Linux kernel vulnerabilities

In the Linux kernel SMB client, cifs_set_acl() validates ACL size using the xattr format (4 + count*8), but cifs_do_set_acl() writes the larger CIFS wire format (6 + count*10) into the same buffer, which can overflow the heap. The size is also not checked against USHRT_MAX, so an oversized ACL truncates the on-wire packet length and causes the server to apply a partial ACL.

In the Linux kernel SMB client, CIFSSMBSetEA() copies the caller's extended attribute value into the SMB request buffer without checking that it fits. An unprivileged setxattr(2) on an SMB1 mount with a large attribute causes a slab-out-of-bounds write. The fix applies SendReceive()'s limit before the copy and widens byte counters to prevent overflow.

In the Linux kernel NTFS filesystem, ntfs_new_attr_flags() passes the wrong MFT record pointer to ntfs_attr_record_resize(). When the attribute resides in an extent record, the base record pointer is passed instead of the extent record, causing incorrect size calculations in memmove.

In the Linux kernel drm/amdgpu driver, amdgpu_cs_parser_bos() allocates HMM ranges for userptr entries but does not free them when later CS processing stages (patch_jobs, vm_handling, sync_rings, early submit) fail. Each such failure leaks the range, its hmm_pfns array, and the BO reference.

In the Linux kernel sched_ext scheduler, a task enqueued with SCX_ENQ_LAST that lands back on its CPU's local DSQ does not trigger rescheduling. The CPU idles with the task queued until an unrelated wakeup or watchdog fires, stalling exiting tasks.

A use-after-free vulnerability was fixed in the Linux kernel workqueue subsystem regarding unbound worker pool lifetime. Canceling the last inactive work skipped pwq_dec_nr_active(), leaving an empty pwq on pending_pwqs, and pwq_release_workfn() put the pool before removing that pwq. This could cause the pool to be RCU-freed while the pwq remained reachable, leading to use-after-free in node_activate_pending_pwq().

In the Linux kernel NTFS filesystem, ntfs_new_attr_flags() shrinks the attribute record before moving its name and mapping pairs to shorter-header offsets. Shrinking first moves the following attribute over the old record's tail, so memmove copies wrong bytes, producing a malformed mapping pairs array.

In the Linux kernel, a vulnerability was resolved in the wifi: p54 driver where the firmware parser accesses component ID and version records without validating their lengths. A malformed record can cause the parser to read past the record. The fix validates record lengths and rejects descriptor values that underflow the RX offset or produce an empty RX range.

In the Linux kernel, an AMD CPU erratum (#1718) was addressed where the processor may fail to invalidate a TLB entry while executing an INVLPGB/TLBSYNC instruction pair. The kernel detects the erratum and applies a software workaround when no microcode fix is present.

In the Linux kernel, dm-integrity in inline mode has a stack buffer overflow when the tag size exceeds HASH_MAX_DIGESTSIZE; integrity_sector_checksum pads the result with zeroes past the end of the buffer. With CONFIG_STACKPROTECTOR the kernel panics on the first read. This is not considered a security bug because it can only be triggered by root.

In the Linux kernel, tee_dyn_shm_alloc_helper() does not check for a zero size, leading to alloc_pages_exact(0) and undefined get_order(0) behavior. This trips the page allocator warning and fails the allocation, and on a panic_on_warn kernel it ends the boot. It can be triggered via TEE_IOC_SHM_ALLOC with size 0.

In the Linux kernel, an io_uring ring created with IORING_SETUP_R_DISABLED is exempt from its register restrictions until enabled, allowing bypass of allowed register opcodes. This also applies to restrictions inherited from the task, so a task with restricted opcodes can create a disabled ring, issue any register opcode, and then enable it. The fix marks rings with inherited restrictions and keeps checking register opcodes while the ring is disabled.

In the Linux kernel, drm/vc4 does not stop the hangcheck timer or job_done_work at V3D unbind, leading to V3D register access through a NULL vc4->v3d pointer and callbacks after memory is freed. The fix drains the timer and cancels reset_work in vc4_v3d_unbind() and flushes job_done_work.

