Linux kernel vulnerabilities

In the Linux kernel, the wifi wilc1000 driver has an out-of-bounds read issue in P2P public action frames. Short frames can lead to reading past the buffer and potentially crashing the system. The fix rejects frames shorter than the P2P public action header before processing.

In the wilc1000 driver in the Linux kernel, there is an out-of-bounds write vulnerability in wilc_wlan_handle_isr_ext(). The RX transfer size taken from the device interrupt status register is not compared against the rx_buffer size, allowing a malicious SDIO device to write data beyond the buffer. The fix drops transfers exceeding the RX buffer size.

In the Linux kernel, the wifi: p54 driver's p54_convert_rev0() and p54_convert_rev1() functions read calibration curve data from the device-supplied EEPROM entry using channel and points-per-channel counts taken verbatim from that same entry. An entry that declares more data than it carries drives an out-of-bounds read past the EEPROM buffer.

In the p54 driver in the Linux kernel, the PDR_INTERFACE_LIST loop only checks that the record start is within the entry before reading an entire struct exp_if. A truncated trailing record causes reads to cross the entry boundary into the heap beyond the EEPROM buffer. The fix advances only while a full record still fits in the entry.

In the mwifiex driver in the Linux kernel, the function mwifiex_search_oui_in_ie() reads a pairwise-cipher (PTK) count from a beacon/probe-response RSN or WPA information element and then walks that many 4-byte OUIs, comparing each with memcmp(). The count comes directly from the attacker-supplied IE and is never checked against the element's length, allowing an out-of-bounds read. The fix bounds the walk to the element length.

In the mwifiex driver in the Linux kernel, the function mwifiex_ret_802_11_scan() subtracts the fixed response fields and the firmware-provided BSS length from resp->size without first proving that either extent fits. A short response or oversized BSS length can underflow tlv_buf_size and make the TLV parser walk beyond the command response. The fix validates that the fixed fields and BSS data fit before deriving the TLV extent.

In the mwifiex driver in the Linux kernel, the function mwifiex_cfg80211_authenticate() derives the authentication frame length from req->ie_len and req->auth_data_len, both of type size_t, but stores it in a u16. The sum can exceed U16_MAX, leading to length truncation and a heap buffer overflow when copying authentication data. The fix computes the length in size_t, rejects values not representable in u16, and only then assigns to pkt_len.

In the Linux kernel's mac80211 subsystem, ieee80211_mesh_preq_size_ok() reads PREQ fields before checking if the element contains even the fixed header. An empty PREQ element causes a one-byte read beyond its declared payload. The fix moves the helper call after both size checks.

In the Linux kernel's mac80211 subsystem, a monitor interface can be set active without a TXQ, leading to a NULL pointer dereference in the ath9k driver. An attacker with CAP_NET_ADMIN can trigger a kernel crash. The fix refuses the flag when there is no queue.

In the Linux kernel's drm/gud driver, gud_plane_atomic_check() has an out-of-bounds write due to incorrect indexing in the property loop. A USB device can trigger the OOB by advertising the maximum number of properties. The fix removes the redundant '+ i'.

In the Linux kernel's drm/msm drivers, msm_ringbuffer and msm_gem_vm objects embed a GPU scheduler that is freed with plain kfree(), while userspace can still access the scheduler name via fences. This leads to a use-after-free reachable unprivileged through SYNC_IOC_FILE_INFO. The fix uses kfree_rcu().

In the Linux kernel's drm/amdgpu driver, amdgpu_pci_remove() calls drm_dev_unplug() before fini_sw(), so iounmap() is skipped, leaking the BAR mapping on each device removal. The fix unmaps unconditionally.

In the Linux kernel's drm/amdgpu driver, amdgpu_amdkfd_clear_kfd_mapping() assumes kfd_dev has a fully populated node array, which is not true when KFD initialization fails. This can lead to NULL pointer dereference during GPU reset. The fix requires the KFD initialization flag.

In the Linux kernel's drm/amdkfd driver, the EOP ring size calculation can underflow in logarithmic calculations, theoretically leading to incorrect configuration. The fix changes the formula to order_base_2(q->eop_ring_buffer_size / 8).

In the Linux kernel's drm/amdkfd driver, the EOP ring size calculation using ffs can underflow, theoretically leading to incorrect configuration. The fix changes the formula to ffs(q->eop_ring_buffer_size / sizeof(unsigned int) / 4).

In the Linux kernel's SMB client, clean_demultiplex_info() does not cancel reconnect work, which can lead to use-after-free when the demultiplex thread exits. The fix cancels reconnect work before freeing the server.

