Linux kernel vulnerabilities

A vulnerability has been identified in the Linux kernel related to manipulating the 'mfd_of_node_list'. A mutex has been added to ensure safety during access and modification of this list, preventing potential crashes.

In the Linux kernel's F2FS filesystem, there is potential corruption when moving a directory, similar to an issue in ext4. The fix addresses this problem.

A vulnerability has been identified in the Linux kernel related to the sticky mode in the SQ manager. This issue can lead to stalls when multiple SQs share an SMQ and transmit concurrently.

A vulnerability has been identified in the Linux kernel that leads to a memory leak in the atomic_destroy_state function. After several commits, slab memory increases as some drm_crtc_commit objects are not freed.

In the Linux kernel, the Android Binder driver no longer stores a pointer to a VMA for later use outside the mmap_lock. This was unsafe because the pointer could reference freed memory.

A vulnerability in the Linux kernel related to the IOMMU mechanism has been resolved, concerning flushing dev-IOTLB only when the PCIe device is accessible in scalable mode.

In the Linux kernel, a vulnerability in KVM for AMD SEV-SNP was found. During SNP launch finish, the synchronization and encryption of VMSA (Virtual Machine Save Area) does not lock all vCPUs, allowing userspace to manipulate or run a vCPU while its state is being synchronized.

In the Linux kernel, a vulnerability related to a reference leak in mtk_mdp_remove() has been fixed. The issue was resolved by adding platform_device_put() to prevent the reference leak.

A vulnerability has been identified in the Linux kernel related to the btree repair functions for free space and inode. The issue involves a lack of checking for deleted cursors when revalidating two btrees, which may lead to filesystem malfunctions.

A vulnerability has been identified in the Linux kernel related to a potential memory leak in the tw9903_probe() function. Memory allocated in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() is not freed in one of the error paths.

A vulnerability in the Linux kernel has been resolved that allowed special inodes to be treated as regular files. The change introduced in commit af153bb63a33 requires any inode to be one of the specified types.

A vulnerability in the Linux kernel has been fixed related to the imx_rproc_elf_find_loaded_rsc_table() function, which could incorrectly report a loaded resource table even when the current firmware does not provide one.

A vulnerability has been identified in the Linux kernel related to the registration of the omap_mpuio_driver in the omap_gpio_probe() function. This issue has been resolved in commit 11a78b794496.

A vulnerability in the Linux kernel related to unsound scalar forking in maybe_fork_scalars() for BPF_OR has been fixed. The issue occurred when the source operand was a constant and the dst range was signed in the range [-1, 0].

A vulnerability has been identified in the Linux kernel related to the missing resource unmapping in the snd_cx23885_hw_params() function. An error path has been added to call cx23885_alsa_dma_unmap() to release resources acquired by cx23885_alsa_dma_map().

A vulnerability in the Linux kernel has been resolved in rnbd-srv, related to not zeroing the rsp buffer before use. Failure to zero the buffer could lead to unintended data being sent to the client.

In the Linux kernel, a vulnerability related to dm-verity has been resolved, which incorrectly handled errors in the dm_bufio_client_create() function. If the call to this function fails, dm_bufio_client_destroy() is later called with an ERR_PTR() argument.

A vulnerability in the Linux kernel related to validating rounded allocations in DRM_BUDDY_CONTIGUOUS_ALLOCATION has been resolved. The issue involved the requested size being rounded up to the next power of two, which could lead to errors.

A vulnerability has been identified in the Linux kernel that leads to a memory leak when the cfg80211_inform_bss_frame() function fails. If this function returns NULL, the allocated buffer 'buf' is not freed, resulting in a memory leak.

A vulnerability has been identified and resolved in the Linux kernel. The issue concerns the fbcon_open() function, which, if it fails, does not set the info->fbcon_par pointer, leading to later dereferencing of a NULL pointer.

A vulnerability has been identified and resolved in the Linux kernel. It concerns the HID Magic Mouse, which can cause system crashes when the input pointer is missing.

In the Linux kernel, a vulnerability related to the pstore: ram_core function has been fixed, which incorrectly returned a success pointer when the vmap() function failed.

A vulnerability has been identified in the Linux kernel related to ARM processor errors, occurring when the BIOS generates a very small or incomplete error. This can lead to improper memory dereferencing.

A vulnerability in the Linux kernel related to the lack of error checking for the kcalloc() function in parse_thread_groups() has been resolved. The absence of this check could lead to a NULL pointer dereference.

A vulnerability in the virtio-gpu module of the Linux kernel involves an incorrect overflow check when allocating 2D images. This flaw can lead to a buffer overflow, potentially enabling privilege escalation or system crash.

