Linux kernel vulnerabilities

In the Linux kernel, the coresight etm4x driver's perf enable path is missing calls to cscfg_csdev_disable_active_config() in two cases: when branch broadcast is selected but unsupported by hardware, and when etm4_enable_hw() fails. This leads to a leak of config_desc->active_cnt. The fix calls cscfg_csdev_disable_active_config() in these error paths.

In the Linux kernel, the BRBE driver (arm_pmuv3) does not initialize the hw_id field in the perf branch stack structure, even though it is passed to userspace. According to documentation, this field should be 0 for architectures storing raw branch records in age order.

In the Linux kernel, the arm_mpam driver causes a NULL pointer dereference when a user unbinds an MSC after mpam_disable() has run in response to an error interrupt. mpam_disable() sets drvdata to NULL, and the driver remove callback does not check this state.

In the Linux kernel, the arm_mpam driver allows unbinding an MSC via sysfs, which can lead to a use-after-free. When the unbound MSC is the last one for a component, the mpam_component structure is freed and later accessed by resctrl_arch_get_config() when reading the schemata file.

A vulnerability was found in the Linux kernel BPF verifier regarding load-acquire instructions (BPF_LOAD_ACQ). Unlike a regular BPF_LDX, load-acquire is not rewritten to BPF_PROBE_MEM, so the JIT emits a plain load with no exception table entry, causing a kernel panic on fault instead of being handled. This affects pointer types requiring fault protection, such as PTR_TO_BTF_ID and PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED.

In the Linux kernel, the scsi: sd driver has incorrect error handling in sd_probe() when sd_large_pool_create() fails after a successful device_add(&sdkp->disk_dev). The out_free_index path calls kfree() on an already registered device and leaks the sysfs entry.

In the Linux kernel, the scsi: sd driver leaks a special_vec mempool page when scsi_alloc_sgtables() fails in sd_setup_unmap_cmnd() or sd_setup_write_same{10,16}_cmnd(). The SCSI midlayer does not call uninit_command() because RQF_DONTPREP is not yet set, causing the page leak.

In the Linux kernel, in the btrfs filesystem on zoned devices, btrfs_delayed_refs_rsv_refill() returns -EAGAIN when over-committed metadata exceeds the usable size in a metadata block-group. If this occurs during reclaim, the transaction is aborted even though -EAGAIN is a transient condition.

A vulnerability in the Linux kernel's Btrfs filesystem can lead to overlapping ordered extents, causing a kernel panic. The issue arises from an unexpected isize revert after a short direct IO, which skips waiting for existing ordered extents during buffered writes.

In the Linux kernel, in the btrfs filesystem, POSIX ACLs can be set even when the root has the read-only property set. The set_acl code path does not check the root's read-only flag because the relevant check was removed in commit 353c2ea735e4.

In the Linux kernel, in the btrfs filesystem, btrfs_read_merkle_tree_page() can find a folio that is not uptodate. After locking the folio, the code treats this as a read error and returns -EIO, making a transient read failure sticky. The fix retries the Merkle item read when a not-uptodate folio is found and unlocks the folio on read_key_bytes() failure.

In the Linux kernel, the btrfs filesystem on zoned devices has a bug that intermittently aborts transactions and forces the filesystem read-only. The issue occurs during metadata-heavy relocation when btree_writepages() encounters an active block group at a higher logical address, leading to -EAGAIN and transaction abort. The fix flushes active metadata and system block groups at the start of btree_writepages() to avoid deadlock and ensure forward progress.

In the Linux kernel, in the btrfs filesystem on zoned disks, btree_csum_one_bio() zeroed the extent buffer's folios before submission, destroying the in-memory buffer while it might still be referenced, leading to extent tree corruption. The fix writes zeros from a shared zero page, leaving the buffer content untouched.

In the Linux kernel, in the btrfs filesystem, the function qgroup_free_reserved_data() has an incorrect length calculation. Using round_up(start + len, sectorsize) gives the rounded end position instead of the length, leading to an oversized length and incorrect calculations. The fix introduces local variables aligned_start and aligned_len.

In the Linux kernel, in the pinctrl driver for Airoha chips, the .irq_request_resources hook is missing. Without it, gpiolib cannot set the GPIOD_FLAG_USED_AS_IRQ flag, breaking pin direction locking and potentially allowing reconfiguration of an active IRQ pin as an output.

In the Linux kernel, in the Bluetooth virtio_bt driver, virtbt_setup_zephyr() passes the response to Zephyr command 0xfc08 as a "%s" string without length checking, potentially causing an out-of-bounds read of adjacent memory. The fix limits printing to skb->len - 1 using "%.*s".

