Linux kernel vulnerabilities

In the Linux kernel for the LoongArch architecture, a vulnerability causes a runtime warning when displaying /proc/cpuinfo if CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are enabled. The issue arises from using NR_CPUS instead of nr_cpu_ids for CPU iteration, triggering cpu_max_bits_warn(). The fix uses nr_cpu_ids as the runtime limit.

In the Linux kernel for ARM64, the emulation_proc_handler() function could be called concurrently, leading to a NULL pointer dereference and an Oops. The fix changes data storage and adds a mutex.

In the Linux kernel, the USB cdns3 driver has an issue with incorrect GFP flags during memory allocation, causing warnings at driver load. The GFP_DMA32 flag is unnecessary and can be safely removed.

In the Linux kernel, a vulnerability in the RDMA/siw driver causes a duplicated IW_CM_EVENT_CONNECT_REPLY event. When siw_recv_mpa_rr returns -EAGAIN, it means the MPA reply has not been fully received and should not be reported. This can trigger a kernel BUG in iw_cm. The fix prevents reporting the event in such cases.

A reference count leak was discovered in the Linux kernel's p9_read_work() function in the 9p subsystem. When the rc.sdata field of the request structure is NULL, the p9_req_put call is missing, causing a temporary reference leak.

In the Linux kernel, the SCSI qla2xxx driver has a bug causing a crash due to accessing a stale SRB during I/O timeout escalation. This can lead to memory protection faults and system crash. The fix ensures SRB is returned during timeout error escalation or fails the escalation path.

In the Linux kernel's Ceph filesystem, there is a snap_rwsem leak in handle_cap_grant. When called for an IMPORT op, the semaphore is held and should be released before returning, but it is not, potentially leading to a deadlock.

In the Linux kernel, the USB cdns3 driver has a use-after-free vulnerability in cdns3_wa2_remove_old_request(). After freeing memory via cdns3_gadget_ep_free_request(), the priv_req list is still used, leading to a read after free.

In the Linux kernel, the habanalabs driver for Gaudi chips has a shift out of bounds vulnerability during NIC queue validation. Queue offset calculation should only be performed for NIC queues.

In the Linux kernel, the ASoC SOF subsystem for Intel CNL platforms may process IPC replies before firmware initialization, leading to a NULL pointer dereference.

In the Linux kernel, the ASoC SOF subsystem for Intel HDA IPC platforms may process IPC replies before firmware initialization, leading to a NULL pointer dereference.

In the Linux kernel, the f2fs filesystem's f2fs_new_node_page() could trigger a BUG_ON due to inconsistency between the NAT entry and NAT bitmap. The fix removes the use of f2fs_bug_on() and adds proper checks.

In the Linux kernel, the F2FS filesystem has a null-pointer dereference vulnerability in f2fs_get_dnode_of_data. The issue occurs during atomic write operations when a newly created cow_inode lacks a properly set cow_inode pointer, leading to a system crash.

In the Linux kernel, the udmabuf driver did not explicitly set the DMA mask for the device. This causes a warning and potential issues when userspace accesses the dma-buf via CPU. The fix sets the DMA mask and adds error handling for its configuration.

In the Linux kernel, the HID driver for Nintendo controllers has a null pointer dereference vulnerability. When the device is disconnected, the workqueue is destroyed and may still be used to schedule rumble work, leading to a crash.

In the Linux kernel, the AMD display driver has an issue where the optc underflow bit is not cleared after turning off the ODM clock. The fix clears the bit before disabling the clock.

In the Linux kernel, the DRM/AMD Power Management driver for Sienna Cichlid lacks the fini_microcode interface, which may lead to a memory leak.

In the Linux kernel's GPIO virtuser driver, there is a lack of input size validation before writing to the buffer. The simple_write_to_buffer function truncates data but does not check if the input size exceeds the buffer size, potentially leading to out-of-bounds write.

In the AMD GPU driver (drm/amd/display) of the Linux kernel, the block_sequence array was too small (50 entries) for 6-pipe configurations in a single MPC chain, causing a buffer overflow and crash.

In the Linux kernel, the algif_hash cryptographic algorithm implementation has a double-free vulnerability in the hash_accept function. When accept(2) on an algif_hash socket with MSG_MORE flag fails in crypto_ahash_import, the sk2 structure is freed twice – once in this function and again in af_alg_release, leading to a use-after-free error.

In the Linux PCM OSS layer, calling snd_pcm_format_set_silence() with runtime->dma_area can lead to use-after-free (UAF) because dma_area may be freed concurrently outside the buffer access lock.

In the Linux kernel vhost-scsi driver, access to vq->log_used is not properly protected by vq->mutex. The command completion path may read vq->log_base after QEMU has set vq->log_used to false and freed vq->log_base, leading to writes to invalid QEMU userspace memory.

In the Linux kernel's LZO compression implementation, there is a lack of output buffer overrun checking. The compression function assumes the caller always provides enough space, ignoring the provided buffer size. The patch adds a safe compression interface that checks for buffer end before each write.

In the Linux kernel, during system shutdown or kexec, virtio devices are not broken or reset. This can cause a hang, as devices (e.g., virtio-console) continue to write to MMIO after the PCI bus reset, and IOMMUs are reset before devices.

A vulnerability in the Linux kernel's MSI handling stores an IOMMU cookie pointer in the MSI descriptor without proper locking, allowing a race condition between IOMMU domain changes and MSI message composition. This can lead to a use-after-free (UAF) condition.

In the Linux kernel BPF subsystem, a vulnerability was found where the 'loop_entry' field is not copied during verifier state copy (copy_verifier_state()). This allows 'loop_entry' values from unrelated states to poison 'cur_state', and states on the verifier stack may contain invalid pointers. As a result, the verifier may accept BPF programs that are not safe.

