Linux kernel vulnerabilities

In the JFS filesystem in the Linux kernel, an array index out-of-bounds read was found in the add_missing_indices function. The s8 array can contain offsets up to 127 but lacks proper bounds checking.

In the Linux kernel, the netfilter nft_set_pipapo module lacked clamping of the maximum map bucket size to INT_MAX. This can trigger a WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing the hashtable because __GFP_NOWARN is not set.

In the Linux kernel's dell_rbu driver (platform/x86), a list usage bug was found. The list_for_each_entry*() function received an incorrect list head when iterating through packets, causing incorrect data reads via sysfs and a NULL pointer dereference when clearing the list.

In the Linux kernel's SFQ (Stochastic Fairness Queueing) qdisc, a missing range check for the perturb period (perturb_period) was found. This can lead to integer overflow when multiplied by HZ and enable a race condition.

In the Linux kernel, a vulnerability was found where a careless NAT46 BPF program can cause a NULL pointer dereference and kernel crash. The issue occurs when the dst structure is not cleared after changing the skb protocol from IPv4 to IPv6, leaving stale IPv4 routing data.

In the Linux kernel, in ksmbd, there is a null pointer dereference in destroy_previous_session. If the client sets PreviousSessionId during Kerberos session setup, a null pointer dereference can occur because sess->user is not yet set. The patch moves calling destroy_previous_session() after ksmbd_krb5_authenticate(), where sess->user is set.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the v3d driver's `v3d_job_update_stats()` function. It occurs when a file descriptor is closed before its submitted GPU jobs complete, causing an attempt to update stats on already freed `v3d_file_priv` structure, leading to a kernel panic.

In the nouveau graphics driver in the Linux kernel, a use-after-free bug was found in the r535_gsp_rpc_push() function. The RPC container is freed prematurely when sending large requests, leading to access to freed memory.

In the Linux kernel's TIPC module, a null-ptr-deref vulnerability was found when retrieving the remote IP for an Ethernet bearer. When the bearer ID (bid) is non-zero and skip count (skip_cnt) is non-zero, accessing bearer_list[bid] may return NULL or a pointer to another bearer if another thread modified it.

A null-pointer dereference vulnerability was found in the Linux kernel's CALIPSO implementation when allocating a CALIPSO option. The issue occurs because the sock structure is NULL due to missing rsk_listener in SYN Cookie scenarios.

A vulnerability was found in the Linux kernel's CIFS/SMB client, involving a buffer overflow in smb_extract_folioq_to_rdma(). The bug causes a slab-out-of-bounds write during RDMA request processing, potentially leading to system crashes or code execution.

In the HFSC network scheduler in the Linux kernel, the hfsc_qlen_notify() function is not idempotent, which may cause issues when called from fq_codel_dequeue(). The fix adds checks to make the function safe for multiple calls.

A use-after-free vulnerability was found in the binderfs_evict_inode() function of the Linux kernel's binderfs filesystem. The bug is caused by insufficient synchronization during concurrent deletions from the 'binder_devices' list, potentially leading to memory corruption.

In the Linux kernel's binder subsystem, another use-after-free bug was found. binder_free_proc() does not remove the device from the binder_devices list before freeing memory, leading to access to freed memory.

In the Thunderbolt driver in the Linux kernel, a double dequeue bug was found in configuration request handling. The tb_cfg_request_work() function can be scheduled twice, leading to double list_del() and system crash.

In the EROFS filesystem in the Linux kernel, a use-after-free bug was found when using multiple devices of different types. When the primary device is a block device and the extra is a file-backed device, erofs_init_device returns ENOTBLK, leading to access to freed memory.

In the Linux kernel on ARM64 with SME enabled, kernel FPSIMD state may be erroneously clobbered during context switch. When the CPU is in streaming SVE mode, restoring kernel FPSIMD state before exiting that mode (SMSTOP) causes register reset and data loss.

