Linux kernel vulnerabilities

A vulnerability was found in the Linux kernel's HFSC network scheduler (sch_hfsc). During a single dequeue, a class can be marked passive twice, leading to incorrect decrementing of the parent's active class counter. As a result, a parent with active child classes is removed from the vttree, and queues stop being processed (stall).

In the Linux kernel, TIPCv2 mutating netlink operations lacked admin permission checks, allowing unprivileged local processes to change TIPC state. The fix adds CAP_NET_ADMIN requirement.

In the Linux kernel TIPC subsystem, the CONN_ACK handler did not validate the ack count, allowing an oversized ack to underflow snt_unacked and permanently stall the connection's send side.

In the Linux kernel TIPC subsystem, peer-advertised service ranges were not validated for lower <= upper, allowing inverted ranges to leak memory in the binding table.

A vulnerability in the Linux kernel ALSA SEQ subsystem leaks a kernel heap address to userspace. The bounce_error_event() function sent SNDRV_SEQ_EVENT_KERNEL_ERROR with a raw pointer to all clients, including user clients, exposing the address via copy_to_user(). The issue affects the fixed-length branch not covered by a previous fix.

In the Linux kernel IOMMU DMA subsystem, the P2PDMA path incorrectly assigned the DMA length from the head segment instead of the current segment, corrupting lengths for multi-segment scatterlists.

A vulnerability was found in the Linux kernel's SPI driver for Xilinx devices. The driver incorrectly determines the FIFO buffer size, not accounting for the shift register, which leads to data loss and driver looping during SPI transfers in interrupt mode.

In the Linux kernel CXL region subsystem, cxl_cancel_auto_attach() used cxled->pos as an index into p->targets[], but it could be a negative errno, causing out-of-bounds access.

In the Linux kernel CXL region subsystem, a vulnerability exists where NULL pointer holes can remain in the target array of an active region after removing endpoint decoders. This leads to NULL pointer dereference (general protection fault) and incorrect counting of attached decoders, potentially causing malfunction. The fix fills the first free target slot during auto-discovery.

In the Linux kernel, the CXL region subsystem now blocks region deletion during region creation. The lock scope was expanded to prevent deletion in the critical period between construction and target attachment, and between device registration and removal action registration. Without this, userspace could confuse the kernel and violate assumptions about region lifetime.

In the Linux kernel, the CXL region subsystem resolves region deletion races. Instead of installing new devres actions per region, the existing root decoder unregistration event is used to remove all remaining regions. An xarray of regions replaces the devres list, addressing three issues: sysfs users racing to delete the same region, multiple actions triggering deletion, and userspace racing devres_release_all().

In the Linux kernel, the power supply core fixes an allocation issue for the supplied_from property. When the dts property power-supplies has multiple values, accessing psy->supplied_from[i-1] in __power_supply_populate_supplied_from can overrun the supplied_from array.

In the Linux kernel, the handshake subsystem now requires admin permission for the DONE command. Previously, DONE had no privilege check, allowing an unprivileged process to send a forged DONE with status 0, causing the kernel to treat the handshake as successful, or with a non-zero status, tearing down a legitimate in-flight handshake.

In the Linux kernel, the net/sched/sch_dualpi2 module has a vulnerability leading to a null-pointer dereference. During peek, when dualpi2 drops packets, it calls qdisc_tree_reduce_backlog before restoring the qlen counter, which can mistakenly deactivate the parent class and cause a system crash.

In the Linux kernel, the net: mana subsystem initializes the gdma queue id to INVALID_QUEUE_ID. Previously, the id remained 0, which could lead to deleting an incorrect queue during cleanup after a failed creation, potentially corrupting gc->cq_table[0] and affecting another queue.

A vulnerability in the Linux kernel's network watchdog code (net/sched/sch_generic.c) involves races in reference tracking. Lack of synchronization between netdev_watchdog_up() and dev_watchdog() can lead to list corruption and system crash.

In the Linux kernel, the t7xx WWAN driver's t7xx_port_ctrl_tx() function clones each skb fragment before passing it to the transmit path. The lack of a check on skb_clone() results in a NULL pointer dereference when cloning fails.

In the Linux kernel, the KCM module's kcm_attach() and kcm_unattach() functions replace callback pointers (sk_data_ready, sk_write_space) on a live TCP socket without using WRITE_ONCE(). This can lead to inconsistent observations of these fields on other CPUs and incorrect callback invocations.

