Linux kernel vulnerabilities

In the Linux kernel, the bnxt driver has a deadlock vulnerability when canceling the IRQ affinity notifier. The notifier restarts the queue under the netdev instance lock, and cancellation waits for the callback, causing a deadlock.

In the Linux kernel, the veth interface has a bug in veth_poll that uses an incorrect queue index to wake the peer TX queue. Without an XDP program, the index remains 0, which can lead to a permanent stall of the TX queue and loss of transmission.

In the Linux kernel, the ngbe driver has a NULL pointer dereference vulnerability when enabling interrupts in non-MSI-X mode. In such mode, wx->msix_entry is not allocated, and calling NGBE_INTR_MISC leads to a crash.

In the Linux kernel, the net/sched act_api module has a TOCTOU vulnerability leading to NULL pointer dereference on a->goto_chain. A concurrent operation can clear the pointer between two reads, causing a NULL dereference.

In the Linux kernel, the net/sched cls_u32 module has a slab-out-of-bounds read vulnerability in u32_bind_class(). The function does not check whether the object is an hnode, leading to invalid memory access.

In the Linux kernel, the cls_bpf module did not verify that a device-bound (offloaded) eBPF program is bound to the same network interface to which the classifier is being attached. This allowed attaching a program intended for device A to device B, and after deleting device A it caused a system panic.

In the Linux kernel, in the L2TP modules (pppol2tp and l2tp_dfs), there is a reference leak for tunnels and sessions when closing seq_file files before reaching end-of-file. References stored in private data are not dropped, leading to memory leaks.

In the Linux kernel, in the gpio: pca953x driver, the function pca953x_irq_bus_sync_unlock did not hold the i2c_lock during regmap calls, which could lead to incorrect register read/write under concurrent access. A previous patch only protected the write to the interrupt mask register, not the read from the direction register.

In the Linux kernel, in sched_ext, when a sub-scheduler enable fails before scx_link_sched(), the cleanup still runs the full scx_sub_disable(), which can race with root disable and lead to use-after-free. The fix skips the cgroup ownership reset and task walk if the scheduler was never linked.

In the Linux kernel, in the soc: aspeed: lpc-snoop driver, the snoop_file_read function can cause a usercopy overflow due to lack of synchronization between the producer (IRQ) and consumer (file). The fix adds a per-channel spinlock to serialize kfifo access.

In the Linux kernel, in XFS, the function xfs_buf_free calls folio_put on a NULL pointer when backing memory allocation fails, leading to a kernel crash. The fix skips folio_put when bp->b_addr is NULL.

In the Linux kernel bonding driver (ALB mode), bond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and takes RTNL via rtnl_trylock() before undoing promiscuity on the active slave. In that window the active slave can change, leading to a null-pointer dereference (kernel panic) or an underflow of the promiscuity counter, leaving the interface in IFF_PROMISC.

In the Linux kernel, in the enic driver, enic_remove does not cancel the tx_hang_reset work, which can lead to use-after-free after free_netdev(). The fix uses disable_work_sync() instead of cancel_work_sync() to block re-scheduling of the work.

In the Linux kernel, in IPVS, the function ip_vs_nat_icmp can write out of bounds because the ihl field in the IPv4 header is read multiple times, and a local attacker can modify the packet during processing. The fix reads ihl only once and uses ciph->len as the offset to the transport header.

A memory leak was found in the Linux kernel's btrfs filesystem in the btrfs_do_encoded_write() function. During encoded write operations (ioctl), allocated extent_changeset structures are not freed before returning from the function, leading to memory leaks. The issue was discovered during local fuzzing on version 6.12.94.

In the Linux kernel, the amdxdna_insert_pages() function in the accel/amxdna driver has two error paths that incorrectly call vma->vm_ops->close(vma) before returning an error code. This causes premature resource release, and later unmapping by the process leads to a double close and reference count underflow.

In the Linux kernel BPF subsystem, when handling scalar += pointer in adjust_ptr_min_max_vals(), copying only selected fields of pointer state is fragile because pointer provenance is tracked by several bpf_reg_state fields. The fix uses the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state.

In the Linux kernel net/smc module, the smc_llc_event_handler() function lacks a check for an already pending qentry before storing a new one for CONFIRM_LINK and ADD_LINK_CONT. A malicious or buggy peer can send a second request, causing the pointer to be overwritten without freeing the previous allocation, leading to a memory leak (kmalloc-96).

