Linux kernel vulnerabilities

In the Linux kernel, the scsi qla2xxx driver had two bugs on the queue creation error path: calling dma_free_coherent() with a NULL pointer and inconsistent bitmap locking (vport_lock vs mq_lock), which could cause a race and clobber a queue entry. The fix adds a NULL check and uses mq_lock in the free functions.

In the Linux kernel, the scsi qla2xxx driver could trigger a use-after-free during queue teardown: free_irq() did not cancel work already queued on ha->wq, so qla_do_work() could access a freed qpair and response queue. The fix adds cancel_work_sync() after free_irq() and before freeing memory.

In the Linux kernel, the scsi qla2xxx driver did not bound the virtual port index (vp_index) to the size of the vp_idx_map bitmap (16 bytes) in the IOCB. A vp_index above 128 could cause an out-of-bounds write, corrupting adjacent IOCB fields or the request-ring slot.

In the Linux kernel, the f2fs filesystem incorrectly updated the free_sections counter during free_segment_range() when some sections in the truncated range were already free. This overestimated available free sections and caused inconsistent accounting, potentially leading to allocation failures or assertion errors when space is tight.

A use-after-free vulnerability was found in the Linux kernel's x86/mm/pat subsystem. A race condition exists between attribute changes and CPA collapse, potentially leading to a write to freed memory. The issue is resolved by acquiring an mmap read lock on init_mm during attribute change operations.

In the Linux kernel, the scsi qla2xxx driver freed pointers on the qla2x00_mem_alloc() error path without clearing them, leading to double frees in qla2x00_mem_free(). Additionally, for dma_pool members it called dma_pool_free() after s_dma_pool had been destroyed and set to NULL, dereferencing a NULL pool.

In the Linux kernel, the scsi qla2xxx driver could re-register a virtual port that was being deleted (VPORT_DELETE) during report ID acquisition, even though its d_id had already been zeroed. This left an entry in host_map and later caused a use-after-free after scsi_host_put().

In the Linux kernel, a vulnerability in the qla2xxx SCSI driver causes a CPU soft lockup. The functions qla27xx_copy_multiple_pkt() and qla27xx_copy_fpin_pkt() poll the signature field in the response structure, but in continuation IOCBs this field contains FC frame payload that may accidentally equal 0xDEADDEAD, leading to an infinite loop.

In the Linux kernel, the scsi: qla2xxx driver does not validate request_len before reading the vendor_cmd[] array in FC_BSG_HST_VENDOR requests. A caller holding CAP_SYS_RAWIO can submit a short request, triggering out-of-bounds heap reads (KASAN-detectable), mis-selecting a command, or causing a kernel panic.

In the Linux kernel, the qla_nvme_xmt_ls_rsp() function in the scsi: qla2xxx driver frees the uctx structure with kfree() on the error path without first removing it from the fcport->unsol_ctx_head list. This leaves a freed node on the list, so subsequent list_add_tail() and list_del() operations can corrupt the list or cause a kernel panic.

In the Linux kernel, the fcport->unsol_ctx_head list in the scsi: qla2xxx driver is modified from several contexts without a common lock. Concurrent add and delete operations (or two concurrent deletes) can corrupt the list pointers, since the qpair qp_lock cannot serialize this per-fcport list.

In the Linux kernel, the PMU PAI support for s390 lacked allocation of per-CPU data structures for CPUs added via hotplug. Running 'perf stat -e pai_crypto/CRYPTO_ALL/ -- <command>' while a CPU was being brought online caused pai_add() to dereference a NULL pointer and panic the kernel. CPU hotplug support (add and remove) was added to create the required per-CPU infrastructure.

In the Linux kernel, the x86/mm/pat code allocated a page table directly when splitting a large page (__split_large_page()), bypassing the standard page table allocation API. As a result, the page table was never marked as a kernel page table (ptdesc_set_kernel() was not called), so freeing such page tables did not invalidate their IOTLB entries. This can leave stale IOTLB entries for kernel page tables.

In the Linux kernel, the MPTCP receive path can, under unlucky error conditions, recursively call mptcp_data_ready() via a state change and then try to hold the data lock again. The fix breaks this recursion by adding a new flag, exiting early in subflow_state_change(), and flushing the RX queue at reset time.

In the Linux kernel, the MPTCP scheduler may race with subflow socket state changes. Data transmission on the selected socket may fail, and a later release could use mss_now reset to 0 in a divide operation.

In the Linux kernel, the __mptcp_subflow_push_pending() function incorrectly updates copied byte counters when __subflow_push_pending() errors out. This causes a counter mismatch and problems on a later push call.

