Linux kernel vulnerabilities

In the Linux kernel's drm/shmem_helper driver, the ->huge_fault handler did not check if the PMD mapping exceeds VMA boundaries, potentially leading to VM_BUG_ON_VMA() in copy_pmd_range(). The fix adds VMA boundary checks before installing the mapping.

In the Linux kernel's ASoC SOF ipc4-pcm driver, IPC errors for pipeline state change are ignored if the firmware is crashed or IPC timed out. The fix allows continuing with state changes to reset the kernel's internal state.

In the Linux kernel's fbdev driver, mode_string() uses snprintf() which can return a value larger than the remaining buffer space, causing the offset to advance past the sysfs buffer. The fix adds a size parameter and uses scnprintf(), plus an early return when offset exceeds the buffer.

In the Linux kernel's fbdev driver, fb_set_var() can delete a mode from the modelist, but does not check if fb_info->mode points to the deleted entry, leading to a stale pointer dereference on sysfs read. The fix clears fb_info->mode before deleting the mode.

In the Linux kernel's fbdev driver in fb_io_read(), a partial copy_to_user() causes desynchronization of the hardware pointer, leading to out-of-bounds reads. The fix breaks out of the loop immediately upon a partial copy.

In the Linux kernel amdgpu driver, there was no limit on the IB buffer size for GFX rings, which could corrupt adjacent control bits and destabilize command submission. A per-ring IB packet size limit was added and oversized submissions are now rejected.

In the Linux kernel, a vulnerability was found in the cs40l50-vibra input driver. The driver copies custom data of an FF_PERIODIC/FF_CUSTOM effect from user space without validating its length, which can lead to out-of-bounds reads and improper indexing of the bank array. Missing length checks (custom_len) and incorrect masking of the bank value (stored as s16) allow an attacker to trigger undesirable behavior.

In the Linux kernel FocalTech touchscreen driver, an array out-of-bounds bug in focaltech_process_rel_packet was fixed by making finger indices unsigned, preventing writes to state->fingers[-1].

In the Linux kernel Iforce driver, input packet lengths were not validated, allowing out-of-bounds reads from short packets. The fix rejects zero-length USB transfers and requires proper packet prefixes.

In the Linux kernel BYD touchscreen driver, a race condition during disconnect was fixed by using timer_shutdown_sync() instead of timer_delete(), preventing use-after-free.

In the Linux kernel Synaptics RMI4 driver (F54), a bug could lead to heap buffer overflow because report_size was not zeroed on error, causing stale larger payload to be copied into a smaller V4L2 buffer.

In the Linux kernel Synaptics RMI4 driver (F54), a bug allowed report size to exceed allocated buffer, leading to out-of-bounds write. The fix records allocation size and rejects reports that do not fit.

In the Linux kernel Synaptics RMI4 driver (F54), a bug allowed changing input type during streaming, which could change report size and lead to heap buffer overflow. The fix blocks VIDIOC_S_INPUT with -EBUSY when streaming.

In the Linux kernel, the crypto qce driver has an error path bug in devm_qce_register_algs. On registration failure, the error path repeatedly calls the same unregister function instead of unregistering previously registered algorithms.

In the Linux kernel, the gpio ml-ioh driver used a regular spinlock for register protection, which is invalid in irq_chip callbacks on PREEMPT_RT systems. The fix converts it to raw_spinlock_t.

In the Linux kernel for the OpenRISC architecture, restore_sigcontext() restored all SR bits from the signal frame, leaving privileged bits under user control. This allows an unprivileged task to disable the MMU and gain access to arbitrary physical memory.

In the Linux kernel, the sur40 driver registered the input device too early, before V4L2 and vb2_queue components were fully initialized. This can lead to data races and system crashes. The fix moves registration to the end of the probe function.

In the Linux kernel, the mmc: atmel-mci driver has a use-after-free (UAF) vulnerability in atmci_remove due to a race condition. The host->bh_work can be queued by interrupt, timer, or DMA completion, and after module removal the host memory is freed before the work finishes, leading to use of freed memory.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a memory leak when cp_init() fails. The current cleanup logic does not handle all channel program segments, leading to memory leakage.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a lack of cancellation of existing workqueues during initialization. This can lead to dispatching work after the private structure is freed.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a lack of range checking for read/write region indexes. The introduction of the capability chain clamped indexes only for capabilities, but not for existing regions.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is an out-of-bounds check on the CCW array. The loop may check a 257th element, which is out of bounds.

In the Linux kernel, in the s390/vfio_ccw subsystem, cleanup of cp resources is performed in fsm_notoper(), which can be called asynchronously while holding other locks. This can lead to deadlocks or malfunction.

In the Linux kernel, in the s390/vfio_ccw subsystem, the scope of io_mutex has been expanded to close remaining synchronization gaps. It also takes advantage of moving cp_free() to a workqueue, allowing safe lock management.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a lack of locking mechanism for the CRW region, which relies solely on asynchronous hardware events. A lock has been added to ensure consistent reading of the payload list.

In the Linux kernel, the xcrb_msg_to_type6cprb_msgx() function for s390/zcrypt lacks proper input validation, leading to integer overflow, missing minimum size validation, and arithmetic overflow in sum calculations. This can result in undersized buffer allocations, uninitialized memory access, and buffer overflows.

In the Linux kernel, the xcrb_msg_to_type6_ep11cprb_msgx() function for s390/zcrypt lacks minimum size validation, has arithmetic overflow in length calculations, and improper ASN.1 payload parsing. This can lead to uninitialized memory access and buffer overflows.

In the Linux kernel, the zcrypt_msgtype6_send_ep11_cprb() function for s390/zcrypt uses fragile struct overlays to access and modify the domain field in the EP11 CPRB payload, causing maintainability and security concerns. It lacks validation of actual ASN.1 encoding and has error-prone length format detection.

