Linux kernel vulnerabilities

In the Linux kernel's nvdimm/btt subsystem, memory allocated by btt_freelist_init(), btt_rtt_init(), and btt_maplocks_init() is not freed on some discover_arenas() error paths. This leaks memory when arena discovery fails. The fix adds missing kfree() calls before returning an error.

In the Linux kernel's lockd subsystem, when nlm_do_fopen() fails, the newly allocated nlm_file object is not freed because the error path goes to out_unlock instead of out_free. A client can repeatedly trigger nlm_do_fopen() failures, causing memory leaks. The fix routes the failure through out_free to call kfree().

In the Linux kernel's lockd module, there is an nlm_file refcount leak when the cached nlm_do_fopen() call fails. The cached path in nlm_lookup_file() always reaches the 'found' label even on error, leading to an unreleased reference and preventing proper file cleanup.

In the Linux kernel's remoteproc module for Qualcomm platforms, there is a memory leak when adding custom dump segments fails. The allocated minidump_region 'name' is not freed if the operation fails before adding the region to the list.

In the Linux kernel for MIPS DEC, in 64-bit configurations, calling the firmware entry point prom_printf() from a kernel thread other than the initial one can use a stack pointer in the XKPHYS 64-bit segment. This causes incorrect behavior of 32-bit ALU operations in firmware code, leading to a system hang. Only the prom_printf() entry point is affected; other entry points are safe.

In the Linux kernel's cpcap-battery driver, a missing nvmem_device_put() call causes a permanent reference leak to the nvmem device. The leak occurs on success and read-failure paths in cpcap_battery_detect_battery_type().

In the Linux kernel's hugetlb module, there is a mismatch between rsvd charge and uncharge in hugetlb cgroup. A single h_cg pointer is overwritten, leading to the wrong cgroup being used during uncharge, causing a page_counter underflow.

In the Linux kernel's memory_hotplug module, there is a bug where NULL is passed instead of altmap in the error path. When arch_add_memory() succeeds and create_memory_block_devices() fails, arch_remove_memory() is called with NULL altmap, leading to memory corruption.

In the Linux kernel, a memory leak was found in the NTFS filesystem during failed mount operations. The ntfs_fill_super() function did not release all volume-related resources, such as the NLS map, volume label, and empty bits page, leading to memory accumulation on each failed mount attempt.

In the Linux kernel, the NTFS filesystem centralized $INDEX_ROOT header validation. A dedicated helper was added for stricter validation of $INDEX_ROOT and is used for both directory inodes and named index inodes. This keeps root size and header geometry checks consistent across both read paths.

In the Linux kernel, an ABBA deadlock in the NTFS filesystem was fixed, occurring during writeback of MFT records. The issue appeared after a change in base record lookup and could cause system hangs during xfstests generic/113. The fix removes extent_lock and mrec_lock acquisition from the MFT folio writeback path, eliminating the lock ordering conflict.

In the Linux kernel, the NTFS filesystem avoids heap allocation for free-cluster readahead state. get_nr_free_clusters() allocated a temporary file_ra_state before publishing the free cluster count, and if allocation failed, the worker returned without setting the flag or waking waiters, potentially causing indefinite blocking. Now the state is kept on the stack and passed by address, eliminating the allocation failure path.

In the Linux kernel's NTFS filesystem, the attribute validator did not reject non-resident records for attributes that must be resident. This could lead to incorrect data reads and potential errors. The fix extends the existing check to all resident-only attribute types.

In the Linux kernel's NTFS3 filesystem, the DeleteIndexEntryAllocation function did not bound the memmove length, potentially leading to out-of-bounds access. The fix adds proper checks, including rejecting zero length.

In the Linux kernel's NTFS3 filesystem (fs/ntfs3), during log replay (log_replay) in the analysis pass, the copy_lcns function did not verify that write indices into the page_lcns[] array stay within bounds. A specially crafted log record (LRH) could cause an out-of-bounds write (slab-out-of-bounds), leading to memory corruption.

In the Linux kernel's NTFS3 filesystem, the UpdateResidentValue function did not validate the attribute offset, potentially leading to data size underflow and out-of-bounds read. The fix adds validation at the source.

A vulnerability in the Linux kernel's ntfs3 driver allows an infinite loop during mount of a crafted NTFS disk image, hanging the mounting thread and triggering a soft-lockup panic. The issue is caused by an unbounded iteration in check_rstbl() while traversing the free-entry list of RESTART_TABLE. A crafted image with a cyclic free chain bypasses existing guards and causes a denial of service.

