Linux kernel vulnerabilities

In the Linux kernel, the msc313e watchdog driver has a division by zero vulnerability. The function clk_get_rate() can return 0, leading to division by zero and kernel panic. The fix adds a check to avoid division by zero.

In the Linux kernel, the msc313e watchdog driver has two severe bugs in the settimeout() function: clock leak and spurious timer start. The function msc313e_wdt_settimeout() unconditionally calls msc313e_wdt_start(), which increases the clock reference count when the watchdog is already active, and starts the timer when the watchdog is stopped. The fix factors out the register-writing logic into a helper and calls it only if the watchdog is running.

In the Linux kernel hwmon corsair-cpro driver, debugfs entries were created before hwmon device registration. If registration failed, the entries remained, and after HID core freed the memory, reading one of them caused a use-after-free. The fix moves debugfs creation after hwmon registration.

In the Linux kernel hwmon corsair-cpro driver, when hwmon device registration failed, debugfs entries were not removed, leading to use-after-free when reading them. The fix adds debugfs removal on the error path.

In the Linux kernel octeontx2-pf driver, during HTB hierarchy teardown, scheduler queues were freed without clearing TOPOLOGY settings, which could affect later allocations. The fix adds functions to reset TOPOLOGY before returning queues to the AF.

In the Linux kernel, the vxlan_xmit_one() function in the VXLAN driver has an uninitialized stack variable _md when a VXLAN device has both VXLAN_F_COLLECT_METADATA and VXLAN_F_GBP enabled, and the transmitted packet lacks the IP_TUNNEL_VXLAN_OPT_BIT flag. This leads to reading garbage from the stack, which can spuriously set flags in the VXLAN header and leak 16 bits of uninitialized kernel data onto the wire.

In the Linux kernel ppp_synctty driver, ppp_sync_txmunge() did not ensure the skb header was writable, which could overwrite data visible to other sockets. The fix uses skb_cow_head() to ensure a writable header.

In the Linux kernel net: stmmac driver, ptp_lock was initialized only during PTP registration, but used also when the interface is down, leading to undefined behavior. The fix moves initialization to __stmmac_dvr_probe().

In the Linux kernel net/mlx5e driver, the vnic health reporter for representors was created and destroyed along the netdev (un)load path, not serialized by the devlink lock, causing a warning on unbind. The fix moves the reporter's lifecycle to the eswitch devlink port.

In the Linux kernel perf/core, list corruption of sched_cb_list is possible during event overflow processing when PMU calls perf_sched_cb_dec() during iteration. The fix changes for_each_list_entry() to for_each_list_entry_safe().

In the Linux kernel perf/x86/intel, drain_pebs() can be reentered, leading to out-of-bounds memory access. The fix disables the full PMU around intel_pmu_drain_pebs_buffer() and adds a warning when PMU is not disabled.

In the Linux kernel, the net/sched: cls_route module has a memory leak. When an existing route4 filter is moved to a different bucket, the old emptied bucket is never freed and remains in head->table[], preventing proper filter deletion and causing a leak of the empty tcf_proto.

A vulnerability was fixed in the Linux kernel's net/sched: cls_api. When a netlink socket repeatedly sends RTM_GETCHAIN requests without receiving responses, tc_ctl_chain() spins and consumes CPU, triggering a Hung Task. The issue was caused by unnecessary replay logic for RTM_GETCHAIN.

In the Linux kernel, the hinic driver has a heap buffer overflow in the mailbox segment validation. The last segment can carry a full 48-byte payload, causing a 16-byte write beyond the 2048-byte receive buffer. The fix limits the last segment length to the remaining buffer space.

In the Linux kernel, the net_failover driver has a deadlock in net_failover_slave_name_change(). Using dev_open() instead of netif_open() leads to a mutex deadlock. The fix changes the call to netif_open() to avoid the deadlock.

In the Linux kernel, the mana driver has an issue with the XDP program pointer. When RX buffer pre-allocation fails, mana_xdp_set() returns an error without restoring the previous pointer, leading to use-after-free. The fix restores the previous program on the error path.

In the Linux kernel, the RDS-TCP subsystem has TCP stream corruption with large pages. rds_message_map_pages() assigns full page size to each scatterlist entry, even when the last part is smaller, causing mapping beyond the end of the congestion map. The fix limits the last mapping to the remaining bytes.

In the Linux kernel, the stmmac driver has an issue with TX descriptor availability for TSO traffic. The estimation of free descriptors is inaccurate, potentially leading to writing past available descriptors and corrupting the TX ring. The fix adds a function to compute the exact number of descriptors needed.