A vulnerability in the Linux kernel's ALSA sequencer subsystem related to FIFO resize operation (snd_seq_fifo_resize) has been identified. The issue involves stale cells remaining in the FIFO during resize, leading to a deadlock in snd_seq_pool_done when deleting the old pool. An attacker can trigger this via ioctl calls, causing a thread to block indefinitely.

In the Linux kernel, the netfilter nf_dup_netdev module's nft_dup and nft_fwd functions have been updated to use the nf_dev_xmit_recursion() helpers. Additionally, bottom halves (BH) are disabled during skb transmission to prevent migration to a different CPU and imbalanced decrementation of recursion counters.

In the Linux kernel, the BPF mechanism for uprobe_multi data lacked an access_ok check before using __get_user, potentially allowing unauthorized access to user memory. The fix adds proper bounds checking.

A use-after-free vulnerability was found in the Linux kernel's udp_bpf_recvmsg() function for sockmap. The issue stems from missing serialization of access to the sk_msg structure, which can lead to use of freed memory during concurrent reads. The fix restores lock_sock() in this function.

A vulnerability was found in the Linux kernel's BPF sockmap mechanism, involving an integer overflow in the bpf_msg_pop_data() function. The addition of start + len is performed in 32-bit arithmetic, allowing the bounds check to be bypassed and leading to an out-of-bounds access on the scatterlist, resulting in a general protection fault and potential system crash.

In the Linux kernel's TCP for IPv6, the ip6_default_advmss() function can return IPV6_MAXPLEN (65535), which is interpreted as mss_clamp, allowing MSS to reach 65535. However, 0xFFFF is also used as a magic value GSO_BY_FRAGS, which can lead to a NULL pointer dereference during TCP packet segmentation.

In the Linux kernel's RDMA bnxt_re driver, the dpi variable is initialized only for the BNXT_RE_ALLOC_WC_PAGE case, but it is copied for all cases. Lack of initialization may lead to use of an uninitialized value.

In the Linux kernel's RDMA bnxt_re driver, the toggle page for SRQ is freed before firmware teardown completes, which could allow an NQ interrupt to write to an already-freed page. The fix moves the page free after bnxt_qplib_destroy_srq().

In the Linux kernel's RDMA bnxt_re driver, the toggle page for CQ is freed before firmware teardown completes, which could allow an NQ interrupt to write to an already-freed page. The fix moves the page free after bnxt_qplib_destroy_cq().

In the Linux kernel's RDMA bnxt_re driver, when dumping MR info using the rdma tool, the kernel pointer mr_hwq is displayed. There is no need to expose this value to the end user, so it has been removed.

In the Linux kernel's RDMA bnxt_re driver, there is a missing max slot check for SQ. The WQE mode variable must be validated against the maximum slots supported by HW (max 64K). Added max and min checks to fail if user supplied value is more than max or zero.

In the Linux kernel, in the ksmbd module, same_client_has_lease() returns an opinfo pointer from ci->m_op_list after dropping ci->m_lock without taking a reference. This can lead to use-after-free during concurrent close. A reference is now taken and released after copying the lease state.

In the Linux kernel, in the staging rtl8723bs driver, the rtw_aes_decrypt function had an incorrect stainfo pointer check that returned _FAIL on a valid pointer. The guard is inverted to return _FAIL only on an invalid pointer.

In the Linux kernel, in the staging nvec driver, nvec_rx_completed() has a use-after-free bug. After calling nvec_msg_free(), the code still reads nvec->rx->data[0], which may be overwritten by a concurrent nvec_msg_alloc() call. The fix saves the message type byte before freeing and uses the saved value.

In the Linux kernel, in the soundwire subsystem, the sdw_add_element_group_count function had an out-of-bounds memory access in the for-loop when i == num. The fix adds a check for existing rate/lane entries before adding them, with no functional changes apart from this fix.

In the Linux kernel, in the PCI subsystem, pci_get_rom_size can crash due to out-of-bounds access to ROM space or misaligned data structure address. Added checks for image header and data structure address, and alignment checking, to prevent crashes on x86_64 and arm64.

In the Linux kernel, the mtk-adsp mailbox driver has a use-after-free vulnerability during device teardown. When SOF audio driver initialization fails, the snd_sof_dev object is freed, and a late interrupt can trigger a handler after the channel is freed, leading to access of freed memory. The fix uses disable_irq() and IRQF_NO_AUTOEN to prevent interrupts from firing at inappropriate times.

In the Linux kernel, the coresight platform subsystem has an issue where connection counters are incremented before successful memory allocation. If allocation fails, the counter remains incremented, and cleanup functions may dereference invalid pointers, causing a kernel panic. The fix moves counter increments after all allocations succeed.

