Linux kernel vulnerabilities

In the Linux kernel, the synaptics-rmi4 driver has a typo that incorrectly assigns the transmitter (TX) electrode count to the receiver (RX) value. This leads to incorrect diagnostic report size and potential out-of-bounds buffer access.

In the Linux kernel, in the ovpn driver, there is a security issue related to running deferred work on global system workqueues. Work may be executed after the module text is freed, leading to use-after-free. The fix adds a module-owned workqueue and flushes it before module destruction.

In the Linux kernel, the psxpad-spi driver has a NULL pointer dereference vulnerability. The psxpad_spi_suspend() function retrieves driver data, but it is not stored during probe, leading to a crash during system suspend.

In the Linux kernel, in the MediaTek pmdomain driver (mtk_mfg), the variable prev_o is uninitialized in mtk_mfg_attach_dev(). On the first loop iteration it is read before assignment, potentially dereferencing a stale or invalid pointer, causing faults or incorrectly skipping the first OPP.

In the Linux kernel's pmdomain subsystem for MediaTek, there is an issue with use of a pointer to a freed device-tree node in error paths. The function scpsys_get_bus_protection_legacy() releases the node before checking the regmap lookup result, then uses it in the error message, potentially leading to dereferencing freed memory.

In the Linux kernel's DRM driver for HDMI connectors, there is an out-of-bounds memory read issue. A helper function copies an audio infoframe into the connector's copy using the destination size (60 bytes) instead of the source size (28 bytes), causing a read beyond the allocated buffer.

In the Linux kernel's MMC driver for Loongson chips, there is an issue with scatterlist iteration in data reorder functions. The for_each_sg() macro already iterates over entries, but the code uses '&sg[i]' and 'sg_dma_len(&sg[i])', leading to access of wrong entries or out-of-bounds reads.

In the Linux kernel's drm/amdkfd driver, the CRAT parser does not validate that the advertised subtype length fits within the image. A malformed CRAT table with an oversized length field causes out-of-bounds reads during parsing.

In the Linux kernel's Qualcomm clock driver (dispcc-eliza), there is a clock reparenting issue when display is disabled, causing warnings and incorrect clock configuration on Eliza EVK.

In the Linux kernel's FP9931 regulator driver, there is an issue with the VPOS/VNEG voltage selector table. The VPOSNEG_table[] does not match the datasheet: it has an extra 7.04V entry (shifting all subsequent) and only 41 entries instead of 64, causing out-of-bounds access for selectors above 0x28.

In the Linux kernel netfilter nf_tables_offload module, the nft_flow_rule_offload_abort() function triggers WARN_ON_ONCE(err) for every error during rollback, including -ENOMEM. Memory allocation failures are expected under low-memory conditions and do not indicate a kernel bug. The fix changes the condition to WARN_ON_ONCE(err && err != -ENOMEM) so warnings are only emitted for unexpected errors.

In the Linux kernel, the ASoC Xilinx formatter_pcm driver has a NULL pointer dereference vulnerability. Interrupt handlers retrieve driver data via dev_get_drvdata(), but the data is set only after interrupt registration, which can lead to a crash.

In the Linux kernel, af_packet has a vulnerability that allows sending zero-byte packets via tpacket_snd(). This triggers a warning in __dev_queue_xmit() and potentially a system crash.

In the Linux kernel's drm_log_draw_kmsg_record() function, there is an out-of-bounds read when the message length is 0. The function accesses s[len - 1], where len is unsigned int, causing a wrap to UINT_MAX when len=0, leading to an out-of-bounds read.

In the Linux kernel, in the drm/log driver, there is an infinite loop when the scale is too large for the display, causing rows or columns to become 0. The loop in drm_log_draw_kmsg_record() never decrements len when columns is 0. A check for zero rows/columns was added in drm_log_setup_modeset() to return an error and clean up the allocated buffer to avoid a leak.

In the Linux kernel, a vulnerability in the mlx5e driver (for Mellanox/NVIDIA network cards) leads to a deadlock (AA deadlock). The issue occurs when an FDB flow addition in TC fails at lower levels, and then flow deletion (mlx5e_tc_del_flow) tries to acquire the devcom lock again, which is already held for peer flows. This causes recursive locking (lockdep: possible recursive locking detected).

In the Linux kernel's bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie functions, there is an issue with missing validation of socket state before accessing sk_protocol. These functions may receive a pointer to a mini-socket that lacks full socket fields, potentially leading to dereferencing invalid memory.

In the Linux kernel, in the amba-pl011 serial driver, there is a synchronization issue during DMA teardown. dmaengine_terminate_all() does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port lock. The fix switches to dmaengine_terminate_sync() and deletes the RX timer before freeing the buffers.

