Linux kernel vulnerabilities

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's ftrace mechanism. When a kernel module triggers an error that disables ftrace (ftrace_disable) and is then removed, the ftrace module list entry remains but the module memory is already freed. Reading /proc/kallsyms after such event accesses freed memory and causes a system crash.

In the mt76 (mt7996) WiFi driver in the Linux kernel, fragments with multicast or broadcast RA are not dropped. According to IEEE 802.11, fragmentation applies only to unicast frames.

In the Linux kernel's software node, an out-of-bounds (OOB) check bug in software_node_get_reference_args() can cause out-of-bounds read for maliciously crafted properties.

In the fbnic network driver in the Linux kernel, there is a double-free vulnerability when DMA-mapping of a firmware message fails. The fbnic_mbx_map_msg() function does not take ownership of the message on error.

In the Linux kernel for PowerPC, a bug was found in the JIT code size calculation of the BPF trampoline. The arch_bpf_trampoline_size() function may return a smaller size than actually needed because the instruction count depends on the image location. This leads to a warning and potential buffer overflow during JIT compilation.

In the Linux kernel's F2FS filesystem, an inconsistency between the free segment map and free section map was detected. The get_new_segment() function should record the error in the superblock and bail out instead of continuing.

In the Cortina (gemini) network driver in the Linux kernel, the TOE/TSO accelerator is not used for all TCP packets. Without this, the driver becomes unstable and may lock up.

A bug in the Linux kernel causes a crash in the icl_update_topdown_event() function on Intel RaptorLake machines. The issue occurs when the function is invoked on E-core CPUs that do not support the perf metrics feature, leading to a general protection fault and system hang. The bug was introduced by commit f9bdf1f95339, which mistakenly replaced is_topdown_count() with is_topdown_event().

In the Linux kernel's CIFS/SMB client, error logging was added when close_all_cached_dirs() fails due to low memory, which previously caused a "Dentry still in use" error during unmount.

In the ath12k wifi driver in the Linux kernel, a buffer overflow in debugfs was found. Writing more than 32 bytes causes memory corruption. The vulnerability is limited to root users.

In the Linux virtio-pci driver, virtio_pci_admin_dev_parts_get() returns a result size 8 bytes too large because it includes extra status bytes from virtqueue_get_buf(). This causes errors during live migration and potential out-of-bounds reads.

In the Linux kernel, a race condition was found in the has_locked_children() function called by may_decode_fh() without holding locks. This can cause a system crash (oops). The fix renames the function to __has_locked_children() and adds a safe wrapper with locking.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the ASoC driver for MediaTek MT8195. When no codec is assigned to ETDM2_IN_BE and ETDM1_OUT_BE links in the device tree, the strcmp function receives a null pointer, causing a kernel panic.

In the Linux kernel's ath11k driver, a vulnerability causes node corruption in the ar->arvifs list during WLAN recovery. Improper list reinitialization in ath11k_core_halt() leads to list inconsistency, triggering a kernel panic when an interface is removed concurrently.

In the ath12k WiFi driver in the Linux kernel, there is a use-after-free bug. After freeing skb, the code still accesses rxcb->is_continuation, which can lead to accessing already freed memory.

In the Linux kernel, a vulnerability in the ath12k driver causes WMI commands to be sent to the firmware during a crash, leading to a kernel call trace. The fix sets ATH12K_FLAG_CRASH_FLUSH and ATH12K_FLAG_RECOVERY flags upon crash notification to prevent command transmission during recovery.

In the ath12k WiFi driver in the Linux kernel, a bug was found causing node corruption in the ar->arvifs list during WLAN recovery. The ath12k_core_halt() function only reinitializes the list head, leaving invalid pointers in the next node, leading to a kernel panic when attempting to remove an interface.

In the Linux kernel's InfiniBand CM subsystem, cm_free_priv_msg() was reused in a context where the cm_id lock is not needed, causing false lockdep asserts and WARNs when freeing an old message.

In the Linux kernel's hisi_acc_vfio_pci driver, a bug in live migration for VMs without a loaded VF driver leads to NULL pointer access when migrating device data.

In the Linux kernel's octeontx2-pf driver, the TC_HTB_LEAF_DEL_LAST callback for QoS was refactored to fix issues with stopping traffic before queue reassignment and warnings during system reboot.

In the Linux kernel's fs/dax subsystem, a bug in wait_entry_unlocked_exclusive() causes the current entry to be skipped after calling xas_pause(), leading to missed locked entries during scanning. This triggers a warning in truncate_folio_batch_exceptionals() and potential data inconsistency.

In the Linux kernel's TIPC stack, a refcount warning in tipc_aead_encrypt occurs when get_net() is called on a network namespace being destroyed (refcount=0), potentially leading to use-after-free.

In the Linux kernel's netdevsim driver, a bug causes napi_complete() to be called from netpoll context when NAPI is not scheduled, triggering a warning in napi_complete_done().

In the uartlite serial driver in the Linux kernel, there is a race condition during UART driver registration. If two devices are probed simultaneously, a null pointer dereference and kernel panic can occur.

In the Linux kernel for RISC-V architecture, a vulnerability was found where the SR_SUM status bit is not saved and restored during thread context switches. This causes sleeping functions called in user-access sections to clear SR_SUM, leading to kernel panics.

