Linux kernel vulnerabilities

In the Linux kernel sdhci-sprd MMC driver, probe enables runtime PM but the remove path does not perform the corresponding runtime PM cleanup. During removal, clocks managed by runtime PM callbacks may be disabled while the device is runtime-suspended. The fix resumes the device, disables runtime PM and drops the temporary reference before disabling clocks.

In the Linux kernel, packet_rcv_spkt() lacks the dev_has_header() check before calling skb_push() to restore the link layer header. For devices without a visible header (e.g. CAN), skb->mac_header remains at the 0xFFFF sentinel, producing a large negative length and triggering skb_under_panic() from softirq context, i.e. a full system panic. The flaw is reachable via a SOCK_PACKET socket with CAP_NET_RAW.

In the Linux kernel, smc_getname() dereferences smc->clcsock without holding clcsock_release_lock, allowing link-group termination to release the CLC socket concurrently. This results in a use-after-free (or NULL dereference if the pointer is cleared before the load) when getsockname() is called.

In the Linux kernel bridge subsystem, br_multicast_sg_del_exclude_ports() removes automatically added STAR_EXCL port groups by calling br_multicast_del_pg(), which for S,G entries calls back into the same function recursively. A large number of STAR_EXCL ports consumes one kernel stack frame per port and can hit the stack guard page.

In the Linux kernel, skb_copy_and_csum_bits() returns 0 after copying only the linear part when it reaches unreadable frags, leaving the rest of the caller's buffer unchanged. Since buffers (e.g., ICMP errors or driver TX bounce buffers) are not zeroed beforehand, unexpected memory contents may be sent over the wire.

In the Linux kernel team subsystem, a nonzero dev_queue_xmit() result does not return ownership of the skb. When an override port's qdisc drops it, the queue override helper tries another port or the mode transmit op with the freed skb, leading to use-after-free.

A Linux kernel vulnerability was fixed in the openvswitch module that caused a soft lockup during netlink flow dumps. ovs_flow_cmd_dump() called ovs_flow_stats_get() for every flow, repeatedly releasing the lock via spin_unlock_bh() and running pending softirqs in the dumping thread's context, preventing preemption.

In the Linux kernel, optee_probe() called tee_device_register() on both the client and supplicant device before the rest of struct optee was initialized. This made the device reachable from user and kernel space before mutexes, completions, and the argument cache were initialized and while optee->ctx was NULL, leading to use of uninitialized mutexes and NULL pointer dereferences.

In the Linux kernel ltc3676 regulator, HRST (0x1e) and CLIRQ (0x1f) are write-only command strobes. Reading HRST triggers a hard reset of the chip and reading CLIRQ clears the interrupt. A plain register dump via regmap resets the board.

In the Linux kernel, the scsi: ch driver in ch_readconfig() takes a reference to the scsi_device of each data transfer element and never drops it. After a drive is removed, its scsi_device can never be released, blocking reuse of the address and preventing module unload. The fix drops the reference right after printing the name and removes the unused dt[] array.

In the Linux kernel on RISC-V, with CONFIG_SHADOW_CALL_STACK enabled, handle_exception() decided whether to reload the shadow call stack pointer (gp) based on the user-writable tp register. By setting tp to the linear-map address of its own task_struct, a user task could make the kernel skip the gp reload, leading to an unprivileged kernel arbitrary-write and control-flow-hijack primitive.

In the Linux kernel, errata_probe_ghostwrite() only marks the CPU vulnerable at the early boot stage, which requires CONFIG_RISCV_ALTERNATIVE_EARLY. That option is currently selected only by ERRATA_THEAD_MAE, so with ERRATA_THEAD_GHOSTWRITE=y and ERRATA_THEAD_MAE=n the vulnerable state is never set and the mitigation does not apply. The fix selects RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE.

In the Linux kernel on RISC-V, futex helpers pass the raw user pointer to atomic operations without untagging, even though access_ok() checks the untagged address. With the tagged address ABI enabled (CONFIG_RISCV_ISA_SUPM), an unprivileged process can make FUTEX_WAKE_OP perform an atomic read-modify-write on an arbitrary kernel address. The fix untags the pointer before the atomic operation, as get_user()/put_user() already do.

In the Linux kernel Bluetooth hci_sock: rebinding an HCI socket after its controller is unregistered can race with monitor control replay. hci_sock_bind() clears the hdev pointer and drops the reference under only the socket lock, while send_monitor_control_replay() reads under hci_sk_list.lock, leading to a NULL dereference or use-after-free. The fix takes hci_sk_list.lock for writing when clearing the pointer and resetting socket state.

In the Linux kernel, hci_le_set_ext_scan_param_sync() during PA sync scan setup suffers from a use-after-free. The address pointer is obtained from hci_sent_cmd_data() without holding a reference to the skb, and the concurrent hci_cmd_work() can free and replace that skb before the address is dereferenced. The fix serializes access to sent_cmd and req_skb using hdev->lock and copies the address before releasing the lock.

A flaw was fixed in the Linux kernel Bluetooth ISO handling where concurrent listen() calls on the same broadcast socket could overwrite the connection pointer and leak a reference. This could lead to a use-after-free when later events access the stale socket, as confirmed by a KASAN report.

