Linux kernel vulnerabilities

A vulnerability in the Linux kernel BPF bloom filter sizing and indexing on 32-bit kernels has been fixed. When the bitmap reaches the U32_MAX fallback case, an arithmetic error causes under-allocation, and negative bit offsets allow writes past the allocated object. This enables local privilege escalation on a 32-bit x86 kernel by a process with CAP_BPF.

The Linux kernel's dm-io module rebuilt destination bios for DM_IO_BIO requests by copying the source biovec, which with non-sector-aligned vector lengths (e.g. misaligned O_DIRECT buffers) could lose a sub-sector fragment and hang I/O. The fix clones the source biovec via bio_alloc_clone() and remaps it to the target device, eliminating manual page copying.

In the Linux kernel, the error codes BLK_STS_NOTSUPP and BLK_STS_INVAL should not cause leg failure on dm-raid1. The fix changes the dm-io interface to report two error bitmaps: error_bits and unsup_bits, where unsup_bits tracks unsupported errors, and dm-raid1 no longer fails a leg on such errors. This fixes misbehavior with unaligned bio vectors on dm-raid1.

The Linux kernel's dm-era module leaks a metadata block when a take-snap operation fails. metadata_take_snap() bumps the superblock refcount and allocates a new shadow block, but if the subsequent dm_sm_inc_block() fails, the block is never returned to the metadata space map. The fix frees the clone with dm_sm_dec_block() on error paths.

The Linux kernel's build_constructor_string() function in the dm-raid1 module does not reserve space for the NUL terminator after the maximum 20 decimal digits of a long long value. This can lead to a buffer overflow in sprintf(). The fix reserves additional space for the NUL terminator.

A use-after-free vulnerability exists in the Linux kernel's rfcomm_security_cfm() function in the Bluetooth RFCOMM subsystem. The function walks the session and DLC lists without holding rfcomm_mutex, allowing the krfcommd thread to concurrently free the same session and its DLCs. This results in a read of freed memory (KASAN: slab-use-after-free).

A use-after-free vulnerability exists in the Linux kernel's IPv4/IPv6 multicast forwarding path. When a multicast packet is not locally deliverable, the skb retains an skb->sk association set by bpf_sk_assign() or UDP early demux even though a socket reference is not guaranteed. After the prefetched socket is destroyed, a later skb free invokes sock_pfree() and dereferences the stale skb->sk.

In the Linux kernel, ip6_tnl_xmit() uses skb_realloc_headroom(), which replaces the caller-owned skb and keeps the replacement only in a local variable. If an error occurs after reallocation (e.g., non-NONE encap rejection in collect_md tunnels or ip6_tnl_encap() failure), the caller still holds the original skb pointer, leading to a double free of the skb.

In the Linux kernel, ip6gre_tnl_link_config_route() incorrectly accumulates the lower device's hardware header length into dev->hard_header_len for NBMA ip6gre tunnels. This results in an incorrect hardware header length for the tunnel, potentially causing packet transmission issues.

A NULL pointer dereference vulnerability exists in the Linux kernel's ipv6_rpl_srh_rcv() function, which reads idev->cnf.rpl_seg_enabled without checking whether idev from __in6_dev_get() is NULL. When the device MTU drops below IPV6_MIN_MTU, addrconf_ifdown() clears dev->ip6_ptr, and a packet that passed the earlier idev check can reach ipv6_rpl_srh_rcv() with a NULL pointer.

A vulnerability in the Linux kernel's Landlock mechanism related to whiteout object creation used by OverlayFS has been fixed. Creating whiteouts via mknod(2) with S_IFCHR and makedev(0,0), and via renameat2(2) with RENAME_WHITEOUT, was not properly restricted by Landlock permissions, allowing bypass of restrictions. The fix requires LANDLOCK_ACCESS_FS_MAKE_REG for both cases.

