Linux kernel vulnerabilities

In the Linux kernel, in the udp_tunnel subsystem, a vulnerability was fixed involving double queueing of work in udp_tunnel_nic_device_sync, leading to a use-after-free. The fix involves returning early if the work_pending flag is already set.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's TIPC UDP media bearer. The cleanup_bearer() function destroys the dst_cache before synchronizing with RCU readers, which can lead to system crashes or rcuref warnings. Additionally, freeing the ub structure after synchronize_net() without closing the socket first leaves a window for UAF for concurrent receivers.

In the Linux kernel, in the ALSA FCP subsystem, a NULL pointer dereference vulnerability was fixed during interface lookup. A malicious USB device can provide an interface without endpoint descriptors, leading to memory safety issues.

In the Linux kernel, in the BPF subsystem, a vulnerability was fixed where BPF verifier logs did not mask pointer values for certain pseudo-source types, potentially leaking kernel addresses. The fix extends masking to all pseudo types.

In the Linux kernel, in the BPF subsystem, a memory leak in the verifier error handling path was fixed. When allocation of env->succ fails, freeing of env->insn_aux_data is skipped, leading to a memory leak. The fix moves the freeing to the err_free_env label.

In the Linux kernel, seg6_validate_srh() lacks a minimum length check before reading fixed SRH fields. The BPF SEG6 encap path can supply a too-short buffer, leading to an out-of-bounds read.

In the Linux kernel's hwmon subsystem (pmbus/core), pmbus_data2reg_vid() always uses VR11 encoding, ignoring the configured vrm_version. This can lead to sending wrong codes to PMBUS_VOUT_COMMAND, resulting in incorrect voltage.

In the Linux kernel's adm1275 hwmon driver, i2c_smbus_read_block_data() reads up to 32 bytes into an uninitialized stack array without appending a null terminator. The strncasecmp() comparison may read beyond the returned length, leading to an uninitialized stack memory read.

In the Linux kernel's hwmon subsystem (pmbus), regulator events are passed to the regulator core as a combined bitmask. If multiple distinct faults occur, the mask does not match any case in regulator_handle_critical(), bypassing the critical hardware protection trigger.

In the Linux kernel's aspeed-g6-pwm-tach hwmon driver, aspeed_tach_val_to_rpm() does not check if the tachometer value is zero before dividing. This can lead to a divide-by-zero and kernel panic.

In the Linux kernel's IPv6 fib6, during multi-batch dump, inet6_dump_fib() saves progress as a positional index within the current hash chain. A concurrent insertion of a new table can shift entries, leading to a wrong pointer and NULL dereference in fib6_walk_continue(), causing a kernel panic.

In the Linux kernel's sfp driver, sfp_i2c_mdiobus_destroy() does not free the allocated mii_bus, leading to a memory leak when an SFP module is removed.

A vulnerability in the Linux kernel's net/sched sch_teql module involves missing synchronization of the teql master's slaves list, leading to race conditions and use-after-free (UAF) during concurrent queue operations. This can compromise memory integrity.

A use-after-free vulnerability was found in the Linux kernel's bridge subsystem related to STP. Missing IFF_UP check in br_topology_change_detection() allows arming the topology change timer while the bridge is administratively down, leading to use-after-free when the bridge is deleted.

In the Linux kernel's Panthor DRM driver, a locking issue was found with dma_fence objects. Since these objects can be shared with other subsystems and accessed from hardirq context, the IRQ-safe variant must be used when acquiring the lock.

In the Linux kernel's Panthor DRM driver, a potential invalid pointer dereference was found in group_process_tiler_oom(). If heaps is an ERR_PTR(), panthor_heap_pool_put() will dereference an invalid pointer.

In the Linux kernel's Panthor DRM driver, a memory leak was found when a group is evicted before the tiler OOM is serviced. A group reference is tied to the pending tiler_oom_work, so it must be released if the cancellation was effective.

In the Linux kernel's fprobe tracing mechanism, a NULL pointer dereference vulnerability was found in fprobe_fgraph_entry(). During two walks of the fprobe list (one for sizing, one for filling), a new fprobe can become visible, leading to writing past reserved memory and a crash.

