Linux kernel vulnerabilities

In do_fault_around of memory.c, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed.

In kvm_vfio_pviommu_attach of vfio.c, there is a possible double free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In fuse_backing_mmap of backing.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed.

In multiple functions of base.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed.

In multiple functions of dma-buf.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed.

In ksys_unshare of fork.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed.

In multiple functions of fork.c, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed.

In the Linux kernel, a race between fallocate and mmap reads in NTFS was fixed. Fallocate only took invalidate_lock for punch hole, collapse range and insert range operations, and during standard allocation new clusters were mapped before being zeroed, allowing concurrent mmap page faults to read uninitialized disk data.

In the Linux kernel, a missing lock in ntfs_filemap_page_mkwrite() was fixed; it called iomap_page_mkwrite() without holding mapping->invalidate_lock. A concurrent truncate or fallocate could be invalidating pagecache and rewriting the runlist while the write fault mapped blocks and dirtied the folio.

In the Linux kernel, the DAMON subsystem (mm/damon/core) has a division-by-zero bug when a DAMOS quota goal has a target_value of zero. The fix moves handling of this corner case to the core layer by adding validation in damos_commit_quota_goal(), which now returns an error for zero target values.

A TOCTOU race in the Linux kernel Bluetooth L2CAP subsystem allowed an l2cap_chan to be linked to an l2cap_conn more than once, violating an invariant assumed during cleanup. The fix adds an invariant check in __l2cap_chan_add and a l2cap_lock_chan guard in l2cap_sock_bind().

A use-after-free in the Linux kernel tracing subsystem: trace_module_record() walks ftrace_trace_arrays from the module notifier without trace_types_lock, while a concurrent rmdir of an instance removes and frees it under that lock. A module load or unload can therefore walk into a freed trace_array.

A double-free/use-after-free in the Linux kernel tracing subsystem: update_last_data_if_empty() is called from tracing_open() with O_TRUNC, tracing_read_pipe() and tracing_buffers_read() without trace_types_lock. Two readers can both pass the LAST_BOOT test and free module_delta twice, and a module notifier can update module_delta while it is being freed.

A Linux kernel tracing vulnerability: incomplete event filter expressions (e.g., ending with a logical operator) left unresolved operator state, causing an out-of-bounds read (prog[-1]) or copying an out-of-bounds word into a branch target. This could be reached via PERF_EVENT_IOC_SET_FILTER on a self-targeted perf tracepoint counting event.

A use-after-free in the Linux kernel tracing/histograms subsystem: create_field_var_hist() saved a pointer to a compatible histogram (hist_data) rather than the one it created. Since find_compatible_hist() matches on keys alone, the user could remove that histogram while the target still pointed at it, leading to a use-after-free in event_hist_trigger_free().

In the Linux kernel tracing subsystem, a failed hist command that creates a field variable histogram leaves a registered trigger without a corresponding entry in field_var_hists[]. As a result, the trigger remains active and keeps counting even though the operation failed with -EINVAL, causing a resource leak and inconsistent state.

A use-after-free in the Linux kernel tracing/histograms subsystem: find_synth_event() compared only the event basename, so registering or removing a histogram on a non-synthetic event whose basename matched a synthetic event erroneously modified the synthetic event's refcount. This could free the synthetic event while an active histogram action still held a pointer to it.

In the Linux kernel, syscall_copy_user_array() was fixed to use copy_from_user() instead of __copy_from_user() when copying the buffer argument of faultable syscalls (write, pwrite64, etc.). Skipping access_ok() allowed a non-user address to be accepted.

In the Linux kernel's io_uring waitid implementation, a use-after-free occurs. io_waitid_wait() clears ->head before taking ownership of the request by incrementing ->refs, allowing another thread to complete and free the request while the wake-up handler still touches it.

In the Linux kernel, io_uring_cmd_del_cancelable() was fixed to not leave LIST_POISON in ->hash_node; it used hlist_del(). Requests are recycled without reinitialisation and not every user of ->hash_node sets it up before use, leading to a write through LIST_POISON2 and a general protection fault.

In the Linux kernel, a spin in io_cqring_wait_schedule() was fixed when IO_CHECK_CQ_OVERFLOW_BIT is set and the overflow list cannot be flushed. The task spins in the kernel and cannot be killed, e.g. with IORING_SETUP_CQE_MIXED or when the application moves the CQ head.

