Linux kernel vulnerabilities

In the Linux kernel, the iio: gyro: adis16136 driver has unprotected debugfs reads. The serial_number file operations are open coded and never call debugfs_file_get(), which debugfs_create_file_unsafe() requires. As a result, debugfs_remove_recursive() does not wait for a read in progress, and unbind frees the iio_dev underneath it. debugfs_create_file() should be used instead.

In the Linux kernel, the iio: health: max30102 driver has a NULL dereference in the interrupt handler. The interrupt is requested in max30102_probe() and stays enabled for the lifetime of the device, but indio_dev->active_scan_mask is only valid while a buffer is enabled. When an interrupt arrives while no buffer is enabled, the handler dereferences the NULL active_scan_mask, causing a kernel crash. max30102_fifo_count() should be called at the top of the handler and return early unless it reports a FIFO sample is ready.

In the Linux kernel, the iio: imu: adis16400 driver has unprotected debugfs reads. The adis16400_serial_number_fops structure is open coded and never calls debugfs_file_get(), so debugfs_remove_recursive() does not wait for a read in progress and unbind frees the iio_dev underneath it. A previous change converted product_id and flash_count to DEFINE_DEBUGFS_ATTRIBUTE but moved all three files to debugfs_create_file_unsafe(). The serial_number file prints three registers and cannot be converted without changing what the file returns. debugfs_create_file() should be used.

In the Linux kernel, the iio: imu: adis16480 driver uses open-coded debugfs file operations for firmware_revision and firmware_date that never call debugfs_file_get(), which debugfs_create_file_unsafe() requires. As a result, debugfs_remove_recursive() does not wait for an in-progress read, and unbind frees the iio_dev underneath it.

In the Linux kernel, the iio: light: gp2ap020a00f driver queues work via irq_work_queue(), but free_irq() does not flush an already queued irq_work. After gp2ap020a00f_remove() returns, that work may still run and call iio_trigger_poll() on data->trig, which devm cleanup has already freed, causing a use-after-free.

In the Linux kernel, the iio: light: rohm-bu27034 driver uses an error code to compute the sleep time when reading the integration time fails, which can lead to an infinite delay.

In the Linux kernel, the iio: pressure: bmp280 driver has an out-of-bounds access in sampling frequency lookup. bmp280_write_sampling_frequency() indexes the flattened table as a two-dimensional array and uses num_sampling_freq_avail as the number of rows, leading to incorrect indexing.

In the Linux kernel, the iio: pressure: rohm-bm1390 driver ignores the cached error value and unconditionally returns 0. After stopping the measurement, it should return the cached 'ret' value so the user knows the read failed and the data is garbage.

In the Linux kernel, the iio: proximity: aw96103 driver's firmware parser reads a length from the binary header and uses it to walk six-byte register/value entries. A truncated firmware image can make the parser read beyond the copied firmware buffer, and a value smaller than the four-byte count field underflows, producing a very large length.

In the Linux kernel, in the iio: proximity: pulsedlight driver, when pm_runtime_set_active() fails in probe(), execution jumps to error_unreg_buffer which only calls iio_triggered_buffer_cleanup() and does not unregister the already-registered iio device. As a result, devm frees indio_dev but the iio core still has it registered, leaving sysfs/chardev nodes pointing at freed memory.

In the Linux kernel, iio_trigger_notify_done_atomic() defers ->reenable() into trig->reenable_work on the system workqueue, and the worker dereferences the owning trigger via container_of(). Since nothing cancels this work before iio_trig_release() frees the trigger, a worker armed by the last in-flight IRQ can outlive the free and touch freed memory.

In the Linux kernel, perf events with exclude_kernel=1 can be opened without kernel perf access, but exclude_kernel does not suppress text-poke sideband records. Every PERF_RECORD_TEXT_POKE is marked PERF_RECORD_MISC_KERNEL and contains a raw kernel instruction address, allowing an unprivileged task to reveal the runtime kernel text base despite KASLR.

