Linux kernel vulnerabilities

In the Linux kernel, the keys subsystem has a vulnerability due to byte order disagreement in keyring key chunks between keyring_get_key_chunk() and keyring_diff_objects(). Differences in byte order and bit position can allow key collisions, potentially leading to incorrect key placement in keyrings.

In the Linux kernel, netfilter nf_tables has a use-after-free vulnerability due to a global rhltable for nft objects. This allows access to objects being dismantled from other network namespaces, potentially leading to use-after-free.

In the Linux kernel, netfilter xt_hashlimit has a vulnerability due to uninitialized access to the burst field in the union of the dsthash_ent structure when XT_HASHLIMIT_RATE_MATCH mode is used by fewer than two rules referring to the same hashtable. Additionally, this mode is rejected for revisions less than 3.

In the Linux kernel, RDS/TCP has a use-after-free vulnerability in rds_tcp_laddr_check(). The function obtains a pointer to an IPv6 interface, drops the RCU lock, and then uses that pointer in ipv6_chk_addr(), which can lead to reading freed memory if the interface is deleted.

In the Linux kernel's nexthop module, there is a race condition during nexthop replacement. The functions fib6_check_nh_list() and __nexthop_replace_notify() walk the f6i_list without holding the nh->lock, while IPv6 RTM_NEWROUTE/RTM_DELROUTE operations mutate that list under the same lock. This leads to a use-after-free condition that could be exploited for code execution or system crash.

In the Linux kernel's nexthop module, there is a race condition in the nh_rt_cache_flush() function, which walks the f6i_list without holding the nh->lock. IPv6 route add/delete operations mutate that list under the lock and can free fib6_info entries, leading to a use-after-free. An attacker could exploit this to escalate privileges or cause a system crash.

A vulnerability in the Linux kernel's AF_XDP causes a buffer leak when dropping multi-buffer packets in xsk_drop_skb(). In three scenarios (overflow error, invalid TX descriptor, socket close), TX descriptors are consumed but buffer addresses are not published to the CQ, causing userspace to lose track of them. The fix triggers the skb destructor to submit addresses to the CQ and moves address assignment before the overflow check.

In the Linux kernel's XSK (AF_XDP) module, there is a vulnerability in the xsk_build_skb() function related to multi-buffer logic in the generic transmit path. When packets are too large (descriptor count exceeds MAX_SKB_FRAGS) or contain an invalid descriptor, continuation descriptors are silently lost and cannot be reused. The fix introduces the xdp_sock::drain_cont flag to drain them to the Cq queue.

In the Linux kernel, a vulnerability was found in the XSK zero-copy Tx batch processing path. Invalid descriptors can cause UMEM frame loss or completion ordering violations, leading to incorrect Tx queue behavior.

In the Linux kernel's libiscsi (SCSI) library, there is a vulnerability involving stale-data leak into the sense buffer. The iscsi_scsi_cmd_rsp() function copies sense data from a SCSI response, but the bounds check does not account for the 2-byte sense length prefix. A target can return a response with datalen equal to senselen, causing a read up to two bytes past the data and copying them into the sense buffer, which is returned to userspace.

In the Linux kernel SCSI libsas subsystem, there is a deadlock during host adapter resume and a race condition in the hisi_sas driver related to disk wake-up. The issue appeared after a change that skipped draining the event workqueue, causing disks to send I/O to a suspended controller and get disabled. The fix moves the PHYE_RESUME_TIMEOUT notification after the workqueue drain, eliminating the deadlock and restoring safe resume behavior.

In the Linux kernel, the ath12k driver had an out-of-bounds error in ath12k_mac_dp_peer_cleanup(), where indexing the free_ml_peer_id_map bitmap used peer_id with the ATH12K_PEER_ML_ID_VALID bit (BIT(13)) set, leading to writes beyond the bitmap memory (256 bits). This caused memory corruption and exhaustion of ML peer IDs.

In the Linux kernel, the hwmon nct6775-core driver for the NCT6116 chip used an incorrect number of temperature registers (six instead of three), leading to an out-of-bounds read (KASAN). The fix sets the number of registers to three and removes the unnecessary array.

In the Linux kernel, the hwmon lm90 driver is vulnerable to reading sysfs attributes before driver registration is complete, which can lead to a NULL pointer dereference in lm90_report_alarms(). The fix schedules work only after data->hwmon_dev is set.

In the Linux kernel, the hwmon nzxt-smart2 driver had an output buffer not aligned to DMA boundaries, which on architectures with non-coherent caches (e.g., ARM, MIPS) led to memory corruption during DMA mapping. The fix aligns the buffer to ARCH_DMA_MINALIGN.

In the Linux kernel network stack, when peer entry allocation (inet_getpeer_v4/v6) fails, functions sending ICMP/NDISC Redirects sent packets without rate limiting, potentially leading to a packet storm. The fix prevents sending redirects when peer is NULL.

