A vulnerability in the Linux kernel's IP multicast routing (ipmr) subsystem allowed a network administrator in a user+net namespace to create many multicast routing tables without proper memory accounting. This caused unreclaimable slab memory growth on the host. The issue was resolved by charging mr_table allocations to memory control groups (memcg) and marking multicast forwarding cache (MFC) caches for accounting. Unresolved MFC entries remain uncharged but are bounded and expire after 10 seconds.
A use-after-free vulnerability in the Linux kernel's IPv6 fib6 walker was resolved. The issue occurs when the fib6 walker is incorrectly treated as unlinked, leading to a freed object being accessed later during route deletion. This affects the /proc/net/ipv6_route and BPF IPv6 route iterators. The vulnerability has a CVSS score of 7.8, indicating high impact on confidentiality, integrity, and availability.
A race condition vulnerability in the Linux kernel's slab allocator was resolved by ensuring proper locking to avoid list corruption. The flaw involved a classic ABA problem where concurrent operations on slab freelists could corrupt kernel linked lists, leading to kernel panic and system instability. The fix involves acquiring and releasing the n->list_lock to serialize list manipulations and prevent the race condition.
A vulnerability in the Linux kernel's x86 alternatives patching code could cause a kernel BUG and system crash due to a race condition involving text poking and change_page_attr(). This occurs when vmalloc_to_page() fails because of concurrent modifications to executable memory regions, potentially collapsing page tables or breaking hugepages. The issue affects specific Linux kernel versions and has been resolved by excluding text poking against change_page_attr() using the init_mm mmap read lock.
A use-after-free vulnerability in the Linux kernel's x86 page attribute modification logic was resolved by acquiring the init_mm write lock during page table collapse operations. This issue could cause races and use-after-free conditions when collapsing kernel page table entries into huge pages, particularly affecting components like ptdump that walk page tables concurrently. The vulnerability affects specific linux-hwe-edge kernel versions and has been fixed by ensuring proper locking.
A vulnerability in the Linux kernel's x86 Control Flow Integrity (CFI) implementation related to FineIBT hash offset handling has been fixed. The issue was caused by an incorrect offset used in the cfi_get_func_hash() function, leading to a mismatch in the hash read from the FineIBT preamble. This caused the kernel to fail CFI checks and crash when making the first indirect call into a BPF struct_ops program, such as during TCP congestion control initialization. The fix aligns the offset definitions to ensure consistent hash reading.
A vulnerability in the Linux kernel's x86 memory management subsystem causes user-space data loss when using MADV_FREE with Transparent Huge Pages (THP). The issue arises because the pmd_modify() function incorrectly clears the hardware dirty bit, leading to data being discarded under memory reclaim pressure despite being rewritten. This affects both anonymous and file-backed PMD-mapped THPs. The bug has been fixed by adjusting pmd_modify() to preserve the dirty bit similarly to related functions.
A vulnerability in the Linux kernel's x86/amd_node component related to PCI device reference counting in the amd_smn_init() function has been resolved. The issue involved improper handling of reference counts for temporary pointers during PCI device searches, which could lead to incorrect reference counting. The fix ensures proper incrementing and decrementing of reference counts to maintain accurate device usage tracking.
A vulnerability in the Linux kernel's x86/amd_node component could cause a NULL pointer dereference due to improper handling of the amd_roots pointer when amd_smn_init() fails. This issue arises because amd_smn_read/write() functions remain available even if initialization fails, leading to potential access of uninitialized memory. The vulnerability has been addressed by reordering initialization steps and simplifying logic to directly check amd_roots instead of relying on a redundant flag.
A vulnerability in the Linux kernel's powerpc/eeh subsystem caused recursive locking on devices without EEH sensitive drivers, leading to potential hangs in the EEH daemon. This issue arises when error detection occurs on the PHB directly or when a device's driver signals a reset is needed but lacks EEH error handlers. The problem was introduced by a code refactor that failed to remove redundant locking, causing the EEH daemon to deadlock.
