Linux kernel vulnerabilities

In the Linux kernel's btrfs filesystem, there is a use-after-free vulnerability during RAID stripe insertion. If allocation of a RAID stripe extent fails, btrfs_insert_one_raid_extent() aborts and ends the transaction before returning -ENOMEM. The caller still owns the transaction handle and on error handling ends the transaction again, potentially leading to use-after-free.

In the Linux kernel's btrfs filesystem, there is a memory leak of the bioc structure on the bioc_list of an ordered_extent. The bug can occur during RAID extent insertion or when an ordered extent encounters an I/O error, causing the bioc to not be freed.

In the Linux kernel's btrfs filesystem (zoned mode), there is a bug in do_zone_finish(): if call_zone_finish() fails, the block group remains on the zone_active_bgs list, leading to reference leak, never waking waiters, and spinning in btrfs_zoned_activate_one_bg().

In the Linux kernel's zstd compression for btrfs, there is a lost wakeup bug in zstd_get_workspace(). A writer can sleep forever even though a workspace is free, due to not re-checking the pool after prepare_to_wait().

In the Linux kernel's IPVS, there is a bug with reversed argument order in sequence serialization for version 1 sync. This leaves 24 bytes of the message unwritten, potentially disclosing stale heap data and replacing the live connection sequence state with values read from the buffer.

In the Linux kernel's netfilter nf_conntrack_sip module, there is an out-of-bounds read vulnerability in sip_skip_whitespace(). The function returns dptr unchanged when its loop exhausts the buffer, instead of NULL, leading to a read one byte past the buffer when a SIP header ends with spaces/tabs without a colon.

A use-after-free vulnerability exists in the Linux kernel's tracing/probes subsystem. Fields of a probe-based dynamic event (kprobe, uprobe, eprobe, fprobe) store pointers to argument name/type strings that are freed when the defining probe is removed, even though the event persists due to other probes. Any field lookup, such as setting a filter, then reads freed memory.

In the Linux kernel, a vulnerability in the BPF mechanism allows referencing the main program as a pseudo-function (BPF_PSEUDO_FUNC). Such an address is not properly rewritten, which can lead to a function call at a bogus address.

In the Linux kernel, a vulnerability in the bonding driver involves prematurely clearing the curr_active_slave pointer when releasing all interfaces. This can lead to a promiscuous mode leak on the physical device after bond teardown.

The Linux kernel has an issue in __dev_change_net_namespace() where conflicting alternative names (altnames) of network devices are not removed when changing network namespaces. This leads to a warning in cfg80211_pernet_exit() when removing a non-root namespace if two devices share the same altname. The vulnerability occurs when a device in init_net has a conflicting altname with a device in the dying namespace.

In the Linux kernel, release_in_xmit() in net/rds uses clear_bit_unlock() without a full memory barrier before checking waitqueue_active(). This can cause a lost wake-up for threads waiting in rds_conn_shutdown() and rds_tcp_reset_callbacks().

In the Linux kernel RDS subsystem, a data race was found in rds_conn_path_reset(), which clears the entire cp_flags word with a plain store while other operations use atomic bitops. This can lead to lost flag updates, destabilizing RDS connection management.

A vulnerability was fixed in the Linux kernel's net/rds module. The rds_tcp_reset_callbacks() function quiesced the transmit path by waiting for RDS_IN_XMIT to be sampled clear instead of taking the lock, which on weakly ordered architectures could allow the transmit path to run concurrently with the reset of cp_xmit_* state.

In the Linux kernel, a flaw was fixed in net/rds where rds_conn_shutdown() only sampled the RDS_IN_XMIT and RDS_RECV_REFILL flags as clear instead of acquiring their locks. On weakly ordered architectures, the transmit path could re-acquire the bit and run concurrently with connection teardown, causing a race and state corruption. The fix acquires both fastpath locks before transport shutdown and releases them after rds_conn_path_reset().

In the Linux kernel RDS subsystem, a vulnerability was found where rds_conn_shutdown() can consume a concurrent drop, leading to a wedged connection path in RDS_CONN_DOWN. The race between connection teardown and socket acceptance can leave sockets established but never torn down, causing receive queue growth and connection stalls.

A vulnerability was found in the Linux kernel's EROFS filesystem related to LZ4 decompression. The 'rolling decompression' optimization can lead to data corruption because the LZ4 implementation may copy literals backward, breaking the algorithm's assumptions. The vulnerability is fixed by temporarily disabling this optimization.

In the ALSA caiaq driver in the Linux kernel, a vulnerability involves a potential double-free during error handling. Resources such as URBs may be freed multiple times, leading to improper memory management.

A vulnerability in the Linux kernel BPF subsystem allows creating a hash map with key-less BTF (btf_key_type_id == 0). After htab and rhtab gained ->map_check_btf callbacks, validation no longer rejected such maps, leading to a NULL pointer dereference in btf_type_show() when the map is read via bpffs. This results in a kernel oops.