In the Linux kernel, the hwmon nct6775-core driver for the NCT6116 chip has weight register arrays with only 3 elements, but the driver iterates up to 5 PWM channels, leading to out-of-bounds reads (KASAN) and invalid hardware register access. The fix extends the arrays with zeroed fields to mark unsupported registers.

In the Linux kernel, the forcedeth driver has a use-after-free vulnerability in nv_remove(), where per-CPU txrx_stats are freed before unregistering the network device, potentially leading to access to freed memory. The fix moves the free after unregister_netdev().

In the Linux kernel, the hwmon adt7470 driver, setting auto_update_interval to 0 via sysfs causes the update thread to loop tightly, leading to continuous CPU usage and flooding the I2C bus. The fix raises the lower limit of the interval to 500 ms.

In the Linux kernel, the adt7470 hwmon driver has a divide-by-zero TOCTOU vulnerability in fan speed read. If fan data becomes zero between the validity check and conversion, a race with a concurrent update can cause a crash.

In the Linux kernel, the cls_u32 classifier lacks validation of the offshift value, allowing shift-out-of-bounds during packet classification. An unprivileged user can trigger undefined behavior via user/network namespaces.

A memory leak in the Linux kernel's UDP tunnel NIC offload code (udp_tunnel_nic) was found. When network device registration fails, udp_tunnel_nic_unregister() returns early without freeing the allocated structure, causing a permanent leak. The fix removes the early return and synchronously cancels pending work before freeing memory.

In the Linux kernel, the netfs subsystem has a folio_queue allocation failure during writeback, causing a warning and potential crash. A mempool and gfp_t flags passing were added to handle allocation failures.

In the Linux kernel, Bluetooth ISO has a use-after-free vulnerability when detaching a connection from hcon. Failure to clear iso_data leads to later use after memory free.

In the Linux kernel, Bluetooth L2CAP has a use-after-free vulnerability in l2cap_le_connect_rsp. The channel is obtained without holding a reference, allowing a concurrent disconnect to free it, leading to use-after-free.

In the Linux kernel, Bluetooth ISO function iso_sock_getname does not hold the socket lock when accessing the conn field, leading to a race condition and potential use-after-free.

In the Linux kernel, Bluetooth ISO function iso_connect_ind does not hold the socket lock when accessing the conn field, leading to a race condition and potential use-after-free. Additionally, conn may be NULL if the socket has changed state.

In the Linux kernel, Bluetooth ISO function iso_conn_ready does not properly hold a reference to the socket when accessing conn->sk, leading to a use-after-free if the socket is concurrently closed.

In the Linux kernel, in the Bluetooth ISO subsystem, a socket reference leak was found after socket release. The early return condition in iso_sock_kill() is always true because sock_orphan() sets SOCK_DEAD, so the reference is never released and the socket destructor is never called. Additionally, the reference leaks when __iso_sock_close() does not set SOCK_ZAPPED, since iso_conn_del() does not call iso_sock_kill() after zapping.

In the Linux kernel, in the Bluetooth ISO subsystem, a potential deadlock was found in iso_sock_timeout(), which takes lock_sock and then synchronously disables the timer, potentially causing a deadlock. Additionally, iso_sock_timeout() may run concurrently with iso_conn_del(), leading to use-after-free (UAF) — one thread frees the hcon structure while another tries to access it.

In the Linux kernel, in the Bluetooth ISO subsystem, a reference counting bug was found in the iso_conn structure. A race between iso_conn_del() and iso_chan_del() can lead to a double-put of iso_conn, resulting in use-after-free (UAF). The issue stems from an extra put in iso_conn_del() for the case when iso_chan_add() fails.

In the Linux kernel, in the Bluetooth ISO subsystem, a race condition was found between kfree and kref_get_unless_zero on the hci_conn::iso_data field, which is accessed and modified without synchronization (lock or RCU). This can lead to use-after-free (UAF) and races between iso_conn_add() and iso_conn_free().

In the Linux kernel, in the Bluetooth subsystem (btintel driver), a missing length validation before accessing tlv->val[0] in btintel_diagnostics() was found. This can lead to reading data beyond the received frame, resulting in information disclosure or a crash.

In the Linux kernel, in the Bluetooth subsystem (hci_conn), a theoretical use-after-free (UAF) vulnerability was found in abort_conn_sync() if the connection (conn) is freed while the hci_sync task is running. There is no reference held to the connection.

In the Linux kernel, in the Bluetooth subsystem (hci_sync), a theoretical use-after-free (UAF) vulnerability was found in hci_connect_big_sync() if the connection (conn) is freed while the hci_sync task is running. There is no reference held to the connection. Additionally, if hcon is NULL, the function returns 0 and does nothing to match previous behavior.

