Linux kernel vulnerabilities

In the Linux kernel, the platform/x86 hp-bioscfg driver's hp_get_string_from_buffer() clamped the converted string length against the destination buffer size using "size > dst_size". When the length equaled dst_size, the unconditional NUL terminator write landed one byte past the destination buffer.

In the Linux kernel's platform/x86 hp-bioscfg module, the per-type ACPI package parsers were handed the wrong element count — instead of the validated obj->package.count they derived it from the NAME field (an ACPI_TYPE_STRING), effectively reading string.length through the acpi_object union. This is safe today because hp_init_bios_package_attribute() rejects packages with fewer elements than the type requires, but an upcoming relaxation of that check would cause an out-of-bounds heap read. The fix forwards the validated obj->package.count to every parser.

A use-after-free vulnerability exists in the Linux kernel's icc_get() and of_icc_get_by_index() functions. When memory allocation for path->name fails, the error path calls kfree(path) without removing the path's requests from the req_list, leaving dangling pointers that can be dereferenced later. The fix replaces kfree(path) with icc_put(path) and ensures the icc_lock mutex is released before calling icc_put().

In the Linux kernel, ipmb_write() in the IPMI driver read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes, and a length smaller than the SMBus header underflows the block write length.

In the Linux kernel, ipmi_add_smi() creates the nr_users and nr_msgs files before trying to create the maintenance_mode file. If that last creation fails, the error path removes only nr_users before dropping the final reference to the interface, leaving the nr_msgs sysfs attribute registered in the freed interface.

A NULL pointer dereference vulnerability exists in the Linux kernel ipmi_si driver. When IPMI interface registration fails (e.g., BMC does not respond correctly to the Get Device ID command), shutdown_smi() frees si_sm and sets the pointer to NULL, but the in_shutdown flag is not set. The asynchronous redo_bmc_reg work item can then retry communication with the already-cleaned interface, causing start_kcs_transaction() to be called with a NULL pointer and resulting in a kernel crash.

In the Linux kernel, if an error occurs during startup of an IPMI interface, it may have scheduled work to run. The work needs to be canceled before the interface can be freed, which was missing in the ipmi:msghandler module.

In the Linux kernel, afiucv_hs_rcv() (net/iucv) selected an AF_IUCV socket based solely on four 8-byte name fields in the transport header, without checking the ingress net_device. This allowed a frame arriving on any netdev, including one in another network namespace, to be delivered to an AF_IUCV socket. The fix skips any socket whose hs_dev does not match the ingress device.

A use-after-free vulnerability exists in the Linux kernel's SLIP driver within the sl_sync() function. The slip_devs[] array stores bare net_device pointers without taking references, and entries are freed outside rtnl_lock() protection, allowing access to freed memory during slip_open().

In the Linux kernel, tun_get_user() in the TUN/TAP driver uses tun->align both as skb headroom and to decide how much packet data to keep linear. When align exceeds the usable space in a one-page skb head, SKB_MAX_HEAD(align) underflows, the result becomes negative, and after assignment to a size_t it causes skb->data to be placed outside the allocated head. OVS can propagate an oversized headroom request from another port to TUN or TAP.

In the Linux kernel, the DSA driver for Realtek switches used gpiod_set_value() instead of gpiod_set_value_cansleep() in rtl83xx_reset_assert() and rtl83xx_reset_deassert() to control the reset GPIO. When the reset GPIO is provided by a sleeping controller such as an I2C I/O expander, gpiod_set_value() triggers a kernel warning. The issue affects kernels v6.9+ that contain these helper functions.

In the Linux kernel, the bnxt driver's SW USO path can return early with NETDEV_TX_BUSY even though txr->kick_pending was previously set to 1. In that case the driver writes some BDs but never writes the doorbell, causing the TX queue to stall because the device does not know it should perform the TX and generate the completion that would wake the queue.

