Linux kernel vulnerabilities

In the Linux kernel, the accel/amdxdna driver's struct amdxdna_cmd_chain contains a flexible array annotated with __counted_by(command_count). Since the structure is stored in shared AMDXDNA_BO_SHARE memory, userspace can concurrently change command_count to zero, causing the bounds check to fail and triggering a kernel panic.

In the Linux kernel, the accel/amdxdna driver allows a command chain with command_count zero to pass the payload length check, and the fill loop does not run. On firmware without AIE2_NPU_COMMAND the request is rejected, but on firmware with aie2_get_npu_chain_msg_op() it reaches drm_clflush_virt_range(cmd_buf, 0), reading the byte before the buffer and faulting on the vmap guard page.

In the Linux kernel, the accel/amdxdna driver's amdxdna_cmd_set_error() takes a reference to the first BO of a command chain but fails to drop it on the mapping failure path, leaking the reference. The path is reachable when the BO handle is recycled by userspace after submission and a dma-buf without a vmap implementation is imported onto the same id.

In the Linux kernel, the accel/ethosu driver reads bits 15:14 of NPU_SET_{IFM,OFM}_PRECISION as an activation storage mode, but on U65 the same field holds the rounding mode. This causes valid U65 command streams to fail CMDSTREAM_BO_CREATE with -EINVAL and produces bogus feature map size calculations.

In the Linux kernel, the drm/cirrus-qemu driver did not validate the BAR0 size during PCI probe. If a PCI device with BAR0 smaller than 4 MB (CIRRUS_VRAM_SIZE) was bound to the driver, the mapped VRAM was smaller than expected, allowing framebuffers larger than the mapped memory to be created and copied out of bounds, causing a supervisor write page fault.

A vulnerability in the Linux kernel BPF verifier allows it to incorrectly infer that a pointer is non-null. The bug occurs when comparing two pointers where one has a type without the PTR_MAYBE_NULL flag but can still be NULL at runtime. As a result, the verifier fails to catch a null pointer dereference, potentially leading to a crash or unauthorized code execution.

In the Linux kernel, the BPF verifier could incorrectly downgrade scalar zero spills to STACK_ZERO when part of the spilled bytes were already dead. This broke precision propagation chains and could lead to incorrect verification of BPF programs. The fix simply avoids converting zero spills to STACK_ZERO.

In the Linux kernel's stmmac network driver, stmmac_tso_xmit() failed to unmap DMA mappings created for the linear part and earlier fragments of an skb when mapping a subsequent fragment failed. This led to a DMA mapping leak. The fix releases descriptors and DMA mappings using stmmac_free_tx_buffer() and stmmac_release_tx_desc().

In the Linux kernel's SCTP_CMD_TIMER_START handling, a TOCTOU race exists: checking timer_pending() before timer_reduce() can allow the timer to expire and detach between these operations. Then timer_reduce() rearms the timer without taking the association reference, leading to an unbalanced reference count and use-after-free during association teardown. The fix uses the return value of timer_reduce() to determine whether the timer was actually armed.

In the Linux kernel's scsi mpi3mr driver, mpi3mr_sas_port_add() does not check the NULL return value from sas_port_alloc_num() on memory allocation failure, leading to a NULL pointer dereference. Additionally, if sas_port_add() fails, the allocated port is not freed, leaking the sas_port structure. The fix adds a NULL check and calls sas_port_free().

In the Linux kernel's scsi mpi3mr driver, mpi3mr_sas_port_add() does not release the target device (tgtdev) reference in the out_fail error path if the reference was previously acquired by mpi3mr_get_tgtdev_by_addr(). This leads to a reference count leak and prevents the target device structure from being freed. The fix adds a tgtdev put in the out_fail path guarded by a NULL check.