In the Linux kernel, in the Bluetooth subsystem (hci_sync), a theoretical use-after-free (UAF) vulnerability was found in hci_connect_pa_sync() if the connection (conn) is freed while the hci_sync task is running. There is no reference held to the connection.

In the Linux kernel, in the Bluetooth subsystem (hci_sync), a theoretical use-after-free (UAF) vulnerability was found in hci_past_sync() if the connection (conn) is freed while the hci_sync task is running. This can lead to passing freed pointers to hci_conn_valid(), which kmalloc may have reused.

In the Linux kernel, in the octeontx2-af subsystem, a vulnerability was found that allows virtual functions (VFs) to overwrite special CGX PKIND state. When HiGig2 or EDSA parsing is enabled, a VF NIX LF allocation must not reset the LMAC RX PKIND or default TX parse config over the PF setup. Missing permission-checking functions.

In the Linux kernel, a potential deadlock was found in the mpi3mr driver in mpi3mr_fault_uevent_emit(). This function runs from the fault watchdog and reset paths where host I/O may already be blocked. GFP_KERNEL allocations, both local and inside kobject_uevent_env(), can trigger reclaim that waits on blocked I/O and deadlocks.

In the Linux kernel, a memory leak was found in the sxgbe network driver: when RX descriptor ring allocation fails, init_dma_desc_rings() only frees the partially allocated RX rings and returns, leaking the TX rings that were allocated earlier in the same function.

In the Linux kernel for RISC-V, a vulnerability was found causing out-of-bounds page-table walk during memory hot-remove. Functions remove_pud_mapping() and remove_p4d_mapping() obtain a child table base with offset 0, then add the index for addr. With page-table folding, this can walk past the parent table and pass an invalid page to __free_pages(), causing a kernel BUG.

A deadlock was found in the qede driver of the Linux kernel during recovery after a TX timeout on NICs with VXLAN/GENEVE tunnel ports configured. The recovery process tries to re-lock the same mutex (qede_lock), causing the entire rtnetlink control plane to wedge and many system services to hang.

In the Linux kernel's SMB server (ksmbd), a use-after-free vulnerability was found in __close_file_table_ids(). A ksmbd_file can remain alive after logical close while another session holds a temporary reference. When the foreign holder performs the final put, the object is freed without being removed from its owner's idr, leading to a stale pointer dereference during file-table teardown.

In the Linux kernel's iommu/iommufd subsystem, a use-after-free vulnerability was found in IOPF group ownership. IOPF groups are linked into the generic pending list before invoking the domain fault handler, and after acceptance they are also queued in the IOMMUFD deliver list without removal from the generic list. When detach or HWPT replacement drops the device's IOPF reference count to zero, groups can be freed, and later access leads to UAF.

In the Linux kernel's pinctrl subsystem for devicetree, a vulnerability was found causing freeing of uninitialized dev_name on error path. dt_remember_or_free_map() duplicates dev_name for each map entry. If kstrdup_const() fails, dt_free_map() frees dev_name in all entries, including uninitialized ones, leading to a double-free.

A vulnerability in the Linux kernel's hugetlb mechanism causes list corruption in allocate_file_region_entries(). The issue stems from using list_splice() instead of list_splice_init(), which under concurrent access to a shared mapping can lead to memory corruption or a system panic.

A vulnerability in the Linux kernel's KVM/SVM was found where x2APIC MSR intercepts are not updated for L1 when AVIC is inhibited while L2 is active. This allows L1 to read host APIC state, send arbitrary interrupts, and change task priority, potentially leading to a host DoS.

In the Linux kernel, in the KVM subsystem for s390 architecture in PCI handling, a vulnerability was found where a request to enable interrupt forwarding is not rejected if it is already enabled for the zPCI device. The MPCIFC instruction does not allow re-registering interrupts without first unregistering. The fix adds a proper check, preventing overwriting and resource leaks when the ioctl is called multiple times for the same device.

In the Linux kernel, in the KVM subsystem for s390 architecture in PCI handling, a memory accounting issue was found for pinned/unpinned pages. The account_mem() and unaccount_mem() functions call get_uid() which increments the reference count of struct user_struct on every invocation, but free_uid() is not called to decrement it. Additionally, accounting is done against current->mm, which may be incorrect when unaccount_mem() is called from a different process context than the one that originally pinned the pages. The fix stores the pinning process's user_struct and mm_struct and frees these resources when unpinning.

A use-after-free vulnerability was found in the Linux kernel's dibs layer, affecting attach/detach/unregister operations for dmb_node in loopback mode. The issue stems from a race between hash table lookup and refcount operations, potentially leading to use of freed memory. The fix makes refcount transitions and hash table removal atomic under the write lock.