In the Linux kernel, the iSCSI target subsystem has a hang for aborted WRITE_PENDING commands. When the initiator sends remaining dataout PDUs after abort, the target does not trigger completion, leading to a deadlocked worker thread. The fix calls target_complete_cmd() upon receiving the final dataout PDU.

In the Linux kernel, the configfs system has an issue with pinning the symlink target's dirent. create_link() reads the dirent from ci_dentry, which may be freed during a race with rmdir, triggering a WARN_ON. The fix pins the dirent in get_target() under d_lock.

In the Linux kernel, the configfs system has an issue with rmdir. configfs_rmdir() leaves the dentry hashed after dropping the item, leading to use-after-free in configfs_symlink(). The fix unhashes the dentry before dropping the item.

In the Linux kernel, the powerpc/eeh subsystem has a recursive locking issue when a device lacks an EEH-sensitive driver. A previous fix added the pci_rescan_remove_lock but did not remove the existing lock inside eeh_rmv_device(), causing the eehd thread to hang on a lock it already holds.

In the Linux kernel, the x86/amd_node subsystem has a potential NULL pointer dereference in __amd_smn_rw() when amd_smn_init() fails and 'amd_roots' remains NULL. The fix replaces the 'smn_exclusive' flag check with a direct check of 'amd_roots', simplifying logic and eliminating the risk.

In the Linux kernel, the x86/amd_node subsystem has a PCI device reference counting issue in amd_smn_init(). The fix uses the __free() cleanup macro to automatically decrement the refcount for the temporary pointer and increments the refcount when caching a root pointer, separating temporary from in-use references.

A vulnerability in the Linux kernel's pmd_modify() function on x86 causes loss of the dirty bit in PMDs for transparent huge pages (THP). This can lead to user data loss when MADV_FREE is used followed by writes, as reclaim may incorrectly free dirty pages. File-backed THPs are also affected, preventing writeback of modified data.

In the Linux kernel, the x86/cfi subsystem has a bug in cfi_get_func_hash() that reads the FineIBT hash from the wrong offset (7 instead of 5). This causes BPF struct_ops trampolines to receive an incorrect hash, leading to a CFI failure on the first indirect call.

A vulnerability was found in the Linux kernel's x86 CPA (Change Page Attributes) mechanism. During the collapse of page table entries into huge pages, page tables are freed without holding relevant locks, leading to a potential use-after-free (UAF) when concurrent operations like ptdump walk the page tables.

A bug in the Linux kernel's x86 alternatives patching code can cause a kernel crash (BUG_ON) in __text_poke. This occurs when vmalloc_to_page() fails due to a race between text poking and change_page_attr (CPA), particularly when CONFIG_ARCH_HAS_EXECMEM_ROX=y and modules share a single execmem range and call set_memory_*() in parallel. The fix excludes this race by using the init_mm mmap read lock.

A race condition exists in the Linux kernel's __slab_try_return_freelist() function in mm/slab. The function incorrectly assumed that if freelist is NULL and cmpxchg succeeds, no other CPU has freed an object to the slab, leading to a classic ABA problem and list corruption. This results in a kernel panic and denial of service (DoS).

In the Linux kernel, the IPv6 subsystem has a use-after-free vulnerability in the fib6 walker iterator during sequence stop. A walker can be moved to the FWS_U state, which is incorrectly treated as unlinked, leading to the seq object being freed while still on the fib6_walkers list, and later route deletions use the freed walker.

In the Linux kernel, the ipmr subsystem lacks memory accounting for multicast tables and routes. A netadmin in a user+net namespace can create many multicast routing tables that are not charged to memcg, leading to uncontrolled growth of unreclaimable slab memory.

A use-after-free race exists in the Linux kernel around the global cad_pid pointer. proc_do_cad_pid() and kill_cad_pid() use cad_pid without protecting the lifetime of the referenced struct pid, so a concurrent writer can drop the final reference to the old struct before the reader finishes dereferencing it. The fix treats cad_pid as an RCU-protected pointer and waits for a grace period before dropping the old reference.

A use-after-free flaw exists in the Linux kernel ftrace subsystem during process forking. The function graph state is initialized too late — after copy_exec_state() — so if the task_exec_state allocation fails, free_task() releases the parent's return stack (ret_stack), which the parent then accesses as freed memory.

A vulnerability exists in the Linux kernel tracing subsystem related to the '.stacktrace' histogram modifier. parse_field() sets HIST_FIELD_FL_STACKTRACE before resolving the field name, and create_hist_field() selects HIST_FIELD_FN_STACK based solely on the field pointer, without verifying that the field actually holds a stacktrace. This leads to unbounded copying and memory corruption (out-of-bounds read/write) during event processing.

