Linux kernel vulnerabilities

A vulnerability in the Linux kernel has been fixed that could lead to a divide-by-zero error in the tcf_skbedit_hash() function. This issue was addressed by adding support for SKBEDIT_F_TXQ_SKBHASH.

A vulnerability has been identified in the Linux kernel that has been resolved. In the error path, the function cx88_alsa_dma_unmap() has been added to release resources acquired by cx88_alsa_dma_map().

A vulnerability has been identified in the Linux kernel related to calculating the maximum value M for scaler configuration. The issue was the lack of a check to ensure that the MIN_X_OUTPUT_SIZE register value is non-zero, which could lead to division by zero.

A NULL pointer dereference vulnerability was found in the Linux kernel's ALSA driver for the TASCAM US-144MKII device. A malicious USB device can have a configuration with interface number 1 but missing interface 0, leading to a system crash.

A vulnerability has been identified in the Linux kernel related to use-after-free in tasklets during device removal. The issue occurs when the PCA-200E or SBA-200E adapter is being detached, potentially leading to unexpected system behavior.

A vulnerability in the Linux kernel related to exception handling in SCSI for UFS has been resolved. The issue was the lack of proper flushing of exception handling work during system suspend when the runtime power management level is set to zero.

A vulnerability has been identified in the Linux kernel related to improper memory deallocation in the uhdlc_memclean() function. The rx_buffer and tx_buffer are allocated as contiguous but freed as two separate buffers, which may lead to memory management issues.

A vulnerability has been identified in the Linux kernel related to ntb_hw_switchtec, which may lead to undefined behavior when the number of MW LUTs is set to zero.

A vulnerability has been identified and resolved in the Linux kernel. The issue concerns the pwlan variable, which may be NULL when passed to the rtw_free_network_nolock() function, leading to dereferencing of this variable.

A vulnerability has been identified in the Linux kernel related to the kexec_load_purgatory() function, which derives the start image from the SHF_EXECINSTR section. The issue occurs when the purgatory object contains multiple executable sections with overlapping addresses.

A vulnerability has been identified in the Linux kernel regarding missing syscalls in the audit read class. The missing 'at' variants of getxattr() and listxattr() may allow bypassing audit rules when reading file extended attributes.

A vulnerability has been identified in the Linux kernel related to the fchmodat2() function, which is not included in the audit attribute class. This function, introduced in version 6.6, allows changing file attributes similarly to chmod().

A vulnerability has been identified in the Linux kernel related to the asynchronous creation of sub-groups in the PCI context. This could lead to a NULL pointer dereference if the driver directory is removed before the work completes.

In the Linux kernel, a vulnerability in KVM for AMD SEV-SNP was found. During SNP launch finish, the synchronization and encryption of VMSA (Virtual Machine Save Area) does not lock all vCPUs, allowing userspace to manipulate or run a vCPU while its state is being synchronized.

A vulnerability has been identified in the Linux kernel in the rtw_core_enable_beacon() function, which reads 4 bytes from an address that is not a multiple of 4. This can lead to system crashes on some devices.

A vulnerability in the Linux kernel has been resolved regarding the introduction of locking when enabling/disabling SR-IOV, which led to deadlocks.

A vulnerability in the virtio-gpu module of the Linux kernel involves an incorrect overflow check when allocating 2D images. This flaw can lead to a buffer overflow, potentially enabling privilege escalation or system crash.

In the Linux kernel, a vulnerability was found in the F2FS filesystem involving uninitialized value access in the f2fs_sanity_check_node_footer function. The issue was reported by syzbot and may lead to unpredictable system behavior.

In the Linux kernel's bcachefs filesystem, a missing bounds check in superblock validation could allow out-of-bounds read. The fix adds the missing check.

In the Linux kernel, the Android Binder driver no longer stores a pointer to a VMA for later use outside the mmap_lock. This was unsafe because the pointer could reference freed memory.

In the Linux kernel, the Bluetooth subsystem (hci_core) now disables works during hci_unregister_dev because the hci_dev is about to be freed and new submissions should not be allowed.

In the Linux kernel's drm/amdgpu/mes driver, a use-after-free issue exists. The fix removes the fence fallback timer to eliminate random errors.

In the Linux kernel, in the DRM/XE driver (guc_submit), a race condition around the suspend_pending field was fixed, which could cause assertions and warnings in certain test scenarios.

A vulnerability was found in the Linux kernel's KVM for AMD SEV. It fails to reject attempts to synchronize vCPU state with an already encrypted VMSA after the VM has been launched.

In the Linux kernel's btrfs filesystem, a use-after-free of the block device file occurs in __btrfs_free_extra_devids(). The issue may arise when mounting two btrfs images with the same fsid.

In the Linux kernel, in the NFS server (nfsd), a race between the laundromat thread and the free_stateid operation was fixed, which could lead to incorrect handling of expired delegations.

In the Linux kernel, a null pointer dereference occurs due to a race between smmu driver probe and client driver probe, when of_dma_configure() for client is called after the iommu_device_re.

In the Linux kernel, a race condition was fixed in the OA TC6 network driver between reference pointers for TX packets. The issue involves managing two skb pointers for packets enqueued from the network stack.

In the Linux kernel, a vulnerability was found in the tracing mechanism where trace_event_file lacks reference counters. This can lead to use-after-free and kernel crash.

