Linux kernel vulnerabilities

A flaw in the Linux kernel's mm/pagewalk mechanism causes walk->action to remain incorrectly set to ACTION_AGAIN after a PMD entry is cleared, leading to duplicate walk callbacks and an out-of-bounds write. This was detected by KASAN in __mincore_unmapped_range.

In the Linux kernel, the scan loop in shrink_lruvec() only calls cond_resched(), which is a no-op on PREEMPTION kernels. As a result, the reclaiming task never reports a Tasks-RCU quiescent state and becomes a holdout, causing rcu_tasks stalls during reclaim.

In the Linux kernel, kernfs serializes file operations only per open file, so concurrent writes to memory.high or memory.max can overlap. If another writer raises or removes the limit, the first writer may keep reclaiming toward a stale target, and for memory.max it can loop indefinitely while repeatedly incrementing the OOM event counter.

On x86, TDX port I/O handling (handle_in() and handle_out()) uses the mask GENMASK(BITS_PER_BYTE * size, 0), which includes the high bit. For size=1 this yields a 9-bit mask 0x1FF instead of the 8-bit 0xFF, making the mask one bit too wide for all I/O sizes.

In the Linux kernel, dup_task_struct() copies user_event_mm from the parent to the child without taking a reference. If user_event_mm_alloc() fails, user_event_mm_dup() leaves the copied pointer unmodified, and when the child exits user_event_mm_remove() decrements a reference the child never owned, leading to a use-after-free (UAF).

In the Linux kernel, event_test_stuff() calls kthread_run() and unconditionally passes the returned task_struct pointer to kthread_stop(). When thread creation fails (e.g. under memory pressure during the boot-time self-test), kthread_run() returns an error pointer such as ERR_PTR(-ENOMEM), and kthread_stop() dereferences the invalid pointer, crashing the kernel.

In the Linux kernel, simple_ring_buffer_swap_reader_page() starts with retry set to 8 and decrements it only after a failed link replacement. On the final attempt, a successful replacement leaves retry at zero while a failed one leaves it at -1, so the !retry test reverses both outcomes and can corrupt the ring buffer.

In the Linux kernel, writing to buffer_subbuf_size_kb calls ring_buffer_subbuf_order_set(), which frees every sub-buffer of the ring buffer, including the reader page. trace_pipe readers hold pointers into those pages, and ring_buffer_peek() returns the event pointer after dropping the lock, so changing the sub-buffer order in that window leads to a use-after-free.

A use-after-free vulnerability exists in the Linux kernel tracing subsystem when two hist triggers with the same name (name=) are registered on different events. The second trigger reuses the first as named_data, but its entry in the tr->hist_vars list is never removed, leaving a dangling pointer to freed hist_data. A later hist trigger referencing a variable then dereferences the freed memory and panics the kernel.

In the Linux kernel, the debugfs lockdown check did not cover the mmap_prepare file operation, only mmap. As a result, files using mmap_prepare could bypass the lockdown when the kernel was in integrity mode.

In the Linux kernel, fwnode_for_each_child_node() can enter an infinite loop when iterating over children of a fwnode that has a secondary fwnode with more than one child. This causes the same nodes to be returned repeatedly instead of terminating the iteration.

In the Linux kernel, nsm_sendrecv_msg_locked() stores the length reported by the NSM device without bounding it to the response buffer size. A malicious or buggy device can report an oversized length, leading to an out-of-bounds read and disclosure of adjacent kernel heap memory.

In the Linux kernel, dma_req_free() in RapidIO mport_cdev drops the mapping reference via kref_put() and then dereferences req->map again to unlock the mutex. If kref_put() drops the last reference, the object is freed and a use-after-free occurs.

In the Linux kernel, a previous error-handling fix in __video_register_device() was reverted because it caused a double-free. The V4L2 API requires calling video_device_release() after a failed registration, but put_device() already freed the structure.

In the Linux kernel, the serial: imx driver publishes its port in imx_uart_ports[] before uart_add_one_port(), and the entry is not cleared on add failure or after removal. This leaves a dangling pointer through which a sibling probe can register the shared console.

A use-after-free vulnerability exists in the Linux kernel USB dwc3 gadget driver. The dwc3_gadget_free_endpoints function frees the dep structure while a queued nostream_work delayed work may still be pending or running and accessing the freed memory. The issue is fixed by canceling the delayed work before freeing the memory.

In the Linux kernel's USB gadget at91_udc driver, in polled-VBUS mode, the timer and associated work item were not stopped before the udc structure was freed. This led to a use-after-free during normal driver unbind or probe failure.

In the Linux kernel, tbt_altmode_remove() drops the plug and cable references without draining tbt->work. The work function dereferences those references and can requeue itself, and VDM callbacks can queue the same work item.

