Linux kernel vulnerabilities

The Linux kernel has a missing memory barrier between anon_vma initialization and the publication of vma->anon_vma. As a result, two threads handling adjacent VMAs can concurrently call __anon_vma_prepare(), leading to a use-after-free (UAF) and a deadlock on the anon_vma->root->rwsem lock. This manifests as a hung task on arm64 platforms.

In the Linux kernel, dissolve_free_hugetlb_folio() does not check hstate_is_gigantic_no_runtime(h), even though remove_hugetlb_folio()/update_and_free_hugetlb_folio() silently bail for such folios. As a result, a still-listed folio is freed, and on vmemmap restore failure the add_hugetlb_folio() rollback corrupts the free list.

In the Linux kernel, damon_hugetlb_mkold() reads the page table entry into a local variable, unsets the accessed bit, and writes the updated value back. If hardware updates the same entry in parallel, hardware updates (e.g., dirty bits) may be lost. The fix uses huge_ptep_get_and_clear() to atomically clear the entry on read.

In the Linux kernel, of_pci_prop_bus_range() and of_pci_prop_intr_map() dereference pdev->subordinate without checking whether the PCI bridge has a subordinate bus allocated. When CONFIG_PCI_DYNAMIC_OF_NODES is enabled, this can cause a NULL pointer dereference and early boot hang.

A vulnerability in the Linux kernel AF_PACKET TX_RING transmission path was fixed. A ring slot could be released and reused while still linked into an skb, because skb_orphan invoked the destructor before the skb was freed. The fix switches to standard zerocopy completion (ubuf_info), so the slot is released only after all references to the payload are freed or copied.

In the Linux kernel, the HID alps driver (alps_input_configured()) allocates and registers a second input device 'DualPoint Stick', but the alps_driver struct has no .remove handler and input2 is not tracked in hdev->inputs. The default remove path (hid_hw_stop -> hidinput_disconnect) only iterates hdev->inputs, so input2 is never unregistered and leaks on every device removal.

In the Linux kernel, alps_input_configured() in the HID alps driver stores data->input2 before registering the input device. If registration fails, input_free_device() frees the memory but data->input2 still points to it, and with active URBs this can lead to a use-after-free.

In the Linux kernel, oxp_hid_remove() in the HID hid-oxp driver uses cancel_delayed_work(), which does not wait for a currently executing callback to finish. If a callback (e.g. oxp_rgb_queue_fn) is running during removal, it continues accessing the HID device after it has been closed and stopped.

In the Linux kernel, wacom_wac_pen_serial_enforce() in the HID wacom driver may compute an invalid offset passed to hid_field_extract(), causing a read past the end of the report. The value is stored in wacom_wac->serial[0] and can reach userspace as an MSC_SERIAL event.

In the Linux kernel, in mlx5_tc_ct_shared_counter_get() of the net/mlx5 driver, when the reverse entry is found but its counter is already being released, refcount_inc_not_zero() fails and the reference taken by mlx5_tc_ct_entry_get() is never dropped before falling through to create_counter.

In the Linux kernel, mlx5e_ipsec_policy_mask() in the net/mlx5e driver builds masks for IPv6 XFRM policies, but setup_fte_addr6() installs each mask in the opposite address field. When source and destination prefix lengths differ, the hardware rule can miss traffic covered by the policy and match traffic outside it.

In the Linux kernel, airoha_npu_remove() in the net: airoha: npu driver calls cancel_work_sync() on wdt_work, but the watchdog IRQ that queues it is freed only after .remove() returns. The handler can re-queue work that dereferences freed memory of the airoha_npu struct.

In the Linux kernel, the ARP ioctl copies a user-provided struct arpreq into a stack object, and its arp_dev field may contain IFNAMSIZ bytes without a NUL terminator. Such input is passed to dev_get_by_name_rcu() or __dev_get_by_name(), where strcmp() can read past the end of the stack object.

In the Linux kernel, the net: atl1 driver may read an out-of-range cmb_tpd_next_to_clean value (e.g. 0xffff) while the PCIe link/MAC is resetting. Such a value can never be reached, so the cleanup loop may spin forever, causing a soft lockup.

In the Linux kernel, ic_dhcp_init_options() in the net: ipconfig driver appends hostname, vendor-class and client-ID options into the fixed 312-byte bootp_pkt.exten[] buffer. Only the client-ID branch checked remaining space, so long hostname and vendor-class values can write past the end of the buffer.

In the Linux kernel, macb_alloc() in the net: macb driver has DMA memory leaks on error paths: a Tx buffer crossing a 4G boundary, an Rx buffer allocation failure, and an Rx buffer crossing a 4G boundary leak Tx and/or Rx buffers. The error handling calls macb_free(bp), but nothing has been stored in bp->queues[0].

