Linux kernel vulnerabilities

In the Linux kernel s390 boot code, append_ipl_block_parm() may pass a zero size to the IPL parameter conversion helpers when the command line occupies the entire COMMAND_LINE_SIZE buffer. This results in a write outside the command line buffer.

In the Linux kernel, a bug was fixed in the icmp_send tracepoint where TP_fast_assign() unconditionally called udp_hdr(skb) before checking whether the packet is UDP. This triggered a DEBUG_NET_WARN_ON_ONCE warning when accessing an uninitialized transport header (transport_header = ~0U), as __icmp_send() can be invoked from paths such as link failures, ARP errors, forwarding, or AF_PACKET.

A vulnerability in the Linux kernel's iptunnel handling causes a stale transport_header offset during tunnel decapsulation of GSO packets. This leads to a negative offset and subsequent KASAN fault or page fault in qdisc_pkt_len_segs_init(). The issue occurs when encapsulated GSO packets are forwarded at L2 by a bridge or HSR instead of being delivered to the local IP stack.

In the Linux kernel s390 kdump handling, set_os_info_reipl_block() dereferences reipl_block_actual, which remains NULL for IPL types without a re-IPL parameter block (e.g., HMC FTP boot, QEMU direct kernel boot). This can lead to a NULL pointer dereference.

In the Linux kernel s390 stand-alone dump handling, dump_reipl_run() unconditionally dereferences reipl_block_actual, which remains NULL for IPL types without a re-IPL parameter block. This can lead to a NULL pointer dereference and put the dumper into disabled wait.

A bug was fixed in the Linux kernel lockdep mechanism that caused a DEBUG_LOCKS_WARN_ON(1) warning in hlock_class() due to an invalid class_idx. The issue arose because class_cache[] entries in lockdep_map structures could still point to zapped lock classes, leading to incorrect matching or warnings. The fix adds validation of class_cache entries and safely refreshes them.

In the Linux kernel platform/x86 x86-android-tablets module, gpio_secondary_fwnode_init() drops the device reference at the end of each iteration, while devm_add_action_or_reset() saves the pointer without incrementing its reference count. This can lead to a use-after-free during driver teardown.

In the Linux kernel on PowerPC, arch_exit_to_user_mode_prepare() restored user memory access permissions (KUAP) too early, before platform-specific exit routines completed. This caused the kernel to run with user memory access unblocked, triggering a warning in interrupt_exit_user_prepare() when CONFIG_PPC_KUAP_DEBUG was enabled. The issue was fixed by removing the KUAP restore from that hook.

In the Linux kernel on PowerPC, __replay_soft_interrupts() overwrote irq_soft_mask with IRQS_DISABLED (0x1) when replaying a pending interrupt, stripping the IRQS_PMI_DISABLED (0x2) bit. This triggered a WARN_ON in arch/powerpc/kernel/irq_64.c:75, observed early in boot on a POWER10 pseries guest. The fix replaces local_irq_disable() with hard_irq_disable().

In the Linux kernel, recv(0, MSG_PEEK) in blocking mode triggered a busy-wait in unix_stream_read_generic() when the last skb in the queue was a MSG_OOB skb. This affects AF_UNIX sockets. The fix makes the function return 0 immediately, matching TCP behavior.

In the Linux kernel IPv4 handling, a UDP length overflow occurs with PMTU discovery and a very large interface MTU. When IP_MTU_DISCOVER is set to IP_PMTUDISC_PROBE and a packet is sent over a netdev with MTU larger than IP_MAX_MTU + 20, the UDP length can exceed the 16-bit field and trigger a WARN in udp_set_len_short. This affects the IPv4 networking stack in the kernel.

In the Linux kernel Bluetooth driver btintel_pcie, there is an off-by-one bounds check error for tx_handle. Valid indices are 0..txq->count-1, but the guard in btintel_pcie_msix_tx_handle() only checked '> txq->count', allowing an index equal to txq->count. The fix changes the guard to '>= txq->count'.

In the Linux kernel drm/xe driver, a race condition occurs during VM teardown when the runtime PM reference is dropped asynchronously while stale page faults are still queued. The page-fault worker may call guc_ct_send_locked() on an already-suspended device, tripping an assertion and kernel warning. The fix holds a runtime PM reference across the entire pagefault queue worker.

In the Linux kernel x86/amd_node code, a divide-by-zero occurs on virtualized systems. The number of nodes is unrelated to the number of roots, and on Xen PVH dom0 roots_per_node can be 0, causing a crash in a modulo operation. The fix sets roots_per_node to 1 in this case and prints a firmware bug warning for non-virtualized systems.

In the Linux kernel drm/amdgpu driver, during resume from GPU reset, the gfx idle work may invoke switch_power_profile before the reset completes. This causes register access without releasing the GPU reset semaphore, leading to an assertion error and stack trace. The fix skips switch_power_profile during GPU reset.