In the Linux kernel, a race condition was found in the __legitimize_mnt() function related to the MNT_SYNC_UMOUNT flag. The check for this flag is performed outside the mount_lock, which could allow stealing the final mntput from a sync unmount, leading to incorrect reference management.

A use-after-free vulnerability was found in the Linux kernel's TIPC module in the tipc_aead_encrypt_done function. After deleting a network namespace, the cryptd_queue_worker may still access the freed tipc_crypto tx structure, leading to a slab-use-after-free read.

A use-after-free vulnerability was found in the cifs_fill_dirent function of the Linux kernel's CIFS module. During concurrent readdir operations, the response buffer may be accessed after being freed, causing memory corruption.

In the Linux kernel, the nvmet-tcp subsystem attempts to restore the sk_state_change pointer that may be NULL if the TCP connection was not established when nvmet_tcp_set_queue_sock() was called. This causes a NULL pointer dereference and kernel panic.

A race condition in the Linux kernel's nfs_local_open_fh() function was found. After dropping the clp->cl_uuid.lock, another CPU could free the newly added nfsd_file structure.

In the Linux kernel, the RDMA/rxe driver has a use-after-free bug in the rxe_queue_cleanup function. During CQ creation (rxe_create_cq), when rxe_cq_from_init fails, rxe_cleanup is called which frees already freed memory resources, causing an error.

A use-after-free vulnerability was found in the Linux kernel's ib_register_device function. The issue occurs when ib_device_rename() changes the device name under lock, while kobject_uevent() accesses the same name without lock protection, leading to a race condition and access to freed memory.

In the Linux kernel TLS subsystem, a bug causes a kernel panic when a page allocation fails. Setting frag_list to NULL leads to a NULL pointer dereference on the next tls_strp_read_sock call.

A vulnerability in the Linux kernel's HID-BPF implementation causes access to a cleaned-up SRCU structure after a HID device is unplugged. The issue occurs when the device has LEDs and the driver does not implement the request() function, leading to calls to dispatch_hid_bpf_output_report() or dispatch_hid_bpf_raw_requests() after device destruction.

In the Linux kernel sched_ext scheduler, bpf_iter_scx_dsq_new() may leave the iterator uninitialized on error, leading to garbage data dereference in next() or destroy().

In the Linux kernel, the TI K3 UDMA DMA engine driver lacked proper locking, triggering lock validator warnings. The fix adds the missing synchronization to prevent data races.

In the CAN broadcast manager (BCM) of the Linux kernel, a missing locking for runtime updates was found. The currframe counter and count variable could be modified concurrently from user space and timer context, leading to out-of-bounds buffer read.

In the Linux kernel CAN Broadcast Manager subsystem, generating procfs content for a bcm_op being removed may show unreliable data (use-after-free). RCU read protection is missing during list traversal.

In the Linux kernel, the io_uring subsystem lacked the uring_lock when calling io_uring_show_fdinfo(). This function reads SQE fields, which can cause issues when the ring is being resized simultaneously. The fix adds a trylock and returns empty output on failure.

A vulnerability in the Linux kernel's HFSC network scheduler allows re-adding a class to the eltree twice despite a previous patch. The issue stems from insufficient checking of the HFSC_RSC flag, potentially leading to an infinite loop in hfsc_dequeue or a use-after-free (UAF) with specific TBF configurations.

In the Linux kernel, the HFSC queuing discipline (sch_hfsc) has a queue length accounting bug when enqueuing the first packet to a class. hfsc_enqueue() calls the child's peek() operation before incrementing qlen and backlog, which with qdisc_peek_dequeued() can cause immediate dequeue and drop, leading to inconsistency and potential use-after-free.

In the Linux kernel openvswitch module, unsafe manual parsing of Netlink attributes in output_userspace() was found. It has been replaced with safe nla_for_each_nested() iteration, ensuring only well-formed attributes are processed.

In the Linux kernel, the netfilter/ipset module has a bug in the macros handling region locks for hash types. The incorrect ahash_region() macro can cause a race condition between the garbage collector and adding new elements when a set has a timeout defined.

In the Linux kernel, KVM for ARM64 has a bug where an uninitialized memcache pointer is used in user_mem_abort(). This can cause crashes on paths requiring stage-2 allocation without transitioning via a permission fault or dirty logging.

A vulnerability was found in the Linux kernel's do_move_mount() function related to MNT_TREE_BENEATH handling. A race condition occurs when locking a mountpoint, where the parent pointer (mnt_parent) can change without proper locking, leading to filesystem instability.

In the Linux kernel's ECDSA implementation (crypto/ecdsa), the DIV_ROUND_UP() macro could cause integer overflows when ->key_size() returned an unusually large value. A new DIV_ROUND_UP_POW2() macro was introduced and applied.

A resource leak was found in the Linux kernel's blk_register_queue() function error path. When queue registration succeeds for blk_mq_sysfs_register() but a later error occurs, the missing blk_mq_sysfs_unregister() call causes a memory leak.

In the Linux kernel, the ASoC driver for Qualcomm sc7280 has a potential buffer overflow. Case values introduced in commit 5f78e1fb7a3e cause out-of-bounds access in sc7280 driver data arrays (e.g., RX_CODEC_DMA_RX_0 in sc7280_snd_hw_params()).

In the Linux kernel, the Exynos UFS driver fails to check the dma-coherent property, leading to an incompatible configuration. Descriptors become non-cacheable while IOCC shareability bits remain enabled, causing random cache-related stability issues.