A use-after-free vulnerability in the Linux kernel's hwmon gpio-fan driver was resolved. The issue involved the fan_alarm_irq_handler() queuing work that could run after the associated fan_data and hwmon device were freed, leading to potential use-after-free conditions. The fix replaced INIT_WORK() with devm_work_autocancel() to ensure proper cancellation of queued work during device unbinding.
A use-after-free vulnerability in the Linux kernel's AFS (Andrew File System) implementation has been resolved. The flaw occurs because stale peer application data is not cleared after address list changes, leading to potential use of freed memory. This can cause kernel memory corruption and crashes. The issue affects specific Linux kernel versions used in the linux-hwe-edge product line. The vulnerability has a CVSS score of 7.5, indicating a medium severity with high impact on confidentiality, integrity, and availability.
A vulnerability in the Linux kernel's AFS implementation was fixed by correcting an improper free operation in the afs_lookup_server() function. The issue involved freeing an endpoint state of a candidate server that did not yet have one, which could lead to memory corruption. This flaw affects specific versions of the linux-hwe-edge kernel and has a CVSS score of 7.8, indicating a high impact on confidentiality, integrity, and availability.
A vulnerability in the Linux kernel's AFS filesystem component was fixed to address a double-unmap issue of directory blocks. The flaw involved improper handling in the afs_edit_dir_remove() function, which could cause a double kunmap operation if afs_dir_find_block() was called consecutively without clearing the block pointer. This issue has been resolved by changing the cleanup approach to avoid manual kunmapping that leads to double unmapping.
A vulnerability in the Linux kernel's AFS component was fixed by correcting a missing kunmap call in the afs_dir_search_bucket() function. This fix addresses proper resource unmapping in an error path to prevent potential kernel issues.
A vulnerability in the Linux kernel's perf subsystem for RISC-V architecture involved improper handling of the available counter mask. The mask was stored as a single unsigned long, but iteration used a constant RISCV_MAX_COUNTERS set to 64, causing out-of-bounds reads on 32-bit RISC-V (RV32) systems. This was corrected by using a bitmap to properly represent the available counters and updating related code paths accordingly.
A vulnerability in the Linux kernel's s390 crypto subsystem causes indefinite blocking when hardware persistently returns the -EBUSY error after retry exhaustion. The crypto API treats -EBUSY as a queueing status and swallows it, preventing the completion callback from firing. This issue has been resolved by mapping persistent -EBUSY errors to -EIO to ensure proper error propagation and callback invocation.
A vulnerability in the Linux kernel's s390 crypto engine caused incorrect return codes in asynchronous callbacks, leading to double completion of crypto requests. This was fixed by ensuring the callback returns 0 after explicit finalization to indicate successful handling. The issue affected specific Linux kernel versions related to the linux-hwe-edge product.
A vulnerability in the Linux kernel's s390 crypto implementation was fixed to address missing scrubbing of temporary buffers used with the PAES algorithm. Specifically, a buffer processing remaining bytes smaller than AES block size was not cleared, potentially exposing sensitive data. The fix involves explicitly scrubbing this buffer and cleaning the entire parameter block in related functions.
A vulnerability in the Linux kernel's s390 crypto subsystem related to the handling of EBUSY return codes in PHMAC when requests are pushed to the crypto engine has been resolved. The issue was that the EBUSY return code was not correctly handled as a successful transfer indication, which has now been fixed.
A vulnerability in the Linux kernel's s390 crypto implementation was fixed to address missing scrubbing of temporary buffers used in AES CTR and GCM algorithms. The flaw involved buffers processing remaining bytes less than AES block size and error paths where sensitive data in parameter blocks and buffers were not properly cleared, potentially exposing unwanted data. The issue affects specific versions of the linux-hwe-edge kernel.
A NULL pointer dereference vulnerability in the Linux kernel's iommu/s390 component was fixed. The issue occurs in the iova_to_phys() function when using a 5-level translation table via ZPCI_TABLE_TYPE_RFX. Specifically, get_rso_from_iova() returns NULL for an invalid region-first entry, but get_rto_from_iova() does not check the region-second origin for NULL before accessing it, causing a NULL pointer dereference. This was corrected by adding the missing NULL check.
A use-after-free vulnerability in the Linux kernel's Landlock security module has been fixed. The flaw involves improper handling of the source's parent directory dentry during certain filesystem operations, allowing a race condition between linkat(2), rename(2), and rmdir(2) system calls. This can lead to kernel memory corruption and potential system compromise. The issue affects specific Linux kernel versions used in the linux-hwe-edge product line.
A use-after-free vulnerability in the Linux kernel's mac802154 subsystem was fixed. The issue involved unsafe handling of queued RX frames leading to potential use-after-free conditions when interfaces were removed while frames were still queued. The flaw was addressed by adding locking around list accesses, pinning interfaces during frame processing, and dropping frames for interfaces being unregistered. This vulnerability has a CVSS score of 7.5 and affects specific versions of the linux-hwe-edge kernel.
A vulnerability in the Linux kernel's IPVS component allows invalid states in connection template sync records to be stored and used, potentially leading to incorrect connection handling. The flaw arises because IPVS sync receivers do not reject invalid template states, which TCP and SCTP then use as indexes into their transition tables. This issue affects specific Linux kernel versions and has been resolved by rejecting invalid template states before connection modification.
A vulnerability in the Linux kernel IPv6 flowlabel handling allowed unprivileged users to bypass lease limits per socket, potentially causing unbounded growth of socket lease lists. The flaw involved the ipv6_flowlabel_get() function allocating entries without proper admission checks on repeated GET requests, which could consume excessive host memory. The issue has been resolved by enforcing a maximum lease limit per socket and proper capability checks.
A vulnerability in the Linux kernel's IPv4 routing table ID allocation was resolved by bounding the automatic table ID allocation to 4096. Previously, the function fib_empty_table() probed every table ID from 1 up to RT_TABLE_MAX (0xFFFFFFFF) to find a free ID, causing potentially unbounded RTNL lock hold times. The fix limits the search to 4096, causing rule addition to fail with ENOBUFS if the range is exhausted. This automatic allocation path is IPv4-only, legacy, undocumented, and unused by major tools like NetworkManager and systemd.
A double-free vulnerability in the Linux kernel's ieee802154 hwsim driver was fixed by serializing pib updates. The issue arises because hwsim_update_pib() performs an unserialized read-swap-free operation on phy->pib, which can race when called without the RTNL lock, leading to double-free and potential kernel memory corruption. The fix adds a lock to struct hwsim_phy and makes the pointer swap atomic.
A use-after-free vulnerability was identified and resolved in the Linux kernel's ieee802154 cc2520 driver. The issue involved the FIFOP interrupt handler queuing work after the device's private data had been released during removal, due to improper work disabling. This could lead to the handler running after removal, potentially causing instability or crashes.
A vulnerability in the Linux kernel's ieee802154 6lowpan subsystem allows a NULL pointer dereference via a crafted RTM_NEWLINK request. This occurs because the lowpan_newlink() function dereferences a pointer without verifying its initialization when a TUN device changes its link-layer type to ARPHRD_IEEE802154. This issue has been resolved by rejecting devices without the required ieee802154_ptr. The vulnerability affects specific linux-aws kernel versions.