Linux kernel vulnerabilities

In the Linux kernel, f2fs checkpoint_merge can be enabled even when no checkpoint merge thread is running, e.g. on a read-only mount. The ckpt_thread_ioprio sysfs store path calls set_task_ioprio() for the checkpoint thread, dereferencing a NULL task pointer when cprc->f2fs_issue_ckpt is NULL.

In the Linux kernel, f2fs free_segment_range() curseg evacuation loop only iterates up to NR_CURSEG_PERSIST_TYPE (0..5), missing non-persistent in-memory curseg types such as CURSEG_COLD_DATA_PINNED and CURSEG_ALL_DATA_ATGC. An active in-memory curseg within the truncated segment range will not be evacuated.

In the Linux kernel, f2fs has a potential deadloop in a race condition between f2fs_fsync_node_pages() and f2fs_setattr(). Thread A gets a folio via folio_get() while Thread B invalidates the folio mapping, causing is_node_folio to always return false and the retry loop to never terminate.

In the Linux kernel, f2fs when a node block is corrupted due to checksum mismatch or inconsistent footer info, the dirty flag of the node folio needs to be cleared in order to persist inconsistent node data to storage. This operation is missing in the error path.

In the Linux kernel, f2fs the sysfs store path for critical_task_priority updates checkpoint or GC kthread scheduling state but is not protected by s_umount, unlike other control entries. This can race with remount or teardown paths that are stopping those threads.

In the Linux kernel DRM/AMD Display subsystem, a dc_lock leak was found on GPU reset error paths. dm_suspend() acquires the lock, but if helper operations fail, it returns without releasing it, causing deadlock on subsequent lock attempts.

In the Linux kernel DRM/AMD Display subsystem, the per-plane degamma LUT size is not validated, potentially leading to divide-by-zero or out-of-bounds read. The issue affects the AMD_PLANE_DEGAMMA_LUT property, only available when built with AMD_PRIVATE_COLOR.

In the Linux kernel DRM/AMDGPU VCN subsystem, an integer overflow was found in the buffer count check of the dec_msg message. A crafted value can bypass the bounds check and cause an out-of-bounds read.

In the Linux kernel DRM/GUD subsystem, TV mode names read from the USB device are not guaranteed to be NUL-terminated. strlen() can read past the allocated buffer, leading to an out-of-bounds read.

In the Linux kernel DRM subsystem, a memory leak of drm_crtc_commit was found when PAGE_FLIP_EVENT is used. The issue occurs when the event is allocated in prepare_signaling() and set to NULL in complete_signaling(), preventing the object from being freed.

A flaw in the Linux kernel's drm/ttm subsystem occurs when ttm_pool_restore_and_alloc() successfully completes the restore process via ttm_pool_restore_commit(), but fails to drop tt->restore afterward. As a result, subsequent backup/restore flows incorrectly perceive the restore as complete while shmem handles remain installed in tt->pages, leading to a stack trace and potential memory corruption.

In the Linux kernel DRM/AMDGPU subsystem, an out-of-bounds access to the adev->isolation[] array was found for rings not assigned to a partition. The index AMDGPU_XCP_NO_PARTITION (value ~0) causes access beyond the array, triggering UBSAN warnings.

In the Linux kernel DRM/AMDGPU subsystem, KIQ ring fences are not force-completed during reset. After a MODE1 reset, the first KIQ submission may poll forever on a value that is never written back, causing a hang.

In the Linux kernel DRM/AMDGPU subsystem, MES ring fences are not force-completed during reset. After a reset, the first MES submission may poll forever, causing resume failure and system hang.

In the Linux kernel DRM/AMDKFD subsystem, a TLB flush is missing after MES queue eviction/suspension, potentially leading to a race condition and page faults during SVM memory migration.

A NULL pointer dereference vulnerability exists in the Linux kernel's drm/amdkfd driver within the pqm_debugfs_mqds function. Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue causes dereference of an uninitialized mqd_mgr pointer, because the loop calling mqd_mgr->debugfs_show_mqd() is placed outside the if (pqn->q) block. This leads to a kernel crash (oops) and denial of service.

A bug was fixed in the Linux kernel's drm/pagemap module in the drm_pagemap_migrate_populate_ram_pfn() function. Higher-order folio allocations lacked the __GFP_NOWARN flag and a fallback path, and in the free_pages error path the folio order was computed after put_page() had already dropped the reference, leading to a use-after-free. The source page array construction was also corrected to ensure full copying after demotion to order-0 folios.

In the Linux kernel, the drm/nouveau/uvmm driver fails to clear the dirty flag when unwinding an OP_UNMAP_SPARSE operation. If a later op in the job fails, the region remains in the tree with dirty set and its completion is never signalled. Subsequent binds over that range then fail permanently with -ENOENT, -EINVAL, or an unkillable wait_for_completion() in bind_validate_region().

In the Linux kernel, the bpf_get_stackid function requires disabled preemption for the get_perf_callchain call and while accessing its returned trace entries buffer. The bpf_get_stackid_pe function already executes with preemption disabled. Failure to disable preemption in bpf_get_stackid may lead to data consistency issues.