In the Linux kernel devlink_nl_reload_doit() function, there is a net namespace reference leak. When the requested namespace differs from the current one and the reload action is not DRIVER_REINIT, the function returns -EOPNOTSUPP without releasing the reference obtained by devlink_netns_get().

In the Linux kernel's mlx5 driver, a vulnerability exists where the firmware tracer creation function can return either NULL or ERR_PTR. The return value is stored without a check, and during core dump generation, an invalid pointer is dereferenced, causing a kernel panic.

In the Linux kernel amdxdna_insert_pages() function in the accel/amdxdna driver, there is a BUG_ON vulnerability. The vm_flags_mod() call sets VM_MIXEDMAP and clears VM_PFNMAP, allowing an unprivileged process to call madvise(MADV_DONTNEED) on a mapped GEM object, and subsequent memory access triggers BUG_ON in vmf_insert_pfn_prot() due to pfn_valid(pfn) and VM_MIXEDMAP.

A vulnerability in the Linux kernel's BPF conntrack kfuncs was found, where the opts argument can point to a shared map value. Inconsistent reads of the netns_id field during acquisition and release of network namespace references can lead to reference imbalance, potentially destroying a live namespace and crashing the system.

A use-after-free vulnerability was found in the Linux kernel's bpf_iter_tcp_established_batch() for TCP_NEW_SYN_RECV sockets. The request_sock is published on the ehash chain before its refcount is set, and the BPF iterator uses plain sock_hold() instead of refcount_inc_not_zero(), leading to a race that overwrites the refcount and causes use-after-free.

A vulnerability in the Linux kernel's vhost_iotlb mechanism allows IOTLB entries to be allocated beyond the configured limit, leading to uncontrolled memory consumption. Affected components include vhost, vDPA, VDUSE, and vhost-vDPA devices that may create tables with zero or no limits. The fix enforces the limit and rejects invalid values.

A type confusion vulnerability was found in the Linux kernel's hwmon driver for PMBus devices. The pmbus_notify() function incorrectly casts different attribute types to sensor_device_attribute, which may lead to an out-of-bounds read or incorrect mask matching during alerts. The fix changes the attribute structures and sets the index to -1 for attributes that do not trigger notifications.

In the Linux kernel, AF_XDP accepts a TX metadata length as small as eight bytes, but every supported request needs flags plus at least one eight-byte field. Such short metadata can let the kernel read beyond the registered area.

In the Linux kernel, AF_XDP allows user space to change metadata flags after request processing. Rereading them during completion can make the kernel write a timestamp that was not requested when the packet was submitted. The fix clears the metadata pointer during request processing unless timestamp completion is requested.

In the Linux kernel, AF_XDP launch-time metadata extends beyond the first 16 bytes of struct xsk_tx_metadata. The vulnerability allows rejecting the request when the registered metadata area does not contain the complete field. The fix also snapshots validated flags for the generic transmit path to avoid inconsistent decisions if user space changes flags concurrently.

In the Linux kernel, the zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata between those operations and bypass the original validation. The fix validates metadata in xsk_tx_metadata_request() and uses the resulting flags snapshot for every feature check.

In the Linux kernel, the bnge driver has a NULL pointer dereference vulnerability in the auxiliary device release function. If allocation of auxr_dev fails during auxiliary device setup, the error path calls auxiliary_device_uninit(), which eventually invokes bnge_aux_dev_release(). The release callback unconditionally dereferences aux_priv->auxr_dev->pdev, causing a NULL pointer exception.

In the Linux kernel, the sch_cake ACK filter contains a WARN_ON(1) that can be triggered by a malformed IP header. Depending on system configuration, this leads to spamming dmesg with warnings or a panic if panic_on_warn is set. The fix removes the WARN_ON because the code already correctly skips the offending packet.

In the Linux kernel, the vhost-scsi subsystem has a vulnerability due to missing validation of T10 PI scatterlist counts. A malformed request can claim protection bytes that cover or exceed the payload length, leading to a zero data SGL count reaching sg_alloc_table_chained(), which triggers BUG_ON(!nents).

A vulnerability in the Linux kernel's vhost-scsi allows feature changes after endpoint activation, leading to a kernel panic. Enabling T10-PI after setup leaves protection scatterlists uninitialized, triggering a BUG_ON in sg_alloc_table_chained().

