Linux kernel vulnerabilities

A use-after-free vulnerability exists in the Linux kernel's SCTP handling. A remote peer can bundle COOKIE ECHO, SHUTDOWN and SHUTDOWN ACK chunks in a single packet, causing the association and its transports to be freed, after which the endpoint loop writes to freed memory. This occurs when the packet is processed from the socket backlog in task context.

In the Linux kernel, sctp_rcv() resolves the transport once per packet and keeps it in chunk->transport until processing completes. An authenticated ASCONF DEL-IP can remove and free that transport via RCU in the meantime, and a subsequent delayed SACK then reads the freed transport's state. This results in a use-after-free.

In the Linux kernel, detect_intel_iommu() did not include tboot in the conditions for requesting ACS, potentially causing a misconfiguration with ACS disabled while IOMMU is later forced on by tboot_force_iommu(). The fix adds a tboot check in detect_intel_iommu().

In the Linux kernel, xdp_convert_zc_to_xdp_frame() clones an XSK packet into an order-0 page and advertises PAGE_SIZE as its frame size, allowing the copied frame to occupy the page tail needed by skb_shared_info. This causes the skb to overlap skb_shared_info or be placed beyond the allocated page, resulting in a KASAN slab-out-of-bounds in skb_gro_receive.

In the Linux kernel, a flaw exists in net/smc where the peer rkey counts in SMC-Rv2 LLC messages are not bounded. On links with a device having max_recv_sge == 1, smc_llc_save_add_link_rkeys() reads the v2 extension beyond the allocated buffer, causing a slab-out-of-bounds read. This occurs on every SMC-Rv2 link addition regardless of what the peer sends.

In the Linux kernel, smc_llc_srv_add_link() in the net/smc subsystem contains a use-after-free flaw. The add_llc pointer references a queue entry that is freed by smc_llc_flow_qentry_del() and then used by smc_llc_save_add_link_rkeys() on a link without a shared v2 receive buffer. The issue has been fixed.

In the Linux kernel's net/smc subsystem, three connection state flags (killed, freed, out_of_sync) are single-bit bitfields sharing one byte of struct smc_connection. Because they are not written under a common lock, storing one flag performs a read-modify-write that corrupts the neighbouring bits, causing a race and inconsistent connection state.

A vulnerability exists in the Linux kernel's IPv6 segment routing (SRv6) handling. The decap_and_validate() function fails to reset the IPv6 control block (IP6CB) after decapsulation, allowing an unprivileged user to trigger a slab-out-of-bounds read in ip6_protocol_deliver_rcu().

In the Linux kernel, the iaa crypto driver has a bug during hardware decompression. On a hardware analytics error, the decompress path retries through the software fallback, which writes req->dst while it is still mapped as DMA_FROM_DEVICE. With SWIOTLB active, the later dma_unmap_sg() copies the stale bounce buffer over req->dst, corrupting the result.

A vulnerability in the Linux kernel's GRO (Generic Receive Offload) mechanism related to BIG TCP packet aggregation has been found. Improper validation of aggregation criteria allows an out-of-bounds write and wrapping of the mac_header pointer, potentially leading to system crashes or code execution. The issue affects older stable branches, e.g., 6.18.y, and has been fixed by tightening conditions in skb_gro_receive().

In the Linux kernel's IPVS, there is an issue with propagating the one-packet flag to synced connections, which can lead to stale hash entries and use-after-free.

In the Linux kernel, the mtk_eth_soc network driver had a bug where the wrong pointer (net_device instead of mtk_eth) was passed to mtk_handle_irq_rx in mtk_poll_controller. This could cause a system crash when using CONFIG_NET_POLL_CONTROLLER.

In the Linux kernel, the idpf driver had a bug where idpf_get_reg_intr_vecs() fills the reg_vals[] array without bounding it to the actual number of allocated vectors. A reply from the controller (PF or hypervisor) with a sum of vectors exceeding the allocated count leads to an out-of-bounds write.

In the Linux kernel's KVM subsystem for s390, airq_iv_create() can return NULL, but its return value is not checked. On failure, zdev->aibv will be NULL, leading to a NULL dereference in kvm_zpci_set_airq(). The fix adds a NULL check and frees previously allocated resources.