In the Linux kernel, rpcrdma_rn_register() inserts @rn into rd_xa via xa_alloc() before storing the caller's callback in rn->rn_done. A device removal racing a fresh registration can observe @rn with rn_done still NULL and call through a NULL function pointer. The fix stores rn->rn_done before xa_alloc() and clears it on allocation failure.

In the Linux kernel, the ab8500_fg driver's ab8500_fg_remove() destroys the workqueue while threaded interrupt handlers are still armed. A handler firing in that window queues work on the freed workqueue, causing a use-after-free. The fix tears down the workqueue through devm, registering its cleanup after the power supply and before the interrupt requests.

A vulnerability in the Linux kernel's DAMON module can cause an infinite loop in kdamond_merge_regions(). The issue stems from integer overflow when doubling the merge threshold if the maximum threshold exceeds UINT_MAX/2. The loop break condition is checked after doubling, which can bypass the safeguard under specific conditions and hang the system.

A vulnerability in the Linux kernel PCI subsystem affecting s390 systems using a machine-level hypervisor has been resolved. The shared pci_slot assignment for multifunction devices caused the hotplug driver to reset the wrong function and leak memory. A flag was added to allow per-function PCI slots for hypervisor-managed functions.

In the Linux kernel, ksmbd compound response handling extends the last response iov to an eight-byte boundary. smb2_read_pipe() allocates only the payload size, so the alignment padding can expose up to seven bytes of uninitialized kernel heap memory. The fix allocates the aligned size and clears the unused tail before pinning the response buffer.

In the Linux kernel, ublk_ch_mmap() rejects mmap requests with VM_WRITE set but never clears VM_MAYWRITE on the resulting read-only mapping. This allows a userspace daemon to mmap the per-queue command buffer PROT_READ, then upgrade it to PROT_WRITE via mprotect(). The command buffer holds kernel-written struct ublksrv_io_desc entries, so a writable mapping lets an unprivileged daemon process corrupt fields such as addr, op_flags, nr_sectors, and start_sector.

In the Linux kernel, in the ksmbd module, there is a vulnerability to out-of-bounds reads in share config responses. Lack of validation of IPC data sizes before processing variable-length fields can lead to reading beyond the allowed memory area.

A use-after-free vulnerability exists in the Linux kernel perf subsystem when perf mmap() revival races with the last munmap(). perf_mmap_close() drops rb->mmap_count without holding event->mmap_mutex, allowing a concurrent perf_mmap_rb() to reattach a buffer that is then freed while another process still has it mapped.

In the Linux kernel, the rt6_multipath_rebalance() function is vulnerable to a divide-by-zero. A concurrent update of ignore_routes_with_linkdown can make the first pass return zero while the second sees an eligible nexthop, causing a division by zero in rt6_upper_bound_set().

In the Linux kernel, the gtp_newlink() error path lacks synchronize_net(), leading to a use-after-free. After clearing sk_user_data without waiting for an RCU grace period, concurrent packet reception in gtp_encap_recv() may still use a pointer to freed memory.

A flaw was found in the Linux kernel's ext4_search_dir() function where the directory entry bounds check does not account for the 8-byte hash trailer (EXT4_DIRENT_HASHES) used in casefolded encrypted directories. A crafted directory entry whose name ends exactly at the block boundary passes the check, causing ext4_match() to read out of bounds, reported as a use-after-free.

In the Linux kernel NTFS3 filesystem, ntfs_reparse_init() and ntfs_objid_init() read type and rule fields from the INDEX_ROOT attribute without checking if the resident attribute is large enough. This can lead to an out-of-bounds read when mounting a crafted image.

In the Linux kernel, rpcb_register_inet4() and rpcb_register_inet6() in SUNRPC store the result of rpc_sockaddr2uaddr() into map->r_addr without checking for NULL. When the underlying kstrdup allocation fails, the unchecked NULL is passed into the RPCBPROC_SET encode path, where strlen() dereferences NULL and crashes the kernel (oops).

In the Linux kernel NTFS3 filesystem, read_log_rec_buf() reads out of bounds due to an invalid log->record_header_len value from disk. This can lead to reading memory beyond the buffer when mounting a crafted NTFS image.

In the Linux kernel, the Qualcomm RMNet driver has a vulnerability where skb->dev is not assigned to frames after deaggregation. This leads to netif_tx_lock() being called on a NULL pointer, causing a kernel panic that can be triggered by an unprivileged user.

In the Linux kernel's vfio/pci subsystem, vfio_msi_cap_len() freed vdev->msi_perm on an initialization failure but left the pointer dangling. This led to a use-after-free on the next device open and a double free on device close, potentially causing a kernel panic.

In the Linux kernel, a vulnerability was resolved in drm/amd/display where HDCP configuration was not skipped in the transition state. The transition state does not have a valid dm_stream_ctx, so the HDCP routine should be skipped — it is only valid when a valid stream is created.

In the Linux kernel, a race condition in the ring-buffer during subbuf resize by readers was resolved. trace_buffer subbuf_size is read lockless in ring_buffer_read_page() and ring_buffer_read_start(), while it can simultaneously be resized with ring_buffer_subbuf_order_set(). The fix uses bpage::order instead of trace_buffer::subbuf_size and adds a mutex in ring_buffer_read_start().

