Linux kernel vulnerabilities

In the Linux kernel, the ext4 filesystem may enable DAX on new encrypted files, causing data written to the file to bypass encryption. This occurs because the EXT4_INODE_ENCRYPT flag is set too late.

In the Linux kernel XFS filesystem, the attribute entry verification function accesses fields before checking whether the entry pointer is within buffer bounds. This can lead to an out-of-bounds read if the nameidx field points near the end of the buffer. Explicit bounds checks for entry pointers have been added before accessing their fields.

In the Linux kernel XFS filesystem, when __xfs_trans_commit() fails in xfs_trans_roll(), the NOFS context is cleared but only restored in the success path. This leaves the error path without nofs protection, causing a circular lock dependency between xfs_nondir_ilock_class and fs_reclaim. The fix moves xfs_trans_set_context() before the error check so that nofs context is always restored on the new transaction.

In the Linux kernel NFC subsystem, the digital_in_recv_sensf_res() function copies data from an NFC-F device response into a fixed-size buffer without checking the upper bound of the length. A malicious nearby NFC-F device can send an oversized SENSF_RES response to overflow the stack buffer. The fix clamps the response length to the maximum allowed size before copying.

In the Linux kernel NFC subsystem for FDP (NXP) controllers, the fdp_nci_i2c_read() function takes the next packet length from two device-supplied bytes and never validates it. This can lead to a stack out-of-bounds write or an skb leak in case of a faulty device. The fix rejects lengths outside the allowed range and frees a previously allocated skb before allocating the next.

In the Linux kernel NFC subsystem for the Microread reader, the microread_target_discovered() function parses target discovery data but does not check whether the skb data length is sufficient for the fields being read. This can lead to out-of-bounds reads or copying data from beyond the buffer. The fix adds length validation for each data type before reading or copying.

A vulnerability was found in the Linux kernel's nfc_llcp_connect_sn() TLV parser in the NFC LLCP subsystem. The parser fails to check buffer boundaries when reading TLV headers and values, leading to out-of-bounds reads or infinite loops due to length underflow for short frames. The issue is remotely reachable by a nearby NFC device without authentication.

The TLV parsers in NFC LLCP (nfc_llcp_parse_gb_tlv and nfc_llcp_parse_connection_tlv) have three bugs: an u8 offset wraps after 255, missing bounds checks before reading the TLV header and data, leading to out-of-bounds reads. These functions are reachable without authentication via nfc_llcp_set_remote_gb.

The NFC LLCP receive path did not check that a frame is at least the LLCP header size before parsing. Short frames cause the size calculation to wrap, leading to out-of-bounds reads. This is reachable without authentication from a nearby NFC device.

In the pn533 NFC driver, the cleanup path did not purge fragment_skb, leading to memory leaks when the device is removed while fragments are still queued.

The NCI activation parameter extractors (nci_extract_activation_params_iso_dep and nci_extract_activation_params_nfc_dep) lack length checks before memcpy, allowing a crafted notification to cause a slab out-of-bounds read.

In the Linux kernel's NFC (NCI) subsystem, a vulnerability was found involving an out-of-bounds write in the nci_target_auto_activated() function. This function adds a target to a fixed-size array without checking if the array is full, which can lead to a write beyond the allocated memory region (slab out-of-bounds).

In the NCI RF discover and activated NTF handlers, on-stack structures are not initialized, and when the technology-specific parameter length is zero, uninitialized data is passed to nci_add_new_protocol, leading to an uninit-value read.

In ip_do_fragment(), undersized MTUs were not rejected, causing fragmentation to loop and eventually trigger a softlockup. The issue occurs when the effective MTU is smaller than hlen + 8.

In ip6_finish_output2(), a pointer to the IPv6 destination address is cached before invoking lwtunnel_xmit(), which can reallocate the skb head and free the memory. After LWTUNNEL_XMIT_CONTINUE, the stale pointer is used, leading to a use-after-free.

In nvmet_execute_auth_receive(), the response buffer is allocated with kmalloc() and not zeroed, and only part of it is filled by DH-HMAC-CHAP. Uninitialized data is sent to the initiator during the pre-authentication handshake.

In nvmet_fc_alloc_ls_iodlist(), the error unwind loop decrements iod past the start of the array, and the final kfree(iod) frees an invalid address, leading to an invalid free.

In the Linux kernel's NVMe-over-TCP subsystem (nvmet-tcp), a vulnerability allows unbounded kernel memory allocation. An attacker can send a crafted write command with an oversized SGL length (up to 4 GiB) that is not properly validated before buffer allocation, leading to uncontrolled memory consumption.