In the Linux kernel's Thunderbolt subsystem, there is an issue with indexing the bandwidth reservation array. The function tb_consumed_dp_bandwidth() uses the group ID (from 1 to MAX_GROUPS) as an index into the group_reserved[] array, which has only MAX_GROUPS entries, causing an out-of-bounds read for group MAX_GROUPS and omitting it from the sum.

In the Linux kernel, in the ovpn driver, there is a security issue with dereferencing sk_user_data. Some subsystems, like BPF SOCKMAP, set sk_user_data without setting encap_type. It is necessary to ensure the type is the one ovpn expects before dereferencing to avoid out-of-bounds reads.

In the Linux kernel, a vulnerability in the btrfs filesystem involves improper initialization of mapping flags and minimal folio order for cached inodes. Under specific conditions (e.g., 8K block size with 4K page size), this can lead to assertion failures and kernel panics.

In the Linux kernel, the sk_mc_loop() function triggers WARN_ON_ONCE(1) for sockets that are neither AF_INET nor AF_INET6, e.g., AF_PACKET sockets when sending packets via raw/packet socket over virtual devices such as VRF or ipvlan. Non-INET sockets do not support IP_MULTICAST_LOOP or IPV6_MULTICAST_LOOP options, so loopback should default to true without generating a warning. The fix removes this warning.

In the Linux kernel, in the ata: pata_sl82c105 driver, there is a use-after-free when reading the bridge revision. pci_get_slot() returns a referenced PCI device, but after the change to direct access to the revision field, the read occurs after pci_dev_put(), which may lead to use of freed memory. The fix moves the revision read before dropping the reference.

A vulnerability was found in the Linux kernel's dev_validate_header() function in the networking stack. For processes with CAP_SYS_RAWIO capability, it zero-padded short link-layer headers by reading dev->hard_header_len directly. If the device was reconfigured and this value increased in the meantime, the zeroing write went beyond the allocated buffer, causing an out-of-bounds write.

In the Linux kernel, in the ring-buffer test, there is a bug causing a crash when passing ERR_PTR to kthread_stop(). The cleanup loop in test_ringbuffer() only checks for NULL values, not ERR_PTR, leading to dereferencing a bogus pointer and kernel panic during init test. The fix likely involves proper handling of ERR_PTR.

In the Linux kernel's mm/huge_memory, during folio split, the workingset state is not initialized, causing the xa_node to be unlinked from the shadow_nodes list. This can trigger VM_WARN_ON during memory reclaim.

In the Linux kernel, in the drm/amdgpu driver, a previous fix for aperture mapping leak was reverted. The previous fix caused a page fault in vcn_v4_0_sw_fini because devres teardown is LIFO and the aperture was unmapped before the DRM device release. The revert restores previous behavior.

In the Linux kernel's x86 MCE subsystem, there is an issue with timer initialization before CMCI discovery. During CMCI storm detection, the timer is modified before it is properly set up, leading to ODEBUG warnings and potential issues.

The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.

A vulnerability in the I3C IBI subsystem of the Linux kernel (drivers/i3c/i3c_ibi_workq.c) stems from missing synchronization on the free-list of work nodes (sys_slist_t). Allocation and deallocation helpers are called from interrupt context (ISR) and the workqueue thread without locks, leading to a race condition. An attacker with physical access to the I3C bus can trigger a series of interrupts, causing list corruption, double allocation, or out-of-bounds writes.

In the Linux kernel, a vulnerability in ptp: vmclock was fixed that allowed read-only mappings to become writable. The vmclock_miscdev_mmap() function rejected writable mappings of the shared vmclock ABI page with -EROFS, but left VM_MAYWRITE set. Userspace could map the page read-only and then upgrade it to writable with mprotect(), allowing the guest to corrupt host-written timekeeping data (sequence counter, UTC time, TSC offset) that the vmclock ABI defines as read-only. The fix clears VM_MAYWRITE on the read-only path so the mapping cannot be upgraded.

In the Linux kernel, a vulnerability in of: reserved_mem was fixed that caused an out-of-bounds write when too many dynamic regions are defined. On boot, fdt_scan_reserved_mem() saves each dynamically-placed /reserved-memory subnode into a local array of size MAX_RESERVED_REGIONS. If the device tree defines more than MAX_RESERVED_REGIONS dynamically-placed regions, the function writes past the end of the local array. The fix adds a bounds check that logs an error and skips the excess regions, restoring the original behavior.

In the Linux kernel, a vulnerability in wifi: mac80211 was fixed regarding validation of individual TWT parameters before driver setup. ieee80211_process_rx_twt_action() only partially validates a received S1G TWT setup frame before queueing it. An individual agreement can therefore reach ieee80211_s1g_rx_twt_setup() with twt->length too short for the full struct ieee80211_twt_params. The individual path passes twt to drv_add_twt_setup(). Both the tracepoint and the driver callback consume the complete parameters block, not merely req_type. The fix does not pass a short individual agreement to the driver. Broadcast agreements remain unchanged because they are rejected locally after accessing only req_type.