A bug in the Linux kernel's IPA driver (net: ipa) caused the modem TX queue to stall permanently after runtime resume. ipa_start_xmit() unconditionally stopped the TX queue before calling pm_runtime_get(), relying on a wake scheduled by runtime resume to restart it. However, that wake work ran too early — before the device power state reached RPM_ACTIVE — so the queue was never restarted and transmit stalled permanently.

In the Linux kernel, the L2TP netlink handlers for tunnel create/modify and session create/modify send multicast notifications after the live operation has completed. A failure to allocate, encode, or multicast the notification is returned as the command result even though the operation already committed, which can cause callers to retry and accumulate live objects.

In the Linux kernel, mctp_route_lookup() uses rt->dev without holding a reference, and mctp_route_lookup_single() returns the route under RCU only. The route's device can be torn down concurrently, leading to a use-after-free in mctp_dev_saddr() when reading rt->dev->addrs[0], reachable by an unprivileged local AF_MCTP user without CAP_NET_RAW. In the same window mctp_dev_hold() increments a refcount that has already reached zero.

In the Linux kernel, phylink_inband_caps() only checks whether the PCS returned by mac_select_pcs is NULL, but mac_select_pcs can also return an error pointer. This causes phylink_pcs_inband_caps() to dereference ops from the phylink_pcs struct despite the error, leading to a kernel panic.

In the Linux kernel, the ravb driver can dereference an invalid PTP clock because the PTP clock is unavailable before the first open, and registration failures can leave an error pointer in priv->ptp.clock. Querying the clock index can then cause a NULL or error pointer dereference.

In the Linux kernel, the ravb Ethernet driver's PTP interrupt handler ravb_ptp_interrupt() can race with ravb_ptp_stop(), passing the clock pointer to ptp_clock_event() while ptp_clock_unregister() is freeing it, leading to a use-after-free. The fix uses READ_ONCE()/WRITE_ONCE() for lockless access, atomically detaches the clock with xchg() before disabling PTP interrupts, and synchronizes IRQs before unregistering.

In the Linux kernel, the Thunderbolt driver's tb_xdomain_alloc_in_hopid() passes the wanted HopID as the lower bound to ida_alloc_range(), so a taken ID is not an error and the allocator returns the next free one. tbnet_connected_work() treats any other ID as a failure and returns without releasing the allocated ID, leaving it live for the rest of the XDomain connection. The fix releases the ID when it is not the one requested.

In the Linux kernel, every failure path in the Thunderbolt driver's tbnet_connected_work() undoes its own work and returns without clearing login_sent, so the connection still looks established. The next tbnet_tear_down() repeats a teardown that already happened: it stops already-stopped rings (dev_WARN(), fatal under panic_on_warn) and releases net->remote_transmit_path even on the HopID mismatch path where this connection never owned that ID. The fix clears login_sent on those paths.

In the Linux kernel, the NTB ntb_transport module's ntb_transport_tx_enqueue() was meant to drop packets submitted while the QP link is down, but it only returned 0 without consuming the packet. Zero means success, so ntb_netdev reports NETDEV_TX_OK and forgets the skb — nothing queued or freed it, leaking one skb per transmit racing a link-down. The fix returns -ENOLINK, restoring the contract that a non-zero return leaves the buffer owned by the caller.

In the Linux kernel, the NTB ntb_transport module's ntb_process_tx() handles an oversized buffer by calling tx_handler() with a NULL data pointer and returning success. ntb_netdev therefore neither frees the skb in its completion callback nor takes its enqueue error path, leaking it. The fix rejects oversized buffers in ntb_transport_tx_enqueue() before acquiring a queue entry and returns -EMSGSIZE.

In the Linux kernel, the net/smc module's smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() read the part of a v2 message that does not fit into the 44-byte smc_llc_msg union, bounding themselves by the buffer size rather than what arrived. On a link with a shared v2 receive buffer, a 44-byte DELETE_RKEY_V2 declaring 255 rkeys reaches rkey[9..254] in leftover data and passes them to smc_rtoken_delete(), potentially deleting a registered rtoken. The fix copies the tail into the queue entry and declares inline rkeys as a union member.

