A use-after-free vulnerability in the Linux kernel's network bridge multicast database (MDB) handling was resolved. The issue occurs when the br_mdb_flush_pgs() function walks through port groups and a deletion causes the cursor to point to freed memory, leading to a stale pointer dereference. This can be triggered by an RTM_GETMDB operation, resulting in a kernel slab-use-after-free error detected by KASAN.
A vulnerability in the Linux kernel's DHCP option construction was resolved. The function ic_dhcp_init_options() appends DHCP options including hostname, vendor-class, and client-ID into a fixed-size buffer without proper bounds checking for hostname and vendor-class options. This can cause a buffer overflow when large option sizes are used, potentially leading to kernel panic during boot if CONFIG_FORTIFY_SOURCE and panic_on_warn=1 are enabled. The fix routes options through a helper that ensures size limits are respected, preventing buffer overruns.
A vulnerability in the Linux kernel's Open vSwitch conntrack implementation could lead to use-after-free (UAF) conditions when cloned skb packets with unconfirmed connection tracking entries are committed with different extension sets. This issue arises from modifying shared unconfirmed ct entries during commit operations. The fix involves resetting the entry to prevent sharing and modification conflicts. No known practical network pipelines require committing both clones without modifications in the same zone, and no known exploits are reported.
A use-after-free vulnerability in the Linux kernel's drm/nouveau driver was resolved by changing the freeing method of the nouveau_sched struct to use RCU (Read-Copy-Update) mechanisms. The issue involved a scheduler fence that could reference freed memory, leading to a kernel memory access error. This vulnerability could be triggered by unprivileged users accessing sync file information, causing a kernel slab-use-after-free read.
A NULL pointer dereference vulnerability in the Linux kernel's drm/virtio driver was resolved. The issue occurs when virtio_gpu_fence_alloc() fails due to memory pressure and returns NULL, but the caller functions do not check for this failure. This leads to a NULL pointer dereference in virtio_gpu_fence_event_create(), causing a kernel crash (general protection fault). The flaw was discovered through fuzz testing with Syzkaller and affects the virtio GPU driver component.
A vulnerability in the Linux kernel's PCI device tree handling was resolved. The issue occurs when a PCI bridge device lacks a subordinate bus, causing certain dynamic device tree helper functions to dereference a null pointer. This can lead to a NULL pointer dereference and an early boot hang when the PCI dynamic device tree nodes feature is enabled. The fix ensures that 'bus-range' and 'interrupt-map' properties are only generated if a subordinate bus exists, preventing the null dereference. The vulnerability was introduced in kernel version 6.15 and affects configurations with CONFIG_PCI_DYNAMIC_OF_NODES enabled.
A memory leak vulnerability in the Linux kernel's drm/virtio driver was fixed. The issue occurs when an execbuffer operation fails, leaving a DRM fence event allocated but never freed, causing a permanent memory leak. This happens because the event is reserved early but not cancelled on error paths, and the driver loses the pointer to free it. The flaw was discovered via fuzzing with Syzkaller and affects the virtio_gpu_execbuffer_ioctl() function.
A vulnerability in the Linux kernel's nouveau DRM driver was resolved that involved incorrect handling of pin counts when a re-pin operation failed. Specifically, the function nouveau_bo_pin_locked() would increment the pin count even when the re-pin failed due to incompatible memory domains, leading to a mismatch in pin/unpin operations and triggering warnings in the kernel. This issue was discovered through fuzz testing and could cause kernel warnings related to resource management.
A vulnerability in the Linux kernel's memory management subsystem related to huge page table entry (PTE) updates has been resolved. The issue involves the damon_hugetlb_mkold() function, which updates page table entries without properly handling concurrent hardware-driven updates, potentially causing loss of hardware-updated bits such as dirty bits. The fix avoids parallel updates by clearing the page table entry atomically during read operations. Since hugetlbfs is an in-memory filesystem and huge pages cannot be reclaimed, no critical impact is expected. The vulnerability was discovered by Sashiko and has been addressed in the Linux kernel.
