Linux kernel vulnerabilities

In the Linux kernel, ath9k_wmi_rsp_callback() fails to validate the length of WMI command responses. A device response shorter than expected is read beyond the skb payload, causing an out-of-bounds read.

In the Linux kernel, __hif_usb_tx() in ath9k_htc limits TX aggregation by frame count but not by cumulative byte length. With large frames (MTU 2304), 20 aggregated frames exceed the tx_buf allocation, causing a memcpy() write past the buffer.

A use-after-free vulnerability was found in the Linux kernel's rtc: ac100 driver. When ac100_rtc_probe() fails after registering the RTC-32k clock and the clock provider, these resources are not released, leaving a dangling pointer on the global of_clk_providers list. A later lookup on this device tree node then reads freed memory.

In the Linux kernel, the mpfs RTC driver does not check the return value of devm_clk_get() for an error before passing it to clk_get_rate(). If an error pointer is returned (e.g. -EPROBE_DEFER), clk_get_rate() dereferences it, crashing instead of deferring probe.

In the Linux kernel, minstrel_ht_tx_status() does not validate the rate metadata (MCS, spatial stream count, bandwidth) reported in TX status. Malformed metadata can be used as an out-of-bounds index into the rate tables, causing an out-of-bounds read.

In the Linux kernel, cfg80211_update_assoc_bss_entry() can copy borrowed beacon_ies pointers from a hidden-group entry into an associated entry, giving the same allocation two owners. Releasing the group entry leaves the associated entry pointing to freed IEs, which are freed again (use-after-free / double-free).

In the Linux kernel, ieee80211_lookup_ra_sta() uses sta_info_get_bss() for all AP and AP VLAN frames, not only control port frames. A unicast frame sent on one interface can match a station of a different VLAN of the same BSS and be transmitted to it.

In the Linux kernel, iocb_bio_iopoll() expects a bio, but when IOCB_HAS_METADATA is set, iocb->private holds a uio_meta. Calling bio_poll() on the uio_meta causes an invalid pointer dereference and crash (KASAN: null-ptr-deref).

In the Linux kernel, blk-mq cached requests are allocated for one operation but can be handed out for another. RQF_USE_SCHED is set based on the first operation, causing a request to be inserted into the scheduler without ->prepare_request() and freed without ->finish_request(), leaking the domain token in kyber and stalling the queue.

In the Linux kernel, the Bluetooth btintel module has a DDC record length validation flaw. Records with length 0xFF can wrap during parsing, and records shorter than the mandatory three-byte header or exceeding remaining firmware bytes are not rejected before Intel_Write_DDC is issued.

A deadlock exists in the Linux kernel in the __kfree_rcu_sheaf() function within the mm/slab subsystem. Since kfree_rcu() can be called under pi_lock (a raw spinlock in the scheduler), attempting to wake up kswapd reacquires pi_lock, leading to a deadlock. The issue was confirmed via lockdep detecting a circular locking dependency.

In the Linux kernel, the ASoC (SDCA) subsystem's probe function mishandles pm_runtime errors. The lack of a common error path leaves the runtime PM reference unbalanced.

In the Linux kernel, the BPF subsystem's bpf_jit_blind_insn() can overflow the jump offset (off is s16) when rewriting jump instructions. Values -32767 and -32768 wrap, causing a jump past the end of the program and a kernel crash when bpf_jit_harden=2.

In the Linux kernel, the NVMe driver has a use-after-free in the command effects log for multipath heads. Sending an I/O passthrough command through a multipath namespace head after the controller path that created the head is removed triggers a KASAN slab-use-after-free read.

A use-after-free vulnerability exists in the Linux kernel BPF subsystem. bpf_ma_set_dtor() duplicates the map record but does not hold a reference to the map BTF, so the BTF can be freed when the program that loaded it exits while a worker still uses the duplicated record. This leads to a slab-use-after-free read in btf_is_kernel() and btf_find_struct_meta().

In the Linux kernel's MCTP subsystem (net/mctp), mctp_add_dev() links the new mctp_dev into dev->mctp_ptr before mdev->dev is assigned. A reader that picks up the device in that window dereferences a net_device pointer that is still NULL, causing a null-ptr-deref (detected by KASAN). The fix publishes the object only after it is fully initialised.

In the Linux kernel net/sched (cls_api), a resource leak occurs when two racing tc filter add requests on the same chain/prio both fail. The loser's error path drops only its own reference without reclaiming the empty proto, which stays linked in the chain and holds references to the chain, block, and classifier module. The fix reclaims the proto on the error path, gated on emptiness.

In the Linux kernel, the mac80211 subsystem's ieee80211_monitor_select_queue() validates skb length using skb->len, which includes non-linear fragments. When AF_PACKET sends a large packet, the 802.11 header may extend past the linear buffer, causing a slab-out-of-bounds read.