In the Linux kernel, in Bluetooth L2CAP, the hci_conn::l2cap_data field is accessed without locks in l2cap_disconn_ind, potentially leading to use-after-free if l2cap_conn is deleted concurrently. The fix uses proto_lock to guard l2cap_data.

In the Linux kernel, in Bluetooth hci_conn, the SCO setup context is allocated with a NULL destroy callback, leading to memory leaks when an entry is cancelled. Additionally, the context stores a bare hci_conn pointer, potentially leading to use-after-free. The fix holds the connection and releases it from a destroy callback.

In the Linux kernel, in Bluetooth hci_sync, the advertising instance allocated in adv_timeout_expire() is not freed on error or cancellation paths, leading to memory leaks. The fix frees the buffer from a destroy callback and in the caller when the entry could not be queued.

In the Linux kernel, in Bluetooth MGMT, the mesh_send_cancel() command is queued with a NULL destroy callback, leading to memory leaks when the entry is cancelled. The leak also pins the socket reference, so the MGMT socket is never released. The fix frees the command from a destroy callback.

In the Linux kernel's Bluetooth MGMT subsystem, there is a memory leak when an HCI command is cancelled. The command is not freed, leading to memory leak and holding a reference to the mgmt socket that is never released.

In the Linux kernel's Bluetooth subsystem (MSFT), the length of the event prefix (evt_prefix_len) is not validated against the actual response length. A controller can declare a length up to 255 bytes, and the kernel will copy data beyond the response, leading to reading unauthorized data.

In the Linux kernel's BPF and cgroup subsystem, there is a null-ptr-deref bug after replacing a program. When program A (empty) is replaced by program B using BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE, the required storage is not allocated, leading to a panic when the new program is kicked.

In the Linux kernel's iio: light: gp2ap002 driver, there is unbalanced runtime PM management on repeated event writes. Double enabling leaks a runtime PM reference, and double disabling underflows the usage count and triggers a warning.

A bug was fixed in the Linux kernel's net/sched cls_api regarding teardown of an adopted proto when losing an insert race. When a request loses the race in tcf_chain_tp_insert_unique(), tp_created was not cleared, causing the error path to delete an active classifier belonging to the winning request. A tri-state variable was introduced to track the insert step outcome.

In the Linux kernel's BPF subsystem, there is a mmap_lock leak in the irq_work path. A nested caller can reuse the slot before the first caller queues it, leading to double locking of mmap_lock and a lock leak, blocking exit_mmap().

In the Linux kernel, a vulnerability in AppArmor's verify_tags() function allows an integer overflow in the bounds check, enabling an out-of-bounds read when loading a crafted policy. The issue is reachable by an unprivileged user in a nested user namespace if unprivileged_userns_apparmor_policy=1 is enabled.

In the Linux kernel's fbdev: kyro driver, there is a lack of validation of overlay viewport coordinates. Large input values can cause 32-bit arithmetic wraparound, leading to incorrect coordinates passed to SetOverlayViewPort().

A locking issue exists in the Linux kernel's iommu/dma subsystem around the msi_page_list. When multiple devices assigned to a VM via the legacy VFIO type1 container share the same IOMMU domain (e.g. ARM SMMU with IOMMU_RESV_SW_MSI), concurrent calls to iommu_dma_get_msi_page() can corrupt that list. The fix restores the static msi_prepare_lock.

In the Linux kernel's iommu/vt-d subsystem, there is an issue with clearing the Present bit before tearing down a copied context entry. Zeroing the entry while Present is still set leaves a window where hardware can fetch a torn entry, leading to unpredictable behavior or spurious faults.

In the Linux kernel's iommu/vt-d subsystem, there is an iopf_refcount leak when replacing a domain at the RID level. The functions identity_domain_attach_dev() and blocking_domain_attach_dev() do not disable IOPF for the old domain, leading to a reference leak. As a result, the count never drops to zero, triggering a WARN_ON when the device is released.

In the Linux kernel's iommu/vt-d subsystem, on device probe failure, scalable-mode context entries are not torn down before freeing the PASID table. This can lead to the IOMMU referencing freed memory. The fix performs teardown before freeing the table, similar to the device release path.

In the Linux kernel's iommu/vt-d subsystem, during DMA alias teardown, the function intel_context_flush_no_pasid() uses an incorrect SID (always the device's requester ID instead of the alias). This causes context cache entries for aliases not to be invalidated, potentially leading to the IOMMU using freed memory.