In the Linux kernel's networking subsystem, a dangling sk pointer is left when socket creation fails, potentially leading to use-after-free when __sock_release() is called with an fentry probe.

In the Linux kernel, in the Btrfs filesystem, an issue with readahead on the relocation inode was fixed when the filesystem uses a RAID stripe tree (RST), which could cause ENOENT errors.

In the Linux kernel's F2FS filesystem, there is potential corruption when moving a directory, similar to an issue in ext4. The fix addresses this problem.

In the Linux kernel, a double accounting race was fixed in Btrfs when btrfs_run_delalloc_range() fails. The issue occurs when block size is smaller than page size and can lead to kernel crash.

In the Linux kernel, in the Bluetooth subsystem (MGMT), possible deadlocks were fixed that could occur due to hci_cmd_sync_dequeue, causing threads to block for extended periods.

A vulnerability in the Linux kernel's FUSE filesystem causes a hang during sync initialization when the FUSE server exits (e.g., due to error or crash) while processing the FUSE_INIT request. The issue stems from the lack of abort on a fatal signal, blocking filesystem creation.

A vulnerability has been identified in the Linux kernel related to resource leaks during early registration failures. A recent commit fixed most cases, but for some reason, it left out the first error path, which still leaks resources.

A vulnerability in the Linux kernel has been resolved that allowed a user-triggerable WARN in the nested_svm_load_cr3() function. The WARN has been removed from the svm_set_nested_state() function on failure of loading, as it can be trivially triggered from userspace by modifying CPUID after load.

A vulnerability in the Linux kernel has been fixed that led to a NULL-pointer dereference in the acpi_processor_errata_piix4() function. The issue occurred during the assignment of IDE and ISA devices.

A vulnerability in the Linux kernel has been fixed that could lead to a null-pointer dereference in the jdi_panel_dsi_remove() function. The issue occurred when the jdi pointer was NULL, potentially causing unexpected system behavior.

A vulnerability in the Linux kernel related to the rio_scan_alloc_net() function has been resolved. In case of idtab allocation failure, memory is released using kfree() instead of rio_free_net().

In the Linux kernel, libiscsi only bounds-checks the task index from parse_pdu_itt from above, so a negative index passes and reads before session->cmds[]. The be2iscsi driver can supply such an index from an unsolicited NOP-In.

In the Linux kernel, the net/mlx5e driver can release a stale XSK buffer during refill retry on a legacy cyclic RQ. When refill succeeds only partially, a WQE left without a replacement retains its old buffer pointer, which may be allocated to another WQE, leading to freeing a live buffer and double-publishing the same UMEM frame. The fix marks the WQE as released immediately after the driver-side free.

In the Linux kernel, the net/mlx5e driver can release a stale XSK buffer during MPWQE refill retry on a striding RQ. When XSK allocation returns -ENOMEM, actual_wq_head is not advanced and a later NAPI poll may call xsk_buff_free() again through stale pointers after frames return to the XSK pool. The fix sets all skip_release_bitmap bits in the error path of mlx5e_xsk_alloc_rx_mpwqe().

A vulnerability in the Linux kernel TCP stack related to collapsing skbs in the retransmit queue has been fixed. The tcp_write_collapse_fence() function was a no-op when the write queue was empty, allowing skbs queued after a device encryption switch to be merged with earlier skbs. As a result, data could be retransmitted in cleartext (psp) or the connection could stall (tls device offload).

A use-after-free vulnerability exists in the Linux kernel's SCTP implementation. When an association is in COOKIE-ECHOED state and a peer sends a bundled [ERROR(Stale Cookie)][DATA] packet from a non-primary address, processing removes the transport the packet arrived on, but the subsequent DATA chunk re-registers a pointer to that freed transport. Later use of this dangling pointer (e.g., via FWD-TSN or delayed SACK timer) leads to a write to freed memory.

In the Linux kernel, the openvswitch conntrack module has a use-after-free due to extension reallocation. A raw pointer to the extensions area is wired into the expectations list, and later extension additions can invalidate it, causing a UAF when the expectation is removed.

In the Linux kernel, a race condition exists in the RISC-V KVM component during VM teardown. The non-Sstc hrtimer callback clears next_set before its final uses of the vCPU, and if teardown observes next_set as false while the callback is still running, kvm_riscv_vcpu_timer_cancel() skips hrtimer_cancel() and the vCPU can be freed before the callback completes. This results in a use-after-free detected by KASAN.

In the Linux kernel, a vulnerability in the IPv4 stack was resolved: if a packet with bad checksum metadata enters the stack, skb_checksum_help can corrupt the network header. Additional validation of checksum_start before completing the checksum was added.

A use-after-free vulnerability exists in the Linux kernel's IPv4 TCP socket option handling. The ireq_opt options are freed with a plain kfree() even though other CPUs may still access them under RCU (e.g., when building a SYNACK or creating a child socket), leading to a use-after-free in ip_options_build(). The issue also affects request socket migration (tcp_migrate_req).

In the Linux kernel RDMA/rxe subsystem, mr_check_range() has an integer overflow vulnerability that allows a remote unauthenticated client to bypass memory range validation and trigger out-of-bounds access, causing a kernel oops. The fix rewrites the check in an overflow-safe form, returning -EINVAL for crafted requests.