Linux kernel vulnerabilities

A race condition exists in the Linux kernel between watch_queue_set_size() and post_one_notification(). An unprivileged user can trigger a NULL pointer dereference in post_one_notification(), leading to a kernel panic.

A race condition exists in the Linux kernel's handling of KVM asynchronous page-not-present (#PF) events. If an NMI interrupts #PF handling and itself takes a kernel-mode #PF, it reads and clears the flags belonging to the interrupted event, causing a kernel panic reporting a host-injected async #PF in an interrupt-disabled region.

In the Linux kernel KVM SEV module, sev_gmem_post_populate() calls set_page_dirty() without holding the required lock, which can race with the page's mapping going away. The fix replaces the call with set_page_dirty_lock().

A flaw was fixed in the Linux kernel KVM (nVMX) where failure to load L2 state in the non-VM-Entry case (RSM emulation or KVM_SET_NESTED_STATE) left the vCPU's MMU pointer pointing at the nested MMU. This caused KVM to try running L1 with a nested MMU, leading to a NULL pointer dereference when the nested state was freed and KVM attempted to get the L1=>L2 EPTP.

A race condition in the Linux kernel fsnotify connector teardown was fixed. A new mark could be inserted before the current one, causing the walk to miss the replacement and detach the entire connector from the object. This led to igrab(NULL) and a null-ptr-deref when an unprivileged user read fdinfo.

In the Linux kernel, ext4_get_link() in RCU pathwalk mode reads data through sb->s_fs_info. ext4_put_super() frees the sbi and destroys extent status counters without waiting for a grace period, which can lead to a NULL dereference or use-after-free when the last mount reference disappears during a pathwalk.

A use-after-free vulnerability exists in the Linux kernel's eventfs mechanism. tracefs_d_revalidate() reads the ->is_freed field of an eventfs_inode during RCU pathwalk with only rcu_read_lock() held, while the object is freed after an SRCU grace period that does not wait for rcu_read_lock() sections. As a result, a walker can read already freed memory.

The Linux kernel has a namespace mount handling flaw: copy_tree() omits mounts of mount namespace files (e.g. /proc/<pid>/ns/mnt) without checking MNT_LOCKED. This lets a task that is root in its own user namespace bypass a locked cover mount and expose a hidden file without a race and without touching the underlying filesystem. The fix makes such copying fail with EPERM and refuses to move a mount namespace file mount beneath a locked mount.

In the Linux kernel, FUT_OFF_MMSHARED futex handling mishandles MM reuse: a process can wait on a shared futex with a different MM because a FUT_OFF_INODE waiter can be requeued onto a FUT_OFF_MMSHARED futex by another process. This causes waiters on a freed MM to consume wakeups intended for a newly allocated MM at the same address.

In the Linux kernel, __tcf_action_put() (net/sched) has a use-after-free: the reference count is decremented before the binding count, so another thread can free the action between these operations, causing the binding-count update to access freed memory.

In the Linux kernel RDS handling (net: rds), an uninitialized trans pointer bug exists in rds_rdma_cm_event_handler_cmn(). The trans pointer is only assigned for InfiniBand CA devices; on other device types (e.g., iWARP RNIC) it remains uninitialized and is dereferenced in the event handler, causing a kernel crash (oops) when a connect request arrives.

A flaw was fixed in the Linux kernel SCTP handling when message interleaving is enabled. The first send waits for association establishment while dropping the socket lock, and handshake processing can reduce the output stream count and free the extensions of removed streams. The sender resumes with the stream checked before the wait, leading to a NULL pointer dereference and a kernel panic.

In the Linux kernel, the SPI imx driver allocates DMA bounce buffers that are too small (kzalloc(dma_len) instead of DMA_CACHE_ALIGNED_LEN(dma_len)), while the DMA API operates on memory beyond the allocation end. This causes slab corruption, leading to refcount_t warnings and kernel oops. The issue is fixed by allocating and syncing buffers with the correct aligned length.

In the Linux kernel, check_synth_field() incorrectly validated synthetic trace event fields of stacktrace type. An 8-byte signed scalar field could pass validation and then be dereferenced as a kernel stacktrace pointer, causing an invalid memory access.

In the i2c viai2c-wmt driver, wmt_i2c_probe() acquires a clock via of_clk_get() but never releases the reference on error paths or module unload. This causes a clock resource leak.

In the ring-buffer, per_cpu/cpuN/buffer_meta files are created for every possible CPU, but the buffer is only allocated once the CPU comes online. Reading the file for a CPU that never came online dereferences a NULL cpu_buffer in rbm_start().

In the ring-buffer, rb_meta_subbuf_idx() can return a sub-buffer index one too high, leaving subbuf_ids[0] NULL which is dereferenced in __rb_map_vma() when userspace maps trace_pipe_raw. Incorrect indices are also written to metadata, causing the previous boot's trace to be rejected.