In the Linux kernel, btf_modifier_show() unconditionally calls show() for the resolved type, but for the void type (type_id 0, BTF_KIND_UNKN) there is no entry in kind_ops[], so the show pointer is NULL. A BPF program passing a "const void" type_id from vmlinux BTF to bpf_snprintf_btf() triggers a NULL dereference. The fix falls back to btf_df_show() with the "<unsupported kind:N>" placeholder.

In the Linux kernel, btf_var_show() unconditionally calls btf_type_id_resolve(), which dereferences btf->resolved_ids, which is NULL for a base BTF (e.g., vmlinux BTF). A BPF program passing a BTF_KIND_VAR type_id from vmlinux BTF to bpf_snprintf_btf() triggers a NULL dereference. The fix resolves the var's type directly with btf_type_skip_modifiers() when resolved_ids is NULL.

In the Linux kernel, the signal_generate and signal_deliver tracepoints declare their info argument as a struct kernel_siginfo pointer, so btf_ctx_access() treats it as a trusted pointer for tp_btf programs. However, signal delivery uses SEND_SIG_NOINFO (0) and SEND_SIG_PRIV (1) as special values that are not pointers. A tp_btf program can dereference these values and fault the kernel, and signal_generate can run from timer interrupt context, leading to a kernel panic.

In the Linux kernel, a tail call from a non-zero frame is modeled as a return from that frame, and the verifier makes R0 unknown and calls prepare_func_exit(). When the current frame is a synchronous callback, prepare_func_exit() enforces the callback return-value contract and marks R0 precise, triggering the "callback unexpected regs" verifier bug. A CAP_BPF task can cause a WARN and an -EFAULT BPF_PROG_LOAD. The fix rejects a tail call made directly by a callback.

In the Linux kernel, __bpf_rbtree_add() keeps parent and link pointers live across calls to the program-supplied comparison callback, so the verifier requires the root's lock to remain held throughout the callback. The helper path enforces this rule for bpf_spin_lock() and bpf_spin_unlock(), but the resilient lock kfunc argument path does not. A callback can release the root lock and let another CPU remove and free the node referenced by the in-progress tree walk, leading to use of freed pointers.

In the Linux kernel, do_wait() passes wo->wo_pid to the sched_process_wait tracepoint, but kernel_wait4() leaves wo_pid NULL for wait4(-1), and kernel_waitid_prepare() does likewise for waitid(P_ALL). btf_ctx_access() types argument 0 as PTR_TO_BTF_ID | PTR_TRUSTED without PTR_MAYBE_NULL, so the verifier accepts an unchecked dereference. Since trusted pointer loads have no fault protection, a wait for any child can cause a NULL pointer dereference in JITed BPF code. The fix marks argument 0 as nullable.

In the Linux kernel, bpf_sys_bpf() and bpf_sys_close() can sleep (e.g., via mutexes, GFP_KERNEL allocations, waiting for an RCU grace period), but they lack .might_sleep on their prototypes. They are limited to BPF_PROG_TYPE_SYSCALL, whose main program is sleepable, but a bpf_timer callback registered by a syscall program is checked in a non-sleepable context. Such a callback can invoke bpf_sys_bpf() from hrtimer softirq context and trigger a scheduling-while-atomic failure. The fix sets .might_sleep on both prototypes.

In the Linux kernel, the persistent ring buffer validation code used meta->nr_subbufs without ensuring it matched nr_pages + 1, assuming the two were the same. The fix adds a check in the validation code to ensure the saved nr_subbufs matches what is expected.

In the Linux kernel, nvme_scan_ns_list() drops stale namespaces in each gap of the reported NSID list one NSID at a time, calling nvme_find_get_ns() in each iteration. Since NSIDs are 32-bit, a sparse NSID space can make a single gap spin the loop billions of times with nothing to remove, leading to a soft lockup. The fix renames nvme_remove_invalid_namespaces() to nvme_remove_nsid_range() with an open (start, end) NSID range, bounding the work by the namespaces actually present.

In the Linux kernel, the ASoC Intel AVS driver's snd_hdac_ext_bus_get_ml_capabilities() may fail and its return code was not checked in avs_pci_probe(). Additionally, if a later part of avs_pci_probe() failed, the hlink list was not cleaned up before leaving the scope.

In the Linux kernel, the ASoC Intel AVS driver's strace_open() invokes try_module_get(), which on success takes a module reference. If any follow-up operation causes strace_open() to fail, the reference count is not released, resulting in an unbalanced state.

In the Linux kernel, the ASoC Intel AVS driver accesses entries in the init_configs array using indexes from the config_ids array, which are bounded by num_config_ids rather than num_init_configs. Using an ID greater than or equal to num_init_configs leads to an out-of-bounds access in avs_path_module_send_init_configs().

In the Linux kernel, the bcmasp network driver's bcmasp_xmit() only set txcb->last = true for the final fragment of an SKB, leaving the field untouched for non-final fragments. If a descriptor slot was reused while still holding a stale true from a previous SKB, bcmasp_tx_reclaim() could prematurely free the sk_buff while its remaining fragments were still in flight.

