Linux kernel vulnerabilities

In the hinic3 network driver in Linux kernel, an issue was fixed related to skb linearization and error handling in skb_checksum_help(). The bug could lead to out-of-bounds DMA reads or IOMMU faults, and also to sending corrupted packets with incomplete checksums.

In the Linux kernel KCM (Kernel Connection Multiplexer) module, RCU protection was missing during execution of a BPF program in the strparser, which could trigger kernel warnings during BPF map operations. The fix holds the RCU lock while running the program.

In the virtio_net driver, the RX ring resize operation was fixed for when an AF_XDP socket is attached, preventing write past the end of the xsk_buffs array when the size grows. The fix properly resizes the array.

In the Linux kernel IPVS module, an integer overflow was fixed in the FTP helper that parses PASV/EPSV responses, which could wrap values and use incorrect port/address for data connections. The fix widens the port accumulator to u32 and rejects values above 65535 and address octets above 255.

In the Linux kernel, the cuse module has a use-after-free vulnerability during module unload. fuse_conn_put() frees fuse_conn via call_rcu(), and if the cuse module is removed before the RCU grace period ends, the callback may execute freed module memory, causing a page fault or undefined behavior.

In the Linux kernel, fuse_fill_super_submount() did not check whether fuse_iget() returned NULL. When the root inode allocation for a FUSE submount failed — e.g. under memory pressure — the NULL result was passed to get_fuse_inode(), causing a NULL pointer dereference and an oops during mount.

In the Linux kernel, vsock_accept() checked the listener's sk_err field, causing valid incoming connections to be rejected if a stale error from an earlier failed connection attempt (e.g., self-connect returning EPROTO) remained on the socket. This led to a resource leak — the child socket created for the rejected connection was never freed on virtio and hyperv transports. The issue was resolved by removing these checks.

In the Linux kernel hp-bioscfg module (platform/x86), a missing bounds check was fixed when parsing password encodings from ACPI packages, which could cause out-of-bounds reads and passing an invalid pointer to hp_convert_hexstr_to_str().

In the Linux kernel, the hsmp_hwmon_write() function in the platform/x86/amd/hsmp driver takes a user-supplied hwmon value as a signed long and assigns the result of division by MICROWATT_PER_MILLIWATT to a __u32 field. A negative value (e.g. echo -1 > power1_cap) is first converted to a huge unsigned value and then stored into the u32, causing a nonsensical multi-gigawatt socket power limit to be sent to the SMU instead of rejecting the write.

In the Linux kernel, alloc_netdev_mqs() fails to call ref_tracker_dir_exit() on error paths when alloc_percpu() or dev_addr_init() fails. As a result, reading /sys/kernel/debug/ref_tracker/* triggers a use-after-free crash.

In the Linux kernel, several NTFS compressed I/O paths discard the address returned by kmap_local_page() and later access or unmap the page using page_address(). This is invalid for highmem pages, and local mappings must be unmapped using the address returned by kmap_local_page().

In the Linux kernel, the ntfs_ir_to_ib() function contains a heap out-of-bounds write. It copies entries from index_root into a freshly allocated index_block_size-byte buffer without verifying that the entries fit in the available space. The lack of a bounds check before memcpy allows writes past the end of the allocation.

In the Linux kernel, the NTFS filesystem did not reject setxattr of the reserved $LXUID, $LXGID, $LXMOD, and $LXDEV extended attributes from userspace. The fix requires CAP_SYS_ADMIN to modify these attributes.

In the Linux kernel, vdpasim_create() leaves vdpasim->worker as an ERR_PTR when kthread_run_worker() fails. The error path drops the device reference, and vdpasim_free() unconditionally passes the worker pointer to kthread_destroy_worker(), dereferencing the ERR_PTR and triggering a general protection fault.

In the Linux kernel, the virtio_balloon driver has no .shutdown handler of its own, so the generic virtio bus handler resets the device during device_shutdown() while the balloon's asynchronous work is still armed. This causes virtqueue_add_inbuf() to return -EIO and trip WARN_ON_ONCE(), turning an ordinary reboot into a kernel panic when panic_on_warn is enabled.

In the Linux kernel, the vdpa/mlx5 driver's add_direct_chain() function adds newly allocated direct MR entries to the local list 'tmp', which is spliced into mr->head only on success. On the error path, the cleanup loop incorrectly iterated over mr->head instead of tmp, leading to improper resource cleanup.

In the Linux kernel, the virtio RTC driver waits without a timeout for the device to return requestq buffers, while RTC class operations run with rtc_device.ops_lock held. On surprise removal, virtio-pci marks the virtqueues broken before unregistering the device, causing viortc_remove() to block in viortc_class_stop() while trying to acquire ops_lock.

