Linux kernel vulnerabilities

In the Linux kernel's BPF subsystem, there is a vulnerability allowing writes through untrusted BTF pointers, bypassing the read-only policy for pointers created by helpers such as bpf_rdonly_cast(). Non-read accesses are not rejected at the common entry point.

In the Linux kernel's staging media ipu7 driver, there is a pm_runtime refcount leak in ipu7_resume(). Using pm_runtime_get_sync() without balancing on error leaves the usage count incremented.

In the Linux kernel's rcar thermal driver, there is an error checking issue in probe(). The thermal_zone_device_enable() function is called before checking if thermal zone registration succeeded, which could lead to an error pointer dereference.

In the Linux kernel's USB gadget r8a66597 driver, there is a double free of ep0_req in the probe error path. If usb_add_gadget_udc() fails, ep0_req is freed twice, which could lead to memory corruption.

A vulnerability exists in the Linux kernel's UDF filesystem. When an I/O error occurs while writing the Logical Volume Integrity Descriptor (LVID) buffer, the block layer clears the BH_Uptodate flag even though the in-memory LVID data remains valid. If the filesystem is later remounted read-write or synced, udf_open_lvid() and udf_sync_fs() modify the buffer and call mark_buffer_dirty(), triggering a spurious WARN_ON_ONCE(!buffer_uptodate(bh)) warning.

In the Linux kernel's drm/amdgpu/mes driver, the loop initializing the hung_queue_db_array iterated only AMDGPU_MAX_MES_PIPES times, leaving entries uninitialized for multi-XCC GPUs. This can lead to null pointer dereferences when accessing arrays indexed by XCC ID >= 2. The fix extends the loop to cover all XCCs.

In the Linux kernel, bpf_get_btf_vmlinux() has a race condition when publishing the parsed vmlinux BTF result. The result is published via a plain store and read locklessly, which on weakly ordered architectures could allow observing the pointer before initialized data is visible. The fix adds memory barriers (smp_store_release/smp_load_acquire).

In the Linux kernel, bpf_find_vma() reads task->mm and calls mmap_read_trylock() without holding a reference to mm_struct. For a foreign task, concurrent exit_mm() can free the mm_struct between the read and the trylock, leading to use-after-free. The fix pins the mm under task->alloc_lock and uses mmput_async(), rejecting irqs-disabled contexts and !CONFIG_MMU.

In the Linux kernel's bus: mhi: ep driver, mhi_ep_create_device() takes device references for UL and DL channels. If dev_set_name() or device_add() fails, the error path drops only one reference, causing a reference leak and leaving channels associated with an unregistered device. The fix routes both failures through a common unwind path.

In the Linux kernel, when an architecture implements bpf_jit_inlines_helper_call(), the verifier skips rewriting the helper call offset. If JIT is disabled or JIT compilation fails, the program falls back to the interpreter, causing a jump to an invalid address and kernel panic. The fix sets prog->jit_required = 1 to reject such programs when JIT is unavailable.

In the Linux kernel's printk, during legacy printing a handover to another context can occur, releasing the console SRCU read lock and potentially invalidating the console struct pointer. console_flush_one_record() did not check for this after emission, leading to possible use-after-free. The fix moves further @con usage after the handover check.

In the Linux kernel's riscv_acpi_add_prt_dep(), the acpi_get_handle() call can fail, leaving link_handle uninitialized. The fix checks the return status of acpi_get_handle() and skips the entry if it fails.

In the Linux kernel's riscv_acpi_add_prt_dep(), the loop handles error conditions incorrectly by continuing without updating the entry pointer, skipping entries. The fix rewrites the loop as a for loop with correct continuation and uses helper functions.

In the Linux kernel's platform/x86: dell-privacy driver, there is a race condition when accessing priv->features_present. Access must be done with the list mutex held, otherwise priv can be freed at any moment. The fix ensures the mutex is held during access.

