Linux kernel vulnerabilities

In the Linux kernel's ARM SCMI subsystem, a vulnerability exists where channel state is published after callbacks are enabled, potentially leading to NULL pointer dereference in the RX callback. This affects both mailbox and SMC channels, where early interrupts can trigger callbacks before the cinfo or handle pointers are initialized.

In the Linux kernel's ARM SCMI subsystem, a vulnerability exists where the device notifier is not unregistered before the active_protocols IDR is destroyed. This can lead to a race condition where the notifier callback attempts to access the already freed IDR structure.

In the Linux kernel's ARM SCMI subsystem, a vulnerability exists where notifications are not quiesced before TX/RX channels are torn down, potentially leading to use-after-free in the notification callback. Additionally, the late-init work may run after the notification instance is freed.

In the Linux kernel's ARM SCMI subsystem, a vulnerability exists where on channel setup failure, previously registered channels are not properly cleaned up. This can lead to resource leaks or leaving an inconsistent state.

In the Linux kernel's ARM SCMI subsystem, a vulnerability exists where on IDR insertion failure after successful transport channel setup, the cleanup callback (chan_free) is not invoked. This can lead to resource leaks such as IRQs, mailbox channels, and shared memory.

In the Linux kernel's ARM SCMI subsystem, a vulnerability exists where during channel cleanup, the callback that removes entries from the IDR while iterating with idr_for_each() can invalidate the iterator, leading to unsafe behavior. Additionally, the callback cannot be protected by rcu_read_lock() because it may sleep.

In the Linux kernel's ARM SCMI subsystem, a vulnerability exists where protocol IDs from the device tree (DT) outside the allowed range are not rejected, potentially leading to truncation and misinterpretation of the protocol. This can also cause aliasing of protocol identities.

In the Linux kernel's ARM SCMI subsystem, a vulnerability exists where on protocol bind failure, the SCMI handle is not released, leading to reference leaks and leaving an inconsistent state. This also applies when device_link_add() fails.

In the Linux kernel's ARM SCMI subsystem, a vulnerability exists where on failure to configure an additional TX receiver channel, the primary mailbox channel is not released, leaving the channel busy.

In the Linux kernel's ARM SCMI subsystem, a vulnerability exists where on failure to configure an additional P2A receiver channel, the primary P2A channel is not released, leaving the channel busy.

In the Linux kernel, the arm_scmi firmware driver has a device lifetime management flaw. scmi_child_dev_find() drops the reference returned by device_find_child() before returning the scmi_device pointer, so a concurrent unregister can release the device while the destroy path still uses the returned pointer. Additionally, the SCMI bus ID may be reused before the old sysfs entry is removed.

In the Linux kernel, the arm_scmi firmware driver has a flaw in transport device lookup during channel teardown. scmi_device_destroy() uses the same protocol/name matching as driver binding, so it fails to find transport devices that must be unregistered. Additionally, duplicate protocol nodes in firmware can reuse an existing transport device and then destroy it.

In the Linux kernel, the cxl/features module's cxlctl_get_feature() sizes its output buffer from the user's fwctl_rpc.out_len but tells the device to write cxl_mbox_get_feat_in.count bytes, where count is a separate user-controlled value. Nothing bounds count against out_len, so a small out_len with a large count overflows the kvzalloc()'d buffer, causing a heap out-of-bounds write reachable from FWCTL_RPC.

In the Linux kernel, the cxl/features module's cxlctl_set_feature() sizes its output buffer from the user's fwctl_rpc.out_len but never checks it is large enough to hold even the fwctl_rpc_cxl_out header. With out_len == 0, kvzalloc() returns ZERO_SIZE_PTR, which passes the !rpc_out check, and the subsequent rpc_out->size = 0 writes through the poison pointer.

In the Linux kernel, the cxl/features module's cxl_get_feature() reads a feature in a loop but passes a fixed size_out as the output capacity every iteration. On the last partial iteration the buffer has less room left, so a device that returns more than asked can overflow feat_out.

In the Linux kernel, the dax/fsdev module does not clear pgmap->vmemmap_shift when binding a static DAX device. When rebinding a static device from device_dax (which may set vmemmap_shift based on alignment) to fsdev_dax, the stale vmemmap_shift persists on the shared pgmap, causing the vmemmap to be built for a different folio order than fsdev requires.

In the Linux kernel, the dax/fsdev module's fsdev_dax_probe() sets pgmap->ops and pgmap->owner but never clears them on unbind. For a static device the pgmap is shared and long-lived, so after fsdev unbinds a static device the stale fsdev_pagemap_ops survives on the shared pgmap. A subsequent memory_failure can then dispatch through the stale, possibly freed handler.

In the Linux kernel, the dax/fsdev module's __fsdev_dax_direct_access() uses virt_addr + linear_offset instead of __va(phys) for the kaddr return. For multi-range devices with physical gaps between ranges, this linear arithmetic crosses the gap and produces a wrong kernel virtual address.