In the Linux kernel, in the arm-ni driver, failure to unregister PMUs (Performance Monitoring Units) after a failed probe can lead to list corruption and kernel panic. When resource allocation fails in one clock domain, previously registered PMUs in other domains are not properly rolled back.

A bug in the Linux kernel's BPF and sockmap mechanism causes a kernel panic when using kTLS. The issue occurs when a BPF program increases the data size in msg_pl->sg and then attempts to revert msg_iter, exceeding the iterator's actual size and triggering a BUG.

A bug in the Linux kernel's BPF sockmap mechanism causes a kernel panic when calling skb_linearize. The issue occurs when a large packet (over 100KB) is processed by the strparser module, and a previous addition of skb_get() to avoid race conditions triggered the BUG_ON(skb_shared(skb)) assertion.

In the Linux kernel, an inconsistency between SIT and SSA tables in the F2FS filesystem was found during block migration in an opened section. The issue occurs when fallocate on a pinned file causes SSA block data to be outdated because the last summary block is still in the curseg cache.

In the Linux kernel, a vulnerability was found in the netfilter module during lookup table allocation in the pipapo set. Missing overflow checks in multiplication can lead to integer overflow, potentially allowing privilege escalation or system crash.

In the Linux kernel, the RDMA/mlx5 driver has a bug in error handling during RQ destruction. When a firmware command fails, some software resources are already cleaned, leading to memory leaks and potential use-after-free. The fix rolls back the object to its original state upon failure.

In the Linux kernel, a vulnerability in BPF sockmap allows skb_send_sock() in the backlog thread to use a freed sk_socket pointer. A race condition between socket close and send operations causes a kernel panic.

In the Linux kernel af_packet subsystem, a bug causes a sleeping function (mutex) to be called from an RCU critical section. This occurs when PACKET_ADD_MEMBERSHIP is invoked on an ops-locked device, potentially triggering the NETDEV_UNREGISTER notifier that requires disabling promiscuous or allmulti mode, which in turn needs the netdev instance lock.

A vulnerability was found in the Linux kernel's dm_blk_report_zones function of the device mapper. The issue involves missing dm_put_live_table() call when dm_get_live_table() returns NULL, inconsistent reading of the md->zone_revalidate_map pointer, and a potential use-after-free during concurrent access to zone emulation resources. This flaw can lead to memory mismanagement and system crashes.

In the Linux kernel's IIO ADC ad4851 driver, a pointer handling bug was found for the ad4858 variant. The pointer returned by ad4851_parse_channels_common() was incremented internally, and then incremented again in ad4858_parse_channels(), causing indio_dev->channels to point past the end of the allocated array.

In the Linux kernel, the ice driver had a bug in Tx scheduler error handling during the XDP callback. Incomplete rollback after a queue configuration failure caused a system crash (general protection fault).

In the Linux kernel, a vulnerability was found in the stmmac driver where the ptp_rate value is not validated before being used in EST configuration. If ptp_rate is 0, a division by zero occurs, potentially causing a system crash.

A vulnerability in the Linux kernel's UDP GSO segmentation handling for frag_list packets was discovered. Packet modifications by NAT or BPF can violate frag_list geometry assumptions, causing a kernel BUG in skb_segment. The fix linearizes packets that fail basic invariants.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's Bluetooth stack during the remove advertising monitor operation (MGMT_OP_REMOVE_ADV_MONITOR). The bug is caused by improper use of mgmt_pending_add, leading to access to already freed memory.

In the Linux kernel, a vulnerability was found in the Bluetooth stack where the mgmt_pending list lacked proper locking against concurrent access. This missing mutex protection caused a use-after-free condition, potentially leading to a system crash.

In the Linux kernel's ath12k WiFi driver, a use-after-free (UAF) vulnerability exists during initialization. If ath12k_core_hw_group_assign() or ath12k_core_hw_group_create() fails, the registered notifier chain is not properly unregistered, and its memory is freed after rmmod. Subsequent access to this chain can lead to UAF.