In the Linux kernel, __nd_label_validate() in libnvdimm/labels has an integer overflow. The nslot field (u32) is multiplied by the label size in 32-bit arithmetic, which can wrap around and bypass the bounds check, leading to an out-of-bounds write in nd_label_data_init().

In the Linux kernel, the super_1_load() function in the md module did not validate the range of sb->bblog_shift loaded from the on-disk superblock. This value (0-255) is used as a bit shift when computing sector and block counts, which with an invalid value can overflow a 64-bit variable and cause an error in badblocks_set() in block/badblocks.c.

In the Linux kernel, elf_validity_cache_secstrings and elf_validity_cache_index_str access the section name table (.shstrtab) and symbol string table (.strtab) headers without first ensuring their type is SHT_STRTAB. If a section type is SHT_NULL or SHT_NOBITS, sh_offset has not been validated and may reference out-of-bounds memory, causing an out-of-bounds read.

In the Linux kernel, mptcp_token_join_cookie_init_state() fails to restore the local_id field from the saved cookie entry when rebuilding the request socket for an MP_JOIN handled under SYN cookies. The uninitialized field is then read by subflow_ulp_clone() and stored as the joined subflow's address-ID, which an off-path peer can influence by sending concurrent MP_JOIN SYNs.

In the Linux kernel, the nouveau/gem driver has a race in the non-uvmm path between the info lookup finding the vma and the gem close path closing the vma, leading to a use-after-free.

In the Linux kernel, param_set_charp() releases the previous parameter value before the replacement allocation succeeds. If kmalloc_parameter() fails, the setter returns -ENOMEM with the parameter left as NULL, which can later trigger a NULL pointer dereference, e.g., when failing zswap's compressor update before zswap is initialized.

In the Linux kernel, svc_pool_for_cpu() can select a pool with no threads when a service runs fewer threads than it has pools (e.g., nfsd in pernode/percpu mode with fewer threads than NUMA nodes). A transport enqueued on such a pool is never picked up, causing the connection to hang indefinitely.

In the Linux kernel, sunrpc_destroy_cache_detail() only cancels the global cache_cleaner delayed_work when cache_list is empty, which never happens during per-netns teardown. This leads to a use-after-free where cache_clean() may still hold a dangling pointer to the freed cache_detail.

In the Linux kernel, __svc_create() ignored the return values of percpu_counter_init() when initializing three per-pool RPC statistics counters. When a per-CPU allocation fails (e.g., under memory pressure), the RPC service (nfsd, lockd, or NFS callback service) is started with uninitialized counters whose per-CPU pointer is NULL. This silently corrupts data in the current CPU's per-CPU area and causes /proc/fs/nfsd/pool_stats to return garbage.

In the Linux kernel, svc_rqst_free() frees rq_argp and rq_resp synchronously while deferring the rqstp struct free via kfree_rcu(). This creates a window where RCU readers can access already freed fields, leading to a use-after-free.

The Linux kernel fixed four coupled defects in the SUNRPC gssx XDR option-array decoder. The bugs caused a NULL dereference in the caller, a refcount leak on the decoded group_info, and a latent use-after-free.

A use-after-free vulnerability exists in the Linux kernel in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir within the sunrpc subsystem. The clnt->pipefs_sb field is not refreshed on mount events nor cleared on unmount, causing comparison against a stale pointer and skipped cleanup. As a result, pipefs dentries may point to a freed rpc_clnt, leading to use-after-free during subsequent rpc_info_open() or rpc_show_info() calls.

A race condition exists in the Linux kernel sunrpc module. The /proc/net/rpc/use-gss-proxy entry is published by proc_create_data() before the sn->gssp_lock mutex is initialized via mutex_init(), allowing a writer to lock an uninitialized mutex.

In the Linux kernel, gssx_dec_option_array() in the SUNRPC subsystem does not reject duplicate CREDS_VALUE options. Each CREDS_VALUE entry triggers gssx_dec_linux_creds(), which overwrites creds->cr_group_info without releasing the previous allocation, causing a memory leak. A reply containing two CREDS_VALUE entries is sufficient to leak the first group_info allocation.