In the Linux kernel, the pcf8563 RTC driver registers the CLKOUT clock provider via of_clk_add_provider() but never unregisters it — there is no of_clk_del_provider() call and no remove callback. Each unbind or module reload leaks an of_clk_provider structure and an OF node reference.

In the Linux kernel, a request buffer leak was found in smb2_new_read_req(). The buffer is allocated but not freed or passed to the caller on two error paths, leading to memory leakage. The issue affects the asynchronous SMB2 read path and can be triggered repeatedly on memory registration failures.

In the Linux kernel, rzg2l_clear_irq_int() and rzg2l_clear_tint_int() perform a read-modify-write on the ISCR/TSCR status registers to clear the bit for the handled interrupt. Since these registers are write-0-to-clear per bit, a concurrently set status bit for another interrupt is written back as 0, clearing and losing an unserviced interrupt.

In the Linux kernel, the irq_domain_activate() callback for the ast2700-intc irqchip calls fwnode_device_is_compatible(), which allocates memory with GFP_KERNEL. This occurs with interrupts disabled and a raw spinlock held, which is not allowed and may cause allocation issues.

In the Linux kernel, visconti_clk_register_gate() fills in init.parent_data and assumes init.parent_names is NULL, but the latter is uninitialized. This may cause subtle issues or even a crash, especially with CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE enabled.

In the Linux kernel, IRS affinity setup in the gic-v5 irqchip publishes an IRS pointer and IAFFID state in per-CPU data before remaining IRS initialization can fail. The error path frees the IRS data without clearing that published state, leaving CPUs associated with freed memory.

In the Linux kernel, gic_acpi_parse_iaffid() does not check the return value of get_logical_index(), which may be an error value when a MADT GICC entry does not correspond to a recognized logical CPU. This may result in out-of-bounds indexing of a per_cpu variable array and memory corruption.

In the Linux kernel, snd_ice1712_probe() performs multiple initialization steps after snd_card_new(), but directly returns on failures from later steps without releasing the ALSA card, causing resource leaks when probing fails.

In the Linux kernel, ntfs_decompress() has an off-by-one range check where dp_addr == dp_sb_end falls through to the symbol copy, writing one byte past the destination page. A corrupted compressed $DATA attribute can produce a bounded run of out-of-bounds writes when the file is read.

In the Linux kernel, ntfs_mft_record_alloc() reads the old update sequence number from an unvalidated MFT record using the untrusted usa_ofs field. A corrupted record can place usa_ofs past the end of the record, causing a two-byte read outside the folio and a use-after-free.

In the Linux kernel, the bridge module's ARP/ND proxy reads the neigh ha address directly, which can result in torn or partial reads while the neigh entry is being updated. The fix uses neigh_ha_snapshot to take a stable snapshot of the address.

In the Linux kernel, the vxlan module's arp/neigh_reduce functions read the neigh ha address directly, which can lead to partial reads while the neigh entry is being updated. The fix uses neigh_ha_snapshot to take a stable snapshot, similar to route_shortcircuit.

In the Linux kernel, the NFSv4.2 implementation has a LAYOUTSTATS send buffer exhaustion issue. The encode_layoutstats_maxsz macro budgets 256 bytes, but the flexfiles record can exceed that because the server controls the filehandle and address lengths. This can drive the encoder past the end of the send buffer and leave a mutex permanently held when xdr_reserve_space() returns NULL.

In the Linux kernel, the NFSv4/pnfs implementation keys the data server cache on the multipath address set alone, without including the NFS version. When two deviceids on the same address have different versions, they share a single nfs4_pnfs_ds, and whichever mirror connects first pins ds_clp to its own version. The other mirror is handed that client and selects rpc_call_ops for a version the connection does not speak, leading to a NULL dereference.

In the Linux kernel, the bnxt_en driver passes the platform device instead of the hardware monitoring device as the first parameter to hwmon_notify_event(). This API break results in undefined behavior and may cause a crash.

In the Linux kernel, the ptp netc driver has a period truncation and potential divide-by-zero issue in PEROUT. The max_period value exceeds U32_MAX, causing silent truncation of period_ns to zero and a divide-by-zero in roundup_u64(). Additionally, a zero pp->period causes an unsigned wraparound to 0xFFFFFFFD, mis-programming the FIPER hardware register.

A vulnerability in the Linux kernel's net/sched classifier mechanism allows unprivileged users to pin kernel memory outside memcg control by using GFP_KERNEL allocations without __GFP_ACCOUNT in classifier *_change() paths and the shared tcf_exts_init_ex() action array. Additionally, an error path in cls_basic leaves a dangling pointer in the IDR.

In the Linux kernel, the sparx5 driver has a sleep-in-atomic-context issue in MAC table access. sparx5_set_rx_mode() runs with netif_addr_lock_bh held and iterates dev->mc, leading to taking the sparx5->lock mutex and polling a register in atomic context, which is not allowed. The fix converts the driver to the new .ndo_set_rx_mode_async callback.

