Linux kernel vulnerabilities

In the Linux kernel, the drm/amdgpu driver added basic validation for the RAS header. If the RAS header read from EEPROM is corrupted, it could result in trying to allocate huge memory for reading the records; validation of header fields was added.

In the Linux kernel, additional checks for DSC / HUBP ONO guarantees were added in drm/amd/display. For non-zero DSC instances, the HUBP domain required to drive it for sequential ONO ASICs may not be met, potentially causing the tile logic to enter an undefined state leading to a system hang.

In the Linux kernel, the drm/xe driver has a bug that attempts to take an invalid lock when handling a device wedge. If the device wedges, e.g., during GuC upload, the wedge call tries to use an uninitialized lock, triggering a DEBUG_LOCKS_WARN_ON warning.

In the Linux kernel, a vulnerability was fixed in firmware: cs_dsp involving an out-of-bounds memory read in a KUnit test. KASAN reported an out-of-bounds access in cs_dsp_mock_bin_add_name_or_info because the source string length was rounded up to the allocation size.

In the Linux kernel, a fix was made for an out-of-bounds (OOB) memory read access in the KUnit test (ctl cache) within the firmware: cs_dsp component. The code used `mock_coeff_template.length_bytes` (4 bytes) for register value allocations, but later this length was set to 8 bytes, causing test failures. The fix removes the length override, keeping the original value 4 for all operations.

In the Linux kernel, a vulnerability was fixed in firmware: cs_dsp involving an out-of-bounds memory read in a KUnit test (wmfw info). KASAN reported an out-of-bounds access in cs_dsp_mock_wmfw_add_info because the source string length was rounded up to the allocation size.

In the Linux kernel, the iavf driver's crit_lock mechanism was removed because it caused deadlocks during virtual function (VF) removal and reset. It was replaced with netdev_lock and the work cancellation scheme was changed to avoid synchronization errors.

A bug in the Linux kernel's uprobe handling can cause a page table entry (PTE) to be overwritten when expanding a VMA. Through mremap and VMA merging operations, a uprobe PTE becomes orphaned, triggering a 'Bad rss-counter state' warning and potentially leading to memory accounting inconsistencies.

In the Linux kernel, the ath12k Wi-Fi driver has a memory leak caused by redundant rx_stats allocations when the same station is added multiple times. ath12k_mac_station_add() allocates rx_stats each time without checking whether it is already allocated.

In the Linux kernel, the drm/msm/a7xx driver fails to call the CP_RESET_CONTEXT_STATE packet when switching contexts. State used by userspace to synchronize between BR and BV is not reset, which can cause another context to malfunction.

In the Linux kernel, a bug was fixed in the dm (device mapper) function dm_revalidate_zones(), which failed to properly update zoned settings on table reload when the device already had zone write plug resources. This caused a mismatch in conv_zones_bitmap size and invalid memory read errors. The fix restricts table reloads that change zoned settings for devices with allocated zone plug resources.

In the Linux kernel, a vulnerability was fixed in the drm/amd/display module where a lack of proper stream ID check in the DML21 wrapper when querying plane_id caused a false positive warning during mode reset (e.g., amdgpu_gpu_recover). The warning occurred in dml2_map_dc_pipes due to incorrect validation, not a critical error.

In the Linux kernel, the following vulnerability has been resolved: on arm64, UXN was not set on swapper page tables. On a system implementing FEAT_EPAN, read/write access to the idmap is denied because UXN is not set on the swapper PTEs; as a result, idmap_kpti_install_ng_mappings panics the kernel when accessing __idmap_kpti_flag. The fix sets UXN on these PTEs.

In the Linux kernel, the following vulnerability has been resolved: arm64: set UXN on swapper page tables. On a system that implements FEAT_EPAN, read/write access to the idmap is denied because UXN is not set on the swapper PTEs. As a result, idmap_kpti_install_ng_mappings panics the kernel when accessing __idmap_kpti_flag. Fix it by setting UXN on these PTEs.

In the Linux kernel, the btrfs subsystem incorrectly estimates the number of extents using the constant BTRFS_MAX_EXTENT_SIZE instead of the actual limit fs_info->max_extent_size. On zoned filesystems where BTRFS_MAX_EXTENT_SIZE exceeds max_zone_append_size, this causes a massive increase in extent count and metadata reservation exhaustion, leading to warnings and potential failures.

In the Linux kernel, the ASoC sma1307 component lacks a NULL check in sma1307_setting_loaded(). Pointers allocated by kzalloc and devm_kzalloc can be NULL, potentially leading to a NULL dereference.

