Linux kernel vulnerabilities

In the Linux kernel, statmount_mnt_basic() read the parent's ids via m->mnt_parent under namespace_sem, which is safe only for mounts in a namespace. For a mount deliberately unmounted and kept alive only by a file descriptor (STATMOUNT_BY_FD), the final mntput() could free the parent concurrently, causing dereference of an already freed mount.

A vulnerability was fixed in the Linux kernel's mount namespace handling, where recursive bind mounts of namespace files (nsfs) could create cyclic dependencies and leak memory. do_loopback() only checked the starting dentry, and with MS_REC it copied namespace files below the source without verifying they don't form loops. This allowed a process in an older mount namespace to repeatedly leak memory by stacking bind mounts.

In the Linux kernel, attach_recursive_mnt() preallocates a mountpoint for the root of the topmost mount of the source, but the loop over the mount chain never examines the topmost mount. If the topmost mount is the only mount namespace file in the chain, the existing mount is attached below the root of the mount namespace file (an nsfs dentry), making it unreachable and preventing synchronous unmount. This leads to incorrect behavior of move_mount and umount.

In the Linux kernel, mnt_ns_release() removes fanotify marks of a mount namespace in process context, but mnt_ns_tree_remove() hands the reference to call_rcu(), so marks are removed from RCU softirq. This triggers a "sleeping function called from invalid context" BUG and lockdep warnings about the connector lock. A fanotify group with a FAN_MARK_MNTNS mark on another task's mount namespace is sufficient.

In the Linux kernel, ksys_unshare() calls put_nsproxy() on an nsproxy that was never installed when set_cred_ucounts() fails. This drives the reference counts of the new namespaces from zero to minus one and drops a reference to namespaces shared with the caller. As a result, the namespaces the caller lives in are no longer listed by listns().

In the Linux kernel drm/bridge subsystem, drm_bridge_add() removes a previously removed bridge from bridge_lingering_list without holding bridge_lock. Both bridge_list and bridge_lingering_list are protected by bridge_lock and concurrently modified by drm_bridge_remove() and __drm_bridge_free(), and walked by the debugfs 'bridges' file. Running the list_empty() test and list_del_init() outside the lock may corrupt either list.

In the Linux kernel cgroup/cpuset subsystem, is_in_v2_mode() may be called in a context where a new cgroup filesystem is being rebound with a stale cpuset_cgrp_subsys.root pointer. To avoid a potential use-after-free, a new cpuset_v2_mode flag is set when the cpuset_v2_mode mount option is used and written only when cpuset_bind() runs with a stable cpuset_cgrp_subsys.root value. is_in_v2_mode() now reads this flag instead of accessing cpuset_cgrp_subsys.root directly.

In the Linux kernel bonding module, replacing an XDP program does not release the reference on the old BPF program, whether going to no-prog or replacing with another program, causing BPF program leaks.

In the Linux kernel btrfs, btrfs_encoded_read_regular_fill_pages() may call btrfs_uring_read_extent_endio() and return the I/O status if all bios finish before it returns. A negative errno causes btrfs_uring_read_extent() and btrfs_uring_read_finished() to both unlock and free resources.

In the Linux kernel btrfs, after btrfs_uring_read_extent() the caller always jumps to out_acct, skipping kfree(data->iov). This is only correct for -EIOCBQUEUED where the deferred path owns the iov; on failure it causes a memory leak.

In the Linux kernel, btrfs_uring_read_extent() failed to release the inode and extent locks on a pages-array allocation failure, returning -ENOMEM without unlocking. This could lead to lock leaks.

In the Linux kernel, btrfs io_uring code left encoded data in the cmd PDU when returning -EAGAIN, causing a memory leak if the request was cancelled or the ring exited. The fix frees data on every exit path.

In the Linux kernel, the mt76 Wi-Fi driver incremented non_aql_packets on the link wcid where the frame was queued but decremented on the link reported in completion. For MLO peers this mismatch caused the counter to drift and block the station.

In the Linux kernel, the mt7915 driver did not disable rx napi before destroying it when removing the device, causing warnings and system instability on MT7916. The fix disables napi in mt7915_stop_hardware().

A vulnerability was fixed in the Linux kernel's __virtio_net_hdr_to_skb() function, which skipped flow dissection for GSO packets without the VIRTIO_NET_HDR_F_NEEDS_CSUM flag. This led to an out-of-bounds read in skb_gso_transport_seglen() for packets with malformed network headers or IP options/IPv6 extension headers.

In the Linux kernel, devlink_rel_nested_in_notify_work_schedule() took a reference on devlink_rel and queued work while ignoring schedule_delayed_work()'s return value. If the work was already pending, the extra reference was leaked along with the devlink_rel object.

In the Linux kernel RISC-V ptrace handling, register set buffers were not zero-initialized before copying data from userspace. A PTRACE_SETREGSET request with a short iov_len left uninitialized stack data that was then validated and copied into the target's state.