In the Linux kernel, a vulnerability was resolved in iomap where a non-existent integrity payload was freed. fs_bio_integrity_alloc might not allocate a bio integrity payload if PI verification is disabled on the block device — the fix checks for that case before calling fs_bio_integrity_free in iomap_bio_read_folio_range_sync to avoid a NULL pointer dereference.

In the Linux kernel, an IRQ leak on the cpuhp_setup_state error path in the nxp-pit clocksource driver was resolved. When cpuhp_setup_state fails after pit_clockevent_per_cpu_init successfully called request_irq, the error handling skips freeing the registered IRQ, leaking the IRQ line and leaving a dangling pointer as the interrupt handler's dev_id, potentially leading to a use-after-free.

A bug was fixed in the Linux kernel in backing_file_open(), which derived the path stored in a new backing file from user_file->f_path. With nested filesystems (e.g. overlayfs on top of overlayfs) this caused an incorrect internal intermediate-layer path to be stored instead of the user-visible path. As a result, files mapped through a nested overlayfs showed the wrong path in /proc/<pid>/maps and in perf/ftrace mmap records.

In the Linux kernel, the PIDFD_GET_*_NAMESPACE ioctls in pidfd_ioctl() perform a ptrace access check based on credentials but, unlike the corresponding procfs paths, do not hold the target task's exec_update_lock. This allows a caller to pass the check against the target's old credentials and then read the namespace after the target has execve()'d a setuid binary and committed new credentials. The fix holds exec_update_lock for reading around the ptrace check and namespace lookup.

In the Linux kernel on native sparc64, struct __kernel_old_timeval contains a four-byte hole after tv_usec because tv_sec is 64-bit while __kernel_suseconds_t is 32-bit. put_itimerval() fills only the named fields in a stack-allocated __kernel_old_itimerval and copies the entire object to userspace, so getitimer() can expose the two padding holes. The fix zero-initializes the aggregate before assigning the fields.

In the Linux kernel's Rust devres layer, a race condition occurs when two paths concurrently revoke a Devres. devres_release_all() calls Revocable::revoke() via the release callback, while Devres::drop() calls revoke_nosync() on another CPU. The revoker that does not claim the is_available swap returns immediately, but the other may still be executing drop_in_place() on the inner data, causing a use-after-free. The fix adds a Completion that Devres::drop() waits on when it loses the is_available swap.

A use-after-free vulnerability exists in the Linux kernel's trusted keys (KEYS: trusted) module due to incorrect TPM teardown ordering. The trusted_tpm_exit() function drops the TPM chip reference and frees the digest array before unregistering the trusted key type, allowing a concurrent key operation to dereference freed memory.

In the Linux kernel, a bug in swap memory management causes hibernation slots to be freed even when a folio is present in the swap cache. The function swap_free_hibernation_slot() clears the entry under that folio, making it unreachable from the swap table and allowing the offset to be reused by another process. This can trigger silent memory corruption, process crashes, or data instability across unrelated userspace applications, typically when uswsusp is preparing the hibernation image.

In the Linux kernel, a vulnerability was fixed in the kmemleak module where kmemleak_scan() scanned all task stacks under a single RCU read-side critical section with no reschedule point. On hosts with very many threads, this could hog a CPU and trip the soft lockup watchdog. The fix walks tasks one PID at a time using find_ge_pid() and releases the RCU lock between tasks.

A vulnerability exists in the Linux kernel's queue_folios_pmd() function in mm/mempolicy, which fails to skip non-present PMD entries (e.g., device-private) before calling pmd_folio(). This can lead to VM_BUG_ON() on debug kernels, an oops on a bogus vmemmap dereference, or silently isolating an unrelated live folio from LRU. The issue is triggered when an HMM-based GPU driver migrates an anonymous THP folio to device memory and userspace then calls mbind(), migrate_pages(), or set_mempolicy_home_node().

In the Linux kernel, the mglru mechanism's sort_folio() function contained a buggy shortcut for folios that are no longer evictable but still on a generation list. The bug caused mlock_count to alias LIST_POISON2 (0x122, i.e. 290), leading to incorrect Mlocked accounting and folios remaining unevictable until freed. The shortcut also manipulated LRU flags in the wrong order, potentially causing unexpected behavior during concurrent folio isolation.

In the Linux kernel, migrate_pages_batch() unmaps each folio, which on KVM hosts triggers expensive MMU notifier callbacks and keeps the CPU busy for a long time. The loop only calls cond_resched(), which is a no-op on PREEMPTION kernels, so the migrating task (e.g. kcompactd) never reports a Tasks-RCU quiescent state and stalls the Tasks-RCU grace period for minutes.

In the Linux kernel, __migrate_device_pages() reads the folio mapping before calling folio_free_swap(). When folio_free_swap() succeeds, the folio is removed from the swap cache but the saved mapping still points to swap_space, leading to use of a stale mapping and invalid reference accounting, eventually triggering a folio reference count BUG.