In the Linux kernel, a vulnerability was resolved in x86/fred: system hang during S4 resume with FRED enabled. Upon wakeup from S4, the restore kernel initialized FRED MSRs, but the image kernel did not restore their pre-hibernation values, leading to a hang.

In the Linux kernel, the cpufreq amd-pstate driver's set_boost function uses an unnecessary driver-wide lock. This lock can collide with the lock in the mode-switch path in status_store(), potentially leading to a deadlock.

In the Linux kernel, a vulnerability was resolved in drm/xe/vf: early GT MMIO initialization is needed to read GMDID. Due to refactoring, gt->mmio was initialized later, and attempts by VF to use xe_mmio_read/write from GuC functions led to an NPD crash due to unset MMIO register address.

In the Linux kernel, a vulnerability was resolved related to Rust incompatibility with FineIBT (CFI). Calling core::fmt::write() from Rust code with FineIBT enabled causes a kernel panic due to a Control Flow Integrity violation. The fix makes CFI_AUTO_DEFAULT depend on !RUST or Rust >= 1.88.

In the Linux kernel, the accel/ivpu driver has a deadlock in ivpu_job_submit due to reversed lock ordering. The thread aborting jobs first takes the submitted_jobs lock and then file_priv, while the job submission thread takes them in the opposite order.

In the Linux kernel, a vulnerability was resolved in UML time-travel mode where sched_yield by userspace may not actually cause scheduling as no time has passed. This can cause extreme slowdown or even deadlock depending on kernel configuration (CONFIG_UML_MAX_USERSPACE_ITERATIONS). The workaround accounts time to the process whenever it executes a sched_yield syscall.

In the Linux kernel, the iommu subsystem does not clear iommu-dma ops on cleanup after an iommu_device_register() error. This can leave devices hooked to iommu-dma and lead to crashes in iommu-dma.

In the Linux kernel, the drm/amd/display driver had a bug causing a hang when link training failed. The enable_streams function assumed link training succeeded and selected the PHY clock, leading to a hang on register write when training had actually failed.

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Guard Possible Null Pointer Dereference. In some situations, dc->res_pool may be null. Check if pointer is null before dereference.

A bug in the Linux kernel's memory reclaim path (mm/vmscan) attempts to reclaim hwpoison (hardware-poisoned) folios, leading to a VM_BUG_ON_FOLIO in add_to_swap when the hwpoisoned page remains on the LRU list with the uptodate flag cleared. The fix skips hwpoisoned pages in shrink_folio_list() and unmaps them earlier.

In the Linux kernel, a vulnerability was resolved in perf/dwc_pcie: wrongly using struct device pci_dev as platform_data during platform_device_register caused a kmemdup copy of pci_dev, leading to list corruption as its mutex content remains the same as the original.

In the Linux kernel, a flaw in drm/xe/vf causes a virtual function (VF) to attempt a full GT reset despite lacking access to the GDRST register. Triggering a reset via debugfs or due to a hang condition leads to a kernel warning and stack trace. The fix sends an H2G VF_RESET action instead.

The Linux kernel has a vulnerability in the amd_set_spi_freq() function of the SPI driver that can lead to out-of-bounds stack access. When speed_hz is less than AMD_SPI_MIN_HZ, the loop iterates beyond the amd_spi_freq array, causing undefined behavior.

In the Linux kernel, a flaw exists in the RISC-V KVM module: during module removal, aia_exit is called before kvm_exit, so the AIA per-CPU IRQ is not properly disabled. This triggers a kernel warning and leaves the IRQ in an inconsistent state, preventing the KVM module from being reinserted.

In the Linux kernel, the idpf driver ignores the error code from register_netdev() during initialization. As a result, a WARN_ON() is triggered on unregister attempts and the user gets no indication that netdev creation failed.

A vulnerability in the Linux kernel's netfs subsystem causes a call to the unimplemented `invalidate_cache` method on filesystems like NFS and Ceph. When writing to the cache (NETFS_WRITE_TO_CACHE) fails, the kernel dereferences a NULL pointer, leading to a crash (oops) and system hang.

A bug was fixed in the Linux kernel's memory-failure handling related to migration of poisoned folios. During unmapping of a poisoned folio, the TTU_HWPOISON flag was not set correctly, causing a kernel warning in try_to_unmap_one. The fix moves the flag-setting policy into unmap_poisoned_folio.

