Linux kernel vulnerabilities

In the Linux kernel, the net: dsa: mt7530 driver's mt7530_remove_common() disposes per-PHY interrupt mappings from .remove, but the regmap-irq chip owning the domain is devm-registered, so its parent interrupt is freed only after .remove returns. The switch's regmap-irq thread can therefore dispatch on an already-removed mapping, leading to a NULL dereference in handle_nested_irq().

In the Linux kernel, phylink_bringup_phy() stored the PHY pointer (pl->phydev) before its last fallible step (phy_eee_rx_clock_stop()). On an MDIO error, the pointer remained set to a PHY that was no longer attached, leading to a permanent -EBUSY, use of a freed phy_device, or double reference release.

In the Linux kernel, the nfp driver dropped the XArray lock before taking a reference to the IPsec xfrm_state, allowing the delete path to erase the entry and drop the last reference. RX could then increment a zero refcount after the state was queued for destruction. The fix takes the reference before releasing the XArray lock.

In the Linux kernel, __rds_conn_create() computed npaths from the caller's transport before deciding whether a connection to a local address would use the loopback transport. This caused seven workqueues to leak on every connection teardown, netns teardown, or module unload. The fix recomputes npaths once the final transport is determined.

In the Linux kernel, smcr_port_err() traversed smc_lgr_list.list without holding smc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched() to free an lgr while it was still being dereferenced. The fix holds the lock across the traversal and calls smcr_port_err() after releasing the lock in smc_ib_gid_check().

In the Linux kernel, dev_cpu_dead() drained softnet queues on CPU offline but left net_hotdata.skb_defer_nodes untouched, stranding deferred skbs until the CPU came back online. This could stall page_pool_destroy() waiting for inflight pages and block future IPI kicks. The fix drains defer nodes, resets defer_ipi_scheduled, and re-checks CPU state in skb_attempt_defer_free().

In the Linux kernel, gve_can_send_tso() unconditionally used skb_tcp_all_headers() to compute header length, which for SKB_GSO_UDP_L4 packets (no TCP header) yielded an incorrect value. This misestimated buffers per segment, causing unnecessary GSO disabling or handing the device packets exceeding buffer limits. The fix uses the UDP header length for SKB_GSO_UDP_L4 packets.

In the Linux kernel, gve_prep_tso() did not enforce the device-required MSS <= 9728 limit, assuming the 9K MTU and 64KB TSO limit were sufficient. Packets not generated locally (e.g., from a guest behind a tap or a packet socket user) can carry arbitrary gso_size, and the 14-bit MSS field silently turns gso_size 16384 into MSS zero. The fix drops such packets and leaves their GSO bits alone.

In the Linux kernel, llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr() called kfree_skb(skb) instead of kfree_skb(nskb) on llc_mac_hdr_init() failure, leaking the newly allocated nskb, reading from freed skb, and double-freeing skb. Similar nskb leaks occurred in llc_sap_action_send_xid_r() and llc_sap_action_send_test_r(). The fix frees nskb in all three error paths.

In the Linux kernel, vlan_dev_hard_header() could be reached with insufficient headroom by callers reserving only ETH_HLEN or less, or by skbs allocated before dynamic device/headroom changes, triggering skb_under_panic(). The fix uses skb_cow_head() when VLAN_FLAG_REORDER_HDR is not set and READ_ONCE() for dev->hard_header_len and dev->needed_headroom.

In the Linux kernel, when autofs_fill_super() failed before clearing AUTOFS_SBI_CATATONIC, deactivate_locked_super() invoked autofs_kill_sb() -> autofs_catatonic_mode(sbi), which returned early without calling fput(sbi->pipe), permanently leaking the pipe file reference. The fix explicitly releases sbi->pipe in autofs_kill_sb() if still non-NULL after autofs_catatonic_mode().

In the Linux kernel, attach_perf_ctx_data() can race between global and !global cases, missing the global field assignment and leaking a reference count. Consequently, a later detach_global_ctx_data() sees the data but does not mark it as global, so it does not call detach_task_ctx_data(). The fix eliminates the race and reference leak.