In the Linux kernel's media: amd: isp4 driver, the function isp4if_alloc_fw_gpumem() does not release previously allocated GPU memory pools when a subsequent allocation fails. This causes a memory leak. The fix releases already-allocated pools before returning an error.

In the Linux kernel's media: amd: isp4 driver, the function isp4sd_pwron_and_init() causes a deadlock in the error path by re-acquiring the ops_mutex it already holds. The fix changes error handling to release resources in stages, avoiding the deadlock and other issues like runtime-PM underflow.

A vulnerability was fixed in the Linux kernel's netfilter nft_ct module related to custom expectation support. The previous implementation could corrupt the expectations list through stale pointers after conntrack extension reallocation. The fix moves expectation handling to an internal conntrack helper and introduces the nf_conntrack_helper_release() function.

In the Linux kernel's NFS subsystem, when the client fails to record a delegation received from the server, it does not send DELEGRETURN. This causes the server to believe the client still holds the delegation, leading to issues with delegation recall and loops in the client's state manager. The fix returns the delegation in these error paths.

In the Linux kernel's nvme-pci driver, descriptor DMA pools are not released on probe failure after the admin tag set is allocated. This causes a leak of dma_pool objects. The fix adds pool release in the out_disable error path.

The vulnerability in the Linux kernel affects the AMT (Automatic Multicast Tunneling) driver. It allows creating AMT devices on a lower device in a different network namespace, leading to a kernel warning and system hang during device unregistration. The fix forbids such cross-netns setup.

A flaw in the Linux kernel AppArmor subsystem affects the unconfined user namespace restriction when a task is already confined by a profile stack. The restriction is not correctly applied, allowing an escape if two transitions through an unconfined profile can be executed. The fix moves the check into the per-profile label build so it is always evaluated against unconfined.

In the Linux kernel nvmet subsystem, nvmet_execute_identify_ns_zns() calls bdev_is_zoned() on req->ns->bdev, which is NULL for a file-backed namespace. A host can send an Identify command with CNS 05h and CSI 02h, causing a NULL pointer dereference and kernel oops. The fix rejects the command when the namespace is not backed by a block device.

In the Linux kernel, the NVME_IOCTL_SUBMIT_IO command never calls nvme_cmd_allowed(), unlike IO_CMD and IO64_CMD. Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. The fix passes flags and open_for_write and rejects disallowed commands with -EACCES.

In the Linux kernel NFC LLCP subsystem, nfc_llcp_getsockopt() always stores 4 bytes via put_user() regardless of the caller-supplied optlen. A call with optlen < 4 writes past the user buffer, violating the getsockopt(2) contract. The fix rejects calls with optlen < sizeof(u32), with an explicit check for negative values.

In the Linux kernel NFC LLCP subsystem, nfc_llcp_getsockopt() reads llcp_sock->local before acquiring the socket lock and then dereferences the cached pointer inside the locked region. A race with an in-flight bind() can cause a use-after-free. The fix moves the read and NULL check inside the lock_sock() region.

In the Linux kernel NFC NCI subsystem, nci_close_device() and nci_rx_work can concurrently call nci_data_exchange_complete(), leading to a double sock_put() and refcount underflow that frees a socket still in use (use-after-free). The fix replaces clear_bit() with test_and_clear_bit() so only the first caller proceeds.

In the Linux kernel NFC LLCP subsystem, nfc_llcp_recv_snl() walks the SNL TLV list without bounding reads to the actual skb data, causing length underflow, out-of-bounds reads, and a bug in strncmp()/nfc_llcp_sock_from_sn(). A nearby NFC device can reach this without authentication since LLCP link activation happens automatically after NFC-DEP. The fix walks the TLV list by pointer bounded by skb_tail_pointer() and validates lengths.

In the Linux kernel, the NFC pn533 driver has a use-after-free bug. __pn533_send_async() publishes the command and then calls send_frame(), while the I2C threaded IRQ can concurrently complete the command and free the skb before the transport finishes using it.

In the Linux kernel, the NFC NCI functions parsing the CORE_INIT_RSP packet do not validate the skb length. A malformed response can declare a large number of RF interfaces with insufficient data, causing reads of uninitialized memory.

In the Linux kernel, the ALSA seq bounce_error_event() embeds a data.ext.ptr pointer in the bounce payload that reaches userspace. This leaks a kernel address (8 bytes on 64-bit) even though the event header read path clears it.

In the Linux kernel, the RDMA cxgb4 driver's c4iw_alloc() creates a debugfs tree but does not remove it in c4iw_dealloc(). When RDMA device registration fails, the err_dealloc_ctx path bypasses c4iw_remove(), leaking debugfs entries.