A use-after-free (UAF) and memory leak vulnerability in the Linux kernel's LLC (Logical Link Control) component was resolved. The flaw occurs when the function llc_mac_hdr_init() fails, leading to incorrect freeing of socket buffers (skb) and leaking of newly allocated buffers (nskb). This can cause double-free and use-after-free conditions in specific error paths.
A vulnerability in the Linux kernel's perf subsystem related to branch entry handling has been resolved. The issue involved improper clearing of bitfields in the perf_branch_entry struct, leading to uninitialized data being exposed in certain ARM64 configurations. The fix assigns the entire entry at once to ensure all fields are properly initialized. This vulnerability affects the ARM64 architecture and does not impact x86. No CVSS score is available for this issue.
A use-after-free vulnerability in the Linux kernel's bcmgenet network driver was resolved. The issue occurs because the transmit (Tx) NAPI is stopped after disabling the Tx queues, allowing a transmit operation to access freed memory. This was observed on a Raspberry Pi CM4 during suspend operations triggered by an MTU change. The fix involves stopping Tx NAPI before disabling the queues to prevent use-after-free conditions.
A refcount leak vulnerability in the Linux kernel's perf subsystem was fixed in the attach_perf_ctx_data() function. The issue arises due to a race condition between global and non-global cases when attaching performance context data, potentially causing a reference count leak. This can lead to resource management issues within the kernel's performance monitoring infrastructure.
A vulnerability in the Linux kernel's VLAN handling was resolved by ensuring sufficient headroom in the vlan_dev_hard_header() function. The issue involved callers reserving insufficient headroom, which could trigger skb_under_panic() due to inadequate buffer space. The fix uses skb_cow_head() to guarantee enough headroom and applies concurrency-safe reads of device header length parameters to avoid race conditions during VLAN header processing.
A race condition vulnerability in the Linux kernel's NFC LLCP socket handling was resolved. The flaw involved concurrent unlinking and releasing of the same child socket due to improper synchronization between socket release and accept dequeue operations, leading to potential use-after-free or NULL pointer dereference. The fix replaces a bottom-half lock with a process-context lock, defers final resource release to a workqueue to avoid sleeping in atomic context, and adds safeguards to prevent object resurrection and listener hangs. The vulnerability affects the NFC LLCP socket lifecycle and was addressed with multiple synchronization and lifecycle management improvements.
A vulnerability in the Linux kernel's NFC driver for the ST21NFCA chip was resolved. The function st21nfca_hci_i2c_repack() improperly handles received frames by trimming at the EOF marker before removing byte stuffing, leading to unsafe assumptions about frame contents. Malformed frames can cause the function to read beyond buffer boundaries, potentially leading to memory corruption. The fix enforces minimum framing byte requirements and corrects the byte unstuffing logic to reject malformed frames.
A vulnerability in the Linux kernel's NFC LLCP socket handling was resolved. The flaw involves improper locking and unlinking of sockets in the nfc_llcp_recv_dm() function, leading to list corruption and reference count desynchronization. This can cause kernel socket objects to leak without being freed, potentially resulting in memory exhaustion and denial of service. The issue affects local unprivileged processes interacting with LLCP sockets and receiving specific DM messages from remote peers. The fix involves proper locking and unlinking of sockets to prevent double reference decrements and list corruption.
A vulnerability in the Linux kernel's cgroup cpuset subsystem allowed remote_partition_enable() to enable remote partitions on CPUs already claimed exclusively by ancestor local partitions, causing conflicting CPU assignments. This was due to a change that replaced an error check with a warning, allowing the conflict to proceed. The issue was fixed by restoring an error return when such conflicts occur, preventing overlapping exclusive CPU claims.
A use-after-free vulnerability in the Linux kernel SCTP implementation occurs when processing a bundled ERROR(Stale Cookie) and DATA packet from a non-primary address during the COOKIE-ECHOED state. The flaw allows the kernel to reference a freed transport object, potentially leading to memory corruption. This issue is triggered by a malicious SCTP peer or local unprivileged user without special capabilities. The vulnerability has been resolved by discarding the rest of the packet upon detecting the stale-cookie error, preventing use of the freed transport reference.