In the Linux kernel's SMB client, the rlist in TCP_Server_Info is incorrectly initialized (NULL pointers instead of self-referencing), causing list_empty() to always return false and list_add() to dereference NULL. Additionally, a race can occur when cifs_signal_cifsd_for_reconnect() is called concurrently. The fix initializes the list correctly and synchronizes access.

In the Linux kernel SMB client, cifs_try_adding_channels() keeps a pointer to the next interface (niface) across the unlocked window while iface_lock is dropped during cifs_ses_add_channel(). A concurrent interface refresh can free that list entry, leading to a use-after-free when reading iface->rdma_capable/is_active and niface->iface_head.next.

In the Linux kernel SMB client, when an RDMA connection is established via smbd_get_connection() but cifs_get_tcp_session() later fails (e.g. kthread_create() error), the error path frees tcp_ses without first destroying the smbd_connection. This leaks the smbd_connection resource.

In the Linux kernel SMB client, receive_encrypted_standard() handling of compound encrypted frames has several issues: next_buffer is not cleared after assignment to server->bigbuf (use-after-free risk), pdu_length is not updated to the decrypted plaintext size, next_cmd values smaller than MID_HEADER_SIZE are not rejected, and there is an integer overflow in the upper bound check.

In the Linux kernel SMB client, move_smb2_ea_to_cifs() has an insufficient while (src_size > 0) loop condition that allows iteration when the remaining size is too small for a complete smb2_ea_info structure. This leads to out-of-bounds reads of ea_name_length and ea_value_length fields.

In the Linux kernel SMB client, smb3_enum_snapshots() sets ret_data_len to sizeof(struct smb_snapshot_array) without verifying the actual server reply length when snapshot_array_size is smaller than GMT_TOKEN_SIZE. A short reply makes ret_data_len exceed retbuf size, and the subsequent copy_to_user() reads past the end of the buffer.

In the Linux kernel SMB client, cifs_query_reparse_point() only checks that the start pointer is within the response (start >= end) but does not verify there is enough space for the fixed 8-byte header of the reparse_data_buffer structure. If a server provides a DataOffset leaving less than 8 bytes, reads of ReparseTag and ReparseDataLength occur out-of-bounds.

In the Linux kernel SMB client, receive_encrypted_standard() leaves server->total_read at the full decrypted frame size while walking sub-PDUs of a compound encrypted frame. This causes cifs_handle_standard() to pass the full size to smb2_check_message(), allowing truncated non-last sub-PDUs to bypass length validation and leading to out-of-bounds reads in smb2_get_data_area_len().

In the Linux kernel, KVM x86/mmu's kvm_gfn_is_write_tracked() only checks the supplied memslot, but page tracking is per-address-space and shadow pages are shared across address spaces. With SMM, a GFN can be write-tracked in one address space and appear untracked in another. The fix checks the supplied slot first, then the slot for the other address space, preventing mmu_try_to_unsync_pages() from marking an upper-level shadow page unsync and triggering a BUG in pte_list_remove().

A vulnerability was found in the Linux kernel's cgroup subsystem, involving iteration over dying tasks with a zero reference count. This leads to a race condition where the iterator may access a task after it has been freed, resulting in a use-after-free.

In the Linux kernel, the smb2_tree_connect() function of the SMB server (ksmbd) leaks a tree connection. When ksmbd_iov_pin_rsp() fails, the newly created tree connection is not disconnected, leading to a resource leak.

In the Linux kernel, the nvdimm (pmem) pmem_submit_bio() function records a REQ_PREFLUSH error but continues to copy bio data and can later overwrite the error with a successful REQ_FUA flush. This allows data writes to run after a failed preflush and can complete the bio successfully despite the failed ordering barrier.

In the Linux kernel, the staging rtl8723bs driver's rtw_sdio_if1_init() function frees padapter->HalData with kfree(), even though it was allocated via vzalloc(). Using kfree() to release a vmalloc-backed buffer can lead to memory corruption.

In the Linux kernel, the USB Type-C (ucsi) subsystem's ucsi_register() creates per-instance debugfs entries, but ucsi_unregister() keeps them until ucsi_destroy(). Drivers like ucsi_glink that unregister/register the same UCSI instance across remoteproc restart then try to create an already existing debugfs directory.

In the Linux kernel, the iwlwifi (mei) driver's iwl_mei_write_cyclic_buf() function receives an incorrect first argument — the q_head pointer is passed instead of cldev. The bug has been fixed.

In the Linux kernel, the drm/msm driver does not safely retire a hung submit before GPU recovery completes. Retiring the submit triggers BO free, which can result in GPU pagefaults since the GPU may be actively accessing those BOs.

In the Linux kernel, a bug was fixed where the BPF_REFCOUNT field was not marked as unique, although it should be. The fix addresses this oversight.