In the Linux kernel, the net/smc module's smc_close_stream_wait() calls smc_tx_prepared_sends() inside its sk_wait_event() condition, which is evaluated once with the socket lock released. smcd_buf_detach() clears conn->sndbuf_desc from smc_conn_kill() under lock_sock(), so a link group terminating while a socket waits leaves the helper dereferencing NULL, faulting out of close(). The fix samples the pointer once in the helper and reports nothing prepared while it is unset.

In the Linux kernel, the net/smc module's smc_switch_conns() takes a reference on the SMC socket before dropping lgr->conns_lock so the connection stays alive while the CDC slot is fetched. The err_out label only drops the wr_tx link reference, so this early exit returns without the matching sock_put(). A leaked sk_refcnt means the smc_sock is never destroyed, its buffers stay allocated, and the network namespace reference is never released, preventing netns teardown. The fix restructures so a single sock_put() covers both outcomes.

In the Linux kernel, the net/smc module's smc_rx_splice() hands RMB pages to a pipe and takes a socket reference per entry so the smc_sock stays alive until the reader finishes. The connection does not: a concurrent close runs smc_conn_free(), which releases the receive buffer back to the link group pool. smc_rx_pipe_buf_release() tests sk_state before taking the socket lock; the state can change between the test and the lock, and smc_rx_update_cons() then dereferences conn->rmb_desc and walks conn->lgr, which smc_conn_free() has already released — a use-after-free. The fix takes the socket lock first and tests conn->freed instead.

In the Linux kernel's net/smc subsystem, smc_conn_free() unregisters the connection only while the link group is still on its device list and never sets conn->killed. In the window between unlinking the group and killing its connections, the device can re-arm the receive tasklet after tasklet_kill() has returned, leading to a use-after-free.

In the Linux kernel, IP tunnel devices derive their advertised needed_headroom from lower output devices. A stack of user-created devices can make the derived value exceed the range representable by 16-bit skb header offsets, so once IP output reserves it, skb head expansion can wrap those offsets.

In the Linux kernel, skb_tx_error() completes the zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, while skb_zcopy_downgrade_managed() clears SKBFL_MANAGED_FRAG_REFS — both in skb_shinfo(), which every clone shares. With an Open vSwitch clone (OVS_ACTION_ATTR_RECIRC) this strips the marker from a packet still being forwarded and a later local ESP delivery decrypts in place over frags it does not own privately.

In the Linux kernel, a vulnerability exists in the mfd: qnap-mcu driver. The qnap_mcu_exec() function publishes an on-stack buffer (rx) to the receive path, which can write to it after a command timeout or write failure when the stack frame is no longer valid. This leads to stack memory corruption and potential arbitrary code execution.

In the Linux kernel, memory allocated for the sm501_devdata structure in sm501_pci_probe() and sm501_plat_probe() is not freed by the corresponding remove functions sm501_pci_remove() and sm501_plat_remove(). This causes a memory leak on each device removal.

The ALSA aloop driver in the Linux kernel blindly trusts the devptr->id value at probe, assuming it is within the proper card index range. When a device is bound manually via sysfs, this value can be -1 ("none"), leading to out-of-bounds access to index[] and other parameters.

The ALSA mpu401 driver in the Linux kernel blindly trusts the devptr->id value at probe, assuming it is within the proper card index range. When a device is bound manually via sysfs, this value can be -1 ("none"), leading to out-of-bounds access to index[] and other parameters.

The ALSA mts64 driver in the Linux kernel checks the devptr->id value but does not validate negative values, which are often passed as "none" when a device is bound via sysfs. This may lead to out-of-bounds access to index[] and other parameters.

The pcxhr_probe() function in the Linux kernel requests pcxhr_threaded_irq() before initializing mgr->lock, even though the threaded handler takes that mutex. An early interrupt can therefore run against uninitialized mutex state during probe.

The ALSA portman2x4 driver in the Linux kernel checks the devptr->id value but does not validate negative values, which are often passed as "none" when a device is bound via sysfs. This may lead to out-of-bounds access to index[] and other parameters.