In the Linux kernel, the xcrb_msg_to_type6cprb_msgx() and xcrb_msg_to_type6_ep11cprb_msgx() functions for s390/zcrypt copy a user space message into a kernel buffer based on length, but further processing assumes 4-byte alignment. As a result, up to 3 bytes of uninitialized kernel memory are forwarded to further processing, potentially exposing kernel memory to the crypto card firmware.

In the Linux kernel, the amdgpu driver's AMDGPU_GEM_CREATE checked domain bits against AMDGPU_GEM_DOMAIN_MASK but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA, causing amdgpu_bo_placement_from_domain() to exceed AMDGPU_BO_MAX_PLACEMENTS and hit BUG_ON().

In the Linux kernel, the amdgpu driver incorrectly calculates the minimum size for UVD decode images because it uses width instead of pitch. Additionally, it does not reject pitch over 4096, which could lead to overflow.

In the Linux kernel, the amdgpu driver's amdgpu_cs_pass1() does not reject repeated chunk IDs, allowing multiple FENCE chunks in one submit. This causes amdgpu_cs_p1_user_fence() to run twice, overwriting p->uf_bo and leaking a BO reference.

In the Linux kernel, the XFS filesystem's xfs_rtginode_ensure() treats every error from xfs_rtginode_load() other than -ENOENT as success. This can leave the realtime group inode unset after an I/O, allocation, or corruption error, and growfs continues as though the inode had been loaded.

In the Linux kernel, the XFS filesystem has a vulnerability due to an off-by-one error in the validation of the root level of the rtrefcount B-tree. A crafted filesystem image with metadir, realtime, and reflink enabled can cause a slab-out-of-bounds write during mount or recovery, leading to a kernel panic.

In the Linux kernel XFS filesystem, during log recovery, the function xlog_recover_do_reg_buffer() copies data into a buffer based on a dirty bitmap without proper bounds checking. An attacker can supply a crafted filesystem image that causes an out-of-bounds write and corrupts the kernel heap. The issue is fixed by replacing the ASSERT with a real XFS_IS_CORRUPT() check that aborts recovery with -EFSCORRUPTED.

In the Linux kernel XFS filesystem, the function xfs_dq_get_next_id() acquires the ILOCK on the quota inode before calling xfs_iread_extents(). If xfs_iread_extents() fails, the function returns without releasing the lock, causing a lock leak. This can leave the quota inode locked and cause subsequent quota operations to hang.

In the Linux kernel XFS filesystem, the function xrep_tempfile_create can lead to a use-after-free (UAF) if the tempfile creation code fails after setting sc->tempip. The fix addresses this issue.

In the Linux kernel XFS filesystem, during exchange-range operations with the XFS_EXCHMAPS_INO1_WRITTEN flag, the function xmi_can_exchange_reflink_flags() may move the reflink flag to another file, but not all mappings are exchanged, which can lead to clearing the reflink flag on a file that still has shared written extents. This can result in data corruption. The fix disables the reflink flag exchange when XFS_EXCHMAPS_INO1_WRITTEN is requested.

A vulnerability in the Linux kernel's Ceph filesystem can cause read operations to hang indefinitely. The issue stems from an incorrect mds_wanted flag state, where a client may wait forever for FILE_RD rights after they were revoked by the MDS. The patch introduces a bounded wait and forces a synchronous OPEN renew when the required caps are not actually held.

In the Linux kernel, the ASoC tas2562 driver's tas2562_volume_control_put() function does not validate the value written by userspace. This value is used as an index into a fixed-size array, which can lead to buffer overflow and writing incorrect data to the device.

In the Linux kernel, the optee ffa driver's optee_ffa_lend_protmem function does not check if the allocated pointer is NULL. Under memory pressure, this can lead to a null pointer dereference.

In the Linux kernel, the clk spacemit k3 driver does not mark the HDMA clock as critical. This clock is responsible for the internal TCM access path of the X100 RISC-V core, and turning it off can cause the system to hang, e.g., on a page fault during vector access.

In the Linux kernel, the crypto tegra driver's tegra_gcm_do_one_req() function incorrectly calculates rctx->cryptlen, which can lead to a write beyond the rctx->dst_sg buffer during decryption if ctx->authsize remains zero.

In the Linux kernel, the af_unix function unix_del_edge() does not unlink the scc_entry before freeing the vertex, which can lead to partial freeing of a dead SCC by the garbage collector, causing errors.

In the Linux kernel, the ovpn driver's ovpn_crypto_kill_key function assumes both crypto slots are populated and dereferences each slot before checking it. This can lead to a NULL pointer dereference when a peer has only one key or when the key to be removed is not present.

In the Linux kernel, the SCSI core subsystem reads the shost->eh_noresume flag twice in one error handling iteration, which can lead to unmatched runtime PM get and put calls, causing a usage count underflow.

In the Linux kernel, the perf subsystem's perf_event_open() accepts events in the EXIT state as group leaders, which can lead to use-after-free when the leader is closed and a new sibling retains a pointer to the freed event.

In the Linux kernel's ovpn module, key slot crypto freeing is performed from an RCU callback, which is unsafe because crypto_free_aead can sleep (e.g., for hardware implementations). The fix defers the freeing to a workqueue where sleeping is allowed.

A vulnerability in the Linux kernel netfilter ipset module involves a race condition between list:set garbage collection and set swap operations. The issue causes a reference count decrement on a set whose reference has already moved to another index, leading to a BUG_ON and kernel panic.

In the Linux kernel's IPVS module, ip_vs_nat_icmp() does not revalidate the ihl field after reading from skb fragments, which can lead to out-of-bounds access. A local process can change the ihl field, causing issues in ip_send_check() calls.