In the Linux kernel, btintel_pcie_prepare_tx() uses tfd_index to access the TFD and data buffer arrays before the index is advanced modulo txq->count. An index equal to txq->count is one past the end of both arrays, so the fix rejects it in the bounds check.

A Linux kernel bug causes a kernel panic during boot when a boot-time function tracer with a filter is used (e.g., ftrace=function ftrace_filter=pud_free_pmd_page). During early tracer initialization, a trampoline is made read-only, splitting a large page that CPA immediately collapses, freeing the split page table via pagetable_free_kernel(). That function queues work on system_percpu_wq, which is still NULL at that point, resulting in a general protection fault and kernel panic.

In the Linux kernel on RISC-V, patch_map() incorrectly assumes vmalloc addresses are directly writable when CONFIG_STRICT_MODULE_RWX is disabled. Since BPF marks its text read-only via set_memory_rox() regardless, the write triggers a page fault and returns -EFAULT, preventing JIT compilation of BPF programs and triggering WARN_ON().

In the Linux kernel Bluetooth MGMT subsystem, pending commands flushed on power off receive an incorrect status. cmd_complete_rsp() passes a struct pointer instead of the status, so the byte sent comes from the socket representation (or 0x00) rather than the intended MGMT_STATUS_NOT_POWERED or MGMT_STATUS_INVALID_INDEX.

In the Linux kernel, the drm/amdgpu vblank counter callback reads display registers without holding reset_domain->sem. During GPU recovery, this can cause hardware access while reset is in progress, triggering a lockdep warning and setting TAINT_WARN. The fix acquires the reset semaphore for reading and falls back to the cached software vblank count when reset is in progress.

In the Linux kernel, the ASoC samsung i2s probe function sets the device to runtime PM active with only the iis bus clock enabled, but does not enable op_clk, which is later disabled in the suspend callback. This causes an unbalanced clock disable and an 'i2s_bus already disabled' warning during boot on Exynos5250 Arndale. The fix enables op_clk in probe and disables it in remove.

In the Linux kernel openvswitch module, set_ipv6_addr() calls update_ipv6_checksum() when rewriting IPv6 addresses on fragments, which reads an uninitialized transport header. This triggers a warning under CONFIG_DEBUG_NET but is otherwise harmless. The fix returns early when the protocol is NEXTHDR_FRAGMENT.

In the Linux kernel, the ksmbd server has a heap out-of-bounds write in krb5_authenticate(). When SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the out_len calculation omits work->next_smb2_rsp_hdr_off, overstating available buffer space and allowing memcpy() to write the AP-REP blob past response_buf. The fix subtracts this value when computing out_len.

A bug was fixed in the Linux kernel KVM on x86 regarding the per-vCPU MMIO cache. The cache was tagged with a memslot generation, but both the fill and validation paths used kvm_memslots(), which unconditionally selects address space 0 even when the vCPU runs in SMM and uses address space 1. As a result, an SMM memslot update could leave an apparently valid entry from the old SMM address space after the vCPU returns to the normal address space, letting a guest force a KVM_EXIT_MMIO for valid RAM.

In the Linux kernel, clear_inode() has an xarray node leak that can be triggered, among other ways, via madvise. Rather than fixing the leaks where they occur, the fix calls xa_destroy(), which has the side effect of cycling the i_pages lock.

A vulnerability in the Linux kernel's IPv4/UDP handling allowed off-path attackers to conduct a side-channel attack on the FIB nexthop exception (FNHE) cache. Previously, an exception was only created if the UDP packet could be matched to an existing socket, enabling discovery of the ephemeral port used by a connected UDP socket. The fix always creates a FNHE before attempting socket matching.

In the Linux kernel IPv4 subsystem, a null-ptr-deref occurs during PMTU update when a nexthop group shrinks. __ip_rt_update_pmtu() iterates over paths, and a concurrent nexthop replacement can cause fib_info_nhc() to return NULL, which is then dereferenced in update_or_create_fnhe(). This requires CAP_NET_ADMIN in the network namespace, but where unprivileged user namespaces are permitted, a local user can obtain it.