A vulnerability in the Linux kernel's packet TX_RING handling was resolved by switching to a standard zerocopy completion mechanism to prevent premature reuse of ring slots. The issue involved skb->destructor being called early, causing ring slots to be reused while still linked to socket buffers, potentially leading to memory corruption or data integrity issues. The fix ensures slots are only released once all references to the payload are freed or copied, improving stability and correctness in packet transmission.
A race condition vulnerability in the Linux kernel's drm/xe virtual memory management was resolved. The issue involved premature destruction of page tables (PTs) before contested VMAs (virtual memory areas) were unlinked, leading to a NULL pointer dereference when concurrent threads accessed shared buffer objects. This could cause kernel crashes due to dereferencing a NULL pointer in xe_pt_zap_ptes(). The fix defers destruction of PTs until after all contested VMAs are safely unlinked and destroyed.
A vulnerability in the Linux kernel's memory management subsystem related to huge pages has been resolved. The issue involves the function dissolve_free_hugetlb_folio() not properly checking for gigantic pages without runtime support, leading to improper freeing of memory folios and potential corruption of the free list during rollback operations.
A vulnerability in the Linux kernel's perf subsystem was resolved by fixing a NULL pointer dereference issue in the perf_pmu_sched_task() function. The flaw involved passing a NULL pmu_ctx pointer to pmu->sched_task(), causing a kernel oops on certain ARM architectures. The patch corrects this by passing the CPU-wide context instead of a potentially NULL task context pointer.
A vulnerability in the Linux kernel's SCSI UFS core was resolved that involved internal commands becoming non-dispatchable during error handling, causing a deadlock. The issue arose because internal commands were dispatched on a pseudo SCSI device queue that was quiesced along with regular logical units, leading to an unrecoverable circular wait. The fix ensures that while logical units remain quiesced during error recovery, the pseudo device queue for internal commands is unquiesced to keep those commands dispatchable, preventing deadlock.
A benign race condition in the Linux kernel's KVM arm64 implementation caused spurious warnings during stage 2 page table teardown. The issue arises when concurrent operations on stage 2 page tables race, triggering a warning that is not indicative of an actual error. The fix updates the code to suppress these false warnings while preserving warnings for other genuine error conditions.
A vulnerability in the Linux kernel's s390 vfio-ap subsystem related to KVM interrupt and page resource handling has been resolved. The issue involves improper handling of the AP_RESPONSE_Q_NOT_AVAIL response code during queue removal from the host's AP configuration when assigned to a mediated device. This leads to resource leaks of KVM GISC registration and pinned guest pages. Additionally, a logic flaw in resource cleanup could cause a potential double-free condition. The fix addresses these issues by properly handling the response codes and ensuring resources are freed correctly.
A vulnerability in the Linux kernel's NFC port100 driver allowed out-of-bounds reads due to improper validation of frame length fields. The driver did not verify that the declared frame length matched the actual received data length, leading to potential buffer over-read. This issue has been resolved by rejecting frames whose declared length exceeds the received data before validation.
A vulnerability in the Linux kernel NFC subsystem's LLCP receive handler was resolved. The function nfc_llcp_recv_hdlc() reads a sequence byte from a packet without verifying the packet length first, potentially accessing uninitialized memory. This occurs because the receive path only guarantees a two-byte LLCP header, but the sequence byte read happens before confirming the packet is long enough. The fix adds a length check to ensure the sequence byte is only read if present, dropping truncated PDUs without processing them.
A NULL pointer dereference vulnerability in the Linux kernel's s390 architecture was fixed in the function ccw_device_get_util_str(). This issue occurs when the channel path registry entry for a CHPID is removed while the subchannel's PMCW still references that CHPID, causing a function to return NULL and leading to a NULL pointer dereference. The fix adds a missing NULL check before dereferencing the pointer.
A vulnerability in the Linux kernel's NFC driver for the trf7970a device was resolved. The issue occurs when the trf7970a_startup() function powers up the device before applying an optional RX gain reduction. If a register read or write fails, the function returns without powering down the device, leaving the device in an unintended powered-on state. This can cause unbalanced power references and improper device state management. The fix ensures that trf7970a_power_down() is called on error to properly deassert enable GPIOs and restore the powered-off state. The vulnerability was found during static analysis of kernel code.