In the SFQ (Stochastic Fairness Queueing) qdisc in the Linux kernel, there is a crash vulnerability related to gso_skb handling. After adding packets to gso_skb, sch->q.len can be inflated, causing immediate packet drop even on an empty queue, leading to an invalid q->tail pointer state.

In the mdiobus subsystem in the Linux kernel, there is an out-of-bounds read/write vulnerability in the statistics array. The ioctl function does not validate the MDIO address, allowing values greater than PHY_MAX_ADDR (32), leading to out-of-bounds access.

In the Linux kernel's mdiobus driver, there is a lack of MDIO address validation during Clause 45 read/write operations. Tools like 'mdio-tools' can pass an address greater than PHY_MAX_ADDR (32), leading to out-of-bounds read/write in the statistics array.

In the RED network scheduler in the Linux kernel, a race condition was found in the __red_change() function. When the SFQ perturb timer fires at the wrong time, a race can occur between flush and rehash operations, leading to underflow of the parent queue (qlen).

In the ETS network scheduler in the Linux kernel, a race condition was found in the ets_qdisc_change() function. When the SFQ perturb timer fires at the wrong time, a race can occur between flush and rehash operations, leading to underflow of the parent queue (qlen).

A use-after-free vulnerability was found in the Linux kernel's __io_uring_show_fdinfo() function for io_uring. The issue occurs because the task_struct pointed to by sq->thread can be freed while being read, as the ctx->uring_lock does not prevent the release or exit of the thread.

A race condition in the Linux kernel VMCI driver between vmci_host_setup_notify and vmci_ctx_unset_notify was found. During get_user_pages_fast, a premature page release via put_page can trigger a warning in try_grab_folio.

In the ring-buffer in the Linux kernel, a locking issue in ring_buffer_subbuf_order_set() was found. The critical section was enlarged to ensure error handling with mutex held, preventing list corruption and concurrency issues.

In the AMD graphics driver in the Linux kernel, the function create_validate_stream_for_sink incorrectly treats a writeback connector (wb_connector) as a physical amdgpu_dm_connector. Attempting operations on wb_connector as amdgpu_dm_connector can lead to undefined behavior.

In the Linux kernel's ESPINTCP mechanism, caching the encapsulation socket (encap_sk) can lead to reference leaks. When the xfrm state is deleted before the network namespace (netns) is removed, the socket reference is correctly released. However, if the netns is removed first, the xfrm state cannot be deleted, causing a socket reference leak and preventing netns deletion.

In the Linux kernel dma-buf subsystem, a missing memory barrier before updating the num_fences counter was found. Using smp_store_mb() inserts the barrier after the store operation, not before, which can lead to a null pointer dereference if memory operations are reordered.

In the Linux kernel, in the ksmbd module (SMB server implementation), the opinfo_get_list() function uses the list_first_entry() macro which does not check if the list is empty. If the list is empty, an invalid pointer is returned, potentially leading to errors.

In the Linux kernel's RapidIO driver (rio_cm.c), a vulnerability allows heap overwrite. The riocm_ch_send() function failed to verify that sufficient data was provided from userspace, enabling writes beyond the allocated buffer.

In the Linux kernel's taprio network scheduler (net/sched), a use-after-free vulnerability exists. The taprio_dev_notifier() function lacked RCU protection, allowing a race condition with advance_sched() and access to freed memory.

In the Linux kernel, a race condition was found between huge_pmd_unshare() and GUP-fast. huge_pmd_unshare() may remove a shared page table, causing gup_fast() to walk another process's page tables. The fix adds an explicit broadcast IPI.

In the Linux kernel's hugetlb mechanism, VMA splitting triggers page table unsharing too early, before the VMA and rmap locks are taken. This allows races with page faults and rmap operations that can re-share page tables before the actual split. The patch moves the unshare call to when VMA and rmap are already locked.

In the Linux kernel, a race condition was found in the PRIO queuing discipline (net_sched). The race between qdisc_tree_flush_backlog() and qdisc_tree_reduce_backlog() can cause an underflow of the packet counter (qlen). The fix replaces qdisc_tree_flush_backlog() with qdisc_purge_queue().