In the Linux kernel, in KVM: s390, under some circumstances the page of nested guest memory being shadowed may not be present at all in the parent guest gmap. dat_entry_walk() will not find any leaf entry and return -ENOENT, which is erroneously propagated all the way to userspace.

In the Linux kernel, in KVM: s390, kvm_s390_set_irq_state() performs the Store status operation without the required kvm->srcu or slots lock, unlike kvm_s390_inject_vcpu(). This missing synchronization can lead to concurrency issues.

In the Linux kernel, in KVM: s390, dat_cond_set_storage_key() may receive NULL as oldkey from some callers. Calling page_cond_set_storage_key() will then dereference that NULL pointer.

In the Linux kernel, in KVM: s390 there is a race window between dat_entry_walk() and large_crste_to_phys() in dat_cond_set_storage_key() and dat_set_storage_key(): a large page could be split concurrently and large_crste_to_phys() might be called with a crste that does not designate a large page, leading to crashes. Similar issues were present in dat_get_storage_key() and dat_reset_reference_bit().

In the Linux kernel, in KVM: s390, _destroy_pages_crste() reads the crste without protection against multiple pointer dereferences, which can lead to a race.

In the Linux kernel, in s390/uv, when the system has more than 85 secrets, the uv_secret_list struct array only holds up to 85 items per page, resulting in an out-of-bounds read in find_secret_in_page if the targeted secret is in the next page or not stored at all.

In the Linux kernel, btf_struct_walk() contains a divide-by-zero bug. When an access goes past a struct whose last member is a flexible array and the element type has zero size (e.g. an empty struct), a divide-by-zero occurs at BPF program load time. This requires a PTR_TO_BTF_ID that is not MEM_ALLOC, such as a plain read of a local kptr stashed in a map from a sleepable program.

A bug in the Linux kernel's inet_csk_listen_stop() function causes cond_resched() to be called under BPF context (inside rcu_read_lock). When bpf_sock_destroy() destroys a listener socket that still has children in its accept queue, it triggers an invalid sleep and a kernel warning. The listener path was missed by the earlier has_current_bpf_ctx() guard.

In the Linux kernel, the HID winwing driver has a use-after-free in force feedback teardown. winwing_init_ff() passes driver private data allocated with devm_kzalloc() as the effect context to input_ff_create_memless(), and the force feedback core frees that pointer with kfree(), which is an invalid free leading to a double free and slab corruption. This triggers on unbind, rmmod, hot-unplug, and system suspend.

A vulnerability was fixed in the Linux kernel's __htab_map_lookup_and_delete_batch() function for BPF hash maps. The function lacked a rescheduling point, so a single BPF_MAP_LOOKUP_BATCH call could walk the entire map without yielding the CPU, causing soft lockups and holding a CPU for over 77 seconds on large maps (e.g., 16 million buckets).

A vulnerability was fixed in the Linux kernel in BPF sock_ops programs that read the rtt_min field. On the tcp_conn_request() path, sock_ops->sk points to a request_sock (non-full socket), but the code casts it to a tcp_sock and reads rtt_min past the end of the structure, exposing adjacent kernel memory.

A use-after-free (UAF) vulnerability exists in the Linux kernel's BPF memory allocator (alloc_bulk). It is caused by a lack of synchronization between concurrent consumption of ttrace lists (waiting_for_gp_ttrace and free_by_rcu_ttrace) and RCU Tasks Trace callbacks freeing memory. The fix introduces a raw spinlock to synchronize access to these lists.

A flaw was found in the Linux kernel on arm64 in BPF exception callback handling. The callback prologue failed to set the frame pointer (BPF_REG_FP), so register x25 retained the value from the subprogram that invoked bpf_throw(). As a result, a helper could receive a local variable address pointing into a dead stack frame and overwrite its own return address, causing a kernel panic.

