Linux kernel vulnerabilities

In the Linux kernel, the netfilter xt_connmark module (revision 2) lacks validation of shift parameters. A shift_bits value of 32 or more triggers an undefined shift, and invalid shift_dir values are accepted and silently fall back to left shift. The fix rejects invalid parameters in connmark_tg_check() so errors are caught at rule installation time.

In the Linux kernel, the platform/x86: bitland-mifs-wmi driver has a NULL pointer dereference during suspend/resume. The driver registers two WMI devices: control and event. During probe, the event device path returns early, leaving data->pp_dev as NULL. PM operations are triggered for both devices, leading to NULL dereference in bitland_mifs_wmi_suspend(). The fix adds a validity check for data->pp_dev in suspend and resume callbacks.

In the Linux kernel, the net/mlx5 (LAG) module has an off-by-one error in mlx5_lag_create_single_fdb() during error rollback. The cleanup loop starts at index i, which can operate on uninitialized state or double-tear-down a rule. The fix changes the loop start to i - 1 so only successfully-installed entries are undone.

In the Linux kernel, the mlx5e (TC) driver has a vulnerability causing a kernel crash when cleaning up peer flows in a LAG configuration. The issue occurs when mlx5_lag_get_dev_seq() returns an error, leading to invalid memory access. The fix skips peer processing when the LAG sequence lookup fails.

In the mlx5e driver for Mellanox network cards, a vulnerability was found involving zero-sized buffer allocation for HV VHCA stats. The buffer is allocated before channel initialization when the channel count is zero, resulting in ZERO_SIZE_PTR instead of NULL. After channels open and hypervisor reporting is enabled, a memset operation on this pointer causes a page fault at address 0x10.

In the mlx5e driver for Mellanox network cards, a race condition was found during HV VHCA stats agent registration. The asynchronous control path may run before work structure and agent pointer initialization, leading to NULL pointer dereference or kernel data structure corruption.

A vulnerability in the Linux kernel affects Microchip network drivers (sparx5, lan969x) related to the shared Super VCAP block. VCAP instances are not independent but were locked separately, causing races during concurrent access. An attacker can use debugfs to read rules outside rtnl, leading to corruption of hardware entries.

In the Linux kernel's net/sched: act_pedit module, there is a TOCTOU vulnerability leading to a heap out-of-bounds write during TC offload. A race between sizing a flow_rule buffer and filling it can allow an attacker with CAP_NET_ADMIN to write controlled content beyond the allocated memory region.

A vulnerability in the Linux kernel's Bluetooth 6lowpan module was found, where lowpan_enable_set() schedules work on a system queue without tracking it, allowing a race during module exit. The work can run after resources are closed, leading to use-after-free.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth 6LoWPAN module, caused by missing L2CAP connection reference during debugfs write operations. This allows a race condition where a concurrent disconnect can free the connection object while it is still being accessed.

In the Linux kernel Bluetooth (MGMT) subsystem, a use-after-free vulnerability exists during advertisement monitor addition. Improper ownership handling between the MSFT add path and management command completion can lead to use of freed memory, as shown by a KASAN report.

In the Linux kernel's Bluetooth ISO subsystem, there is a vulnerability related to improper handling of ISO_END/CONT packets. Incorrect handling can lead to memory leak of conn->rx_skb, kernel panic on skb_put, or acceptance of too short ISO_END packets.

A vulnerability in the Linux kernel Bluetooth L2CAP subsystem causes an identifier (ident) leak for commands without a response. Specifically, repeated L2CAP_LE_CREDITS packets exhaust the 1-255 ident range, leading to packets with invalid ident 0 and permanent channel stall for LE CoC.

In the Linux kernel's accel/amdxdna driver, there is a vulnerability leading to a deadlock during PM resume in hwctx_sync_debug_bo(). The function invokes a hardware callback while holding xdna->dev_lock, which can cause a deadlock when the device is suspended.

In the Linux kernel's accel/amdxdna driver, there is a use-after-free vulnerability due to a race in VMA access. The functions aie2_populate_range() and amdxdna_umap_release() access a saved VMA pointer that may have already been freed, leading to potential use-after-free.