In the Linux kernel, the bcmasp network driver's tx_spb_ring_full() initialized next_index from intf->tx_spb_index on every loop iteration, so incr_ring() always produced the same result and only one slot was ever tested. This caused incorrect checking of consecutive descriptor slot availability before transmission.

In the Linux kernel's BPF subsystem, is_cmpxchg_insn() matches only BPF_MODE == BPF_ATOMIC, so an arena cmpxchg misses the required zero extension for a 32-bit operation. This can lead to incorrect values in the destination register on architectures requiring explicit zero extension.

In the Linux kernel's BPF subsystem, mark_fastcall_pattern_for_call() must ensure that a matched "spill; call; fill" instruction series is not interrupted by a jump. Otherwise the rewrite applied by bpf_remove_fastcall_spills_fills() is unsound. The fix records instructions targeted by jumps in insn_aux_data[*].jump_target and uses this flag to stop growing a pattern.

In the Linux kernel's BPF subsystem, in_rbtree_lock_required_cb() only checks the innermost verifier frame, so rbtree callback restrictions disappear in a nested static subprogram call frame. The subprogram can unlock the tree, remove and drop the node being compared, then relock, leading to freed memory being linked into the tree.

In the Linux kernel's BPF subsystem, bpf_btf_find_by_name_kind() returns a new BTF object fd through __btf_new_fd(), which reaches anon_inode_getfd() that can sleep while allocating or expanding the current task fd table. The helper prototype does not set might_sleep, so the verifier allows the helper in non-sleepable contexts such as BPF timer callbacks.

In the Linux kernel, a BPF verifier vulnerability affects stack helpers that may block on filesystem reads (e.g., resolving build IDs) but were not marked as sleepable. The verifier could still allow these helpers from non-sleepable regions such as RCU or preemption-disabled sections.

In the Linux kernel, the BPF verifier mishandled legacy packet-load instructions (BPF_LD_ABS/BPF_LD_IND) reached from callbacks, triggering a verifier bug warning and an -EFAULT on BPF_PROG_LOAD. A privileged program loader could trigger this issue.

In the Linux kernel, the BPF verifier incorrectly inferred that a pointer with an unbounded offset is non-NULL based solely on its type. As a result, a BPF program could pass verification while a NULL pointer dereference occurred at runtime.

In the Linux kernel, the BPF verifier could resurrect a scalar id dropped by collect_linked_regs() because snapshots of compared registers were taken before linked registers were collected. This could lead to range inconsistencies and precision propagation issues.

In the Linux kernel, the BPF verifier incorrectly predicted the outcome of pointer vs zero comparisons in JMP32 instructions, failing to distinguish BPF_JMP from BPF_JMP32 comparisons. This led to incorrect inference that a jump is always taken.

In the Linux kernel, the BPF verifier did not mark the zero register as precise for a register-form NULL check. As a result, one path was pruned and the program could dereference a zero pointer at runtime.

In the Linux kernel, the BPF verifier did not require the MEM_PERCPU flag for stores to percpu kptr fields, accepting both plain bpf_obj_new() allocations and kernel pointers. This could lead to arbitrary kernel read/write or invalid address relocation.

In the Linux kernel, the BPF verifier incorrectly classified borrowed RCU kptr references as owning references, thus not requiring a NULL check. At runtime refcount_inc_not_zero() could return NULL while the verifier treated the result as non-NULL.

In the Linux kernel, the BPF verifier treated PTR_UNTRUSTED pointers with the MEM_ALLOC flag as live allocated objects even though their lifetime is no longer protected. The bpf_refcount_acquire() function could then dereference NULL or stale memory.

In the Linux kernel, rhtab_map_update_elem() reinitialized special fields in recycled map elements, clearing the only pointer to a timer. As a result, the timer could fire with its key and value pointing into freed memory.

A vulnerability in the Linux kernel BPF subsystem related to rhtab maps was fixed. The functions rhtab_map_update_existing() and rhtab_delete_elem() called bpf_obj_free_fields(), which could be unsafe in NMI context. The fix uses bpf_obj_cancel_fields() to cancel only asynchronous fields, leaving referenced kptr release to the allocation destructor.

A vulnerability in the Linux kernel BPF verifier regarding stores to kptr fields was fixed. The function check_map_kptr_access() allowed a scalar store into an untrusted kptr field only when the register was known to be zero, but did not mark that register as precise. This could allow bypassing the verifier and writing attacker-controlled data into the kptr field.

A vulnerability in the Linux kernel BPF subsystem regarding inner map identity in callback frames was fixed. Callback frame constructors cleared the map_uid field, preventing distinction between inner maps sharing an inner_map_meta template. This could lead to use-after-free of a map.

A vulnerability in the Linux kernel tracing subsystem regarding subbuffer resize races was fixed. Concurrent subbuffer resizes could crash trace_pipe_raw readers or leak uninitialized memory to userspace. The fix modifies ring_buffer_alloc_read_page() and adds a new ring_buffer_read_page_size() function.