In the Linux kernel, the USB gadget u_audio driver has a use-after-free in g_audio_cleanup(). snd_card_free_when_closed() returns asynchronously while the snd_uac_chip structure is freed immediately, leaving ALSA control handles (kctls) open in userspace. Accessing these handles dereferences freed memory.

In the Linux kernel, the USB gadget midi2 driver's f_midi2_alloc_inst() creates default configfs groups, but configfs_remove_default_groups() is never called during function teardown or EP cleanup. This leaks f_midi2_ep_opts and f_midi2_block_opts structures.

In the Linux kernel, the USB gadget uvc driver's uvcg_video_init() logs an error using the video->uvc pointer when kthread_run_worker() fails, but this pointer is not yet assigned. This triggers a null pointer dereference.

In the Linux kernel, the USB gadget uvc driver's uvc_function_bind() and uvc_function_unbind() leave dangling pointers uvc->control_req and uvc->control_buf after freeing. This leads to use-after-free.

In the Linux kernel, ffs_ep0_read() in the USB gadget FunctionFS interface could deadlock. The function slept while holding ffs->mutex, so when the gadget was torn down via configfs (e.g., echo "" > UDC) while a userspace daemon looped on read(), a permanent deadlock occurred. The fix drops the mutex before sleeping and uses wait_event_interruptible_exclusive().

In the Linux kernel, cxl_rch_get_aer_info() reads AER registers beyond the mapped block because sizeof(struct aer_capability_regs) exceeds the physical AER capability size. The over-read can also cause a second out-of-bounds in pcie_print_tlp_log().

In the Linux kernel, the altera-cvp FPGA driver's altera_cvp_send_block() dereferences a u32 pointer even when only 1-3 bytes remain in the buffer. This can cause an out-of-bounds read if the buffer ends at a page or scatterlist boundary.

In the Linux kernel, the HID sensor-hub driver's sensor_hub_get_feature() clamps the return value but the copy loop still copies field->report_size / 8 bytes per value. A malicious HID descriptor can cause an out-of-bounds write when an IIO caller supplies a small buffer.

In the Linux kernel, the i3c renesas driver's function computing the newly discovered devices bitmask does not account for an empty bus. When the bus is empty, the data length field contains the maximum number of devices (8), leading to an out-of-bounds access.

In the Linux kernel, KVM arm64 GICv2's vgic_v2_deactivate() passes the INTID written by the guest to GICV_DIR directly to vgic_get_vcpu_irq() and treats a failed lookup as impossible with WARN_ON_ONCE(). A guest can trigger this at will, causing a host panic with panic_on_warn.

In the Linux kernel, ucs2_strnlen() in lib/ucs2_string.c checks the current character before checking whether the caller-provided maximum length has been reached. If the input is not NUL-terminated within that bound, the loop can read one ucs2_char_t past the limit, causing an off-by-one out-of-bounds read.

In the Linux kernel, the media: cec: stm32 driver's stm32_rx_done() appends each received CEC byte to rx_msg.msg[] using rx_msg.len as the write index without checking it against the buffer size. The rx_msg.msg[] buffer is a fixed CEC_MAX_MSG_SIZE (16) byte array, and the number of bytes before RXEND is controlled by the remote CEC device, allowing an out-of-bounds write.

In the Linux kernel, the media: vicodec driver's fwht_encode_frame() encodes one plane per component, and an incompressible plane takes the FWHT_FRAME_UNENCODED path copying the plane verbatim. For a 4-component pixel format all four planes are full resolution, so a frame forcing the unencoded fallback writes more bytes than the buffer size, overrunning the plane by coded_w * coded_h.

A slab-out-of-bounds vulnerability was fixed in the Linux kernel's nilfs_direct_propagate() function in the nilfs2 filesystem. After truncating a file, a B-tree node block remained in the cache in a dirty state and was later incorrectly processed as a direct mapping entry, causing an out-of-bounds memory access. The issue was resolved by adding a nilfs_btree_discard() operation to delete the orphaned node block during mapping conversion.

A vulnerability was fixed in the Linux kernel's pci_write_legacy_io() function in the PCI/sysfs subsystem. The function unconditionally loaded 4 bytes from the kernfs write buffer even when userspace wrote only 1 or 2 bytes, causing an out-of-bounds read of the allocated memory (slab-out-of-bounds). Additionally, on little-endian PowerPC (POWER8 and later), byte shifts caused an out-of-bounds byte write instead of the requested value.

In the Linux kernel, the phy: rockchip-samsung-dcphy driver has an incorrect max_register value of 0x10000, while the PHY register block is 64KB, so the last accessible register is at offset 0xfffc. Dumping registers through the regmap debugfs interface reads beyond the ioremapped region and oopses on the unmapped page.