A vulnerability in the Linux kernel's workqueue subsystem was resolved that involved a NULL pointer dereference in the flush dependency check. The flaw occurred because the check_flush_dependency() function dereferenced worker->current_pwq without ensuring it was non-NULL, which could happen when a kworker thread was not executing a work item. This could lead to a kernel warning or potential instability during memory reclaim operations.
A vulnerability in the Linux kernel's fprobe component was resolved involving improper termination of the fgraph_data list when a reservation is not filled. The issue caused fprobe_return() to misinterpret unused shadow stack space as valid headers, potentially causing an exit handler to run twice or run despite being skipped. The fix involves writing a zero word after the last entry to properly terminate the list and prevent incorrect parsing.
A vulnerability in the Linux kernel's af_packet subsystem involves an integer overflow in the prb_calc_retire_blk_tmo() function. This overflow can cause a negative timeout value to be used in a high-resolution timer, resulting in a timer that fires continuously at maximum rate. This behavior can cause a CPU to spin indefinitely in a softirq context, effectively leading to a denial of service. The issue arises from 32-bit integer arithmetic overflow when calculating block size timeouts, triggered by user-controlled parameters. The vulnerability has been resolved by changing the calculation to use 64-bit arithmetic.
A vulnerability in the Linux kernel's bna driver was resolved that involved improper handling of IOC timers during teardown. Specifically, certain IOC timers were not properly shut down, leading to potential use-after-free conditions when timer callbacks accessed freed memory structures. The fix involved shutting down all four IOC timers synchronously to prevent rearming after teardown.
A vulnerability in the Linux kernel's NTFS3 filesystem driver related to inode creation and locking has been resolved. The issue involved improper use of d_instantiate() in ntfs_create_inode(), leading to lock state corruption and potential deadlocks during concurrent mount and directory creation operations. The fix replaces d_instantiate() with d_instantiate_new() and removes a problematic unlock_new_inode() call. This resolves warnings and lock underflow conditions observed during certain race conditions.
A vulnerability in the Linux kernel arm64 architecture related to trapping PMZR_EL0 writes to EL2 has been resolved. The issue arises because PMZR_EL0 is write-only and its trap bit exists only in HDFGWTR2_EL2, which was never set, causing a write from the host to trap to EL2 where the hypervisor lacks a handler and triggers a BUG(). This can cause the host to crash without a panic message when kernel.perf_user_access=1 is enabled and a user-read event is set. The fix involves properly accumulating the HDFGWTR2_EL2 bits and setting the nPMZR_EL0 trap bit correctly.
A vulnerability in the Linux kernel's ATA passthru sense descriptor handling was resolved. The flaw allowed a faulty or malicious ATAPI device to cause out-of-bounds read and write operations beyond a 96-byte buffer when processing ATA PASS-THROUGH command failures. This was due to improper trust in the sense buffer's additional length byte, leading to unchecked buffer length calculations and descriptor writes. The issue was confirmed with Kernel Address Sanitizer (KASAN) testing and fixed by bounding the sense descriptor writes properly.
A vulnerability in the Linux kernel related to the writeback subsystem's handling of Tasks-RCU quiescent states during cgroup writeback (cgwb) drain passes has been resolved. The issue causes the drain loop to never report a Tasks-RCU quiescent state on certain kernel preemption models, leading to long-running worker tasks that can stall other kernel operations and potentially cause system panics. The fix involves calling cond_resched_tasks_rcu_qs() to avoid stalling synchronize_rcu_tasks() calls.
A vulnerability in the Linux kernel's writeback mechanism involving the cleanup_offline_cgwb() function has been resolved. The issue caused rescans of inodes to be quadratic in complexity due to repeated scanning of inodes that remain on the list, leading to potential soft lockups with CPUs stuck for extended periods. The fix changes the scanning approach to linear by reordering inodes during processing, preventing excessive rescanning and improving performance.
A vulnerability in the Linux kernel related to BPF LSM programs attached to path_unlink and path_rmdir hooks allows mutation of victim inode extended attributes (xattrs) without holding the required inode lock. This occurs because the verifier incorrectly assumes the inode is locked, leading to potential unsafe modifications. The issue has been resolved by dropping the problematic hooks from the locked inode hooks list, ensuring the locking variants of the functions are used.