In the Linux kernel, svc_rdma_free() in the svcrdma subsystem has a use-after-free due to operation ordering. rpcrdma_rn_unregister() is called after rdma_destroy_id(), leaving the sc_rn entry in the device's rd_xa after the cm_id is freed. A concurrent ib_unregister_device walk can dispatch svc_rdma_xprt_done() against the freed sc_cm_id. Additionally, the sc_cm_id dereference lacks a NULL check.

In the Linux kernel svcrdma module, when handling an ADDR_CHANGE event the replacement connection ID (cm_id) allocation fails, sc_cm_id still points to the old cm_id that the CM core is about to destroy. Any later dereference of sc_cm_id, such as the rdma_disconnect() call in svc_rdma_detach(), results in a use-after-free.

In the Linux kernel svcrdma module, handle_connect_req() takes no action when svc_rdma_create_xprt() fails to allocate a new transport. Because the CM core returns 0 for CONNECT_REQUEST events, the new rdma_cm_id is not destroyed, leaking one rdma_cm_id per failed allocation under memory pressure.

In the Linux kernel svcrdma module, the RPC/RDMA Read list decoder stores wire-supplied segment lengths without validation. An oversized rs_length reaches svc_rdma_build_read_segment(), which derives nr_bvec from it and can drive a large dynamic bvec allocation before verifying that enough rq_pages remain; if the post-allocation page-overrun guard fires, the freshly acquired rw context is not returned, leaking the resource.

In the Linux kernel svcrdma module, individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending multiple segments whose cumulative length exceeds the rq_pages array budget. When one segment fills the page array exactly, the runtime guard in svc_rdma_build_read_segment() is bypassed because len reaches zero, and a subsequent segment accesses the NULL sentinel slot at rq_pages[rq_maxpages], resulting in a NULL pointer dereference during DMA mapping.

In the Linux kernel svcrdma module, svc_rdma_create() calls kfree(cma_xprt) when svc_rdma_create_listen_id() fails. Because svc_xprt_init() has already acquired a net namespace reference via get_net_track(), kfree bypasses svc_xprt_free() which would release it, leading to unbalanced reference counts.

In the Linux kernel UDF filesystem, UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings, where s_num_entries stores the number of entries, not the highest valid index. udf_get_pblock_virt15() currently rejects only indexes greater than s_num_entries, so a crafted image can request index s_num_entries, pass the bounds check, and make the kernel read one entry past the allocated VAT table.

A bug was fixed in the Linux kernel's sched_ext scheduler regarding dispatch kfuncs. Under core scheduling, ops.dispatch() may run on a different CPU than the dispatched rq, leading to incorrect assumptions in several kfunc paths, including a potential deadlock in scx_dsq_move() and incorrect resolution of SCX_DSQ_LOCAL.

In the Linux kernel, a bug in the sched_ext scheduler caused corruption of rq->core_pick state under core scheduling. When a task pick released the rq lock during dispatch, concurrent selections on the same SMT core corrupted each other's state, leading to a NULL deref or deadlock and hard hangs. The fix forces RETRY_TASK whenever dispatch released the lock, so a selection only commits picks made under a continuously held lock.

A vulnerability exists in the Linux kernel SCSI subsystem where scsi_alloc_sgtables() leaves DMA padding bytes (pad_len) uninitialized for the last unaligned scatterlist element. This leads to an uninitialized memory read (detected by KMSAN) during DMA operations, potentially causing data leakage or system instability.

In the Linux kernel, the fnic (SCSI/FCoE) driver allocates a VLAN descriptor with GFP_KERNEL while holding the vlans_lock spinlock. GFP_KERNEL allocation may sleep, which is not allowed in this atomic context and can trigger a sleeping-from-invalid-context warning or deadlock.

