Linux kernel vulnerabilities

In the Linux kernel binder, when a TF_UPDATE_TXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree() directly, skipping binder_free_txn_fixups(). This leaks all binder_txn_fd_fixup entries and their fget()'d struct file references.

A use-after-free vulnerability exists in the Linux kernel's binder_add_device function in binderfs. After publishing a new device entry and releasing the parent directory lock, a concurrent unlinkat() can remove the entry and free the device object, which binder_add_device() then writes to, causing a write to freed memory.

In the Linux kernel nitro_enclaves, when ne_create_vm_ioctl() fails the SLOT_ALLOC request after anon_inode_getfile() succeeds, the error path calls fput(enclave_file) and then frees ne_enclave. Since fput() defers the final __fput() via task_work, ne_enclave_release() runs after ne_enclave has been freed and dereferences ne_enclave->slot_uid, causing a use-after-free.

In the Linux kernel rust_binder, deferred work items on the thread todo list are not cleaned up in the Thread::release() method. This can happen if the thread dies while it has an active outgoing transaction, leading to a resource leak.

In the Linux kernel USB cdc-acm driver, acm_port_shutdown() unconditionally calls acm_unpoison_urbs() and, when the ALWAYS_POLL_CTRL quirk is set, immediately re-submits the ctrlurb and all read URBs. If a concurrent acm_disconnect() then frees those URBs and their DMA buffers while in-flight, a use-after-free occurs in acm_ctrl_irq() or acm_read_bulk_callback().

In the Linux kernel USB serial drivers, some multiport device drivers access port driver data from completion handlers of shared URBs submitted at attach() or first open() and stopped at disconnect() or last close(). A simple NULL check does not prevent a race with port tear down, leading to a use-after-free.

In the Linux kernel USB storage sierra_ms driver, sierra_get_swoc_info() requests 60 bytes via usb_control_msg(), but callers only treat a negative return value as failure. A device answering with a short IN transfer leaves the tail of the freshly allocated swoc_info buffer uninitialized, and truinst_show() prints it into the world-readable "truinst" sysfs attribute, disclosing up to 5 bytes of stale kernel heap memory.

In the Linux kernel USB gadget midi2 module, the jack in/out descriptor arrays in struct f_midi2_usb_config have the size of MAX_CABLES, which turned out to be incorrect. Entries are added from both inputs and outputs, so each loop cycle adds two, ending up twice the expected size, potentially resulting in OOB when a large number of jacks are set up via configfs.

In the Linux kernel, generic_set_cmd() and generic_get_cmd() in the USB gadget f_uac1_legacy driver use the low nibble of ctrl->bRequest as an index into the con->data[] array, which has only 5 elements. Index values from 5 to 15 cause an out-of-bounds heap access (up to 44 bytes past the array). A malicious USB host can send a crafted SET_CUR/GET_CUR request, triggering the vulnerability from an IRQ handler.

In the Linux kernel, the USB Type-C anx7411 driver has an issue where the IRQ is devm-managed and can still queue plat->work while remove() is tearing down the workqueue. This leads to a race condition and potential use-after-free.

In the Linux kernel, the USB dwc3 gadget driver's dwc3_check_event_buf() returns IRQ_NONE without writing back to GEVNTCOUNT when the read value exceeds the event buffer length. Since the DWC3 interrupt is level-triggered, the uncleared IRQ source causes an IRQ storm, accumulating unhandled interrupts and triggering a kernel panic (BUG at spurious.c:184).

In the Linux kernel, the USB gadget aspeed-vhub driver does not cancel the wake_work work item in ast_vhub_remove(), leading to a use-after-free after vhub and its ports are freed. Additionally, a remote wakeup request can re-arm the work after cancellation if the registered flag is not cleared.

In the Linux kernel, the USB gadget dummy-hcd driver emulates synchronize_irq() by waiting for the callback_usage counter to drop to 0. However, this counter is not incremented during request completion callbacks, potentially allowing a gadget driver's unbind routine to run before all outstanding request completions have finished.

In the Linux kernel, the f_fs (FunctionFS) driver has a NULL pointer dereference flaw. When user space sets up FunctionFS with only full-speed descriptors (FUNCTIONFS_HAS_FS_DESC) and the gadget operates at a higher speed (HIGH or SUPER), the FUNCTIONFS_ENDPOINT_DESC ioctl selects a descriptor index based on gadget speed that may be NULL, causing an immediate kernel panic.

In the Linux kernel, usb_disable_endpoint() only clears either dev->ep_out[epnum] or dev->ep_in[epnum] for non-zero control endpoints, leaving the opposite direction's array slot pointing to the disabled/freed endpoint. This can lead to use-after-free.

In the Linux kernel, the USB dwc2 driver deletes the wakeup timer only after freeing host state in dwc2_hcd_free(), and timer_delete() does not synchronize a callback or prevent it from being queued again. This can lead to use-after-free.