A bug was fixed in the Linux kernel's io_uring/io-wq where the signal ending work could be lost. When a thread exits, its io-wq is torn down and workers are signalled, but a worker that had not yet started the work could lose the signal. This caused the thread to hang in do_exit(), e.g. with IORING_OP_OPENAT of a FIFO without a writer and IOSQE_ASYNC.

In the Linux kernel, the io_uring/waitid mechanism has a reference counter bug where repeated failed cancellation attempts can wrap the 31-bit reference field to zero. A later cancellation can then claim ownership and complete the request a second time.

A use-after-free flaw was fixed in the Linux kernel's find_keyring_by_name() during named keyring lookup. The function read keyring->user->uid under keyring_name_lock, which does not protect the separate key_user object, so a concurrent KEYCTL_CHOWN could free the old key_user between the pointer load and the UID read. The fix uses the inline keyring->uid field instead of dereferencing the owner account.

A vulnerability exists in the Linux kernel's search_process_keyrings_rcu() function, which validates the authorization payload and saved credentials. Due to a race condition between a request-key helper's descendant and the requester, request_key_auth_revoke() can clear the payload pointer, leading to a NULL dereference and kernel oops.

A flaw was fixed in the Linux kernel's keyctl_describe_key(), where the key type's name could be freed by a module unload (e.g., AF_RXRPC) while the key description was being formatted. This led to a use-after-free and a page fault in string(). The fix holds key->sem across the kasprintf() call.

In the Linux kernel, keyring indexes contained kernel addresses (hashes of type and domain pointers), allowing an unprivileged user to predict key ordering and recover the kernel image address, defeating KASLR. The fix removes addresses from the entire index, replacing them with lazily allocated 64-bit IDs hashed with a SipHash key.

A use-after-free vulnerability exists in the Linux kernel key management subsystem. keyctl_read_key() checks key->type->read without holding key->sem, so a surviving RxRPC key can be read while the AF_RXRPC module is being unloaded, accessing freed module memory.

In the Linux kernel, trusted_tpm_unseal() proceeded to call pcrlock() after a TPM unseal failure; if pcrlock() succeeded, its return value overwrote the unseal error, causing key instantiation to succeed despite the failure.

In the Linux kernel, the PKCS#8 parser leaves the asym_key_ids slot empty, and key_or_keyring_common() unconditionally dereferences it when a PKCS#8 key is supplied to a key_or_keyring restriction. An unprivileged caller can trigger a NULL pointer dereference via KEYCTL_RESTRICT_KEYRING followed by add_key(), causing a kernel panic.

In the Linux kernel, print_rec() leaves 'modname' and 'offset' uninitialized, and kallsyms_lookup() only sets them on success. When the lookup fails (e.g., during module load or unload), 'modname' holds a garbage value, passes the 'if (modname)' check, and is dereferenced by seq_printf(), causing a general protection fault.

In the Linux kernel, coredump_finish() releases parked threads without holding a reference on the task and outside of RCU. If the coredump client is preempted between the store and wake_up_process(), the thread can be freed and try_to_wake_up() accesses freed memory.

In the Linux kernel, the cleanup order in copy_process() caused a deadlock: a fork failing while another thread closed the bpf link fd deadlocked against its own read side of scx_fork_rwsem, blocking every fork on the system. The fix releases the child's files after sched_cancel_fork() and clears p->files up front.

In the Linux kernel power supply subsystem, a use-after-free vulnerability exists. If a power supply is unregistered while its external_power_changed() callback is still running, the driver may free data that the callback is still accessing, leading to a kernel crash (NULL pointer dereference).

In the Linux kernel accel/rocket driver, rocket_probe() stores the return value of rocket_device_init() in the file-scoped rdev pointer before checking whether it is an error pointer. On failure rdev remains an ERR_PTR, and a later probe can skip initialization and dereference the error pointer when reading rdev->num_cores.

In the Linux kernel drm/xe driver, xe_evict_flags() reads tbo->resource->mem_type, but a BO can reach eviction with no ttm.resource, e.g. an imported dma-buf whose resource was freed during teardown. This causes a NULL pointer dereference and a kernel fault.

