A memory leak vulnerability in the Linux kernel's drm/i915 component was fixed by ensuring that when krealloc() fails in query_perf_config_list(), the original oa_config_ids memory is freed. This prevents resource leakage in affected kernel versions.
A vulnerability in the Linux kernel's drm_exec locking mechanism could cause an infinite loop when handling contended objects with zero num_objects. This occurs because drm_exec_prepare_array() returns success without properly clearing contention state when num_objects is zero, leading to a spin loop in certain driver operations such as amdgpu's userq signal/wait ioctls. The issue has been fixed by ensuring drm_exec_prepare_array() calls drm_exec_lock_contended() even when num_objects is zero to clear pending contention.
A vulnerability in the Linux kernel's generic netlink controller allows the target family's module to be unloaded while a policy dump is pending, leading to potential dereferencing of memory from an unloaded module. This issue arises because the module reference is taken for the controller's owner instead of the target family's owner during policy dumps. The flaw has been resolved by properly taking a reference to the target family's module during the dump process.
A vulnerability in the Linux kernel's filesystem freezing mechanism causes incorrect error reporting during nested thaw operations. This leads to a leaked freeze count on block devices when multiple freeze holders are involved, preventing the device from being mounted again until reboot or device destruction. The issue affects certain Linux kernel versions and disrupts block device management after freeze and thaw sequences involving device-mapper or LVM snapshots.
A use-after-free vulnerability in the Linux kernel related to improper reference handling of thread_pid during task exit has been resolved. The flaw involves releasing a PID reference too early, leading to a potential use-after-free detected by KASAN. No controlled read/write, information leak, or privilege escalation is claimed. The fix involves holding a reference to thread_pid across proc_flush_pid to prevent premature freeing. The patch applies to Linux kernel versions 6.19.y and newer, with backports needed for 6.16.y through 6.18.y.
A vulnerability in the Linux kernel's cpufreq subsystem was resolved by changing the initialization order of a semaphore (policy->rwsem). Previously, the semaphore was initialized after the sysfs directory and attributes were created, allowing sysfs access to reach a policy callback before the semaphore was ready. This could lead to improper synchronization. The fix ensures the semaphore is initialized before the policy kobject is published to sysfs.
A vulnerability in the Linux kernel's cpufreq subsystem was resolved by zero-initializing the policy cpumask before sysfs publication. The issue involved uninitialized memory being exposed in sysfs attributes due to the cpumask bitmap not being zeroed before being published, potentially causing attribute callbacks to run on an uninitialized policy. This was fixed by changing the allocation to zero-initialize the cpumask variable.
A vulnerability in the Linux kernel's bootconfig initrd size check allows an integer overflow in pointer arithmetic, leading to a bypass of bounds checking. This can cause the kernel to read excessive memory during early boot, resulting in a fatal kernel page fault. The issue affects specific linux-hwe-edge versions and has been fixed by validating initrd size and pointer bounds.
A vulnerability in the Linux kernel's Bluetooth btrtl component was resolved. The issue involved leaking an uninitialized return code when parsing firmware format v2, specifically when the key_id from the chip is zero and security headers are ignored. The flaw caused the function rtlbt_parse_firmware_v2() to leak return codes from previous sections due to improper control flow in a switch statement. This has been fixed by correctly skipping the loop iteration with a continue statement.
A vulnerability in the Linux kernel's Bluetooth subsystem (btqcomsmd driver) was resolved. The issue involves improper teardown order of RPMsg endpoints and the hci_dev device, which can lead to use-after-free conditions when callbacks access freed memory. This affects specific linux-azure kernel versions and has been addressed by changing the destruction order of endpoints and device freeing.
A vulnerability in the Linux kernel's ASoC sti driver was resolved by initializing the IRQ lock before requesting the IRQ. The issue involved the uni_reader_init() function registering a shared IRQ before the reader->irq_lock was initialized, potentially allowing a pending interrupt to invoke the handler while the lock was uninitialized.
A vulnerability in the Linux kernel's ASoC sprd driver allows local users to overflow fixed-size buffers due to improper validation of compress buffer sizes. The driver allocates fixed-size buffers but does not properly check user-controlled parameters against these sizes, enabling buffer overflows. This issue has been resolved by rejecting parameters that exceed the fixed buffer sizes and correcting the advertised maximum fragment size.
A vulnerability in the Linux kernel's ethosu accelerator driver allowed userspace to set the job SRAM size to zero while still performing SRAM accesses, causing the system to use a stale base address from a prior job. This could lead to unauthorized memory access and potential system compromise. The issue has been resolved by ensuring the SRAM region size matches the job's SRAM size.
A vulnerability in the Linux kernel's ethosu accelerator driver causes the SRAM size to remain non-zero after a mapping failure. This can lead to jobs accessing SRAM incorrectly, as the probe does not check the error return and assumes SRAM is available. This issue has been resolved in the linux-hwe-edge kernel versions listed.
A vulnerability in the Linux kernel's ethosu accelerator component was resolved by ensuring the command stream ends with a stop operation. The QSIZE register setting should prevent out-of-bounds access, but it was unclear if the hardware generated the required interrupt to prevent a timeout. The fix enforces the presence of a stop operation at the end of the command stream, as a stop operation in the middle is illogical.
A vulnerability in the Linux kernel's ethosu accelerator driver was fixed by correcting the return value handling in the ethosu_job_open() function. The issue involved improper use of WARN_ON(), which returns 0 or 1 instead of a negative error code, potentially causing incorrect error reporting. The fix drops WARN_ON() to allow the file descriptor open operation to properly pass the error code to userspace. This vulnerability affects specific versions of the linux-hwe-edge kernel.
A vulnerability in the Linux kernel's accel/ivpu component allows unbounded printing of a firmware log name field that may not be properly NUL-terminated. This can cause the kernel to output adjacent memory bytes through dmesg and debugfs firmware log output, potentially exposing sensitive information. The issue is addressed by limiting the printed characters to the fixed size of the name field, preventing out-of-bounds reads.
A vulnerability in the Linux kernel's accel/ivpu component allowed a time-of-check to time-of-use (TOCTOU) issue in firmware log buffer metadata validation. The firmware can modify log header fields in shared memory after initial validation, leading to potential out-of-bounds memory dereferences when printing logs. This issue has been resolved by snapshotting validated values to prevent re-reading from shared memory.
A vulnerability in the Linux kernel's accel/ivpu component was resolved by adding a size parameter to the ivpu_to_cpu_addr() function and validating that the entire buffer range remains within bounds. This fix prevents potential out-of-bounds access by ensuring the full buffer range [vpu_addr, vpu_addr + size) is validated.
A use-after-free vulnerability in the Linux kernel's tracing subsystem was resolved by ensuring proper undoing of trigger registration when enabling a histogram trigger fails. The flaw involved improper handling of triggers that were freed while still referenced in global lists, leading to potential memory corruption. The fix ensures that triggers remain registered until properly unregistered, preventing use-after-free conditions.