In the Linux kernel, the USB Type-C TCPM driver was fixed so that a failure to start the FAST_ROLE_SWAP AMS now triggers error recovery and a port reset. Previously, when a faulty cable signaled FRS during disconnection, the TCPC autonomously enabled VBUS sourcing and left it on because the port state was set to INVALID_STATE without a reset. The fix ensures the port transitions to ERROR_RECOVERY and resets properly.

In the Linux kernel, tps6598x_connect() passes a stack-allocated typec_partner_desc to typec_register_partner() after initializing only some fields. This can lead to garbage function pointers being stored and later invoked, as well as leaking stack data through sysfs.

In the Linux kernel, cd321x_update_work() passed a stack-allocated typec_partner_desc to typec_register_partner() while initializing only usb_pd, accessory and identity. The remaining fields, including the attach and deattach function pointers plus pd_revision and usb_capability, were left uninitialized, potentially causing garbage function pointers to be invoked or leaking stack data through sysfs.

In the Linux kernel, the pmic_glink client is released by devres cleanup after pmic_glink_ucsi_remove() returns, so its notification callbacks can queue work until then. Work running after ucsi_unregister() touches freed state (the connector array) or registers/unregisters the instance a second time, causing a use-after-free.

In the Linux kernel, cdns3_gadget_start() arms two works (pending_status_wq and aligned_buf_wq) on system_freezable_wq whose handlers use the embedded cdns3_device. cdns3_gadget_exit() does not wait for these works and frees endpoints, buffers and private device data, so a queued work can run after the free, causing a use-after-free.

In the Linux kernel, the Cadence USBSS controller is a two-function PCI device. When the second function is probed while the first has been enabled but has not yet set its driver data, pci_get_drvdata() returns NULL and the subsequent wrap->devfn assignment dereferences a NULL pointer, crashing the kernel.

In the Linux kernel, the stack-allocated struct vio_vcc pkt in vcc_send_ctl() was only partially initialized, leaving the tag.stype_env field uninitialized before being sent via ldc_write(). This can leak kernel stack data to the LDC peer.

In the Linux kernel, vcc_cleanup() sets port->tty to NULL without holding port->lock, racing with vcc_event() LDC callbacks that read port->tty under port->lock and then use tty->port. This can cause a use-after-free when the callback dereferences tty->port after cleanup has already destroyed and freed it.

In the Linux kernel, the tty_port layer fails to restore the TTY_IO_ERROR flag when port activation fails. This can lead to I/O attempts on a port that is gone or powered down, causing kernel panics from unclocked accesses or NULL-pointer dereferences when a TTY ioctl races with hangup and open.

In the Linux kernel, tty_port_tty_vhangup() may return before the port has actually been shut down if it races with another hangup. The missing serialization between tty_port_tty_vhangup() and tty_port_hangup() leads to use-after-free and NULL-pointer dereferences in racing ioctls and in processing of asynchronous hangups (carrier loss).

In the Linux kernel, break ioctls (TCSBRK and TCSBRKP) can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. After a user-controlled timeout, the driver may be called even after the tty has been reopened.

In the Linux kernel, resetting saved termios state on device registration can cause a use-after-free when closing a TTY (and saving its termios) races with re-registration. The issue affects drivers that do not guarantee the minor number is no longer in use.

In the Linux kernel, the max3100 serial driver's max3100_shutdown() stops the polling timer but returns early during system suspend. If the SPI device is unbound before resume, max3100_remove() frees the port while the timer remains armed, leading to a use-after-free in max3100_timeout(). The fix adds final timer teardown in max3100_remove() using timer_shutdown_sync(), and frees the IRQ and destroys the workqueue before freeing the port.

In the Linux kernel, the serial: 8250_bcm7271 driver has a use-after-free in brcmuart_remove(). brcmuart_remove() cancels the hrtimer before unregistering the port, so a receive-timeout interrupt arriving in between re-arms the timer. After devm frees priv, the callback runs on freed memory.

In the Linux kernel, serial_core_unregister_port() passes port->port_dev to serial_core_get_ctrl_dev(), which dereferences it. When port->port_dev is NULL (no port device installed or registration failed before serial_core_port_device_add()), a NULL pointer dereference occurs.

In the Linux kernel, the serial: ma35d1 driver has a clock reference leak in ma35d1serial_probe(). of_clk_get() returns a clock with a reference that must be released with clk_put(), but ma35d1serial_probe() never does that, so the reference is leaked on probe error paths and when the port is removed.

In the Linux kernel on arm64, restore_sve_fpsimd_context() fails to reject an SVE signal context where SVE_SIG_FLAG_SM is clear and an SVE payload is present on SME-only systems (without SVE support). This allows a task to be placed in a non-streaming SVE state even though the hardware does not support it, potentially leading to EL1 UNDEF errors and a kernel panic.

