupts during probe. Registering the IRQ before handler initialization can lead to a NULL dereference during system boot on Rb3Gen2.

In the Linux kernel for LoongArch architecture in the KVM module, a buffer overflow vulnerability was found in the send_ipi_data() function. The kvm_io_bus_read() function is called with a buffer smaller than 8 bytes, while emulation functions write 8 bytes, causing stack corruption and kernel panic when CONFIG_STACKPROTECTOR is enabled.

In the Linux kernel, in the io_uring/futex subsystem, there is a vulnerability due to improper cleanup of async_data on failure in io_futex_wait(). The REQ_F_ASYNC_DATA flag is not set, and data is not cleared after an error, potentially leading to use of uninitialized memory.

In the Linux kernel's NFS filesystem, there is a race condition when updating an existing write. Lack of early page group locking may lead to request removal before processing. The fix moves the lock earlier.

In the tas2781 HDA audio driver in the Linux kernel, there is a reference error to the tasdevice_priv structure. An incorrect pointer was used, leading to memory corruption and crashes.

In the Linux kernel's SCLP subsystem on s390, the NULL check for the SCCB address is performed after physical-to-virtual address translation. If the identity mapping does not start at zero, the check fails, potentially leading to incorrect memory access.

A use-after-free vulnerability was found in the Linux kernel's bh_read() helper in fs/buffer.c. The issue occurs during NTFS3 filesystem mount when a stack variable 'map_bh' is passed to ntfs_get_block_vbo(), and after buffer unlock it may be prematurely freed, leading to a stack out-of-bounds read.

In the Linux kernel ftrace subsystem, readers of set_ftrace_filter and set_ftrace_notrace files use a pointer to the global hash instead of a copy. After releasing locks, the global hash can be updated, leading to use-after-free and similar bugs.

In the Linux kernel tracing module, a slab-out-of-bounds read vulnerability exists in the strsep function. The issue occurs when trace_get_user fails to set the parser buffer end to 0 after processing an overly long string, leading to an out-of-bounds access in ftrace_regex_release.

In the Linux kernel, Hygon processors lacked the resctrl_cpu_detect() call in BSP initialization, causing a division by zero fault during boot. The issue appeared after the function was moved to vendor-specific code.

In the i2c driver for the RTL9300 chip in the Linux kernel, an out-of-bounds read vulnerability was found in the rtl9300_i2c_smbus_xfer function. The data->block[0] variable comes from user input and without proper validation can be very large, leading to memory corruption.

A vulnerability was found in the Linux kernel's backlog accounting in qdisc_dequeue_internal for hhf, fq, fq_codel, and fq_pie qdiscs. When a tbf parent runs out of tokens, packets are placed in gso_skb, and backlog is not properly decremented when dropping packets due to limit changes. This causes a backlog underflow in the parent tbf, potentially leading to network queueing issues.