A vulnerability in the Linux kernel's mac80211 wireless subsystem allows oversized IEEE 802.11 fragments to cause an integer overflow in the fragment payload length accumulator. This overflow leads to insufficient buffer allocation and ultimately triggers a kernel crash in softirq context when processing fragmented frames. The issue arises because the fragment length sum is stored in a 16-bit unsigned integer, which can overflow when large fragments are received. The flaw has been fixed by adding a check to drop frames that would cause overflow without increasing memory footprint.
A slab-out-of-bounds read vulnerability in the Linux kernel's mac80211 wifi subsystem was fixed in the ieee80211_monitor_select_queue() function. The issue arises because skb->len, which includes both linear and non-linear data, was used to validate pointer dereferences into skb->data, potentially causing out-of-bounds reads when packets become non-linear. The fix involves checking skb_headlen(skb), the length of the linear data region, before accessing skb->data. Similar fixes were applied to ieee80211_validate_radiotap_len() and ieee80211_monitor_start_xmit() to prevent similar out-of-bounds reads.
A vulnerability in the Linux kernel's blk-mq subsystem was resolved involving incorrect handling of the RQF_USE_SCHED flag on cached requests. The flaw caused requests allocated for one operation to be reused for another without properly setting scheduling flags, leading to resource leaks and queue stalls in the kyber scheduler. The fix involves setting RQF_USE_SCHED only after the request is claimed by an operation and introducing a helper function to properly initialize requests.
A NULL pointer dereference vulnerability in the Linux kernel's sparx5 network driver was resolved. The issue occurs when sparx5_ptp_init() returns early due to missing PTP features or interrupts, but sparx5_ptp_deinit() does not check this and attempts to clean up uninitialized resources, causing a kernel NULL pointer dereference. The fix adds an early return in sparx5_ptp_deinit() if PTP is not used, preventing the crash.
A vulnerability in the Linux kernel's TIPC protocol allowed reuse of AES-GCM nonces when peer keys changed, breaking confidentiality and enabling trivial forgeries. The issue was fixed by changing nonce generation to use a shared atomic counter that persists across key changes, preventing nonce reuse. This fix maintains compatibility with existing receivers and prevents key revocation except in rare counter wrap scenarios.
A NULL pointer dereference vulnerability in the Linux kernel's bcmgenet network driver was fixed. The issue occurs when setting Rx coalescing parameters on an interface that has not been opened, causing a NULL dereference and kernel oops. This results in networking becoming unresponsive until a reboot. The fix involves initializing necessary private data structures at probe time to prevent the NULL dereference.
A vulnerability in the Linux kernel's IPVS SYNC protocol has been resolved that involved improper filtering of certain connection flags received by the backup server. The issue allowed problematic flag combinations, such as NO_CPORT with TEMPLATE, which could cause lookups to incorrectly hit template connections and potentially disrupt normal operation. Additionally, the ONE_PACKET flag, which should not be sent by the master, was previously ignored or inconsistently handled, leading to potential connection handling issues. The fix improves filtering to drop these problematic messages, protecting the backup server from disruptive inputs.
A vulnerability in the Linux kernel's BPF trampoline handling was resolved. The issue involved detached BPF programs being freed while tasks might still be running in them, potentially causing kernel crashes. The fix ensures that detached programs are not freed prematurely by patching no-op instructions to jumps, preserving program execution safety. This addresses a race condition where tasks sleeping in certain BPF programs could resume execution in freed memory, leading to kernel Oops errors.
A vulnerability in the Linux kernel Bluetooth subsystem related to hci_sync backlog handling during device unregistering has been resolved. The issue caused the backlog of synchronous HCI commands to be drained improperly, leading to potentially very long blocking times when closing virtual HCI devices. This could result in local processes hanging for extended periods due to unbounded command queues. The fix prevents new entries from being processed once unregistering begins and cancels pending requests promptly, avoiding long delays.
A vulnerability in the Linux kernel Bluetooth subsystem (btintel) related to improper validation of Display Data Channel (DDC) record lengths has been resolved. The issue involved parsing DDC record lengths as unsigned values to prevent wrapping errors and rejecting invalid records that are too small, exceed maximum length, or surpass remaining firmware bytes. This vulnerability was reported by Claude Mythos and fixed in the Linux kernel.