In the Linux kernel's SMB client, smb3_insert_range() does not check whether the new file size (i_size + len) is valid. This allows FALLOC_FL_INSERT_RANGE to bypass RLIMIT_FSIZE, exceed s_maxbytes, or produce a size outside the loff_t range. The fix uses check_add_overflow() to calculate the new EOF and validates it with inode_newsize_ok().

In the Linux kernel SMB client, smb3_zero_range() may extend a file's EOF without checking RLIMIT_FSIZE when FALLOC_FL_ZERO_RANGE is used without FALLOC_FL_KEEP_SIZE. The fix calls inode_newsize_ok() before sending the zero-range request when the operation would extend EOF.

A vulnerability in the Linux kernel's SCTP implementation causes a soft lockup due to inconsistent parameter iteration in ASCONF-ACK handling. A crafted ASCONF-ACK packet can trigger an infinite loop in softirq context, leading to a remote denial of service. Additionally, missing length validation for SCTP_PARAM_ERR_CAUSE allows an out-of-bounds read.

A use-after-free vulnerability exists in the Linux kernel's vxlan_mdb_remote_src_del() function related to VXLAN MDB entry handling. The vxlan_mdb_is_valid_source() function accepts an all-zeros source address, allowing aliasing of (*, G) and (S, G) entry keys, which leads to freeing and then reusing the same memory entry.

In the Linux kernel msc313e watchdog driver, msc313e_wdt_probe() does not set the platform device driver data, so dev_get_drvdata() in msc313e_wdt_suspend() and msc313e_wdt_resume() returns NULL, leading to a NULL pointer dereference. The fix sets the platform device driver data in msc313e_wdt_probe().

In the Linux kernel netfs subsystem, a subrequest reference leak occurs in netfs_unbuffered_write() when subreq->io_iter ends up zero length during preparation. The fix addresses this reference leak.

In the Linux kernel netfs subsystem, when netfs_alloc_subrequest() fails, subreq is NULL, and netfs_prepare_write() then tries to initialize its members, leading to a NULL pointer dereference. The fix properly handles the netfs_prepare_write() error.

A vulnerability was found in the Linux kernel's netfs subsystem related to readahead synchronization. The issue arises from the application thread adding folios to the rolling buffer while the collector thread processes them, potentially causing errors in determining folio order. The fix loads all folios selected by the VM upfront and drops references after I/O starts.

In the Linux kernel cachefiles subsystem, trace_cachefiles_coherency() is passed a pointer to a __be64 overlaid on variable-length coherency data (which may even be 0 bytes), potentially leading to a UAF or KASAN warning. The fix ensures the buffer has room for at least 8 pre-cleared bytes and extracts the data as four 2-byte words.

In the Linux kernel, ksmbd during logoff did not wait for all channels of an SMB3 multichannel session before freeing shared session objects. Added safe draining that wakes blocked byte-range locks, invokes cancellation callbacks for CANCEL requests, and serializes session teardown with channel registration.

In the Linux kernel, parse_dacl() in ksmbd silently accepted truncated ACEs and allocation failures, allowing set_info_sec() to continue with an incomplete ACL conversion. The fix propagates parsing and allocation errors to parse_sec_desc() so malformed security descriptors are rejected before inode attributes or ACL xattrs are updated.

In the Linux kernel, ksmbd allows a client to include many structurally valid but unmapped SIDs in a DACL, causing hundreds of kernel error messages per request. The fix rate-limits the logging of these mapping failures.

In the Linux kernel, the ksmbd listener thread exits when its listening socket is shut down. The netdevice notifier shuts down the socket before calling kthread_stop(), so the task_struct can be freed before kthread_stop() gets its reference. The fix creates the listener in a stopped state and holds an extra task_struct reference until kthread_stop_put() completes.

In the Linux kernel, the Bluetooth btintel driver's btintel_parse_version_tlv() does not ensure the TLV value is long enough for the specific type, potentially causing an out-of-bounds read via get_unaligned_le16(), get_unaligned_le32(), or memcpy(). The fix rejects values shorter than the minimum required by each known TLV type and also rejects responses without the Command Complete Status field.