In the Linux kernel's platform/x86: dell-wmi-base driver, there is a resource leak on module load failure. The fix ensures proper cleanup of the SMBIOS request and the privacy driver when the module load fails.

In the Linux kernel, the platform/x86 dell-wmi-base module has an indexing bug when handling the ultra performance key. The event data passed to dell_wmi_process_key() is already parsed, so using the wrong index to access the first data field can cause a buffer overread.

In the Linux kernel, the platform/x86 lg-laptop module mishandles LED resources. The event notification callback may access kbd_backlight even when it was not successfully registered with the LED subsystem, and acpi_remove() unregisters LED devices unconditionally.

In the Linux kernel, the BPF verifier mishandles scalar ids when filling the stack with sign-extending narrowing loads. The shared scalar id is not dropped, so two registers can share the same id while holding different values, allowing the verifier to infer incorrect bounds and enabling an out-of-bounds access.

In the Linux kernel, the remoteproc qcom_q6v5_adsp driver has a device node reference leak. The adsp_map_carveout function calls of_parse_phandle_with_args() but does not release the node reference via of_node_put().

In the Linux kernel, the BPF subsystem fails to validate the rdonly_buf_size and rdwr_buf_size kfunc arguments. Values exceeding U32_MAX are not rejected but truncated when assigned to the u32 mem_size field, causing the verifier to record an incorrect memory size bound.

In the Linux kernel, the platform/x86 asus-wireless module's asus_wireless_probe() returns success when acpi_match_acpi_device() finds no match. This leaves an input device without a notify handler, and when force-bound to a device without an ACPI companion it stores a NULL pointer, causing a NULL pointer dereference on unbind.

In the Linux kernel, the qcom-geni serial DMA TX completion path advanced the transmit FIFO by the byte count stored in port->tx_remaining. If uart_flush_buffer() ran after the hardware completed a DMA transfer but before the completion interrupt was handled, a stale DMA completion could advance and discard new bytes written after the flush. The fix marks an in-flight DMA transfer as stale when the transmit FIFO is flushed.

In the Linux kernel USB gadget UAC1/UAC2 module, configfs rate-list attributes did not validate the input length before storing values into fixed-size arrays of UAC_MAX_RATES (10) entries. Supplying more than ten rates caused an out-of-bounds write past p_srates[] or c_srates[], leading to memory corruption. Additionally, freeing the advanced strsep() cursor caused a memory leak or an interior pointer free.

In the Linux kernel, the error paths for endpoint-disabled (ESHUTDOWN) and request-allocation failure (ENOMEM) in ffs_dmabuf_transfer() of the USB gadget f_fs driver called dma_fence_put() on a fence that had only been kmalloc'd, without dma_fence_init() having been called. Calling dma_fence_put() on such an uninitialized object leads to undefined behavior. The fix replaces it with kfree().

In the Linux kernel, os_desc_qw_sign_show() in the USB gadget configfs driver passed OS_STRING_QW_SIGN_LEN (14) as the input length to utf16s_to_utf8s(), but that argument counts UTF-16 code units while the qw_sign[] array holds only 7 units. When the stored signature fills the array without a NUL terminator, the conversion reads up to 7 units past the end of qw_sign[], exposing adjacent bytes of struct gadget_info through the configfs attribute.

In the Linux kernel, ljca_enumerate_gpio() in the USB ljca driver reads desc->bank_num from the device and loops writing into valid_pin[], which holds only 2 entries. Existing checks do not bound bank_num against the size of valid_pin[], so a device reporting bank_num 9 with pins_per_bank 7 passes validation and overruns the stack. A broken or malicious LJCA device can therefore overflow the stack.

In the Linux kernel, ast_udc_probe() in the USB gadget aspeed_udc driver allocates a coherent DMA buffer used as backing store for endpoint buffers, and ast_udc_init_ep() derives per-endpoint pointers from udc->ep0_buf. A failed allocation is dereferenced during probe, and the existing error path calls ast_udc_remove(), which is unsafe before usb_add_gadget_udc() succeeds. The fix adds an allocation check and a local cleanup helper.

