A vulnerability in the Linux kernel's BPF verifier has been resolved. The issue involves improper handling of PTR_TO_PACKET pointers passed to mutating subprograms, where packet memory may be invalidated unexpectedly. The fix rejects BPF code that passes PTR_TO_PACKET pointers to subprograms that may mutate the packet, preventing unsafe memory access.
A vulnerability in the Linux kernel's tg3 driver was resolved involving improper cleanup of PHYLIB resources on probe failure. The tg3_get_invariants() function can register an MDIO bus and connect a PHY for USE_PHYLIB devices, but if tg3_init_one() fails afterward, the error path does not properly release these PHYLIB resources. The fix ensures the PHY is disconnected and the MDIO bus unregistered before completing teardown, preventing resource leaks.
A vulnerability in the Linux kernel's IPv6 routing code allowed a reference cycle to form between fib6_info structures and exception routes during route removal, causing resource leaks and stalling network device unregistration. This was due to improper handling of exception insertion for dying fib6_info objects. The issue has been resolved by adding a check to prevent new exceptions from being inserted during fib6_info destruction.
A use-after-free vulnerability in the Linux kernel SCTP implementation was resolved by changing the order of operations in timer handlers. The flaw involved calling mod_timer() before taking a reference on the association or transport, which could lead to a race condition causing a reference count underflow and potential kernel memory corruption.
A vulnerability in the Linux kernel's skb_pointer_if_linear() function caused an unsigned integer underflow in bounds checking for skb-backed BPF dynptrs. This underflow led to incorrect pointer calculations, potentially backing dynamic pointers with invalid memory. The issue has been resolved by preventing underflow and overflow in the arithmetic checks.
A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) sock context code generation was fixed. The issue involved incorrect handling of the rx_queue_mapping field, where the code used 64-bit move instructions that could cause the register to hold values outside the verifier's assumptions. This discrepancy could lead to unexpected runtime values. The fix ensures the read value width matches the assumed size by using 32-bit move instructions and correctly reporting the destination variable size.
A vulnerability in the Linux kernel's FireWire cdev component involving improper state transitions in the iso_resource_auto client resource has been resolved. The issue allowed the state to incorrectly transition backwards due to concurrent access, potentially causing inconsistent resource management.
A vulnerability in the Linux kernel's spacemit network driver was resolved involving improper handling of TX descriptors on fragment mapping failure. The emac_tx_mem_map() function prematurely marks TX descriptors as owned before all buffer fragments are successfully mapped. If a fragment mapping fails, the cleanup path does not clear the descriptor memory, leaving stale DMA addresses that can be reused incorrectly. This can cause the DMA engine to fetch unmapped, invalid addresses. The fix ensures descriptors are cleared properly on mapping failure.
A vulnerability in the Linux kernel's NFC driver (nfcmrvl) was resolved by validating the helper command length before processing. The flaw involved reading the helper command before confirming the packet length, allowing malformed short frames to be accessed improperly. The fix ensures the complete helper command length is validated before removing the NCI data header.
A vulnerability in the Linux kernel's IPv6 routing code causes a memory leak of destination cache (dst) objects for uncached routes due to a race condition in list handling when devices are unregistered. This flaw can lead to resource leaks tied to network devices. IPv4 is not affected by this issue. The vulnerability has been resolved by changing the detection method for uncached routes and fixing the race condition in list operations.
A vulnerability in the Linux kernel's UDP socket handling was resolved, where a disconnected UDP socket bound to a specific address and port remained in the 4-tuple hash table. This stale entry caused the kernel to continue processing packets through the 4-tuple lookup unnecessarily. The issue affected both IPv4 and IPv6 sockets, with a related but separate IPv6 defect not addressed here. The fix involves removing the socket entry from the hash table before disconnection completes, preventing stale entries and potential lookup inefficiencies.
A vulnerability in the Linux kernel's fbnic Ethernet driver was resolved by correcting how zero ring sizes are handled. The function roundup_pow_of_two() is undefined for zero, and ethtool allowed a zero ring size to reach the driver, bypassing the minimum-size check. The fix ensures zero ring sizes remain unchanged during rounding, allowing the minimum-size check to reject zero deterministically without affecting other values.
A potential stack information leak vulnerability in the Linux kernel's net/sched subsystem was identified and resolved. The issue involved the em_text_dump() function allocating a struct on the stack without zero-initializing it, leading to uninitialized bytes being copied into netlink responses. This was detected by KMSAN during testing but its practical security impact is uncertain. The vulnerability arose after replacing strncpy() with strscpy(), which does not zero-pad the destination buffer. The fix involves zero-initializing the struct to prevent leakage.
A vulnerability in the Linux kernel's net: usb: sr9700 driver was resolved by correcting the length check to include receive overhead. The issue involved improper validation of payload length against the receive buffer, potentially leading to incorrect memory operations during packet processing. The flaw was identified through static analysis and has been fixed.
A vulnerability in the Linux kernel's BPF sockmap implementation allowed creation of sockmaps with max_entries greater than INT_MAX, leading to a signed integer overflow during map freeing. This caused out-of-bounds memory access and potential memory corruption or kernel crashes. The issue was triggered by setting max_entries to UINT_MAX (0xffffffff).
A NULL pointer dereference vulnerability in the Linux kernel's s390/debug component was fixed. The issue occurs in debug_info_copy() when debug_register_static() fails and clears certain pointers but leaves area bounds unchanged, leading to dereferencing NULL pointers during area copying operations.
A vulnerability in the Linux kernel's network stack related to skb_checksum_setup_ipv6() has been resolved. The issue involves an underflow in the pull-bound calculation when parsing IPv6 extension headers, which can lead to a negative delta being passed to skb_copy_bits(), potentially causing an excessively large copy operation. This flaw arises when the skb linear area is larger than MAX_IPV6_HDR_LEN and the parser attempts to access data beyond this area. The fix involves passing the requested length directly to prevent the delta from becoming negative.
A race condition vulnerability in the Linux kernel's net: libwx Tx timestamp handling was resolved. The issue involved improper synchronization of shared skb pointers between transmission, timestamp worker, and cleanup paths, potentially causing double frees or reference leaks. A dedicated spinlock was introduced to serialize access and prevent these race conditions. This fix addresses stability and memory management issues in the affected kernel component.
A time-of-check to time-of-use (TOCTOU) race condition was identified and resolved in the Linux kernel's VXLAN implementation. The vulnerability occurs because vxlan_na_create() samples the headroom size twice, allowing a concurrent vxlan_changelink() to modify the headroom between reads. This can cause an out-of-bounds write when the Ethernet header is written, potentially leading to memory corruption. The issue was detected by KASAN during testing and has been fixed by snapshotting the headroom once for allocation and reservation.
A vulnerability in the Linux kernel's IPv6 networking code related to handling MAC header space in dst_dev_overhead() has been resolved. The issue occurs when the MAC header length exceeds the reserved space, such as with VLAN devices with reorder_hdr off, causing a negative offset and out-of-bounds memory write during skb_mac_header_rebuild(). This affects seg6, ioam6, and rpl lightweight tunnels. The fix ensures the function returns the larger of the two header size values to prevent memory corruption.