Linux kernel vulnerabilities

A vulnerability has been identified in the Linux kernel related to incorrect length checking of the response authenticator in the rxgk_verify_response() function. This flaw allows oversized authenticators to be accepted, potentially leading to system crashes.

A vulnerability has been identified in the Linux kernel related to the iptfs_clone_state() function. The issue is that x->mode_data is stored before the allocation of the reorder window, which may lead to pointing to freed memory in case of allocation failure.

A vulnerability has been identified in the Linux kernel regarding incorrect pte restoration for lazyfree folios. The issue involved potentially setting an entire batch of anonymous folios as writable during unmapping, which has been fixed by respecting the writable bit during batching.

In the Linux kernel bridge/cfm subsystem, a race condition during peer MEP deletion was fixed. br_cfm_frame_rx() running in softirq context could re-schedule ccm_rx_dwork after cancel_delayed_work_sync() returned, leading to a use-after-free. cancel_delayed_work_sync() was replaced with disable_delayed_work_sync() in both peer MEP deletion paths.

In the Linux kernel, the dma_map_sg tracepoint could trigger a perf buffer overflow when tracing large scatter-gather lists because array sizes exceeded PERF_MAX_TRACE_SIZE. The fix caps dynamic arrays at 128 entries and adds a truncation flag.

In the Linux kernel, the pinctrl cirrus cs42l43 driver's cs42l43_pin_probe() function contains a double-put because devm_add_action_or_reset() already invokes the action on failure, and the explicit put causes a double-put. This can lead to memory corruption.

In the Linux kernel, the gve driver in DQ-QPL mode incorrectly uses the RDA buffer cleanup path in gve_tx_clean_pending_packets. This leads to attempts to unmap incorrect DMA addresses and out-of-bounds access on the dma_addr_t array, causing UBSAN warnings.

A flaw was fixed in the Linux kernel's file_thp_enabled() function, which incorrectly allowed THP (Transparent Huge Pages) for files on anonymous inodes such as guest_memfd and secretmem. With CONFIG_READ_ONLY_THP_FOR_FS enabled, these files appeared as read-only regular files, enabling large folio creation and leading to kernel warnings or crashes (e.g., BUG: unable to handle page fault in secretmem). The fix excludes anonymous inodes from THP eligibility.

In the Linux kernel, a bug in the i2c-i801 driver was fixed by reverting a change that replaced acpi_lock with the I2C bus lock. Under rare circumstances, multiple udev threads can concurrently access i801_acpi_io_handler during boot, leading to a NULL pointer dereference and kernel panic.

In the Linux kernel's mt76 wifi driver (mt7925), the mt7925_mac_write_txwi_80211() function lacks a frame length check before accessing management fields. This can lead to an out-of-bounds access.

In the Linux kernel, the CAN BCM module has a locking bug for bcm_op runtime updates. When the RX_RTR_FRAME flag is set, the RX path uses bcm_can_tx() and bcm_tx_lock, which was not initialized in bcm_rx_setup(), leading to improper lock state.

In the Linux kernel, an admin queue leak occurs on NVMe controller reset. When nvme_alloc_admin_tag_set() is called during a reset, a previous admin queue may still exist and is not released before allocating a new one.

A race condition exists in the Linux kernel when creating nvdimm objects in the CXL subsystem. If the nvdimm_bus object is not yet registered, __nd_device_register() can trigger a NULL pointer dereference, causing a kernel oops. The issue is reproducible during cxl-translate.sh tests and relates to probe ordering between cxl_acpi and cxl_pmem drivers.

In the Linux kernel, a fix was made in the CAN USB f81604 driver for a missing urb anchoring in the read bulk callback. When submitting a urb that uses the anchor pattern, it must be anchored before submission; otherwise, it could be leaked if `usb_kill_anchored_urbs()` is called. This logic is correctly implemented elsewhere in the driver, except in the read bulk callback, where it has now been added.

In the Linux kernel, the crypto: ccp driver contains a use-after-free on the error path of sev_tsm_init_locked(). The code calls pr_err() accessing fields of structure 't' after it has been freed by kfree().

In the Linux kernel, the f81604 CAN USB driver improperly handles interrupt urb messages of incorrect length. The fix ensures such messages are properly detected and their data is not treated as valid.

In the Linux kernel, the wifi: mt76 driver for the mt7996 chipset has a possible out-of-bounds access in mt7996_mac_write_txwi_80211(). The frame length is not checked before accessing management fields.

The Linux kernel has a vulnerability in the i40e driver causing a preempt count leak in the napi poll tracepoint. Using get_cpu() in the tracepoint assignment causes a leak because nothing invokes put_cpu(), leading to a preempt count mismatch. The issue was fixed by replacing get_cpu() with smp_processor_id().