In the Linux kernel, hci_unregister_dev() disables cmd_work and cmd_timer and then calls hci_cmd_sync_clear(), which waits for the worker draining cmd_sync_work_list. With cmd_work disabled nothing reaches the controller, so each queued HCI command waits the full HCI_CMD_TIMEOUT (2s), and the backlog is unbounded. Closing /dev/vhci can block for backlog * 2s (over 5000 entries reproduced, i.e. hours of hang).

In the Linux kernel, bcm_sysport_get_stats() on SYSTEMPORT Lite skips unsupported statistics, with 'j' tracking the compacted index into the destination buffer while 'i' iterates all elements of bcm_sysport_gstrings_stats. Because the ethtool buffer is sized only by bcm_sysport_get_sset_count(), writing to data[i] instead of data[j] goes past the allocated array bounds, causing memory corruption.

In the Linux kernel, mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event() check for LAG masters (bonding and team) but only call bonding-specific APIs. When processing team device events, calling bond_slave_get_rcu() and bond_is_slave_inactive() on team_port structures causes KASAN to detect an out-of-bounds access since team_port is smaller than bond slave.

In the Linux kernel, the octeontx2-pf driver's BPID assignment under CONFIG_DCB assumed queue_to_pfc_map was always initialized. For SDP VFs this leads to an invalid memory access because the map was not initialized. The patch adds a NULL check for queue_to_pfc_map before dereferencing it.

A vulnerability was found in the Linux kernel's TIPC module involving AES-GCM nonce reuse. When a peer reports a change in its receive key, the nonce counter is reset even though the sender may still use the same TX key and salt, causing nonce reuse. This breaks confidentiality and exposes the GCM authentication key, making packet forgeries trivial.

In the Linux kernel with CONFIG_PAGE_POOL_STATS=y, page_pool_recycle_ring_bulk() updates recycle stats after dropping the producer lock. If it just recycled the last inflight netmems of a pool being destroyed, page_pool_release() can pass its producer-lock barrier and free the pool before recycle_stat_add() runs, causing a use-after-free.

In the Linux kernel, a bug in the stmmac network driver related to RX Scatter-Gather support was fixed. When a received frame was larger than dma_buf_sz, the DMA wrote the overflow to an unmapped secondary buffer address, triggering an SMMU translation fault on IOMMU-based platforms. The fix enables scatter-gather for non-SPH frames on GMAC4/XGMAC cores and corrects buffer length computation and FCS stripping.

A vulnerability was found in the Linux kernel's IPv6 segment routing (seg6) handling. The functions advance_nextseg() and seg6_next_csid_advance_arg() modify the SRH Segments Left field and the IPv6 destination address without first ensuring the packet data is writable. When the skb is cloned (e.g., by an AF_PACKET socket), the write occurs into data shared with the clone, potentially causing a read from that socket to return the modified packet instead of the received one.

A vulnerability in the Linux kernel's handling of the SO_RESERVE_MEM socket option has been fixed. The option was accepted on both TCP and UDP sockets even though the memory reservation mechanism is only supported by TCP, which could corrupt sk_forward_alloc and memcg accounting on UDP sockets. Additionally, the lack of an upper bound allowed values near INT_MAX to overflow 32-bit signed counters.

A use-after-free vulnerability exists in the Linux kernel's BPF trampoline mechanism. When a BPF program is detached from a trampoline, it may be freed while a task preempted in the trampoline just before calling the program can still invoke it, leading to access to freed memory. This affects preemptible kernels.

A vulnerability was fixed in the Linux kernel's BPF trampoline mechanism, where a detached BPF program could be freed while a task was still executing in it. This led to use-after-free and kernel oops on x86, manifesting as an int3 in poisoned bpf_prog_pack memory. The issue occurred when programs attached via trampolines were detached while their hooks were busy.

In the Linux kernel, the bcmgenet driver sets the Rx ring private data and index only when the interface is opened. Setting Rx coalescing parameters on an interface that was never opened (e.g. ethtool -C eth0 rx-usecs 50) dereferences a NULL pointer and causes a kernel oops with RTNL held, leaving networking stuck until reboot.

The Linux kernel mishandles skb->queue_mapping when a packet is redirected between devices with different TX queue counts. The skip_txqueue flag set by skbedit was not confined to the current transmit, so a nested xmit could leave a stale mapping that causes taprio_enqueue() to index past its qdiscs[] array. A local user with CAP_NET_ADMIN in a network namespace can trigger the bug, producing a slab-out-of-bounds under KASAN.

In the Linux kernel, the mtk_eth_soc driver registers MAC netdevs before allocating the internal dummy netdev and shared NAPI. If an interface is brought up during that window (e.g., by netifd immediately after registration), the first-open path dereferences NULL (eth->dummy_dev or napi->dev), causing a warning in net/core/xdp.c and failing with -ENODEV. The fix allocates the dummy netdev and adds the NAPI before the register_netdev() loop and improves error unwinding.

