Linux kernel vulnerabilities

In the Linux kernel, the Input: evdev driver has a vulnerability where the user-supplied event type index in EVIOCGMASK / EVIOCSMASK ioctls is used to index arrays in evdev_get_mask_cnt() and evdev_get_mask(). Speculative execution may mispredict bounds checks and perform out-of-bounds loads.

In the Linux kernel, the ALSA usb-audio driver has an out-of-bounds write vulnerability when handling inbound USB transfers of Format Type II. The issue is caused by incorrect calculation of the transfer buffer size, which is one packet too small, leading to writes beyond the allocated memory.

In the Linux kernel, the usb: misc: usbio driver has a vulnerability where in usbio_bulk_msg() the EMSGSIZE check compares ibuf_len (receive buffer size) with txbuf_len (transmit endpoint size) instead of rxbuf_len. When these sizes differ, the check is incorrect.

In the Linux kernel's cxacru driver for USB ATM devices, a vulnerability was found due to improper URB management. During an error in cxacru_cm(), the active rcv_urb is not killed, which can lead to a warning in usb_submit_urb() and potential system stability issues.

In the Linux kernel, the usb: gadget: f_ncm driver has a vulnerability where the variable ndp_index is declared as signed, but it stores the return value of get_ncm(), which is unsigned. A malicious host can supply a large offset that overflows the signed ndp_index, making it negative, which bypasses sanity checks and leads to an out-of-bounds read when calculating the address of the NDP block.

In the Linux kernel, the net: usb: ax88179_178a driver has a vulnerability where when the interface has NETIF_F_SG enabled and skb_linearize() fails in ax88179_tx_fixup(), the function returns NULL without freeing the skb. This leads to a memory leak on every TX frame whose linearization fails (e.g., under memory pressure).

A use-after-free vulnerability was found in the Linux kernel's ipheth driver for iPhone USB devices, caused by improper re-arming of carrier_work after interface close or device disconnect. This leads to accessing freed memory, potentially causing a kernel crash or memory corruption.

In the Linux kernel, the vt driver lacks a permission check for the KDSKBMETA ioctl, allowing a process to change keyboard meta mode on a non-controlling console without authorization.

In the Linux kernel, kbd_keycode() reads the port.tty pointer without acquiring a proper reference, racing with con_shutdown() and potentially causing use-after-free.

A vulnerability in the Linux kernel's zap_pte_range function during direct page table reclaim causes an incorrect flush address passed to pte_free_tlb. This leads to improper TLB (paging-structure-cache) flushing, potentially resulting in use-after-free or system crashes. The issue primarily affects architectures where flushing depends on the address, such as AMD with EFER.TCE or Intel with INVPCID.

In the Linux kernel, the evdev subsystem does not fully initialize the input_event structure, leaking uninitialized stack memory to userspace via padding bytes.

A use-after-free (UAF) vulnerability has been found in the Linux kernel's vmalloc mechanism, caused by a race between page table freeing and the ptdump tool. The issue occurs when promoting entries to huge pages, where the lower page table is freed without proper locking, potentially leading to access to freed memory. The patch resolves this by acquiring the mmap lock on init_mm during vmap operations and in the CPA (Change Page Attributes) mechanism on x86.

In the Linux kernel, the IMA module's xattr_verify() has a bug in the digest length check, leading to an out-of-bounds read for truncated xattrs.

In the Linux kernel, the IPVS estimator thread may continue after the calculation phase is disabled, leading to out-of-bounds writes and potential crashes.

In the Linux kernel, the packet subsystem's tpacket_snd() reads dev->hard_header_len independently for allocation and header construction, which can lead to buffer overflow during concurrent reconfiguration.

In the Linux kernel, the packet socket transmit path does not reset the MAC header for protocol-bound SOCK_RAW, SOCK_DGRAM, and SOCK_PACKET frames. In PACKET_QDISC_BYPASS mode, the frame reaches the driver with an unset MAC header, causing an out-of-bounds read.

In the Linux kernel, packet_set_ring() updates RX ring state under lock but publishes the tpacket receive mode after releasing it. This race can cause packet_poll() or packet_recvmsg() to access stale or NULL ring storage.