In the Linux kernel's vxlan subsystem, after calling route_shortcircuit(), the Ethernet header pointer may point to freed memory because the function can reallocate the skb buffer. This leads to a use-after-free when reading the destination address.

A vulnerability was found in the Linux kernel's NTFS filesystem. Attribute lists for base inodes were not properly validated when resident, allowing out-of-bounds reads of the buffer. A validation function was added to check each entry's header and length before use.

In the Linux kernel's NTFS filesystem, ntfs_external_attr_find() improperly bounds-checks the next attribute-list entry, potentially leading to a slab out-of-bounds read with a crafted disk. The fix adds validation of the entry before dereferencing.

In the perf sched tool in the Linux kernel, register_pid() has several issues when processing untrusted perf.data: integer overflow, heap buffer overflow via strcpy, BUG_ON on allocation failure, and memory leak on realloc. The fix caps pid, uses strlcpy, adds NULL checks, and uses safe realloc patterns.

In the perf tool in the Linux kernel, machine__resolve() does not validate the CPU index from untrusted perf.data before accessing env->cpu array, potentially leading to an out-of-bounds heap read. The fix uses perf_env__get_cpu_topology() and adds bounds checking.

In the Linux kernel's netfilter subsystem (nf_conntrack_expect), the timer API for expectations has been replaced with a GC worker approach. This change addresses a race condition where an expectation could access a stale exp->master pointer after it was freed, and introduces the NF_CT_EXPECT_DEAD flag for safe reaping.

In the Linux kernel, the netfilter flowtable module has an underflow of num_encaps when untagging VLAN on a bridge, which can lead to an out-of-bounds stack read. This only happens with a malformed bridge path stack.

In the Linux kernel, the net/sched/sch_fq_codel module has a vulnerability where qdisc_tree_reduce_backlog is called during peek before restoring the qlen counter. This can lead to incorrect deactivation of the parent class and, consequently, to a wild memory access in the qfq scheduler, manifesting as a general protection fault.

In the Linux kernel's airoha network driver, there is a heap buffer overflow in the foe_check_time function. The array is declared as a u16 pointer but allocated with only ppe_num_entries bytes instead of ppe_num_entries * sizeof(u16), leading to out-of-bounds writes.

In the Linux kernel, a vulnerability was found in the LWT (Lightweight Tunnels) mechanism. During LWT encapsulation, skb metadata (passed between XDP and TC) located in the packet headroom is overwritten or cleared, leading to warnings and errors, especially for forwarded packets carrying XDP metadata. The issue affects all LWT encapsulation types (mpls, seg6, ioam6, BPF) and all LWT redirect modes.

In the Linux kernel, the qede driver had an out-of-bounds check issue in cqe->len_list[], where the index check was performed after element access. The fix moves the index check before the access.

In the Linux kernel, the parse_dcc() function in netfilter nf_conntrack_irc had an off-by-one error leading to an out-of-bounds read. It treated the end pointer as inclusive, while the caller passed a pointer one past the last valid byte. The fix changes the loop to strict less-than, consistent with the caller's convention.

In the Linux kernel, the batman-adv dat module does not reassign the ARP hardware source pointer after pskb_may_pull() reallocates the buffer. This can lead to a use-after-free condition.

A vulnerability in the Linux kernel block subsystem was found where the timeout timer is not stopped when releasing a disk that was never added (e.g., after a failed probe). This leads to a use-after-free in the timer mechanism, potentially causing system crashes or privilege escalation.

In the Linux kernel's MPTCP module, a vulnerability was found due to lack of rejection of mutually exclusive incoming MPTCP suboptions. An attacker can send a packet with a combination of suboptions that according to RFC 8684 cannot coexist, potentially leading to unexpected network stack behavior. The fix introduces validation consistent with outgoing rules, ignoring invalid combinations.

In the Linux kernel's MPTCP module, a remote peer can send a malformed DSS with an incorrect size, causing the first suboption to be ignored but leaving some fields written, potentially leading to inconsistency or access to uninitialized data. The fix explicitly resets fields that could have been modified in case of unexpected size.

In the Linux kernel's MPTCP module, mptcp_fastopen_subflow_synack_set_params() set the is_mptfo flag before checking for queued SYN data. This caused data-less TFO SYNs to trigger a WARN and leave stale MPTFO state, potentially leading to a state-confusion bug in check_fully_established(). The fix marks the subflow as MPTFO only after confirming that an SKB was queued.