In the Linux kernel, Bluetooth ISO iso_sock_connect() checks socket state before taking the socket lock and drops the lock before setting up a connection, allowing two concurrent callers to pass the admission check. This can overwrite the socket destination, leak references, and cause a use-after-free, as reported by KASAN in iso_sock_hold().

In the Linux kernel Bluetooth SCO handling, a race existed between the receive path (sco_recv_scodata) and sco_conn teardown, leading to a use-after-free. The hcon->sco_data pointer was cleared without holding hdev->lock, so the RX path could call kref_get_unless_zero() on an already freed sco_conn. The fix gives the pointer a real reference and serialises its clearing under hdev->lock.

In the Linux kernel, the Bluetooth RFCOMM implementation leaks an skb in rfcomm_recv_data() when the DLC has no owner. The socket implementation returns without freeing the skb, whereas the tty implementation frees it correctly. The leak grows continuously because the remote keeps receiving credits and sending data frames.

In the Linux kernel Bluetooth RFCOMM subsystem, an AB/BA deadlock exists between rfcomm_mutex and hdev->lock. An RFCOMM connect() issued while a BR/EDR link is being authenticated can trigger a circular locking dependency, potentially causing a deadlock. The fix connects the session socket without holding rfcomm_mutex and adds the session to the list afterwards.

In the Linux kernel, the Bluetooth RFCOMM driver has a NULL dereference in rfcomm_dev_shutdown() when an RFCOMM tty is closed. If tty device registration in rfcomm_dev_add() fails, dev->tty_dev is never set, and the shutdown function uses it without checking.

In the Linux kernel, drm/fb-helper has an issue when drm_fb_helper_single_fb_probe() fails with an error other than -EAGAIN. In that case fb_helper->deferred_setup is not set, and a later .restore() call commits a stale mode_set with fb == NULL, triggering WARN_ON(!set->fb).

In the Linux kernel, drm/i915/gem's eb_relocate_parse_slow() can call kvfree() on entries outside the original exec array. This happens because eb_parse() increments eb->buffer_count after appending VMAs, and cleanup uses the incremented count to release relocation pointers.

In the Linux kernel's drm/i915/gt component, a race exists between intel_rps_boost() reading a stale ACTIVE state and queuing rps->work. This can cause rps_work() to run after the GT has been parked and unmask RPS PM interrupts without holding the PM wakelock, triggering an "RPM wakelock ref not held during HW access" message and tainting the kernel.

In the Linux kernel, drm/vmwgfx lacks validation of the pitch coming from userspace before copying data from the underlying surface. This can lead to out-of-bounds reads during cursor snooping.

In the Linux kernel, mnt_change_mountpoint() did not reset the old parent's ->overmount, unlike __umount_mnt(). In the reparent()/propagate_umount() path this led to a dangling pointer and use-after-free when a file descriptor kept an unmounted mount alive, and do_lock_mount() followed ->overmount into the freed mount.

A Linux kernel bug was fixed in clone_mnt(), where the MNT_UMOUNT flag was inherited by cloned mount points. This allowed copies of a lazily unmounted mount (kept alive by an nsfs/pidfs file descriptor) to be created, causing multiple issues: structure leaks, incorrect unmounting of peers, and propagation/reparenting problems. The fix adds MNT_UMOUNT to MNT_INTERNAL_FLAGS so it is never copied.

In the Linux kernel, may_copy_tree() accepted a mount whose root is an nsfs or pidfs file before checking whether that mount is mounted. This exception also admitted a bind mount of such a file after lazy unmount, kept alive only by a file descriptor, so recursive copying (MS_REC/AT_RECURSIVE) copied the entire unmounted mount stack.

A use-after-free vulnerability exists in the Linux kernel mount notification mechanism. mnt_notify_add() does not check whether a mount is already on notify_list, so multiple umount_tree() calls under a single namespace_sem hold can queue the same mount twice and corrupt the list. Subsequent mount operations on the host then walk freed memory.

In the Linux kernel, shrink_submounts() and mark_mounts_for_expiry() first collect mounts to unmount and then unmount them. Unmounting the first mount changes the propagation tree, so the second mount can be unmounted even though it is busy, leaving it marked MNT_SYNC_UMOUNT while still in use. This affects mounts with MNT_SHRINKABLE, such as automounted submounts of NFS, AFS, CIFS, or tracefs under debugfs.

A vulnerability was fixed in the Linux kernel's open_tree(OPEN_TREE_NAMESPACE) mechanism, which creates a new mount namespace from a copy of the tree at a given path. An unprivileged user could first create a user namespace and then access content hidden by covering mounts (e.g., masking parts of /proc and /sys in container runtimes).

A use-after-free flaw was fixed in the Linux kernel's path_pivot_root() function used by pivot_root(). It read the parent pointer (mnt_parent) of a mount that could already be unmounted and freed while only a file descriptor kept it alive. The check that both mounts belong to the caller's mount namespace now happens before their parents are read.

