A vulnerability in the Linux kernel TCP stack involving the collapsing of socket buffers (skbs) across encryption boundaries in the retransmission queue has been resolved. The issue could cause encrypted and unencrypted data to be merged improperly, leading to potential retransmission of cleartext data or connection stalls due to dropped packets. The fix involves improved fencing and checks to prevent merging skbs with different encryption states.
A vulnerability in the Linux kernel's fsl/fman component involved a clock reference leak in the read_dts_node() function. The function of_clk_get() increments the clock's reference count but read_dts_node() reads the clock rate without releasing the reference, causing a leak. This issue has been resolved by ensuring the clock reference is released after reading the rate, including error paths.
A vulnerability in the Linux kernel's fou (foo-over-UDP) module allowed creation of a FOU_ENCAP_DIRECT socket without specifying the required FOU_ATTR_IPPROTO attribute, leading to a memory leak of sk_buff structures when receiving packets. The issue was fixed by rejecting attempts to create such sockets without the protocol attribute, preventing the leak.
A vulnerability in the Linux kernel's TIPC protocol allows invalid or unexpected GRP_ACK_MSG messages to cause an underflow of the bc_ackers counter. This underflow can lead to permanent congestion reporting and blocking of all future group broadcasts on the socket. The issue arises from improper validation of ACK messages during broadcast rounds, allowing duplicate or stale acknowledgments to decrement the counter incorrectly. The vulnerability has been resolved by dropping GRP_ACK_MSGs when bc_ackers is zero and enforcing strict acknowledgment sequence checks.
A vulnerability in the Linux kernel's GPIO character device interface could cause kernel stack data to leak to user-space in an error path. This occurs when the function gpio_desc_to_lineinfo() fails to acquire a GPIO chip guard and returns early without zeroing a data structure passed to user-space. The issue has been resolved by ensuring the structure is zeroed before use and by propagating error codes properly.
A vulnerability in the Linux kernel's kprobes subsystem caused a permanent hang when flushing the kprobe optimizer. Writing 0 to /proc/sys/debug/kprobes-optimization while a kprobe is jump-optimized results in the writer process sleeping indefinitely with a mutex held, causing subsequent reads or writes to hang. The issue stems from improper synchronization and completion handling in the optimizer flushing logic, leading to deadlock conditions.
A vulnerability in the Linux kernel's IPv6 segment routing (SR) implementation allowed an out-of-bounds read of uninitialized kernel memory due to improper length validation of the SEG6_ATTR_DST attribute. This flaw could leak kernel heap memory to userspace. The issue was fixed by enforcing exact attribute length validation, preventing malformed netlink messages from triggering the memory leak.
A use-after-free vulnerability in the Linux kernel's Nouveau DRM driver was resolved. The flaw occurs in the nouveau_uvmm_sm function when a buffer object (BO) is in the TTM_PL_SYSTEM memory placement. The code incorrectly treats a ttm_resource as a nouveau_mem structure, leading to an out-of-bounds read and a kernel slab-use-after-free error detected by KASAN.
A vulnerability in the Linux kernel's gpio: arizona driver was fixed to address a runtime power management (PM) reference leak. The issue occurred when switching a persistent GPIO line from input to output; if an internal update operation failed, the acquired runtime PM reference was not released, potentially causing resource leaks.
A vulnerability in the Linux kernel's amdgpu driver caused a runtime power management (PM) reference leak in the function amdgpu_debugfs_test_ib_show(). This leak occurs when the function's attempt to acquire a reset domain semaphore is interrupted, leading to the GPU remaining awake unnecessarily. The issue has been fixed by ensuring the runtime PM reference is properly dropped on error paths.
A vulnerability in the Linux kernel's ipv6_find_hdr() function could allow it to return an offset beyond the end of a packet. This occurs because the function skips extension headers based on their declared length without verifying that the skip stays within the packet bounds. This flaw can lead to out-of-bounds reads and writes when other kernel components, such as openvswitch, use the offset to access transport headers, potentially causing use-after-free errors. The issue has been resolved by adding bounds checking to reject headers whose declared length exceeds the packet size.
A vulnerability in the Linux kernel's drm/i915 component related to incorrect RCU teardown order has been resolved. The issue involves the i915_gem_busy_ioctl function iterating over fences in a GEM object without holding a proper reference, only the RCU read side lock. This can cause an endless loop if the GEM object is destroyed concurrently, as the iteration never finishes when encountering a destroyed dma_fence. The fix involves dropping fence references only after the RCU grace period.
A double-free vulnerability was identified and resolved in the Linux kernel's nouveau DRM driver, specifically in the nvif_vmm_dtor function. The issue occurs because the nouveau_cli_init() failure path calls nouveau_cli_fini(), which frees memory, and then nouveau_drm_open() also calls nouveau_cli_fini() again, leading to a double-free of the same memory. This was discovered through fuzz testing with a modified Syzkaller tool. The vulnerability has been fixed in the Linux kernel.
A vulnerability in the Linux kernel's nouveau DRM driver related to VRAM pinning has been resolved. The issue involved an incorrect sizing of the VRAM buffer object backing a registered memory region, causing address calculations to reference VRAM outside the intended buffer. This was fixed by sizing the buffer object to cover the entire registered region.
A vulnerability in the Linux kernel related to dm-verity root hash handling has been resolved. The function ipe_bdev_setintegrity() improperly frees the old root hash while it may still be dereferenced during policy evaluation. The fix involves protecting the root hash with RCU (Read-Copy-Update) synchronization to prevent use-after-free conditions.
A vulnerability in the Linux kernel's LLC (Logical Link Control) layer was resolved involving insufficient reservation of device headroom for allocated frames. The function llc_alloc_frame() reserved link-layer headroom based on the device type, which was inadequate for stacked Ethernet devices like VLAN devices. This could cause underflow of skb headroom in eth_header() when an LLC response is processed on such devices. The fix involved using LL_RESERVED_SPACE() to correctly account for the required headroom while maintaining the existing device-type checks.
A vulnerability in the Linux kernel's drm/nouveau component caused a gem reference leak in the validate_init() function. The issue occurs when ttm_bo_reserve() fails or a "vma not found" error happens, leading to a reference taken by drm_gem_object_lookup() not being released. This is due to the loop breaking without adding the object to any validate list, and validate_fini() only processing spliced lists. The fix involves dropping the reference before breaking out on these error paths.
A vulnerability in the Linux kernel's Direct Rendering Manager (DRM) subsystem was resolved that could cause a NULL pointer dereference when closing a DRM file descriptor. This occurs due to a partially initialized framebuffer device client remaining registered after a failed initialization, leading to an invalid restore operation. The issue results in a kernel warning and a NULL pointer dereference during cleanup.
A reference leak vulnerability in the Linux kernel's drm/nouveau driver was fixed. The issue involved pci_get_domain_bus_and_slot() taking a PCI device reference that was never released after reading memory size from config space, causing a bridge reference leak.
A vulnerability in the Linux kernel's drm/imagination driver was resolved where map failures from the pvr_mmu_map_sgl() interface were not properly propagated to the pvr_mmu_map() interface. This caused pvr_mmu_map() to continue operation instead of returning an error, potentially leading to a kernel NULL pointer dereference and system crash. The issue has been fixed by ensuring the proper error code is returned from pvr_mmu_map_sgl().