Linux kernel vulnerabilities

In the spi: amlogic-spisg driver, the clk_init_data structure is not fully initialized, which may cause a crash when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is enabled. The issue involves the uninitialized parent_names field.

In the drm/xe driver, there is an issue with a WARN warning during kernel job timeout when the device is already wedged. The fix honors the wedged state even for killed queues to avoid false warnings.

A race condition exists in the Linux kernel Bluetooth mgmt subsystem where the 'uuid_count' and 'uuids' fields of the discovery_state structure are accessed without proper locking. This can lead to a state where 'uuid_count' is non-zero but 'uuids' is NULL, causing a NULL pointer dereference and kernel panic. The fix adds discovery.lock around all reads/writes of these fields and ensures 'uuid_count' is set only after a successful kmemdup allocation.

In the octeontx2-af driver, there is an out-of-bounds read vulnerability when setting MSI-X IRQ affinity. The strstr() function may read beyond the buffer when the field is uninitialized, potentially triggering a KASAN error.

In the Linux kernel, a vulnerability in AppArmor was found where list heads are not properly initialized if profile creation fails before policy_init completes. This triggers warnings and a potential crash in aa_policy_destroy during profile free.

In the drm/sysfb: simpledrm driver, stride validation has been improved to check that the computed value does not exceed INT_MAX. This prevents potential overflow issues.

A flaw was found in the Linux kernel's secretmem mechanism (mm/secretmem) regarding accounting of locked pages. secretmem folios are not properly charged against RLIMIT_MEMLOCK or the process's RSS, so a user can repeatedly map and unmap (or fork) to bypass the limit and exhaust all available system memory with unevictable folios. This leads to system instability, and the OOM killer will not target the process because the memory usage is not accounted.

In the Linux kernel, the scsi: qla2xxx driver's __qla_consume_iocb() function consumed one too many response queue entries. This caused the wrong IOCB to be marked as processed and a legitimate firmware response to be silently dropped. The fix marks the head IOCB as processed and consumes only entry_count - 1 continuation IOCBs.

A vulnerability in the Linux kernel's memory cgroup (memcg) mechanism causes OOM-killed processes to get stuck in the exit path for hours. The issue occurs when the oom_reaper fails to free the process memory (setting MMF_OOM_SKIP), and dying threads still attempt to swap in pages from zswap, leading to serialization on oom_lock and severe exit delays.

In the Linux kernel, the memcg v1 soft limit has been deprecated — writes to memory.soft_limit_in_bytes are now ignored and reads always report the maximum value. The fix also addresses a syzbot warning related to soft limit reclaim invoked from kswapd.

In the Linux kernel on arm64, show_pte() performs a lockless page-table walk that can dereference a freed table page or derive a bogus pointer during concurrent teardown. The fix uses lockless offset helpers with saved parent entries and disables local interrupts around the walk.

In the Linux kernel's s390/vfio-ap module, the apm_filtered bitmap is stack-allocated without zero-initialization. When a hot plug change adds only control domains, the filtering function is bypassed and the uninitialized bitmap is passed to reset_queues_for_apids(), potentially causing unintended guest hardware queue resets. The fix zero-initializes the bitmap at the start of the function.

The Linux kernel for the LoongArch architecture lacks a DIRECT_MAP_PHYSMEM_END definition, causing get_free_mem_region() and mhp_get_pluggable_range() to potentially return ZONE_DEVICE regions outside the vmemmap window. This can lead to page table corruption or system crashes, especially on CPUs with fewer physical address bits, such as the Loongson-2K series.

In the Linux kernel's media: meson: vdec driver, vdec_try_fmt_common() falls back to V4L2_PIX_FMT_MPEG2 for unsupported pixel formats. If a distro has patched out MPEG2 support, find_format() returns NULL, causing a NULL pointer dereference and crash. The fix uses the first format in the platform's format array instead of hardcoding MPEG2.

In the Linux kernel's drm/gud driver, gud_connector_add_tv_mode() passes fixed-size TV mode names directly to the DRM property code. If a device returns an entry without a NUL terminator, strlen() reads past the buffer, causing an out-of-bounds read. The fix validates the NUL terminator and rejects malformed responses with -EIO.

Vulnerability in the Nouveau driver (drm/nouveau/dmem) causes an underflow of the callocated counter when a large folio is split. The counter is not updated on split, leading to memory leak and warnings. The fix accounts for new sub-folios in the split hook.

A vulnerability in the Linux kernel causes a boot panic on CONFIG_DEBUG_VM kernels when hugetlb_free_vmemmap is enabled. The issue is due to late initialization of shared tail pages (zone->vmemmap_tails[]) used by HVO, leading to dereferencing an uninitialized page during bootmem HugeTLB folio preparation. The fix moves initialization to gather_bootmem_prealloc() before bootmem HugeTLB folios are processed.