In the Linux kernel's s390/pkey module, there is a missing overflow check in size calculation for memdup_user(). The number of APQN target list entries comes from user space and can cause an overflow during multiplication.

In the Linux kernel's HID Wacom driver, wacom_aes_battery_handler() is scheduled as delayed work but not canceled on device removal, leading to hard crashes or 'general protection fault' after device disconnect.

In the Linux CXL RAS driver, cxl_cper_handle_prot_err() incorrectly assumes PCIe endpoint devices are CXL type 3 and bound to the cxl_pci driver. This can cause crashes when handling CPER error records.

A use-after-free vulnerability has been identified in the vhci_flush() function in the Linux kernel. The issue occurs when one thread closes a vhci file descriptor while another thread is using the device, leading to unsynchronized memory access.

A use-after-free vulnerability was discovered in the Linux kernel's bridge multicast router port configuration. When per-VLAN multicast snooping is enabled, ports are not properly removed from the global or per-VLAN router port list, allowing re-addition after deletion and leading to access of freed memory.

A potential deadlock was found in the Linux kernel's CIFS/SMB client during channel reconnection. The issue is caused by incorrect lock ordering in cifs_signal_cifsd_for_reconnect, which can lead to thread deadlock.

A race condition in the Linux kernel's userfaultfd_move mechanism with the swap cache has been discovered. It can cause RSS counter corruption and trigger BUG_ON, leading to system crashes.

In the megaraid_sas driver in the Linux kernel, an array index out-of-bounds error was detected during MSI-X interrupt vector allocation on systems with DRAM interleave enabled.

In the fnic SCSI driver in the Linux kernel, a bug was found causing a crash in fnic_wq_cmpl_handler when FDMI RHBA and RPA requests time out. The driver reuses the same frame to send ABTS for both requests, leading to a double free of the same frame and a system crash.

In the Linux kernel, the exynos4-is camera platform driver's fimc_is_hw_change_mode() function changes camera modes without waiting for hardware completion, risking corrupted data or system hangs. Hardware synchronization has been added to ensure stability.

A use-after-free vulnerability was discovered in the Linux kernel's AF_UNIX socket subsystem. The issue occurs when consumed OOB (Out-Of-Band) skbs are left on the receive queue after reading OOB data, potentially leading to access of freed memory during subsequent read operations.

A race condition in the push_rt_task function in the Linux kernel's RT scheduler was discovered. During task migration between CPUs, a task may be migrated and re-executed, after which the scheduler attempts to migrate it again, leading to data corruption and system crashes.

In the Linux kernel on PowerPC64, a vulnerability was found in the ftrace mechanism during livepatching. Register r15 is clobbered by PPC_FTRACE_OUT_OF_LINE but not restored in the livepatch sequence, causing kernel data access faults and system crashes.

A race condition in the Linux kernel between NFSD registration and /proc/fs/nfsd operations causes a NULL pointer dereference and kernel OOPS. Concurrent execution of exportfs -r and mount/umount of /proc/fs/nfsd triggers the bug in both older (5.4) and latest (6.14) kernels.

In the Linux kernel, the JFS (Journaled File System) lacked validation of AG (Allocation Group) parameters in the dbMount() function. This can lead to a shift-out-of-bounds in dbAllocAG(), causing a system crash.

In the Linux kernel, a use-after-free vulnerability was found in the vidtv driver. After a failed PSI initialization, the si structure is accessed again, causing a read of freed memory. The issue was reported by syzbot and requires terminating further processing after initialization failure.

In the Linux kernel, a vulnerability was found in the VIVID driver (V4L2 test driver) involving an out-of-bounds write (vmalloc-out-of-bounds). The issue occurs when the composition size exceeds the fmt_cap_rect buffer size, leading to a buffer overflow during image pattern filling.

In the Linux kernel's kvaser_pciefd CAN driver, an out-of-bounds read in the echo_skb[] array was discovered. The issue arises because echo_skb_max is rounded up to the nearest power of two (e.g., from 17 to 32), but the allocated array size remains 17, causing memory corruption when processing ACK packets.

In the Linux kernel, the F2FS filesystem lacks sanity check on the SIT bitmap size, allowing an attacker to trigger a kernel panic by mounting a crafted filesystem image.

In the iommu/vt-d driver in the Linux kernel, a change in context entry setup order caused a regression for PCI aliased devices, leading to DMA faults and non-functional keyboard/touchpad on some Apple Macbooks.

A use-after-free vulnerability was discovered in the Linux kernel's IPC mechanism. The idr_for_each() function was not protected by an RCU read-critical region, potentially allowing reading of already freed memory while processing radix_tree_node entries.

A double-free vulnerability was found in the Linux kernel's exfat filesystem in the delayed_free function. The bug occurs when exfat_create_upcase_table() returns an error, causing exfat_free_upcase_table() to be called twice.

In the JFS filesystem in the Linux kernel, an array index out-of-bounds read was found in the add_missing_indices function. The s8 array can contain offsets up to 127 but lacks proper bounds checking.

In the Linux kernel, the netfilter nft_set_pipapo module lacked clamping of the maximum map bucket size to INT_MAX. This can trigger a WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing the hashtable because __GFP_NOWARN is not set.

In the Linux kernel's dell_rbu driver (platform/x86), a list usage bug was found. The list_for_each_entry*() function received an incorrect list head when iterating through packets, causing incorrect data reads via sysfs and a NULL pointer dereference when clearing the list.