Linux kernel vulnerabilities

In the Linux kernel's MPTCP implementation, a vulnerability was found due to non-atomic fallback decision and action, leading to a race condition that triggers a warning splat in __mptcp_do_fallback during incoming option processing.

In the Linux kernel, the commit 7796c97df6b1 for the soundwire qcom driver adding set_channel_map support has been reverted. The revert was necessary because the original patch caused a kernel panic on Dragonboard 845c (sdm845) and introduced three bugs: incorrect array indexing, memory corruption, and overwriting TX data with RX data.

In the fxls8962af accelerometer driver (IIO) in the Linux kernel, there is a use-after-free (UAF) vulnerability in fxls8962af_fifo_flush(). The function uses indio_dev->active_scan_mask without checking if the device is still in buffer mode, leading to a race condition when disabling buffer mode.

In the IIO backend subsystem in the Linux kernel, there is an out-of-bound write vulnerability. A buffer of size 80 characters is written without boundary check after adding a string terminator, allowing writes beyond allocated memory.

In the Comedi subsystem of the Linux kernel, do_insn_ioctl() and do_insnlist_ioctl() allocate at least 16 data elements for instructions but do not initialize all of them. For write-to-subdevice instructions, uncopied elements remain uninitialized, potentially causing the handler to read uninitialized memory.

A race condition in the Linux network scheduler (sch_qfq) occurs when the 'agg' structure is modified in qfq_change_agg while other threads access it concurrently. This can cause NULL dereference in qfq_dump_class or use-after-free in qfq_delete_class.

A vulnerability in the Linux kernel's SMC (Shared Memory Communications) implementation causes type confusion between inet_sock and smc_sock structures. The missing inet_sock as the first member of smc_sock leads to misinterpretation of memory fields, resulting in double-free and system crashes (oops).

A vulnerability in the Linux kernel's 8021q module causes incorrect VLAN ID 0 reference counting when toggling VLAN filtering at runtime. This leads to memory leaks or kernel BUG_ON crashes when deleting VLAN 0 after enabling/disabling rx-vlan-filter feature.

In the Linux kernel, uprobes can be used destructively when placed in the middle of an instruction. Since the kernel cannot verify if a byte is actually an instruction in the execution stream, the requirement for CAP_SYS_ADMIN for uprobes has been reinstated.

A use-after-free vulnerability was discovered in the Linux kernel's tipc_conn_close() function within the TIPC module. During network namespace dismantle, tipc_topsrv_stop() releases the IDR lock before calling tipc_conn_close(), allowing a concurrent worker thread to free the tipc_conn structure, resulting in a read-after-free.

A vulnerability in the Linux kernel's TCP stack involves incorrect signedness in the calculation of remaining space in an skb. A type promotion bug causes the 'copy' variable to become a large positive value, leading to overflow of 'sk_forward_alloc' and potential memory exhaustion.

A TOCTOU (time-of-check time-of-use) vulnerability was found in the vsock module of the Linux kernel during transport assignment. The transport assignment could race with module unloading, leading to use of a stale pointer.

In the Linux kernel's ATM CLIP subsystem, the function to_atmarpd() is called without RTNL lock, leading to potential NULL-pointer dereference. RTNL protection of atmarpd is insufficient because calls may come from unsleepable contexts.

In the Linux kernel's IPMI subsystem (msghandler), the function ipmi_create_user() uses a list iterator "intf" that may be an invalid pointer if the correct intf->intf_num is not found. Calling atomic_dec(&intf->nr_users) on an invalid pointer leads to memory corruption.

A vulnerability in the Linux kernel's KVM for SVM allows migration of SEV{-ES} state between hosts while vCPU creation is in progress. This can result in an SEV{-ES} VM having a non-SEV{-ES} vCPU, leading to a system crash when freeing VMSA memory.