In the Linux kernel, the openvswitch conntrack module can modify a shared unconfirmed ct entry. When a cloned skb with an unconfirmed ct entry is committed, differing extension sets cause a use-after-free on the destruction path.

In the Linux kernel, the atl1e driver has a soft lockup issue caused by an out-of-range hw_next_to_clean read. When the hardware reports 0xffff during PCIe/MAC link reset, the cleanup loop can spin forever.

In the Linux kernel, the bridge mdb module has a use-after-free due to a stale cursor after port group deletion. br_mdb_flush_pgs() can point to freed memory, exposed by a subsequent RTM_GETMDB.

In the Linux kernel, the ena driver leaks an MMIO read buffer on probe failure. If ena_probe() fails after successful device init, the coherent DMA buffer is not freed.

In the Linux kernel, the netfilter ip6t_rt module has an out-of-bounds read in non-strict zero-address matching. When a rule has rtinfo->addrnr == 0, a crafted IPv6 packet can cause the index to go past struct ip6t_rt.

In the Linux kernel, the netfilter nf_tables module skips expired catchall elements on insert and delete. Predicate drift makes expired elements invisible to userspace but still blocks re-insertion or causes the wrong element to be deleted.

In the Linux kernel, the NFC module has a use-after-free in nfc_get_local_general_bytes. After the local object is freed, callers may still use the returned pointer, leading to a UAF.

In the Linux kernel, the NFC LLCP module reads uninitialized memory on truncated I/RR/RNR PDUs. nfc_llcp_recv_hdlc() reads the sequence byte before any length check, allowing a one-byte read past the packet data.

In the Linux kernel, the NFC port100 driver does not verify that the frame length declared by the device (datalen field) does not exceed the number of bytes actually received. A device can report an oversized datalen, causing an out-of-bounds read past the transfer buffer during checksum computation.

In the Linux kernel, trf7970a_startup() powers up the NFC device before applying the optional RX gain reduction. If the register read or write fails, it returns without undoing that power-up, leaving unbalanced VIN references and enable GPIOs.

In the Linux kernel, the Data-In branch of iscsi_tcp_hdr_dissect() in libiscsi_tcp copies the PDU's data segment into the command's scatterlist without checking whether the command was a read. A malicious iSCSI target can answer a WRITE command's ITT with a Data-In frame and overwrite pages the initiator was about to send.

In the Linux kernel, during UFS error recovery, ufshcd_err_handling_prepare() quiesces the entire tagset, including the pseudo SCSI device's request queue used by internal commands. This causes a deadlock because internal commands (e.g. NOP OUT UPIU) cannot be dispatched on the quiesced queue.

In the Linux kernel, perf_pmu_sched_task() passes NULL as pmu_ctx to pmu->sched_task() because it returns early when cpuctx->task_ctx is set. This leads to a NULL pointer dereference in armv8pmu_sched_task() and a kernel oops.

In the Linux kernel on s390, ccw_device_get_util_str() can receive NULL from chpid_to_chp() when the channel path registry entry is removed while the subchannel's PMCW still references that CHPID. The missing NULL check leads to a NULL pointer dereference.

In the Linux kernel on s390, the cmf measurement block address is an absolute address, but the associated schib_config and schib fields are not defined as dma64_t, preventing automatic detection of incorrect assignments. The missing virt_to_dma64() translation causes firmware to use a wrong address when storing extended format channel measurement data.

In the Linux kernel on s390, zpci_report_status() accesses the device's driver without holding the device lock when pdev is non-NULL. The missing lock can lead to an inconsistent state relative to the recovery process.

In the Linux kernel, the s390/vfio-ap module has three related bugs in handling KVM interrupts and page resources when a queue is removed from the host's AP configuration while assigned to a mediated device (mdev). The unhandled AP_RESPONSE_Q_NOT_AVAIL response code in vfio_ap_mdev_reset_queue() and apq_status_check() causes a leak of the KVM GISC registration and the pinned guest page holding the notification indicator byte (NIB). Additionally, vfio_ap_free_aqic_resources() fails to clear saved_isc when kvm is NULL, potentially leading to a double-free.

In the Linux kernel, KVM SEV does not free the "have run CPUs" cpumask during VM destruction if the VM is no longer in SEV mode (e.g. after intra-host migration). This leads to a memory leak.

In the Linux kernel, KVM SEV did not manually perform cache maintenance on the source VM during intra-host migration. After the source VM was destroyed, stale data could remain in CPU caches because KVM's memory reclaim flows would not trigger cache maintenance.

