Linux kernel vulnerabilities

In the Linux kernel, the FUSE filesystem publishes io-uring queues without release semantics, which can lead to data visibility inconsistencies for readers.

In the Linux kernel, the FUSE filesystem's abort_on_kill path does not wait for FR_FINISHED, which can lead to use-after-free during concurrent request processing.

In the Linux kernel, the FUSE filesystem has an invalidate lock leak on writeback failure in fuse_do_setattr(), which can block subsequent file operations.

In the Linux kernel, the FUSE filesystem leaks a write lock (rwsem) during an open with O_TRUNC for DAX files when fuse_dax_break_layouts() fails (e.g., -ERESTARTSYS). This causes later operations on the file to stall due to the unreleased lock.

In the Linux kernel, the USB gadget f_tcm driver has an issue where the port count (tpg_port_count) is decremented before LUN teardown completes, potentially leading to a race and use-after-free during session removal. An optional fabric_post_unlink() callback is added to keep the port count until core_dev_del_lun() finishes.

In the Linux kernel KVM subsystem for AMD SEV/SEV-ES on SNP-enabled hosts, the temporary buffer used for memory encryption/decryption operations was not allocated as a full 4KiB page. On SNP platforms, the page containing the buffer must be temporarily assigned to firmware, causing access by other kernel parts to trigger an RMP #PF fault, leading to a kernel panic.

A vulnerability in the Linux kernel's TLS device offload (tls_device.c) causes an out-of-bounds write in tls_append_frag(). When a TLS record remains open with a full fragment count and subsequent splice() calls with SPLICE_F_MORE add non-coalescing pages, the frags array is overrun, corrupting memory including a function pointer in destruct_work, which can lead to arbitrary code execution.

In the Linux kernel, the GTP module lacks serialization of PDP context updates, which can lead to double deletion of the same PDP context when GTP_CMD_DELPDP and RTM_DELLINK operations run concurrently. This results in a general protection fault and potential use-after-free.

A use-after-free vulnerability was found in the Linux kernel's tcp_ao_connect_init() function related to TCP-AO. A race between key validation and VRF membership change can lead to removal of the only key and subsequent direct freeing of tp->ao_info, while the receive path may still use the pointer. The issue was found during a static audit and confirmed by a reproducer triggering a KASAN report.

A use-after-free vulnerability was found in the Linux kernel's TCP-AO (TCP Authentication Option) module. The issue occurs during reconnection to another peer, where the current_key pointer may reference freed memory after call_rcu().

In the Linux kernel, the xfrm (ESP-in-TCP) module has a use-after-free (UAF) bug during close of espintcp sockets. espintcp_close() frees the skb without holding any socket lock, while the xfrm_trans_reinject work queue may still use the same skb. The fix adds synchronize_rcu() after resetting sk_prot.

In the Linux kernel, the TCP stack has an issue where route-derived advmss values can be smaller than 1, leading to a divide-by-zero in tcp_select_initial_window(). The fix introduces a tcp_dst_advmss() helper that clamps advmss to TCP_MIN_MSS.

In the Linux kernel, the xfrm (ESP-in-TCP) module has an issue with packets that have no ingress device. When the ingress device is removed, dev_get_by_index_rcu() returns NULL, leading to a NULL dereference in the XFRM input path. The fix drops such packets.

A deadlock vulnerability was found in the Linux kernel's xfrm NAT keepalive mechanism. The nat_keepalive_work() function walks the state table while holding xfrm_state_lock, then acquires x->lock in its callback, conflicting with the delete path that takes these locks in reverse order, causing an AB-BA deadlock. The fix splits the walk into two phases: first collect candidate states with references, then process them without nesting locks.

In the Linux kernel's AH6 (IPsec) subsystem, there is an out-of-bounds read vulnerability. The ipv6_rearrange_rthdr() function assumes that the segments_left field in the routing header does not exceed the number of addresses described by hdrlen. However, for raw IPv6 HDRINCL packets, a packet with hdrlen=2 (describing one address) and segments_left=255 can be sent, causing the address pointer to move 4064 bytes backwards and passing a 4064-byte length to memmove(), leading to out-of-bounds access. The fix adds validation of this invariant before modifying the header.

In the Linux kernel's xfrm_state_construct() function, there is a memory leak related to the authentication algorithm. The attach_auth_trunc() function can allocate memory for x->aalg but does not set x->props.aalgo when the selected algorithm has no sadb_alg_id (e.g., cmac(aes)). Then xfrm_state_construct() treats the zero value of x->props.aalgo as no algorithm and calls attach_auth(), which overwrites the x->aalg pointer and loses the original allocation. The fix checks whether x->aalg is already attached instead of inferring from x->props.aalgo.

A use-after-free vulnerability was found in the Linux kernel's bridge multicast code for master VLANs. During master VLAN deletion, the BR_VLFLAG_MCAST_ENABLED flag is not cleared under lock, allowing readers (bridge transmit path) to re-arm the multicast context after it has been deinitialized and freed, leading to access of freed memory.