In the Linux kernel's io_uring/msg_ring subsystem, a use-after-free vulnerability was found. The issue occurs when msg_ring adds a task to the local work queue that has already been freed, potentially leading to system crashes or exploitation.

In the Linux kernel, a vulnerability in the DRM/GEM subsystem allows a GEM handle to be released while the GEM buffer object is still attached to a DRM framebuffer. This causes the dma-buf to be freed, leading to a segmentation fault when the framebuffer is used in mode-setting operations.

In the Linux kernel's mm/rmap subsystem, the batched unmap logic in try_to_unmap_one() may read past the end of a PTE table when a large folio's PTE mappings are not fully contained within a single page table, leading to out-of-bounds access.

In the Linux kernel, an out-of-bounds access was found in the dispmix_csr_clk_dev_data function of the i.MX clock driver. When num_parents is 4, __clk_register() reads beyond the parent_names array, triggering a KASAN error.

In the Linux kernel's mlx5e driver, a race condition exists between disabling DIM (Dynamic Interrupt Moderation) and calling net_dim(). If NAPI checks the DIM state bit and sees it as active, then DIM gets disabled, the pointer to the DIM context may already be NULL, leading to a NULL pointer dereference and kernel panic.

In the Linux kernel for RISC-V with the xtheadvector extension, vector context save/restore is incorrect – only registers v0-v7 are handled properly, while v8-v31 are corrupted.

In the Linux kernel, a change setting TASK_SIZE_MAX to LONG_MAX to optimize access_ok() has been reverted. Addresses between TASK_SIZE and LONG_MAX, though not valid user addresses, were accepted by get_user_pages_fast(), causing issues (e.g., in futex). The fix restores the default TASK_SIZE, at the cost of performance.

In the Linux kernel, a bug in the order of stopping perf sampling during do_exit() caused crashes when accessing userspace after its teardown. The fix reorders operations to stop perf before mm destruction and hardens PERF_SAMPLE_CALLCHAIN and PERF_SAMPLE_STACK_USER.

In the lan743x network driver for PCI1xxxx devices, EEPROM and OTP sizes have been fixed. Maximum OTP size is 8 Kb and EEPROM 64 Kb. Size definitions and returned EEPROM length are adjusted per device, preventing out-of-bounds read/write.

In the amd-pmf driver (platform/x86/amd), memory allocations have been changed to device-managed to prevent a double free when smart PC setup fails. Previously, dev->buf was freed but not set to NULL, leading to a second free in amd_pmf_remove().

In the NFC NCI UART driver in the Linux kernel, there is a vulnerability where tty->disc_data is set before successful NCI device opening. This can lead to use of an invalid pointer if the device starts sending data before initialization completes.

In the virtio-net driver in the Linux kernel, a bug was found in the frame length check within the buf_to_xdp function for XSK (XDP Socket). For the first buffer, the frame length was incorrectly compared with a value including vi->hdr_len, potentially exceeding the allocated chunk size.

In genirq/irq_sim (interrupt simulation), work context pointers initialization has been fixed. Using kmalloc() instead of kzalloc() caused pointers to contain random data, leading to invalid dereferencing.

In nvmet (NVMe over Fabrics target), a memory leak related to bio integrity (bi_integrity) has been fixed. Since a kernel version requiring bio_uninit after bio_init, nvmet did not call bio_uninit for inline bios, causing continuous memory leak (kmalloc-128 slab).

In the mtk-sd driver, a failed DMA mapping does not stop the operation, leading to use of previous DMA settings and potential memory corruption. The fix stops the request after msdc_prepare_data() fails.

In the SCSI target subsystem (Linux kernel), a NULL pointer dereference bug in core_scsi3_decode_spec_i_port() has been fixed. In the error path, when dest_se_deve is not set, core_scsi3_lunacl_undepend_item() is called with NULL, leading to kernel panic.