In the Linux kernel, the change "drm/amd/display: Use HW lock mgr for PSR1" was reverted because it may cause a system hang when two eDP panels are connected.

A flaw was found in the Linux kernel's btrfs subsystem where btrfs_set_item_key_safe() was used to modify keys in the RAID stripe-tree, potentially corrupting the tree and triggering a kernel BUG during RAID extent operations. The issue was fixed by using btrfs_duplicate_item() to copy the item and safely adjust both the key and per-device physical addresses.

In the Linux kernel, a use-after-free vulnerability was fixed in the net/mlx5 (HWS) driver that occurs when a firmware failure happens during matcher disconnect. The error flow reconnected the matcher and returned an error, leading to the matcher being freed while still on the matchers list, resulting in use-after-free and eventual crash. The fix avoids reconnecting the matcher when a firmware command fails during disconnect.

In the Linux kernel, the wifi ath12k driver has an out-of-bounds access error. The print_array_to_buf_index() function receives an array length parameter that is too large, resulting in a possible out-of-bounds memory error. Decreasing the buffer size by one fixes the faulty upper bound of the passed array.

In the Linux kernel, a vulnerability was resolved in firmware: qcom: scm: smc: handling missing SCM device. Since qcom_scm_get_tzmem_pool() can return NULL, its users should handle this case.

In the Linux kernel, a use-after-free (UAF) bug exists in the zswap subsystem related to the per-CPU acomp_ctx structure. During compression or decompression, preemption and migration are not disabled, so the operation may continue on a different CPU. If the original CPU is hot-unplugged while acomp_ctx is still in use, its resources may be freed, leading to a UAF.

In the Linux kernel, the drm/amd/display module did not initialize variables used as denominators to a non-zero value. This could lead to a divide-by-zero error (DIVIDE_BY_ZERO), as reported by Coverity.

In the Linux kernel, a vulnerability was resolved in drm/amd/display: wrapper functions for dcn_bw_ceil2() and dcn_bw_floor2() should check for granularity is non zero to avoid assert and divide-by-zero error in dcn_bw_ functions. A check for granularity 0 was added.

In the Linux kernel, the RDMA/siw module removed a direct link to net_device that was improperly managed and caused a 'KASAN: slab-use-after-free' exception during siw_query_port().

In the Linux kernel, a vulnerability was fixed in the PCI imx6 driver where suspend/resume support was broken on the i.MX6QDL platform. Without the patch, suspend/resume would hang the kernel and display an error if a PCIe device was connected.

In the Linux kernel, the BPF verifier incorrectly assumed that raw tracepoint arguments are always non-NULL, while they can actually be NULL. This caused explicit NULL checks to be removed and could lead to kernel crashes when accessing such pointers. The fix marks raw_tp arguments as PTR_MAYBE_NULL and adjusts dereference and helper/kfunc passing handling.

In the Linux kernel, a vulnerability was resolved in gpio: graniterapids: moving the setting of irq_chip.name from probe() to the initialization of the irq_chip struct fixes a vGPIO driver crash during bootup caused by unauthorized modification of the irq_chip.name field when the irq_chip struct was initialized as const.

In the Linux kernel, a vulnerability exists where memory for cacheinfo is not allocated during early boot on some architectures (e.g., x86). Consequently, during the cacheinfo CPU hotplug callback, last_level_cache_is_valid() attempts to dereference a NULL pointer, causing a kernel oops.

In the Linux kernel, the udmabuf module changed the folios array from kmalloc to kvmalloc because large allocations with kmalloc can fail and return NULL, triggering a warning and buffer creation failure. The fix allows fallback to vmalloc, guaranteeing allocation of any size.

In the Linux kernel, the drm/xe/ufence component now prefetches the ufence address to catch bogus addresses. Since access_ok() only checks for address overflow, an additional read is performed to detect invalid addresses sent from userspace.

In the Linux kernel, a vulnerability was resolved in the idpf driver: the idpf_vc_core_init error path was fixed. When the platform running the device control plane is rebooted, the driver detects a reset, releases resources, and waits for completion. If the control plane is not yet started, the driver times out on the virtchnl message and retries establishing the mailbox. In the retry flow, the mailbox is deinitialized but the workqueue is still alive, leading to a null-ptr-deref.

In the Linux kernel, a speculative execution issue exists with non-canonical address accesses on AMD Zen 5 CPUs. Due to AC bit renaming, the speculation window remains open, potentially leaking speculative data through a suitable gadget. This affects user address masking, valid_user_address() checks, and get_user() helpers.