Linux kernel vulnerabilities

In the Linux kernel, the s390/crypto subsystem fails to scrub temporary buffers in the PAES algorithm. The buffer processing remaining bytes < AES_BLOCK_SIZE in ctr_paes_do_crypt() was not scrubbed, and __xts_2keys_prep_param() only scrubbed the key field instead of the whole parameter block.

In the Linux kernel, the s390/crypto subsystem returns an incorrect code in asynchronous crypto engine callbacks. When crypto_finalize_hash_request() or crypto_finalize_skcipher_request() explicitly completes a request, the do_one_request callback must return 0; returning a negative error code causes a double completion.

In the Linux kernel, the s390/crypto subsystem propagates persistent -EBUSY after exhausting key conversion retries to crypto_finalize_*_request(). The crypto API completion wrapper treats -EBUSY as a queueing status and swallows it, preventing the completion callback from firing.

In the Linux kernel, the RISC-V perf subsystem stored the available-counter mask as a single unsigned long, but iteration uses RISCV_MAX_COUNTERS which is 64. On RV32 this reads past the object, and setting an unsigned-long bit at index 32 and above is also wrong.

In the Linux kernel, the AFS subsystem's afs_dir_search_bucket() fails to kunmap the block it is using in the "bad:" path. This results in a missing kernel memory unmap.

In the Linux kernel, the AFS filesystem has a double-unmap issue in directory block handling. Manual kunmapping without clearing the pointer can lead to a double-kunmap if afs_dir_find_block() is called twice in a row.

In the Linux kernel, afs_lookup_server() incorrectly frees an existing server's endpoint state during candidate cleanup. The candidate record does not have an endpoint state at that point, so the free is unnecessary.

In the Linux kernel AFS subsystem, a use-after-free vulnerability was found due to improper clearing of peer app data during server address list updates, potentially leading to access of freed memory.

In the Linux kernel, the gpio-fan hwmon driver has a use-after-free in alarm work. The queued alarm work is not cancelled, and after unbind it may run after memory is freed.

In the Linux kernel, the Verisilicon Hantro HEVC driver has unbounded tile loops in prepare_tile_info_buffer(). The function writes entries to a DMA buffer, but loops may go out of bounds.

In the Linux kernel, the rkvdec HEVC driver has unbounded tile loops and PPS id in compute_tiles_uniform(), compute_tiles_non_uniform(), and assemble_hw_pps(). These functions may write out of bounds.

In the Linux kernel, the mediatek vcodec AV1 driver has an unbounded tile-start copy in vdec_av1_slice_setup_tile(). The function copies entries into mi_col_starts[] and mi_row_starts[] without bounds checking.

In the Linux kernel, the Verisilicon Rockchip VPU981 AV1 driver has an unguarded division and tile buffer write. The function rockchip_vpu981_av1_dec_set_tile_info() divides by tile_cols which can be zero, and writes descriptors without bounding to buffer capacity.

In the Linux kernel, the Verisilicon Rockchip AV1 driver does not reject frames exceeding tile capacity. The function rockchip_vpu981_av1_dec_set_tile_info() may read out of bounds and program hardware for more tiles than the buffer holds.

In the Linux kernel, v4l2-ctrls lacks validation of HEVC tile counts. Tile column and row counts are not bounded to array capacity, which can lead to out-of-bounds reads.

In the Linux kernel, std_validate_compound() did not bound the tile_cols and tile_rows fields for V4L2_CTRL_TYPE_AV1_FRAME controls. These values are used as loop bounds, array indices, and a divisor, and their product bounds per-tile descriptor buffers. Validation was added to reject values exceeding V4L2_AV1_MAX_TILE_COLS/_ROWS or whose product exceeds V4L2_AV1_MAX_TILE_COUNT.

In the Linux kernel, bnxt_queue_mem_alloc() shallow-copied the live RX ring into a clone, leaving rx_tpa and rx_tpa_idx_map pointing at the live ring's memory. If a later allocation failure took the err_free_tpa_info label, the live ring's memory could be freed while still in use. The fix initializes the clone's pointers to NULL.