In the Linux kernel, do_close_on_exec() is called while holding exec_update_lock, which can block waiting for a filesystem reply. This can lead to deadlock if a FUSE filesystem tries to inspect the calling process, or block codepaths using exec_update_lock. The fix moves do_close_on_exec() before taking exec_update_lock, but after copying the FD table if necessary.

In the Linux kernel s390/crypto module (aes_s390), return codes from skcipher_walk_virt() are not properly checked before entering processing loops in ecb_aes_crypt() and ctr_aes_crypt(). If skcipher_walk_virt() fails, the walk structure may be in an undefined state, leading to incorrect behavior or access to uninitialized memory. The fix adds proper return code checking.

In the Linux kernel scsi: qla2xxx driver, __qla2x00_alloc_iocbs() zeroes the QLAFX00 request ring slot with a plain memset(), even though it is ioremapped device I/O memory, not DMA-coherent RAM. On architectures like ARM64, memset() may emit invalid instructions (e.g., DC ZVA) on Device memory, causing a synchronous external abort. The fix uses memset_io() for QLAFX00.

Time-of-check time-of-use (TOCTOU) race condition in the Linux Kernel allows an authorized attacker to elevate privileges locally.

A use-after-free (UAF) vulnerability was found in the Linux kernel's scheduler cache grouping mechanism. Scheduler statistics were stored in the mm structure, allowing access after the old mm was freed during context switching. The issue was fixed by extracting these statistics into a separate refcounted object.

In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardware register corruption due to improper input validation of the frequency index. This could lead to system instability or denial of service with local privileges.

In the Linux kernel, bpf_sock_destroy() reads sk_protocol from the wrong structure, causing an out-of-bounds read. The issue affects TIME_WAIT and request sockets passed by the TCP iterator. The fix restricts the sk_protocol check to full sockets only.

In the Linux kernel, LWT_SEG6LOCAL programs can invalidate the cached SRH and then call bpf_skb_pull_data(), leading to a dangling pointer and use-after-free. The fix disallows bpf_skb_pull_data() for LWT_SEG6LOCAL programs.

In the Linux kernel, the BPF device matching mechanism has a flaw that allows a program bound to one device to run on another, leading to memory corruption. The fix restricts non-offloaded programs to exact netdev matches.

In the Linux kernel, during veth channel resize, XDP program pointers are not cleared for removed RX queues. This can lead to running a freed program after a later channel increase, causing a system crash.

In the Linux kernel's net/sched subsystem, a vulnerability exists where tcf_action_delete() fails to check if the IDR lookup result is an error pointer (ERR_PTR). An attacker can exploit a race to replace an action with an error pointer, leading to a null-pointer dereference and kernel panic.

A vulnerability in the Linux kernel's netfilter ip6t_rpfilter module was found, where ip6_route_lookup() can return a route without an inet6_dev (NULL pointer). An unprivileged user can trigger this state by lowering an external interface's MTU below IPV6_MIN_MTU, leading to a NULL pointer dereference and kernel panic.

In the Linux kernel, a vulnerability exists in the BPF link iterator. bpf_link_prime() inserts a link into link_idr before the ID is published, and the link iterator takes a reference without checking whether the link is settled (ID zero). If anon_inode_getfile() fails, the iterator is left with a dangling reference and a subsequent bpf_link_put() accesses freed memory (use-after-free).

In the Linux kernel, __vlan_insert_inner_tag() does not require the MAC header to be present before rewriting it. When a very short frame is sent through an IFF_TUN device, subsequent VLAN push operations can pull uninitialized slab bytes into the frame, leaking kernel memory.

In the Linux kernel, the metadata comparison for percpu array BPF maps used as inner maps does not check max_entries. Replacing an inner map with a smaller one bypasses validation, and the index_mask inlined by the JIT can cause an out-of-bounds access to the pptrs[] array.

In the Linux kernel, the xen/netfront driver does not validate the length of the first RX slot against ETH_HLEN before calling eth_type_trans(). If the first slot is shorter than an Ethernet header, a BUG() may occur in __skb_pull() or the header may be read past the end of the data.

In the Linux kernel, a use-after-free vulnerability exists in tcp_send_synack() involving retransmit_skb_hint. When tcp_send_synack() replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original but tp->retransmit_skb_hint still points to the freed object, which can be exploited by an unprivileged TFO client to trigger a use-after-free.

In the Linux kernel, a bug exists in move_hugetlb_page_tables() where the destination address is advanced too far when the source and destination offsets within their page tables differ. This can lead to a kernel panic on x86-64.

In the ep_free function in eventpoll.c, there is a possible use-after-free due to a race condition. This could lead to local privilege escalation with no additional execution privileges needed. User interaction is not needed for exploitation.