In the Linux kernel, the Bluetooth btintel driver treats the firmware ID as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf() can read beyond the received response. The fix limits the conversion to the advertised TLV value length.

A vulnerability in the Linux kernel's Bluetooth subsystem (hci_core) involves a race condition during device registration. The power_on work item is queued before full initialization, and concurrent execution can lead to using an uninitialized mutex in msft_do_close(), triggering DEBUG_LOCKS warnings and potential instability.

In the Linux kernel, Bluetooth L2CAP's l2cap_le_connect_req() left the channel mode at the default, causing FLAG_DEFER_SETUP channels to reply to L2CAP_LE_CONN_REQ with L2CAP_ECRED_CONN_RSP, which is incorrect. This can lead to an out-of-bounds write in l2cap_ecred_rsp_defer(). The fix sets chan->mode correctly and adds a channel mode check with WARN_ON_ONCE instead of an OOB write.

In the Linux kernel, Bluetooth L2CAP's l2cap_chan_connect() checks the limit of pending ECRED channels, but only counts deferred channels. If 6 L2CAP sockets are connected at the same time in order DDDDND (D=deferred, N=non-deferred), the last can exceed the limit, causing an out-of-bounds write in the scid array and sending an invalid ECRED_CONN_REQ. The fix accounts for non-deferred pending channels in the counting and adds a WARN_ON_ONCE check.

A flaw in the Linux kernel's drm/pagemap subsystem allows the same device-private folio to be migrated twice. If a folio is being migrated from device memory to system memory, the raw-PFN eviction path can select the same folio and attempt migration again. This leaves an uncharged folio on an LRU list, causing folio_lruvec_lock_irqsave() to retry indefinitely, resulting in a soft lockup and RCU stall.

In the Linux kernel, the oa_tc6 driver's error recovery was improved for oversubscribed traffic. When the skb buffer lacks tailroom for incoming data, the frame is abandoned and the driver looks for a new frame. SK buffer allocation errors are now considered recoverable.

In the Linux kernel, the ip_sf_list structure in IGMP was converted to RCU. This fix eliminates a potential deadlock and lockdep warnings that occurred when ip_check_mc_rcu() tried to acquire a lock already held on the same CPU.

In the Linux kernel, a bug in ip6_mc_del1_src() related to RCU lists in IPv6 multicast was fixed. Previously, when a source filter was removed, the pointer was mutated before the grace period, which could cause concurrent readers to see the tombstone list instead of the proper source list.

In the Linux kernel, ip6_mc_source() in IPv6 multicast was changed to use copy-on-write RCU updates. Previously, modifications to the source filter list were done in-place, which could lead to torn IPv6 addresses or duplicated/missed entries for concurrent readers.

In the Linux kernel, several places in IPv6 multicast where RCU-protected lists were updated without rcu_assign_pointer() were fixed. The fix ensures consistent use of rcu_assign_pointer() along with appropriate dereference helpers.

In the Linux kernel, a vulnerability in the TIPC module was fixed where exceeding the TIPC_MAX_PUBL (65535) limit of local service publications prevented protocol service types (node state, link state) from being inserted into the name table. This caused missing event notifications and a NULL pointer dereference in tipc_named_node_up() when the publication list was empty.

In the Linux kernel, a problem in TIPC where random pad bytes were sent in RESET/ACTIVATE messages was fixed. Previously, strcpy() was used, which could send random data from the skb buffer to the remote system. Now memcpy() is used, which copies zeroed pad bytes.

In the Linux kernel, a problem in IPv6 Segment Routing where the network header was not properly restored before routing and forwarding was fixed. Previously, when the SRH did not immediately follow the IPv6 header, the network offset could be negative, potentially leading to buffer overflows during forwarding.