In the Linux kernel, the sparx5 driver returns early from PTP initialization on base lan969x variants lacking the SPX5_FEATURE_PTP flag and when no "ptp" interrupt is described. Unbinding the driver then causes a NULL pointer dereference while cleaning up uninitialized tx_skbs queues.

In the Linux kernel, the IPVS module now filters certain connection flags received by the backup server in the SYNC protocol. The NO_CPORT+TEMPLATE combination and the ONE_PACKET flag are dropped, and IP_VS_CONN_F_BACKUP_MASK is also applied to flags from v0 protocol messages.

In the Linux kernel, bpf_ct_set_nat_info() does not validate the NAT manipulation type, so a wrong value is passed directly to nf_nat_setup_info(), triggering WARN_ON(). If panic_on_warn is not set, IPS_SRC_NAT_DONE is set without adding nat_bysource, and conntrack cleanup tries to unlink an uninitialized hlist node.

In the Linux kernel, the NF_FLOW_HW_PENDING bit was renamed to NF_FLOW_PENDING and used to inhibit the flowtable GC worker until pending hardware offload work completes. The reordering from commit d644b23afe1e was reverted to prevent a race between GC and the hardware offload handler.

In the Linux kernel, the mlx5e driver completes outstanding descriptors without a CQE during XSK TX queue teardown. If a descriptor requested a TX timestamp, the completion path passes a NULL CQE to mlx5e_xsk_fill_timestamp(), which dereferences it.

In the Linux kernel, a race condition exists between perf_event_exit_task() and perf_pending_task() during begin_new_exec(). When perf_event_exit_task() is called and the PF_EXITING flag is not set, perf_sigtrap() continues and triggers WARN_ON_ONCE(event->ctx->task != current).

In the Linux kernel BPF subsystem, a flaw exists in the RCU tasks trace memory freeing mechanism. Objects added to free_by_rcu_ttrace while an RCU grace period is in flight can remain there indefinitely because the call_rcu_ttrace_in_progress flag is cleared too early, and the number of such objects is unbounded.

In the Linux kernel futex subsystem, a use-after-free flaw exists related to private hash resizing. The __futex_pivot_hash() function sets mmph->batches before assigning mmph->hash, allowing futex_ref_drop() to move forward while a reader still holds a pointer to the old hash.

In the Linux kernel BPF subsystem, migration protection is missing in __rhtab_map_lookup_and_delete_batch(). The bpf_mem_cache_free_rcu() call uses this_cpu_ptr() without migration disabled, which under CONFIG_PREEMPT_RCU can trigger a "using smp_processor_id() in preemptible code" bug.

In the Linux kernel drm/amd/display driver, NULL checks are missing when dereferencing dc_sink in dm_dp_mst_is_port_support_mode() and get_conv_frl_bw(). The dc_sink pointer is cleared asynchronously on MST unplug, which can lead to a NULL dereference during a race with teardown.

In the Linux kernel drm/amd/display driver, dm_suspend() does not check whether dc_state_create_copy() returned NULL on allocation failure. As a result, dm_resume() dereferences a NULL cached_dc_state, crashing during GPU reset recovery.

In the Linux kernel drm/amdgpu/gfx6 driver, firmware requested in gfx_v6_0_init_microcode() is not released when the GFX block is torn down, leaking firmware resources (PFP, ME, CE, RLC).

In the Linux kernel drm/mediatek driver, an IS_ERR() check is missing for the ovl_adaptor platform device returned by platform_device_register_data(). An invalid pointer is stored in ddp_comp[].dev and passed further, potentially causing a kernel crash.

In the Linux kernel drm/mediatek driver, the OVL adaptor platform device created by platform_device_register_data() is not unregistered when a later initialization step fails or during normal driver removal, causing a device leak.

In the Linux kernel drm/mediatek driver, mtk_drm_bind() takes a reference on the disp-mutex device via of_find_device_by_node(), but in the non-mmsys-master path it returns early without dropping that reference. mtk_drm_unbind() only puts mutex_dev for the master.

In the Linux kernel drm/amdgpu driver, amdgpu_discovery_sysfs_ips() allocates ip_hw_instance and initializes its embedded kobject before calling kobject_add(). If kobject_add() fails, the return value is ignored, the reference is not dropped, and ip_hw_instance_release() is never called, leaking memory.

In the Linux kernel, acp_hw_init() in the drm/amdgpu driver registers ACP child devices via mfd_add_devices() before attaching them to the ACP power domain and initializing the hardware. If attaching a child to the power domain fails, or if the ACP reset or clock enable times out, the failure path frees only the source cell, resource, and platform-data allocations, leaving the already-registered MFD child platform devices registered and never released.

In the Linux kernel binder, when a TF_UPDATE_TXN transaction supersedes a pending async transaction, binder_release_entire_buffer() is called with is_failure=false. Since the superseded transaction was never delivered, no fds were installed, and the BINDER_TYPE_FDA cleanup handler interprets stale buffer contents as installed fd numbers and passes them to binder_deferred_fd_close(), closing unrelated file descriptors.