In the Linux kernel's nvmet-tcp subsystem, a vulnerability allows a remote initiator to control the size of SGL allocations, triggering a kernel warning (WARN_ON_ONCE_GFP) for very large allocations. The issue is fixed by adding GFP_NOWARN to the allocation flags to avoid kernel panic on systems with panic-on-warn enabled.

In the Linux kernel, a use-after-free vulnerability was found in the NVMe over Fabrics (nvmet) subsystem for PCIe Endpoint controllers (pci-epf). The function nvmet_pci_epf_exec_iod_work() reads iod->data_len and iod->dma_dir after calling req->execute(), but for commands without device-to-host data transfer, the iod can be freed asynchronously on another CPU before those fields are read, leading to a use-after-free.

In the Linux kernel's fbdev subsystem, a lack of consistency in handling display mode changes was found. Some call paths (e.g., via sysfs) did not update fbcon state, potentially leading to incorrect console behavior. A helper function fb_set_var_from_user() was introduced to centralize mode change handling, including fbcon updates.

In the Linux kernel's fbdev subsystem, a lack of synchronization when accessing the modelist and current mode in sysfs operations was found. Concurrent read/write could lead to use-after-free or storing a freed pointer. The fix adds lock_fb_info() locking in show_mode(), show_modes(), and store_mode().

In the Linux kernel's HID magicmouse driver, a vulnerability allows unbounded recursion in magicmouse_raw_event(). A malicious HID device can send a report with the sequence [0xf7, 0x00], causing thousands of nested calls and kernel stack overflow. The fix bounds recursion depth to two levels.

In the Linux kernel's HID magicmouse driver, a use-after-free vulnerability was found. If input device registration fails, the msc->input pointer remains non-NULL, leading to dereferencing freed memory on subsequent reports. The fix clears the pointer when no input device is claimed.

In the Linux kernel HID subsystem, a vulnerability was found involving an out-of-bounds read in hid_set_field(). The issue arises because hid_dump_input() is called before the offset bounds check, which with CONFIG_DEBUG_FS enabled can lead to reading beyond the allocated usage[] array. The bug was reported by XBOW and affects e.g. the picolcd driver.

In the Linux kernel, the HID PIDFF driver (hid_pidff) has a vulnerability involving an out-of-bounds write when the hid->inputs list is empty. The function hid_pidff_init_with_quirks() derives a pointer to hid_input without checking if the list is empty, leading to a type-confused pointer and writes past the end of the object. An attacker can trigger the vulnerability by plugging in a malicious USB device, with no user interaction or logged-in user required.

In the Linux kernel, the net/ionic driver has a vulnerability involving an out-of-bounds read when looking up the TX partner for the dedicated hardware timestamp RX queue. This queue has an index equal to the number of regular queue pairs, causing a read past the txqcqs array and a write through the derived pointer. The fix avoids pairing this queue and makes the XDP_TX path abort cleanly if no TX partner exists.

In the Linux kernel's futex/pi mechanism, there is a vulnerability where a private futex owner from a different address space is accepted. The private futex key borrows the waiter's mm without taking an mm_users reference, and attach_to_pi_owner() copies the key into the owner's PI state. When the owner exits, a use-after-free can occur if the waiter's mm is freed concurrently. The fix adds validation that for private futexes, the owner's mm and waiter's mm are the same.

In the Linux kernel's futex/pi mechanism, there is a race condition during exec() for private futexes. There is a window between setting exit_state to OK and changing the mm pointer where the mm check is incorrect, potentially leading to use-after-free. The fix sets exit_state to FUTEX_STATE_DEAD in futex_exec_release() and only sets it to FUTEX_STATE_OK after the mm switch.

A race condition was found in the Linux kernel during the initial allocation of mm->futex.phash.ref. In certain nested vfork scenarios, two processes sharing the same address space can concurrently allocate and overwrite this counter, leading to a use-after-free in futex_q_lock().

In the Linux kernel's HID driver for ASUS devices, there is a missing hid_is_usb() check before using to_usb_interface(). This can lead to invalid memory access when the HID device does not have a real USB parent, potentially causing a kernel splat. The fix adds the appropriate check.

In the Linux kernel's HID driver for Huawei devices, there is a missing hid_is_usb() check before using to_usb_interface(). This can lead to invalid memory access when the HID device does not have a real USB parent, potentially causing a kernel splat. The fix adds the appropriate check.

