A vulnerability in the Linux kernel's Industrial I/O (iio) subsystem related to buffer teardown and mode claims has been resolved. The issue involved improper synchronization during buffer teardown in iio_device_unregister(), which could invalidate buffer state while a buffer-mode claim was held. The fix ensures proper locking order to maintain buffer-mode claim guarantees during device unregister operations.
A vulnerability in the Linux kernel's iio proximity driver for aw96103 was resolved by improving validation of firmware data length. The firmware parser previously could read beyond the buffer or interpret an underflowed length as a very large value, potentially causing out-of-bounds reads. The fix involves validating header size, rejecting underflowed lengths, and ensuring the payload fits within the firmware image.
A race condition vulnerability in the Linux kernel's KVM s390 architecture code related to storage key functions has been fixed. The issue involves potential concurrent splitting of large pages leading to crashes due to improper handling of pointers in dat_cond_set_storage_key() and related functions. The fix involves safer pointer access using READ_ONCE and retrying operations if a race is detected.
A vulnerability in the Linux kernel's iio pressure bmp280 driver caused an out-of-bounds access due to incorrect indexing of the sampling frequency lookup table. The issue arose because the code treated a flattened frequency table as a two-dimensional array without properly converting the element count to the number of rows. This flaw has been resolved by correcting the indexing logic.
A divide-by-zero vulnerability in the Linux kernel's bpf_struct_walk() function has been fixed. The issue occurs when accessing past a struct with a flexible array member whose element type has zero size, causing a divide-by-zero error at program load time. This flaw can trigger a kernel error and crash when loading certain BPF programs.
A vulnerability in the Linux kernel's iio adc xilinx-xadc driver was resolved by changing the order of resource management to free IRQ before cancelling the unmask worker on unbind. This prevents the IRQ handler from queuing work after the associated data structure has been freed, which could cause use-after-free conditions.
A vulnerability in the Linux kernel's KVM s390 subsystem was resolved by adding a missing SRCU lock in the function kvm_s390_set_irq_state(). This fix aligns with similar locking requirements in related functions to ensure proper synchronization during Store status operations.
A vulnerability in the Linux kernel's KVM s390 subsystem related to the _gaccess_shadow_fault() function has been resolved. The issue occurs when a nested guest memory page being shadowed is not present in the parent guest gmap, causing dat_entry_walk() to fail and erroneously propagate an error to userspace. The fix involves manually calling gmap_link() on the nested guest memory if the mapping was missing.
A vulnerability in the Linux kernel's iio: imu: adis16400 driver involved unprotected debugfs reads due to improper handling of debugfs file operations. The issue was that adis16400_serial_number_fops did not call debugfs_file_get(), causing debugfs_remove_recursive() to not wait for ongoing reads before unbinding and freeing the device, potentially leading to use-after-free conditions. The vulnerability was fixed by changing the debugfs file creation method to debugfs_create_file(), aligning with other similar drivers and ensuring proper protection of debugfs reads.
A vulnerability in the Linux kernel's iio frequency driver (adf4377) was resolved by fully initializing the clk_init_data and clk_parent_data structures. The issue arose because some members of these structures were left uninitialized, which could cause crashes when certain kernel configuration options (CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE) were enabled. The fix ensures all members are properly initialized to prevent such issues.
A vulnerability in the Linux kernel's KVM implementation for RISC-V was resolved by correcting the order of updates to the nested HFENCE (hfence) entry. The issue involved writing the Config word before updating the Page_Number and Page_Count, which could cause incorrect TLB flush ranges due to stale values being observed. The fix ensures the page number and count are written first, followed by the Config word, using memory barriers to prevent reordering.
A vulnerability in the Linux kernel's net/sched cls_u32 component causes improper handling of manual hash table handles, leading to permanent memory leaks and potential misrouting of network traffic. The issue arises because manual hash tables use a different key domain than auto-allocated tables, causing aliasing and incorrect deletions. This flaw has been fixed by aligning the key domains and rejecting manual handles that conflict with existing IDs.
A vulnerability in the Linux kernel's fbnic Ethernet driver was fixed involving improper cleanup of the payload page pool when allocation fails. The error pointer was incorrectly passed to the cleanup function, potentially causing a dereference of an error pointer and leaving the header page pool allocated.
A vulnerability in the Linux kernel's amd_sfh driver was resolved by validating the PCI BAR 2 size before mapping. The driver previously accessed memory offsets beyond the actual size of BAR 2 without validation, causing out-of-bounds memory access and potential page faults during device probing.
A use-after-free (UAF) vulnerability in the Linux kernel's BPF memory allocator was fixed. The flaw arises from a race condition due to concurrent access to ttrace lists without proper synchronization, leading to potential memory corruption. The issue was identified by repeated triggering of UAF errors by Syzkaller. The fix introduces a raw spinlock to synchronize concurrent consumption of specific linked lists used in BPF memory allocation.
A vulnerability in the Linux kernel's SCSI subsystem (sd_zbc) was resolved that involved improper handling of disks reporting an excessively large number of zones. The function sd_zbc_read_zones() used 64-bit arithmetic but stored the result in a 32-bit unsigned integer, causing silent truncation of zone counts exceeding 32 bits. Additionally, sd_zbc_report_zones() used a signed integer to count zones, which could overflow if the device reported more than INT_MAX zones. The fix rejects devices reporting more than INT_MAX zones at scan time, as such devices are unrealistic and cause inconsistent zone bookkeeping.
A vulnerability in the Linux kernel's KVM arm64 implementation related to the handling of the Scalable Vector Extension (SVE) feature on virtual CPU initialization failure has been resolved. The issue involved improper clearing of VM-wide SVE feature flags, causing subsequent vCPUs to skip SVE setup and potentially leading to a NULL pointer dereference during the guest's first floating-point access. The fix ensures that the error is returned without modifying the vcpu_features state.
A vulnerability in the Linux kernel's KVM arm64 implementation was resolved by improving validation of the SVE vector length in the pkvm_vcpu_init_sve() function. The issue involved insufficient validation of the host-provided sve_max_vl value, which could lead to a fatal condition at EL2 due to an invalid vector length causing a WARN_ON() trigger. The fix ensures that sve_vl_valid() is checked before calculating the state size, preventing invalid lengths from causing kernel faults.
A use-after-free vulnerability in the Linux kernel's HID winwing driver was resolved. The issue involved improper freeing of driver private data, leading to double free and slab corruption during device teardown events such as unbind, module removal, hot-unplug, and system suspend. The fix changes the force-feedback context handling to prevent invalid frees.
A vulnerability in the Linux kernel's BPF subsystem involving the __htab_map_lookup_and_delete_batch() function could cause a soft lockup on systems with many CPUs and large hash maps. The issue arises because the function lacks rescheduling points during batch operations, leading to prolonged CPU occupancy and triggering the soft lockup watchdog. This has been fixed by adding rescheduling points to avoid long CPU hold times during batch lookups and deletions.