In the Linux kernel, a vulnerability in gfs2 was fixed: gfs2_quota_init() checks for duplicate quota_change IDs while holding qd_lock and the quota hash bucket bitlock. That path used gfs2_qd_search_bucket(), which takes a lockref reference via lockref_get_not_dead(). On PREEMPT_RT this may sleep, which is not allowed under the bucket bitlock, triggering 'sleeping function called from invalid context'. The fix uses a no-ref bucket lookup in this path and continues duplicate handling without taking a lockref there. It refactors gfs2_qd_search_bucket() to build on top of the no-ref helper so lookup traversal stays in one place.

In the Linux kernel, a vulnerability in gfs2 was fixed: moved qc++ from the loop body into the for-loop increment expression in gfs2_quota_init(). This keeps iterator progression explicit and avoids mixing pointer advance with duplicate-slot handling in the loop body.

In the Linux kernel, a vulnerability in drm/xe was fixed: in xe_devcoredump_snapshot_free(), ss->gt may be NULL when the snapshot was never fully populated (e.g., when cleanup is triggered without a prior capture). Guard the xe_guc_capture_put_matched_nodes() call with IS_ERR_OR_NULL() to prevent a null dereference. In xe_devcoredump_free(), the deferred work is only queued when a coredump is captured, so guard cancel_work_sync() with a check on coredump->captured.

In the Linux kernel, a vulnerability in cfg80211 was fixed: rejecting duplicate entries in wiphy->cipher_suites. Duplicates do not describe any additional capability, but cfg80211 currently accepts them and leaves individual consumers to deal with them. The WEXT compatibility code appends a WEP key length for each WEP cipher entry, which can overflow the fixed iw_range::encoding_size array returned by SIOCGIWRANGE. The fix rejects duplicate cipher suite entries in wiphy_register(), causing malformed wiphy descriptions to fail early with -EINVAL.

In the Linux kernel, a vulnerability in nl80211 was fixed: rejecting beacons with bad HE operation. The HE operation element not only needs to be longer than the fixed part, but also have an appropriate size for the variable part inside of it. This is now checked.

In the rtw88 driver, a NULL pointer dereference occurs in rtw_fw_adaptivity_result(). On devices with the 8821CE chip that do not define the edcca_th field, the kernel triggers an oops. The fix adds a NULL check before dereferencing, preventing the crash.

In the i3c svc driver on NPCM845, a false SLVSTART event causes an interrupt storm. After emitting a STOP condition, the controller reports a new event, creating a loop that can lock up the CPU. The fix clears the SLVSTART status bit explicitly after the STOP, breaking the loop.

In the chips-media wave5 driver, a lock issue is detected in handle_dynamic_resolution_change. The call in initialize_sequence does not properly acquire the lock. Additionally, v4l2_ctrl_find and s_ctrl can sleep, so they should not be called while holding the lock. The fix stores the fbc_buf_count value and updates the control after the lock is released.

In the chips-media wave5 driver, a use-after-free risk occurs when removing an instance from the list. The IRQ thread may acquire the spinlock between m2m_ctx release and removal, leading to a null pointer dereference.

In the Qualcomm QSPI SPI driver, incomplete error handling in runtime PM was found. During suspend or resume, the system could be left in an inconsistent state, leading to clock/power imbalances. The fix reorders operations and adds proper error checking with cleanup.

In the mac80211 module, an out-of-bounds access is detected in the function adding the radiotap header for monitoring in NAN mode. When the band is set to NUM_NL80211_BANDS, accessing the sbands array causes an error. The fix avoids accessing the array when the band is invalid.

In the Thunderbolt driver, a memory leak is found in __tb_xdomain_response(). When tb_cfg_request() fails and returns an error, it does not call the callback, leading to memory leak. The fix calls tb_cfg_request_put() on failure.

In the Thunderbolt driver, there is a missing reference to XDomain during the service's lifetime. Since the service ID is released in tb_service_release() and the ID array is owned by the parent XDomain, a use-after-free risk exists. The fix keeps the reference.

In the Thunderbolt driver, after stopping the domain, the root_switch pointer is not set to NULL. The fix sets it to NULL, causing tb_xdp_handle_request() to return an error to the remote host. However, the uuid must be kept alive to respond until the domain is released.

In the dm1105 driver, a missing error check for DMA memory allocation is found. The return value of dm1105_dma_map() is ignored in dm1105_hw_init(). If dma_alloc_coherent() fails, the driver uses a NULL pointer for DMA transfers, leading to a kernel oops or invalid hardware access. The fix adds a check and propagates -ENOMEM on failure.