In the Linux kernel, perf_clear_branch_entry_bitfields() cleared the perf_branch_entry bitfields one by one and did not cover the new_type and priv fields that were added later. As a result, on arm64, perf branch records can reach userspace with uninitialised kmalloc() data or values from the previous record.

A vulnerability in the Linux kernel's TIPC module was fixed where invalid or unexpected GRP_ACK_MSG messages could cause an underflow of the bc_ackers counter. Because the counter is a u16, it could wrap to 65535, permanently blocking group broadcasts on the socket.

The Linux kernel has an integer overflow in prb_calc_retire_blk_tmo() in the af_packet subsystem (TPACKET_V3). A user with CAP_NET_RAW can set tp_block_size to around 256 MiB, causing 32-bit arithmetic to overflow and return a negative value. As a result, the hrtimer is started with a negative interval, causing it to fire immediately and restart continuously, spinning a CPU in softirq.

In the Linux kernel, __init_el2_fgt2() wrote the same mask to both HDFGRTR2_EL2 and HDFGWTR2_EL2, so the nPMZR_EL0 trap bit for PMZR_EL0 writes was never set. With kernel.perf_user_access=1, a PMZR_EL0 write from EL0 traps to EL2, where the nVHE hypervisor has no handler and BUG()s, taking the host down without a panic message.

In the libata subsystem, ata_scsi_set_passthru_sense_fields() trusted the additional length byte sb[7] from a faulty or malicious ATAPI device's REQUEST SENSE reply. This causes reads and writes past the 96-byte sense buffer in three ways, confirmed by KASAN slab-out-of-bounds reports.

In the bna driver, bnad_pci_remove() and the probe disable_ioceth path called timer_delete_sync() for ioc_timer, sem_timer and hb_timer, but not for iocpf_timer. After free_netdev() frees the bnad struct, bnad_iocpf_timeout() accesses freed memory, because sem_timer and iocpf_timer rearm each other.

In the Linux kernel, bpf_lsm_has_d_inode_locked() caused the verifier to rewrite bpf_[set|remove]_dentry_xattr() to the _locked variants that assume the inode's i_rwsem is held. However, the path_unlink and path_rmdir hooks run before vfs_unlink()/vfs_rmdir() take that lock, so a BPF LSM program attached to these hooks mutates xattrs without holding the lock.

In the Linux kernel, remote_partition_enable() had its cpumask_intersects() conflict check replaced by WARN_ON_ONCE(). As a result, a remote cpuset partition can be enabled on CPUs already owned by an ancestor local partition, emitting a kernel warning and leaving two partitions claiming exclusive use of the same CPU.

A vulnerability was found in the Linux kernel's FOU (Foo-over-UDP) implementation. When a user creates a FOU_ENCAP_DIRECT tunnel via netlink while omitting the optional FOU_ATTR_IPPROTO attribute, the protocol field remains zero, causing an sk_buff memory leak on every received packet. The flaw was fixed by rejecting such requests with -EINVAL.

In the Linux kernel, fprobe_fgraph_entry() reserves shadow stack space for every fprobe with an exit handler, but only fills it for those whose entry handler returns 0. Because fgraph_reserve_data() does not clear the area, fprobe_return() parses the unused tail as headers left over from an earlier call, which can cause an exit handler to run twice or despite its entry handler asking to skip it.

In the Linux kernel, cleanup_offline_cgwb() walks wb->b_attached and wb->b_dirty_time from the same end on every call, rescanning a growing run of inodes that cannot be switched. With roughly 17 million inodes attached to one dying cgwb, this makes a full drain quadratic and results in soft lockups with CPUs stuck for 21-48 seconds.

A vulnerability was fixed in the Linux kernel workqueue subsystem where check_flush_dependency() could dereference a NULL pointer (worker->current_pwq). This occurs when a kworker thread with PF_WQ_WORKER set is not currently executing a work item, such as during an allocation path invoking the OOM notifier. It can lead to a kernel crash (kernel panic).