In the Linux kernel, the hv vmbus module attempts to clean up an uninitialized VMBus module for a non-nested root partition. hv_acpi_init() does nothing in that scenario but reports success, so the module is loaded. Later unloading tries to clean up never-initialized resources, resulting in memory faults and a panic.

In the Linux kernel, a vulnerability was found in the FUSE filesystem related to direct writes with the O_APPEND flag. The fuse_direct_write_iter() function used a stale position before write checks, causing invalidation of the wrong page range after the write. This can lead to data inconsistency when the file size is not page-aligned.

In the Linux kernel, a fix was made to the condition that enables over-io-uring in FUSE. The fuse_uring_cmd() function now requires the FUSE_OVER_IO_URING flag to be set in the FUSE_INIT reply before accepting an IORING_OP_URING_CMD. Without this flag, there is a risk of deadlock when attempting to use io-uring. The change is trivial but alters behavior: FUSE servers must set this flag to handle io-uring.

In the Linux kernel, a bug was fixed in context management for ARM64 processes related to the Memory Tagging Extension (MTE) store-only mode. The SCTLR_EL1.TCSO0 bit was not included in SCTLR_USER_MASK, so after a context switch the setting was not cleared and could leak into another task. The fix adds SCTLR_EL1_TCSO0_MASK to SCTLR_USER_MASK to ensure proper clearing during switch.

In the Linux kernel, a fix was made for safely accessing the chan->conn field in getsockopt/setsockopt functions for Bluetooth L2CAP. After a previous change, chan->conn retains a reference and remains non-NULL even after the associated hci_conn is deleted, but accessing its fields (e.g., hdev) is invalid and leads to a KASAN crash. The fix adds a check to verify that hci_conn is still alive, and holds l2cap_chan_lock() to avoid data races.

In the Linux kernel, a fix was made for the Bluetooth L2CAP issue where a new socket could be added to the parent accept queue after l2cap_sock_cleanup_listen() had run and the state was set to BT_CLOSED, leading to a use-after-free (UAF). The fix adds a check for sk_state == BT_LISTEN after acquiring the sk lock in l2cap_sock_new_connection_cb(), and further prevents data races.

A race condition exists in the Linux kernel Bluetooth L2CAP subsystem between l2cap_sock_cleanup_listen() and l2cap_sock_put_chan(). An unsynchronized read of the l2cap_pi(sk)->chan pointer may return NULL, leading to a null-ptr-deref and kernel crash. The issue is fixed by taking lock_sock() in l2cap_sock_kill().

In the Linux kernel, the btmtksdio Bluetooth driver's TX path rounds the transfer size up to the 256-byte SDIO block size but hands the controller the SKB buffer as-is. The controller therefore reads up to 255 bytes of uninitialised memory, and the read can extend past the end of the buffer.

In the Linux kernel, the btnxpuart Bluetooth driver's nxp_process_fw_dump() reads seq_num and buf_len from a firmware dump header struct at skb->data without verifying the ACL payload is long enough. A short frame with connection handle 0xfff reads both fields beyond the received data, and a buf_len of zero can end a dump early and reset the controller.

In the Linux kernel, the Bluetooth RFCOMM rfcomm_apply_pn() accepts the MTU value from a remote Parameter Negotiation frame without checking for zero. When a peer sends an MTU of zero, d->mtu becomes 0, causing an infinite loop during data fragmentation and exhausting system memory.

A leak of the hci_conn structure occurs in the Linux kernel when a second LE connection is rejected. The create_le_conn_complete() function incorrectly compares the failed connection against hci_lookup_le_connect(), so when two connections are pending simultaneously, hci_conn_failed() is never called and the connection remains stuck in BT_CONNECT forever. As a result, all subsequent LE connection attempts fail with -EBUSY and require an adapter reset.

In the Linux kernel, the xsk zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set XDP_TX_METADATA. The fix passes descriptor options through the metadata helpers and ignores metadata unless the option is set.

In the Linux kernel, the octeontx2-af driver's rvu_dbg_nix_tm_tree_display() dereferences pfvf->sq_ctx without checking whether the SQ context has been allocated. Reading /sys/kernel/debug/octeontx2/nix/tm_tree for a NIX LF without configured transmit queues triggers a kernel oops.

In the Linux kernel, the octeontx2-vf driver has a workqueue and netdev race in the probe/remove paths. The VF workqueue is not initialized before register_netdev(), so ndo_set_rx_mode can queue work on a NULL workqueue, and the workqueue is destroyed before the netdev is unregistered.

A vulnerability in the Linux kernel's act_ife module (net/sched) causes a kernel panic (skb_under_panic) when processing non-Ethernet frames. The issue stems from using skb->dev->hard_header_len instead of ETH_HLEN, leading to incorrect skb buffer operations. The fix restricts IFE to Ethernet frames only and enforces the correct header length.