Linux kernel vulnerabilities

A data corruption vulnerability was found in the Linux kernel's BPF and KTLS mechanism. When sending plaintext data, the ciphertext length is not recalculated after the plaintext is reduced by socket policy, leading to transmission of uninitialized data.

In the BPF subsystem in the Linux kernel, a vulnerability was found where the BPF_JSET instruction (conditional jump if a & b) was not properly handled in the can_jump() function during control flow graph (CFG) computation. This led to incorrect determination of live registers and SCC calculations.

In the Linux kernel rtl818x driver, a NULL pointer dereference vulnerability exists in the rtl8187_tx_cb function. The issue occurs when in rtl8187_stop() the TX status queue is cleared before killing anchored URBs, allowing a callback to use already freed skb.

In the Linux kernel ath11k Wi-Fi driver, the initialized flag for SRNG lists is not cleared during deinitialization. After a crash and recovery attempt, a subsequent call to dump SRNG stats may access freed memory, causing a page fault and kernel panic.

In the mt7925 WiFi driver in the Linux kernel, there is an off-by-one error in the mt7925_mcu_hw_scan() function. Using >= instead of > may lead to an out-of-bounds array access.

In the mt76 WiFi driver in the Linux kernel, there is an out-of-bounds (OOB) access vulnerability in mt7996_tx(). If link_id is set to IEEE80211_LINK_UNSPECIFIED, it may read or write outside the allocated memory.

A use-after-free vulnerability was found in the Linux kernel's amdgpu driver in the amdgpu_userq_suspend function. It occurs during PCI hot-unplug and can lead to reading freed memory.

In the panthor DRM graphics driver in the Linux kernel, there is a use-after-free (UAF) vulnerability in panthor_gem_create_with_handle() debugfs code. The object may be freed before initialization completes, leading to access to freed memory.

In the Xen driver (gntdev), there is a use-after-free (UAF) vulnerability in the dmabuf_exp_from_pages() function. After calling dma_buf_fd() and fd_install(), objects like gntdev_dmabuf can be destroyed by closing the descriptor, and then are still used.

In the IOMMU subsystem (Intel VT-d) in the Linux kernel, there is a use-after-free (UAF) vulnerability during SVA unbind with pending IOPFs. The iopf_for_domain_remove() function is called before blocking hardware and flushing pending page faults, leading to premature freeing of data structures.

A double-free vulnerability was found in the Linux kernel's Bluetooth subsystem in the 'hci_discovery_filter_clear()' function. The issue is caused by a race condition where the 'uuids' array can be freed twice before being set to NULL.

In the Linux kernel's Bluetooth subsystem, an out-of-bounds read vulnerability was found in the hci_devcd_dump function. The issue is caused by incorrect call ordering: dev_coredumpv may free the buffer pointed to by hdev->dump.head before skb_put_data safely reads it.

A vulnerability in the Linux kernel's BPF subsystem causes a kernel warning when performing narrower access to pointer fields in context structures. The issue occurs when a BPF program reads fewer bytes than the pointer field size, leading to a context access conversion error.

In the Linux kernel's mlx5e driver, a bug was found where after hardware decryption, if the xfrm (IPsec) state was freed before lookup, the secpath extension on the skb was not removed. This caused access to an invalid pointer and a system crash (page fault) during security policy checks.

In the Linux kernel BPF JIT for ARM64, when a program acts as an exception boundary, find_used_callee_regs() is not called, leaving ctx->fp_used false. Consequently, the frame pointer (FP) is not set up in the prologue, potentially causing a kernel crash due to a page fault.

A double destruction of the rsv_qp object was found in the Linux kernel's RDMA HNS driver. The issue occurs when rsv_qp is destroyed first in free_mr_init() and then in hns_roce_exit() during error handling, leading to list corruption.

In the ext4 filesystem in the Linux kernel, a use-after-free vulnerability exists in ext4_end_io_rsv_work(). The issue occurs when an io_end is added to the i_rsv_conversion_list without checking if conversion is needed, and the inode may be freed before the work executes, leading to use-after-free.

In the f2fs filesystem in the Linux kernel, KMSAN detected use of uninitialized values in the extent_info structure. The get_read_extent_info() function initializes only three fields (fofs, blk, len), leaving others uninitialized, leading to undefined behavior during extent merging.

A use-after-free (UAF) vulnerability was discovered in the Linux kernel's F2FS filesystem in the f2fs_sync_inode_meta() function. Reported by syzbot, it can cause reading freed memory during inode metadata synchronization.

In the Linux kernel, a vulnerability in the F2FS filesystem causes a kernel panic during f2fs_evict_inode due to a use-after-free in inode list operations. An attacker could trigger this to crash the system.

In the PPTP driver in the Linux kernel, there is an uninitialized data read vulnerability in the pptp_xmit() function. Lack of minimal skb length check can lead to out-of-bounds memory read.

In the cs42l43 SPI driver in the Linux kernel, the property entries array is not null-terminated. When unterminated, this can lead to a fault in the cs35l56 amplifier driver as the node parser walks off the end of the array into unknown memory.

A vulnerability in the Linux kernel's ipv6_gso_segment() function allows rejecting malicious IPv6 packets with overly long extension headers. The issue causes an overflow of the 16-bit skb->transport_header field, potentially leading to a system crash.

In the Linux kernel sunrpc module (NFS over TLS), a vulnerability exists in TLS alert handling. The tls_alert_recv function assumes valid data in the msghdr iterator's kvec, which can be exploited. A rework of control message setup and usage via sock_recvmsg() is proposed.

