Linux kernel vulnerabilities

In the Linux kernel HID steam driver, a narrow window existed during teardown where callbacks could still be scheduled and then reference the freed steam struct (dangling pointer). The fix rearranges the teardown sequence and moves rumble and mode switch work cancellation into steam_unregister.

In the Linux kernel HID steam driver, the registration/unregistration flow was simplified, replacing the serial number assumption with a boolean flag. A bug was also fixed where a battery was not unregistered if later registration steps failed, leaving a power_supply object after the steam object was torn down.

In the Linux kernel, a race condition in sched_ext cid table publication was fixed. The cid tables were visible to cid kfuncs while being modified, allowing concurrent TRACING or SYSCALL programs to read uninitialized memory or torn topology updates.

In the Linux kernel, ext4 fails to disable large folios on encrypted inodes when the encrypt feature is enabled on a mounted filesystem, bypassing the mount-time check. Writing encrypted data then triggers a kernel NULL pointer dereference crash. This affects kernels between v6.19 and v7.2.

In the Linux kernel, the ASoC qcom lpass-cpu driver uses the DAI ID to index variant->dai_driver when configuring a DAI with LPAIF_I2SCTL_MODE_QUAD01. On platforms where DAI IDs are sparse (e.g., IPQ806x MI2S with ID 4), this writes beyond the table entry instead of updating the correct DAI.

In the Linux kernel perf/core subsystem, perf_event_open() gates perf_allow_kernel() only on !attr.exclude_kernel. Users can still request kernel callchain collection with attr.exclude_callchain_kernel == 0 even when attr.exclude_kernel == 1, and this is not enforced.

In the Linux kernel ath11k Wi-Fi driver, ar->num_stations is not reset in ath11k_mac_op_start() during hardware restart. This prevents accepting new stations or mesh peers because the counter remains inflated.

In the Linux kernel, struct rtc_wkalrm has padding holes after the 'pending' member. When returned to userspace via the RTC_WKALRM_RD ioctl, uninitialized kernel stack data may be leaked.

A vulnerability was fixed in the Linux kernel's seg6_make_flowlabel() (IPv6 Segment Routing), which called skb_get_hash() without the required net pointer. When a packet had neither skb->dev nor skb->sk set (e.g., a TIPC UDP bearer discovery message using seg6 encapsulation with net.ipv6.seg6_flowlabel enabled), a warning and failure occurred in __skb_flow_dissect(). The fix uses skb_get_hash_net() with the already available net pointer.

In the Linux kernel, a fix addresses an AMD platform issue triggered by holding a USB3 hub PM runtime reference for 200ms during resume. The hold time for USB3 root hubs is reduced to 120ms, while external hubs keep the 200ms hold.

In the Linux kernel, a use-after-free in the EDAC/altera driver's error paths was fixed. The dci structure was freed before releasing the devres group, allowing an IRQ to dereference freed memory.

In the Linux kernel, a NULL pointer dereference in the MTD/spinand subsystem was fixed. When 'nand-no-ecc-engine' is set in DT, nand->ecc.engine remains NULL, but SPI-NAND code dereferenced it unconditionally, causing an oops during probe.

In the Linux kernel, KVM on arm64 (nv) fixed the life cycle of the nested_mmus array. The array holding shadow page tables could be relocated during VCPU_INIT while another vCPU was running, leaving a dangling pointer to freed memory.

In the Linux kernel, the drm/amd/display driver fixed usage of stream->sink in DPMS sequences without NULL checks. Since stream->sink is optional, this could lead to NULL dereference; it was replaced with stream->link and assertions were added.

In the Linux kernel on parisc, the default kernel stack size (THREAD_SIZE_ORDER) was increased to 32 kB for 64-bit kernels to avoid kernel panics caused by stack overflow, observed for example when building the debian vtk9 package with gcc 17.

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: check link is beaconing for color change. When trying to do a color change, validate that the link is beaconing first, to avoid calling the driver with an invalid link.

In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: use vb2_video_unregister_device on driver removal. The driver uses vb2_fop_release() as its file release operation, so vb2_video_unregister_device() should be used instead of video_unregister_device() during driver removal. This ensures that the vb2 queue is properly disconnected before the video device is unregistered.

In the Linux kernel, the drm/amdgpu driver lacked a limit on ATOM command table nesting depth. A cap of 32 levels with an execute_depth counter and returning -ELOOP when exceeded was added.

In the Linux kernel, the net: thunderx driver's cavium_ptp_get() acquires a reference to the PTP PCI device, but if initialization fails afterward the reference is leaked. A common error path was added to release the PTP reference before returning from probe failures.