In the Linux kernel's net/tls module, there is an issue in tls_sw_read_sock() that causes empty TLS application data records to block subsequent data records. Empty records (allowed in TLS 1.3) are not consumed, leading to an infinite loop and connection stall.

In the Linux kernel's accel/amdxdna module, there is a race condition in amdxdna_umap_release() that can lead to use-after-free when aie2_populate_range() runs concurrently.

In the Linux kernel's v3d graphics driver, there is a missing validation of the indirect buffer handle in v3d_get_cpu_indirect_csd_params(), which can lead to NULL pointer dereference when the CSD job runs.

In the Linux kernel's net/sched cake module, there is an issue with handling negative overhead values that can cause packet length to wrap to a large value, disrupting rate accounting.

A vulnerability was found in the Linux kernel's perf subsystem for AMD processors. During SVM (virtualization) toggling on PerfMonV2-capable CPUs, amd_pmu_enable_all() incorrectly enables Branch Sampling (BRS) even when not supported by hardware, leading to a #GP fault and potential system crash.

In the Linux kernel's mvebu GPIO driver, there is a memory leak during unbind because generic chips are not freed by mvebu_gpio_remove_irq_domain().

In the Linux kernel's IPv4 IGMP module, there are potential memory leaks in igmp_mod_timer() and igmp_stop_timer() due to incorrect reference counting, leading to the multicast group structure not being freed.

In the Linux kernel, the dm era module has a bug where metadata_open() returning NULL is not handled properly. The era_ctr() function only checks IS_ERR(md), and since IS_ERR(NULL) returns false, NULL is treated as a valid result, leading to a NULL pointer dereference when accessing metadata.

In the Linux kernel, a vulnerability in the CIFS/SMB client causes a busy dentry warning during unmount after direct I/O (DIO) operations. The issue stems from delayed dentry reference release via workqueues, potentially leading to improper unmount. The fix adds a per-superblock outstanding request counter and waits for it to reach zero before unmounting.

In the Linux kernel, the regulator_lock_two() function compares the error code against -EDEADLOCK instead of -EDEADLK. On MIPS, SPARC, and PowerPC architectures these values differ, causing the code to fall into WARN_ON and return with only one regulator locked when a real deadlock backoff occurs. In practice, the bug only affects MIPS because the regulator core is not built or used on the other platforms.

In the Linux kernel DRM fb-helper, the fbdev output is now synchronized to the vblank of an active CRTC only. Previously, the first CRTC was chosen, causing warnings about vblank wait timeouts when the fbdev output was not on CRTC 0. The fix selects the first active CRTC and supports both atomic and non-atomic drivers.

In the Linux kernel octeontx2-af driver, mbox handling for a VF with promiscuous and all_multi flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. This occurs because the APIs that enable/disable these rules operate only on the PF, even when the request comes via a VF interface. The fix adds an is_vf() check in the disable paths to prevent a VF from inadvertently clearing the PF's MCAM rules.

In the Linux kernel drm/xe driver, xe_vm_madvise_ioctl() allocates a VMA array in get_vmas(). On error in the L2 flush validation path for PAT madvise, the array is not freed, leading to a memory leak on each failed ioctl. The fix jumps to free_vmas instead of directly to madv_fini.

In the Linux kernel SMB client, smb2_ioctl_query_info() validates the PASSTHRU_FSCTL response payload before copying it to userspace. The addition of OutputOffset and qi.input_buffer_length can wrap in 32-bit arithmetic, allowing a malicious server to bypass the bounds check and read outside the response buffer. The fix uses size_add() for safe addition.

In the Linux kernel trace_remote_alloc_buffer(), if page allocation fails, desc->nr_cpus is not yet incremented for the current CPU, causing a partially allocated rb_desc to not be freed in trace_remote_free_buffer(). The fix increments desc->nr_cpus as soon as the first allocation for the current CPU succeeds.

In the Linux kernel mlxsw driver, mlxsw_sp_port_lag_join() does not release the LAG reference when mlxsw_sp_port_lag_index_get() fails. Other error paths jump to a cleanup label that calls mlxsw_sp_lag_put(), but this path returns an error without releasing. The fix replaces 'return err' with a goto to the cleanup label.