In the Linux kernel, a vulnerability was found in the lockd module where the nlmsvc_match_ip() function had swapped arguments during IP address comparison. This caused lock release by server IP address (via /proc/fs/nfsd/unlock_ip) to practically never work, as the comparison read invalid data from memory.

Vulnerability in the HugeTLB mechanism for gigantic bootmem pages involves late initialization of struct pages. This can cause incorrect zone contiguity or kernel panic during boot. The fix moves initialization to an earlier phase.

In the NFS server (nfsd), there is a missing read barrier in the rpc_status_get dumpit function, which on weakly-ordered architectures (ARM, POWER) can lead to an ineffective retry mechanism. This could result in reading inconsistent data. The fix adds smp_rmb() before the second counter check.

In the Linux kernel, a vulnerability was found in the deferred struct page initialization mechanism (CONFIG_DEFERRED_STRUCT_PAGE_INIT). When large CMA reservations are used, deferred_grow_zone() may improperly update the first_deferred_pfn pointer, leading to an overflow and triggering a BUG_ON in deferred_init_memmap(), causing a system crash during boot.

In the Linux kernel, rt6_nh_dump_exceptions() iterated over RCU-protected IPv6 route exception lists using hlist_for_each_entry() without holding rt6_exception_lock, while rt6_insert_exception() could concurrently add entries. This caused a data race reported by KCSAN. The fix switches to hlist_for_each_entry_rcu() for safe iteration.

In the phy driver (fsl-imx8mq-usb), there is a leak of the typec switch when probe errors occur. The fix uses devm_add_action_or_reset() to ensure cleanup on both probe failure and driver removal.

A flaw was fixed in the Linux kernel's svcrdma module where a failed accept path called rpcrdma_rn_unregister() without a prior successful registration. This caused erasure of another caller's XArray slot and an unmatched reference release on the RDMA device, as well as a memory leak of the svcxprt_rdma structure on every failed accept.

In the Linux kernel, the tegra-video driver (staging/media) has a bug where tegra_vip_channel_of_parse() drops a reference to the OF node in its error paths without ever taking one, underflowing the refcount. This occurs when endpoint parsing fails on a malformed device tree.

In the Linux kernel, send_signal_locked() rewrites sender IDs for the target namespace, and group sends reuse the same siginfo, so one recipient can affect the next. This allows cross-recipient influence over signal data.

A race condition exists in the Linux kernel's nfsd_net structure, where the boolean field grace_ended is read and written without synchronization from multiple threads. Two concurrent calls to nfsd4_end_grace() can both proceed to nfsd4_record_grace_done(), leading to a double-free and corruption of the reclaim_str_hashtbl list. The vulnerability is fixed by replacing boolean fields with a flags word and using the atomic test_and_set_bit() operation.

In the Linux kernel's sched_ext scheduler, kick_sync_wait_bal_cb() assumes it runs on the rq's CPU, but due to changes in rq lock dropping it can run on a foreign CPU. This leads to comparisons against unrelated snapshots and potential deadlock.

In the Linux kernel, the timer-sun4i clock driver advertises TIMER_SYNC_TICKS as the minimum delta, allowing the clockevents core to call set_next_event() with a value that programs a zero-tick interval. This can leave the next event stuck and cause a boot hang on Allwinner D1.

In the Linux kernel's mm/huge_memory, madvise_free_huge_pmd() can encounter a device-private PMD and enter the !pmd_present() branch, leading to pmd_folio() being called on an unexpected PMD. This can occur when an HMM-based GPU driver races with madvise(MADV_FREE).

In the Linux kernel's mm/madvise, madvise_cold_or_pageout_pte_range() can encounter a device-private PMD and enter the !pmd_present() branch, triggering a VM_BUG_ON(). This can occur when an HMM-based GPU driver races with madvise(MADV_COLD)/MADV_PAGEOUT).

In the Linux kernel's mm/page_owner, print_page_owner_memcg() re-reads page->memcg_data locklessly in two places, creating a TOCTOU condition. If the page is concurrently freed and reallocated as a THP tail page or slab page, VM_BUG_ON assertions can crash the kernel.

In the Linux kernel, cdx_create_res_attr() frees res_attr when sysfs_create_bin_file() fails but does not set cdx_dev->res_attr[num] to NULL, leaving a dangling pointer. A later call to cdx_destroy_res_attr() frees the already-freed memory, causing a double free.

In the Linux kernel's USB gadget f_tcm, usbg_make_tpg() holds dep_lock while calling configfs_depend_item_unlocked(), creating a circular lock dependency with configfs_rmdir(). This can lead to a deadlock.

In the Linux kernel, a vulnerability was found involving an out-of-bounds read in the of_alias_scan() function. The stem parser checks isdigit before validating boundaries, causing a read one byte before the property name when the name is empty or all digits. This could lead to unexpected behavior or information leakage.