In the Linux kernel, dynamic USB IDs are only guaranteed to be valid while usb_dynids_lock is held, as remove_id_store can free the node. usb_probe_interface used these IDs without copying them, leading to a use-after-free when probe runs concurrently with dynamic ID removal. The fix makes a copy of the ID in usb_probe_interface.

In the Linux kernel, the error path labels in asus_wmi_add() of the platform/x86 asus-wmi driver are out of order relative to the subsystem registration sequence. As a result, failures in asus_wmi_custom_fan_curve_init() or asus_screenpad_init() skip cleanup calls for previously registered resources, leaking them. The fix reorders the labels to match the reverse order of allocations.

In the Linux kernel, mlxbf_pmc_probe() in the platform/mellanox mlxbf-pmc driver passes the result of ACPI_COMPANION() to acpi_device_hid(), which dereferences it. Since a platform driver can be force-bound to a device without an ACPI companion, this leads to a NULL pointer dereference. The fix adds an ACPI_COMPANION() check against NULL and returns -ENODEV.

In the Linux kernel, san_probe() in the platform/surface acpi-notify driver dereferences the result of ACPI_COMPANION() when installing the GSBUS address space handler. Since a platform driver can be force-bound to a device without an ACPI companion, this leads to a NULL pointer dereference. The fix checks the ACPI companion against NULL and returns -ENODEV.

In the Linux kernel, a vulnerability was resolved in the clk: qcom: camcc-sc8280xp driver where CAMCC_GDSC_CLK was not unregistered. With the introduction of sync_state support in the clk and pmdomain subsystems, a kernel warning about titan_top_gdsc status stuck at 'on' occurred when unused clocks were shut down.

In the Linux kernel, bpf_cpumask_populate() writes to its destination with bitmap_copy(), but the destination is typed as struct cpumask *. This allows the verifier to accept borrowed cpumask pointers returned by read-only kfuncs (e.g., scx_bpf_get_online_cpumask()) as a writable destination. The fix changes the destination type to struct bpf_cpumask * so it follows the same ownership rule as other mutating cpumask kfuncs.

In the Linux kernel, the tracing_multi link does not set ftrace_managed, causing failure to release the tracing_multi link when attaching a tracing_multi link followed by an fentry link. This triggers a warning in bpf_trampoline_multi_detach and potential resource leaks. The fix sets 'ftrace_managed = true' in register_fentry_multi().

In the Linux kernel, put_gid_ndev() is queued with call_rcu() and implemented in ib_core. Stopping the workqueues does not drain already queued callbacks, so RCU could invoke it after the module code has been unloaded. synchronize_rcu() does not wait for callbacks; the fix waits for them after all producers have stopped.

In the Linux kernel, devx_free_subscription() can remain queued after the last DevX event file drops its module reference or an auxiliary driver detaches its devices. mlx5_ib can then unload before the callback runs. Registration error unwind has the same risk; the fix waits after all drivers have stopped.

In the Linux kernel, IPoIB reclamation completions can be signaled from inside an RCU callback. Teardown can wake before the callback returns and unload ib_ipoib while its code is still executing. Client registration failure can also remove already-added devices and queue callbacks; the fix waits after client and workqueue teardown.

In the Linux kernel, restore_dm_crypt_keys_to_thread_keyring() gets a reference to the user keyring before restoring saved dm-crypt keys. The same reference is passed to add_key_to_keyring() for each key, but that function drops the reference on every call. With multiple keys, the reference is dropped too many times, potentially triggering a refcount underflow or use-after-free. With more than five keys restored, a warning can be triggered.

In the Linux kernel, esp_ssg_unref() releases page references held on the source scatterlist after the AEAD operation completes. It calls skb_page_unref() on every frag page for out-of-place transforms and in the error path of esp_output_tail(). This is wrong when the skb carries managed frags (SKBFL_MANAGED_FRAG_REFS), which are owned by a zerocopy ubuf and the skb does not hold a per-frag page reference. The missing guard causes a page reference count underflow and frees a page still in use.

