A vulnerability in the Linux kernel's ovpn UDP output fallback mechanism was resolved by changing how stale local source addresses are cleared. The issue involved clearing bind->local in place, which could cause torn IPv6 addresses due to concurrent lockless reads. The fix retries route lookup without modifying the bind, revalidates under lock, resets the cache, and publishes a replacement bind with a wildcard address. This prevents inconsistent routing cache states.
A vulnerability in the Linux kernel's MTK Ethernet driver was resolved where net_devices were not properly unregistered on probe failure, causing a kernel BUG due to freeing devices still marked as registered.
A livelock vulnerability in the Linux kernel SCTP implementation was resolved. The function sctp_assoc_update_retran_path() could enter an infinite loop when all transports, including the retransmit path, were in the SCTP_UNCONFIRMED state. This occurred because the loop termination condition did not properly account for this state, causing the function to loop indefinitely. The fix ensures the loop termination is independent of transport state and restores a NULL guard to prevent invalid retransmit path assignments.
A vulnerability in the Linux kernel's ovpn module related to local endpoint learning has been resolved. The issue involved unsafe in-place updates to the local endpoint bind structure, leading to potential torn reads of IPv6 addresses during concurrent updates. The fix replaces the bind structure when learning a new local endpoint to ensure safe publication and synchronization.
A vulnerability in the Linux kernel's Bluetooth RFCOMM implementation was resolved. The flaw involved improper length checks for certain RFCOMM frames with extended length fields, allowing malformed frames to be processed incorrectly. This could lead to malformed data being treated as valid payload or control commands. The issue was fixed by enhancing the length validation logic in the rfcomm_recv_frame() function.
A vulnerability in the Linux kernel's drm/virtio component caused an object leak in the function virtio_gpu_resource_create_ioctl(). The issue arises because drm_gem_object_release() is called incorrectly on an error path, preventing the proper freeing of resources. This leads to leaks of virtio_gpu_object, its pages, scatter-gather table, resource ID, and host-side resource. The fix involves using drm_gem_object_put() to correctly drop the reference and free the object.
A vulnerability in the Linux kernel's fbnic Ethernet driver related to incorrect usage of the Rx queue NAPI pointer has been resolved. The issue involved the queue management code incorrectly mapping Rx queues to Tx NAPI vectors when standalone Tx vectors were present, potentially causing use of freed memory or invalid pointers during queue restart or PCIe recovery scenarios. The fix uses the correct napi pointer stored in netdev_rx_queue.napi, ensuring safe queue management under locking. No CVSS score is available for this issue.
A vulnerability in the Linux kernel's ethtool ioctl self test was resolved. The issue involved the offline self test tearing the network interface down and back up without holding the required rtnl_lock, which is necessary for safe device reconfiguration. This could lead to warnings or assertion failures during the self test on ops-locked drivers such as fbnic and bnxt. The fix adds an opt-in bit for drivers needing rtnl_lock during the self test to ensure proper locking.
A vulnerability in the Linux kernel's fbnic network driver involves improper handling of the num_napi counter when napi vectors are freed during suspend and resume operations. This can lead to a kernel NULL pointer dereference and crash when the network device is removed or unbound after certain failure scenarios in PCIe error recovery or resume open failures. The issue is resolved by clearing the num_napi count when the vectors are freed, preventing use-after-free dereferences.
A vulnerability in the Linux kernel's BPF verifier related to packet pointer displacement handling has been resolved. The regsafe() function did not preserve displacement between registers sharing a packet pointer ID, allowing an out-of-bounds packet access. The fix requires matching range bases for packet pointers with the same ID to prevent unsound bounds checks.
A vulnerability in the Linux kernel's Bluetooth BNEP implementation allowed out-of-bounds reads on short RX/TX frames and control fallthrough. The issue was fixed by adding proper length checks before accessing frame headers and preventing unintended fallthrough in control frame processing.
A vulnerability in the Linux kernel's fbnic network driver related to handling maximum standalone channels has been resolved. The issue involved an incorrect allocation of NAPI vectors for Tx and Rx queues, causing NULL pointer dereferences during resource setup in certain configurations.
A vulnerability in the Linux kernel's USB network driver for catc devices was resolved by properly bounding the RX packet length in the catc_rx_done() function. The flaw allowed crafted packet headers to cause out-of-bounds reads, potentially leading to reading uninitialized memory or buffer overflows. The fix involves stricter validation of packet lengths and rejecting malformed packets, preventing runt packets from being processed.
A vulnerability in the Linux kernel's Generic UDP Encapsulation (GUE) implementation involving the REMCSUM option has been resolved. The issue arises from an underflow in checksum offset calculations, which can lead to a buffer overflow when processing certain forwarded packets. This flaw could cause skb_copy_and_csum_dev() to write two bytes beyond the intended buffer boundary. The fix involves rejecting invalid REMCSUM offset tuples to enforce correct ordering and prevent exploitation.
A use-after-free vulnerability in the Linux kernel's netfilter flowtable component was resolved by changing the order of state flag updates to prevent premature freeing of flow objects during concurrent garbage collection.
A use-after-loop vulnerability in the Linux kernel's drm/nouveau/clk component was resolved. The issue occurs in the nvkm_clk_ustate_update function when a list traversal exits without a break, causing an invalid pointer dereference. This can lead to an out-of-bounds read when userspace requests an invalid pstate id via debugfs. The flaw was fixed by introducing a 'found' variable to ensure pointer validity.
A concurrency vulnerability in the Linux kernel's netfilter nfnetlink_queue subsystem has been resolved. The issue involved improper serialization between the release notifier and the config netlink function, allowing concurrent threads to cause a general protection fault (kernel crash) due to race conditions during socket close and unbind operations. The fix enforces serialization to prevent parallel UNBIND and URELEASE events, addressing the root cause of the crash.
A vulnerability in the Linux kernel's BPF CO-RE relocation handling has been resolved. The issue involved improper poisoning of instructions when a relocation could not be resolved, allowing malformed metadata to replace critical instructions such as jumps, calls, and exits. The fix restricts poisoning to only valid relocatable instructions and enforces strict validation checks, preventing invalid instruction modifications.
A vulnerability in the Linux kernel's BPF verifier was resolved by making post-verification instruction rewrites interruptible. Previously, after verification, certain instruction rewrite passes could take a long time and were not preemptible, causing a task to be unkillable during this period. The fix introduces cancellation and rescheduling points during these rewrites, allowing a killed loader to be terminated promptly.
A vulnerability in the Linux kernel's net/sched subsystem related to the act_ct module has been resolved. The issue involved a WARN triggered on benign failures of flow_offload_alloc(), which occur under normal load conditions and are not kernel bugs. When panic_on_warn=1, an unprivileged user could cause a kernel panic by racing a conntrack flush against a 'tc ... action ct commit' classifier. The fix removes the WARN without changing behavior, preventing unintentional panics.