In the Linux kernel Open vSwitch, when updating a flow with a UFID that misses and falls back to key lookup, the preallocated reply may be too small. This can cause -EMSGSIZE and trigger BUG_ON in the update path.

In the Linux kernel net/sched subsystem, overly deep qdisc hierarchies can cause excessive recursion and kernel stack exhaustion. The existing loop check does not cover the create-and-graft path, allowing hierarchy extension.

In the Linux kernel mac802154 subsystem, the beacon worker reads local->beacon_req under RCU but continues to use sdata and wpan_dev after leaving the RCU section. This can lead to use-after-free after interface teardown.

A vulnerability in the Linux kernel netfilter ebt_nflog module leads to a use-after-free condition. The issue arises from not holding a reference to the NFLOG logging module, allowing an ebtables rule to be invoked after per-net data has been freed by nfnetlink_log. An attacker could exploit this to corrupt kernel memory.

In the Linux kernel bridge MRP subsystem, br_mrp_alloc_test_skb() builds MRP test frames on an skb from dev_alloc_skb(), which does not clear the linear data area. In the MRA ring-role branch, three bytes remain uninitialized in every MRP_Test frame.

A vulnerability in the Linux kernel futex mechanism involves a race condition during robust futex exit. The previous fix (ca16d5bee598) was insufficient, allowing lost wakeup notifications when another thread re-acquired the futex via the fast path. This could cause waiting threads to sleep forever on a free futex.

In the Linux kernel, fib_nlmsg_size() incorrectly estimated nexthop space assuming every gateway is encoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an IPv6 gateway, which is dumped as RTA_VIA, leading to undersized skb allocation and -EMSGSIZE errors, and with panic_on_warn set, a kernel panic.

A use-after-free vulnerability was found in the Linux kernel's fib_nhc_update_mtu() function for IPv4. The issue stems from lack of synchronization between walking the PMTU exception table and updates, potentially leading to access to freed memory. An attacker could exploit this flaw to compromise system integrity.

In the Linux kernel's qcom-geni UART driver, there is an issue with flushing the TX DMA buffer during transmission, causing the UART to get stuck infinitely repeating corrupted TX DMA frames. The DMA-mode uart_ops lacks a flush_buffer callback, and the stop path is broken, leading to a hang.

In the Linux kernel's 8250_dma driver, serial8250_release_dma() terminates RX DMA and releases the channel but leaves rx_running set. On port reopen, the stale state causes a NULL channel to be passed to dmaengine_pause(), leading to a kernel Oops.

A vulnerability in the Linux kernel serial driver 8250_of for the NXP LPC32xx UART was found. The UART can report an RX timeout interrupt while the FIFO is empty, which is never cleared. This causes an interrupt storm that can livelock the CPU on single-core ARM926 systems.

In the Linux kernel's amba-pl011 driver, RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel both timers.

In the Linux kernel's staging rtl8723bs driver, rtw_get_wpa_ie() reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short trailing IE.

In the Linux kernel's staging rtl8723bs driver, WMM_param_handler() copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read for a short WMM IE.

In the Linux kernel's staging rtl8723bs driver, the WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg_txt buffer, potentially causing overflow or underfill.

In the Linux kernel's staging rtl8723bs driver, rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and reads the 802.11 frame control field without checking that a base 802.11 header remains, potentially causing out-of-bounds reads or insufficient data.

In the Linux kernel's fastrpc module, there is a potential race condition during buffer unmap operations. The buffer is removed from the list only after the unmap operation, which can cause issues when multiple threads invoke unmap concurrently. The fix moves the list removal before the unmap, re-adding the buffer if unmap fails.

In the Linux kernel's fastrpc module, the fl->lock is not held when moving memory mappings after an interrupted invoke. The list_del() and list_add_tail() operations run without this lock, which can cause races with other operations on the mmaps list. The fix adds the lock around the move.

In the Linux kernel's DAMON_LRU_SORT module, there is a division by zero vulnerability when the active_mem_bp parameter is set to a value greater than 10000. The target value for cold memory is calculated as '10000 - active_mem_bp + 2', which becomes zero for 10002, causing a divide error. The fix returns an error when starting DAMON with >10000.

