A use-after-free vulnerability in the Linux kernel's signal handling was resolved, involving a race condition during exec() calls in multithreaded processes. The flaw allowed a timer signal's queued signal to remain linked after the task was freed, potentially leading to memory corruption. The issue was fixed by changing when and how signal queues are flushed during task exit and preventing signal queueing on tasks marked as exiting.
A vulnerability in the Linux kernel's RDS over InfiniBand (rds: ib) protocol handling was resolved. The issue occurs when a peer negotiates a protocol version older than the supported compatibility version, causing a deadlock in connection shutdown due to improper lock handling. This leads to stalled RDS connection workqueues and denial of service. The vulnerability affects specific Linux kernel versions and has a CVSS score of 7.5, indicating a medium severity impact primarily causing availability disruption.
A use-after-free vulnerability in the Linux kernel's POSIX CPU timer code was resolved. The issue arises from a race condition involving the timer's firing state and expiry list management, potentially leading to use-after-free when a timer is freed while still queued. This flaw affects specific Linux kernel versions used in various Ubuntu HWE edge releases.
A use-after-free vulnerability in the Linux kernel's CIFS implementation was fixed. The flaw occurred in the cifs_chan_skip_or_disable() function when handling secondary channels no longer supported by the server. The function dropped the channel reference before safely signaling the server, potentially leading to use of freed memory. This could cause system crashes or allow an attacker to execute arbitrary code with kernel privileges.
A vulnerability in the Linux kernel's network subsystem involves improper locking of socket flags in the sock_gettstamp() function. This flaw allows a race condition where sk_flags can be modified without holding the socket lock, leading to a use-after-free scenario on UDP sockets. The issue was reported by Jungwoo Lee and Wongi Lee and results from concurrent ioctl and bind() operations racing on socket flags. This can cause premature socket freeing while references still exist, potentially leading to kernel memory corruption.
A vulnerability in the Linux kernel futex subsystem related to the handling of private hash allocation on vfork() has been resolved. The issue involves the potential to access the memory management (mm) through vfork(), which requires allocating a private hash for vfork() and other CLONE_VM users to prevent having private futex waiters before the private hash allocation. This vulnerability affects specific versions of the linux-hwe-edge kernel and has a CVSS score of 7.8, indicating a high impact on confidentiality, integrity, and availability.
A vulnerability in the Linux kernel's powerpc iommu component was fixed by correcting overflow validation in the iommu_tce_check_ioba function. The issue involved improper handling of the npages parameter, which could lead to an arithmetic overflow and potentially allow the requested range to exceed the table capacity. This flaw was addressed by properly checking npages and ensuring the entire range is within bounds.
A use-after-free vulnerability in the Linux kernel's KVM PPC Book3S HV component was fixed. The flaw involved improper reference counting in the function kvmhv_emulate_tlbie_all_lpid(), which could lead to accessing freed memory during nested guest IDR iteration. This issue affects specific Linux kernel versions and was resolved by adjusting reference counting to prevent dangling pointers.
A vulnerability in the Linux kernel's Bluetooth RFCOMM implementation could cause a socket lock inversion leading to a potential deadlock during listener cleanup. This issue arises from the order in which locks are acquired and released when closing unaccepted child sockets. The flaw has been resolved by changing the locking strategy to prevent deadlocks and rejecting new connections once cleanup starts.
A vulnerability in the Linux kernel's DSA mxl862xx driver was resolved. The issue involved the stats poll being armed before proper setup completion, allowing a poll to access freed ports after a failed setup or teardown. This could lead to use-after-free conditions causing potential confidentiality, integrity, and availability impacts. The fix ensures the poll is only armed after successful setup and properly disabled during teardown and shutdown using disable_delayed_work_sync().
A use-after-free vulnerability in the Linux kernel's virt_wifi module was resolved. The issue occurs because the operstate transfer happens before the virtual WiFi device is fully registered, leading to a potential use-after-free if registration fails. This was fixed by moving the operstate transfer to after the device linking step.
A vulnerability in the Linux kernel's NTFS driver related to improper locking during runlist updates has been resolved. The issue involved the ntfs_non_resident_attr_shrink() function not holding the required runlist write lock while freeing clusters and truncating the runlist, potentially leading to inconsistent state. The fix serializes these operations with the runlist lock to ensure proper synchronization. Additionally, ntfs_attr_map_cluster() was updated to handle rollback correctly if mapping pair updates fail, marking the volume in error if rollback fails.
A vulnerability in the Linux kernel SMB client was resolved that involved improper validation of absolute native symlink targets before NT fixups. When symlinkroot is unset, absolute targets are copied without conversion to an NT drive path, leading to buffer overflows due to incorrect assumptions about NT prefix presence. A user with write access to a mounted share could trigger these overflows, potentially causing high impact on confidentiality, integrity, and availability.
A vulnerability in the Linux kernel's netfilter flowtable component was resolved. The issue involved premature release of connection tracking (ct) references, which could lead to referencing incorrect conntrack entries in the flowtable datapath. The fix ensures the ct reference is held until the flow is released after the RCU grace period, preventing use-after-free conditions.
A vulnerability in the Linux kernel's RDMA/siw component allows an out-of-bounds write due to improper handling of fragmented header copies in the siw_get_hdr() function. This occurs when an extended DDP/RDMAP header is received across multiple TCP callbacks, causing the destination buffer to be overwritten beyond the header's end. This can corrupt receive state and lead to an out-of-bounds write.
A vulnerability in the Linux kernel's dmaengine pxa driver caused double counting of hardware descriptors due to improper handling of the descriptor count variable nb_desc. This could lead to incorrect freeing of descriptors and potential memory corruption. The issue was fixed by explicitly setting nb_desc and removing an erroneous increment in the code.
A vulnerability in the Linux kernel's wifi cfg80211 subsystem related to handling wiphy objects during network namespace destruction has been resolved. The issue occurs when moving a wiphy out of a dying network namespace fails due to allocation errors, leaving a dangling pointer that can cause kernel faults. The fix ensures interfaces that cannot be moved are removed, preventing the wiphy from being left in an invalid state.
A vulnerability in the Linux kernel's mac80211 wireless subsystem can cause a kernel BUG due to improper handling of virtual interfaces (vifs) when their network device (netdev) is unregistered. This occurs if the netdev is unregistered without going through the usual interface removal process, potentially leading to a stale interface reference and a kernel crash.
A vulnerability in the Linux kernel's wifi cfg80211 component was resolved. The issue involved improper filtering by BSS type when removing stale entries, which could cause a warning and potential instability when a rogue AP or device changed the BSS type unexpectedly. This was fixed by removing the BSS type check during stale entry removal.
A use-after-free vulnerability in the Linux kernel's wifi cfg80211 subsystem was resolved. The issue occurs when a network interface goes down during an ongoing scan, causing asynchronous cancellation confusion that leads the driver to incorrectly believe it owns the scan request, resulting in a use-after-free condition. This vulnerability affects specific linux-aws kernel versions and has a CVSS score of 7.8.