In the Linux kernel, the ALSA seq oss snd_seq_oss_read() function had an inverted check for whether the next event fits in the userspace buffer. This caused valid events not to be copied or events larger than the read buffer to be copied.

In the Linux kernel, the dpaa2-switch driver's error path in dpaa2_switch_rx() incorrectly called dpaa2_switch_free_fd(), which is intended for Tx frame descriptors and expects an skb pointer. The fix moves dma_unmap_page() into dpaa2_switch_rx() and uses free_pages() or kfree_skb() depending on the error stage.

In the Linux kernel, the drm/amdkfd kfd_dbg_trap_enable() function did not unwind trap activation, debug_trap_enabled, an extra process reference, or the opened debug event file on copy_to_user failure. The fix deactivates the trap and undoes the rest of the enable setup before returning the error.

In the Linux kernel, the net: cpsw_new driver's cpsw_probe() registers devlink before registering CPSW ports. If cpsw_register_ports() fails, the error path does not unregister devlink, leaving its instance and parameters registered after a failed probe.

In the Linux kernel, the net: microchip: sparx5 driver's sparx5_tc_flower_psfp_setup() allocates PSFP resources before adding VCAP actions and does not unwind them on later failure. Error paths were added to release the stream filter, flow meter, and stream gate, and the flow-meter id return was corrected.

In the Linux kernel, the btrfs sb_write_pointer() function reads the superblock from the block device page cache via read_cache_page_gfp() without protection against block size changes. The fix takes the mapping invalidate lock around the read to serialize it against block size changes.

In the Linux kernel, the net: lan966x driver's lan966x_fdma_reload() did not restore rx->page_order and rx->max_mtu or the per-port XDP RXQ page pool registration when RX resource allocation for a new MTU failed. The fix saves and restores these fields and the old page pool registration before restarting RX.

In the Linux kernel, the drm/amdkfd set_queue_properties_from_criu() function did not call kfd_queue_acquire_buffers() after that function was split off from set_queue_properties_from_user(), so queue_properties buffer fields were not filled. The fix adds the proper call and correct cast types.

In the Linux kernel, the imx mailbox driver has a power management (pm_runtime) initialization and teardown ordering issue. Calling pm_runtime_enable() early before probe completes can lead to using the device in an incomplete state. The fix moves pm_runtime handling to devm and reorders mailbox controller registration.

In the Linux kernel, the imx mailbox driver has a race between interrupt handling (imx_mu_isr) and channel shutdown (imx_mu_shutdown). In a short window, the RX event may be re-enabled by the ISR after being disabled in shutdown, which on shared interrupt handlers can lead to a "nobody cared" message. The fix adds a shutdown field to signal channel teardown and serializes access with a lock.

In the Linux kernel, the md/raid5 subsystem compares the 32-bit bm_seq sequence counter in stripe batches without overflow safety. After the counter wraps, a newer value can appear smaller than an older one. The fix introduces a wrap-safe comparison.

In the Linux kernel, the ksmbd server has a flaw in lease break and acknowledgment state handling. When breaking level-II/read leases for writes and truncates, valid states containing WRITE_CACHING are skipped. The fix applies the acknowledged state directly and keeps the break pending on failed ACKs.

In the Linux kernel, the xen/gntalloc module's gntalloc_ioctl_alloc() allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above the limit cannot succeed, so the fix rejects them before calling kcalloc(). It also adds a subtraction-based check under gref_mutex and casts the count before page-size multiplication.

In the Linux kernel, the netfilter ipset subsystem does not properly mark RCU-locked areas. After incrementing the uref counter, there is no need to hold the RCU lock because the referenced hash table cannot disappear. The fix corrects RCU lock and spinlock usage in mtype_gc.

In the Linux kernel, the drm/amd/pm/si driver does not initialize the thermal work queue when DPM is disabled via the amdgpu.dpm=0 module parameter. Nevertheless, it attempts to schedule work on that queue. The fix prevents scheduling thermal work when the queue is not initialized.

In the Linux kernel, the ksmbd server's __smb_break_all_levII_oplock() waits for a lease break acknowledgment while holding ci->m_lock for read. A cifs.ko client reacts to a handle lease break by closing the deferred handle, which requires the lock for write and blocks, causing a wait of up to 35 seconds. The fix collects opinfos under the lock and then breaks them after releasing it, using references.

In the Linux kernel, the thunderbolt subsystem processes hotplug events in a workqueue that may run after the domain has been removed by tb_domain_remove(). This can lead to a use-after-free (UAF) when the driver is unloaded while a device is being plugged in. The fix takes a domain reference before scheduling the hotplug handler.