In the Linux kernel, cleanup_offline_cgwbs_workfn() draining dying cgwbs used cond_resched(), which is a no-op on CONFIG_PREEMPTION kernels (full and lazy modes). As a result, the drain loop never reported a Tasks-RCU quiescent state, causing multi-minute stalls of synchronize_rcu_tasks() when cgroups had millions of attached inodes.

In the Linux kernel, read_dts_node() calls of_clk_get(), which returns a clock with its reference count incremented, but only uses it to read the rate and never calls clk_put(). The clock is not stored anywhere, so the reference cannot be released later either.

In the Linux kernel, new_policy() audits the policy after ipe_new_policyfs_node() publishes it and drops the new directory's inode lock. A concurrent delete can free the policy while ipe_audit_policy_load() is still using it, resulting in a use-after-free.

In the Linux kernel, ipe_bdev_setintegrity() frees the old root hash when dm-verity publishes a new one on ->preresume, while policy evaluation can still be dereferencing it. This results in a potential use-after-free.

In the Linux kernel, ipv6_find_hdr() walked the IPv6 extension header chain without verifying that the computed offset stayed within the packet bounds. openvswitch then installed that offset as the transport header, and update_ipv6_checksum() read and wrote the transport checksum field out of bounds, causing a KASAN-reported use-after-free. The fix rejects any header whose declared length does not fit within the packet.

In the Linux kernel, the seg6 (IPv6 Segment Routing) SEG6_ATTR_DST attribute used NLA_BINARY with only a maximum length limit. A shorter attribute (e.g., 0 bytes) caused a 16-byte out-of-bounds read past the skb buffer and leaked uninitialized kernel heap memory to userspace via SEG6_CMD_GET_TUNSRC.

A flaw in the Linux kernel kprobes subsystem causes a permanent hang when disabling kprobe optimization. Writing 0 to /proc/sys/debug/kprobes-optimization while a kprobe is jump-optimized leaves the writer sleeping forever in D state with kprobe_sysctl_mutex held, blocking any subsequent access to that sysctl. The issue stems from improper completion synchronization between the optimizer thread and flush callers.

In the Linux kernel, the gpio: arizona driver's arizona_gpio_direction_out() acquires a runtime PM reference when switching a GPIO line from input to output, but if the subsequent regmap_update_bits() fails, the reference is never dropped. This leads to a runtime PM reference leak.

In the Linux kernel, the gpio: cdev subsystem's gpio_desc_to_lineinfo() returns early if it fails to acquire the GPIO chip guard, before zeroing the info struct that is later passed to userspace. This may leak kernel stack contents.

In the Linux kernel, the gpio: zynq driver's zynq_gpio_request() calls pm_runtime_get_sync(), which increments the usage counter even on failure, and the error is returned without dropping the reference. Since gpiolib does not call ->free() when ->request() fails, the runtime PM reference is leaked.

In the Linux kernel, the llc subsystem's llc_alloc_frame() reserves link-layer headroom based on the device type, which is insufficient for stacked Ethernet devices such as VLAN devices. An LLC response on such a device can underflow skb headroom in eth_header().

In the Linux kernel, the mctp subsystem's mctp_lookup_prealloc_tag() iterates over the namespace-wide &mns->keys list instead of the socket's own list, without checking whether tmp->sk == &msk->sk. This allows any MCTP socket in the same network namespace to use and consume another socket's preallocated tag.

In the Linux kernel, the rds: ib subsystem's rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA mapping succeeds. On failure, __rds_rdma_map() unpins pages and frees the scatterlist, but rds_ib_free_frmr() can return the MR to the pool with a stale pointer, leading to use-after-free and local privilege escalation.

A null-ptr-deref bug exists in the Linux kernel DRM subsystem when closing a DRM file descriptor. It occurs when an fbdev client is registered but its initialization fails, leaving a partially initialized state. The restore callback then attempts to restore a non-existent framebuffer, causing a warning and NULL pointer dereference.