In the Linux kernel, the dax module's dax_holder_notify_failure() reads dax_dev->holder_ops twice without READ_ONCE() — once for the NULL check and once for the indirect notify_failure() call. A concurrent fs_put_dax() can clear holder_ops between the two reads, so the check observes a non-NULL pointer while the call dereferences NULL.

In the Linux kernel, the irqchip/renesas-irqc driver leaks resources on driver removal. The driver allocates domain generic chips at probe, but on removal they are not automatically freed because the domain flags do not include IRQ_DOMAIN_FLAG_DESTROY_GC. This leaks the structures and leaves them on the global list, where they may later be accessed by generic interrupt chip suspend, resume, or shutdown callbacks after the driver has been removed.

In the Linux kernel, the media bcm2835-unicam driver failed to free the asc structure allocated by v4l2_async_nf_add_fwnode_remote() in error and module removal paths. This caused a memory leak detected by kmemleak after rmmod.

In the Linux kernel, the media ipu6 driver freed pdata after auxiliary device initialization, which could lead to a double free of the same object. Error paths already call put_device() and auxiliary_device_uninit(), which trigger release via ipu6_bus_release().

In the Linux kernel OPP subsystem, the initialization order of pointers was changed so that *opp_table was initialized after *opp. This altered the cleanup function order and caused use-after-free errors when _opp_kref_release accessed the already freed opp->opp_table.

In the Linux kernel drm/amd/display driver, a teardown race exists with DM I2C adapters. Adapters can remain visible to userspace during DM teardown, and a concurrent i2c-dev transfer may call amdgpu_dm_i2c_xfer() after DM state is destroyed, leading to a NULL pointer dereference.

In the Linux kernel drm/bridge tc358767 driver, tc_aux_transfer() did not clamp the AUX read size to the request size. The controller could report up to 255 bytes, overflowing the 16-byte auxrdata stack buffer and the caller buffer.

A use-after-free vulnerability was found in the Linux kernel's PAT (Page Attribute Table) mechanism for x86. The issue occurs during concurrent module loading/unloading on multiple CPUs, when the large-page collapse operation is not protected by the proper lock, leading to a write to freed memory and system crash.

In the Linux kernel wifi iwlwifi driver, the loop counter 'count' in iwl_fwrt_dump_error_logs was declared as u8 while num_pc is u32. If firmware advertises more than 255 PC entries, the counter wraps and the loop never terminates, potentially causing an infinite loop or reading past the pc_data array.

In the Linux kernel wifi iwlwifi mvm driver, iwl_mvm_frob_txf_key_iter() had an off-by-one error in calculating the start offset for key sanitization. This zeroed one byte before the match and left the final key byte unsanitized.

In the Linux kernel wifi iwlwifi mei driver, the SAP message size was not checked before reading the message. The lack of size verification could lead to a buffer overflow.

In the Linux kernel wifi iwlwifi driver, iwl_dbg_tlv_alloc_fragments could cause a division by zero when num_frags was 0. Missing checks on the required size and fragment count allowed this situation.

In the Linux kernel, the host1x driver's debug output helpers used vsnprintf(), which returns the length the formatted string would have reached with an unbounded buffer. This value was passed as the number of bytes to emit, potentially causing a read past the end of the output buffer if the string exceeded 256 bytes. The issue affected debugfs files and was unlikely in practice.

In the Linux kernel, the drm/msm/adreno driver's a6xx_gpu_init() function has a use-after-free bug on the error path. The a6xx_destroy() function frees 'a6xx_gpu', and then 'adreno_gpu' points to freed memory. The fix preserves the error code before freeing the memory.

In the Linux kernel, the drm/msm driver's recover_worker function leaks a reference to the task_struct. get_pid_task() increments the reference count, but the corresponding put_task_struct() is missing in the else branch, leaking a reference on every GPU hang recovery.

In the Linux kernel, the drm/msm driver's msm_ringbuffer_new() destroys a partially initialized ring through msm_ringbuffer_destroy() when an allocation or scheduler setup step fails. If drm_sched_init() fails before finishing initialization, the failure path still calls drm_sched_fini(), which assumes initialized scheduler state. The fix tracks successful scheduler initialization and calls drm_sched_fini() only after drm_sched_init() returned 0.

In the Linux kernel, the scsi: ufs: core driver has a potential memory reclaim deadlock in the TX EQTR context. Functions ufshcd_tx_eqtr(), __ufshcd_tx_eqtr(), and ufs_qcom_get_rx_fom() allocate memory with GFP_KERNEL, which can trigger direct reclaim that depends on I/O to the UFS device, while the queue is quiesced, leading to deadlock. The fix uses memalloc_noio_save/restore() in ufshcd_tx_eqtr() to cover all allocations in the call tree.