In the Linux kernel, the crypto ixp4xx driver has a vulnerability to NULL pointer dereference during buffer chain allocation. On allocation failure, the code sets buf to NULL and later dereferences it unconditionally, which can lead to a system crash. Additionally, the partially built chain is not properly released.

In the Linux kernel, the PCI/sysfs subsystem lacks a CAP_SYS_ADMIN check in __resource_resize_store(). This allows unprivileged users to change BAR sizes, potentially disrupting drivers.

In the Linux kernel, the lenovo_se10_wdt watchdog driver has a use-after-free vulnerability and resource leak risk. The issue involves the se10_pdev pointer not being nulled after free, and the DMI callback.

In the Linux kernel, the genirq/proc subsystem has a buffer that is too small for 10-digit interrupt numbers in /proc/irq/<n>/ directory names. This can lead to buffer overflow during name formatting.

In the Linux kernel, the davinci MMC driver has a NULL pointer dereference vulnerability in the IRQ handler. When host->data is NULL and TOUTRD or CRCWR/CRCRD bits are set in qstatus, the code dereferences data without checking, leading to a crash.

In the Linux kernel, the mediatek paris pinctrl driver has an issue with pinctrl_gpio_direction_input/output taking the pinctrl mutex, causing gpiochip operations to sleep. Since .can_sleep is not set, a spinlock may be used instead of a mutex, triggering warnings.

In the Linux kernel, the rtw89 phy WiFi driver lacks a length check before parsing the PHY status IE. Hardware may report an unexpected length, leading to out-of-bounds access.

In the Linux kernel, the coresight perf subsystem has a race condition related to the per-CPU csdev_src pointer during device registration and unregistration. The patch retrieves the path and source from event data to avoid the race.

In the Linux kernel, the drm/amdgpu/userq driver does not pin the mqd and fw objects, which can lead to their eviction. During eviction, the hardware uses invalid addresses, causing page faults and system hangs.

In the Linux kernel, the drm/amdkfd driver's allocate_sdma_queue does not bounds-check the restore_sdma_id parameter, which could lead to invalid memory access.

In the Linux kernel, the get_wave_state() function in the drm/amdkfd driver trusts cp_hqd_cntl_stack_size and cp_hqd_cntl_stack_offset values read directly from the MQD. On the CRIU-restore path (AMDKFD_IOC_RESTORE_PROCESS) these values are attacker-controlled, leading to an unbounded copy_to_user() that can leak adjacent GTT/kernel memory (up to ~4 GiB via integer underflow or 1 MiB against a 4 KiB allocation).

In the Linux kernel, the allocate_doorbell function in the drm/amdkfd driver allows setting the doorbell id to a specific value (used by CRIU) without bounds checking. The lack of validation may allow out-of-range values to be used.

In the Linux kernel, the drm/amdgpu driver's psp_copy_fw function was changed from void to int to return -ENODEV when drm_dev_enter fails and -EINVAL when the image size is zero or larger than the 1 MiB PSP private buffer. Open-coded memset/memcpy into fw_pri_buf was replaced with psp_copy_fw.

In the Linux kernel, the drm/amdgpu driver does not properly bound the GPIO I2C table entry count from VBIOS. The fix rejects undersized tables and caps the derived entry count to AMDGPU_MAX_I2C_BUS to avoid overrunning adev->i2c_bus[] or walking an absurd number of entries on corrupt size fields.

In the Linux kernel, the wifi: mac80211 subsystem calls ieee80211_handle_reconfig_failure on NAN reconfiguration failure, marking all interfaces as not in the driver. Then cfg80211_shutdown_all_interfaces destroys the interfaces, but other interfaces' state (e.g., BSS station) is not reported to the driver, potentially leaving dangling pointers to stations and links (at least for iwlwifi).

In the Linux kernel, the net/rds subsystem's rds_ib_conn_path_shutdown function sleeps on a wait_event call, blocking other work items in the queue and causing a hang when tearing down ib network configs. The fix changes wait_event to a timeout-based wait_event and loops until the wait check succeeds.

In the Linux kernel, the affs filesystem uses buffer_heads, which do not handle block size > PAGE_SIZE well. Without the fix, mounting triggers BUG_ON(offset >= folio_size(folio)) in folio_set_bh on the first __bread_gfp call.

In the Linux kernel, the bfs filesystem uses buffer_heads, which do not handle block size > PAGE_SIZE well. Without the fix, mounting triggers BUG_ON(offset >= folio_size(folio)) in folio_set_bh on the first __bread_gfp call.

In the Linux kernel, the qnx4 filesystem uses buffer_heads, which do not handle block size > PAGE_SIZE well. Without the fix, mounting triggers BUG_ON(offset >= folio_size(folio)) in folio_set_bh on the first __bread_gfp call.