In the Linux kernel, a vulnerability in Bluetooth: ISO was fixed regarding dangling hcon references in iso_conn. After iso_conn_del(), ISO sockets should not dereference the hcon anymore. Currently, clearing iso_conn::hcon relies on iso_conn_del() releasing the last reference to the iso_conn. The fix simplifies this by explicitly clearing conn->hcon in iso_conn_del(), to avoid more complex reasoning on races about who holds the last reference.

In the Linux kernel, a vulnerability in iomap was fixed that caused a deadlock. iomap_split_ioend can split bios that already come from iomap_ioend_bioset and thus deadlock when the bioset is exhausted. The fix adds a separate bio_set to avoid this deadlock. Additionally, iomap_ioend_split_bioset is marked static as it is only used in ioend.c, fixing the sparse warning reported by the kernel test robot.

A vulnerability in the Linux kernel's MGLRU (Multi-Gen LRU) mechanism causes stale batch updates after memcg reparenting. A race between the page table walker and the memcg reparenting path can lead to underestimated nr_pages, potentially causing premature OOM.

In the Linux kernel, a vulnerability in mm/percpu-km was fixed that caused bitmap overflow and accounting issues in pcpu_create_chunk(). In pcpu_create_chunk(), nr_pages is the total contiguous backing allocation, i.e., nr_units * pcpu_unit_pages, but pcpu_chunk_populated() uses it to set chunk->populated, whose size is pcpu_unit_pages bitmap. Since bit N in chunk->populated means page offset N inside every unit is backed, when nr_units > 1, the function writes beyond chunk->populated. The fix uses chunk->nr_pages. It also fixes the global pcpu_nr_empty_pop_pages accounting, since pcpu_balance_free() only iterates up to chunk->nr_pages. The issue was introduced by commit a63d4ac4ab609, and later commit b539b87fed37f added pcpu_nr_empty_pop_pages and caused the accounting issue.

In the Linux kernel, the SCTP Adaptation Indication parameter length was not properly validated. A header-only parameter was accepted, leading to an out-of-bounds read and potential disclosure of four receive-buffer tail bytes.

In the Linux kernel's ALSA PCM subsystem, there is an issue with waking linked drain waiters on unlink. This can lead to use-after-free of a stack frame during a later wake-up.

In the Linux kernel's igc driver, there is an issue with napi_synchronize() in igc_down() that can cause the network interface to hang during shutdown when AF_XDP zero-copy is used.

In the Linux kernel's io_uring, there is an issue with preserving per-task restrictions across exec. These restrictions are dropped during task context cleanup, allowing an unrestricted ring to be created after exec.

A vulnerability in the Linux kernel's SPI-NAND driver for Qualcomm chips (spi-qpic-snand) was found. The SET_FEATURE value was written to the register after command execution, causing a one-operation delay. As a result, the chip remained in OTP mode, making the flash memory unusable and the device unbootable.

In the Linux kernel's max17040 driver, there is an issue with handling a missing status supplier. When no supplier is registered, the function returns success but the status value remains uninitialized, potentially leading to reading invalid data by userspace.

In the Linux kernel's dasd driver, there is an issue with an undersized format-check buffer. The fmt_buffer_size variable is declared as int, causing truncation of the computed size and potentially leading to out-of-bounds write.

In the Linux kernel's zcrypt driver, there is an issue with incorrect domain value verification for EP11 CPRBs. The wrong upper limit can lead to heap memory access beyond perms->adm when an administrative CPRB is sent.

In the Linux kernel's zcrypt driver, there is an issue with missing memory scrub at clear key import in cca_clr2cipherkey(). The internal buffer may contain sensitive data that could be exposed via memory reuse.

In the Linux kernel, the CAN J1939 function j1939_session_fresh_new() did not zero the buffer before use, potentially leaving residual data. The fix zeroes the allocated buffer to prevent potential information leakage.

In the Linux kernel, the CAN softing driver's fw_parse() function did not validate that firmware records fit within the firmware image, potentially leading to out-of-bounds reads. Additionally, bounds calculations for DPRAM writes were prone to integer overflow, and the application loader's data copy was not properly bounded.

In the Linux kernel, the AMD Display driver (drm/amd/display) lacked a check for successful allocation of the phantom plane in dml21_add_phantom_plane(), which could lead to a segmentation fault later.

In the Linux kernel, the AMD Display driver (drm/amd/display) function get_ss_info_from_atombios() used an uninitialized context for logging, leading to NULL pointer dereference during DC_LOG_SYNC() calls. Similar issues exist in dce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers(). The fix changes the logging context to use the one from the clock source base.