Linux kernel vulnerabilities

There is an issue with the MLD ID in TXD and HIF TXP in the mt7996 driver. When the MLD_ID field is neither the primary nor the secondary link ID, it can lead to a firmware busy loop when the third link is in power saving mode. The fix remaps frames to the primary link wcid.

There is an error in non-AQL packet accounting for MLO stations in the mt76 driver. The function overrides the wcid passed by the driver, causing the counter to be updated on the wrong wcid. Once the limit is exceeded, the scheduler may permanently refuse to service the station.

In the mt7996 driver, there is a missing validation of the band_idx field in the RX descriptor. The field (2 bits) can be invalid and cause out-of-bounds access to the phys[] array or a NULL dereference, potentially leading to crashes.

In the mt7915 driver, there is a race condition when clearing the wcid mask in remove_interface(). The mask is cleared without holding the mutex and before clearing the RCU pointer, which can lead to wcid leaks, double allocation, or even removal.

In the mt7915 driver, there is an underflow when calculating the number of spatial streams. If the MCS map has no supported streams, the function returns 255, which is written into the firmware's beamforming fields.

In the mt76 driver, there is a race in RXDMAD_C buffer recycling. These buffers come from page pools tied to a different NAPI, so direct recycling can race with the owning NAPI, leading to errors.

In the mt7996 driver, there is a bug in the TLV walk in mt7996_mcu_get_chip_config. The loop advances by tlv->len without a minimum, so a zero-length TLV could cause an infinite loop, and an out-of-bounds read is also possible.

In mt76 drivers, the mmio_write_copy and mmio_read_copy functions iterate up to ALIGN(len,4), so a length not a multiple of four reads past the source buffer or writes past the destination.

In the Linux kernel, mt7915_add_interface() in the mt76 wifi driver fails to unwind state when adding an interface fails. When mt76_wcid_alloc() fails, the function returns without clearing the vif_mask/omac_mask bits it set, without removing the firmware dev info added earlier, and without clearing a monitor_vif pointer to a vif mac80211 is about to free. Since mac80211 does not call remove_interface() for a failed add, indices and the firmware dev entry leak permanently and testmode could dereference the stale monitor_vif.

In the Linux kernel, mt7996_mac_reset_work() in the mt76 wifi driver (mt7996) parked the tx worker and disabled the RX/TX NAPIs before taking dev->mt76.mutex. Since mt76_worker_disable()/_enable() are plain kthread park/unpark, not refcounted, and __mt76_set_channel() toggles the same worker and the MT76_RESET bit under the mutex, an L1 SER racing a channel switch could leave the worker unparked and MT76_RESET cleared while the reset path resets the DMA rings, corrupting descriptors or tokens.

In the Linux kernel, mt7996_mcu_beacon_cntdwn() in the mt76 wifi driver (mt7996) emits two bss_bcn_cntdwn_tlv entries (the CSA countdown and the CCA-abort BCC), but MT7996_BEACON_UPDATE_SIZE only reserved one. With MBSSID enabled and a near-maximum beacon template, the extra 8 bytes could push the offload command past MT7996_MAX_BSS_OFFLOAD_SIZE and trigger skb_over_panic().

In the Linux kernel, both mt76 wifi drivers cancelled dump_work on unregister but left reset_work and rc_work to be flushed only by destroy_workqueue() in mt76_free_device(), which runs after the hw is unregistered and the hardware stopped. A reset_work that fires in that window calls ieee80211_restart_hw() and re-arms mac_work on an unregistered hw, and rc_work touches station state being torn down.

In the Linux kernel, acpi_processor_driver_init() registers the cpufreq policy notifier before registering the ACPI processor driver and setting up CPU hotplug state. If driver_register() or cpuhp_setup_state() fails, the error path only unregisters the ACPI processor driver and the idle driver, leaving the cpufreq notifier registered even though initialization failed.

In the Linux kernel, MDP4/MDP5 MSM display drivers double-free KMS state during failed initialization, causing a use-after-free. The error path in msm_drm_init() calls cleanup again after the driver already destroyed the KMS, leading to a crash.

In the Linux kernel, the drm/msm/dsi driver calls dev_pm_opp_set_rate(0), which removes the vote specified in required-opps but does not actually park the clock, making it run without the necessary power backing. The fix drops the explicit call; every call site of ops->link_clk_disable() is followed by pm_runtime_put(), so the power vote will be rescinded if deemed safe.

In the Linux kernel, ath11k_service_ready_ext_event() in the ath11k wifi driver can allocate svc_rdy_ext.mac_phy_caps during TLV parsing. This is a temporary allocation freed on the success path but not on the error path — if parsing succeeds far enough to allocate mac_phy_caps and then fails on a later TLV, the allocation leaks.

In the Linux kernel, regulator_init_complete_work uses schedule_delayed_work() with system_wq, which is non-freezable, allowing it to run concurrently with system suspend. This work fires ~30s after boot to disable unused regulators via I2C; when it races with PM suspend, the I2C adapter may already be suspended, triggering a -ESHUTDOWN warning in __i2c_transfer().

