A use-after-free vulnerability in the Linux kernel Bluetooth mesh management subsystem was resolved. The flaw occurs when a mesh transmission object is freed but a queued work entry retains a pointer to it, leading to use-after-free during later processing. The fix involves properly dequeuing pending entries before freeing and ensuring the transmission queue advances correctly to avoid deadlocks.
A vulnerability in the Linux kernel's xsk_map_gen_lookup function was resolved. The issue involved improper comparison of a 32-bit key with max_entries using a sign-extended 64-bit immediate, which could cause the bounds check to be bypassed. This allowed out-of-range index access leading to a read past the xsk_map array. The fix involved using a 32-bit unsigned comparison to maintain correct bounds checking.
A vulnerability in the Linux kernel's BPF subsystem on arm64 architecture was resolved by properly setting the frame pointer for the exception callback. The flaw caused the callback prologue to omit setting the frame pointer register, leading to potential use of stale stack frame pointers from subprograms that never return. This could allow a helper function to overwrite its own return address, potentially causing a kernel panic or fatal exception. The fix ensures the frame pointer register is correctly set on the exception callback path, preventing this unsafe condition.
A vulnerability in the Linux kernel's SquashFS implementation allows a shift-out-of-bounds operation when mounting an abnormal SquashFS image with a COMP_OPTS flag set to 1 but a dictionary size of 0. This occurs due to missing validation on the dictionary size before performing bit-shift operations, which can lead to an invalid negative shift exponent. The issue has been resolved by adding a dictionary size range check prior to the shift operation.
A vulnerability in the Linux kernel's BPF sock_ops program allowed an out-of-bounds read of the rtt_min field due to improper type checking. This flaw caused the program to read beyond the end of a request_sock structure by casting it incorrectly to a tcp_sock, potentially leaking kernel memory. The issue was fixed by adding proper checks to ensure the socket is a full tcp_sock before reading rtt_min.
A vulnerability in the Linux kernel's SCSI block subsystem allowed an out-of-bounds write due to improper bounds checking on zone report data. The issue occurred when a device reported more zones than the allocated array size, particularly when the zone count exceeded 32 bits, causing array undersizing and potential memory corruption. The flaw was fixed by adding index bounds checking and refusing to revalidate when the zone count does not fit in 32 bits.
A vulnerability in the Linux kernel Bluetooth btnxpuart driver caused a memory leak when CONFIG_DEV_COREDUMP was disabled. Specifically, the function hci_devcd_append() returned an error without freeing a cloned socket buffer (skb), leading to a leak and preventing a recovery function from being called. This issue has been fixed by adding a guard to the function call based on the CONFIG_DEV_COREDUMP configuration.
A vulnerability in the Linux kernel s390/uv subsystem could cause an out-of-bounds read when the system has more than 85 secrets. This occurs because the uv_secret_list struct array holds only up to 85 items per page, but the code incorrectly loops over the overall count of secrets rather than the per sub-list count. This flaw has been resolved by correcting the loop to use the per sub-list count of stored secrets.
A race condition vulnerability in the Linux kernel's KVM s390 subsystem was fixed by using READ_ONCE() in the _destroy_pages_crste() function to prevent multiple dereferences of a pointer. This fix addresses a concurrency issue that could lead to inconsistent behavior during page destruction.
A vulnerability in the Linux kernel's TCP stack was resolved involving a call to cond_resched() within inet_csk_listen_stop() under BPF context. The issue occurs when bpf_sock_destroy() runs under rcu_read_lock() and triggers a debug check due to a sleeping function being called from an invalid context. The fix involves skipping cond_resched() in this specific listener path to avoid rescheduling within the iterator's rcu_read_lock() context.
A vulnerability in the Linux kernel's BPF subsystem related to ownership depth through local kernel pointers (kptrs) and graph roots has been resolved. The issue allowed program-allocated objects to form arbitrarily deep chains via self-referential local kptrs, potentially exhausting the kernel stack during object destruction. The fix bounds the ownership walk depth to prevent such deep or cyclic chains, improving validation during BPF Type Format (BTF) load time.
A vulnerability in the Linux kernel's bpf_crypto_ctx_create() function allowed reading beyond the validated buffer size due to improper parameter size checking. This could lead to the kernel accessing memory outside the intended bounds. The issue was fixed by moving the size check before reading reserved fields.
A vulnerability in the Linux kernel's drm/virtio component caused an object reference leak when drm_gem_handle_create() failed. The error path incorrectly called drm_gem_object_release(), which does not decrement the reference count, leading to resource leaks including shmem pages, scatter-gather tables, and host-side resources. This issue has been resolved in the Linux kernel.
A vulnerability in the Linux kernel's BPF subsystem allowed non-negative offsets in stack_slot_obj_get_spi(), which could cause incorrect validation of pointers referencing the BPF stack. This flaw could enable a kernel function to interpret memory outside the BPF stack as iterator state, potentially leading to unintended behavior. The issue has been resolved by rejecting non-negative offsets before converting them to stack pointer indices.
A vulnerability in the Linux kernel's net/sched subsystem (sch_hfsc) allowed a classification walk to enter an infinite loop under certain conditions, causing a soft lockup. This occurs when two classes bound at different levels point to each other, leading to a stuck traversal with the qdisc lock held and BH disabled. The issue can be triggered by unprivileged users with CAP_NET_ADMIN via unshare -Urn. The fix bounds the classify walk with a drift budget to prevent infinite loops and drops packets with a warning once the budget is exhausted.
A vulnerability in the Linux kernel's drm/bridge samsung-dsim driver was fixed by correcting the handling of the TE GPIO lifetime during host attach operations. The issue involved improper management of GPIO descriptors leading to potential resource mismanagement when the DSI host was detached and reattached without device destruction.
A vulnerability in the Linux kernel's fbnic network driver related to flushing the firmware mailbox Rx ring has been resolved. The issue involved improper handling of the AW_FLUSH and AW_FLUSH_MODE bits during mailbox teardown, which caused staged write requests to remain in the pipeline indefinitely. This could prevent the flush operation from completing as expected. The fix sets both AW_FLUSH and AW_FLUSH_MODE bits to ensure staged writes drain correctly while maintaining device stability. The read path is unaffected by this issue.
A use-after-free vulnerability in the Linux kernel's drm/virtio component was resolved by ensuring proper release of GEM objects on errors in virtio_gpu_vram_create(). The flaw caused freed objects to remain referenced in an interval tree, potentially leading to invalid memory accesses and unreleased locks.
A vulnerability in the Linux kernel's drm/virtio component caused object leaks in the virtio_gpu_resource_create_blob_ioctl() function due to improper reference handling. The function incorrectly calls drm_gem_object_release() on error paths instead of drm_gem_object_put(), preventing the free callback from running and leading to resource leaks. This issue has been resolved by correcting the reference drop method.
A vulnerability in the Linux kernel Bluetooth driver (btintel_pcie) was resolved that involved improper validation of device-supplied DMA indices. The driver used a 16-bit device-controlled value as an array index without bounds checking, allowing out-of-bounds memory access. Additionally, a loop could become infinite due to unvalidated indices. The issue was fixed by adding bounds checks and logging invalid values.