In the Linux kernel, the most: video driver has a double free vulnerability during failed video device registration. The function comp_register_videodev() frees the video_device, but the error path in __video_register_device() also frees it, leading to a double free. The fix uses video_device_release_empty() during registration to avoid double freeing.

In the Linux kernel, the USB host max3421 driver has a shift-out-of-bounds vulnerability in max3421_hub_control(). An untrusted userspace process can send a USBDEVFS_CONTROL request with wValue greater than or equal to 32, causing an out-of-bounds bit shift and corrupting port_status, including immutable bits. The fix rejects requests with a value exceeding the shift width.

In the Linux kernel, the gpib driver has a double decrement of the descriptor_busy counter in command_ioctl(). The error path inside the loop decrements the counter and breaks, but then an unconditional decrement after the loop occurs, causing an underflow. This re-enables the use-after-free that the original fix intended to prevent. The fix removes the early decrement from the error path.

In the Linux kernel, the iio: magnetometer ak8975 driver has a potential kernel stack memory leak. If i2c_smbus_read_i2c_block_data_or_emulated() returns fewer bytes than the buffer size, uninitialized bytes remain in the buffer and are passed to IIO buffers, potentially leaking kernel memory to userspace. The fix adds a check that the return value equals the buffer size.

In the Linux kernel, the iio: adc xilinx-ams driver has an out-of-bounds read vulnerability in ams_event_to_channel(). The function may return a pointer past the end of dev->channels when no matching scan_index is found, leading to invalid memory access in ams_handle_event(). The fix adds a bounds check and returns NULL when no channel is found.

In the Linux kernel, the iio: accel mma8452 driver has an issue with handling I2C read errors in mma8452_read(). If the I2C read fails but mma8452_set_runtime_pm_state() succeeds, the function returns 0, causing the caller to use uninitialized stack memory. The fix adds proper checking of the I2C read return value and propagates errors to the caller.

In the Linux kernel, the NTFS3 filesystem has an out-of-bounds read vulnerability in run_get_highest_vcn(). The function parses a packed mapping-pairs buffer without any length bound, relying solely on a 0x00 terminator. A crafted $LogFile UpdateMappingPairs record can cause a read past the slab allocation, triggering a KASAN error during mount. The fix adds a run_buf_size parameter and rejects run headers whose payload would extend past the buffer end.

In the Linux kernel, the dma_release_channel() function has a use-after-free vulnerability. The privatecnt check occurs after calling dma_chan_put(), which may release the last reference to the device if the DMA provider is already gone, leading to memory free. The fix moves dma_chan_put() before the check.

In the Linux kernel, the dma-axi-dmac driver has an issue with incomplete freeing of the axi_dmac_desc structure. In the error path after calling axi_dmac_alloc_desc() in axi_dmac_prep_peripheral_dma_vec(), the axi_dmac_free_desc() function is not used, leading to memory leak or incomplete release.

In the Linux kernel, the dma-axi-dmac driver has an issue with DMA descriptor management. Using dma_alloc_coherent() may cause memory remapping (vmalloc) on architectures like Microblaze or arm64, leading to a BUG() when calling dma_free_coherent() from softirq context. The fix uses a DMA pool to manage descriptors, avoiding direct dma_free_coherent() calls in interrupt context.

In the Linux kernel, the NTFS3 filesystem has a vulnerability involving the use of an uninitialized variable lcn. When the sought VCN is not found in runs[0], run_lookup() returns false, leading to premature exit from attr_data_get_block_locked() without initializing lcn, triggering a KMSAN bug. The fix moves the clen check before the lcn check in ni_seek_data_or_hole().

In the Linux kernel's NTFS3 filesystem (fs/ntfs3), there is a buffer overflow vulnerability. During mounting of a dirty NTFS volume, log_replay() allocates one_page_buf using the host page size, then may adopt a larger on-disk page size from the restart area. If the on-disk page size is larger than the initial allocation, the buffer remains undersized, and a subsequent read of log->page_size bytes into it causes an overflow.

In the Linux kernel's xprtrdma subsystem, a vulnerability was found due to a kref imbalance when handling the ADDR_CHANGE event. If this event arrives before ESTABLISHED, an ep_put is called without a matching ep_get, leading to a kref underflow and use-after-free during disconnect.

In the Linux kernel, the xprtrdma module has a race condition during re_id initialization. rpcrdma_create_id() registers ep->re_rn before rpcrdma_ep_create() assigns ep->re_id, allowing a local administrator to trigger RDMA device removal in that window, leading to NULL pointer dereference in trace_xprtrdma_device_removal(). The fix assigns re_id before publishing re_rn.