In the Linux kernel's irqchip/ts4800 driver, a missing chained handler cleanup on remove was found. After driver removal, a dangling handler remains that may be called when the parent interrupt fires, potentially accessing freed memory and causing a kernel crash.

In the Linux kernel's SCTP subsystem, a race condition was found in sctp_free_addr_wq() regarding the addr_wq_timer. Using timer_delete() does not guarantee that a currently running timer handler has completed, which can lead to use-after-free.

In the Linux kernel's ksmbd server, a vulnerability was found where undersized DACLs are not properly rejected before parsing ACEs. Due to an underflow in the calculation, a malicious client can bypass the ACE count limit and cause excessive memory allocations.

In the Linux kernel's xen/pvcalls driver, the request ID (req_id) from the backend is not validated before being used as an index into the rsp[] array. A malicious or buggy backend can set req_id out of bounds, leading to an out-of-bounds write. Additionally, the int type for req_id does not cover u32 values, allowing negative indexing.

In the Linux kernel, vfs_tmpfile() does not check whether the caller's fsuid and fsgid map into the filesystem. On an idmapped mount that does not cover the caller, a new temporary file (O_TMPFILE) is created with owner (uid_t)-1, which is incorrect. Other file creation paths already perform this check.

In the Linux kernel, in afs_extract_vl_addrs(), error codes are only set on the first iteration of the loop. Subsequent iterations do not update them, which can lead to incorrect error reporting.

In the Linux kernel's AFS filesystem, the AS_RELEASE_ALWAYS flag is set for symlinks and mountpoints that use afs_dir_aops without a release_folio callback. This causes try_to_free_buffers() to be called with null buffer_heads, leading to a pointer dereference.

In the Linux kernel's AFS filesystem, the net->cells_outstanding counter is incremented before checking for failure of idr_alloc_cyclic(). On error, the counter remains incremented, leading to an incorrect state.

In the Linux kernel's AFS filesystem, initializing the work_struct lock_work only once in the slab init function is insufficient. This causes DEBUG_OBJECTS warnings and potential issues on reuse. The fix requires reinitialization after inode allocation and flush before eviction.

In the Linux kernel's AFS filesystem, callback service message parsers do not pass through -EAGAIN correctly. afs_extract_data() returns -EAGAIN, but it is inadvertently converted to 0, which can lead to incorrect processing.

In the Linux kernel's AFS filesystem, afs_break_some_callbacks() does not check if afs_lookup_volume_rcu() returned NULL (e.g., when the volume is unknown). This could lead to a NULL pointer dereference.

In the Linux kernel's AFS filesystem, there is a lack of locking around modifications of net->cells_dyn_ino. The fix requires taking net->cells_lock exclusively and moving the removal of the cell from net->cells_dyn_ino to afs_destroy_cell_work(), because afs_cell_destroy() runs in RCU cleanup context.

In the Linux kernel's AFS filesystem, afs_insert_volume_into_cell() sets the AFS_VOLUME_RM_TREE flag on the new volume instead of the replaced one. This causes the old volume to be removed from the tree twice and the new volume never to be removed.

In the Linux kernel iomap code, during atomic direct I/O, when bio_iov_iter_get_pages() or the bounce helper builds a short bio, the REQ_ATOMIC size check rejects it before submission. The old error path only dropped the bio reference, leaving pages attached to the bio unreleased. The fix releases or unbounces the pages before falling through to out_put_bio.

In the Linux kernel Minix filesystem, minix_check_superblock() uses minix_blocks_needed() to verify bitmap block counts. The calculation uses unsigned int arithmetic, which can overflow when s_ninodes or s_zones is near UINT_MAX. This leads to accepting a zero bitmap block count, and then minix_fill_super() dereferences s_imap[0] or s_zmap[0], causing a kernel panic.

In the Linux kernel cachefiles module, the nomem_d_alloc error path in cachefiles_get_directory() has a double unlock. When start_creating() fails with -ENOMEM, it already releases the parent directory lock, but the error path calls inode_unlock() again, corrupting the rwsem state.

