A vulnerability in the Linux kernel's Thunderbolt driver related to DisplayPort (DP) tunnel activation callback handling has been resolved. The issue involved a missing mandatory callback in the tb_tunnel_alloc_dp() function, causing a reference leak for every tunnel without a callback. This flaw also caused hibernation restore to block for up to 12 seconds. The fix enforces the callback requirement and removes the synchronous path, improving stability and resource management.
A vulnerability in the Linux kernel's mac80211 WiFi subsystem allowed proxy-path churn to cause the interface path counter to become negative, bypassing the mesh path limit (MESH_MAX_MPATHS). This flaw could let mesh path additions exceed the intended maximum. The issue was due to improper accounting of proxy paths against the shared mesh path quota. The vulnerability has been resolved by ensuring proxy paths reserve quota slots and share a 1024-entry budget with mesh paths.
A vulnerability in the Linux kernel's cw1200 WiFi driver allowed out-of-bounds reads during TX padding, leaking up to 511 bytes of kernel heap data to the device. The issue was caused by reading beyond the frame buffer when padding the transfer size for bus alignment. The vulnerability has been resolved by correctly computing padding, ensuring sufficient tailroom, and zeroing padding bytes before transfer.
A vulnerability in the Linux kernel's KVM SVM subsystem was resolved. The issue involved updating control fields on VMEXIT only if the VMRUN instruction succeeded. If VMRUN failed, certain control fields were incorrectly updated, which could lead to inconsistent virtual machine state handling. The fix ensures that control fields remain unchanged if VMRUN fails, aligning with AMD's architectural guidance.
A vulnerability in the Linux kernel's mac80211 WiFi subsystem was resolved that could cause exhaustion of mesh path quotas due to repeated failed or duplicate mesh path additions. The issue arises because the function mesh_path_add() reserves a slot before allocation and insertion, but on failure to allocate or insert, it does not release the reserved slot, leading to quota exhaustion and preventing new mesh paths from being created.
A use-after-free vulnerability in the Linux kernel's thunderbolt driver was identified and fixed. The issue occurs when a request is canceled, leading to a potential use of freed memory during control channel operations. The fix ensures that canceled requests are not rescheduled and that cleanup occurs immediately after canceling work, preventing access to released memory.
A use-after-free vulnerability in the Linux kernel's mac80211 WiFi subsystem was resolved. The flaw occurs when associating to a non-transmitted MBSSID profile, causing the code to read freed memory while processing fallback association elements. This happens because pointers to fallback parsed information are used after the parse object has been freed. The fix ensures the fallback parse result remains valid until association setup completes.
A race condition vulnerability in the Linux kernel's USB serial driver has been resolved. The issue involves tty ioctl operations racing with device hangup, potentially causing the driver to access a device that has been disconnected or powered down. This could lead to a NULL-pointer dereference during lengthy break signaling. Certain ioctls like TIOCGICOUNT and TIOCMIWAIT are not affected. The fix involves serializing callbacks with a mutex and adding checks to prevent accessing driver data after hangup.
A vulnerability in the Linux kernel's Cadence NAND interrupt handler was resolved by initializing the IRQ state before requesting the IRQ. The issue involved a race condition where the interrupt handler could access uninitialized synchronization state due to the IRQ being registered before the IRQ lock and completion object were initialized.
A vulnerability in the Linux kernel's SMB client implementation related to the handling of allocated ranges in the fallocate emulation was resolved. The issue arises because the FSCTL_QUERY_ALLOCATED_RANGES call on Windows servers may not reflect recently written data unless the data is flushed and committed first. This can lead to zero-filling of live data, causing data corruption. The fix ensures that dirty pages are written back, outstanding I/O is drained, and an SMB2 FLUSH is issued before querying allocated ranges, preventing data corruption.
A vulnerability in the Linux kernel's SMB client implementation related to server-side copy and clone operations could cause file corruption. The issue arises because the destination page cache is not properly serialized against server-side copy operations, allowing asynchronous writeback to overwrite newly copied data. This flaw has been fixed by ensuring proper locking and draining of in-flight I/O before issuing server-side copy or clone commands.
A vulnerability in the Linux kernel SMB client was resolved that involved improper handling of the pagecache when extending a file via a zero range operation. The issue caused data beyond the end of file (EOF) to remain visible after file extension, potentially exposing stale or unintended data.
A use-after-free vulnerability in the Linux kernel's iio adc ad_sigma_delta driver was resolved. The issue occurs because a buffer allocated at runtime is freed prematurely during device unbinding, while an interrupt handler can still access it, leading to potential memory corruption. The fix involves preallocating the buffer earlier so it is freed only after the interrupt handler is properly drained.
A vulnerability in the Linux kernel's Thunderbolt driver was resolved that involved accessing a DisplayPort (DP) tunnel after its DPRX read operation was canceled. The issue occurred because the code checked a cancellation flag without proper locking, allowing a callback to run on a tunnel that had already been torn down during system suspend or shutdown. This could lead to improper handling of the DP tunnel state.
A race condition vulnerability in the Linux kernel's SMB client was resolved by splitting certain bitfields in the cifsFileInfo structure into separate boolean fields. The issue involved multiple flags stored in the same byte being updated concurrently under different locks, causing potential race conditions due to read-modify-write operations on shared bytes.
A vulnerability in the Linux kernel's SMB client implementation was resolved involving improper flushing of dirty data before zeroing a file range. The smb3_zero_range() function failed to flush dirty data for zero ranges that did not reach the end of the file, potentially causing stale data to be written back after zeroing. This could lead to reading stale data where zeroed data is expected. The issue was fixed by ensuring unconditional flushing of dirty data before zeroing, aligning with similar fixes in related code paths.
A race condition in the Linux kernel's Thunderbolt driver causes a NULL pointer dereference in the tb_remove_work() function. This occurs due to improper locking around tb_free_unplugged_xdomains(), which accesses tb->root_switch without verifying it is non-NULL. The issue was identified by static analysis and has been resolved.
A vulnerability in the Linux kernel's IIO core for the kxcjk-1013 accelerometer driver allowed duplicate disable event requests to cause a runtime PM usage count underflow. This occurs because repeated disable requests improperly drop runtime PM references that were not acquired, leading to a warning. The issue has been resolved by returning early when the requested state matches the current event enable state.
A vulnerability in the Linux kernel's iio adc ad4030 driver was fixed by correcting invalid input validation for the oversampling_ratio parameter. The issue involved calculating a logarithm before validating that the input was strictly positive, which could lead to undefined behavior when zero or negative values were passed.
A NULL pointer dereference vulnerability in the Linux kernel's ade9000 ADC driver was fixed. The issue occurred when registering a divider clock with a NULL register address, causing a crash during clock registration if the ADE9000 was configured as a clock provider with an external input clock. The fix involved registering the CLKOUT as a 1:1 fixed-factor clock that does not require register access, preventing the NULL pointer dereference. This fix does not affect configurations using the internal clock.