A vulnerability in the Linux kernel's multipath TCP (mptcp) implementation was fixed to correct improper accounting in the __mptcp_subflow_push_pending() function. The issue involved updating copied byte counters even when __subflow_push_pending() returned an error, potentially causing mismatches in push calls later on. This flaw has been resolved in specific linux-hwe-edge kernel versions.
A race condition vulnerability in the Linux kernel's Multipath TCP (mptcp) scheduler was resolved. The issue involves a race between the scheduler and subflow socket state changes, which can cause data transmission failures and potentially lead to a divide-by-zero operation during socket release. This vulnerability affects specific versions of the linux-hwe-edge kernel and has a medium severity rating with a CVSS score of 7.5.
A vulnerability in the Linux kernel's Multipath TCP (mptcp) implementation could cause recursive calls in the mptcp receive path under rare error conditions, leading to unneeded processing and potential denial of service. The issue arises when the subflow reset triggers recursive state changes and data lock attempts. The fix introduces a new flag to break this recursion and explicitly flushes the receive queue during reset to avoid unnecessary operations.
A vulnerability in the Linux kernel's x86 memory management subsystem related to page table allocation has been resolved. The issue involves split page tables being allocated without using the standard kernel page table allocation routines, causing them not to be marked as kernel page tables. This leads to stale IOTLB cache entries because these split page tables are freed without proper invalidation. The fix ensures that split page tables are allocated via the ordinary PTE allocation API, invoking necessary constructors and destructors, and properly marking them as kernel page tables. This change also causes split page tables to appear in /proc/vmstat statistics, which is considered a positive side effect.
A vulnerability in the Linux kernel's s390/pai subsystem causes a kernel crash when using the 'perf stat' command with CPU hotplug events. The issue arises because the kernel does not allocate necessary per-CPU data structures for CPUs added during runtime, leading to a NULL pointer dereference and kernel panic. The flaw affects specific versions of the linux-hwe-edge kernel and has been resolved by adding CPU hotplug support that properly initializes these data structures when CPUs are brought online or taken offline.
A concurrency vulnerability in the Linux kernel's qla2xxx SCSI driver was resolved by introducing a dedicated per-fcport spinlock to serialize modifications to the NVMe unsolicited context list. The vulnerability involved unsynchronized concurrent modifications to a shared list, which could corrupt list pointers. This issue affects specific versions of the linux-hwe-edge kernel and has a CVSS score of 8.8, indicating high impact on confidentiality, integrity, and availability.
A use-after-free vulnerability in the Linux kernel's qla2xxx SCSI driver related to NVMe unsolicited context handling has been resolved. The flaw occurs because a context structure is freed without being unlinked from a linked list, leading to potential list corruption or kernel panic. This affects specific versions of the linux-hwe-edge kernel. The vulnerability has a high CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. Remediation involves unlinking the context before freeing it, matching the fix applied in the kernel source.
A vulnerability in the Linux kernel's qla2xxx SCSI driver allows a caller with CAP_SYS_RAWIO capability to trigger out-of-bounds heap reads by submitting crafted FC BSG requests with insufficient length validation. This can cause kernel address sanitizer (KASAN) detectable errors, mis-selection of commands, or kernel panic. The issue arises because the driver reads vendor_cmd[] fields without properly verifying the request length. The vulnerability has been resolved by adding centralized length checks and restricting early reads to sufficiently long messages.
A vulnerability in the Linux kernel's qla2xxx SCSI driver causes a CPU soft lockup due to an infinite polling loop triggered by misinterpreting certain payload data as a continuation IOCB signature. This occurs because the code spins waiting for a signature value that can be falsely matched by payload bytes, causing the CPU to hang in interrupt context. The issue has been resolved by removing the problematic signature polling and relying on safer guards to detect continuation IOCBs.
A vulnerability in the Linux kernel's scsi qla2xxx driver was resolved that involved improper handling of virtual port (vport) deletion during report ID acquisition. The flaw allowed a vport marked for deletion to be re-registered in the host map, leading to potential use-after-free memory dereference. This could result in high impact on confidentiality, integrity, and availability. The issue affects specific linux-azure kernel versions.
A vulnerability in the Linux kernel's qla2xxx SCSI driver was resolved by nulling out freed pointers in the qla2x00_mem_alloc() error path. The issue involved double freeing of adapter members and dereferencing a NULL DMA pool pointer during error handling, which could lead to kernel instability or crashes.
A use-after-free vulnerability in the Linux kernel's x86 memory management subsystem was resolved by adding a read lock on init_mm during attribute changes to prevent race conditions. The flaw involved a race between attribute changes and CPA collapse, which could free a page table entry while it was still in use. The fix introduces locking around the entire operation except during page table allocation to avoid deadlocks. This vulnerability affects specific versions of the linux-hwe-edge kernel and was reported by Denis V. Lunev.
A vulnerability in the Linux kernel's f2fs filesystem was resolved that involved incorrect accounting of free sections during garbage collection. The issue caused the filesystem to overestimate available free sections, potentially leading to allocation failures or assertion errors under tight space conditions. The fix adjusts free section counts accurately during segment freeing operations.
A vulnerability in the Linux kernel's qla2xxx SCSI driver allows an out-of-bounds write due to improper bounds checking of the virtual port index (vp_index) against the VP_CTRL IOCB bitmap size. This can cause corruption of adjacent IOCB fields or request-ring slots. The issue affects certain versions of linux-hwe-edge and has been resolved by adding proper bounds checks and defensive guards.
A use-after-free vulnerability in the Linux kernel's qla2xxx SCSI driver was resolved. The flaw occurs when work scheduled on a workqueue references a qpair that has been freed during queue teardown, leading to potential memory corruption. This is due to the workqueue not being properly flushed after interrupt release and before freeing memory. The issue is fixed by flushing the work item with cancel_work_sync() to ensure no pending work operates on freed memory.
A vulnerability in the Linux kernel's qla2xxx SCSI driver has been resolved. The flaw involves improper handling of dma_free_coherent() calls with NULL pointers and inconsistent locking mechanisms during queue teardown in error paths. This can lead to undefined behavior, including kernel panic, and potential race conditions corrupting queue ID mappings. The fix includes adding NULL checks before dma_free_coherent(), using consistent locking with mq_lock, and removing redundant bitmap clearing in error paths.
A vulnerability in the Linux kernel's hwmon driver for asus_rog_ryujin was resolved. The driver did not validate HID report lengths before parsing response headers and payload fields, potentially causing it to consume uninitialized bytes from the HID transport buffer. These uninitialized bytes could be exposed as sensor values via sysfs. The fix involves validating the response header and fields before parsing.
A vulnerability in the Linux kernel's usb subsystem (xusbatm driver) was resolved. The issue involved incorrect pointer arithmetic on the USB device ID table when dynamic IDs are used, leading to out-of-bounds indexing. The fix involved avoiding reliance on pointer arithmetic and disabling dynamic ID support for xusbatm.
A vulnerability in the Linux kernel's USB Pegasus driver involves incorrect pointer arithmetic when handling dynamic USB device IDs. The existing code incorrectly calculates an index when dynamic IDs are involved, potentially leading to out-of-bounds pointer usage. The issue is addressed by updating the dynamic ID parsing to use the driver_info field instead of relying on pointer arithmetic and removing the problematic loop.
A vulnerability in the Linux kernel's ath9k_htc WiFi driver was resolved. The issue involved storing the usb_device_id, which is not guaranteed to persist beyond the probe phase due to dynamic IDs. The fix involves storing only driver_data, which is reliably retrievable from the usb_device structure.