In the Linux kernel, tpacket_parse_header() in the af_packet subsystem cast the user-provided tpacket_hdr.tp_len (u32) to int. A value larger than INT_MAX became negative, passed the size check, and was returned up to sock_sendmsg_nosec(), triggering BUG().

In the Linux kernel, the fbtft staging driver's dirty_lock was not IRQ-safe. fbtft_mkdirty() can be reached from the fbcon rendering path in hardirq context, while fbtft_deferred_io() takes the same lock in workqueue context with local interrupts enabled, leading to a possible lock inversion and deadlock.

In the Linux kernel, the ASoC fsl_micfil driver's hw_params() and hw_free() enabled and disabled the mclk clock without balancing. The PCM core does not guarantee 1:1 pairing, so hw_free() can run without hw_params(), and hw_params() can be called multiple times, causing an "already disabled" warning or an enable reference leak.

In the Linux kernel, the ASoC amd yc driver's acp6x_pdm_dma_close() does not free the runtime->private_data buffer allocated in acp6x_pdm_dma_open(). The missing kfree causes a memory leak.

In the Linux kernel, in the btrfs filesystem, when creating the first metadata chunk for a sprout filesystem, create_chunk() adds the new device to the transaction dev_update_list. If the subsequent system chunk creation fails, btrfs_init_new_device() aborts the transaction and releases the device while post_commit_list is still linked, causing a warning and leaving the transaction list referencing freed memory.

In the Linux kernel, in the btrfs filesystem, btrfs_init_new_device() switches latest_dev and possibly s_bdev from the seed device to the new sprout device before creating the first writable chunks. If chunk creation or the subsequent sprout setup fails, the error path releases the new device without switching those pointers back, so btrfs_show_devname() can dereference the freed latest_dev and crash.

In the Linux kernel, the bonding module (alb mode) function alb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers, but in transmit paths (e.g. packets sent via AF_PACKET / raw sockets or forwarded packets) skb->transport_header is not guaranteed to be initialized. pskb_network_may_pull() does not set the transport header offset, so dereferencing icmp6_hdr(skb) can access out-of-bounds memory.

In the Linux kernel, the scsi mpt3sas driver's _base_assign_reply_queues() calls cpumask_of_node() with the value returned by dev_to_node(), which can be NUMA_NO_NODE (-1) on systems without NUMA topology information for the PCI device. Passing -1 to cpumask_of_node() causes an out-of-bounds array read of node_to_cpumask_map[-1], caught by UBSAN.

In the Linux kernel, a bug in the real-time scheduler (sched/rt,dl) causes RT tasks with migrate_disable() to remain on the pushable tasks list (rq->rt.pushable_tasks) even though they cannot be moved to another CPU. As a result, the RT balancer repeatedly attempts to push such a task, fails every time, and wastes CPU time — in the described case, 37 ms out of an 89 ms window was consumed by failed push attempts.

In the Linux kernel, in the ALSA ump subsystem, snd_ump_parse_endpoint() sets ump->parsed on every exit, including error, before the caller attaches the legacy rawmidi device. ump_handle_ep_name_msg() then treats parsed as "legacy_rmidi is live" and calls ump_legacy_set_rawmidi_name(), which snprintf()s into ump->legacy_rmidi->name. If a UMP packet arrives in that window (IRQ path from snd_ump_receive), legacy_rmidi is still NULL, causing a null-ptr-deref in snprintf.

In the Linux kernel, the precision backtracking mechanism for BPF_LD | BPF_{IND,ABS} instructions did not handle the implicit exit from a subprogram. This caused backtracking to continue in the caller frame while processing instructions in the callee frame, leading to segmentation faults or unsound state pruning.

In the Linux kernel, the precision backtracking for bpf_loop() calls had a bug: on the second visit of the call, the precision of register R1 (loop counter) was reset by processing the preceding BPF_EXIT. This resulted in injecting a checkpoint without R1 marked as precise, potentially allowing the verifier to accept unsafe programs.