In the Linux kernel's HID driver for Nintendo devices, there is an out-of-bounds read vulnerability in joycon_ctlr_read_handler(). The function casts an incoming HID report to struct joycon_input_report, guarding only with a 12-byte length check, while the structure is 49 bytes. For an IMU report of exactly 12 bytes, it can read past the declared length, and the data is forwarded to userspace, leaking driver-internal memory. The fix applies the full structure size check.

In the Linux kernel's HID driver for Nintendo devices, there is a vulnerability where the input device is registered before all capabilities are set. input_register_device() exposes the device to userspace immediately, and calling it before configuring FF_RUMBLE can lead to NULL dereference on concurrent EVIOCSFF. The fix moves registration to the end of joycon_input_create(), after all capabilities are configured.

In the Linux kernel's HID driver for Nintendo devices, there is a use-after-free vulnerability during failed probe. nintendo_hid_probe() calls hid_device_io_start() before joycon_init() and joycon_leds_create(). If either fails, the error path calls hid_hw_close()/hid_hw_stop() without first calling hid_device_io_stop(), allowing HID reports to still be processed and access driver data being torn down. The fix adds an err_io_stop label that calls hid_device_io_stop() before hid_hw_close().

In the Linux kernel, the HID rapoo driver lacked a hid_is_usb() check before using to_usb_interface(). uhid devices can be identified as USB but not have a USB parent, leading to a kernel crash.

In the Linux kernel, the HID ft260 driver has a stack-use-after-return write during I2C read operations. A race between the read path and ft260_raw_event() can lead to a write to freed stack memory.

In the Linux kernel, the HID sensor custom driver has a use-after-free vulnerability in enable_sensor. Field attributes are created after exposing the enable_sensor sysfs attribute, and on removal enable_sensor is deleted after freeing the field attributes.

A use-after-free vulnerability was found in the Linux kernel's uclogic HID driver. The issue involves the inrange_timer which can be re-armed after cancellation during device removal, leading to a dereference of freed memory when the timer expires.

In the Linux kernel, the HID hyperv driver lacks bounds validation for initial device info. A malicious Hyper-V host or backend can send a short message with an oversized report descriptor length, leading to an out-of-bounds read past the VMBus packet.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth subsystem (hci_event). The hci_cc_reset() function clears the LE accept and resolving lists without holding hdev->lock, allowing a concurrent debugfs read to access freed memory. KASAN reported the issue as slab-use-after-free in white_list_show.

In the Linux kernel, the Bluetooth hci_event handler lacks validation of the LE Set CIG Parameters response. The function hci_cc_le_set_cig_params() trusts the num_handles value and reads entries from the array without checking that the response contains enough data.

A use-after-free vulnerability was found in the Linux kernel's Bluetooth subsystem (hci_sync) during system suspend. The issue stems from improper synchronization of access to the accept list, potentially leading to a reference to freed memory.

In the Linux kernel, the Bluetooth ISO function iso_sock_getname() does not zero the sockaddr structure before returning it to user space, leaking uninitialized bytes from the kernel stack.

In the Linux kernel, the Bluetooth MGMT handler lacks an upper bound for params_len in HCI_CMD_SYNC. params_len can exceed 255, leading to a mismatch with the plen field in the HCI header and potentially causing the controller to interpret trailing bytes as the start of the next packet.

In the Linux kernel, the Bluetooth hci_aml driver's aml_download_firmware() function reads two lengths from the firmware header and uses them to build pointers before checking that the header and segment data are present. A truncated or inconsistent firmware image can cause the driver to read past firmware->data while constructing TCI commands. The fix rejects images shorter than the header and ensures that the ICCM and DCCM ranges fit within the loaded firmware.

In the Linux kernel, the futex mechanism has a use-after-free vulnerability in futex_private_hash_put(). This function drops the reference to fph before reading fph->mm for wake_up_var(). If that put drops the final reference and the task is preempted, another task can pivot to the replacement hash and free the old hash after an RCU grace period, and the first task reads from freed memory. The fix loads the mm pointer while the fph reference is still held and passes the saved value to wake_up_var().

In the Linux kernel, SELinux has a vulnerability involving an out-of-bounds heap write. A class that inherits permissions from a common block can have a smaller permission count than inherited, leading to a write past the allocated array during policy load.

In the Linux kernel, SELinux has a NULL pointer dereference vulnerability. On the first policy load, if building the selinuxfs tree fails, selinux_policy_cancel() is called and tries to access a non-existent old policy, causing a system crash.

In the Linux kernel, in the SELinux module, there is a vulnerability due to not rejecting a permission value exceeding the class permission count. perm_read() bounds the value by SEL_VEC_MAX but not by nprim of the class, leading to an out-of-bounds heap write in security_get_permissions(). The fix rejects permissions whose value exceeds nprim.