In the Linux kernel, btf_distill_func_proto() builds the function model used for fentry/fexit/fmod_ret/fsession trampolines and struct_ops, having accepted a 16-byte __int128 return value since the trampoline was introduced. However, the BPF trampoline preserves only 8 bytes of the return value (RAX/R0), so for attach types that read the target's return value (fexit, fmod_ret, fsession plus their _multi variants, and struct_ops) the second half is neither saved nor restored, corrupting the value seen by the real caller.

In the Linux kernel, btf_distill_func_proto() accepts function arguments up to 16 bytes, so a 128-bit scalar such as __int128 reaches the x86 trampoline with arg_size == 16. The current implementation assumes an __int128 argument only needs one register, so the register save area is under-allocated and save_args() overwrites adjacent stack slots.

In the mt76 wifi driver (mt7915), the TWT flow is added to dev->twt_list before sending the agreement to the firmware, but the error path leaves it linked while flowid_mask is never set. The flow slot can then be reused and memset while still on the list, corrupting twt_list, and station removal leaves a dangling entry behind.

In the mt76 wifi driver (mt7996), mt7996_mac_reset_vif_iter() queues non-default vif links for kfree_rcu while dev->wcid[] still holds pointers to the wcid embedded in each freed link. mt76_reset_device() then dereferences those entries and runs mt76_wcid_cleanup() on them; if a grace period elapses in between, the cleanup operates on freed memory.

In the mt76 wifi driver (mt7996), after a full chip reset the reset path frees link structures without clearing bits in mvif->valid_links, so mac80211's replayed setup never re-creates dev_info/bss_info/STA records and never re-registers the link wcid, leaving the device inoperative. The reset path also leaks every allocated MLD index, exhausting the index space on repeated resets.

In the mt76 wifi driver (mt7915), mt7915_pci_init_hif2() was called unconditionally and again inside the WED-inactive branch. This double-incremented the global hif_idx, wrote the PCIe RECOG_ID register twice, and leaked a device reference, since removal only drops one reference.

In the mt76 wifi driver (mt7915), after mt7915_register_ext_phy() succeeded, a failure of the main PHY mt7915_init_debugfs() or mt7915_coredump_register() unwound through free_phy2, which called ieee80211_free_hw() on the ext PHY hw while it was still registered with mac80211, since mt76_unregister_device() only unregisters the main hw.

In the mt76 wifi driver (mt7915), the hif2 reference obtained by mt7915_pci_init_hif2() is only released on error paths that key off dev->hif2, which is not assigned until after the IRQ setup. If pci_alloc_irq_vectors() or the primary devm_request_irq() fails, the reference leaks.

In the mt76 wifi driver (mt7996), if the WED attach for the primary PCIe function fails, the probe path still attaches wed_hif2 for the secondary function, leaving the device in an inconsistent half-WED configuration that crashes later. The hif2 call also re-enabled hwrro_mode, which the failed primary attach had just turned off.

In the mt76 wifi driver, mt76_vif_link() indexes mvif->link[] without validating link_id, but callers pass mvif->deflink_id / msta->deflink_id, which hold IEEE80211_LINK_UNSPECIFIED (0xf) until the first link has been added. Since IEEE80211_MLD_MAX_NUM_LINKS is 15, that reads one element past the end of the array, aliasing mt76_vif_data.offchannel_link.

In the mt76 wifi driver (mt7996), when mac80211 leaves the link unspecified, mt7996_tx() substitutes the primary link id of the station or vif. That value is IEEE80211_LINK_UNSPECIFIED (0xf) until the first link has been added, and it is then used unchecked to index vif->link_conf[], mvif->mt76.link[] and sta->link[], all of which hold 15 entries.

In the Linux kernel's ath10k driver for SNOC (WCN3990), copying the MSA region to a crash dump uses plain memcpy() which performs unaligned accesses on a MEMREMAP_WT mapping. This causes an alignment fault and kernel crash during devcoredump collection, and zeroes the dump buffer.

In the Linux kernel for arm64, the ptrace subsystem has an issue with keeping 'orig_x0' in sync with x0 on syscall entry. A previous fix failed to update 'orig_x0' during SECCOMP_RET_TRACE, allowing a tracer to modify the syscall argument without being subjected to seccomp or audit checking.

In the Linux kernel's nl80211_color_change() function there is a memory leak when processing beacon_next data. If beacon_next parsing fails, allocated parameters (such as mbssid_ies and rnr_ies) are not freed because the function returns an error directly instead of using the out: cleanup path.

In the Linux kernel's brcmfmac driver there is an issue with handling P2P action frames when no P2P device vif exists. Some paths assume the vif is always available, which is not true for public action frames sent through the primary interface or when action-frame abort runs before P2P vif creation.