A deadlock vulnerability in the Linux kernel's memory management subsystem was resolved. The issue involved the function __kfree_rcu_sheaf() waking up kswapd while holding a raw spinlock (pi_lock), which could lead to a circular locking dependency and deadlock. This deadlock was difficult to reproduce and was verified using a modified kernel with lock dependency detection. The vulnerability was fixed by ensuring kfree_rcu() does not wake up kswapd under pi_lock.
A use-after-free vulnerability in the Linux kernel's BPF trampoline program handling was resolved by ensuring an RCU tasks grace period is waited for before freeing trampoline programs. This addresses a race condition on preemptible kernels where a task preempted in the trampoline could call a freed program, causing a kernel memory access error.
A vulnerability in the Linux kernel's ath9k wireless driver was resolved that involved improper handling of short WMI command responses. The function ath9k_wmi_rsp_callback() could read beyond the expected response buffer if the device response was shorter than anticipated, potentially leading to memory safety issues. The fix involves detecting short responses, recording an error, and preventing stale data consumption.
A vulnerability in the Linux kernel related to the octeontx2-pf driver was fixed. The issue involved improper BPID assignment when CONFIG_DCB was enabled, leading to invalid memory access due to an uninitialized queue_to_pfc_map for SDP VFs. The fix adds a NULL check before dereferencing and simplifies the assignment logic.
A vulnerability in the Linux kernel related to the ASoC SDCA component's power management runtime error handling in the function probe has been resolved. The fix adds a common error path to balance the runtime PM reference. No CVSS score or detailed impact information is provided.
A vulnerability in the Linux kernel's segment routing over IPv6 (seg6) implementation was resolved. The functions advance_nextseg() and seg6_next_csid_advance_arg() modified packet data without ensuring it was writable, potentially causing unintended modifications to cloned packets. This could lead to altered packet data being observed by AF_PACKET sockets receiving on ingress devices. The fix involves calling skb_ensure_writable() before modifying packet data to prevent shared data corruption. If skb_ensure_writable() fails, the packet is dropped.
A vulnerability in the Linux kernel's stmmac network driver related to RX Scatter-Gather support has been resolved. The issue occurs when a received frame larger than the DMA buffer size is scattered across multiple RX descriptors, but the secondary RX buffer was not properly allocated or mapped for regular frames. This causes DMA to write to an unmapped secondary buffer address, triggering an SMMU translation fault on IOMMU-based platforms. The fix enables scatter-gather support for non-split-header frames on capable cores by properly allocating and validating the secondary buffer and adjusting buffer length computations. Some related cases, such as AF_XDP zero-copy RX, remain unaddressed and are planned for future fixes.
A use-after-free vulnerability in the Linux kernel NVMe driver was identified and resolved. The issue occurred when an I/O passthrough command was sent through a multipath namespace head after the controller path that created the head was removed. This caused a kernel slab-use-after-free error detected by KASAN. The fix involved moving the log cache to the subsystem level to maintain valid log pointers until subsystem release.
A vulnerability in the Linux kernel's mac80211 WiFi subsystem allowed unicast frames sent on one interface to be incorrectly matched and transmitted to stations of a different VLAN within the same BSS. This issue was caused by the station lookup function ieee80211_lookup_ra_sta() using a broader matching approach after refactoring, leading to cross-VLAN transmission of frames. The fix restricts matching to stations on the same interface except for control port frames, which may be sent for VLAN stations on the BSS interface.
A vulnerability in the Linux kernel's network subsystem involving skb->queue_mapping and the handling of the skip_txqueue flag in packet transmission has been resolved. The flaw allowed a nested transmit operation to improperly consume a flag set by an inner transmit, leading to out-of-bounds array indexing in the taprio scheduler's child qdisc array. This could be triggered by a local user with CAP_NET_ADMIN in a network namespace redirecting packets between devices with differing numbers of TX queues. The issue is fixed by properly scoping the skip_txqueue flag to the correct transmit context and ensuring skb->queue_mapping is capped to valid values.