In the Linux kernel, the amd_sfh driver maps PCI BAR 2 and accesses MMIO registers at offsets up to 0x10958 without first validating that the BAR size is large enough. If the driver is bound to a device with a smaller BAR 2, this leads to an out-of-bounds memory access and a page fault during the probe function.

In the Linux kernel, KVM for RISC-V has an incorrect NACL hfence entry update order. __kvm_riscv_nacl_hfence() writes the Config word before the Page_Number and Page_Count words, violating SBI v3.0 specification requirements and potentially allowing a pending entry to be observed with stale pnum/pcount values, resulting in incorrect TLB flush ranges.

In the Linux kernel, KVM for arm64, pkvm_vcpu_init_sve() clamps only the upper bound of the host-provided sve_max_vl, so an invalid vector length reaches sve_state_size_from_vl() and triggers the WARN_ON() there, which is fatal at EL2. The existing !sve_state_size test rejects such a length, but only after the macro has run.

In the Linux kernel, pkvm_vcpu_init_sve() clears KVM_ARM_VCPU_SVE on failure but leaves KVM_ARCH_FLAG_GUEST_HAS_SVE set. Subsequent vCPUs on that VM then skip SVE setup and register with a NULL sve_state, causing a fault on the guest's first FP access.

In the Linux kernel's squashfs, a missing dictionary size range check allows a shift-out-of-bounds when mounting an abnormal image (COMP_OPTS flag set but dictionary size 0). The bug occurs in squashfs_xz_comp_opts() where the shift exponent is -1.

In the Linux kernel block subsystem, blk_revalidate_disk_zones() sizes the zones_cond array from disk capacity and zone size, but the index used by blk_revalidate_zone_cond() comes from the device-driven report_zones() walk and is never checked against the array size. A device reporting more zones than fit the array causes an out-of-bounds write in blk_zone_set_cond().

In the Linux kernel SCSI subsystem, sd_zbc_read_zones() computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nr_zones field of struct zoned_disk_info, silently truncating counts exceeding 32 bits. Additionally, sd_zbc_report_zones() counts zones with a signed int zone_idx, which overflows past INT_MAX.

In the Linux kernel Bluetooth btnxpuart driver, when CONFIG_DEV_COREDUMP=n, hci_devcd_append() returns -EOPNOTSUPP without freeing its skb argument, leaking the cloned skb and preventing nxp_set_ind_reset() from performing recovery.

In the Linux kernel Bluetooth mgmt subsystem, send_cancel() removes pending mesh_tx objects from hdev->mesh_pending and frees them via mesh_send_complete(), but if a mesh transmission was already queued via mesh_next(), the queued entry retains a raw pointer to mesh_tx. Later processing by hci_cmd_sync_work causes a use-after-free.

In the Linux kernel XDP socket subsystem, xsk_map_gen_lookup() loads a u32 key and compares it with max_entries using BPF_JMP_IMM. BPF immediates are sign-extended to 64 bits, so a max_entries value of 0x80000000 or higher becomes a threshold larger than every zero-extended 32-bit key, allowing an out-of-range index to skip the bounds check and read past xsk_map[].

In the Linux kernel Ethernet fbnic driver, the payload page pool pointer contains an error pointer when its allocation fails. The cleanup path passes that error pointer to page_pool_destroy() instead of destroying the header page pool, which can dereference the error pointer and leave the header page pool allocated.

In the Linux kernel BPF verifier, after do_check() returns, instruction rewrite passes patch or remove one instruction at a time, making the work quadratic in program length. A privileged loader can submit 131072 unconditional jumps by zero, causing bpf_opt_remove_nops() to spend a long time, and since this work neither checks for signals nor reschedules, a pending SIGKILL cannot terminate the task.

In the Linux kernel, regsafe() in the BPF subsystem did not preserve the displacement between registers sharing the same packet pointer ID. Because packet range is shared by ID, a bounds check on one class member updates every member, which can license an out-of-bounds packet access on the pruned path.