In the Linux kernel, KVM for arm64 had kvm_pkvm_ioctl_allowed() issue a WARN when the ioctl number was not found in vm_ioctl_caps[]. An ioctl call with an unknown number from userspace would taint a pKVM host and panic it when panic_on_warn was enabled.

In the Linux kernel, KVM for arm64 had the consolidation of breakpoint and watchpoint register accessors switch DBGBXVR<n> from trap_bvr() to trap_dbg_wb_reg(). Because DBGBXVR<n> uses Op2 value 1, an AArch32 guest access hit KVM_BUG_ON() and marked the VM dead.

A spurious warning in the Linux kernel KVM on arm64 was fixed, triggered by a benign race during stage 2 page table teardown. The warning occurred when concurrent release of mmu_lock set mmu->pgt to NULL, causing -EINVAL and a WARN_ON. The fix makes stage2_apply_range() no longer treat concurrent PGT teardown as an error.

In the Linux kernel, the KVM arm64 module contains a null pointer dereference vulnerability caused by a race during nested guest teardown. Concurrent invalidation of the MMU range and freeing of the stage 2 page tables can cause kvm->arch.mmu.pgt to become NULL and then be dereferenced. The issue is resolved by checking that the pgt pointer is non-NULL before use.

In the Linux kernel, KVM for arm64 had fix_host_ownership() walk only the linear-map alias of each memblock region. The per-CPU hypervisor stack, mapped in the private VA range for its guard page, had no such alias and was not covered by that walk.

In the Linux kernel, RISC-V KVM does not serialize IMSIC attribute operations against vCPU migration. kvm_riscv_aia_imsic_rw_attr() can snapshot stale physical CPU and HGEI data before a concurrent vCPU migration, so a GET or SET attribute may access the new owner's interrupt file.

In the Linux kernel sched_ext scheduler, the SCX_RQ_IN_WAKEUP flag is derived from merged enqueue flags, including flags stashed for remote activation. move_remote_task_to_local_dsq() sets this flag on the destination rq without a following task_woken_scx(), leaving a reenqueue request pending that can point into freed per-cpu memory after the scheduler is disabled.

In the Linux kernel Bluetooth hci_conn, CIS hold ownership on reuse is incorrect. hci_bind_cis() takes the hold only after configuring a CIS, so BT_CONNECTED and BT_BOUND paths return a bare lookup result, and hci_connect_cis() assumes hci_conn_link() always takes a new CIS hold, which is not true for an existing link.

In the Linux kernel Bluetooth hci_sock, is_filtered_packet() reads the event code from skb->data[0] without checking the skb is nonempty, and reads the command opcode at offsets 3 or 4 without verifying the event is long enough. A malformed event from a controller or vhci device can cause an out-of-bounds read.

In the Linux kernel Bluetooth hci_sock, the raw HCI socket security filter masks the 10-bit OCF with 127 before looking up the command. An unprivileged socket can submit a reserved OCF that aliases an allowlisted command modulo 128, bypassing the security filter.

In the Linux kernel Bluetooth ISO, hci_bind_bis() obtains the parent from hci_conn_hash_lookup_big(), which returns a bare pointer without a hold. Unlinking the child then drops the parent's existing hold and can schedule it for disconnection while its socket is still using it.

In the Linux kernel Bluetooth ISO, hci_bind_cis() and hci_connect_cis() return one hci_conn hold for the ISO layer, but iso_chan_add() does not create an association when the socket is already attached to the same iso_conn or when another socket is attached (returns -EBUSY). The hold returned for the current call is unused and leaked.

In the Linux kernel Bluetooth L2CAP, l2cap_data_rcv() unpacks a two- or four-byte control field without ensuring it is present, causing an out-of-bounds read for short ERTM or streaming-mode frames. Additionally, with CRC16 enabled, l2cap_check_fcs() subtracts two from skb->len without checking, causing a wrap and an FCS read past the logical end of the frame.

In the Linux kernel Bluetooth mgmt, read_unconf_index_list() counts unconfigured controllers before allocating its response, then rechecks device flags while filling it. During asynchronous controller setup, the worker can set HCI_UNCONFIGURED and clear HCI_SETUP between the two passes, so a controller omitted from the count becomes eligible for the fill pass, causing an out-of-bounds write to rp->index[].

A NULL pointer dereference vulnerability exists in the Linux kernel's RFCOMM_CONNINFO getsockopt handler. When a socket is created with deferred setup enabled and a remote peer sends a DISC frame, the dlc->session pointer becomes NULL while dlc->defer_setup remains set. A subsequent getsockopt call on that socket dereferences the NULL session, causing a kernel oops.