A NULL pointer dereference vulnerability in the Linux kernel's DSA mt7530 driver affecting MT7531 and MT7621 devices has been resolved. The issue occurs because the core and IO supplies are requested only for ID_MT7530, but the removal function disables regulators unconditionally, potentially calling regulator_disable() on NULL pointers during module removal or sysfs unbind operations.
A slab-out-of-bounds read vulnerability in the Linux kernel's NFC LLCP component was resolved. The issue occurred when non-null-terminated strings were passed to debug logging functions, causing reads beyond allocated memory buffers. This was fixed by limiting the output length explicitly in the debug calls.
A use-after-free (UAF) vulnerability in the Linux kernel's net/smc subsystem was resolved. The function smcr_port_err() traversed the smc_lgr_list.list without holding the necessary lock, allowing concurrent termination of an lgr object while it was still being accessed. This could lead to dereferencing freed memory. The fix involves holding the smc_lgr_list.lock during traversal and adjusting the call order in smc_ib_gid_check().
A vulnerability in the Linux kernel's NFC LLCP implementation allowed a WKS SAP hijacking due to improper prefix matching in the nfc_llcp_wks_sap() function. The function compared only the length of the service name prefix, enabling shorter service names to match longer WKS strings incorrectly. This issue has been fixed by enforcing an exact length match before performing the string comparison.
A vulnerability in the Linux kernel NFC driver for pn533 devices allowed an out-of-bounds read due to improper validation of the ccid.datalen field from USB response frames. This could be triggered by a malicious or malfunctioning device sending crafted data. The issue was fixed by bounding the datalen value against the maximum frame size before use.
A vulnerability in the Linux kernel's nfp driver was resolved involving improper handling of IPsec RX state references under the XArray lock. The function nfp_net_ipsec_rx() released the XArray lock before safely acquiring a reference to the xfrm_state, allowing a race condition where the state could be deleted and its reference count dropped to zero. This could lead to attempts to increment a zero reference count after the state was queued for destruction. The issue arises because the asynchronous firmware invalidation and delayed garbage collection do not prevent invalid reference acquisition. The fix ensures the xfrm_state reference is taken before releasing the XArray lock, preventing the race condition.
A vulnerability in the Linux kernel's RDS networking subsystem was resolved involving incorrect sizing of a connection's path set based on the transport protocol. The issue caused mismatches between connection creation and destruction logic, leading to potential resource leaks during network namespace teardown or module unload when using RDS over TCP loopback connections.
A vulnerability in the Linux kernel's net: dsa: mt7530 driver involves improper handling of MDIO IRQ mappings. The issue arises because the regmap-irq chip that owns the interrupt domain is devm-registered and its parent interrupt is only freed after the .remove function returns. This can lead to the switch's regmap-irq thread dispatching on an already removed mapping, causing a fault due to a NULL descriptor lock. The vulnerability has been resolved by leaving the MDIO IRQ mappings to regmap-irq to manage properly.
A vulnerability in the Linux kernel's phylink component was resolved that involved improper handling of the PHY device pointer during bringup. The function phylink_bringup_phy() stored the PHY pointer before a potentially failing step, leading to stale pointers referencing freed PHY devices. This could cause subsequent operations to access invalid memory references. The issue was found in scenarios where a PHY driver arrives after switch probes, allowing a retry path that exposes this flaw. The fix involved updating the pointer only after the last failure-prone call, preventing stale references.
A vulnerability in the Linux kernel's drm/imagination component related to freelist reconstruction requests has been resolved. The issue involved unbounded access to protocol arrays due to an unchecked firmware reconstruction count. The fix clamps the count to the request capacity to prevent out-of-bounds access and maintains the firmware recovery exchange instead of dropping oversized requests without response. The flaw was identified through static analysis.
A memory leak vulnerability in the Linux kernel's NFC LLCP component was fixed. The issue involved failure to free allocated TLV nodes on certain error paths during nested netlink attribute parsing and sending. This could lead to resource leakage but does not affect normal operation paths.
A vulnerability in the Linux kernel's network subsystem (net: xps) allows an out-of-range traffic class to be used, causing a write beyond the bounds of an allocated map. This occurs when the number of traffic classes (num_tc) is lowered without clearing related arrays, leading to an out-of-bounds write in __netif_set_xps_queue(). The issue has been resolved by rejecting traffic classes that exceed the map's capacity.
A vulnerability in the Linux kernel's ip_gre module allowed enabling metadata collection on existing GRE, GRETAP, or ERSPAN devices through the changelink interface without enforcing metadata tunnel uniqueness. This could cause metadata receive entries to be overwritten or cleared improperly, breaking metadata lookup for surviving devices. The issue has been resolved by rejecting metadata mode enabling in changelink callbacks before modifying tunnel parameters.
A vulnerability in the Linux kernel's autofs subsystem caused a file reference leak in the autofs_kill_sb() function. This leak occurs when autofs_fill_super() fails before clearing a specific flag, leading to a permanent leak of the pipe struct file reference. The issue was fixed by explicitly releasing the pipe reference if it remains after autofs_catatonic_mode() is called.
A vulnerability in the Linux kernel's stmmac network driver was resolved by clearing a stale buffer page pointer after a failed skb build operation. The issue involved a stale pointer to a recycled page that could cause inconsistent buffer lifecycle management in the receive path.
A vulnerability in the Linux kernel's BPF implementation on MIPS32 was fixed. The issue involved an incorrect instruction emitted for immediate JMP JEQ/JNE operations, causing invalid comparisons when the immediate operand was negative. This was due to using an addu instruction instead of addiu, leading to misinterpretation of the immediate value as a register. The flaw affected constant blinding via BPF_REG_AX. The vulnerability was identified with test_bpf on MIPS32r1 emulated by QEMU and has been resolved.
A vulnerability in the Linux kernel's gve driver related to UDP Generic Segmentation Offload (GSO) was resolved. The function gve_can_send_tso() incorrectly calculates header length for UDP GSO packets by using a TCP header length function, leading to miscalculated segment boundaries. This can cause either unnecessary disabling of GSO or handing the device packets with segments spanning too many buffers. The fix involves using the correct UDP header length for these packets.
A vulnerability in the Linux kernel's gve driver related to TSO packet handling has been resolved. The gve_prep_tso() function did not enforce the maximum segment size (MSS) limit of 9728 bytes, assuming the hypervisor-enforced 9K MTU and 64KB TSO size limit were sufficient. However, packets not generated locally, such as those from guests behind a tap or packet socket users, could specify an arbitrary gso_size, potentially causing MSS to be set incorrectly. This could lead to MSS being zero due to a 14-bit field overflow. The fix drops such packets and adjusts feature checks to prevent improper segmentation. The issue is specific to GSO packets and MTU checks in the forwarding path and is addressed separately for non-TSO packets.
A vulnerability in the Linux kernel's NFC subsystem (st21nfca driver) related to ISO15693 inventory length validation has been resolved. The issue involved the inventory helper removing a two-byte prefix without verifying its presence, then accepting a one-byte remainder before reading data as the DSFID. The fix requires the prefix and at least two remaining bytes before processing UID data and DSFID.
A vulnerability in the Linux kernel's network subsystem related to handling deferred socket buffers (skb_defer_nodes) when a CPU goes offline has been resolved. The issue caused stranded skbs holding page_pool fragments to stall system teardown processes indefinitely. The fix ensures proper flushing of skb_defer_nodes during CPU offline events and addresses race conditions involving CPU and NUMA node teardown.