In the Linux kernel, kset_replay() in dm-pcache has a use-after-free and invalid segment operations. When a key's seg_gen is stale, cache_key_put(key) frees the key memory but key->cache_pos.cache_seg is then accessed as an argument to cache_seg_get(). Additionally, for expired invalid keys, setting the cache->seg_map bit and calling cache_seg_get() is unreasonable.

In the Linux kernel, i3c_device_get_supported_xfer_mode() dereferences dev->desc without holding bus->lock, which is not allowed. The function only needs the master controller associated with the device's bus, so it should use dev->bus, which is always valid for the device's lifetime.

In the Linux kernel, adi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR before initializing the IBI state, transfer queue list, and transfer queue lock. A pending CMDR interrupt can run adi_i3c_master_irq() and take an uninitialized lock, as reported by Lockdep.

In the Linux kernel, i3c_master_unregister_i3c_devs() clears i3cdev->dev->desc before calling device_unregister(). During unregister, i3c_device_uevent() and a racing modalias_show() can observe a NULL desc and fall back to an uninitialized stack struct, leaking kernel stack contents. A use-after-free may also occur from writing desc after the device is released.

In the Linux kernel, svc_i3c_master_handle_ibi() reads the IBI payload from the RX FIFO into the slot, bounding the loop by the hardware FIFO size (SVC_I3C_FIFO_SIZE) rather than the slot size. A driver can request a smaller max_payload_len (e.g., mctp-i3c requests 1), so a device sending more bytes writes past slot->data, an out-of-bounds write into the IBI pool.

In the Linux kernel, the Renesas I3C driver uses an asynchronous model: it prepares a struct renesas_i3c_xfer, enqueues it, and waits for completion. If completion times out, the waiting thread dequeues and frees the transfer; a later interrupt may access freed memory, causing crashes.

In the Linux kernel, brcmf_sdio_read_control() does not free the memory allocated for buf in some error paths. The fix adds vfree() calls in those paths.

In the Linux kernel, iwl_op_mode_dvm_start() in the iwlwifi dvm driver: jumping to out_free_eeprom bypasses the out_free_eeprom_blob label. Consequently, error paths after successfully parsing the EEPROM free priv->nvm_data but leak priv->eeprom_blob. The fix reorders the error handling labels.

In the Linux kernel, the rtl8xxxu wifi driver has a use-after-free bug involving the rx_urb_wq workqueue. rtl8xxxu_stop() does not cancel rx_urb_wq, so a worker can run after rtl8xxxu_disconnect() frees the priv structure, causing a use-after-free. The issue occurs under active RX traffic followed by a disconnect.

In the Linux kernel, the fuse-io-uring transport copies req->in.h and req->out.h directly to/from userspace in fuse_uring_copy_to_ring() and fuse_uring_commit(). The headers live in the fuse_request slab object, whose cache lacks a usercopy whitelist, tripping CONFIG_HARDENED_USERCOPY and causing a kernel panic.

In the Linux kernel, the rtlwifi driver (rtl8192du) uses the QoS TID from the 802.11 header as an index into sta_entry->tids[] in rtl92du_tx_fill_desc(). Since ieee80211_get_tid() returns a value in the range 0..15 while the array only has MAX_TID_COUNT (9) entries, a TID greater than 8 indexes past the aggregation state array.

In the Linux kernel, the rtlwifi driver (rtl8192du) does not free memory allocated inside rtl92du_init_shared_data() in any of the subsequent error paths in rtl92du_init_sw_vars(). This leads to a memory leak.

In the Linux kernel, the rtw88 wifi driver's rtw_txq_push_skb() does not free the skb before returning on the error path, even though rtw_hci_tx_write() expects the skb to be freed on failure. This leads to a memory leak in rtw_txq_push().

In the Linux kernel, the rtw88 wifi driver (PCI) allocates PCI resources via rtw_pci_setup_resource() before setting up NAPI in rtw_pci_probe(). If rtw_pci_napi_init() fails, the error path skips rtw_pci_destroy(), leaving the allocated PCI resources behind.