In the Linux kernel, the net/mlx5 HWS driver has an issue when destroying a table that has a miss table created by mlx5hws_table_set_default_miss. The miss table keeps the table pointing to it in a list. When such a table is deleted, it is not removed from the miss table list, leaving a node with garbage data.

In the Linux kernel, the drm/amd/ras CPER ring overflow handling trusts the parsed entry size from the current ring contents. Corrupt CPER data can produce an entry size that does not advance the read pointer, causing the recovery loop to spin while holding the CPER ring mutex and hang the worker writing the next CPER record. The fix detects a no-progress rptr update and resets the CPER ring to an empty state.

In the Linux kernel, the arm_scmi SENSOR_UPDATE notification parser derived the expected reading count from the sensor description but did not verify that the received payload contained those entries before parsing them. Truncated update notifications could therefore be parsed past the end of the payload. The fix rejects truncated notifications before reading the variable array.

In the Linux kernel, the arm_scmi BASE_ERROR_EVENT notification parser used the report count encoded in error_status without checking whether the received payload contained all reported entries. Truncated payloads could therefore be copied past the end of the buffer. The fix rejects truncated payloads before copying the report array.

In the Linux kernel, the wifi mac80211 function ieee80211_rx_mgmt_deauth() read the deauth reason code before checking that the fixed field was actually present in the received frame. The fix validates the deauth frame length first and only then reads the reason code.

In the Linux kernel, the wifi libertas driver's lbs_hard_start_xmit() in monitor mode cast skb->data to a radiotap TX header, skipped that header, and copied the 802.11 destination address from offset 4 without checking the minimum frame length. The generic length check only rejected zero-length and oversized skbs, so a short monitor frame could be read past the end of the skb data. The fix requires enough bytes for the radiotap TX header and the destination address field.

In the Linux kernel, the wifi iwlwifi mvm scheduled scan built the probe request before iwl_mvm_scan_fits(), so oversized IEs could be copied into the fixed preq buffer before length validation. The fix moves iwl_mvm_build_scan_probe() after the fits check and advertises max_sched_scan_ie_len using iwl_mvm_max_scan_ie_len() so userspace limits account for driver-inserted DS/TPC bytes.

In the Linux kernel on arm64, a vulnerability exists in kprobes handling during single-stepping. A kprobe hit in KPROBE_HIT_SS state was incorrectly treated as unrecoverable, potentially losing interrupt state and leaving interrupts permanently disabled. The fix allows safe reentry in this state and saves/restores saved_irqflag in struct prev_kprobe.

In the Linux kernel, the wifi mac80211_hwsim function hwsim_tx_info_frame_received_nl() cast the HWSIM_ATTR_TX_INFO payload to a struct hwsim_tx_rate * and unconditionally read IEEE80211_TX_MAX_RATES entries (8 bytes) from it. The policy only bounded the attribute from above and the op set GENL_DONT_VALIDATE_STRICT, so a short or zero-length attribute was accepted and the loop read past the payload. The fix requires the exact length in the policy so a malformed attribute is rejected before the handler runs.

In the Linux kernel, the drm/gma500 xfer_read() waited for the HDMI I2C transaction to reach I2C_TRANSACTION_DONE but ignored both timeout and signal returns from wait_for_completion_interruptible_timeout(). If the interrupt never advanced the transaction state, the loop could wait forever. The fix returns -ETIMEDOUT when the completion wait expires, propagates interrupted waits, and makes the I2C master_xfer callback return the first transfer error instead of reporting a successful message count.

A bug was fixed in the Linux kernel's IMA (Integrity Measurement Architecture) subsystem that attempted to change file extended attributes (xattr) on a read-only filesystem during early boot. On ext4 this triggered a journaling transaction and a kernel warning. The fix detects the file state early and returns an error instead of attempting the disallowed operation.

In the Linux kernel MMC core, validation for the host-provided max_segs field was missing. If a host driver sets an excessively large value, the unsigned short field may be truncated to zero, causing kmalloc(0) to return ZERO_SIZE_PTR, which then leads to invalid memory access in sg_init_table() and a kernel crash (Oops).

In the Linux kernel, the 8250 serial port driver did not recognize the UPIO_AU (type 4) UART type, causing a warning and unsupported UART type during probe on MIPS Alchemy systems. The fix adds recognition of UPIO_AU in set_io_from_upio() without further action, since parameters are already set up in au_platform_setup().

In the Linux kernel, the chips-media wave5 media driver did not range-check dec_output_info data, which could lead to an out-of-bounds write (buffer overflow of inst->frame_buf). The fix adds a range check for that data.