In the Linux kernel, a vulnerability in the AF_PACKET subsystem related to TX_RING buffers has been fixed. The issue was that skb descriptors held a raw pointer to a ring frame, which could point to a no-longer-existing vmalloc mapping after pg_vec was freed. The fix defers the reference release until after timestamp and frame status writes, and adds an additional check before ring replacement.

In the Linux kernel's IPv6 Segment Routing (seg6) module, during IPIP decapsulation (End.DX4, End.DT4), the IPv4 control block (IPCB) is not cleared. This causes IPv4 to use stale IP6CB data, leading to an out-of-bounds read in __ip_options_echo() and potential memory corruption (KASAN: slab-out-of-bounds).

In the Linux kernel's batman-adv module, there is an out-of-bounds read vulnerability. The batadv_tvlv_call_handler() function sets the network_header and transport_header fields in the sk_buff structure based on a received multicast TVLV, without checking whether the end offset is representable in a 16-bit field. If the offset exceeds the range, skb_set_transport_header() truncates it, causing the transport header to precede the network header, and skb_network_header_len() returns a large u32 value. The batadv_mcast_forw_packet() function then accepts an oversized multicast tracker and accesses memory beyond the skb data. The fix adds the skb_set_transport_header_careful() function and rejects unrepresentable TVLVs.

In the Linux kernel's vxlan module, there is a vulnerability involving an invalid pointer during FDB flush operations. When a filtered bulk flush removes all remotes from an FDB entry, the last remote is unlinked in vxlan_fdb_dst_destroy() and only afterwards the parent FDB entry is destroyed. During this interval, an RCU reader can find the parent entry, and first_remote_rcu() applies list_entry_rcu() to the empty list head, producing an invalid remote pointer that the receive learning path can read from and write to. The fix leaves the last remote linked and asks the caller to destroy the entire FDB entry.

In the Linux kernel's netfilter/nf_tables subsystem, there is a race condition in queueing object notifications from the packet path. The nft_obj_notify() function, called from the packet path (e.g., via nft_quota_obj_eval), adds notifications to the notify_list without proper locking, which can lead to a use-after-free of sk_buff. The issue appeared after commit 67cc570edaa0, which changed how notifications are sent.

In the Linux kernel's crypto virtio module, there is an out-of-bounds read vulnerability. The virtio_crypto_dataq_akcipher_callback() function sets the result length from the device-reported response length without bounding it to the destination buffer, which was allocated for the original request length. sg_copy_from_buffer() then reads that many bytes from the destination buffer; a backend reporting a larger length over-reads adjacent kernel heap into the caller's scatterlist (an out-of-bounds read). The fix clamps the reported length to the originally requested destination length.

In the Linux kernel, the crypto_rng interface was removed from the qcom-rng driver because it was redundant and buggy. The driver exposed the same hardware through two separate interfaces, which could lead to concurrent register access and generation of incorrect random values. The hwrng interface remains active and is the one that matters.

In the Linux kernel, the crypto_rng interface was removed from the sun8i-ce driver because it was unused and redundant. The driver had a use-after-free vulnerability in its ->generate() function due to improper handling of DMA operation shutdown. hwrng support remains intact.

In the Linux kernel, the crypto_rng interface was removed from the sun8i-ss driver because it was unused and redundant. The driver had a use-after-free vulnerability in its ->generate() function and a buffer overread bug in the line memcpy(ctx->seed, d + dlen, ctx->slen). hwrng support remains.

In the Linux kernel, the crypto: qce driver has an AAD buffer underallocation bug in qce_aead_ccm_prepare_buf_assoclen(). The buffer can be smaller than the length later programmed into the DMA scatterlist, leading to out-of-bounds read by QCE hardware during CBC-MAC computation. The fix adds the maximum AAD header length before alignment.

In the Linux kernel, the crypto: mxs-dcp driver's mxs_dcp_aes_block_crypt() uses sg_dma_len() without mapping the source scatterlist with dma_map_sg() first. This can lead to incorrect data length during encryption/decryption when CONFIG_NEED_SG_DMA_LENGTH=y. The fix uses the original scatterlist length.

In the Linux kernel, a spin lock was added to usb_wakeup_notification() to prevent a race condition with dereferencing freed memory. The issue could occur when the xHCI driver called this function from an IRQ, racing with hub_disconnect().

In the Linux kernel, the ALSA: usb-audio driver has an out-of-bounds write vulnerability in snd_usbmidi_novation_output(). A malicious USB device can advertise wMaxPacketSize=1, leading to a negative transfer length and writing beyond the buffer. The fix adds a check that the endpoint can hold the header plus at least one payload byte.

In the Linux kernel, a vulnerability in the ALSA usb-audio driver involves incomplete cleanup after a system-resume error. A failed resume can leave the sound card unusable until reboot, and the suspended-interface counter becomes inconsistent, affecting subsequent suspend/resume cycles.

