Linux kernel vulnerabilities

In the Linux kernel accel/rocket driver, rocket_remove() decrements num_cores before searching for the core slot, so the last core is never found and removed. This leaves stale state and leads to an out-of-bounds write to rdev->cores when cores are rebound on RK3588.

In the Linux kernel accel/rocket driver, sched_to_core() searches only up to rdev->num_cores, which is decremented when a core is unbound. Unbinding a non-last core leaves later cores outside the search, so sched_to_core() returns NULL for a core that is still bound and running jobs. Neither rocket_job_run() nor rocket_job_timedout() checks the result, leading to NULL pointer dereference (KASAN: null-ptr-deref).

In the Linux kernel, create_ipc_ns() leaks resources: when mqueue/ipc sysctl setup or msg_init_ns() fails, the mqueue mount is dropped with a plain mntput() instead of kern_unmount(). Because the mount is long-term (MNT_NS_INTERNAL), the count drops to zero but the mount and mqueue superblock are never freed.

In the Linux kernel, mshv_vtl checks the global mshv_has_reg_page flag before selecting the requested CPU's register page. With mixed setup results across CPUs, the check passes even for a CPU with no register page, leading to get_page(NULL) when userspace faults in that mapping.

The GPIO shared subsystem has a use-after-free bug when adding shared proxies. The device name (dev_id) references a kobject's name string that may be freed before the GPIO lookup table.

In the Linux kernel, drm/amd/display functions allocate_usb4_bandwidth_for_stream() and allocate_usb4_bandwidth() use ASSERT(stream->sink) before dereferencing stream->sink->link. Since ASSERT is compiled out in production builds, a NULL stream->sink causes a NULL pointer dereference.

In the Linux kernel's drm/amdgpu driver, amdgpu_gem_userptr_ioctl() returns -ENOMEM immediately when amdgpu_hmm_range_alloc() fails and skips the cleanup path. This leaks the GEM object, the bo->parent reference on the VM root, and the MMU notifier registration.

In the Linux kernel's drm/i915/dmc driver, for DMC firmware header version 3 the firmware load address is stored in dmc_info->start_mmioaddr and used by dmc_load_program(). Unlike the MMIO address table, the load address is not validated, potentially leading to use of an invalid address.

In the Linux kernel's drm/xe driver, xe_bo_set_purgeable_shrinker() unconditionally transfers pages between the shrinkable and purgeable counts. When the purgeable state of a pinned BO changes (e.g., userspace madvising DONTNEED on a VMA of a BO pinned as a scanout buffer), one count underflows and the other remains permanently inflated after unpin.

In the Linux kernel's sched_ext module, a deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred list until run_deferred() takes it, and the RCU callback freeing the DSQ assumes the grace period flushed it, but a run_deferred() starting after the grace period began can detach the request right before the callback looks and read the freed DSQ's id.

In the Linux kernel, a flaw in ftrace causes tracing_set_tracer() to set current_trace_flags to NULL when switching to a tracer with no flags (e.g., hwlat, irqsoff, wakeup). If the ring buffer still holds function_graph entries from the previous tracer, printing them (e.g., via cat trace) dereferences the NULL pointer and crashes the kernel.

In the Linux kernel cifs subsystem, cifs_do_truncate updates i_size without a valid file handle. When find_writable_file() returns null, the inode size is set to 0 even though the server file is unchanged, causing inconsistency.

In the Linux kernel, a flaw in SELinux BPF token permission checks was fixed. Multiple lookups of the bpffs creator SID using the token's file descriptor could lead to TOCTOU issues if the user changed the token file descriptor passed into the kernel.

In the Linux kernel, handling of multiple PMU stop callback invocations in s390/pai was fixed. The kernel throttles high sampling load, which can result in two back-to-back PMU->stop() calls; the fix checks the PERF_HES_STOPPED bit and prohibits the unsupported ioctl PERF_EVENT_IOC_PERIOD call.

A Linux kernel vulnerability was fixed in KVM (x86/mmu) where an unexpected SS bit in #NPF exit codes caused out-of-bounds accesses in permission_fault(), resulting in WARNs or UBSAN reports. The issue occurred when running Hyper-V from Windows 11 and was resolved by dropping unknown bits and preserving the SS bit when reflecting the fault to L1.

In the Linux kernel, the drm/amdgpu/userq driver was fixed to properly validate userq buffer objects (BOs). Previously, the loop did not iterate over the individual evicted list, so BOs created and evicted before a userq was made would never be rearmed in the eviction fence. A missing reference to the BO before drm_exec locks was also added.

In the Linux kernel, the SMB client (cifs) was fixed for data corruption with concurrent writes and O_TRUNC. cifs_do_truncate() flushed dirty pages and truncated the file on the server without holding i_rwsem or invalidate_lock, so a concurrent write could dirty new pages that were then silently discarded. The fix adds locks to make the flush-truncate-resize sequence atomic.

In the Linux kernel NTFS filesystem, ntfs_trim_fs() aligns the start of a free extent up to the discard granularity but derives the discard length by aligning the original extent length down. When the extent start is not discard-aligned, the resulting discard range can extend past the free extent into allocated clusters, which get zeroed.