In the Linux kernel drm/imagination driver, pvr_vm_gpuva_remap() unnecessarily took a GEM reference for each split part (memory leak) and incorrectly linked the parts to the new object's vm_bo instead of the original, triggering a drm_gpuva_link() warning.

In the Linux kernel mlxsw spectrum_flower driver, mlxsw_sp_flower_tmplt_create() could acquire port range registers while parsing a template that were never released, because the local rulei struct never went through mlxsw_sp_acl_rulei_destroy().

A memory leak exists in the Linux kernel's vmci_transport_recv_dgram_cb() function during datagram socket closure. Packets are added to the socket's backlog, and after the receive queue is cleared, __release_sock() moves them back to the receive queue, causing a memory leak. The issue is fixed by adding receive queue cleanup in the socket destructor.

In the Linux kernel, the drm/vc4 driver has a race during runtime suspend. vc4_irq_disable() masks V3D interrupt sources and calls synchronize_irq(), but on the ARMCTRL interrupt controller (RPi 0-3) this does not fully quiesce the handler — an interrupt may run after the V3D power domain is off, where register reads return 0xdeadbeef. This can schedule vc4_overflow_mem_work() after it was cancelled. The fix disables the interrupt line across the PM transition and balances IRQ installation/request.

In the Linux kernel, a possible deadlock reported by lockdep was fixed when kswapd shrinks the TTM page pool. The immediate cause was an unnecessary GFP_KERNEL allocation in a page table free path, performed while holding mmap_read_lock. The PMD page copy was removed, eliminating the allocation and resolving the locking issue.

In the Linux kernel Rust irq layer, RegistrationInner is passed as the IRQ cookie to request_irq before its fields are initialized. This can lead to reading uninitialized memory in the IRQ callback.

In the Linux kernel, KVM on s390 fixed IRQ injection with SIGP Stop and Store Status. Storing status to userspace could fault while holding a spinlock, which is problematic.

In the Linux kernel, the MACsec driver fixed initialization ordering: SecY was initialized after netdevice registration, causing warnings and reporting uninitialized attributes (including SCI) in notifications. The fix initializes SecY and link attributes before registration.

In the Linux kernel, KVM on arm64 fixed an inconsistency between KVM_ARCH_FLAG_GUEST_HAS_SVE and KVM_ARM_VCPU_SVE. A host setting the flag without the bit caused a vCPU with NULL sve_state, leading to issues during world switch.

A bug was fixed in the Linux kernel's BPF sockmap mechanism where redirecting an skb back to the same socket (self-redirect with BPF_F_INGRESS) caused double-counting of copied_seq. This led to kernel warnings and incorrect recvmsg behavior. The fix converts the self-redirect verdict to __SK_PASS to avoid double advancement of copied_seq.

A Linux kernel issue causing hung tasks during filesystem unmount after disk removal has been fixed. evict_inodes() repeatedly rescanned the same inodes because it restarted the list walk after dropping the lock, keeping s_umount held for a long time and blocking concurrent unmounts. The fix keeps the current inode out of the disposal batch until the lock is reacquired and resumes the walk from it.

In the Linux kernel on arm64, ioremap_prot() did not reject mappings lacking the PTE_USER flag, causing a spurious WARN when accessing PROT_NONE or execute-only pages via /dev/mem and /proc/<pid>/cmdline. The fix makes such protection values fail cleanly without warning.

A bug was fixed in the Linux kernel emac driver that caused a kernel panic (NULL pointer dereference) during driver initialization on PowerPC 44x platforms. The issue occurred because of_phy_connect() was called before netdev_ops were set, leading to a netdev_need_ops_lock() check on an uninitialized pointer. The fix moves the initialization of netdev_ops, commac.ops, and ethtool_ops before emac_init_config().

In the overlayfs filesystem, ovl_do_mkdir() printed the input dentry with %pd after calling vfs_mkdir(), which may free or replace the dentry, leading to a use-after-free when CONFIG_OVERLAY_FS_DEBUG is enabled. The fix prints the dentry before the call and only the result afterward.

In the Linux kernel, a bug was fixed in the netfs subsystem where direct mempool allocation calls bypassed the alloc_hooks() wrapper, causing warnings about current->alloc_tag not being set during allocation and free when CONFIG_MEM_ALLOC_PROFILING_DEBUG is enabled. The issue occurred e.g. when reading files on a CIFS mount, and allocations were missing from /proc/allocinfo.

In the Linux kernel, DAMON's damon_ptep_mkold() passed an unaligned sampling address to the young-flag clearing path. On arm64 this caused the contpte walk to overrun the block and write into the page following the page table, leading to kernel crashes or silent memory corruption.