A vulnerability in the Linux kernel's configfs subsystem involving improper handling of dentries during directory removal (rmdir) has been resolved. The issue arises because the dentry remains hashed after simple_rmdir() returns, leading to a use-after-free condition when configfs_symlink() resolves its target without holding a lock. This can cause a kernel slab-use-after-free bug. The fix involves unhashing the dentry before dropping the item to prevent this unsafe window.
A vulnerability in the Linux kernel's configfs subsystem involves improper handling of symlink target directory entries (dirents). The issue arises because the code pins the item reference but not the dentry, which can be released prematurely during removal operations. This can lead to a race condition where a symlink races with the removal of its target directory, causing a use-after-free condition and triggering kernel warnings.
A vulnerability in the Linux kernel's iSCSI target implementation causes a hang when a WRITE_PENDING command is aborted by a LUN_RESET. The abort path deadlocks because the target does not complete the aborted command properly, leading to a stuck target worker thread. This issue has been fixed by explicitly completing the command upon receiving the final dataout PDU for aborted writes.
A vulnerability in the Linux kernel's sunvdc driver causes a permanent leak of map table entries when the descriptor send fails during I/O operations. This leak leads to exhaustion and fragmentation of the fixed-size map table, resulting in large multi-segment requests failing and the disk becoming unusable until reboot. Retry attempts worsen the leak by orphaning previous mappings. The issue has been resolved by rolling back the mapping on failure and properly resetting the descriptor state.
A vulnerability in the Linux kernel's stmmac network driver affects the TX descriptor availability check for TCP Segmentation Offload (TSO) traffic. The flaw causes an underestimation of the number of transmit descriptors required, potentially leading to buffer overwrites and corruption of the TX ring. This issue has been resolved by improving the descriptor count calculation to accurately reflect the descriptors needed for headers, payload fragments, and MSS context. The vulnerability impacts specific Linux Azure kernel versions.
A vulnerability in the Linux kernel's RDS TCP implementation caused TCP stream corruption on systems with large page sizes. The issue arises because rds_message_map_pages() assigns PAGE_SIZE bytes to each scatterlist entry even when the total length ends in a partial page, leading to bytes beyond the congestion map being transmitted and corrupting the RDS stream. This was fixed by limiting the final scatterlist mapping to the remaining bytes, allowing RDS-TCP to function correctly on systems with page sizes larger than 8 KB.
A vulnerability in the Linux kernel's mana network driver was resolved that involved improper handling of the XDP program pointer when pre-allocation of RX buffers fails. The issue occurs because the new XDP program pointer is published before buffer allocation, and if allocation fails, the previous pointer is not restored. This can lead to use of freed memory when the system attempts to add a reference to the freed BPF program. The vulnerability is triggered by a standard command to set an XDP program on a network device when RX buffer pre-allocation cannot be satisfied.
A deadlock vulnerability in the Linux kernel's net_failover component was fixed in the net_failover_slave_name_change() function. This issue was addressed by changing the locking mechanism to prevent deadlocks during network device name changes. The vulnerability affects specific versions of the linux-hwe-edge kernel. No CVSS score is provided, but the impact is assessed as medium severity.
A buffer overflow vulnerability in the Linux kernel's hinic network driver was resolved. The issue arises because the check_mbox_seq_id_and_seg_len() function allows the last mailbox segment to carry a payload that overflows the receive buffer by 16 bytes. This can lead to a heap buffer overflow. The hinic3 driver already implements a fix by rejecting oversized last segments, and this fix was applied to the hinic driver as well.
A vulnerability in the Linux kernel's net/sched cls_api subsystem was resolved to prevent excessive CPU usage and system hangs caused by repeated RTM_GETCHAIN requests on netlink sockets without reading responses. The issue arises when tc_ctl_chain() replays RTM_GETCHAIN requests unnecessarily, leading to CPU hogging and a hung task state. The fix restricts replay logic to RTM_NEWCHAIN requests only. This vulnerability affects specific versions of the linux-hwe-edge kernel.