A vulnerability in the Linux kernel's KVM SEV implementation related to cache maintenance during intra-host VM migration has been resolved. The issue involved the lack of manual cache maintenance on the source VM after it is converted to a non-SEV VM, potentially leaving stale data in CPU caches. This could occur because KVM's memory reclaim flows do not trigger cache maintenance in this scenario. The fix ensures manual cache maintenance is performed on the source VM to prevent stale data exposure.
A vulnerability in the Linux kernel's netfilter nf_tables subsystem involves improper handling of expired catchall elements during insert and delete operations. Expired catchall elements become invisible to userspace dumps but still block re-insertion attempts, causing silent failures or errors. This can lead to stale entries persisting until garbage collection occurs, potentially causing catchall rules to stop matching unexpectedly. The issue affects the logic for detecting duplicates and deleting elements, resulting in inconsistent behavior between userspace visibility and kernel state.
A vulnerability in the Linux kernel's KVM arm64 implementation caused a WARN on unknown VM ioctl calls in protected mode, which could lead to a panic on hosts configured with panic_on_warn. This issue occurs because the function kvm_pkvm_ioctl_allowed() triggers a WARN when an ioctl number is not found in vm_ioctl_caps[], and the architecture-specific ioctl handler calls this for unrecognized ioctl numbers. Userspace can trigger this by issuing an ioctl with an arbitrary number, causing the host to become tainted and potentially panic.
A vulnerability in the Linux kernel's s390 PCI subsystem was fixed by ensuring a missing device lock is held in the zpci_report_status() function when the device pointer (pdev) is non-NULL. This fix prevents inconsistent device driver state during recovery by expanding the critical section protected by the device lock and adding lockdep assertions.
A vulnerability in the Linux kernel's libiscsi_tcp component allows improper handling of Data-In PDUs during WRITE commands. The flaw causes the initiator to write target-supplied data into the caller's own memory pages without verifying the data direction, potentially leading to data corruption. This occurs because the Data-In branch of iscsi_tcp_hdr_dissect() does not check if the command is reading before copying data, unlike the iscsi_tcp_r2t_rsp() function. The issue affects both O_DIRECT and buffered writes, with the latter silently corrupting page cache data.
A vulnerability in the Linux kernel's netfilter ip6t_rt module allowed out-of-bounds reads due to improper handling of zero-address non-strict matches. This flaw could cause kernel panics or memory safety warnings when processing crafted IPv6 packets with specific routing addresses. The issue has been resolved by rejecting invalid rules and correcting loop termination conditions in the affected code.
A vulnerability in the Linux kernel s390 architecture involving confusion between virtual and physical addresses has been fixed. The issue related to the measurement block address being treated incorrectly, causing firmware to use wrong addresses when storing extended format channel measurement data on kernels built with CONFIG_RANDOMIZE_IDENTITY_BASE=y. The fix involves defining certain fields as dma64_t and adding the missing virt_to_dma64() translation to ensure correct address usage.
A vulnerability in the Linux kernel's KVM SEV implementation involves improper freeing of the 'have_run_cpus' cpumask during virtual machine destruction, even if the VM is no longer using SEV. This issue arises because an SEV VM becomes a non-SEV VM if it is intra-host migrated, but the cpumask is still unconditionally freed in the VM destroy path. The flaw could lead to use-after-free conditions if the mask is not properly nullified. The vulnerability has been resolved by ensuring the cpumask is freed unconditionally during VM destruction.
A use-after-free vulnerability in the Linux kernel's NFC subsystem was resolved by refactoring functions to safely copy data into caller-provided buffers before releasing references. The issue involved improper lifetime management of a local pointer leading to potential use-after-free conditions.
A vulnerability in the Linux kernel's ena driver was resolved that involved a memory leak of a coherent DMA buffer during probe failure. Specifically, if ena_probe() fails after ena_device_init() succeeds, the allocated MMIO read buffer is not properly freed, leading to a resource leak. This was fixed by ensuring the buffer is destroyed in the probe error path.