In the Linux kernel iomap code, when trimming io_size to EOF, an underflow can occur if end_pos is below ioend->io_offset. This causes io_size to wrap to a huge value, potentially leading to errors in write handling and data corruption.

In the Linux kernel netfs module, writethrough writes did not set the NETFS_RREQ_OFFLOAD_COLLECTION flag on the request, causing collection to be processed only at the end, and asynchronous O_SYNC writes might not be collected at all. The fix sets this flag.

In the Linux kernel netfs module, error handling in the writeback_iter() loop is incorrect. If an error occurs, writeback_iter() needs to be called again with the error set to clean up iteration state, and the current folio needs unlocking and redirtying.

In the Linux kernel netfs module, during writeback iteration, when ENOMEM occurs, the state of the current folio is incorrect. The folio needs to be redirtied and unlocked before the terminal writeback_iter() is invoked.

In the Linux kernel DRM xe driver, xe_pt_zap_ptes_entry() calls container_of(*child) before checking if the child pointer is NULL, leading to a NULL pointer dereference and crash. The fix moves the container_of() call after a NULL guard, so the function returns early instead of proceeding with an invalid pointer.

In the Linux kernel DRM xe driver, the error path in hw_engine_init() has a double-free of a managed BO. The BO allocated with xe_managed_bo_create_pin_map() has a devm cleanup action registered, and the explicit xe_bo_unpin_map_no_vm() causes a double-free during devm unwind. The fix removes the explicit free.

In the Linux kernel, the drm/xe/pf driver was found to process FAST_REQ or EVENT messages, which can break the VF/PF ABI protocol and trigger an assert on the PF side. The fix prevents the PF from handling these message types.

In the Linux kernel, the drm/xe driver has a NULL pointer dereference vulnerability in bo_meminfo(). When a buffer object is purged, its ttm.resource is set to NULL, but the BO remains in the client's list. Querying memory stats during this time leads to a NULL dereference.

In the Linux kernel, the drm/xe/pt driver has an issue with invalid cursor access for purged BOs. Functions xe_pt_hugepte_possible() and xe_pt_scan_64K() did not check if the BO was purged, leading to warnings and potential misbehavior.

In the Linux kernel, the uprobes mechanism for x86 has a bug where the wrong mm_struct is used in __in_uprobe_trampoline. In the unregister path, current->mm is used instead of the traced process's mm_struct, which is incorrect in the tracer context.

In the Linux kernel, the cifs module has a missing credit release in the failure path of cifs_issue_read(). This can lead to overwriting the credits value when retrying the subrequest, disrupting resource management.

In the Linux kernel, a use-after-free vulnerability was found in the NTFS filesystem's $MFT writeback path. The issue arises from dereferencing a runlist element pointer after releasing the lock, while concurrent $MFT allocation extension can free the underlying memory. This can lead to system crashes or potential code execution.

In the Linux kernel's NTFS filesystem, a use-after-free vulnerability was found in ntfs_attr_fallocate(). The issue arises from dereferencing a runlist element pointer after releasing the lock, which can lead to accessing freed memory. An attacker could exploit this flaw to cause a system crash or potentially escalate privileges.

In the Linux kernel, the HID-BPF module has a vulnerability in hid_bpf_get_data() due to an incorrect range check. Because of unsigned arithmetic, a very large size can wrap the sum and bypass the check, allowing a pointer outside the buffer to be returned.

In the Linux kernel, the netfilter xt_u32 module lacks validation of shift counts supplied by rules. A malformed rule can provide a shift count of 32 or more, triggering an undefined shift out-of-bounds during packet evaluation. Validation of XT_U32_LEFTSH and XT_U32_RIGHTSH operands was added in u32_mt_checkentry() to reject malformed rules before they reach the packet path.

In the Linux kernel, the netfilter xt_rateest module has a truncation issue in xt_rateest_mt() where values are truncated to 32 bits. On links faster than ~34 Gbps, where byte rate may exceed 2^32-1, the comparison becomes incorrect. The fix changes local variables to u64.