A vulnerability in the Linux kernel's xfrm IP-TFS module allows an out-of-bounds stack read in iptfs_skb_reset_frag_walk() due to missing fragment index validation. A crafted AGGFRAG packet can trigger this, causing a system crash or potential information leak.

In the Linux kernel, a flaw in xfrm/iptfs handling of inner packet fragmentation occurs when the start of an inner packet is split across two outer packets such that fewer than 4 bytes land at the end of the first one. This bypasses IP header length validation, leading to a buffer overflow and kernel panic (DoS).

In the Linux kernel, a use-after-free vulnerability was fixed in xfrm_state_netlink() when handling ALLOCSPI requests. xfrm_alloc_userspi() calls alloc_compat() again, but passes the original request skb and its header, which for compat requests causes the 228-byte compat xfrm_userspi_info to be interpreted as the 232-byte native layout and reads four bytes past the declared payload. A multicast clone of the request shares skb_shared_info and can observe that child, and xfrm_user_rcv_msg() frees it after the request handler returns, leading to a race and use-after-free.

A bug was fixed in the Linux kernel xfrm subsystem where xfrm_trans_reinject(), after being converted from a tasklet to a workqueue, ran in process context without an RCU read lock. This caused suspicious RCU usage warnings and potential validity issues for dst and netdevice references of packets queued through the workqueue.

A vulnerability in the Linux kernel's ESP (IPsec) implementation was found on the out-of-place output path, where the skb frag array was mutated without downgrading managed zerocopy frags (SKBFL_MANAGED_FRAG_REFS). This breaks the managed-frag invariant, potentially leading to use-after-free of zerocopy pages and memory leaks.

In the Linux kernel, a vulnerability was fixed in the RDMA/siw driver in siw_accept(). If siw_qp_modify() fails, the QP's state_lock is released before error path cleanup, allowing a concurrent ibv_modify_qp() to transition the QP to ERROR and free the cep structure, leading to use-after-free. The fix clears qp->cep and drops the association reference under the held write lock.

In the Linux kernel's RDMA/rxe subsystem, a vulnerability exists where rxe_rereg_user_mr() reassigns the PD pointer before validating access flags. If validation fails, the MR remains in an inconsistent state, leading to a use-after-free of the PD memory.

In the Linux kernel xfrm subsystem, during bundle creation, a missing reference to net_device leads to a use-after-free when a concurrent interface deletion occurs. The fix reads dst->dev via dst_dev_rcu() and keeps the RCU read-side critical section active until xfrm_fill_dst() takes the required references.

In the Linux kernel firmware arm_scpi subsystem, scpi_dvfs_get_info() does not check the upper bound of the OPP count read from SCP firmware, which can lead to out-of-bounds read and incorrect sizing of the allocated OPP table. The fix rejects both zero and too-large OPP counts, returning -EINVAL.

In the Linux kernel clk scpi subsystem, scpi_dvfs_recalc_rate() does not check the upper bound of the DVFS index returned by dvfs_get_idx(), which can lead to out-of-bounds read and treating garbage as clock frequency. The fix treats indexes greater than or equal to the OPP count as invalid and returns 0.

In the Linux kernel RDMA/rxe subsystem, the HMM_PFN_WRITE check has been restored in ODP write paths. A previous fix removed the access permission test, allowing an unprivileged user to modify read-only pages (e.g., file cache) via RDMA operations, similar to Dirty COW. The fix requires HMM_PFN_WRITE for all write operations, preventing overwriting read-only files.

In the Linux kernel RDMA/core subsystem, ib_get_eth_speed() does not check the registration state of the net_device before invoking the ethtool callback, which can lead to use-after-free during interface unregistration. The fix adds a NETREG_REGISTERED check under RTNL and returns -ENODEV for devices being unregistered.

In the Linux kernel's IB/iser subsystem, a vulnerability allows a remote invalidation of an unregistered direction to cause a null pointer dereference and a general protection fault. The issue affects write commands whose data is sent entirely as immediate data, leaving the descriptor rdma_reg[ISER_DIR_OUT].desc NULL, while iser_check_remote_inv() passes it to iser_inv_desc(), which reads sig_protected from an invalid address.

A use-after-free vulnerability exists in the Linux kernel's IB/isert module. isert_send_done() defers completion handling for certain control PDUs to the isert_comp_wq workqueue, but nothing orders that work against connection teardown, so the queued work can run against memory freed by isert_wait_conn() and iscsit_close_connection().

In the Linux kernel RDMA/bnxt_re subsystem, bnxt_re_init_dcb_wq() ignores a failed allocation of the workqueue, leading to a call to queue_work() on a NULL pointer by the async DCB handler. The fix likely adds an allocation error check.

In the Linux kernel RDMA/rtrs subsystem, a guard was added against null pointer dereference. On error in init_path(), the cleanup code could call event tracing with kobj->name being NULL, causing a crash. A check was added to ensure the name is not NULL before copying.