In the Linux kernel drm/xe/oa driver, ttm_bo_type_kernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale kernel memory contents.

In the Linux kernel's scsi: target subsystem, target_do_delayed_work() acquired delayed_cmd_lock with a plain spin_lock() without disabling interrupts, while all other acquisition sites use spin_lock_irqsave(). Since commands can now complete in interrupt context (complete_type=1 with direct_compl_supp), this can cause a deadlock when a completion arrives on the same CPU where the work item holds the lock.

In the Linux kernel, a race exists in sched_change_end() with __sched_setscheduler() for queued but non-running tasks. When a task's scheduling class changes (e.g., from SCHED_OTHER to SCHED_RR), rq->next_class is not updated and the need-resched indicator is not set, causing the CPU to idle despite a runnable task being present.

In the Linux kernel, the hisi_femac network driver (net: hisilicon) assigns netdev_ops only after connecting the PHY. With CONFIG_NET_SHAPER enabled, phy_attach_direct() reads uninitialized netdev_ops, causing a kernel panic from a NULL pointer dereference.

In the Linux kernel, the hip04_eth network driver (net: hisilicon) calls of_phy_connect() before ndev->netdev_ops is assigned. With CONFIG_NET_SHAPER enabled, phy_attach_direct() reads uninitialized netdev_ops, causing a kernel panic from a NULL pointer dereference.

In the Linux kernel, the owl_emac network driver (net: ethernet: actions) calls owl_emac_phy_init(), which connects the PHY, before netdev->netdev_ops is assigned. With CONFIG_NET_SHAPER enabled, phy_attach_direct() reads uninitialized netdev_ops, causing a kernel panic from a NULL pointer dereference.

In the Linux kernel, the mv643xx_eth network driver connects the PHY before dev->netdev_ops is assigned. With CONFIG_NET_SHAPER enabled, phy_attach_direct() reads uninitialized netdev_ops, causing a kernel panic from a NULL pointer dereference.

In the Linux kernel, the au1000 network driver calls au1000_mii_probe() and attaches the PHY before dev->netdev_ops is assigned. Since netdev_need_ops_lock() was introduced, phy_attach_direct() reads dev->netdev_ops, causing a NULL pointer dereference and a crash during probe when CONFIG_NET_SHAPER is enabled.

In the Linux kernel, the ethoc driver calls ethoc_mdio_probe() and attaches the PHY before netdev->netdev_ops is assigned. Since netdev_need_ops_lock() was introduced, phy_attach_direct() reads netdev->netdev_ops, causing a NULL pointer dereference and a crash during probe when CONFIG_NET_SHAPER is enabled.

In the Linux kernel, the aeroflex greth driver calls greth_mdio_init() and attaches the PHY before dev->netdev_ops is assigned. Since netdev_need_ops_lock() was introduced, phy_attach_direct() reads dev->netdev_ops, causing a NULL pointer dereference and a crash during probe when CONFIG_NET_SHAPER is enabled.

In the Linux kernel, the ti icssm-prueth driver calls of_phy_get_and_connect() before ndev->netdev_ops is assigned. Since netdev_need_ops_lock() was introduced, phy_attach_direct() reads dev->netdev_ops, causing a NULL pointer dereference and a crash during probe when CONFIG_NET_SHAPER is enabled.

In the Linux kernel, the mxc GPIO driver installs the chained IRQ handler (mxc_update_irq_chained_handler()) before the IRQ domain, generic IRQ chip and port list entry are set up. An interrupt in that window causes a NULL dereference or access to an incomplete list, and failures in later probe steps leave a dangling handler pointing at freed memory.

In the Linux kernel, since SGMII/RGMII/SMII interrupt handling was removed, the stmmac dwmac1000 driver no longer reads GMAC_RGSMIIIS, so the RGMII status stays pending behind GMAC_INT_MASK. During stmmac_resume() the MAC reset clears the mask and the pending status storms the interrupt line, causing a soft lockup, watchdog reset or hang.

In the Linux kernel, get_seg_reg_override_idx() had its local result variable shadowed by the loop counter declared in for_each_insn_prefix(). As a result, FS and GS segment overrides are ignored, and a CS override causes an infinite loop in the kernel during UMIP emulation, allowing any user to tie up CPUs until reboot.