In the Linux kernel, the decode_locker() function in cls_lock_client.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads. Missing bounds checks before copying the name, an unchecked pointer advance, and an uncapped length value can lead to memory corruption. The fix replaces unsafe operations with safe variants and returns -EINVAL on any bounds violation.

In the Linux kernel, libceph may use invalid OSD indices from primary_temp in a corrupted osdmap, leading to out-of-bounds reads. The fix adds validation of indices in get_temp_osds().

In the Linux kernel, libceph's decode_watchers() lacked a bounds check before reading a 32-bit value, leading to an out-of-bounds read when struct_len=0. The fix uses the safe variant ceph_decode_32_safe.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is no limit on the number of channel program segments. Processing is recursive, which can lead to exceeding the global limit and potential issues.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a lack of verification that the first IDAW remains constant between reads. This can lead to an inconsistent set of IDAWs.

In the Linux kernel, a vulnerability in Ceph was found where handle_reply() stores a ceph_mds_request pointer in current->journal_info while populating inode and dentry caches. An allocation in this section can trigger direct reclaim, pruning dentries from another filesystem, which may start a JBD2 transaction in ext4. JBD2 misinterprets the Ceph pointer as a journal handle, causing a kernel crash.

In the Linux kernel, the ovpn driver's crypto completion callbacks hold references to the key slot and peer. If the peer reference is released before the callback finishes, it can lead to use-after-free or scheduling an RCU callback after rcu_barrier has run, risking a crash.

In the Linux kernel's SCTP protocol, the COOKIE_ECHO state restoration does not properly validate AUTH fields (RANDOM, HMACS, CHUNKS) originating from peer-controlled cookie bytes. Forged lengths or identifiers can lead to out-of-bounds reads and even a write past a buffer, potentially enabling local privilege escalation.

In the Linux kernel for RISC-V, the ZBB-optimized strnlen loop may read one word past the count boundary when the start address is aligned and count is a multiple of word size. This can cause a page fault if the next page is unmapped.

In the Linux kernel, the netfilter flowtable module has a vulnerability where the original-direction tuple node is published before the reply node, allowing the garbage collector to observe and free a flow while it is still being installed. This can lead to slab-use-after-free in the flowtable/rhashtable path, detected by KASAN.

In the Linux kernel, ipvlan interfaces do not inherit needed_headroom and needed_tailroom from the physical device, which can lead to insufficient space reservation for headers and trailers. This results in buffer overflows, headroom underflows, or KASAN slab-use-after-free crashes.

In the Linux kernel, macvlan interfaces do not inherit needed_headroom and needed_tailroom from the lower device, which can lead to insufficient space reservation for headers and trailers. This results in buffer overflows, headroom underflows, or KASAN slab-use-after-free crashes.

In the Linux kernel, the am65-cpsw-nuss driver has a bug in extracting the port ID from the source tag. It uses the full 16 bits, while only the lower 8 bits represent the port ID, which can lead to out-of-bounds memory access and system crash.

In the Linux kernel, in NFS, the FREE_STATEID operation could be delayed, leading to a use-after-free of the 'struct nfs_server' object. The fix bumps the refcount of this object for the duration of the FREE_STATEID call to prevent cleanup while operations are in flight.

A race condition in the Linux kernel's ovpn subsystem between peer deletion and rehashing operations can resurrect already-removed peers in hash tables, leading to a use-after-free (UAF) vulnerability.

A vulnerability in the Linux kernel's btrfs filesystem was found in LZO decompression for inline extents. A crafted btrfs image can trigger an out-of-bounds read (KASAN: slab-out-of-bounds) when reading a file, leading to a system crash or potential security compromise.

In the Linux kernel, a vulnerability in the vdpa/mlx5 driver leads to a slab-out-of-bounds read. The issue is caused by incorrect calculation of the input buffer size in create_direct_keys(), resulting in reading 16 bytes beyond the allocated region.

In the Linux kernel, __skb_udp_tunnel_segment() has a potential use-after-free vulnerability. It gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb->head, the saved UDP header pointer becomes invalid.

In the Linux kernel, the SCTP protocol has a use-after-free vulnerability. sctp_make_heartbeat_ack() caches a pointer to the transport without taking a reference, and when the transport is removed, a queued control chunk may retain a dangling pointer, leading to memory corruption.