In the Linux kernel, bnxt_rx_ring_reset() ignored the result of reallocating RX ring buffers. When bnxt_alloc_one_rx_ring() failed with -ENOMEM, some rxr->rx_tpa[] entries remained zeroed while TPA was re-enabled. The fix falls back to a global reset on allocation failure.

In the Linux kernel, bnxt_init_nic() discarded the return value of bnxt_init_rx_rings() and called bnxt_init_chip(), enabling TPA despite an allocation failure. This could leave rxr->rx_tpa[] partially zeroed. The fix propagates the error out of bnxt_init_nic().

In the Linux kernel, bnxt_queue_mem_alloc() discarded the return value of bnxt_alloc_one_tpa_info_data(), which returns -ENOMEM on the first failed allocation, leaving some rxr->rx_tpa[] entries zeroed. The partially initialized ring was installed by bnxt_queue_start(). The fix checks the return value and unwinds.

In the Linux kernel, the MPTCP syncookies mechanism used an uninitialized bit when copying information in subflow_ulp_clone(). The fix remembers the backup flag by using one bit for both structures without extending join_entry.

In the Linux kernel, a race between disconnect() and retransmission (rtx) in the MPTCP stack was identified, leading to inconsistent state. The fix prevents the race using a synchronous timer stop operation.

In the Linux kernel, the in-kernel MPTCP path manager left a stale ADD_ADDR announcement when removing the id 0 endpoint, because that path did not tear down pending announcements. Later reselecting id 0 hit the stale anno_list entry and triggered WARN_ON_ONCE in mptcp_pm_announced_alloc(). The fix makes the id 0 removal path symmetric.

In the Linux kernel SMB client, CIFSSMBRead() reads READ_RSP header fields without first verifying that a complete READ_RSP was received. A malicious or compromised SMB1 server can return a response shorter than the READ_RSP header, causing an out-of-bounds read past the receive buffer. This only affects mounts explicitly configured with vers=1.0, as SMB1 is not negotiated by default.

In the Linux kernel SMB client, the cifs.idmap key type lacks a vet_description hook, unlike its sibling cifs.spnego. This allows userspace to create keys of this type via request_key(2)/add_key(2) and supply authority-bearing fields (owner/group SIDs, uid/gid) without CIFS origin. A request_key(2) call with a non-NULL callout then triggers a root usermodehelper upcall that consumes the unvetted description in root context.

In the Linux kernel, the CIFSSMBRead() function (SMB1 client) did not validate the DataOffset field in the server response. A malicious or compromised SMB1 server can return a large DataOffset with a valid DataLength, causing an out-of-bounds read past the response buffer — leaking kernel heap memory (information disclosure) or triggering an oops (denial of service). The vulnerability only affects mounts explicitly using vers=1.0, as SMB1 is not negotiated by default.

In the Linux kernel SMB client, tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super() takes its active reference only after iterate_supers_type() has dropped s_umount and its passive reference. Concurrent DFS automount expiry can therefore free the superblock before cifs_sb_active() uses it, resulting in a use-after-free. The fix takes the active reference in the callback while iterate_supers_type() still holds s_umount shared.

In the Linux kernel SMB client, several code paths unconditionally called sid_to_id(), overwriting cf_uid/cf_gid with server-provided values despite mounts using forceuid/forcegid options. This affected smb311_posix_info_to_fattr(), cifs_posix_to_fattr(), and parse_sec_desc(). It allowed an untrusted server to dictate local file ownership against the administrator's explicit configuration.

In the Linux kernel SMB client, smb2_parse_native_symlink() copies smb_target+1 (skipping the leading separator) when parsing a share-root relative native symlink, but uses strlen(smb_target)+1 as the length, reading one byte past the allocated buffer. This results in an out-of-bounds read, as confirmed by a KASAN report. The issue occurs when accessing an SMB symlink with a target such as '\a\b'.

In the Linux kernel's SMB client, a problem was found in DACL rewrite: the size accumulator using u16 can wrap, leading to corruption of the DACL sent to the server. The fix changes the type to u32 and returns -EOVERFLOW on overflow.