A vulnerability has been identified in the Linux kernel related to the failure to free memory in case of an error. Specifically, the screen buffer fbi->fb.screen_buffer is allocated using dma_alloc_coherent() but is not freed if an error occurs.

A vulnerability in the Linux kernel leads to a General Protection Fault (GPF) in the write_page() function during array resize. This issue is caused by a use-after-free race between bitmap_daemon_work().

A vulnerability has been identified in the Linux kernel that has been resolved. The issue concerns the cper_print_fw_err() function, which does not check if the error record length is sufficient to handle the offset, potentially leading to malfunction in case of faulty firmware.

In the Linux kernel, a vulnerability related to a resource leak in the cx25821_dev_setup() function has been fixed. The issue occurred when ioremap() failed, leading to the memory region obtained by cx25821_get_resources() not being released.

A vulnerability in the Linux kernel related to double free in the pruss_clk_mux_setup() function has been resolved. The issue occurred during the call to devm_add_action_or_reset(), which triggered pruss_of_free_clk_provider() on error.

In the Linux kernel, a fake timeout has been removed to avoid request leaks. This change requires drivers to be responsible for calling blk_should_fake_timeout() at appropriate code paths.

A vulnerability in the Linux kernel related to reserving slots for the clk_hw structure in the 9FGV0841 has been resolved. The issue concerns the lack of sufficient slots for eight outputs, which may lead to out-of-bounds writes.

A vulnerability in the Linux kernel related to swapped parameters in the pci_{primary/secondary}_epc_epf_unlink() functions has been resolved.

A vulnerability in the Linux kernel related to V3D rendering has been resolved, which occasionally caused segment size mismatch warnings when CONFIG_DMA_API_DEBUG was enabled.

A vulnerability in the Linux kernel related to the cpumask_of_node() function has been resolved. This function could not properly handle the NUMA_NO_NODE index, potentially leading to system errors.

A vulnerability related to error handling after finding a match in an async connection has been fixed in the Linux kernel. Once a match with an fwnode is found, a sub-device may be registered, and its bound operation is called.

A vulnerability in the Linux kernel related to parameter validation for packet data in communication with nci NFC chips has been resolved. The introduced fix has caused issues with communication with these chips.

A vulnerability in the Linux kernel related to the dma_free_coherent() function has been fixed, which was using an incorrect DMA handle in the error path. This could lead to improper unmapping of the buffer.

A vulnerability has been identified in the Linux kernel in the ceph_zero_partial_object function, which was missing proper snapshot context for OSD write operations. This could lead to data inconsistencies in snapshots.

In the Linux kernel, in the Bluetooth subsystem (MGMT), possible deadlocks were fixed that could occur due to hci_cmd_sync_dequeue, causing threads to block for extended periods.

A vulnerability related to the TSV110 processor has been resolved in the Linux kernel, which is susceptible to the Spectre-BHB attack. This attack can be exploited to leak information through branch prediction side channels.

A vulnerability has been identified in the Linux kernel related to the handling of fake USB devices that can send their own report descriptors. If the input_mapping() hook is not called, the pm->input_ep82 pointer remains NULL, leading to a system crash.

In the Linux kernel, a vulnerability was found in the mechanism preventing timer interrupt starvation. Missing resets of the next_event_forced flag in several places, such as when the clock event state changes, may cause incorrect behavior.

A vulnerability in the Linux kernel has been fixed that could lead to a divide-by-zero error in the tcf_skbedit_hash() function. This issue was addressed by adding support for SKBEDIT_F_TXQ_SKBHASH.

In the Linux kernel, the Bluetooth subsystem (hci_core) now disables works during hci_unregister_dev because the hci_dev is about to be freed and new submissions should not be allowed.

A vulnerability has been identified in the Linux kernel related to calculating the maximum value M for scaler configuration. The issue was the lack of a check to ensure that the MIN_X_OUTPUT_SIZE register value is non-zero, which could lead to division by zero.

A vulnerability has been identified in the Linux kernel related to use-after-free in tasklets during device removal. The issue occurs when the PCA-200E or SBA-200E adapter is being detached, potentially leading to unexpected system behavior.

A vulnerability has been identified in the Linux kernel related to improper memory deallocation in the uhdlc_memclean() function. The rx_buffer and tx_buffer are allocated as contiguous but freed as two separate buffers, which may lead to memory management issues.

A vulnerability has been identified in the Linux kernel related to ntb_hw_switchtec, which may lead to undefined behavior when the number of MW LUTs is set to zero.

A vulnerability has been identified and resolved in the Linux kernel. The issue concerns the pwlan variable, which may be NULL when passed to the rtw_free_network_nolock() function, leading to dereferencing of this variable.