A use-after-free vulnerability in the Linux kernel's tracing subsystem was resolved. The issue occurs because the reference to a named histogram trigger is taken only after it is published to a global list, which can lead to a freed object being accessed during subsequent lookups. This flaw can cause kernel memory corruption and instability. The fix involves taking the reference before publishing the trigger, preventing access to freed memory.
A vulnerability in the Linux kernel tracing subsystem causes improper handling of error conditions during histogram stats allocation. Specifically, when allocation fails, an error code overwrites the entry count used for cleanup, leading to out-of-bounds memory access and potential kernel crashes. This issue affects specific linux-hwe-edge kernel versions and has been resolved by separating the error return from the entry count variable.
A vulnerability in the Linux kernel tracing subsystem was resolved that involved improper freeing of histogram fields when a hist trigger uses a disallowed modifier. The flaw caused memory leaks due to fields not being freed correctly on error paths. The issue was fixed by correcting the control flow to ensure fields are properly freed and not leaked. This affects specific versions of the linux-hwe-edge kernel.
A vulnerability in the Linux kernel's tracing subsystem causes a memory leak when the same variable is used three or more times in one histogram trigger. This occurs due to improper reference counting and freeing of variable references, leading to leaked variable references and associated strings when the trigger is removed. The issue has been resolved by changing the reference counting logic to free variable references unconditionally.
A memory leak vulnerability in the Linux kernel's tracing subsystem was fixed. The issue occurs when initialization of a histogram variable reference fails, causing allocated memory to be leaked because it is not properly freed. This was due to changes in how variable references are destroyed, leaving some allocated fields unmanaged on failure paths.
A vulnerability in the Linux kernel's tracing/user_events subsystem was fixed where fields of a trace event could be destroyed prematurely if event removal failed, leaving the event in an inconsistent state. This could cause subsequent interactions with the event to operate on an empty field list while the event remains visible in tracefs.
A race condition vulnerability in the Linux kernel's tick broadcast device replacement mechanism has been resolved. The issue occurs when a broadcast clockevent device is replaced without proper serialization, potentially leading to a BUG() in tick_cleanup_dead_cpu() if the original device has a restricted interrupt affinity mask and the last CPU in that mask goes offline. The fix involves serializing the device replacement operations with a lock to prevent concurrent tick broadcast operations from causing inconsistent device states.
A vulnerability in the Linux kernel's UFS filesystem code allowed unvalidated cylinder group metadata to be cached, leading to potential out-of-bounds memory accesses. The flaw involved copying cylinder group indices and rotor positions directly from disk without validation, which could cause invalid indexing during allocation and free operations. This issue was fixed by rejecting cylinder groups with inconsistent metadata before caching. The vulnerability affects specific Linux kernel versions and has a CVSS score of 7.0, indicating a medium severity.
A vulnerability in the Linux kernel's UFS filesystem code caused a kernel oops during mount failure. The issue occurs because the root dentry is created before the cylinder group metadata is fully loaded, leading to a NULL pointer dereference during error handling. This was fixed by reordering the setup to load cylinder group metadata before creating the root dentry.
A vulnerability in the Linux kernel's AMDGPU driver was resolved that involved an unnecessary VMID 0 flush operation during VRAM Clear-on-release. This spurious flush could cause the graphics engine to hang on certain hardware (GFX11, e.g., Navi33). The fix ensures the flush only occurs when a GART window is used, preventing the engine from wedging.
A vulnerability in the Linux kernel ALSA usbusx2y driver was resolved that involved processing interrupt URB data without validating the actual_length field. This could cause uninitialized heap data to be copied to a mmap-accessible array. The issue was fixed by zero-initializing the buffer and adding a check on actual_length to skip processing short transfers.
A vulnerability in the Linux kernel's ALSA usbusx2y driver involves an array size mismatch between in04_last and in04_buf, leading to a potential out-of-bounds read. The in04_last array is declared with 24 bytes, but in04_buf is allocated with 21 bytes. During initialization, 24 bytes are copied from a 21-byte buffer, reading beyond the buffer boundary. This issue has been resolved by introducing a consistent size constant for these buffers.
A vulnerability in the Linux kernel ALSA us122l driver allowed processes with read-only mappings to later upgrade those mappings to writable, potentially enabling unauthorized memory access and corruption. This was due to the hwdep mmap callback leaving VM_MAYWRITE set on read-only mappings, allowing mprotect() to make them writable. The flaw could lead to out-of-bounds memory access and improper page freeing. The issue has been resolved by clearing VM_MAYWRITE on read-buffer mappings after rejecting initially writable VMAs.
A vulnerability in the Linux kernel's tracing subsystem was resolved to prevent dereferencing a freed trace_event_file during deferred trigger free operations. The issue involved the enable_event trigger deferring a reference decrement to a kernel thread, which could access a trace_event_file that had already been freed when the instance was removed. The fix keeps the trace_event_call directly in enable_trigger_data to avoid accessing freed memory.
A use-after-free vulnerability in the Linux kernel tracing subsystem was resolved by ensuring proper reference counting when opening tracer option files. The flaw involved a race condition where an element used to find the trace array could be freed during instance removal, leading to potential use-after-free. The fix introduces a helper function to safely acquire a reference to the trace array under a lock, preventing the race condition. The vulnerability affects specific versions of the linux-hwe-edge kernel.
A memory corruption vulnerability in the Linux kernel's tracing subsystem related to the handling of the "STACKTRACE" histogram key has been resolved. The issue arises from improper handling of certain generic fields that leads to an unbounded memcpy operation, potentially causing a kernel panic due to a general protection fault. This affects specific Linux kernel versions used in the linux-hwe-edge product line.
A use-after-free vulnerability in the Linux kernel tracing subsystem was resolved by changing the order of operations when registering histogram triggers. The flaw involved registering a trigger before setting the trace clock, which could cause a freed trigger object to remain accessible, leading to a kernel memory corruption detected by KASAN. This issue affects specific versions of the linux-hwe-edge kernel.
A memory corruption vulnerability in the Linux kernel's tracing subsystem was fixed. The issue arises from improper handling of the histogram stacktrace modifier, which can lead to out-of-bounds memory access during event histogram triggering. This can cause kernel crashes such as NULL pointer dereferences. The vulnerability affects specific versions of the linux-hwe-edge kernel. The flaw is addressed by enforcing that only fields holding valid stacktraces are accepted.
A use-after-free vulnerability in the Linux kernel's ftrace subsystem related to improper initialization of the function graph state during process forking has been resolved. The issue occurs because the child's function graph state is not initialized before a fallible operation, leading to the parent's function graph return stack being freed prematurely. This can cause the parent process to access freed memory, potentially resulting in system instability or crashes. The vulnerability has a CVSS score of 7.8, indicating a medium severity level. Multiple specific Linux kernel versions are affected. A fix has been implemented to initialize the child function graph state immediately after duplicating the task structure, preventing the use-after-free condition.
A use-after-free race condition in the Linux kernel's reboot subsystem involving the cad_pid pointer was resolved. The vulnerability arises because cad_pid, a kernel-wide struct pid pointer, was accessed without proper lifetime protection, allowing a concurrent writer to free the referenced struct pid while it was still in use. This could lead to kernel memory corruption. The issue was partially mitigated by moving cad_pid to the global reboot sysctl table but required further fixes to treat cad_pid as an RCU-protected pointer and properly synchronize reference dropping. The vulnerability affects specific Linux kernel versions and was fixed by implementing RCU protection and grace period waits on the pointer. No known exploits in the wild have been reported.