A use-after-free vulnerability was found in the Linux kernel tracing histogram mechanism. hist_register_trigger() registers the trigger on the global named_triggers list before setting the trace clock, so an unknown clock name fails after registration, causing the object to be freed without removal from the list and later read after free.

A vulnerability in the Linux kernel tracing subsystem allows memory corruption via a "STACKTRACE" histogram key. The field is passed as non-NULL to create_hist_field(), causing an untrusted offset and length to be read and an unbounded memcpy to occur. This can result in a general protection fault and kernel panic.

A use-after-free vulnerability exists in the Linux kernel tracing subsystem. When opening a tracer options file, a race condition can cause the topts array element to be freed by removal of the trace_array instance before it is used to increment the reference counter. This can lead to use of freed memory.

In the Linux kernel, the tracing enable_event trigger deferred trace_event_put_ref() to the trigger free kthread, but the associated trace_event_file could already be freed when the instance was removed. This led to a use-after-free. The fix keeps the trace_event_call directly in enable_trigger_data so the deferred free does not access the freed trace_event_file.

In the Linux kernel, the ALSA us122l driver did not clear the VM_MAYWRITE flag for read-buffer mappings created with PROT_READ. A process with O_RDWR access to the hwdep node could later use mprotect() to make the mapping writable, then modify the read_size field and access pages beyond the allocation. The fix clears VM_MAYWRITE for read-buffer mappings.

In the Linux kernel, the ALSA usbusx2y driver has a size mismatch between the in04_last array (char[24]) and the in04_buf buffer allocated as 21 bytes (sizeof(struct us428_ctls)). In i_usx2y_in04_int(), 24 bytes are copied from a 21-byte allocation, reading 3 bytes past the end of the object. The fix introduces a USX2Y_IN04_SIZE constant and uses it consistently.

In the Linux kernel, the ALSA usbusx2y driver's i_usx2y_in04_int() processes URB data without checking urb->actual_length. A short transfer from a malfunctioning device causes the handler to process uninitialized heap data from in04_buf, which is then copied to the mmap-accessible ctl_snapshot[] array. The fix uses kzalloc() and adds an actual_length check.

In the Linux kernel, the drm/amdgpu driver performs an unnecessary VMID 0 flush for clear-on-release operations on VRAM even though it does not program a GART window. On GFX11 chips (e.g. Navi33) this spurious SDMA flush can wedge the engine. The fix only flushes when a GART window is actually used.

In the Linux kernel, the UFS filesystem installed sb->s_root before loading cylinder group structures for a writable mount. When loading failed, the error path freed superblock info and set sb->s_fs_info to NULL while sb->s_root remained, causing a NULL dereference during teardown. The fix loads cylinder group metadata first and creates the root dentry last.

In the Linux kernel, the UFS filesystem copied the cylinder group index and rotor positions from disk without validation, then used them as indices during allocation and free. A crafted image could set arbitrary values, causing writes outside the s_csp allocation or bitmap scans far past the cylinder group buffers. The fix rejects cylinder groups with mismatched index or out-of-group rotors.

A race condition in the Linux kernel during broadcast device replacement can lead to using a detached device, potentially triggering a BUG() in tick_cleanup_dead_cpu() when the last CPU in a restricted interrupt affinity mask goes offline.

In the Linux kernel, the tracing/user_events mechanism destroyed an event's fields before attempting to remove the trace event call. If removal failed (e.g. returning -EBUSY), the event remained registered with an irreversibly destroyed field list, leading to operations on an empty field list. The fix moves field destruction after call removal and restores the field list on failure.

In the Linux kernel, create_var_ref() allocates a VAR_REF hist_field and then calls init_var_ref(). When initialization fails, the field is leaked because destroy_hist_field() returns early for HIST_FIELD_FL_VAR_REF and the field has not yet been added to the var_refs[] array. The fix calls __destroy_hist_field(), which frees the field without consulting the flag.

In the Linux kernel tracing subsystem there is a memory leak. When the same variable is used three or more times in one hist trigger, removing the trigger leaks the variable reference and its strings. The reference count is only incremented and freeing occurs at 0 or 1, so three or more references leak.

A vulnerability in the Linux kernel tracing subsystem (histograms) causes a memory leak when a histogram field is rejected due to an invalid modifier (e.g., .log2). The field is not properly freed because it is not added to the fields[] list before the error path. This can lead to unreferenced objects and memory exhaustion.

In the Linux kernel, print_entries() in the tracing/histogram subsystem uses n_entries both as the number of sort entries and as its return value. When the stats allocation fails, the stored -ENOMEM overwrites the count that is later passed to tracing_map_destroy_sort_entries(), which takes an unsigned int and loops up to it, causing an out-of-bounds read and free (vmalloc-out-of-bounds).