A vulnerability in the Linux kernel's SMB client was resolved involving improper handling of compound mids during send failures. When a compound request fails to send, the system incorrectly manages mids on the pending queue, leading to double decrementing of in-flight credits and kernel warnings. This issue was identified during SMB2 negotiation when socket send failures occur.
A vulnerability in the Linux kernel's XFS filesystem was resolved, addressing multiple bugs in the xlog_recover_iunlink_bucket function related to cursor and pointer handling during inode unlink recovery. These bugs included use-after-free conditions, memory leaks, and the creation of loops in the unlinked inode list. The issues could cause improper inode unlinking behavior but were mitigated by immediate flushing of unlinked inodes.
A NULL pointer dereference vulnerability in the Linux kernel's Bluetooth RFCOMM implementation was resolved. The flaw occurs in the RFCOMM_CONNINFO getsockopt handler when it dereferences a NULL session pointer due to improper handling of deferred setup sockets after disconnection. This can cause a kernel crash (general protection fault) when getsockopt is called on an accepted socket after the remote side disconnects. The issue arises because the session pointer is cleared while the defer_setup flag remains set, leading to unconditional dereference without a race condition. The vulnerability was fixed by restricting the exception to a specific socket state and verifying the session pointer before use.
A vulnerability in the Linux kernel's XFS filesystem was resolved involving improper handling of the dquot flush lock. The function xfs_qm_flush_one failed to release the dquot flush lock if it could not find the buffer to flush, potentially causing a lock to remain held indefinitely. This issue was identified and fixed by ensuring the lock is dropped even when no buffer is found.
A vulnerability in the Linux kernel scheduler's extended scheduling code (sched_ext) has been resolved. The issue involves incorrect handling of the SCX_RQ_IN_WAKEUP flag derived from enqueue flags, leading to deferred actions not being scheduled properly. This can cause an immediate (IMMED) task insert to remain pending behind the running task, potentially resulting in a use-after-free scenario when the scheduler is disabled and the deferred actions reference freed per-CPU memory. The fix ensures that only the core enqueue flags' wakeup bit triggers the task_woken_scx() call, preventing the stale flag condition.
A vulnerability in the Linux kernel SMB client was resolved where the SMB2_open() function did not close a handle after a failure in parsing create-context data. This caused the server-side handle to remain open and the count of remote opens to be incorrectly elevated. The fix ensures that handles are closed properly after such parsing failures, releasing remote resources and balancing open counts.
A vulnerability in the Linux kernel's XFS filesystem code could cause an integer underflow in the hidden_space calculation within xfs_metafile_resv_init. This occurs when the reserved fdblocks for a metadata btree file are less than the space already used, leading to a large incorrect subtraction in xfs_dec_fdblocks. The issue has been fixed by correcting the logic to prevent the target from being less than the used space.
A vulnerability in the Linux kernel's SMB client handling was resolved involving improper handling of non-regular inodes during O_CREAT open operations. The issue caused resource leaks and incorrect inode handling when encountering symlinks or other non-regular inodes, potentially leading to reference leaks and lookup errors. The fix ensures proper tracking and closing of server handles for non-regular inodes and corrects flags to prevent improper VFS behavior.
A vulnerability in the Linux kernel Bluetooth ISO layer was resolved involving the improper release of connection holds after channel attachment. The issue occurs when certain functions return a hold that is not used due to idempotent or busy socket states, potentially causing resource mismanagement. The fix ensures that unused holds are properly released in these cases.
A use-after-free (UAF) vulnerability in the Linux kernel's net/sched act_ct helper was resolved. The issue involved a raw pointer to the extensions area being stored in an expectations list, which could become invalid if extensions were reallocated before the helper was called. This could lead to accessing freed memory during expectation removal. The fix ensures helpers are called only after all extensions are added. The helper rejection behavior regarding marks and labels remains consistent with previous handling, and no atomicity guarantees are provided by the API.