In the Linux kernel, the pinctrl: equilibrium driver has a bug that causes a warning trace on every GPIO load. The function eqbr_irq_mask_ack() calls eqbr_irq_mask(), which additionally calls gpiochip_disable_irq(), leading to the warning trace. The issue was fixed by implementing the logic directly without calling eqbr_irq_mask() and eqbr_irq_ack().

In the Linux kernel, the ems_usb_read_bulk_callback() function in the CAN ems_usb driver has a message length checking issue. When looking at the data in a USB urb, actual_length is the size of the buffer passed to the driver, not the transfer_buffer_length set by the driver as the max size of the buffer. When parsing messages in ems_usb_read_bulk_callback(), properly check the size both at the beginning of parsing the message to ensure it is big enough for the expected structure, and at the end of the message to ensure we don't overflow past the end of the buffer for the next message.

In the Linux kernel, the scsi: pm8001 driver has a use-after-free/double free in pm8001_queue_command(). When the phy is down or the device is gone, the function returns -ENODEV after freeing the SAS task, causing libsas to free the same task again.

A vulnerability in the Linux kernel related to improper unwinding in the error path of the rocket_probe function has been resolved. The issue occurs when rocket_core_init() fails, potentially leading to out-of-bounds memory access.

In the Linux kernel, `drbd_request_endio()` passes `READ_COMPLETED_WITH_ERROR` to `__req_mod()` with a NULL `peer_device`, which is then dereferenced in `drbd_set_out_of_sync()`. This causes a null-pointer dereference on a local read error in DRBD.

A vulnerability has been identified in the Linux kernel that may lead to ubuf size overflow. This can result in undersized memory allocation and potential memory corruption.

In the Linux kernel, tunnel xmit functions (iptunnel_xmit, ip6tunnel_xmit) lacked their own recursion limit. When a bond device in broadcast mode has GRE tap interfaces as slaves and those GRE tunnels route back through the bond, multicast/broadcast traffic triggers infinite recursion between bond_xmit_broadcast() and ip_tunnel_xmit()/ip6_tnl_xmit(), causing kernel stack overflow. A lower recursion limit (4) and recursion detection were added to iptunnel_xmit() and ip6tunnel_xmit().

In the Linux kernel's mac80211 wifi subsystem, ieee80211_ml_reconfiguration does not properly bounds-check the link_id taken from the ML Reconfiguration element (range 0–15). The link_removal_timeout[] array has 15 elements, so index 15 causes a stack out-of-bounds write.

In the Linux kernel, nvme_pr_read_keys() uses a userspace-supplied num_keys value to calculate the allocation size (up to 4 MB). A large num_keys value triggers an allocation attempt whose order exceeds MAX_PAGE_ORDER, causing a warning in the page allocator. The fix replaces kzalloc() with kvzalloc().

In the Linux kernel, a vulnerability was resolved in riscv: trace, causing a snapshot deadlock due to sbi ecall calls. If functions in sbi_ecall.c are traceable, a ringbuffer snapshot triggers an IPI interrupt, which calls __sbi_ecall again and another snapshot, creating an endless loop. This is easily triggered on RISC-V systems without the SSTC extension due to periodic sbi ecalls from timer-riscv.c.

In the Linux kernel, a safety check was added in the HID Intel-thc-hid (Intel-thc) driver before reading the DMA buffer to avoid unexpected NULL pointer access. The fix adds a DMA buffer readiness check before reading the buffer.

A vulnerability in the Linux kernel btrfs filesystem was fixed, related to block size inconsistency on the block device during mount. If a user changes the block size via the BLKBSZSET command after a folio is allocated, a VM_BUG_ON_FOLIO assertion or a NULL pointer dereference in create_empty_buffers() occurs.

In the Linux kernel, the SMB server (ksmbd) has a refcount leak in smb2_open(). When ksmbd_vfs_getattr() fails, the reference count of ksmbd_file is not released.

In the Linux kernel, the wifi mac80211 subsystem incorrectly decodes TTLM (TID-To-Link Mapping) elements with a default link map. When a default mapping is used, parsing is not skipped properly, causing a one-byte read beyond the end of the element.

In the Linux kernel, the ice driver has a devlink reload call trace bug related to HWMON temperature sensor reading. ice_hwmon_init() is called in ice_init_feature() and ice_hwmon_exit() in ice_remove(), so devlink reload followed by driver removal leaves an orphaned hwmon instance and causes a page fault call trace.