In the Linux kernel, attach_recursive_mnt() creates a second mountpoint for the root of the source mount without locking the inode, and d_set_mounted() only rejects unlinked dentries. Between detach_mounts() and d_delete() the victim is still hashed, so a bind mount of the directory being removed can be moved beneath an existing mount and never detached. This leaves a mount on a removed directory.

In the Linux kernel, d_alloc_pseudo() returns dentries with DCACHE_NORCU that are freed immediately unless they become a mount root. Bind mounting /proc/self/fd/<fd> of such a file (e.g., a BPF token on bpffs) makes such a dentry a mount root, leading to a use-after-free during __follow_mount_rcu(). This can result in access to freed memory.

A race condition exists in the Linux kernel's __detach_mounts() when detaching mounts from a dentry. Between detach_mounts() and d_delete() the dentry remains hashed and positive even though nothing covers it anymore, allowing concurrent lookups to uncover what the mounts hid. This affects unlinking files or directories that are mountpoints in other mount namespaces.

A vulnerability was fixed in the Linux kernel namei refwalk mechanism that could reveal overmounted entries. In a narrow race window between mount detachment and name removal (unlink/rmdir/rename), refwalk could return the underlying entry instead of the mounted content. The fix adds a DCACHE_CANT_MOUNT check after step_into() to detect this case.

The Linux kernel has a flaw in mount namespace handling that allows adding an automount below a mount that is not in the caller's mount namespace. clone_private_mount() sets MNT_NS_INTERNAL, so the validity check passes and count_mounts() dereferences an error pointer, causing a general protection fault. The issue is reachable from userspace via fanotify and occurs while namespace_sem is held for writing, blocking subsequent mount operations system-wide.

The Linux kernel has a flaw in handling locked mounts, which are meant to protect underlying files and directories from being revealed. When a user namespace owner places a mount beneath a locked mount using MOVE_MOUNT_BENEATH, the locked property moves to the bottom mount, allowing the top mount to be unmounted and the covered directory to be revealed. The fix makes plain umount() return EBUSY and lets a locked mount die together with its parent.

A flaw in the Linux kernel's mount locking for automounts across user namespaces was fixed. The user namespace was taken from the caller's mount namespace instead of the namespace where the mount actually lands, causing the lock to be placed on the host's mount rather than the child's copy, preventing the host from changing its own mount flags.

A vulnerability in the Linux kernel mount namespace handling was fixed. attach_recursive_mnt() transferred the MNT_LOCKED flag from the top mount to a mount moved beneath it, allowing a user namespace owner to unlock and unmount a protected /proc or root mount, exposing hidden data.

In the Linux kernel GPIO exar driver, an initialization ordering bug exists: the allocated ID is stored in exar_gpio only after registering the devm_add_action_or_reset() cleanup action. If registration fails, the cleanup action releases ID 0 instead of the allocated ID, leaking the resource or freeing an ID belonging to another device.

In the Linux kernel drm/vc4 driver, vc4_bo_cache_destroy() purges cached BOs but never frees the size list, leaking memory on every unbind.

In the Linux kernel net/sched em_text, em_text_change() passes an algo array without an enforced NUL terminator to textsearch_prepare(). On the TS_AUTOLOAD retry, request_module() with %s reads past the array, disclosing kernel memory into the modprobe command line. Requires CAP_NET_ADMIN in the target network namespace.

A use-after-free vulnerability was fixed in the Linux kernel AMT driver. IGMP/MLD queries were queued through a qdisc, and a raw tunnel pointer stored in skb->cb could reference a freed tunnel, causing a use-after-free in amt_dev_xmit(). The fix sends the query directly from the receive path, bypassing the qdisc.

In the Linux kernel cxgb4/ch_ktls, the tid_list array is inserted via xa_insert_bh() with softirqs disabled, but chcr_ktls_dev_del() and the chcr_ktls_dev_add() error path use xa_erase() without disabling softirqs. A receive softirq can interrupt the erase and spin on the held lock.

In the Linux kernel nvmet, nvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after both data and metadata SGL allocations succeed. If data allocation succeeds but metadata allocation fails, out_free_sg passes an unassigned req->p2p_dev to pci_p2pmem_free_sgl().

In the Linux kernel, the ASoC adau1372 driver used gpiod_set_value() for the powerdown GPIO, triggering a warning when the GPIO provider can sleep (e.g., I2C expanders). The fix uses the _cansleep variant.

In the Linux kernel, a bug was fixed in flow_dissector where computing key_control->thoff used min_t(u16, ...), truncating skb->len to 16 bits. For packets larger than 64 KB (e.g., GSO, BIG TCP), this caused a bogus small transport header offset even when dissection succeeded.

In the Linux kernel, pfcp_session_recv() read the 8-byte SEID without ensuring it was in the linear area. A short PFCP packet with the S flag set, or one with the session header in a fragment, caused an out-of-bounds read of packet data.

In the Linux kernel, bpf_flow_dissect() clamped offsets returned by the BPF program using clamp_t(u16, ..., hlen). When hlen exceeded 65535, the upper bound was truncated before comparison, potentially forcing nhoff and thoff to zero despite sane values returned by the program.