In the Linux kernel mlxsw driver, mlxsw_sp_vrs_lpm_tree_replace() in the error rollback loop does not update the vr pointer, causing the loop to operate on the same VR and not roll back earlier replacements. This leads to a reference leak to new_tree. The fix reinitializes vr inside the loop with the updated index.

In the Linux kernel vduse driver, there is a race between vduse_dev_msg_sync and vduse_dev_read_iter that can lead to a double list_del() crash. The fix ensures that vduse_msg is on send_list or recv_list outside the msg_lock critical section.

In the Linux kernel VDUSE driver, mapping bounce pages to userspace can leak kernel information because the pages are not necessarily page aligned. The fix allocates bounce pages with __GFP_ZERO to avoid leaking information to userspace.

In the Linux kernel, the sof_ipc4_bytes_put() function has a TOCTOU vulnerability where the copy size is derived from the old buffer instead of the new data. This can lead to truncation of valid data or copying stale bytes.

In the Linux kernel, there is a missing validation of the MODULE_NOTIFICATION payload size before reading bytes/channel data in control update handling.

In the Linux kernel, the sof_ipc3_control_update() function calculates expected_size using firmware-provided num_elems, which can overflow on 32-bit platforms. This could allow size comparison to pass with mismatched sizes, potentially leading to out-of-bounds access.

In the Linux kernel, the sof_ipc3_bytes_put() and sof_ipc3_bytes_get() functions have TOCTOU vulnerabilities and incorrect bounds checking. In bytes_put, the copy size is derived from the old buffer, and in bytes_get, the flex array offset is not accounted for.

In the Linux kernel, the sof_parse_token_sets() function lacks validation of the vendor array size before reading it. A malformed topology with a truncated trailing array can cause out-of-bounds read. Additionally, comparison with negative size can pass due to unsigned promotion.

In the Linux kernel, the qrtr_endpoint_post() function has a 32-bit integer overflow in the ALIGN(size, 4) calculation, which can lead to out-of-bounds write and kernel oops on 32-bit platforms.

In the Linux kernel, the check_tp() function does not reject ATM traffic classes above ATM_ANYCLASS, which can lead to out-of-bounds read when reading /proc/net/atm/pvc.

In the Linux kernel for LoongArch, KVM lacks validation of the irqchip index in irqfd routing, which can lead to out-of-bounds access past the routing table's chip array.

In the Linux kernel for LoongArch, the kvm_vcpu_ioctl_interrupt() function did not validate the IRQ number passed from userspace. Validation has been added to prevent potential issues.

In the Linux kernel for KVM on s390, the _gaccess_shadow_fault() function was missing a radix_tree_preload() call, which could prevent forward progress. The missing call was added and the function was split to simplify locking.

In the Linux kernel for KVM on s390, kvm_s390_get_cmma_bits() used vmalloc() for its output buffer, which does not zero the pages. Under certain conditions, uninitialized bytes could be copied to user space, disclosing stale kernel memory. The fix changes the allocation to vzalloc() to zero the buffer.

In the Linux kernel for KVM on s390, kvm_s390_gisc_register() had a GISC refcount leak on AIF enable failure. After registering GISC, if later steps failed, kvm_s390_gisc_unregister() was not called. The fix adds the missing call in the error unwind path.

In the Linux kernel for KVM nVMX, the consistency check for vTPR vs. TPR threshold was moved into normal controls checks. Previously, the check was done late, which could lead to running L1 with an incorrect CR3. The fix simplifies vTPR access and skips the check in some cases.

In the Linux kernel for KVM SEV, intra-host migration/mirroring of SNP VMs has been disallowed because the feature is not fully implemented. Proper migration requires additional SNP-specific state to be transferred. The fix rejects SNP source VMs in migration/mirroring.

In the Linux kernel for KVM TDX, concurrent change to CPUID entry count during initialization is now rejected. Previously, a user could change cpuid.nent between read and copy, potentially leading to out-of-bounds access. The fix requires the copied count to match the value used for allocation.

In the Linux kernel, KVM x86 has a bug where the internal request to service a pending PV EOI is not ignored if the vCPU has disabled PV EOIs since the request was made. This can lead to a kernel BUG in kvm_lapic_sync_from_vapic.