Linux kernel vulnerabilities

In the Linux kernel, the dw-edma dmaengine driver's dw_edma_abort_interrupt() drops vc.lock before updating request and channel status. In that window issue_pending() can observe the old busy state and skip starting queued descriptors, after which the abort handler overwrites the channel status as idle, permanently stranding the new descriptors.

In the Linux kernel, the dw-edma dmaengine driver's pause() and resume() read and update channel state without holding vc.lock, while interrupt handlers update the same state under it. This can record a pause request on an already idle channel that no further interrupt will acknowledge, permanently wedging the channel.

In the Linux kernel, the ASoC meson driver's meson_card_reallocate_links() grows the DAI link and private data arrays with two consecutive krealloc() calls, updating owner pointers only after both succeed. If the first krealloc() moves the data and the second fails, card->dai_link points to an already freed block, leading to a use-after-free and double free.

In the Linux kernel, the iio dac ad5686 driver is missing a NULL check on the chip_info pointer. If a user binds the driver via sysfs driver_override with a device name not present in the id_table or of_match_table, the match data will be NULL.

In the Linux kernel, the RDMA hfi1 driver's set_txreq_header_ahg() ignores the return value of sdma_txinit_ahg(). When initialization fails, tx->txreq is not initialized, yet the caller continues processing the request as though it had succeeded.

In the Linux kernel, the RDMA rxe driver's rxe_requester() does not validate num_sge/cur_sge for WQEs from a user queue. A local unprivileged user can post a WQE with an out-of-range cur_sge or oversized num_sge, forcing an out-of-bounds read of the per-WQE sge array in copy_data() (vmalloc OOB read).

In the Linux kernel, the irqchip gic-v3-its driver's its_vpe_irq_domain_alloc() fails to invoke its_vpe_teardown() in the error path when its_irq_gic_domain_alloc() fails. This leaks the resource associated with the corresponding interrupt.

In the Linux kernel, the RDMA nldev module's RDMA_NLDEV_ATTR_STAT_HWCOUNTERS is a nested attribute whose children are consumed directly with nla_get_u32(). The top-level policy validates only the container, not the fixed shape of each child.

In the Linux kernel, the ACPI processor module's IOAPIC hotplug lookup parses both MADT and _MAT records without full bounds validation. The MADT walk used a subtable's declared length to advance the cursor after only locating a generic header, and the _MAT path likewise passed a generic header to the IOAPIC helper.

In the Linux kernel, the ACPI PCI module's acpi_pci_root_add() assigns the freshly allocated root to device->driver_data before dmar_device_add() and pci_acpi_scan_root(). Only the pci_acpi_scan_root() path clears driver_data before freeing root, so when dmar_device_add() fails a dangling pointer remains. acpi_pci_root_remove() has the same problem.

In the Linux kernel, the BPF queue and stack pop/peek helpers did not zero the output buffer on a failed lock acquisition. BPF programs could observe uninitialized stack contents. The fix clears the buffer before returning -EBUSY.

In the Linux kernel on RISC-V, a memory leak occurs in the BPF JIT. When JIT compilation fails for a later subprogram, bpf_jit_free() does not free the context offset array, causing a leak. The fix adds the missing kfree.

In the Linux kernel on RISC-V with CONFIG_CFI_CLANG enabled, tailcalls in BPF cause kernel stack corruption. Due to double counting the kcfi instruction, the jump skips an extra 4 bytes and misses stack pointer adjustment. The fix removes this double inclusion.

In the Linux kernel on RISC-V, exception handling for BPF load_acquire operations is missing an extable entry, causing a kernel oops on a faulty memory access. Additionally, the rd register is not cleared on fault, allowing data leakage through a map. The fix checks ret >= 0 before adding the handler and passes rd for LOAD_ACQ to zero it on fault.

In the Linux kernel's BPF, the offset check for the BPF_RES_SPIN_LOCK instruction incorrectly uses the offset for BPF_SPIN_LOCK instead of res_spin_lock_off. The fix corrects this to use the proper field.

In the Linux kernel's BTF, btf_find_struct_field() initializes a fresh seen mask on every recursive descent, so unique special fields at different levels of the same aggregate do not see each other. Duplicate fields can reach btf_parse_fields(), triggering an invariant WARN_ON_ONCE(). A crafted user BTF can trigger the warning before capability checks. The fix initializes the mask once and passes the same pointer through the entire traversal.

In the Linux kernel, the RDMA/erdma driver has a use-after-free in the CEQ tasklet during device removal. free_irq() does not drain a tasklet already scheduled by the interrupt handler, so the tasklet can access freed EQ buffers (eq->qbuf or eq->dbrec) after erdma_eq_destroy().

