A use-after-free vulnerability in the Linux kernel's ipe component was resolved. The issue occurred when auditing a newly loaded policy, where a concurrent delete could free the policy while it was still in use, leading to potential memory corruption. The fix involves auditing the policy load under the appropriate lock to prevent this race condition.
A vulnerability in the Linux kernel's MCTP socket implementation allowed any MCTP socket within the same network namespace to use and consume another socket's preallocated tag. This issue was due to iterating over a namespace-wide tag list instead of the socket's own tag list in the mctp_lookup_prealloc_tag() function. The flaw has been resolved by restricting tag iteration to the socket's own tag list, preventing unauthorized tag usage.
A use-after-free vulnerability in the Linux kernel's rds_ib_map_frmr() function was resolved. The issue occurs when DMA mapping fails but the scatterlist pointer remains stored in the memory region (MR) structure, leading to a dangling pointer. This can cause local privilege escalation detected by KASAN during MR teardown.
A use-after-free and multi-container mapping gap vulnerability in the Linux kernel's drm/amdkfd component has been resolved. The issue involves kfd_dev_mapping caching the address_space of only the first /dev/kfd opener, leading to a dangling pointer after the first container exits and stale mappings for subsequent containers. This can cause GPU reset hangs and stale doorbell/MMIO page mappings accessible to guest users, risking PCIe transaction timeouts and NMI panics. The fix involves redirecting all openers' file mappings to a single anonymous inode's address_space owned by the module, preventing dangling pointers and ensuring all mappings are correctly unmapped during GPU reset.
A vulnerability in the Linux kernel's gpio driver for the Zynq platform causes a runtime power management (PM) usage counter leak when pm_runtime_get_sync() fails during gpio request. This leak prevents the controller from runtime-suspending, leaving its clock enabled unnecessarily. The issue is fixed by switching to pm_runtime_resume_and_get(), which increments the usage counter only on success.
A use-after-free (UAF) vulnerability in the Linux kernel's openvswitch conntrack helper was resolved. The issue involved a raw pointer to the extensions area being stored in an expectations list before all extensions were fully added, leading to potential invalid pointer dereferences when extensions were reallocated. The fix ensures helpers are called only after all extensions are added. The vulnerability does not provide atomicity guarantees and leaves marks and labels set similarly to previous behavior on helper rejection or confirmation failure.
A use-after-free vulnerability in the Linux kernel's HID alps driver was resolved. The flaw occurs when input device registration fails, causing a freed pointer to still be referenced, potentially leading to memory corruption. The fix involves only storing the input device pointer after successful registration and adding a null check to prevent dereferencing freed memory.
A vulnerability in the Linux kernel's atl1e network driver caused a soft lockup due to an out-of-range hardware pointer read during PCIe link or MAC reset. This issue was fixed by treating the out-of-range value as no new data to clean, preventing an infinite loop.
A vulnerability in the Linux kernel's HID alps driver was resolved by adding a proper remove handler. The issue involved a second input device ('DualPoint Stick') being allocated and registered without proper tracking and unregistration on device removal, causing a resource leak. The fix adds a remove handler that stops the device and unregisters the second input device to prevent leaks.
A vulnerability in the Linux kernel's atl1 network driver caused a soft lockup due to an out-of-range read of cmb_tpd_next_to_clean. This occurs when the hardware reports an invalid value (0xffff) during PCIe link or MAC reset, causing an infinite loop in the driver. The issue has been resolved by treating the out-of-range value as indicating no new data to clean.
A vulnerability in the Linux kernel's drm/nouveau driver caused a runtime power management (PM) reference leak in the nouveau_connector_detect() function. If the function nvif_outp_edid_get() fails, nouveau_connector_detect() would return early without releasing the runtime PM reference, causing the device to remain powered on unnecessarily until the next successful detection. This issue has been fixed by ensuring the runtime PM reference is properly balanced on all error paths.
A vulnerability in the Linux kernel's hid-oxp driver was resolved by changing the removal function to use cancel_delayed_work_sync() instead of cancel_delayed_work(). The previous approach allowed delayed work callbacks to continue running concurrently with device teardown, potentially accessing the HID device after it was closed and stopped. This fix ensures that any in-progress work completes before the device is torn down.
A reference leak vulnerability in the Linux kernel's mlx5 network driver was resolved. The issue involved a failure to drop a reference when a reverse entry's counter was already being released, causing the reverse entry to remain alive indefinitely. This was fixed by ensuring the reference is properly dropped to prevent the leak.
A vulnerability in the Linux kernel's mlx5e driver caused swapped IPv6 IPsec policy masks, leading to incorrect hardware rules for IPv6 XFRM policies. This flaw resulted in source and destination prefix masks being applied to the wrong address fields, potentially causing traffic to be incorrectly matched or missed by IPsec policies. The issue has been resolved by correcting the mask installation to match the appropriate address fields.
A race condition in the Linux kernel's memory management subsystem (anon_vma handling) on arm64 servers can cause a deadlock or hung task due to a missing memory barrier between anon_vma initialization and publication. This leads to use-after-free of anon_vma->root, causing inconsistent locking states and potential indefinite blocking of tasks.
A vulnerability in the Linux kernel's macb network driver was resolved by fixing memory leaks related to dma_alloc_coherent() during error handling in macb_alloc(). The issue involved leaking transmit (Tx) and receive (Rx) buffers when allocations failed or crossed a 4GB boundary. The fix ensures allocated buffers are properly stored and freed during error cleanup.
A vulnerability in the Linux kernel's ARP ioctl handling was resolved by ensuring the device name field is properly NUL-terminated before lookup. Without this termination, a string comparison function could read beyond the intended memory boundary, potentially causing an out-of-bounds read.
A use-after-free vulnerability in the Linux kernel's airoha network driver was resolved by changing the order of work cancellation and IRQ release. The issue involved the watchdog IRQ handler potentially scheduling work after the associated memory was freed, leading to a use-after-free condition. The fix involves registering the work with devm_work_autocancel before requesting the IRQ, ensuring proper resource cleanup order.
A vulnerability in the Linux kernel's atl1c network driver caused a soft lockup due to an out-of-range tpd_cons read. The hardware can report an invalid tpd_cons value (0xffff) during PCIe link or MAC reset, causing an infinite loop and CPU soft lockup. This issue was reproduced on systems using Qualcomm Atheros AR8151 v2.0 NICs, triggered by rebooting a Mikrotik CCR2004 PCIe card. The problem manifests as a transmit queue timeout and a stuck CPU thread in the atl1c_clean_tx function.
A vulnerability in the Linux kernel's HID wacom driver was fixed to prevent an out-of-bounds (OOB) read in the function wacom_wac_pen_serial_enforce(). The flaw allowed reading memory beyond the intended report buffer due to improper handling of usage counts in HID descriptors, potentially leading to information disclosure. The issue was verified and resolved by clamping the loop to the actual report count, preventing invalid memory access.