In the Linux kernel, the spi-qpic-snand driver has a vulnerability due to out-of-bounds memory access. The issue arises from allocating BAM transaction structures before knowing the actual number of codewords for the NAND chip, causing memory corruption, swiotlb mapping failures, and system panics.

In the Linux kernel, the anon_inode_make_secure_inode() function was exported and a secretmem LSM bypass was fixed. The patch ensures proper security context for anonymous inodes used by KVM guest_memfd and removes the S_PRIVATE flag that bypassed LSM/SELinux checks in secretmem.

In the GPIO regulator in the Linux kernel, an out-of-bounds access to the drvdata::gpiods array was found. Memory was allocated for only one pointer, while config::ngpios can be greater than 1. The fix allocates sufficient memory.

A race condition in the Linux NFSv4/pNFS driver affects the NFS_LAYOUT_DRAIN bit. Tasks waiting on this bit in pnfs_update_layout() may never wake up even though plh_outstanding is zero, causing system hangs.

In ACPICA, calling a method with fewer arguments than expected leads to use-after-free. The fix makes ACPICA refuse to evaluate the method if arguments are missing.

In the Btrfs filesystem, during log replay, an iteration bug in extrefs processing causes an uninitialized victim_name.len field, leading to invalid memory access and potential security issues.

In the Linux kernel, a bug in the CIFS/SMB module causes a warning during channel reconnection. The smb2_reconnect_server() function passed an uninitialized dummy tcon to smb2_reconnect(), leading to an attempt to queue delayed work on an invalid object.

In the Linux kernel's ROSE protocol, two bugs in rose_rt_device_down() cause use-after-free due to incorrect iteration of the neighbour array, leaving dangling pointers.

In the virtio-net driver, the xdp_linearize_page function did not check if the received length exceeds the allocated size, leading to out-of-bound read. The fix adds the missing check.

In the Linux kernel, the RDMA/mlx5 driver had unsafe xarray access in implicit ODP handling. Functions __xa_store() and __xa_erase() were used without proper locking, triggering a lockdep warning about suspicious RCU usage.

In the Linux kernel for LoongArch in KVM, the variable index is modified and reused as an array index when modifying the EIOINTC_ENABLE register, potentially causing array index overflow.

In the Linux kernel for LoongArch architecture in the KVM module, there is a missing validation of the CPU number passed from user space. This can lead to an array pointer overflow.

A vulnerability in the Linux kernel's FUSE filesystem triggers a runtime warning during truncate_folio_batch_exceptionals due to incomplete removal of DAX entries before unmount. The fix, already applied to XFS and ext4, is now required for FUSE.

A vulnerability was found in the Linux kernel's network scheduling subsystem (net/sched). During an enqueue operation, a child qdisc may be unexpectedly emptied, triggering qlen_notify() and potentially causing a use-after-free due to class reactivation. The fix ensures qdisc_tree_reduce_backlog always notifies the parent when the child class becomes empty.

In the Linux kernel's eventpoll (epoll) mechanism, a vulnerability was found where the ep reference count is decremented before releasing the mutex. This can cause a use-after-free if another thread concurrently drops its reference and frees the memory while the first thread is still accessing the mutex.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's ftrace mechanism. When a kernel module triggers an error that disables ftrace (ftrace_disable) and is then removed, the ftrace module list entry remains but the module memory is already freed. Reading /proc/kallsyms after such event accesses freed memory and causes a system crash.

In the mt76 (mt7996) WiFi driver in the Linux kernel, fragments with multicast or broadcast RA are not dropped. According to IEEE 802.11, fragmentation applies only to unicast frames.

In the Linux kernel's software node, an out-of-bounds (OOB) check bug in software_node_get_reference_args() can cause out-of-bounds read for maliciously crafted properties.

In the fbnic network driver in the Linux kernel, there is a double-free vulnerability when DMA-mapping of a firmware message fails. The fbnic_mbx_map_msg() function does not take ownership of the message on error.