In the ring-buffer, ring_buffer_map_get_reader() treats a NULL result from rb_get_reader_page() as an error and emits a false warning when the mmap reader catches up with a writer still committing events. This state is normal and should not be reported as an error.

In the scsi bsg subsystem, bsg-lib allocates a 96-byte reply buffer while struct ufs_rpmb_reply is 104 bytes. When an Advanced RPMB command returns an EHS, ufshcd_advanced_rpmb_req_handler() writes 8 bytes past the end of the buffer.

In the Linux kernel, the scsi: st driver has a use-after-free race between st_remove() and st_open(). st_remove() removes the idr entry only after dropping the reference, so a concurrent st_open() can find the freed structure and call kref_get() on it.

In the Linux kernel, the xen/scsifront driver's scsifront_do_response() only bounds-checks rqid from above and does not verify the shadow[] slot is populated. A malicious or buggy backend can return a response with an in-range but not in-flight rqid, causing a NULL pointer dereference.

In the Linux kernel's drm/amdgpu driver, amdgpu_debugfs_gpr_read() drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label and drops the reference a second time, causing a runtime PM usage count underflow or stealing a reference held by someone else.

In the Linux kernel's drm/amdgpu driver, amdgpu_gem_object_close() detaches the user queue eviction fence from the BO before checking bo_va->ref_count. Closing any handle of a BO removes the fence even when the file still has another handle and GPU mappings, allowing the BO to be evicted without suspending the user queues.

In the Linux kernel's drm/exec module, detecting contention causes a reference to the contended object to be grabbed and the object pre-locked. If the object was about to be destroyed, drm_exec holds the last reference but the object never enters the array of locked objects, so no dma_fence slot is reserved, potentially triggering a warning or BUG_ON().

In the Linux kernel's tracing module, predicate_parse() adds two to nr_preds to reserve terminal TRUE and FALSE entries and uses that increased value as the limit for parsed predicates. If the initial count is smaller than the number actually parsed, the program can fill the allocation and subsequent accesses can go past its end.

In the Linux kernel's tracing module, predicate_parse() uses the first operator stack entry before processing any opening parentheses. A push increments top before writing, and the existing check still permits the write when top already points to the last allocated entry, potentially accessing beyond the operator stack.

A bug was fixed in the Linux kernel tracing subsystem regarding hist trigger timestamps for buffered events. When an event file has a filter and the hist trigger is not yet attached, the event is written to a temporary per-CPU buffer without incrementing the committing counter, causing a WARN_ON_ONCE in ring_buffer_event_time_stamp. The fix uses tracing_event_time_stamp() in hist_field_timestamp() to record the current timestamp instead of warning.

In the Linux kernel, do_tcp_getsockopt() for TCP_CONGESTION suffers a use-after-free. The icsk_ca_ops pointer is read without holding rcu_read_lock(), and with BPF struct_ops it may point to memory freed concurrently via setsockopt(TCP_CONGESTION).

In the Linux kernel, do_tcp_getsockopt() for TCP_CC_INFO suffers a use-after-free. The icsk_ca_ops pointer and get_info function pointer are dereferenced without rcu_read_lock(), and with BPF struct_ops they may point to freed memory.

In the Linux kernel dm-crypt, crypt_dec_pending reads io->error before atomic_dec_and_test, creating a race condition. As a result, a failed read or write may be incorrectly reported as successful.

In the Linux kernel dm-integrity, integrity_metadata can enter an infinite loop on discard when the tag size exceeds HASH_MAX_DIGESTSIZE and kmalloc fails. In that case max_blocks is zero and bi_size is never decremented.

In the Linux kernel, the mac802154 subsystem had a data race and NULL pointer dereference on local->assoc_dev. The pointer shared between the association path and the association-response worker was not synchronized, which could lead to use-after-free or NULL dereference. The fix replaces the pointer with a cached address protected by a dedicated spinlock.

In the Linux kernel net/iucv, iucv_sock_recvmsg() sends the AF_IUCV_FLAG_WIN flag without testing the transport, causing a NULL dereference and spurious disconnect on classic z/VM sockets. Sending under spin_lock_bh also causes a race and double use of window credit.

In the Linux kernel XFS, xfs_sync_sb_buf() holds sb/rtsb buffer locks across a synchronous xfs_trans_commit(), causing a deadlock if shutdown occurs during CIL push. The fix removes xfs_trans_bhold() calls and re-acquires buffers after commit.

In the Linux kernel XFS, the capability check uses has_capability_noaudit(), which tests real credentials instead of effective ones. This allows bypassing group quota limits by changing a file's gid to another group the user belongs to, e.g. via an NFS client.