In the Linux kernel's DAMON module, there is an issue with folios when the migration target is invalid (e.g., NUMA_NO_NODE). Functions damon_pa_migrate() and damos_va_migrate() isolate folios, but when target_nid is invalid, folios are not returned to the LRU, causing reference leaks and pages staying off the LRU. The fix adds putting folios back on the invalid-nid path.

A vulnerability in the Linux kernel's DAMON_SAMPLE_MTIER sample module allows a user to trigger a division by zero in damos_quota_score(). This occurs when the node0_mem_free_bp or node0_mem_used_bp parameter is set to zero, leading to a kernel Oops and potential system crash.

In the Linux kernel's ALSA USB driver, there is a use-after-free (UAF) vulnerability in delayed release of MIDI2 endpoints. The previous fix for UAF in ump_to_endpoint() causes another UAF because it tries to dereference the UMP endpoint object, which may already be released in a delayed context. The fix adds private_free to clear associated data.

In the Linux kernel, the ALSA usx2y driver (for USB US-X2Y sound cards) lacks offset validation in the mmap function for the hwdep interface. An attacker can supply an arbitrary offset, leading to access to kernel memory outside the allocated region, and in extreme cases to a system oops.

A vulnerability in the Linux kernel's ALSA FCP driver causes an out-of-bounds write in fcp_meter_ctl_get(). The issue stems from an incorrect map size limit (255 instead of 128), allowing writes beyond the allocated buffer. An attacker with CAP_SYS_RAWIO can install an oversized map, and any process with access to /dev/snd/controlC0 can trigger the out-of-bounds write.

In the Linux kernel, the ALSA driver for the us144mkii device has a use-after-free vulnerability. When resubmitting capture URBs in capture_urb_complete(), the URBs were not re-anchored, leaving the anchor list empty after the first completion. This caused cleanup functions like tascam_free_urbs() to fail to stop the URBs, leading to writes to freed memory and dereferencing of a freed driver object.

In the Linux kernel, the V3D DRM driver (drm/v3d) has a vulnerability due to lack of serialization of timeout handlers for different hardware queues (BIN, RENDER, TFU, CSD). Since the reset is global, concurrent timeout handling can lead to inconsistent job credit counts, resulting in GPU hang and UI freeze.

A use-after-free vulnerability was found in the Linux kernel's perf subsystem, related to improper sibling event detachment from a group. When a sibling event is detached (e.g., during CPU hot-unplug), its group_leader pointer remains pointing to the old leader, which may be freed, leading to dereferencing freed memory during a PERF_IOC_FLAG_GROUP ioctl. The issue was reproduced by running the perf event fuzzer, CPU hotplug, and a stress workload concurrently.

A race condition between event_define_fields() and update_event_fields() in the Linux kernel was found during concurrent module loading. Lack of event_mutex protection for the event field list in trace_event_update_all() can lead to a kernel panic.

In the Linux kernel fbdev driver, the bit_cursor() function did not validate the glyph index read from the screen buffer, which could lead to an out-of-bounds memory read. The issue was reported by Syzkaller and affects the write path to /dev/vcsa.

In the Linux kernel, ring_buffer_subbuf_order_set() frees buffer pages, which is not allowed when resizing is disabled. A non-consuming reader is at risk of use-after-free in rb_advance_iter(). The function now returns -EBUSY when resize_disabled is set, matching ring_buffer_resize() behavior.

In the Linux kernel, a NULL pointer dereference occurs in the tracing module when removing events from the module cache. A module-specific event filter such as ':mod:foo' is cached with a NULL pointer when the module is not loaded. A later attempt to remove a specific match from the same module passes this NULL to strcmp(), causing a NULL pointer dereference.

A subtle race condition in the Linux kernel's huge_zero_folio implementation can cause the huge_zero_pfn to be overwritten with an invalid sentinel value by the shrinker, leading to misidentification of the huge zero page as a regular THP folio. This may result in incorrect splitting and handling of the huge zero folio.

In the Linux kernel, smc_rx_splice() has a lifetime imbalance issue for splice entries. The function passes pages to splice_to_pipe() before taking references, which can lead to use-after-free due to refcount underflow.