In the Linux kernel's NTFS filesystem, the ntfs_rename function could cause a deadlock due to incorrect locking order of mrec_lock. The fix changes the locking order to avoid deadlock.

In the Linux kernel's NTFS filesystem, attribute list update during superblock teardown could cause a self-deadlock. The fix adds a check for superblock activity and returns an error if inactive.

In the Linux kernel's NTFS filesystem, there is a self-deadlock issue during inode eviction. An attribute-list update can drop the last reference to a temporary attribute inode, leading to ntfs_drop_big_inode() being called for the base inode from within its own writeback path. If the base inode is unlinked, the function waits for folio writeback that the same worker is responsible for, causing an indefinite wait.

In the Linux kernel's NTFS filesystem, ntfs_non_resident_attr_insert_range() allocates memory for hole_rl before mapping the whole runlist. If mapping fails, the error path returns without freeing hole_rl, causing a memory leak. The fix adds freeing hole_rl before returning from that error path.

A vulnerability in the Linux kernel's Landlock mechanism allows bypassing the LANDLOCK_SCOPE_SIGNAL restriction via the asynchronous SIGIO delivery path. A sandboxed process can send a signal (e.g., SIGKILL) to an entire process group, including processes outside its domain that were meant to be protected. The issue stems from incorrect domain recording for process-group targets.

In the Linux kernel's power supply subsystem (charger-manager), is_full_charged() calls power_supply_get_by_name() and if the voltage condition is met, returns true without releasing the reference, causing a refcount leak. The fix sets a flag and jumps to the out label where the reference is properly released.

In the Linux kernel for MIPS architecture, there is a critical memory management flaw in the scheduler. When CONFIG_CPUMASK_OFFSTACK is enabled, cpumask_var_t is a pointer, so sizeof(new_mask) evaluates to pointer size, causing copy_from_user() to clobber the mask pointer. Additionally, copying occurs before mask allocation. The fix allocates the mask first and uses cpumask_size() to handle variable-sized masks.

In the Linux kernel's mm/huge_memory subsystem, change_non_present_huge_pmd() rewrites a writable device-private PMD swap entry without carrying pmd_swp_uffd_wp. The fix adds carrying this bit to preserve the UFFD_WP marking, similar to change_softleaf_pte() and copy_huge_pmd().

In the Linux kernel for RISC-V architecture, there is a node reference leak in populate_cache_leaves. The while loop drops the reference to prev in each iteration, but if the loop terminates naturally with np == NULL, the last valid node in prev is not released. The fix changes the final of_node_put(np) to of_node_put(prev).

In the Linux kernel, a vulnerability was found in the DAMON subsystem where unsuccessfully committed target PIDs are not properly released, leading to a memory leak. The issue occurs when the commit operation fails after partially copying PIDs and the destination context lacks the appropriate cleanup callback.

In the Linux kernel, a bug was found in mm/damon/sysfs-schemes in the access_pattern_add_dirs() function, where error paths release directory references in the wrong order. This can lead to uninitialized memory dereference or memory leak. The issue has been fixed.

In the Linux kernel, a bug was found in mm/damon/sysfs-schemes in the damon_sysfs_scheme_add_dirs() function, where the error path releases the tried_regions directory instead of the stats directory after a failed setup. This leads to a leak of the stats directory object and potential uninitialized memory dereference.

A vulnerability was found in the Linux kernel in the make_uffd_wp_huge_pte() function in fs/proc/task_mmu. The function did not use huge_ptep_modify_prot_start() before modifying a HugeTLB PTE, causing a race condition and loss of hardware Dirty/Accessed bit updates. The fix adds the missing call to ensure PTE consistency.

A vulnerability in the Linux kernel causes a self-deadlock in the PAGEMAP_SCAN mechanism for hugetlb mappings. An ioctl request with PM_SCAN_WP_MATCHING on a hugetlb VMA with unpopulated pages hangs the calling thread unkillably. The issue arises from attempting to re-acquire the same VMA lock (read->write) while handling holes in the range.

In the Linux kernel, a stale warning was found in fs/proc/task_mmu in the pagemap_pmd_range_thp() function, which triggered when a PMD entry was not a migration entry. After device-private entries at the PMD level were added, the warning became false. The warning has been removed.