In the Linux kernel's mac80211 subsystem there is an erroneous handling of channel zero during CSA (Channel Switch Announcement) parsing. The refactor incorrectly equated channel zero with no information, so an AP advertising a switch to invalid channel 0 did not trigger a disconnect, which could lead to firmware crashes on some Intel devices.

In the Linux kernel's cfg80211 there is a missing stop of PMSR measurements before tearing down P2P and NAN interfaces. Functions cfg80211_stop_p2p_device() and cfg80211_stop_nan() do not call cfg80211_pmsr_wdev_down(), which can leave stale requests in the driver and cause inconsistencies.

In the Linux kernel's BPF arena, there is a potential deadlock on mmap_lock when arena_vm_fault() fails to take the arena spinlock. The function returns VM_FAULT_RETRY without having dropped mmap_lock, causing it to be taken twice on retry and leading to a deadlock.

In the Linux kernel's coreboot driver there is a missing validation of table bounds. coreboot_table_probe() replaces the platform resource length with values supplied by firmware, which can lead to overflow in 32-bit size addition or mapping memory beyond the resource via a malformed table.

In the Linux kernel's pinctrl (generic) subsystem there is a memory leak in the pinctrl_generic_to_map() function. If any subsequent step (mux, group, config) returns an error, the *maps pointer may contain partially allocated entries that are not freed, causing memory leaks for all drivers relying on this function.

In the Linux kernel for PowerPC, a vulnerability was found in syscall handling after enabling GENERIC_ENTRY. When seccomp or ptrace intercepts a syscall and sets a return value, system_call_exception() did not handle the -1 sentinel, overwriting the set value with -ENOSYS. The fix introduces a thread flag to track explicit return value setting and prevents overwriting.

A vulnerability exists in the Linux kernel's amba-pl011 serial console driver. The pl011_console_write_atomic() function runs in nbcon atomic context and calls clk_enable(), which under PREEMPT_RT can sleep, triggering a "sleeping function called from invalid context" bug. This affects arm32 and arm64 Device Tree SoCs where the UART uses a common-clk managed clock.

In the Linux kernel's serial core, a vulnerability exists where memory allocations for uport->tty_groups and uport->name are performed after console registration, leading to dangling pointers if allocation fails. This can cause NULL dereference (PL011 console) or use-after-free (i.MX console).

In the Linux kernel's uart_register_driver(), on failure of tty_alloc_driver(), drv->state remains pointing to freed memory, and on failure of tty_register_driver(), drv->tty_driver also retains a stale pointer. Drivers using drv->state as an 'already registered' flag may skip registration and pass freed state to uart_add_one_port().

In the Linux kernel's TTY subsystem, a vulnerability exists where TTY device registration can fail before a cdev is allocated. The serial core keeps the port, so setserial can still use it, and later removal passes a NULL cdev pointer to cdev_del(), causing a NULL-pointer dereference.

In the Linux kernel's tty_cdev_add(), on cdev_add() failure, the cdev reference is dropped but driver->cdevs[index] remains pointing to freed memory. Later tty_unregister_device() passes that stale pointer to cdev_del(), causing a use-after-free.

In the Linux kernel's dm-integrity module, a vulnerability exists where a block tag of all 0xf6 bytes (DISCARD_FILLER) is treated as proof of discard and skips HMAC verification. An attacker with raw write access to the backing device, but without the integrity key, can stamp any block with such a tag and have it served as authentic.

In the Linux kernel's PCI dwc ep driver, a vulnerability exists where the MSI path lacks a flush equivalent to the MSI-X path before unmapping the iATU entry. This can cause posted MSI writes to be dropped or misrouted when the iATU entry is unmapped.

In the Linux kernel's HID driver for ASUS devices, multiple issues exist: unchecked size in asus_raw_event(), unclean teardown in asus_probe on failure, possible use-after-free in asus_probe, multiple workqueues used where one sufficed, sleeping calls in atomic context, and packets of incorrect size sent to the keyboard controller.

In the Linux kernel's Logitech HID++ driver, a vulnerability exists where in hidpp_ff_init(), if allocations of private data, effect ID array, or workqueue fail after input_ff_create() succeeds, the function returns an error without destroying the FF device, leading to resource leaks.

In the Linux kernel's HID subsystem, a vulnerability exists where hid_device_io_start() allows reports to run concurrently with probe. If probe subsequently fails, __hid_device_probe() releases driver resources and clears hdev->driver without excluding those report callbacks, leading to use-after-free, e.g., in hidraw_report_event().

In the Linux kernel, the HID driver for the Steam Controller (HID: steam) trusted the message size reported within the FEATURE report itself instead of verifying the actual read length. This led to a potential issue with short reads.

In the Linux kernel, the pep_getsockopt() function in the phonet module clamped the reported length to the caller's buffer using min_t(), but then stored the value with put_user(), which always writes sizeof(int) bytes. A getsockopt() call with an optlen smaller than sizeof(int) thus reported the clamped length yet wrote a full int, one to three bytes past the user buffer.