In the Linux kernel, the idpf driver has flawed error handling in the init_task during driver load. If init_task fails (e.g., CREATE_VPORT rejected by firmware), the driver ends up without vports and netdevs, and a subsequent reset causes a NULL pointer dereference and kernel crash.

In the Linux kernel, the idpf driver frees the RSS LUT during a soft reset and does not restore it unless the interface is up. Running an ethtool command that accesses the RSS LUT immediately after reset causes a NULL pointer dereference and a kernel panic.

In the cpm_fwtp_msg_handler function in cpm/google/lib/tracepoint/cpm_fwtp_ipc.c, there is a possible memory overwrite due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In the Linux kernel, the following vulnerability has been resolved: um: init cpu_tasks[] earlier. This is currently done in uml_finishsetup(), but e.g. with KCOV enabled we'll crash because some init code can call into e.g. memparse(), which has coverage annotations, and then the checks in check_kcov_mode() crash because current is NULL. Simply initialize the cpu_tasks[] array statically, which fixes the crash. For the later SMP work, it seems to have not really caused any problems yet, but initialize all of the entries anyway.

In the Linux kernel's net/mlx5e driver, PSP is unregistered twice — in both the _mlx5e_remove and mlx5e_nic_cleanup paths via mlx5e_psp_unregister. This leads under some conditions to a refcount underflow and use-after-free, triggering a kernel warning and potential system instability.

In the Linux kernel, a vulnerability was resolved in can: isotp: isotp_bind() by adding a missing check to block non-AF_CAN binds. Syzbot created code matching the right sockaddr struct size but using AF_XDP (0x2C) instead of AF_CAN (0x1D) in the address family field.

In the Linux kernel, there is a bug in the exception handling annotation of clear_user_rep_good() on x86. The exception table annotation points to the register move instruction instead of the actual user memory access instruction, so a user access exception is not properly handled and results in a kernel oops instead of returning -EFAULT.

In the Linux kernel, /proc/pid/smaps_rollup has a null-deref when the task has no VMAs. The issue was introduced by the commit converting to seq_file and occurs in show_smaps_rollup.

In the Linux kernel, a flaw exists in aperture_remove_conflicting_pci_devices() where sysfb_disable() is not called before removing PCI devices. As a result, simpledrm can still bind to simple-framebuffer devices after the hardware driver has taken over, causing driver interference and undefined behavior, including modesetting errors and RCU stalls.

In the Linux kernel, a change was reverted that caused the dma_buf field in struct drm_gem_object to become NULL when user space released the final GEM handle, resulting in a NULL-pointer dereference. The fix restores the use of .import_attach->dmabuf.

In the Linux kernel, the change "drm/gem-framebuffer: Use dma_buf from GEM object instance" was reverted because the dma_buf field in struct drm_gem_object is not stable over the object's lifetime. The field becomes NULL when user space releases the final GEM handle, causing a NULL-pointer dereference.

In the Linux kernel, a previous change regarding the dma_buf field in struct drm_gem_object was reverted because the field is not stable over the object's lifetime. The field becomes NULL when user space releases the final GEM handle, leading to a NULL-pointer dereference.

In the Linux kernel, a change in drm/gem-shmem was reverted that caused the dma_buf field in struct drm_gem_object to become NULL when user space released the final GEM handle, resulting in a NULL-pointer dereference. The fix restores the use of .import_attach->dmabuf.

In the Linux kernel, the ath12k Wi-Fi driver's ath12k_dp_tx_get_encap_type() uses the arvif parameter only to retrieve the ab pointer. During the vdev delete sequence, arvif->ar may become NULL, leading to a kernel panic. Since the caller ath12k_dp_tx() already has a valid ab pointer, passing it directly avoids the panic and unnecessary dereferencing.

In the Linux kernel, a vulnerability was resolved in perf/core: when `perf_mmap()` fails to allocate a buffer, it still invokes the `event_mapped()` callback, which on X86 may increment the `perf_rdpmc_allowed` reference counter. Since `perf_mmap_close()` is never called in this case, the counter is not decremented, causing a reference count leak. The fix returns early on failure.

In the Linux kernel, a vulnerability in perf/core allows splitting of ring buffer VMA mappings, leading to reference count leaks. VMA splits cause perf_mmap_open() calls that increment reference counts, but subsequent perf_mmap_close() calls no longer satisfy offset and size checks. The fix implements a may_split() callback returning -EINVAL to prevent splits.

In the Linux kernel, the ASoC SOF Intel hda component has a memory leak because sof_pdata->tplg_filename can be overwritten when the address was allocated by kstrdup(). The leak was detected by kmemleak.