In the Linux kernel, the USB: serial: option driver has a slab out-of-bounds read vulnerability in the interrupt URB callback. The interrupt buffer is allocated based on wMaxPacketSize, and when a device sends a short packet, the code reads beyond the allocated buffer. The fix adds missing bounds checks before accessing data.

In the Linux kernel, the USB: c67x00 driver has a use-after-free vulnerability in c67x00_add_iso_urb(). When TD creation fails for the last packet of an isochronous URB, the URB is given back before updating the endpoint scheduling state, leading to access to freed memory. The fix updates next_frame and cnt before giving back the URB.

In the Linux kernel, a vulnerability in the mt76 driver for mt7925 chipsets fails to ensure adequate headroom in USB/SDIO transmit buffers. Forwarded frames from a wired interface to an mt7925u AP can trigger a kernel panic (skb_under_panic) due to insufficient headroom. The issue affects the transmit path for forwarded frames that do not reserve the required headroom.

A use-after-free vulnerability was found in the Linux kernel's usbfs driver (usbdev_release). The function drops its reference to the usb_device structure before draining the list of completed URBs, which after a disconnect leads to reading freed memory. The issue is reachable by an unprivileged process with access to /dev/bus/usb.

In the Linux kernel's st21nfca NFC driver, the declared length of an ATR_REQ frame was not validated against the actual received length. A nearby attacker can send a short frame with an inflated length, causing an out-of-bounds read that may disclose kernel memory or lead to a denial of service.

In the Linux kernel's mchp-ipc-sbi mailbox driver, a missing null check for devm_kasprintf() could lead to a null pointer dereference if memory allocation fails.

In the Linux kernel's NVMe PCIe endpoint subsystem (nvmet pci-epf), a missing CQ reference release on PCI mapping failure leads to memory and controller reference leaks. A remote PCI host can repeatedly trigger this, exhausting resources.

A vulnerability was found in the Linux kernel's Bluetooth RFCOMM subsystem. The rfcomm_sock_recvmsg() function calls rfcomm_dlc_accept() without holding the rfcomm_mutex lock, which can lead to a NULL pointer dereference when a remote peer sends a DISC frame for a deferred setup connection (BT_DEFER_SETUP). The issue is fixed by taking rfcomm_mutex around rfcomm_dlc_accept() and re-checking the session.

In the Linux kernel, the iommu/tegra241-cmdqv driver has a use-after-free vulnerability during teardown. The CMDQ queue is freed before arm_smmu_impl_remove() runs, which then attempts to issue a CMD_SYNC on the freed memory, potentially causing a system crash.

A vulnerability in the Linux kernel's iommu/iommufd subsystem causes a NULL pointer dereference in iommufd_ioas_change_process when racing with iopt_map_file_pages. The issue arises from a window between IOAS area creation and pages pointer assignment, leading to a kernel crash.

In the Linux kernel's ALSA FCP (USB) driver, a shared URB intended for another endpoint was used, leading to initialization errors and potential crashes. A separate URB and proper synchronization initialization were added.

In the Linux kernel, the ALSA driver for 2nd-generation Focusrite Scarlett devices has a vulnerability where a shared URB is used for the notification endpoint, causing initialization to be skipped and cmd_done to remain zeroed. This can lead to a crash in wait_for_completion_timeout() during the init sequence.

In the Linux kernel, the rndis_host driver lacks an overflow check in rndis_rx_fixup(). This can allow an out-of-bounds read of the USB data buffer.

In the Linux kernel, the nvmet subsystem's nvmet_execute_identify_nslist() function dereferences a NULL pointer when handling an Identify command with CNS 07h. This occurs because req->ns is not set and then used for comparison.

In the Linux kernel, the ALSA dummy driver's snd_dummy_probe() does not validate the card index value. If the device is bound manually via sysfs, the index can be -1, leading to out-of-bounds array access.

In the Linux kernel's io_uring/rsrc subsystem, a vulnerability was found in io_vec_fill_bvec() due to an integer overflow when calculating folio size. Using a plain int instead of unsigned long for bit shifting leads to undefined behavior for folio shifts of 32 or more, causing out-of-bounds writes. The issue mainly affects systems with gigantic hugetlb pages (e.g., 16G on arm64).

In the Linux kernel, the OCFS2 filesystem lacks metadata reservation for large extended attributes (xattrs). This can lead to a kernel panic during lsetxattr() on a fragmented filesystem when the file already has an external xattr block.

In the Linux kernel, the ext4 filesystem has a vulnerability causing an infinite retry loop in ext4_xattr_block_set() when selecting a cached extended attribute entry. A corrupted filesystem can cause an entry with a saturated reference count to be selected repeatedly, leading to a task hang and blocking rmdir operations on the parent directory.

In the Linux kernel, the nilfs2 filesystem lacks range validation of parameters in the nilfs_vdesc structure used by the GC ioctl. This can lead to inserting a page with index ULONG_MAX into the page cache, causing list corruption and a crash.