In the Linux kernel IPv4 subsystem, a null-ptr-deref occurs during route notification sizing when a nexthop group shrinks. fib_nlmsg_size() checks fib_info_num_path() before each iteration, then fib_info_nhc() independently reloads nh->nh_grp; if RTM_NEWNEXTHOP replaces the group with fewer paths, fib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences it. The fix stops sizing when the indexed path is absent.

In the Linux kernel IPv4 subsystem, a false warning about a route notification size race occurs. fib_alias_hw_flags_set() sizes the skb with fib_nlmsg_size() and later fills it with fib_dump_info() while holding only RCU; a concurrent replacement can grow the nexthop group, causing fib_dump_info() to legitimately return -EMSGSIZE. The fix removes the warning as it does not prove a sizing bug.

In the Linux kernel IPv6 subsystem, a false warning about a route notification size race occurs. fib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later fills it with rt6_fill_node(); a concurrent replacement can grow the nexthop group, causing rt6_fill_node() to legitimately return -EMSGSIZE. The fix removes the warning as it does not prove a sizing bug.

In the Linux kernel, scrub_print_warning_inode() in btrfs leaks a root reference when paths_from_inode() fails. The error path does not drop the reference taken by btrfs_get_fs_root(), leaking a reference every time path resolution fails while printing scrub warnings.

In the Linux kernel, cipso_v4_skbuff_delattr() removes CIPSO bytes but does not adjust cached offsets for options that follow them (srr, rr, ts, router_alert). Consumers such as ip_forward_options() and __ip_options_echo() then access the wrong bytes, and the latter may interpret packet data as the option length and copy it into fixed-size option storage.

In the Linux kernel, get_result_buffer() sets data_start to sizeof(struct dm_ioctl) without checking the actual buffer size, so with the minimum buffer data_start ends up past the end. This causes a slab-out-of-bounds read in ctl_ioctl() and leaks seven bytes adjacent to the allocation.

In the Linux kernel, is_chained_work() can be reached by a kworker that is not currently executing a work item, so worker->current_pwq is NULL and the chained-work test faults before emitting the intended warning. The fix guards the test with worker->current_pwq.

In the Linux kernel's xen/netfront driver, xennet_fill_frags() returns an error when a response chain has more slots than fit in the skb's frags. The error path in xennet_poll() moves what remains on tmpq to errq, but the skb being filled was already dequeued from tmpq and is never freed, leaking the skb and its attached pages.

In the Linux kernel, strparser did not guarantee that in-flight __strp_recv calls completed before the parser was torn down in strp_done(). A dummy lock_sock/release_sock pair was added to ensure completion of in-flight strp_recv calls, and state bits were switched to u8 to avoid races between strp_stop() and strp_pause/unpause().

In the Linux kernel, tipc_topsrv_stop() closed subscriber connections while the topology server's send and receive workqueues were still running. This caused races leading to refcount errors, a use-after-free in tipc_conn_close(), queue_work() on a destroyed workqueue, and an RCU stall in tipc_topsrv_exit_net(). The fix clears the flag under idr_lock, destroys workqueues before closing connections, and refuses tipc_conn_lookup() after the flag is cleared.

In the Linux kernel TIPC module, tipc_node_find_by_name() returned a node pointer after dropping the RCU read lock without taking a reference. The LINK_SET, LINK_GET and LINK_RESET_STATS handlers could then use a freed node, leading to a use-after-free (reported by KASAN).

In the Linux kernel, SELinux did not set SECURITY_LSM_NATIVE_LABELS in *set_kern_flags when an NFSv4 filesystem exported with security_label was mounted a second time, because the superblock was already SB_INITIALIZED and selinux_set_mnt_opts() exited early. As a result, nfs_get_root() cleared NFS_CAP_SECURITY_LABEL on the shared nfs_server, disabling per-file labeling for both mounts.