In the Linux kernel, the i915_gem_busy_ioctl function in the drm/i915 driver has an incorrect RCU teardown order. If a GEM object is destroyed during fence iteration, the loop never terminates, causing an endless loop.

In the Linux kernel, the kfd_dev_mapping function (drm/amdkfd driver) had two bugs: a use-after-free leading to an i_mmap_rwsem deadlock, and a multi-container gap where VMAs from later /dev/kfd openers were never unmapped. Both manifest under SRIOV with multiple containers and can cause a hard hang or leave stale doorbell/MMIO mappings. The fix creates a private pseudo-filesystem and redirects all openers to a single anonymous inode.

In the Linux kernel, the amdgpu_debugfs_test_ib_show() function in the drm/amdgpu driver calls pm_runtime_get_sync() and then attempts to acquire the reset domain semaphore via down_write_killable(). If the lock acquisition is interrupted, the function returns without releasing the runtime PM reference, leaking it and keeping the GPU awake.

In the Linux kernel, the drm/nouveau/dmem module's nouveau_dmem_chunk_alloc() registers a region of DMEM_CHUNK_SIZE * NR_CHUNKS, but the backing VRAM buffer object remains DMEM_CHUNK_SIZE. As a result, pages beyond the first chunk resolve to VRAM outside the buffer, causing invalid memory access.

A use-after-free vulnerability exists in the Linux kernel's drm/nouveau/uvmm module. The nouveau_uvmm_sm() function calls op_map(), which passes bo->resource through nouveau_mem() to nouveau_uvma_map(), and nouveau_uvmm_vmm_map() then reads mem->mem.type. When the BO remains in TTM_PL_SYSTEM, bo->resource points only to a struct ttm_resource, so reading mem->mem.type goes past the end of the resource, triggering a KASAN slab-use-after-free.

In the Linux kernel, the nv1a_ram_new() function in the drm/nouveau driver calls pci_get_domain_bus_and_slot(), which takes a reference to the PCI device, but this reference is never released after reading the memory size from its config space.

In the Linux kernel, the validate_init() function in the drm/nouveau driver, on ttm_bo_reserve() failure or "vma not found" error paths, breaks the loop without adding the looked-up object to any validate list, so the reference taken by drm_gem_object_lookup() is never released.

In the Linux kernel, the nouveau_connector_detect() function in the drm/nouveau driver, if nvif_outp_edid_get() fails, returns early without dropping the runtime PM reference taken at the start of the function, keeping the device powered on.

In the Linux kernel, struct nouveau_sched embeds a drm_gpu_scheduler, and nouveau_sched_destroy() frees it with kfree() after drm_sched_fini(). Because fences exported to userspace via drm_syncobj/sync_file still point to the freed memory, a later get_timeline_name() call causes a use-after-free (KASAN slab-use-after-free read).

In the Linux kernel, xe_vm_close_and_put() destroyed vm->pt_root (via xe_vm_pt_destroy()) before processing contested VMAs that were still linked to their buffer objects. If a concurrent thread evicts one of those shared buffers, xe_bo_trigger_rebind() walks the BO's VMAs and calls xe_pt_zap_ptes(), where dereferencing pt->level causes a NULL pointer dereference because vm->pt_root[tile->id] is already NULL.

A memory leak exists in the Linux kernel's drm/virtio driver within virtio_gpu_execbuffer_ioctl(). When an execbuffer call fails (e.g., invalid bo_handle or a syncobj with no fence), the reserved DRM event is neither cancelled nor freed, and the only driver-side pointer to it is lost. Closing the DRM file does not release this memory, so the allocation leaks permanently.

In the Linux kernel, the drm/virtio driver's virtio_gpu_fence_alloc() can return NULL under memory pressure, but its caller virtio_gpu_init_submit() never checks for this. The NULL fence is then passed to virtio_gpu_fence_event_create(), which unconditionally dereferences it, causing a NULL pointer dereference and kernel crash (general protection fault).