In the Linux kernel, bpf_core_patch_insn() poisoned the CO-RE relocation target before checking whether the instruction was a valid relocation target. Malformed metadata could therefore replace jumps, calls, exits, register-source arithmetic, or non-immediate loads instead of failing at the relocation step.

In the Linux kernel netfilter flowtable, flow_offload_work_del() set NF_FLOW_HW_DEAD before the work handler cleared NF_FLOW_HW_PENDING. A concurrent garbage collection pass could free the flow via RCU before the worker finished, resulting in a use-after-free.

In the Linux kernel nfnetlink_queue module, the release notifier and the config netlink function were not serialized. A concurrent close() could call the release function while another thread processed an UNBIND request for the same portid, causing a general protection fault in __instance_destroy.

In the Linux kernel drm/nouveau/clk driver, nvkm_clk_ustate_update() used the pstate pointer after list_for_each_entry() exited without a break, making it invalid. The flaw is reachable from userspace via the 'pstate' debugfs file and causes an out-of-bounds read.

In the Linux kernel net/sched act_ct module, flow_offload_alloc() returns NULL when the conntrack entry is dying or when GFP_ATOMIC allocation fails, both expected under load. This path issued a WARN, so with panic_on_warn=1 an unprivileged user could panic the box by racing a conntrack flush against a 'tc ... action ct commit' classifier.

In the Linux kernel GUE handling, gue_remcsum() passed absolute checksum start and field offsets to skb_remcsum_process(), where offset < start underflowed the u16 skb->csum_offset variable. A forwarded packet could retain CHECKSUM_PARTIAL and reach a NETIF_F_HW_CSUM driver, causing skb_copy_and_csum_dev() to write two bytes about 64 KiB beyond the destination buffer.

In the Linux kernel mtk_eth_soc driver, when register_netdev() failed for one of the MTK_MAX_DEVS devices in mtk_probe(), the error path skipped mtk_unreg_dev(). Previously registered net_devices were then freed by mtk_free_dev() while still in NETREG_REGISTERED state, hitting BUG_ON.

A Linux kernel vulnerability was fixed in the ethtool subsystem where an offline self test (ETHTOOL_TEST) could bring the network interface down and up without holding the required rtnl_lock. This affected drivers fbnic and bnxt that are ops-locked and only hold the netdev instance lock. The missing rtnl_lock triggered lockdep warnings and ASSERT_RTNL() violations.

In the Linux kernel fbnic driver, the standalone channel allocation path excluded FBNIC_MAX_TXQS from the layout, using one NAPI vector per Tx and Rx queue. A 64-Tx/64-Rx configuration recorded 128 vectors but allocated only 64, leaving NULL entries dereferenced during resource setup.

A bug was fixed in the Linux kernel's fbnic Ethernet driver related to selecting the NAPI vector for an Rx queue. The code used an index modulo the number of NAPI vectors, which incorrectly assigned Tx NAPI vectors when standalone Tx vectors existed. The fix uses the NAPI pointer stored in netdev_rx_queue.napi, set by fbnic_set_netif_napi() and cleared by fbnic_reset_netif_napi(), eliminating the modulo division and ensuring correctness even when the datapath is down.

In the Linux kernel, the fbnic Ethernet driver failed to reset num_napi when NAPI vectors were freed. As a result, when the PM path or a failed PCIe error recovery tears down the datapath without rebuilding it, num_napi remains positive while the vectors are freed, leading to a use-after-free and NULL pointer dereference in fbnic_dbg_down().

In the Linux kernel, the eth: fbnic driver's fbnic_mbx_reset_desc_ring() set only AW_FLUSH without AW_FLUSH_MODE when tearing down the FW mailbox Rx ring, so staged writes were not drained from the PUL pipeline and the flush never completed. The fix adds the FLUSH_MODE definition and sets both bits so staged writes drain on their own while BME stays cleared.