In the Linux kernel's SMB client, there is a cifsFileInfo reference leak in the deferred close mechanism due to a race condition between flags. The fix checks the return value of queue_delayed_work() and hands off the reference only if the work was actually queued.

In the Linux kernel's SMB client, there is a reference leak in cifs_queue_oplock_break() — the reference is always taken, but if the work is already queued, it is not released. The fix takes the reference only after successful queueing.

In the Linux kernel's SMB client, there is a reference leak in cifs_oplock_break() when cifs_sb_tlink() fails in multiuser mode. The fix releases the reference on that error path as well.

In the Linux kernel's SMB client, there is a heap overflow when rewriting DACL owner/group: the buffer is allocated based on the original DACL size, but SID substitution can enlarge each ACE, causing out-of-bounds write. The fix always allocates worst-case size considering maximum SID expansion.

In the Linux kernel's SMB client, cifs_posix_to_fattr() ignores the return value of posix_info_parse(), which can lead to using uninitialized SIDs and potentially leaking kernel stack data to the ID mapping process. The fix checks the return value and skips SID mapping on parsing failure.

In the XFS filesystem, a lock is missing when inserting the unmount event into the health monitor. The fix adds proper locking.

In the XFS filesystem, xfs_defer_finish_one() may return an uninitialized error value when the list is empty, which can lead to a false shutdown of the filesystem. The fix initializes the error variable to 0.

In the XFS filesystem, an incorrect args->total value during parent pointer updates can lead to improper free space checking and ENOSPC errors that escalate to a filesystem shutdown. The fix sets args->total in add and replace paths, similar to log recovery.

In the XFS filesystem, the unit conversion in the per_binval computation is backwards, leading to incorrect space calculation. The fix changes the conversion direction from FSB to bytes.

In the Linux kernel, the _maxlevels_ondisk functions for rtrmap and rtrefcount in XFS fail to account for the inode root when computing the size of in-memory btree cursors. With a sufficiently large btree, this can lead to accessing beyond the end of the cursor.

In the Linux kernel, XFS's xmi_can_exchange_reflink_flags() can move the reflink flag between files during range exchange, but when XFS_EXCHMAPS_INO1_WRITTEN is set, some mappings may be skipped. This can clear the reflink flag from an inode that still owns shared written extents, leading to data corruption.

In the Linux kernel, XFS's xrep_dir_recover_data can spin forever if it encounters an unused dirent that claims to have length zero. The fix also prevents the same issue with zero-length entries.

In the Linux kernel, XFS's xfs_btree_bload_prep_block may fail to release new_bp if xfs_btree_bload_drop_buf hits an I/O error while writing the delwri buffer list to disk. This results in a leaked locked buffer.

In the Linux kernel, XFS's xqcheck_mod_live_ino_dqtrx does not free the newly allocated dqa object if rhashtable insertion fails. This leads to a memory leak.

In the Linux kernel, XFS's xchk_dirtree_create_path fails to destroy the seen inode bitmap if the directory path object is created but appending the name to the path fails. A similar bug exists in xrep_dirtree_create_adoption_path.

In the Linux kernel, XFS's xrep_agfl_fill does not check the result of xagb_bitmap_walk, silently dropping errors from xagb_bitmap_set and proceeding with inconsistent incore data.

In the Linux kernel, the ath9k_htc wifi driver stores a usb_device_id pointer that is not guaranteed to live longer than probe due to dynamic ID. The fix stores only driver_data, as other information can be retrieved from usb_device.

In the Linux kernel, the pegasus USB network driver relies on id table pointer arithmetic, which is broken with dynamic ID because the usb_device_id in probe lives on the heap and the computed index can be wildly out of bounds. The fix uses the driver_info field instead of a side table.

In the Linux kernel, the USB xusbatm driver relied on pointer arithmetic over the device ID table, which with dynamic IDs caused an out-of-bounds index (pointer on the heap). The fix removes that arithmetic and sets no_dynamic_id, since the driver does not support dynamic IDs anyway.

In the Linux kernel, the hwmon asus_rog_ryujin driver did not validate HID report lengths before parsing response headers and payload fields. A short report could make the driver read uninitialized bytes from the HID buffer and expose them as sensor values via sysfs.