In the Linux kernel, the openvswitch module's key_extract() function does not check the Ethernet header length before accessing it, which can lead to a kernel BUG in __skb_pull() for packets arriving on ARPHRD_NONE devices such as TUN. The fix is to call check_header() before accessing the Ethernet header.

A vulnerability was found in the Linux kernel's network filter mechanism (net/sched). The issue is a race condition during filter creation that can lead to use-after-free (UAF) in the cls_u32 class. The fix ensures rtnl_lock is always acquired when destroying locked classifiers.

In the Linux kernel, the DRM/Xe driver has a memory leak in exec_queue_set_hang_replay_state(). The q->replay_state is blindly overwritten, potentially leaking memory previously allocated by vmemdup_user(). The fix returns an error if q->replay_state is not empty.

In the Linux kernel, the mlx5e network driver has a vulnerability due to incorrect BQL reset on SQ re-activation. mlx5e_activate_txqsq() unconditionally calls netdev_tx_reset_queue(), zeroing BQL counters of channels with in-flight TX WQEs, leading to BUG_ON in dql_completed().

In the Linux kernel, the bnxt_en driver has a vulnerability causing data corruption. When EOP (end of frame padding) is enabled on the AGG ring, zero padding may overlap with the next segment's data, especially with Relaxed Ordering (RO) enabled. On older chips (P5 and older), RO is not automatically disabled, potentially overwriting valid data.

In the Linux kernel, the TCP Fast Open (TFO) implementation has an issue with max_qlen accounting during SO_REUSEPORT listener migration. After migration, the qlen counter is not correctly transferred, causing the limit of pending Fast Open requests to be exceeded.

In the Linux kernel, the netfilter nf_flow_table module has an issue with dst_entry reference leak. When a packet passing through flowtable hooks already has a ref-counted dst, calling skb_dst_set_noref() overwrites the pointer, causing a reference leak and triggering DEBUG_NET_WARN_ON_ONCE warnings.

In the Linux kernel, the net/ncsi module has a heap out-of-bounds read vulnerability. The ncsi_send_cmd_nl() function does not validate the payload length from the packet header, allowing an attacker with CAP_NET_ADMIN to read up to 64KB of kernel memory and leak information.

In the Linux kernel, the prestera driver lacks validation of the firmware header length. The prestera_fw_hdr_parse() function reads the header before checking that the firmware image contains that header, which could lead to out-of-bounds read.

A TOCTOU race condition was found in the Linux kernel's net/smc module. The smc_listen_out() function checks the socket state without holding the lock, then acquires it later, allowing a race with listener close. This can lead to kernel memory leaks due to unreleased references to the child socket.

In the Linux kernel's Thunderbolt network driver, a vulnerability was found in the teardown sequence: DMA rings are stopped and frame buffers freed before DMA paths are deactivated. This causes in-flight data to have nowhere to drain, so the 'pending' bit never clears, leading to timeouts and link failure.

In the Linux kernel, the s390/ism driver has a use-after-free vulnerability. During ism_dev_exit(), an interrupt handler may be active in parallel, accessing freed data structures, leading to memory safety violation.

In the Linux kernel, the net/atm module has a slab-out-of-bounds read vulnerability in vcc_setsockopt(). An ineffective optlen check allows bypassing validation, which could lead to reading beyond buffer boundaries.

In the Linux kernel, the at91sam9_wdt watchdog driver has a vulnerability where at91_ping() rearms the watchdog timer from its callback. Using timer_delete() neither waits for a running callback nor prevents rearming, potentially leading to access to freed memory during probe failure or driver removal.

A vulnerability in the Linux kernel's rqspinlock mechanism was found, where the queue tail is not reset when an ABBA deadlock is detected. This can cause a thread to wait indefinitely for a next waiter that never arrives, leading to intermittent or permanent system stalls.

In the Linux kernel, the ltc4282 hwmon driver has a vulnerability where negative current values are cast directly to u64, leading to large positive values and then overflow and random values after division. These values are then clamped to the maximum limit instead of zero.

In the Linux kernel, the net: tap driver has a vulnerability where in tap_get_user_xdp() the virtio-net header is parsed before assigning skb->dev. When the vhost TX path passes an XDP buffer with a GSO virtio-net header and protocol set to zero, dev_parse_header_protocol() can be called with skb->dev NULL, leading to a crash.