In the Linux kernel, the crypto ccp driver called rmp_mark_pages_firmware() with locked=false while the parent function already held sev_cmd_mutex. On an RMPUPDATE failure, the cleanup path could deadlock in sev_do_cmd. The fix passes locked=true.

In the Linux kernel, a vulnerability was found in the amdgpu driver where amdgpu_devcoredump_format() recursively acquires a ww_mutex lock. This can lead to a deadlock when dumping IB contents from a hung job. The fix moves the operation to a separate helper using a single drm_exec context.

In the Linux kernel, the drm/xe driver's DPT allocation paths were fixed. The fallback from VRAM to system memory was removed as it did not work and caused black screen with pipe faults. Also, stolen memory usage is avoided due to latency and risk of random system hangs under load.

In the Linux kernel, a vulnerability in the msm serial driver was fixed by disabling DMA for the console UART. Concurrent writes from userspace and the kernel can trigger a race condition resulting in an infinite loop of the same messages. The fix disables DMA for the console UART to ensure a reliable output path.

In the Linux kernel, a fix was made for an uncancelled rxrpc OOB message handler in AFS. The fix cancels OOB message processing (typically to respond to security challenges) and moves it to afs_wq so it is also waited for. The OOB handler now returns if the net namespace is no longer live.

In the Linux kernel, a fix was made in the Tegra crypto driver to return ENOMEM when input buffer allocation fails for ccm. The fix ensures the ENOMEM error value is set when the allocation fails in tegra_ccm_do_one_req.

In the Linux kernel, a fix was made in the OCFS2 filesystem regarding buffer head management in ocfs2_read_blocks(). The fix clarifies that the caller should not assume that the buffer head returned by sb_getblk() is exclusively owned and that put_bh() always drops b_count from 1 to 0. To avoid a scenario where a buffer head remains on hold and may be returned with BH_Uptodate set despite previous validation failure, BH_Uptodate is now cleared immediately after the validate() callback detects data inconsistency.

In the Linux kernel, the IB/mlx5 driver has a vulnerability related to implicit ODP and rereg_mr operation. Due to child mkeys in the implicit ODP configuration, nothing can be changed in place for the parent mkey, so the whole structure must be rebuilt. Additionally, a race condition involving access to mr->pd by child keys was removed.

A circular locking dependency was found in the Linux kernel's OCFS2 filesystem during direct I/O write completion. The ocfs2_dio_end_io_write function could deadlock due to improper lock ordering involving system inodes (INODE_ALLOC, EXTENT_ALLOC, ORPHAN_DIR). The fix releases allocation contexts before acquiring the ORPHAN_DIR lock.

In the Linux kernel, the AFS filesystem has a memory leak related to the vllist in afs_update_cell(). When the new list is empty (nr_servers == 0), the old list is not replaced, leading to a leak of the new list.

A vulnerability was found in the Linux kernel's ring buffer mechanism used by ftrace. When RB_FORCE_8BYTE_ALIGNMENT is enabled (e.g., on riscv64 with CONFIG_HAVE_64BIT_ALIGNED_ACCESS), ring_buffer_event_length() incorrectly calculates the length of small events, reporting a data length 4 bytes larger than expected. This causes inconsistent results in ftrace tests (trace_marker_raw).

In the Linux kernel, the IPVS module has a vulnerability in TCP state handling. The code reparses the packet to find the TCP header, using sizeof(struct ipv6hdr) for IPv6, while the actual transport header offset is already known from ip_vs_fill_iph_skb(). For IPv6 packets with extension headers, this leads to reading the wrong bytes.

In the Linux kernel, the DTS file for the Renesas Ironhide platform lacks descriptions of memory areas reserved for the DBSC5 DRAM controller with inline ECC. If these areas are not properly reserved, Linux may use and corrupt the memory used by the controller, leading to system instability.

In the Linux kernel, KVM for arm64 has a vulnerability where ESR_EL2 is not written when injecting nested SError exceptions. The kvm_inject_el2_exception() function writes ESR_EL2 for synchronous exceptions but not for SError, causing the L2 guest to observe a stale ESR_EL2.

In the Linux kernel, the ALSA HDA driver for TAS2781 has a vulnerability where the asynchronous firmware request is not cancelled during unbind. This can lead to a situation where the firmware callback operates on state that is being torn down, potentially causing errors or races.

In the Linux kernel, the Xilinx TRNG cryptographic driver removed the crypto_rng interface because it was not used. The removal eliminates bugs such as returning success without filling all bytes and the possibility of concurrent execution of xtrng_trng_generate() and xtrng_hwrng_trng_read(), which could interfere with each other.

In the Linux kernel's amdkfd driver, the CRIU restore flow did not properly validate user-supplied IDs before passing them to idr_alloc. IDs larger than INT_MAX can trigger a WARN in the IDR layer, potentially causing a panic or reboot if panic_on_warn is enabled.