In the fbnic network driver in the Linux kernel, a use-after-free (UaF) vulnerability exists in the AF_XDP part. When the device fails to open, the NAPI pointer is not cleared from the queue, leading to use-after-free in xsk_bind().

A stack out-of-bounds write vulnerability was found in the Linux kernel's mqprio network scheduler. The issue occurs when validation of TCA_MQPRIO_TC_ENTRY_INDEX allows value 16, while the fp[] array has only 16 elements (indices 0-15).

A use-after-free vulnerability was found in the Linux kernel's USB gadget driver in the composite_dev_cleanup() function. The issue occurs when the cdev->os_desc_req pointer is freed but not set to NULL, leading to reuse after an allocation failure.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel memory management subsystem. The issue occurs when a VMA (Virtual Memory Area) is recycled after being freed, and vma_end_read() calls rcuwait_wake_up() using a stale pointer to mm. An attacker could exploit this to access freed memory.

In the Linux kernel, the ksmbd module has incorrect buffer length validation in smb2_set_ea(). It fails to check buffer length before accessing the next smb2_ea_info, potentially leading to out-of-bounds read.

In the Linux kernel, the ksmbd module has an out-of-bounds read vulnerability in the smb2_write function. The issue arises from lack of validation of the hdr->NextCommand field, which could allow oversized SMB2 write length and lead to out-of-bounds read.

In the Linux kernel, the ksmbd server lacks a call to rcu_barrier() during module unload, which can lead to a race condition and unintended execution of kernel code locally, bypassing protections such as Kernel Lockdown.

In the Linux kernel, there is a vulnerability in ipv6: mcast where a delayed put of pmc->idev in mld_del_delrec() could lead to a use-after-free. pmc->idev is still used in ip6_mc_clear_src(), so the reference should be put after ip6_mc_clear_src() returns.

The AXP717 ADC driver in the Linux kernel is missing a sentinel entry in its channel maps, triggering a KASAN warning.

In the am65-cpsw-nuss driver in the Linux kernel, memory for skb_shared_info was not allocated during the transition to build_skb(), causing incorrect skb size.

In the Linux kernel Appletalk protocol (net/appletalk), the atrtr_create() function did not release the old device reference before assigning a new one when updating an existing route entry, leading to a device refcount leak.

In the Linux kernel tracing subsystem, when adding trace events by a module, a write lock on the trace_event_sem semaphore was missing. When two modules are loaded simultaneously, this can corrupt the ftrace_events list and crash the kernel.

In the airoha driver in the Linux kernel, there is a potential use-after-free in airoha_npu_get() because np->name is used after calling of_node_put(np).

In the Linux kernel, a vulnerability in the libwx driver causes improper reset of Rx ring descriptors during device reset. Stale descriptor values can lead to malformed SKBs, resulting in a kernel BUG and system crash.

In the Linux kernel, the bprintf helpers (e.g., bpf_trace_printk) mishandled the "%p%" format sequence, causing a kernel warning at runtime because the second percent sign was skipped during %p processing.

In the Intel Ethernet driver (ice), the function ice_lag_is_switchdev_running() can be called outside LAG event handler code, causing lag->upper_netdev to be NULL. Missing NULL check before dereference leads to a NULL-pointer dereference.

In the Linux kernel, a vulnerability in the RxRPC subsystem causes a warning in local_bh_enable() when rxrpc_assess_MTU_size() is called with interrupts disabled. This occurs during incoming call acceptance, leading to potential system instability.

A race condition was found in the rxrpc module of the Linux kernel between two recvmsg threads for a completed call. One thread could terminate and release the call while the other was still processing it, leading to a BUG.

In the CIFS client (smbdirect) in the Linux kernel, there is a vulnerability due to the packet area in smbd_response allocation not being marked as allowed for usercopy. When CONFIG_HARDENED_USERCOPY=y, copying data from the packet to a folioq buffer causes a kernel BUG.

In the AF_RXRPC subsystem of the Linux kernel, when a service socket is opened and bound but no preallocation of calls has been done, the rxrpc_backlog struct is not allocated. Calling rxrpc_alloc_incoming_call() then causes an oops.

A vulnerability enabling A-MSDU attacks in mesh networks has been fixed in the Linux kernel. The flaw allowed spoofing A-MSDU frames, potentially leading to traffic interception or modification. The patch detects attack attempts by analyzing Mesh Control headers.

In the drm/xe/pf driver in the Linux kernel, LMEM buffer objects are not cleared on allocation, potentially leaving stale data in LMTT PTEs, allowing a malicious VF to access other VFs' or PF's memory.

In the Linux kernel for x86/SEV, a bug was found in Secure TSC frequency calculation. Using the nominal P0 frequency from the GUEST_TSC_FREQ MSR causes a slight deviation from the actual mean TSC frequency, leading to accumulating clock skew between the hypervisor and SEV-SNP VM. The fix uses TSC_FACTOR from the SEV firmware secrets page to accurately calculate the mean TSC frequency.

In the mwifiex driver for Marvell WiFi cards, a vulnerability was found where in concurrent STA/AP mode, the firmware incorrectly sends disassociation frames to the STA interface when clients disconnect from the AP. This causes kernel warnings and potential system instability.

In the Linux kernel, the clone_private_mnt() function lacks a check for CAP_SYS_ADMIN in the correct user namespace. It only checks MNT_LOCKED but does not verify admin rights in the namespace the mount belongs to.

A memory leak flaw was found in the Linux kernel's ksmbd component. If a client sends a session setup request with an unknown NTLMSSP message type, it can lead to resource exhaustion.