In the Linux kernel, the usb: gadget: f_uac1_legacy driver's UAC1_STR_ATTRIBUTE macro defines show/store handlers for the fn_play, fn_cap, and fn_cntl string options. The store function contains an inverted null check on the kstrndup() return value, causing every write attempt to return -ENOMEM on success and dereference a NULL pointer on allocation failure. The attributes have been broken and unused for years. The fix removes the macro and the three attributes.

In the Linux kernel, the UDF filesystem's udf_symlink_filler() can enter udf_pc_to_char() with a partial pathComponent header. The fix adds validation that enough input remains for a complete header before accessing it, rejecting malformed symlink data that would otherwise cause an out-of-bounds read.

In the Linux kernel, the uio driver has a stale info pointer issue in the failed registration path. After device_add(), the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, __uio_register_device() unwinds the device but leaves idev->info pointing at the caller-owned struct uio_info. This is unsafe when an opener races with the failed registration path, leading to use-after-free. The fix handles post-device_add() failures like unregister: removes UIO attributes, clears idev->info under info_lock, and wakes waiters before removing the device.

In the Linux kernel, the speakup: keyhelp driver's help_init() builds letter_offsets[] by using the first byte of each function name as an index via `(start & 31) - 1`. If function names are overridden from sysfs (root) with a name starting outside [a–z], the index underflows or exceeds the array, leading to OOB write. The fix checks the first letter in help_init() and returns an error if it is not in the [a–z] range.

In the Linux kernel, the misc: bcm-vk driver has an ordering issue with msgq_inited. bcm_vk_sync_msgq() fills the message queue information and then sets msgq_inited. Readers call bcm_vk_drv_access_ok() before accessing the queues. atomic_set()/atomic_read() do not order those accesses, so a reader can see msgq_inited set while still seeing stale queue information. The fix uses release when publishing the initialized queues and acquire when checking the gate.

In the Linux kernel, the ad525x_dpot driver created sysfs files manually in probe, causing issues with rolling back partial sysfs state on error and with removing files on device detach. The vulnerability was fixed by moving device attributes into driver core dev_groups and adding an is_visible() callback that exposes only attributes supported by the probed device.

In the Linux kernel, the ipack ipoctal driver had three issues when a device was removed while a tty session was active: a use-after-free of struct ipoctal, a NULL dereference in ipoctal_write_tty(), and a use-after-free in ipoctal_cleanup(). Fixes introduce kref-based lifetime management, a NULL check for xmit_buf, and a "removed" flag checked in tty operations.

In the Linux kernel, in the mtdswap module, a debugfs setup failure after successful blktrans registration could free the mbd_dev structure twice. The fix clears the local pointer after deregistration so the common cleanup path does not free the blktrans object twice.

In the Linux kernel, mtd_add_partition() did not reject the special offset value MTDPART_OFS_RETAIN (-3), leading to a WARN_ON in add_mtd_device() when called through the BLKPG ioctl on NAND devices. The RETAIN value relies on cur_offset being the end of the previous partition, but in the dynamic partition path cur_offset equals the offset argument itself, causing undefined behavior.

In the Linux kernel, in the drm/v3d driver, the BO list was only attached to the last job in a chain, so when the last job was a trailing CACHE_CLEAN job, the job actually consuming the BOs had no implicit dependencies. This could allow one context to read a BO while another was still writing it, causing data corruption. The fix attaches BOs to the consuming job and adds a has_implicit_dep flag.

In the Linux kernel, the software_node_get_reference_args() function incorrectly checked the index bounds when UINT_MAX was passed, leading to an out-of-bounds access in the property array. The fix extends the bounds check to also cover the UINT_MAX case.

In the Linux kernel, bpf_arena_free_pages() accepted arena addresses below the arena base, which after masking to the low 32 bits and reconstructing the user address led to freeing a range outside the arena mapping. The fix rejects such frees before computing the clipped range.

In the Linux kernel, the BPF interpreter does not support arena-related instructions, yet interpreter fallback was allowed for them, leading to a BUG_ON() hit in ___bpf_prog_run() at runtime. The fix sets jit_required to true when an arena map is used in the program to disallow interpreter fallback.

In the Linux kernel, the BPF interpreter does not recognize the BPF_JMP|BPF_JA|BPF_X instruction used for the insn_array map, leading to a BUG_ON() hit in ___bpf_prog_run() at runtime. The fix sets jit_required to true when an insn_array map is used in the program to disallow interpreter fallback for the gotox instruction.

In the Linux kernel, the dmaengine dw-edma driver called vchan_cookie_complete() on a deferred STOP, scheduling a callback for the active descriptor and leaving other descriptors queued. A late callback after dmaengine_terminate_sync() could dereference freed client state, and leftover descriptors could restart into reused buffers. The fix moves all issued and submitted descriptors to the terminated list without scheduling callbacks.