In the Linux kernel, a bug was found in mm/mm_init regarding uninitialized struct pages for ZONE_DEVICE. When DAX memory is hotplugged into an unoccupied subsection of an early section, section_activate() reuses the unoptimized boot memmap, but compound_nr_pages() still assumes optimization and initializes only a reduced number of pages. The remaining pages are left uninitialized, which can lead to unexpected behavior or crashes.

In the Linux kernel, a bug was found in the mtd: slram module in the register_device() function, where an entry is linked to the global list before all required state is allocated. If a later allocation, memremap(), or mtd_device_register() fails, the partially initialized entry remains on the list, which can lead to dereference or free of invalid state during later cleanup.

In the Linux kernel, a bug was found in the 9p module in the v9fs_dec_count() function, which unconditionally calls drop_nlink() on regular files even when nlink is already zero. In cacheless mode, the client refetches metadata from the server, leading to a race and WARN_ON warning. The fix skips nlink update in cacheless mode.

In the Linux kernel, a bug was found in the kho module where the scratch size is not always aligned to CMA_MIN_ALIGNMENT_BYTES. When using fixed sizes from the command line, an unaligned size can lead to releasing a pageblock that is only partially scratch. The fix rounds up the size in both cases.

In the Linux kernel, the vmu-flash driver for MTD memory has a bug causing access to uninitialized data when allocating memcard structs. The fix uses kzalloc instead of kmalloc to zero the memory before use.

In the Linux kernel, the pl353 driver for rawnand memory has a resource allocation issue during probe. devm_ioremap is called with the parent device instead of the current one, causing the register area not to be released when the module is unloaded.

In the Linux kernel, a vulnerability in net/9p causes an infinite loop in p9_client_rpc when handling a fatal signal (e.g., SIGKILL). The issue occurs when a P9_TFLUSH call is made on a transport without a peer (e.g., fd transport via pipes with no 9p server), and a fatal signal interrupts the wait. The bug clears the TIF_SIGPENDING flag before rechecking, leading to re-sleeping and system hang.

In the Linux kernel, the rawnand driver has a bug in the condition in the 'nand_select_target()' function. The condition does not correctly check the range of the 'cs' value, which should be in [0:nanddev_ntargets[.

In the Linux kernel, the OCFS2 filesystem has a bug in ocfs2_move_extent that can cause moving data to occupied clusters. During block group scanning, if no free run is found, phys_cpos remains unchanged, potentially leading to overwriting data belonging to another inode.

In the Linux kernel, the OCFS2 filesystem has a bug in ocfs2_assure_trans_credits that can lead to a NULL pointer dereference when the journal aborts during DIO operations. The function does not check if the transaction handle is aborted before reading remaining credits.

In the Linux kernel, the OCFS2 filesystem has a bug in ocfs2_sum_rightmost_rec that can lead to an array-index-out-of-bounds (UBSAN) when on-disk data is corrupted. The function does not validate l_next_free_rec before using it to index the l_recs array.

In the Linux kernel, the OCFS2 filesystem has a bug in ocfs2_checkpoint_inode that can lead to a NULL pointer dereference during unmount. After the journal is freed and osb->journal is set to NULL, the function tries to use it.

In the Linux kernel, a vulnerability in the OCFS2 filesystem allows acceptance of invalid i_mode values in dinodes. Lack of POSIX file type validation can lead to processing of forged metadata, resulting in incorrect system behavior. The patch adds structural checks rejecting dinodes with non-canonical i_mode types.

In the Linux kernel, the OCFS2 filesystem has an issue with accepting non-inline dinodes with non-zero size and zero clusters. Such structures are malformed but are not rejected in some paths, which can lead to errors during file or directory operations.

In the Linux kernel, the dfh_get_param_size() function lacks bounds checking after size increment, potentially returning a size larger than the feature region. A malicious FPGA device can exploit this to call memcpy_fromio() with a size exceeding the mapped area.

In the Linux kernel, the thunderbolt network driver (tbnet) lacks a bound on frame_count to the maximum number of skb fragments, leading to out-of-bounds write past frags[] and memory corruption. A malicious peer can send a packet with many small frames to trigger the overflow.

In the Linux kernel, the Microchip SPI FPGA driver's mpf_ops_parse_header() reads one byte before the buffer start when header_size is zero. This can lead to out-of-bounds memory read.

In the Linux kernel, the SPI-NOR (mtd) driver has an issue with unlocking the first blocks of flash memory. When a user tries to unlock only the locked blocks, the operation fails due to incorrect lock_len calculation.