In the Linux kernel, __fsverity_get_info() uses rhashtable_lookup_fast() with rcu_read_lock(), which does not directly synchronize with fsverity_remove_info(). For different inodes, concurrent calls can cause a use-after-free because they rely on fsverity_info::rhash_head and fsverity_info::inode after freeing. The fix RCU-delays freeing of struct fsverity_info after removal from the rhashtable.

In the Linux kernel's gpio-mpsse driver, gpio_mpsse_irq_enable() armed the poll worker before adding it to priv->workers. If gpio_mpsse_disconnect() walked the list in that window, it missed the worker, and after mpsse_priv was freed the orphaned gpio_mpsse_poll() kept accessing it, causing a use-after-free. The fix publishes and arms the worker in one irq_spin critical section and adds a priv->dying flag.

In the Linux kernel's gpio-xilinx driver, xgpio_request() called pm_runtime_get_sync(), which leaves the usage counter incremented on failure. Since gpiolib does not call ->free() after a failed ->request(), xgpio_free() with the matching pm_runtime_put() never ran, leaking the reference and preventing the controller from runtime-suspending. The fix switches to pm_runtime_resume_and_get().

In the Linux kernel, the gve driver leaks an XSK buffer on an error descriptor. When the error bit is set in the RX completion descriptor, buf_state and its attached buffer should be freed, but in the AF_XDP ZC case the XSK buffer is not freed.

In the Linux kernel, the ibmveth driver fails to free the logical LAN on open failure after registration. When RX buffer pool allocation fails, the code skips h_free_logical_lan(), so PHYP still owns the buffer-list page when it is unmapped.

In the Linux kernel, the ice driver mishandles metadata_dst refcount on representor teardown. ice_eswitch_release_repr() uses metadata_dst_free(), which frees memory without checking the dst_entry refcount, while queued packets still hold references.

In the Linux kernel, io_uring/net has a CONNECT filter bypass for 24-byte sockaddr_in6. io_connect_bpf_populate() fills filter fields only when addr_len >= 28 bytes, while IPv6 connect paths accept 24 bytes, so the filter sees zero port and address and can be bypassed.

In the Linux kernel, ip6_gre has a NULL dereference in the obsolete ERSPAN PMTU update. ip6erspan_tunnel_xmit() treats a metadata dst as a route, and since it has no output device, dst_dev(dst)->mtu dereferences NULL.

In the Linux kernel, the KEYS subsystem has an add_key() race with keyring restriction. __key_create_or_update() snapshots restrict_link before taking the semaphore, allowing a writer to observe no restriction, wait for installation, and link a key despite the restriction.

In the Linux kernel memstick rtsx_usb_ms module, a race during device removal can cause a request to be silently dropped, so nobody completes card->mrq_complete. With the memstick core waiting for request completion without a timeout, this hangs removal: memstick_check() never returns and memstick_remove_host() blocks in flush_workqueue(). The fix ensures requests are never dropped but completed with -ENOMEDIUM once eject is set.

In the Linux kernel, dm-crypt accepted an invalid configuration pairing an AEAD cipher with the lmk IV mode (e.g. "capi:gcm(aes)-lmk"). The lmk mode sets tfms_count to 64, but crypt_alloc_tfms_aead allocates only one transform, causing an out-of-bounds read of the tfms_aead array and a call to crypto_aead_setkey on invalid data, resulting in an oops when the table is loaded.

In the Linux kernel device-mapper (dm) subsystem, do_resume calls dm_table_get_mode(new_map) without holding locks, so a concurrent ioctl on the same device can cause a read of freed memory (use-after-free). The race was found by syzbot; the fix reads the new table's mode before dm_swap_table.

In the Linux kernel mtk-sd MMC driver, the queued request timeout work was not synchronously cancelled during device unbind. The timeout callback can keep using a freed mmc_host, which KASAN reports as use-after-free in msdc_request_done() and msdc_recheck_sdio_irq(). The fix adds cancel_delayed_work_sync() after mmc_remove_host().