In the Linux kernel, the RISC-V KVM implementation has an integer overflow in the PMU event info array size calculation. The guest-controlled num_events value is multiplied by sizeof(*einfo) and stored in a 32-bit integer, causing truncation for large values and allocation of an undersized buffer. The subsequent loop iterates over the original num_events, resulting in out-of-bounds reads and writes.

In the Linux kernel, the remoteproc subsystem (SCP driver) leaks a device reference on a failed driver data lookup before the driver has been bound. The reference taken to the SCP device is not dropped when the lookup fails.

In the Linux kernel, the qede driver (QLogic FastLinQ NIC) has a bug where memory pressure causes a NULL pointer dereference while processing TPA continuation fragments. Because tpa_info->buffer.data is not assigned in qede_tpa_start(), a "ghost" buffer with a valid DMA mapping but a NULL data pointer is pushed back into the Rx ring, causing a kernel panic in qede_fill_frag_skb().

In the Linux kernel, the RDMA/cxgb4 driver's c4iw_remove() can free ctx->dev while the queued reg_work (which registers the RDMA device) is still pending or running. This leaves c4iw_register_device() accessing the freed device.

In the Linux kernel, the RDMA/ionic driver was not adapted to the requirement of embedding struct rdma_counter in a driver-specific struct and registering its size via INIT_RDMA_OBJ_SIZE. As a result, rdma_zalloc_drv_obj() allocates zero bytes, causing a NULL pointer dereference in alloc_and_bind().

In the Linux kernel, ucma_set_ib_path() called ucma_event_handler() from the write() path without the handler lock that keeps ctx->file stable while a uevent is queued. A concurrent ucma_migrate_id() could reassign ctx->file, causing list operations on another file's event_list without the correct mutex, leading to a use-after-free (detected by KASAN).

In the Linux kernel, the RDMA/uverbs subsystem's UVERBS_METHOD_REG_MR method is missing the UVERBS_ATTR_UHW attribute, even though three drivers (mthca, irdma, siw) have UHW data associated with reg_mr and assume udata cannot be NULL. A malicious userspace process can trigger a NULL udata crash in those drivers.

In the Linux kernel, the RDMA/uverbs subsystem's legacy write() path passes a uverbs_attr_bundle to provider code without an ioctl method element. If malformed provider input causes the common validation code to emit an error message, uverbs_get_handler_fn() dereferences the uninitialized method_elm pointer.

In the Linux kernel's as3722_get_regulator_dt_data(), of_get_child_by_name() acquires a reference on np which is assigned to pdev->dev.of_node, but of_node_put(np) is then called immediately, releasing the reference and leaving a dangling pointer. Removing the of_node_put(np) call lets the device hold the reference.

In the Linux kernel ring-buffer subsystem, ring_buffer_alloc_read_page() races with ring_buffer_subbuf_order_set, potentially allocating a reader page with an outdated order. If subbuf_order changes mid-allocation, bpage->order may not match the actual allocated memory.

In the Linux kernel ring-buffer subsystem, when sub-buffers use an order greater than 0, cpu_buffer->free_page is allocated with subbuf_order. The fix ensures the correct order is used for cpu_buffer->free_page.

In the Linux kernel ring-buffer subsystem, ring_buffer_subbuf_order_set() can clear cpu_buffer->free_page, causing races with ring_buffer_alloc_read_page() and ring_buffer_free_read_page(). The fix holds cpu_buffer->lock while resizing a subbuf.

In the Linux kernel ring-buffer subsystem, discarding a cached reader page after a concurrent ring buffer resize uses the new global subbuf_order for free_pages(), potentially crashing the kernel or leaking memory. The fix stores the actual page order alongside the page address by making free_page a buffer_data_read_page.

In the Linux kernel ring-buffer subsystem, __rb_get_reader_page_from_remote() continues despite a failed swap_reader_page callback (returning -EBUSY), potentially mishandling the page list. The fix treats the callback failure as recoverable, logs it with pr_warn_ratelimited(), and returns NULL.