A vulnerability in the Linux kernel module loading process was resolved. The function codetag_load_module() did not properly set an error code upon failure, causing load_module() to incorrectly return success (0) after the module teardown. Additionally, a memory leak occurred for livepatch modules due to mod->klp_info not being freed on this error path. This issue has been fixed by ensuring the error code is set and the livepatch memory is properly cleaned up.
A vulnerability in the Linux kernel's wifi wfx driver was resolved by adding validation of the MIB read length before copying data to the caller. The function wfx_hif_read_mib() previously copied reply->length bytes from the firmware response into a caller buffer without verifying that reply->length did not exceed the buffer size val_len. This could lead to a buffer over-read and potential memory corruption. The fix replaces a non-functional -ENOMEM check with an active validation to ensure reply->length fits within val_len before memcpy.
A vulnerability in the Linux kernel's MTD (Memory Technology Device) core component has been resolved. The issue involved incorrect handling of the master MTD device when calling the _get_device() callback, which affected gluebi partitions relying on container_of() with the master MTD. The fix ensures the master MTD is passed correctly to _get_device(), aligning with the behavior of _put_device().
A vulnerability in the Linux kernel's vmgenid driver was resolved by changing the order of operations during driver initialization. The issue involved registering notification handlers before setting the driver_data pointer, which could lead to a NULL pointer dereference and kernel panic if a notification arrived early. This affected both device tree and ACPI probe paths. The fix ensures driver_data is assigned before handler registration, preventing the NULL dereference.
A vulnerability in the Linux kernel's virtual terminal (vt) selection code was fixed to address an unsigned integer underflow and slab-out-of-bounds read in the paste_selection() function. The issue arises when a concurrent ioctl call modifies the selection buffer length while paste_selection() is running, causing an underflow and out-of-bounds memory read. This flaw was resolved by adding a loop termination condition to prevent reading beyond the buffer.
A vulnerability in the Linux kernel's kionix-kx022a accelerometer driver involved an incorrect array boundary check. The driver allowed an index equal to the array size, which is out of bounds, potentially leading to improper behavior. This issue has been fixed by correcting the boundary check to reject indices greater than or equal to the array size.
A vulnerability in the Linux kernel's netfs subsystem related to handling pagecache beyond the end-of-file (EOF) during file extension via write has been resolved. The issue involved stale data remaining in the pagecache after extending a file, which could lead to incorrect data exposure or corruption. The fix ensures that the tail of the folio straddling the EOF is zeroed before an extending write, preventing stale data from persisting. The patch also handles concurrency and writeback synchronization to avoid data loss or corruption during concurrent writes.
A use-after-free (UAF) vulnerability in the Linux kernel's vc_screen component was resolved by reloading the vc pointer before checking the return value in the vcs_write() function. The issue occurred because the vc pointer could become stale and non-NULL after being freed, leading to a read from freed memory in vcs_notifier(). This could cause kernel memory corruption and crashes.
A vulnerability in the Linux kernel's overlay filesystem code was resolved to prevent leaking fragment references when initialization of a changeset fails. The issue occurs because fragment references taken during partial initialization are not properly released if an error happens before full success, leading to resource leaks.
A vulnerability in the Linux kernel ALSA line6 driver allows oversized playback packets to be processed without proper size validation, leading to out-of-bounds memory writes. This occurs because the playback URB buffer size is not properly checked against the actual data length, potentially causing memory corruption. The issue arises when a device has a large IN endpoint max packet size and a smaller OUT endpoint max packet size, allowing writes beyond the allocated buffer. The vulnerability has been resolved by rejecting packets that exceed the allocated buffer size.
A vulnerability in the Linux kernel's rtc: mpfs driver was fixed by adding proper error checking for the devm_clk_get() function's return value in the probe() function. Previously, an error pointer returned by devm_clk_get() was passed unchecked to clk_get_rate(), which only checks for NULL pointers, causing a potential kernel crash. The fix involves checking the return value with IS_ERR() before usage, preventing crashes during driver probe when dependent clocks are not yet registered.
A use-after-free vulnerability in the Linux kernel's page_pool subsystem was resolved. The issue occurs in the function page_pool_recycle_ring_bulk() when CONFIG_PAGE_POOL_STATS=y is enabled. The vulnerability arises because recycle stats are updated after releasing a lock, allowing the pool to be freed prematurely, leading to a use-after-free condition. The fix involved moving the stats update back under the lock to prevent this race condition.
A vulnerability in the Linux kernel related to block device polled direct I/O (DIO) with user integrity metadata has been resolved. The issue arises because IOCB_HAS_METADATA leaves iocb->private as a uio_meta, but iocb_bio_iopoll() expects a bio, causing a mismatch. This leads to a general protection fault and kernel crash when io_uring IOPOLL is used with a PI attribute on an integrity device. The fix involves rejecting polled DIO with user metadata and returning -EOPNOTSUPP when HIPRI is combined with user metadata.
A vulnerability in the Linux kernel related to the SO_RESERVE_MEM socket option has been resolved. The issue involved improper handling of SO_RESERVE_MEM on UDP sockets, which are only supported for TCP sockets. This could lead to memory accounting corruption due to concurrent operations and lack of proper locking. Additionally, there was no upper bound on the SO_RESERVE_MEM value, allowing large values to cause integer overflow and memory corruption. The fix restricts SO_RESERVE_MEM usage to TCP sockets and caps the maximum value to 1GB.
A vulnerability in the Linux kernel's BPF JIT compiler was fixed to address an overflow of the jump offset in the constant blinding function bpf_jit_blind_insn(). This overflow could cause backward jumps to wrap around and become large forward jumps, potentially crashing the kernel when running certain BPF programs with bpf_jit_harden=2 enabled.
A vulnerability in the Linux kernel's net/mctp subsystem was resolved by ensuring the mctp_dev object is only published after it is fully initialized. The issue involved a null pointer dereference caused by a race condition where a reader could access a net_device pointer before it was assigned, leading to a kernel address sanitizer (KASAN) null pointer dereference error.
A vulnerability in the Linux kernel's mlx5 driver related to handling team device events has been fixed. The issue involved out-of-bounds memory access triggered by calling bonding-specific APIs on team device structures, which are smaller and incompatible. This was detected by KASAN during event processing. The fix adds checks to ensure bonding-specific functions are only called for bonding devices, preventing invalid memory access. Testing confirmed no regressions and resolved KASAN errors.
A use-after-free vulnerability in the Linux kernel's BPF subsystem was resolved by ensuring a reference to the map BTF is held during memory allocator destructor operations. The flaw involved premature freeing of BTF data while deferred workqueue tasks still accessed it, leading to kernel memory corruption detected by KASAN.
A buffer overflow vulnerability in the Linux kernel's bcm_sysport_get_stats() function was fixed. The issue occurs because the function writes statistics data beyond the allocated buffer bounds when running on SYSTEMPORT Lite, due to incorrect indexing. This leads to memory corruption.
A vulnerability in the Linux kernel's network scheduler (net/sched) related to the cls_api component has been resolved. The issue involves a race condition when two concurrent traffic control (tc) filter add requests operate on the same chain and priority of an unlocked classifier. Both requests can fail and leave an empty protocol (proto) linked in the chain, which holds references that should have been released. This residual empty proto can persist until the chain or block is torn down, potentially causing resource retention. The fix ensures that the proto is reclaimed on the error path of any failed request holding a proto reference, preventing the empty proto from lingering.