Linux kernel vulnerabilities

In the Linux kernel's NTFS filesystem, the ntfs_read_inode_mount() function improperly validates attribute-list entries during mount. A short entry with attacker-controlled length can cause an out-of-bounds read when the attribute list size is a multiple of the sector size.

In the Linux kernel's NTFS3 filesystem, the allocation of inline_data used kmemdup, which did not guarantee page alignment. This caused a BUG in iomap_write_end_inline when the inline data validity check failed. The fix allocates with alloc_page to ensure page alignment.

In the Linux kernel for the Alpha architecture, pci_mmap_resource() did not check security_locked_down(LOCKDOWN_PCI_ACCESS) before allowing userspace to mmap PCI BARs. The generic version has this check to prevent DMA attacks when the kernel is locked down.

In the Linux kernel's BPF subsystem, copy_user_syms used __get_user without a prior access_ok call on the user space pointer. This missing check could lead to improper memory access. The fix adds the missing access_ok call for the whole pointer array and simplifies the error path.

In the Linux kernel's XFS filesystem, the online scrub functionality can livelock if the unlinked inode list contains a loop. There is no cycle detection.

A vulnerability in the Linux kernel's MPTCP subsystem causes a memory leak due to a race between socket teardown and concurrent userspace PM ANNOUNCE handling. The issue stems from improper synchronization in mptcp_pm_destroy() and allocation paths, leading to lost list entries and memory leaks.

A race condition in futex_pivot_pending() during private hash resize in the Linux kernel can leave a task blocked in uninterruptible sleep indefinitely, leading to a hung-task detection and kernel panic.

In the Linux kernel's drm/panthor driver, panthor_fw_load_section_entry() skips BO creation for zero-sized firmware sections but adds them to the section list, leading to NULL pointer dereference in later paths. The fix skips adding such sections to the list.

In the Linux kernel powerpc/pseries papr-phy-attest, missing validation of cmd.length could lead to buffer overflow. The fix adds length checks and fixes memory leaks on error paths.

In the Linux kernel Synaptics RMI4 driver (F54), worker errors were not propagated to the V4L2 queue, causing stale or uninitialized data to be delivered to userspace. The fix adds error checking and marks buffers as error state.

In the Linux kernel, the hynitron_cstxxx driver improperly validated touch count and finger IDs. This can lead to corrupted touch state or out-of-bounds buffer access.

In the Linux kernel, the gve driver lacks an implementation of adjfine, leading to a NULL pointer dereference when triggered from userspace, e.g., via testptp.

A use-after-free vulnerability was found in the Linux kernel's gpio-sloppy-logic-analyzer driver. The 'trigger' debugfs file lacked proper protection, allowing a write to freed memory during device unbind. The issue was fixed by using debugfs_create_file() instead of debugfs_create_file_unsafe().

In the Linux kernel, the amdgpu driver for AMD Display has a NULL pointer dereference in amdgpu_dm_crtc_set_vblank() when vblank is enabled or queried before a stream is attached to acrtc_state->stream. This can lead to a system crash.

In the Linux kernel XFS filesystem, during directory tree repair, a self-referential directory may be detected. In such a case, the repair code attempts to lock the same inode twice (double iolock/ilock), leading to a deadlock. The fix detects this corner case and handles it appropriately.

In the Linux kernel XFS filesystem, during AGI repair, the function xrep_iunlink_walk_ondisk_bucket may attempt to use the pointer sc->sa.agi_bp, which can be null if the buffer verifier fails. The fix uses ragi->agi_bp instead, which skips verifier checks, to avoid walking off the end of memory.

In the Linux kernel XFS filesystem, during online fsck, the function xrep_iunlink_resolve_bucket is still vulnerable to infinite loops coming from next_unlinked pointers. The fix remembers which inodes have already been seen and checks new agino pointers against that to detect loops.

In the Linux kernel XFS filesystem, the function xlog_recover_dquot_commit_pass2() validates the recovered dquot with xfs_dqblk_verify(). On failure, it sets error = -EFSCORRUPTED and jumps to out_release, but out_release unconditionally returns 0, so the error is discarded. This allows a corrupt quota buffer to be written back to disk.

A vulnerability in the Linux kernel's ASoC SOF subsystem affects IPC payload handling for copier widgets. After suspend/resume, the ipc_config_data buffer is not refreshed, causing stale DMA channel assignments to be sent to firmware, leading to errors and crashes. The fix refreshes copier_data and dma_config_tlv before sending the IPC message.

In the Linux kernel's rseq mechanism, rseq_grant_timeslice_extension() calls hrtimer_rearm_deferred_tif() with interrupts enabled, while __hrtimer_rearm_deferred() expects interrupts disabled. This can lead to a livelock and is caught by lockdep.

In the Linux kernel, the regmap sdw-mbq module has a vulnerability of calling an unset readable_reg callback. When the callback is not set, calling it leads to a NULL pointer dereference, potentially causing a system crash.

In the Linux kernel's firewire: ohci driver, a NULL pointer dereference vulnerability was found in ar_context_release(). The issue occurs during the error handling path of the probe function when the context was not initialized, and the devres cleanup mechanism triggers release. An attacker could exploit this to cause a kernel crash (system panic).

A vulnerability in the Linux kernel's khugepaged mechanism can lead to data loss. Specifically, when a file is written, closed, then subjected to MADV_COLLAPSE, and later reopened for writing, dirty folios may be permanently discarded. The issue occurs when khugepaged interacts with previous writes, resulting in data loss.