In the Linux kernel, rvt_alloc_device() deallocates the IB device when its port array cannot be allocated but then returns the pointer to the released allocation. Callers treat any non-NULL value as valid and dereference it, resulting in a use-after-free. The fix returns NULL immediately after deallocation so callers can propagate the allocation failure.

Vulnerability in the hfi1 driver in the Linux kernel concerns the hfi1_free_devdata() function, which assumes the device was inserted into the unit table and unconditionally erases dd->unit. If xa_alloc_irq() fails, the zero-initialized unit remains zero, so full cleanup can remove an unrelated device from index 0.

Vulnerability in the hfi1 driver involves memory leak during late probe failure. The hfi1_init_dd() function allocates shared AIP/VNIC RX support before returning. If hfi1_init() or hfi1_register_ib_device() later fails, init_one() tears down device data without calling hfi1_free_rx(), leaking netdev_rx and its dummy netdev.

Vulnerability in the v4l2-async subsystem in the Linux kernel causes a crash when disconnecting an em28xx USB device using the i2c tvp5150 driver. When the asc_list is empty, v4l2_async_unregister_subdev() never calls v4l2_device_unregister_subdev(), leading to a crash. The fix calls v4l2_device_unregister_subdev() even when asc_list is empty.

A use-after-free vulnerability exists in the Linux kernel's rdtgroup_kn_put() function within the fs/resctrl subsystem. The rdtgroup structure can be freed by two racing mechanisms, leading to use-after-free and potentially double-free. The fix replaces atomic_dec_and_test() with atomic_dec_and_mutex_lock() to ensure mutual exclusion with bulk free paths.

Use-after-free vulnerability in the Linux kernel's resctrl subsystem when removing monitoring domains. Worker threads reading event counters may sleep and use delayed_work embedded in the domain structure. Under certain conditions, while a worker waits for a lock, the domain can be freed, leading to a reference to freed memory.

A deadlock exists in the Linux kernel's rpmsg glink implementation when destroying an endpoint during driver detach. The endpoint destroy routine attempts to unregister the underlying rpmsg device, which tries to re-acquire the same device mutex already held by the device core, causing rmmod to hang indefinitely. The fix removes the redundant unregistration.

Vulnerability in the cxl/mbox subsystem in the Linux kernel involves an infinite loop in the poison list handling. A device returning count == 0 with CXL_POISON_FLAG_MORE set every iteration never advances nr_records, so the max_errors guard never trips and the do/while loop runs forever while holding poison.mutex. This hangs the sysfs-triggered scan thread and blocks all subsequent poison operations. The fix stops the loop on an empty payload.

Vulnerability in the cxl/features subsystem in the Linux kernel involves missing serialization of multi-part Get/Set Feature transfers. A payload larger than the mailbox payload size is split into multiple mailbox commands, but mbox_mutex only serializes individual commands and is dropped between iterations. Concurrent calls from fwctl and EDAC paths can interleave parts of transfers, corrupting the device's transfer context. The fix adds a per-mailbox feat_mutex held across the entire transfer.

Vulnerability in the HFS+ filesystem in the Linux kernel involves missing validation of the thread record before rebuilding the delete key. When hfsplus_delete_cat() is called with str == NULL, it reconstructs the key from thread.nodeName without checking if the record is valid. A corrupted image can provide an oversized name length, leading to a buffer overflow. The fix uses hfsplus_brec_read_cat(), which bounds the record read and verifies the record size.

Vulnerability in the ath12k wifi driver in the Linux kernel involves dangling dp_link_peer references during AP vdev rollback. When vdev creation fails after ath12k_peer_create(), the function does not call ath12k_dp_link_peer_unassign(), leaving published references pointing to potentially freed memory, leading to use-after-free. The fix uses ath12k_peer_delete(), which performs unassign first.