In the Linux kernel sched_ext scheduler, scx_bypass() claims bypass dispatch only for the scheduler whose depth goes from zero to one but does not propagate the claim to descendants. This leaks the claim when a sub-scheduler is enabled/disabled during PM suspend, leading to WARN_ON_ONCE or tasks left on bypass DSQs with no consumer.

In the Linux kernel NTFS filesystem, ntfs_setattr_size() updates i_size and resizes the on-disk attribute without holding mapping->invalidate_lock. A racing page fault can resolve a VCN against transient runlist state and fail with a spurious SIGBUS, or interleave with the size-change epilogue, causing inconsistency.

In the Linux kernel, dm-integrity has a NULL pointer dereference when a device with the SB_FLAG_DIRTY_BITMAP flag is activated in 'R' mode. The dm_integrity_resume function attempts to read the journal containing the bitmap, causing a crash. The fix skips writes to the device in 'R' mode during resume.

In the Linux kernel, dm-integrity does not validate the superblock on resume, allowing a user to modify the superblock on the underlying device while the dm-integrity device is suspended. This can cause a mismatch in in-memory structure sizes and an out-of-bounds write past the journal, including a 512-byte write through a NULL pointer. The fix snapshots the validated superblock in the constructor and refuses to resume if the on-disk geometry changed.

A Linux kernel vulnerability was fixed in the sched_ext scheduler that caused a CPU hotplug hang when a dying CPU's tasks remained in the BPF scheduler. Such tasks were still counted on the runqueue, but an inactive CPU no longer called ops.dispatch() and could not pull them back, blocking the hotplug thread and cpu_down() while holding cpu_hotplug_lock. The fix re-enqueues tasks on the offline rq to the local DSQ so balance_push() can move them off.

In the Linux kernel, a flaw was fixed in iterate_dir() where the directory's i_rwsem lock was held during readdir even for immutable directories that are never removed. For the nullfs instance directory (shared across mount namespaces and kernel threads), a malicious reader could hold the lock indefinitely, blocking mkdir, lookups, and mounts for other users. A new FOP_IMMUTABLE flag was added to skip the lock for such directories.

A vulnerability in the Linux kernel's IPv6/UDP handling allowed off-path attackers to conduct a side-channel attack on the exception cache to discover the ephemeral port used by a connected UDP socket. Previously, an exception was only created if the UDP packet could be matched to an existing socket. The fix always creates an exception before attempting socket matching.

In the Linux kernel, the rust_binder module has a bug in node refcount update on thread exit. When a thread exits via BINDER_THREAD_EXIT, a pending node refcount increment could be dropped because Node::cancel() and NodeWrapper::cancel() were no-ops. This desynchronizes the node's delivery and count state, and userspace may not receive the notification, potentially causing the node to never be freed.

In the Linux kernel IPv4 subsystem, a null-ptr-deref occurs during FIB exception dump when a nexthop group shrinks. fib_dump_info_fnhe() uses fib_info_num_path() as the loop bound, then fib_info_nhc() independently reloads nh->nh_grp; if RTM_NEWNEXTHOP replaces the group with fewer paths, fib_info_nhc() returns NULL and the dump dereferences it. The fix stops the walk when the indexed path is absent.

In the Linux kernel Input: ati_remote2 driver, a type confusion occurs in device attribute handlers. The channel_mask and mode_mask attributes were moved to usb_interface devices, but the show and store callbacks still invoked to_usb_device() on a struct usb_interface pointer, producing an invalid usb_device pointer. The fix uses to_usb_interface() directly in the attribute handlers.

In the Linux kernel ALSA: ctxfi driver, a memory leak occurs when clearing DAO input mappers. dao_clear_input() removes mapper entries from the list and sets their pointers to NULL without freeing the allocated array, leaking memory on each call. The fix stores the base pointer of the allocation and frees the array after removing entries from the list.

In the Linux kernel, init_can_skb() no longer initializes skb headers (mac_header remains 0xFFFF) after the skb_reset_*_header() calls were removed. When such an skb reaches packet_rcv_spkt() (SOCK_PACKET), the push length calculation overflows and triggers skb_under_panic, causing a full kernel panic.

In the Linux kernel, the cgroup/cpuset subsystem has a race during CPU offline: cpu_active_mask is updated before cpuset_handle_hotplug(), so guarantee_active_cpus() can dereference NULL for the top cpuset. The fix restores the NULL cs check.

In the Linux kernel, virtio_transport_read_skb() in vsock/virtio subtracts the full packet length from rx_bytes instead of only the unread bytes, underflowing the counter. This causes incorrect SIOCINQ reports (e.g. -40), wrong recv/poll behavior, and hiding of queued data.

In the Linux kernel, the mt76 Wi-Fi driver for mt7603 publishes a driver-private global station WCID without first calling mt76_wcid_init(). The first frame injected through a monitor interface reaches __skb_queue_tail() with an uninitialized sk_buff_head and dereferences a NULL prev pointer, causing an oops.

