A vulnerability in the Linux kernel driver for the Kionix KX022A accelerometer (iio: accel: kionix-kx022a) has been resolved. The issue involved a memory leak when regmap operations failed during the buffer enable path, causing allocated memory not to be freed. Additionally, hardware state and configuration were not properly reverted on error, potentially leaving interrupts and buffers enabled incorrectly. The fix ensures memory is freed and hardware state is restored on error.
A vulnerability in the Linux kernel's ADE9000 ADC driver was resolved by correcting the handling of Phase C dip events in the IRQ1 handler. The issue was due to an off-by-one error in scanning event bits, which caused the highest event bit (bit 25) representing Phase C dip events to be ignored and never reported.
A vulnerability in the Linux kernel's SMB client was resolved involving improper discarding of the pagecache when extending a file via clone range. The issue caused the folio overlapping the old end-of-file (EOF) to retain data beyond the EOF, which could become visible as file content after the file was extended.
A vulnerability in the Linux kernel's Thunderbolt driver allows a heap out-of-bounds read due to improper handling of oversized XDomain properties responses. The driver allocates a fixed-size buffer but does not properly validate the length field in the response, which can be set maliciously to exceed the buffer size. This causes the driver to read beyond the allocated memory when copying data, leading to a 12-byte heap out-of-bounds read. The issue has been resolved by rejecting response data lengths that exceed the allocated source buffer before copying.
A vulnerability in the Linux kernel's Thunderbolt driver caused a domain reference leak when a DisplayPort (DP) receiver (DPRX) read operation was canceled. This leak could block driver unbinding indefinitely due to a completion wait that never finishes. The issue arises when a DP tunnel is torn down before the DPRX read completes, such as unplugging within a timeout period. The fix involves changing the ownership of the domain reference to the work itself, ensuring proper reference counting and preventing leaks or hangs during driver removal.
A vulnerability in the Linux kernel's iio adc pac1934 driver related to ACPI label duplication has been resolved. The issue involved a failure to properly handle duplicate ACPI labels, which could lead to accessing a missing label. The fix ensures that the ACPI result is released and the operation aborted before accessing the missing label, preventing potential errors. This vulnerability was detected through static analysis and reviewed with AI-assisted source auditing.
A vulnerability in the Linux kernel's iio proximity pulsedlight driver was fixed. The issue involved the iio_device remaining registered in the system after a power management setup failure during device probe, leading to sysfs and character device nodes pointing to freed memory. This could cause use-after-free conditions. The fix unregisters the iio device properly on error to prevent stale references.
A vulnerability in the Linux kernel's iio pressure driver for rohm-bm1390 sensors caused the data reading function to ignore cached error values and always return 0, even when a read operation failed. This could lead to user-space applications receiving invalid data without indication of failure. The issue has been resolved by modifying the function to return the cached error value after stopping the measurement, ensuring that users are informed if a read fails and that invalid data is not silently propagated.
A vulnerability in the Linux kernel's sun4i-gpadc-iio driver was resolved. The issue involved improper cleanup when thermal zone registration failed during device probing, leading to resources like the IIO map array and runtime PM not being released properly. This could cause resource leaks or unstable device states.
A use-after-free vulnerability in the Linux kernel's iio light sensor driver (gp2ap020a00f) was resolved. The issue occurs because the threaded IRQ handler queues work that may run after free_irq() has been called, potentially accessing freed memory. The fix adds synchronization to ensure queued work is drained after free_irq(), preventing use-after-free.
A use-after-free vulnerability in the Linux kernel's Industrial I/O (iio) trigger subsystem was resolved by ensuring that deferred work is canceled before the trigger is freed. The issue involved a deferred reenable_work task that could access freed memory, potentially causing instability or crashes.
A vulnerability in the Linux kernel's perf subsystem allowed unprivileged tasks to open perf events with text poke sideband records without requiring kernel access. This could leak kernel text base addresses despite Kernel Address Space Layout Randomization (KASLR). The issue has been resolved by enforcing kernel access requirements for events with text_poke enabled.
A vulnerability in the Linux kernel's iio light driver for the rohm-bu27034 sensor caused an infinite delay when reading the integration time failed. The issue occurred because the error code was incorrectly used to compute sleep time, leading to an infinite delay. This has been fixed by defaulting to the smallest integration time if reading fails.
A vulnerability in the Linux kernel's KVM subsystem for s390 architecture involved improper handling of a NULL pointer in the dat_cond_set_storage_key() function. This could lead to a NULL pointer dereference when certain callers pass NULL as oldkey to page_cond_set_storage_key(). The issue has been resolved by adding a NULL check and assigning a dummy local variable to prevent crashes.
A vulnerability in the Linux kernel's stm32-adc driver could cause a division by zero error when processing ADC channel data if the conversion fails or returns zero. This occurs because the code does not properly check for error conditions or zero values before performing division. The issue has been fixed by adding checks to treat zero or failed conversions as invalid data.
A vulnerability in the Linux kernel's iio adc adi-axi-adc driver was resolved by initializing a previously uninitialized mutex. The issue involved the AXI ADC register access paths that serialize transactions using a lock which was not initialized during probe, potentially leading to improper synchronization.
A vulnerability in the Linux kernel's iio: imu: adis16480 driver involved unprotected debugfs reads. The firmware_revision and firmware_date file operations did not properly use debugfs_file_get(), causing debugfs_remove_recursive() to not wait for ongoing reads. This could lead to the iio_dev device being freed while still in use. The issue was fixed by replacing debugfs_create_file_unsafe() with debugfs_create_file().
A vulnerability in the Linux kernel's Industrial I/O (iio) buffer handling was resolved. The function iio_push_to_buffers_with_ts_unaligned() could leak uninitialized heap memory to userspace when data length was not a multiple of 8 bytes and timestamping was enabled. The issue was fixed by ensuring the bounce buffer is zeroed using __GFP_ZERO during memory allocation.
A vulnerability in the Linux kernel's iio gyro driver (adis16136) related to unprotected debugfs reads has been resolved. The issue stems from the serial_number file operations not calling debugfs_file_get(), which is required by debugfs_create_file_unsafe(). This causes debugfs_remove_recursive() to not wait for ongoing reads, potentially leading to use-after-free conditions when the device is unbound. The fix involves replacing debugfs_create_file_unsafe() with debugfs_create_file().
A NULL pointer dereference vulnerability in the Linux kernel's max30102 interrupt handler was resolved. The issue occurs when an interrupt arrives while no buffer is enabled, causing the handler to dereference a NULL active_scan_mask pointer. This can lead to a kernel crash due to the NULL pointer dereference. The fix involves checking the FIFO sample readiness at the start of the interrupt handler and returning early if no data is available, preventing the NULL dereference.