In the Linux kernel, the RDMA/mana_ib module has a use-after-free during partial table insertion of a QP. mana_table_store_ud_qp() publishes a QP before inserting the receive-queue id, dropping the XArray lock, allowing a concurrent completion handler to take a transient reference; when the second insertion fails, rollback erases only the send-queue entry, leaving references outstanding and causing a use-after-free.

A use-after-free vulnerability has been found in the Linux kernel in the ib_query_qp() function within the RDMA/core subsystem. The issue arises from improper synchronization when querying a QP via netlink while the QP is being destroyed, potentially leading to access to freed memory.

In the Linux kernel, the RDMA/core subsystem has a potential use-after-free in ib_destroy_cq_user(). rdma_restrack_del() is invoked too late, leaving the CQ accessible through restrack while vendor-specific resources are already being freed.

In the Linux kernel, the RDMA/core subsystem has a potential use-after-free in ib_destroy_srq_user(). rdma_restrack_del() is invoked too late, leaving the SRQ accessible through restrack while vendor-specific resources are already being freed.

In the Linux kernel, the RDMA/core subsystem has a potential use-after-free in counter_release(). rdma_restrack_del() is invoked too late, leaving the counter accessible through restrack while vendor-specific resources are already being freed.

In the Linux kernel, the RDMA/core subsystem has a potential use-after-free in ib_free_cq(). rdma_restrack_del() is invoked too late, leaving the CQ accessible through restrack while vendor-specific resources are already being freed.

In the Linux kernel, the RDMA/core subsystem has a potential use-after-free in ib_dealloc_pd_user(). rdma_restrack_del() is invoked too late, leaving the PD accessible through restrack while vendor-specific resources are already being freed.

In the Linux kernel, the firmware arm_scmi subsystem has a race during requested device removal. scmi_protocol_device_unrequest() drops scmi_requested_devices_mtx while notifying listeners but retains the list head; when two SCMI drivers for the same protocol unregister concurrently, one thread can free the list head while the other dereferences it after reacquiring the mutex, potentially freeing it twice.

In the Linux kernel, the iommu/amd subsystem has undefined behavior in the devid_write debugfs function. When the for_each_pci_segment() loop completes without finding a matching segment, pci_seg is not NULL but points to the list head, and accessing pci_seg->id after the loop causes undefined behavior.

In the Linux kernel, the thermal intel int3400 driver's evaluate_odvp() creates per-ODVP sysfs files before the thermal zone and later probe resources are registered. The unwind path only calls cleanup_odvp() from the late sysfs failure path, so failures after evaluate_odvp(), including thermal_tripless_zone_device_register() failures, leave the ODVP files and storage behind. The fix moves ODVP cleanup to the common ART/TRT unwind path and clears cached ODVP pointers.

A fix was applied in the Linux kernel for an ABBA deadlock in ext4_xattr_inode_cache_find() triggered by concurrent extended attribute (xattr) workloads using the ea_inode mount option. The deadlock occurred between a transaction holding a reference to an mbcache entry and the eviction thread evicting the same EA inode. The fix introduces a new EXT4_IGET_NOWAIT flag that performs a non-blocking inode lookup and returns -ENOENT instead of waiting for eviction or creation to complete.

A race condition in the Linux kernel's ext4 filesystem inline data write path has been fixed. During concurrent writes and page faults, the inline data state could change between write_begin and write_end, leading to NULL pointer dereferences or data loss. The fix passes the write state via the fsdata parameter and replaces a critical BUG_ON with graceful error handling and retry.

A vulnerability in the Linux kernel's ext4 filesystem was fixed, where a corrupted directory could trigger a use-after-free (reported by KASAN) during ext4_readdir(). The ext4_dir_llseek() function invalidates the directory cookie, causing a rescan of directory entries, and a corrupted rec_len field can point to an offset where the block lacks space for a complete directory entry. This leads to an out-of-bounds read and potential access to freed memory.

In the Linux kernel, the wifi ath6kl driver's WMI event handlers ath6kl_wmi_scan_complete_rx(), ath6kl_wmi_addba_req_event_rx(), and ath6kl_wmi_delba_req_event_rx() read from the event buffer without first verifying that the message is large enough. The fix adds length checks to prevent overreads.

In the Linux kernel, the wifi ath12k driver's ath12k_wmi_op_rx() reads the firmware buffer without first verifying that it contains enough data to hold a header. This could result in a buffer overread. The fix adds a check that the buffer holds at least a wmi_cmd_hdr before reading.