In the Linux kernel, in the ASoC codec max98363, stream_config is not initialized before being passed to sdw_stream_add_slave(). The type field may contain garbage and is later copied to stream->type by sdw_config_stream().

In the Linux kernel, the ASoC rt1017-sdca-sdw codec driver did not initialize stream_config before passing it to sdw_stream_add_slave(). The type field could contain garbage and was later copied to stream->type by sdw_config_stream().

In the Linux kernel ALSA seq subsystem, the translated port-info compat ioctl path invoked handlers through snd_seq_kernel_client_ctl() without taking client->ioctl_mutex, unlike the native ioctl path. This allowed concurrent compat CREATE_PORT requests to bypass the port-count check, potentially wrapping the port index and accessing a freed subscriber.

In the Linux kernel EDAC/altera driver, the a10 ECC setup callbacks and their helpers were marked __init even though they run from the probe path, which may execute after __init memory is freed. This caused dereferences of freed memory on deferred probe (-EPROBE_DEFER) or manual unbind/rebind.

A race condition exists in the Linux kernel's Bluetooth RFCOMM implementation regarding the initial TTY port reference. Both the install and release paths can drop the same reference, leading to a use-after-free. The issue affects RFCOMM_RELEASE_ONHUP devices and was confirmed by KASAN.

A use-after-free vulnerability exists in the Linux kernel's Bluetooth SMP build_pairing_cmd() function. It reads remote OOB data without holding hdev->lock, allowing a concurrent Remove Remote OOB Data command to free the entry before SMP reads it. The fix introduces a dedicated per-device remote_oob_lock.

A use-after-free vulnerability exists in the Linux kernel Bluetooth hci_sync subsystem. The sync command worker reads inquiry cache entries without holding the proper lock, allowing a concurrent HCIINQUIRY ioctl to flush the cache and free the entry, leading to access of freed memory.

A use-after-free vulnerability exists in the Linux kernel's hci_enhanced_setup_sync() function during enhanced SCO setup for Bluetooth connections. The function dereferences conn->parent without holding hci_dev_lock, allowing a concurrent receive workqueue to free the ACL parent object before it is read. The fix holds hci_dev_lock across the codec switch.

A use-after-free vulnerability exists in the Linux kernel Bluetooth subsystem. hci_chan_sent() selects a channel under RCU but drops the read lock before accessing chan->conn, so a concurrent channel deletion (e.g., triggered by a disconnect command timeout) can free the channel memory before the TX scheduler finishes using it.

A use-after-free vulnerability exists in the Linux kernel Bluetooth subsystem. hci_low_sent() selects a connection under RCU but drops the read lock before using the pointer, so hci_sched_iso() and hci_sched_sco() can access a connection already freed by hci_abort_conn_sync(). The fix holds hci_dev_lock() across connection selection and transmission.

In the Linux kernel, the fragmented path in hci_queue_iso() calls __skb_queue_tail() without holding conn->data_q.lock. The transmit worker can concurrently dequeue packets via skb_dequeue(), leading to a use-after-free or queue corruption.

In the Linux kernel's btintel driver, the "Exception info %s" print in btintel_hw_error() uses skb->data + 1, but the 12-byte payload is not guaranteed to be NUL-terminated, allowing a read past its end.

In the Linux kernel's btintel_pcie_recv_frame(), plen is u16 and computed as HDR_SIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the "skb->len < plen" check and letting skb_trim() truncate the packet.

In the Linux kernel's btintel_pcie_send_frame(), skb->data is copied into a fixed BTINTEL_PCIE_BUFFER_SIZE (4096) DMA buffer via memcpy() in btintel_pcie_prepare_tx(), with a 4-byte PCIe type header prepended. A user-space process with HCI_CHANNEL_USER access can inject an oversized packet and overflow the buffer.

In the Linux kernel, get_align_mask() returns huge_page_mask_align() for hugetlbfs, but get_align_bits() adds va_align.bits regardless, so vm_unmapped_area() returns an address off the huge page boundary and __unmap_hugepage_range() hits BUG_ON(start & ~huge_page_mask(h)) at teardown.

In the Linux kernel's tpm2_get_random(), when the response carries the TPM2_ST_SESSIONS tag, the function skips the 4-byte parameter size field before locating the random data, but the bounds check still validates the response length against TPM_HEADER_SIZE. A truncated response can pass the check and make memcpy() read up to 4 bytes past the response end.

In the Linux kernel's nvme-multipath subsystem, the namespace head is marked zoned at allocation time based only on the command set identifier. If the zone info query reports a zero zone size, the path namespace is registered without zoned limits while the head still advertises the zoned capability with a zone size of zero, leading to a shift by ilog2(0).