A vulnerability in the Linux kernel's NFS server (nfsd) involves a NULL pointer dereference in nfsd_file_net_dispose(). During network teardown, the nn->nfsd_serv pointer may be cleared while the function still attempts to use it, leading to a crash. The fix safely checks the pointer before use.

In the Linux kernel's NFS server (nfsd), the vulnerability concerns the order of DRC hash table initialization before registering the shrinker. On weakly-ordered architectures (arm64, ppc), the shrinker may observe an uninitialized hash table, causing a NULL pointer dereference in the callback. The fix moves the initialization before registration.

In the Linux kernel's SMB client, the vulnerability involves hardening the DFS cache against invalid target hints. Functions get_tgt_name() and dfs_cache_noreq_update_tgthint() do not handle missing hints (NULL) properly, potentially leading to NULL pointer dereferences. The fix hardens the callers and adds NULL checks.

In the Linux kernel Bluetooth subsystem, hci_send_cmd_sync() cloned the sent command into hdev->req_skb using skb_clone(). Under memory pressure this clone could fail, leaving req_skb NULL, so hci_req_cmd_complete() never invoked hci_cmd_sync_complete() and the waiter timed out with -ETIMEDOUT after 10 seconds. The fix replaces skb_clone() with skb_get(), which only increments the reference count and cannot fail.

A race condition in the Linux kernel between KASAN quarantine cache shrink and CPU hotplug was found. When a CPU goes offline, objects remain on its per-CPU shrink_qlist and are not returned to the slab allocator, causing incomplete cache destruction and kernel warnings. Affects kernels with CONFIG_KASAN_GENERIC enabled.

In the Linux kernel, the procfs interface for reading PCI config space (proc_bus_pci_read) checked CAP_SYS_ADMIN based on the credentials of the task calling read(), not the process that opened the file. A privileged process could open the file and pass the file descriptor to an unprivileged process, which could then read the entire config space. The fix uses file_ns_capable() to check the credentials recorded in file->f_cred at open time, aligning with sysfs behavior.

In the Linux kernel's iommu/arm-smmu-v3 driver, the vulnerability involves teardown management. Manual freeing of resources in arm_smmu_device_remove() runs in the wrong order relative to devm-managed resources, potentially causing use-after-free, e.g., the IOPF queue freed before the IRQ that uses it. The fix moves all management to devm.

In the Linux kernel, the batman-adv module's dat handling updated MAC addresses using a simple copy, which could be partially observed by parallel readers. A reader might transport a half-updated MAC address over the network or use it in ARP responses, poisoning the ARP cache. The fix uses atomic64_t to store the 48-bit MAC address, ensuring readers see either the old or new address, never a mixture.

A bug in the Linux kernel's I3C subsystem causes recursive locking during registration of new I3C devices. The function i3c_master_register_new_i3c_devs() registers devices while holding i3c_bus_normaluse_lock(), and device_register() can immediately trigger a probe callback that tries to acquire the same lock again, leading to a deadlock. The fix separates device creation from registration and uses the maintenance lock.

In the Linux kernel, the dm-pcache module did not validate cache segment IDs from persistent memory before indexing into cache->segments[]. With only CRC protection using a public seed, an attacker with CAP_SYS_ADMIN supplying the cache device could cause out-of-bounds reads and writes via crafted metadata. The fix adds validation and rejects invalid segment IDs with -EIO.

The Linux kernel's i3c master subsystem had a use-after-free vulnerability in the master->this pointer. Sysfs attribute callbacks dereferenced master->this, which was freed in i3c_master_detach_free_devs() before the master device was released. The fix keeps master->this alive until i3c_masterdev_release() and resets it on error paths.

In the Linux kernel, the i3c_master_search_i3c_dev_duplicate() function that searches for duplicate I3C devices can incorrectly match the master device itself (master->this), returning the controller as a duplicate. Since the controller is not a target device, it cannot be a duplicate of one. The fix excludes master->this from matching.

In the Linux kernel, the dm-pcache module does not validate the persisted dirty_tail chain at load. A crafted image, whose on-media fields are authenticated only by a crc32c with a fixed seed, can aim dirty_tail at a chain of last ksets that never terminates, causing cache_writeback_fn() to re-arm itself forever. The fix adds validation of the dirty_tail chain at load with a hop cap.

A bug in the Linux kernel's memcg subsystem causes LRU size accounting to be copied to the parent instead of moved when a memory cgroup is offlined, leaving stale counters on the child. This makes the LRU (or MGLRU) scanner read phantom sizes and grind through empty lists on dying cgroups, over-budgeting limits and wasting CPU. On one host, counters described 476 GiB of pages—1.89x the machine's RAM.

A use-after-free vulnerability was found in the Linux kernel's virtio_pmem driver for NVDIMM persistent memory. The issue occurs when a request has already been freed by the submitter but is still reachable via the virtqueue, leading to waking up freed memory during interrupt handling.