Parts of the DM_OP handling code assume the caller has provided the required number of buffers without checking. This can lead to access to uninitialized stack structures, causing unpredictable behavior.

In the Linux kernel, a vulnerability related to error handling in the emac_tx_mem_map() function has been fixed. In case of a mapping error, DMA mappings were leaked, which has been resolved by freeing them using the existing emac_free_tx_buf() function.

A vulnerability in the Linux kernel related to duplicate device registration in netdev hooks has been fixed. The issue occurred during the handling of NETDEV_REGISTER notifications, which could lead to incorrect device registrations.

A vulnerability has been identified in the Linux kernel related to the io_uring mechanism, concerning the bounds check for 128-byte SQE_MIXED operations. The flaw involved validating the logical position instead of the physical SQE index, potentially leading to unauthorized memory access.

A vulnerability in the Linux kernel has been resolved in the mana_gd_setup() function. In the event of a setup error, the gc->service_wq pointer was set to NULL after destroying the workqueue, preventing a use-after-free error.

In the Linux kernel, a vulnerability related to the improper invocation of the css_put() function in scx_cgroup_init() has been resolved. This issue could lead to a reference count underflow, creating a risk of a Use-After-Free vulnerability.

A vulnerability has been identified in the Linux kernel related to Rust Binder, allowing improper page insertion into the wrong virtual memory area (vma). The issue arises when a vma is closed and replaced with another vma at the same address, potentially enabling write access to pages that should be read-only.

A vulnerability has been identified in the Linux kernel's rust_binder mechanism that allows reading values from the offsets array. If the target process gains the ability to write to its own vma, it can change the offset before it is read back, leading to misinterpretation by the kernel.

A vulnerability in the Linux kernel related to permission checks for namespace iteration ioctls has been resolved. Even privileged services should not necessarily be able to see other privileged service's namespaces to prevent information leakage between them.

A vulnerability has been identified in the Linux kernel within the damos_walk() function, which does not clear the walk_control pointer in the case of an inactive context. This can lead to use-after-free situations and a permanent -EBUS error.

A vulnerability related to RCU task stalls during threaded busypoll has been identified and fixed in the Linux kernel. This issue caused bpftrace to hang during startup.

A vulnerability has been identified in the Linux kernel that leads to improper access to hypervisor-owned memory on Monaco-based platforms. This issue results in 'Synchronous External Abort' exceptions and kernel crashes.

A vulnerability has been identified in the Linux kernel's interrupt handling for the ADXL380 accelerometer, allowing for reading more FIFO entries than actually available. The issue arises from a mismatch between how the sensor fills the FIFO and the number of active channels.

A vulnerability has been identified in the Linux kernel related to double destruction of the workqueue in the mana driver during PCI scanning. This issue leads to a use-after-free crash, potentially causing system instability.

A vulnerability has been identified in the Linux kernel regarding the improper classification of data as interlaced plain extents. This issue occurs when data is not properly aligned to the block size, potentially leading to out-of-bounds read errors.

A vulnerability related to null pointer dereference in the __udp_enqueue_schedule_skb() function has been fixed in the Linux kernel. This issue was reported by syzbot and may lead to failures in the UDP socket initialization functions.

A vulnerability in the Linux kernel related to bind attributes in sysfs for the reset device has been resolved. The issue allowed users to unbind the device, leading to a use-after-free error.

A vulnerability has been identified in the Linux kernel within the cachefiles_cull() function, leading to a loss of dentry references. Changes made in the cachefiles_bury_object() function did not account for all calls, resulting in improper reference management.

A vulnerability has been identified and resolved in the Linux kernel. The issue involves a double call to ida_free in the hv_pci_probe error path, leading to an attempt to free the same identifier twice.

A vulnerability has been identified in the Linux kernel regarding incorrect length accounting for TX packets that span multiple buffer descriptors. This issue leads to the loss of earlier bytes, potentially stalling the TX queue.

A vulnerability has been identified in the Linux kernel that allows the import of a zero-length buffer, leading to out-of-bounds memory reads. This issue occurs in the validate_fixed_range() function, where the lack of proper buffer length checking results in incorrect offset calculations.

A vulnerability in the Linux kernel related to the container_of operation in the intel_pmu_hw_config function has been fixed. The issue could lead to out-of-bounds memory reads when software events are present in a group of events.

A vulnerability has been identified in the Linux kernel that allows out-of-bounds access to the odr_table array in the st_lsm6dsx_hwfifo_odr_store() function. This issue occurs when a user attempts to set the buffer sampling frequency for sensors other than the accelerometer or gyroscope.

A vulnerability has been identified in the Linux kernel related to a double free in the reset_add_gpio_aux_device() function on error. The issue occurs when __auxiliary_device_add() fails, leading to improper resource deallocation.

A vulnerability has been identified in the Linux kernel related to incorrect buffer size in DMA allocation and memcpy in zynqmp_nvmem. This flaw may lead to undersized DMA buffer access and potential memory corruption.

A vulnerability in the Linux kernel related to the unmap function was identified, which can unmap more than requested if the endpoint lands within the middle of a large or contiguous IOPTE. This issue has been resolved with a fix that ensures all unmapped areas are properly flushed.

A vulnerability has been identified in the Linux kernel that leads to a double free when splitting a virtual memory area (VMA). The issue occurs when a user performs a partial munmap() on a privcmd mapping, allowing for improper memory pointer management.