In the Linux kernel, ubifs_sb_verify_signature() bounds the on-disk ubifs_sig_node->len field with the wrong sign, adding the header size instead of subtracting it. This accepts a declared length up to 2 * UBIFS_SIG_NODE_SZ larger than the node actually holds, leading to an out-of-bounds read past c->sbuf while processing the PKCS7 signature.

In the Linux kernel, zram's read_block_state() calculates nr_pages before taking dev_lock. If the device is reset and reinitialized with a smaller disksize before lock acquisition, nr_pages still describes the old table, and the subsequent loop can call slot_lock() past the end of the newly allocated table.

In the Linux kernel, zram's writeback_store() calculates the table scan bounds before taking dev_lock. A reset followed by reconfiguration with a smaller disksize can replace zram->table while writeback_store() is waiting for the lock, so once it acquires the lock it scans the new table using the old upper bound, resulting in an out-of-bounds access.

In the Linux kernel, zram_destroy_comps() resets all compressors and leaves them set to NULL, including the primary one, which is invalid device state. This can lead to a NULL pointer dereference in comp_algorithm_show() via strcmp().

In the Linux kernel, the zram module lacked validation of deflate parameters. A user-supplied winbits value was not checked before being passed to zlib_deflate_workspacesize(), which triggers BUG_ON() for values outside the valid range.

In the Linux kernel, the NFS/localio subsystem has a reference leak when nfs_uuid_add_file() races with nfs_uuid_put() and returns -ENXIO. In that case the error path fails to release the nfsd_file and nfsd_net references, preventing proper teardown of network resources.

A memory leak exists in the Linux kernel NFS subsystem. The nfs4_server_common_setup() function allocates the delegation_hash_table, but the server->destroy pointer responsible for freeing it is only assigned at the end of the function. If any intermediate step fails, the table is not freed, leaking 4 KiB of kernel memory on every failed NFSv4 mount attempt.

In the Linux kernel, a flawed WARN_ON_ONCE was removed from nfsd_mode_check(). The assumption justifying the warning is invalid for NFS reexport, where the function can encounter a dentry without i_op->lookup. Returning nfserr_notdir must remain to guard the lookup_one_unlocked() path against a NULL method pointer dereference.

In the Linux kernel, the out_forget path in pnfs_layout_process() never drained the free_me list, causing a layout segment leak. Previous fixes added and removed the drain, and this change restores the pnfs_free_lseg_list() call.

In the Linux kernel, the nlmsvc_ops pointer was published and cleared with plain stores while lockd dereferenced it unguarded from dispatch sites in fs/lockd/svcsubs.c. After nfsd module removal, a stale load could result in a NULL dereference or a module-text use-after-free.

In the Linux kernel, nfsd_cross_mnt() jumped to the out label on a follow_down() error without releasing the path references taken by mntget() and dget(). This leaked references on each failed cross-mount, blocking umount and pinning dentries.

In the Linux kernel, nfsd4_copy() leaks an nfsd_file reference when inter-server COPY setup fails. The function returns an error directly, bypassing the out: label that would release the file reference. Each failed operation leaks one nfsd_file, pinning the file, inode, dentry, and vfsmount.

In the Linux kernel, nfsd4_setattr() has a NULL pointer dereference when a SETATTR request includes delegation time attributes (FATTR4_WORD2_TIME_DELEG_ACCESS or FATTR4_WORD2_TIME_DELEG_MODIFY) and the client supplies the special stateid (all 0xFF bytes). The local variable st remains NULL and is then dereferenced, causing a kernel oops. This is remotely triggerable by any NFSv4 client without authentication.

In the Linux kernel, nfsd_direct_write() has a partial-write detection bug. After vfs_iocb_iter_write(), iter.count holds the residual byte count, not the original length, so the break condition is incorrect. Short writes completing between 50% and 99% of the segment are not detected, causing the next segment to be written at the wrong offset and over-reporting the byte count to the NFS client.

In the Linux kernel, nfsd4_ff_encode_getdeviceinfo() has an XDR padding calculation error. The da_addr_body reservation does not match the actual bytes written by xdr_encode_opaque(), causing stale reply-page content to leak to the client and misaligning the subsequent version list decode. This occurs on every flexfile GETDEVICEINFO reply.

A vulnerability was fixed in the Linux kernel's nfsd module where nfsd_open_local_fh() dereferenced an nfsd_file pointer without holding an RCU read lock. The object could be freed and reallocated by another thread, leading to a use-after-free condition. The fix wraps the cmpxchg and reference acquisition in an rcu_read_lock() section.