In the Linux kernel TCP zerocopy receive path, can_map_frag() could dereference NULL when the next skb contained a net_iov fragment (DMABUF or IOURING). skb_frag_page() returns NULL for a net_iov, and can_map_frag() uses it in PageCompound(). The fix rejects all net_iov fragments before skb_frag_page().

In the Linux kernel's gve driver, disabling XSK pools called the unlocked versions of napi_disable and napi_enable even though the netdev lock was already held before ndo_bpf. This caused a deadlock because the thread tried to re-acquire a lock it already held. The fix switches the NAPI calls to the locked versions.

In the Linux kernel, the gve driver leaks XSK buffers when stopping queues. GVE does not free XSK buffers attached to buf_state when resetting ring state, causing all buffers posted to the NIC to be leaked.

In the Linux kernel, the ice driver has a use-after-free in dynamic port cleanup. ice_dealloc_dynamic_port() frees the VSI before reading the index needed to erase the dynamic port from the xarray, resulting in a use-after-free.

In the Linux kernel sparx5 driver, sparx5_tc_matchall_replace() allocates a struct sparx5_mall_entry for every offloaded matchall filter and adds it to a list, but sparx5_tc_matchall_destroy() removes the entry without freeing it. This leaks memory for every deleted mirror and goto matchall filter.

In the Linux kernel axienet driver (net: xilinx), the dmaengine path pre-submits RX buffers and holds in-flight TX buffers whose SKBs are DMA-mapped and freed only in completion callbacks. On ndo_stop(), dmaengine_terminate_sync() aborts descriptors without running callbacks, so the driver frees only ring shells, leaking every SKB and its DMA mapping on each ifdown.

In the Linux kernel team subsystem, bc_transmit() sends the original skb through the last txable port. When no port is txable, it returns false without consuming the skb, but team_xmit() still returns NETDEV_TX_OK, so AF_PACKET sends retain the skb and its socket write-memory charge.

In the Linux kernel pwrseq-pcie-m2.c driver, of_regulator_bulk_get_all() allocates the consumers array and hands it to the caller, who is expected to free it. The driver never did, leading to a memory leak.

In the Linux kernel, of_regulator_bulk_get_all() returns an array where only the consumer is filled in, not the supply name. When such an array is passed to regulator_bulk_enable() and a supply fails to enable, the function dereferences uninitialized memory. The fix copies names into the array's own allocation and removes the fixed 64-byte stack buffer.

In the Linux kernel, the tps6594-regulator driver for TPS65224 BUCK2-4 passes 4 as n_linear_ranges while tps65224_bucks_2_3_4_ranges[] has only two entries. This causes an out-of-bounds read when looking up selectors above 0x45 during normal registration. The fix uses ARRAY_SIZE() so the count always matches the table.

In the Linux kernel, drm/imagination page table preallocation is incorrectly sized from device_addr + sgt_offset with an exclusive end. This allocates one table too many and can underflow index differences when crossing a page table boundary, leading to huge preallocation and memory exhaustion.

In the Linux kernel, drm/panthor's panthor_ioctl_group_create() validates the queue count against the hardcoded MAX_CS_PER_CSG rather than the firmware-reported slot count. If firmware reports fewer slots, unprivileged userspace can request more queues, leading to use of an uninitialized stream interface and a potential crash.

In the Linux kernel's drm/xe/i2c component, xe_i2c_remove() did not cancel or drain the scheduled i2c->work before unregistering the adapter and client devices. A work item still queued or running could dereference the released adapter or freed xe_i2c memory, causing a use-after-free. The fix moves bus notifier unregistration before client teardown and cancels the work right after it.

In the Linux kernel, the drm/xe driver has a shrinker accounting bug with nested external buffer pins (dma-buf). The functions xe_bo_pin_external() and xe_bo_unpin_external() support nested pins, but the calls to xe_ttm_tt_account_subtract() and xe_ttm_tt_account_add() are invoked unconditionally on every call, instead of only on the transition into and out of the pinned state. This causes repeated subtraction of the buffer's pages from the shrinker's accounting, leading to an underflow and an inflated count of reclaimable pages, resulting in excessive shrinker invocation under memory pressure.

In the Linux kernel, the th1520-dw-hdmi drm/bridge driver's th1520_dw_hdmi_remove() read the platform drvdata back as struct dw_hdmi * instead of struct th1520_hdmi *, passing the wrong pointer to dw_hdmi_remove(). As a result, teardown ran on an incorrect object.

In the Linux kernel, the drm/amdgpu/userq amdgpu_userq_get_doorbell_index() pinned any BO passed as doorbell_handle into the doorbell domain. For a regular BO, TTM moved it with ttm_bo_move_null() and its contents were lost, allowing a client to corrupt a buffer shared with another client on the same device.

A flaw was fixed in the Linux kernel's propagate_mount_busy() function, which failed to properly check mount copies with multiple children or a single child that is not an overmount. As a result, a synchronous unmount could succeed while the mount was still in use, detaching an active mount. The issue affected mount namespaces and could be triggered by a container.