In the Linux kernel, the wifi ath11k driver's ath11k_wmi_tlv_op_rx() reads the firmware buffer without first verifying that it contains enough data to hold a header. This could result in a buffer overread. The fix adds an upfront length check before dereferencing skb->data as a wmi_cmd_hdr, placed before the trace_ath11k_wmi_event() call to preserve existing trace semantics.

In the Linux kernel, the RDMA/bnxt_re module's bnxt_re_mmap() rejects VM_WRITE for the DBR_PAGE and TOGGLE_PAGE mmap flags, but a read-only mapping can still retain VM_MAYWRITE and later be upgraded with mprotect(PROT_WRITE). This bypasses the write check that only runs at mmap time. The fix clears VM_MAYWRITE before vm_insert_page() in the shared DBR/toggle-page branch.

In the Linux kernel, ext4_init_orphan_info() leaks a buffer_head reference. When ext4_bread() succeeds but orphan block magic or checksum validation fails, the out_free loop starts releasing buffers from i-1, skipping the current buffer_head at index i.

In the Linux kernel, the amd_pstate_ut module does not check whether the amd-pstate driver is active, causing a NULL pointer dereference when modprobe is run on Intel platforms. The lack of state detection leads to a kernel crash.

In the Linux kernel, the cpufreq/amd-pstate driver's amd_pstate_power_supply_notifier() and amd_pstate_profile_set() do not handle cpufreq_cpu_get() returning NULL. This can lead to a NULL pointer dereference during a race with CPU hotplug or driver teardown.

In the Linux kernel, scmi_protocol_table_register() can leave earlier requests registered when a later entry in the same ID table fails. Each request retains a pointer to the driver's ID table, so a failed module load can leave a dangling pointer after the module storage is released.

In the Linux kernel, scmi_driver_register() requests protocol devices before registering the driver. If driver_register() fails, those requests remain in the global IDR and retain pointers to the module's ID table, leading to dangling pointers after the failed module load releases that storage.

In the Linux kernel, the RDMA/erdma driver's erdma_destroy_qp(), erdma_destroy_cq(), erdma_dereg_mr(), and erdma_destroy_ah() return early when erdma_post_cmd_wait() fails, leaking queue buffers, MTTs, doorbells, and STAG, QPN, CQN, and AHN identifiers.

In the Linux kernel, the exfat filesystem zeroes the page-cache gap below the new valid_size when a shared writable mapping has its valid_size extended by a buffered write or page fault. A store through the mapping can race with this zeroing and be overwritten.

In the Linux kernel, BPF subprograms use the bpf_callback_t ABI, but task work invokes the callback through a three-argument function pointer. This trips kCFI.

In the Linux kernel, a WARNING occurs in bpf_tracing_link_release because the verifier blindly sets 'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX'. This corrupts the trampoline and causes failure to restore the prog's nop insn.

In the Linux kernel, the error path in find_pos_and_ways() releases its reference to a switch decoder before logging an error that includes the decoder name. If the released reference is the last one, the decoder can be freed before the error message accesses its name, leading to a use-after-free.

In the Linux kernel, the liveupdate (LUO) mechanism did not remember the status of a failed retrieve() attempt on an FLB, causing the FLB's retrieve() callback to be called again on a retry. The retry is problematic because the FLB may be in a very different state (e.g. some KHO pages may have already been restored and freed).

In the Linux kernel, the pinctrl: mediatek driver registered the gpio_chip with the non-managed gpiochip_add_data() even though the memory was allocated with device-managed memory. Once the drivers can be built as modules and unbound/rmmod'd, devm frees the gpio_chip's memory while it is still registered, causing a use-after-free.

In the Linux kernel, mtk_eint_do_init() creates an IRQ domain, populates it with mappings and installs a chained handler, but never releases them. Now that the drivers can be built as modules and unbound/rmmod'd, this leaves behind a dangling IRQ domain, interrupt mappings whose chip data points at freed memory, and a chained handler that keeps firing into that freed data.

In the Linux kernel, the scsi: ufs: core driver improperly validated string descriptors. It passed a byte count instead of a UTF-16 code-unit count to utf16s_to_utf8s(), which could read beyond the descriptor buffer, and copying bLength bytes could read beyond the response buffer.

In the Linux kernel, the single-doorbell completion path can call ufshcd_compl_one_cqe() with a NULL CQE. If no command is associated with the completion tag, the warning message dereferences the CQE while reporting the error.

In the Linux kernel, the scsi: ufs: core driver did not validate connected lane counts. The connected lane count is used by TX equalization code to index arrays sized by UFS_MAX_LANES, which can lead to out-of-bounds indexing.