In the Linux kernel, a flaw was fixed in io_uring/cancel where io_uring_cancel_generic() refused to sleep while local work remained pending on a ring of the exiting task. For a ring created as disabled (IORING_SETUP_R_DISABLED) and later enabled by another task, the exiting task could spin in do_exit() and trigger WARN_ON_ONCE(), potentially panicking the kernel if panic_on_warn is set. The fix skips sleeping only when io_allowed_defer_tw_run() allows the task to run the work and drops the WARN_ON_ONCE().

The Linux kernel fixed a vulnerability in the SCTP inqueue parser (sctp_inq_pop) that accepted chunks with declared lengths shorter than the four-byte generic header. When ASCONF is covered by the association's SCTP-AUTH policy, a remote peer can repeatedly return the same malformed chunk and lock up the receive softirq (soft-lockup).

In the Linux kernel, page_pool_alloc_frag_netmem() does not align the requested fragment size on architectures without ARCH_DMA_MINALIGN (e.g., x86), causing frag_offset to advance by an odd, unaligned value. Subsequent users of the shared page pool receive misaligned buffers, and in the worst case an atomic_inc() in __skb_clone() straddles a cache line, triggering a kernel panic (Oops: Split lock detected) when split lock detection is enabled.

In the Linux kernel, a NULL dereference in the s390/ctcm driver's mpc_validate_xid() was fixed. When the peer XID is NULL or an r/w channel pairing mismatch occurs, grp->saved_xid2 is never initialized, and setting the flag leads to a NULL dereference.

In the Linux kernel, a leak of uninitialized kernel data in the s390/pci SCLP report was fixed. report_error_write() did not verify that the buffer was large enough for the report length claimed in report->length, so a short user buffer caused an out-of-bounds read and leaked up to about 4K of kernel data.

In the Linux kernel, missing packet source validation for connected sockets in vsock/virtio was fixed. virtio_transport_recv_pkt() could select a non-listening socket via destination-only lookup without checking the source, allowing an unrelated source to transition the victim socket to TCP_ESTABLISHED and deliver RW packets.

In the Linux kernel, missing packet source validation for connected sockets in vsock/vmci was fixed. vmci_transport_recv_stream_cb() could select a non-listening socket via destination-only lookup without checking whether the packet came from its stored peer; a RST from another context could reset a TCP_SYN_SENT socket.

In the Linux kernel, a divide-by-zero in fib_rebalance() was fixed. A concurrent change to ignore_routes_with_linkdown could make the first pass return a zero total weight while the second pass saw an eligible nexthop, resulting in division by zero.

In the Linux kernel, the drm/i915/dmc driver hardened DMC firmware payload parsing. It validates the conversion of firmware size from dwords to bytes using check_mul_overflow() before calculating the payload size, rejects zero-length payloads and zero MMIO counts in the header, and sets dmc_fw_size only after successful allocation.

In the Linux kernel bridge multicast subsystem, the port group walk during teardown is truncated because hlist_del_init() clears the ->next pointer of a deleted node, terminating the iteration early. This leaves port groups in the bridge mdb with a dangling ->key.port after the port is freed, causing a slab-use-after-free detected by KASAN in __mdb_fill_info.

In the Linux kernel, the net/psp subsystem fixed an issue where the Rx association was inherited on socket clone. Because sk->psp_assoc sits past sk_dontcopy_end, sock_copy() copied it into every accepted socket without taking a reference, leading to a use-after-free in psp_twsk_assoc_free. The fix clears the association on clone.

In the Linux kernel, the ksmbd server was fixed to fill in the FileSysIdentifier field in FS_POSIX_INFORMATION responses. smb2_get_info_filesystem() reported 56 bytes but never assigned the field, so eight bytes from the response buffer were sent to the client. In compound requests this could leak data from previous responses.

In the Linux kernel, the ksmbd server was fixed to initialize the FileSystemControlFlags field in FS_CONTROL_INFORMATION responses. smb2_get_info_filesystem() reported 48 bytes but never assigned the field, so four bytes from the response buffer were sent to the client. In compound requests this could leak data from previous responses.

In the Linux kernel, the ksmbd server was fixed to zero the FS_OBJECT_ID_INFORMATION buffer before filling it in. smb2_get_info_filesystem() reported 64 bytes but wrote only 46, leaving 31 bytes uninitialized. In compound requests this could leak data from previous responses, including those that failed with access denied.

In the Linux kernel, net/sched: cls_flower has a mask pointer validation flaw after nla_next(). fl_set_enc_opt() iterates the key's nested tunnel-option attributes while advancing a single mask pointer via nla_next() based on the number of key attributes rather than the mask's own attributes; the pointer produced by nla_next() is used in the next iteration without validation, leading to an out-of-bounds read (slab-out-of-bounds) in __nla_validate_parse called from fl_change().