In the Linux kernel, a bug in the ext4 filesystem related to transaction overflow during writeback was fixed. A previous fix was too eager in reducing reserved transaction credits, leading to insufficient reservation in some corner cases. The fix uses ext4_meta_trans_blocks() for a correct upper bound estimate.

In the Linux kernel, a problem in the ACPI subsystem was fixed where the use of acpi_get_first_physical_node() in acpi_platform_fill_resource() and acpi_create_platform_device() was unsafe because the returned device could be freed at any time. The fix replaces it with acpi_bus_get_primary_device() and adjusts the code to call it only once.

In the Linux kernel, a memory leak in the HSR (High-availability Seamless Redundancy) module was fixed. When hsr_dev_finalize() fails after registering an RX handler, dynamic nodes learned in that window are not released. The fix frees both dynamic databases in the error unwind path.

In the Linux kernel, a bug in the netfilter nf_nat_sip module was fixed where the offset was not rewound when NAT shrinks the packet. If map_addr() changes the packet length, coff may point to an incorrect position, potentially causing subsequent Contact headers to be skipped and leaking internal network details.

In the Linux kernel, the wifi mt76 (mt7921) driver lacks validation of CLC firmware records. The loader trusts the region count and each record length, so a malformed image can make the region table pointer precede the firmware buffer, make the record loop fail to advance, or index phy->clc past its end.

In the Linux kernel, a vulnerability in ppp_async causes the error path to zero the skb headroom, violating the NET_SKB_PAD guarantee. As a result, a subsequent frame can be processed without the required headroom, leading to a kernel panic (skb_under_panic) or an out-of-bounds read when CCP compression is enabled.

In the Linux kernel, the EDAC/device_sysfs poll_msec sysfs store file uses simple_strtoul(), which accepts an unsigned long, while the target field poll_msec is an unsigned int. On 64-bit systems, a value greater than UINT_MAX is silently truncated when stored.

In the Linux kernel, the drm/virtio (virtio-gpu) driver on Xen PV domains incorrectly decides whether to use the DMA API by looking only at the VIRTIO_F_ACCESS_PLATFORM feature bit. Because QEMU does not set iommu_platform on virtio-vga by default, virtio_gpu_object_shmem_init() describes the framebuffer's backing pages to the host using sg_phys() with guest-physical addresses, which in a PV domain resolve to pages belonging to another domain.

In the Linux kernel, the accel/qaic driver's resp_worker() skips the bounds checking present in decode_message(), which can lead to reading past the end of a slab allocation, infinite loops, or kernel panics. A malformed wire message sent from the device is required for these issues to occur.

In the Linux kernel, the nvme-rdma driver's queue_rq path on -EIO reports a host path error and then still cleans up the command and unmaps the SQE DMA. Because the path error helper completes the request, this results in double cleanup and DMA unmap after the request is already complete.

In the Linux kernel, nvme_query_fdp_info() is called per-path and populates head->nr_plids/head->plids for FDP registration, but nothing protects that pair from concurrent access. Two paths scanning the same namespace can race to populate it.

In the Linux kernel, the nvmet-rdma module has a resource leak. When pending disconnecting queues exceed the backlog limit, the connect path only drops the device reference and leaks the newly allocated queue and its IB resources.

A bug exists in the Linux kernel BPF verifier regarding speculative pointer arithmetic. When processing a pointer addition (r0 += r1), the register state is snapshotted while var_off and the 32-bit range are out of sync, triggering a register invariants violation warning. The issue affects unprivileged programs and was fixed by moving the __mark_reg32_unbounded() call after sanitize_ptr_alu().

In the Linux kernel, the BPF subsystem's bpf_map_check_op_flags() compares the CPU ID against num_possible_cpus() instead of nr_cpu_ids and cpu_possible(). With sparse CPU IDs (e.g. mask 0,2-3), invalid CPU 1 is accepted while valid CPU 3 is rejected, leading to a kernel paging fault and panic.

In the Linux kernel, the BPF subsystem's per-CPU map update paths (array, hash, cgroup storage) without BPF_F_CPU or BPF_F_ALL_CPUS use the logical CPU ID to compute the buffer offset instead of a dense offset. With sparse CPU IDs (e.g. mask 0,2-3), this causes incorrect per-CPU values and an out-of-bounds read from the update buffer for CPU3.

In the Linux kernel, the drm/gud driver does not validate that the GUD_ROTATION_0 flag is present in the device's supported rotation bitmask. A device that omits this bit from GUD_PROPERTY_ROTATION triggers the WARN_ON in drm_plane_create_rotation_property().

In the Linux kernel, the printk subsystem incorrectly uses WARN_ON() to catch kthread_run() failure, since __kthread_create_on_node() returns -EINTR upon SIGKILL. This causes spurious kernel warnings under normal conditions.