A vulnerability in the Linux kernel's MediaTek Ethernet driver (mtk_eth_soc) was resolved by changing the order of dummy net device allocation. The issue involved a timing window where network devices became visible before a shared NAPI and dummy device were initialized, causing null pointer dereferences and failures when bringing interfaces up. The fix allocates the dummy net device and adds the shared NAPI earlier during initialization, preventing these race conditions and ensuring proper cleanup on failure.
A use-after-free vulnerability in the Linux kernel's ac100 RTC clock provider was fixed. The issue occurs when the probe function fails after registering clocks that are not device-managed, leaving dangling pointers in the global clock provider list. This can cause later lookups to access freed memory, leading to potential instability or crashes. The fix ensures proper device-managed registration and cleanup on probe failure.
A use-after-free vulnerability in the Linux kernel NVMe driver related to character device (cdev) lifetime management has been resolved. The issue occurs in multipath mode when the NVMe namespace head is torn down, causing open cdev file operations to reference freed memory. This can lead to kernel memory corruption and potential crashes. The vulnerability was reported by the Sashiko bot and fixed in the Linux kernel.
A vulnerability in the Linux kernel's ath9k_htc wifi driver was resolved by bounding TX aggregation to the maximum transmit buffer size. The issue involved the __hif_usb_tx() function dequeuing up to 20 frames without limiting the cumulative byte length, causing a buffer overflow when large frames were aggregated. The fix ensures the loop stops before exceeding the buffer size, preventing memory corruption and frame loss.
A vulnerability in the Linux kernel's mac80211 wireless subsystem was resolved. The issue involved insufficient validation of TX status rate metadata in the minstrel_ht_tx_status() function, which could lead to out-of-bounds indexing in rate tables. The fix involves validating rate metadata earlier in the TX status path to prevent malformed metadata from corrupting mac80211 state. This mitigates potential instability caused by bad driver reports without causing kernel panics.
A use-after-free vulnerability in the Linux kernel's wifi cfg80211 component related to hidden-group beacon IE ownership has been resolved. The issue occurs when a hidden-group probe-response entry borrows beacon IEs from the group's beacon entry, leading to double freeing of memory when the group's beacon entry is released. The fix involves skipping beacon IE replacement for entries belonging to hidden groups while preserving probe-response processing and metadata updates.
A vulnerability in the Linux kernel's AMDGPU driver (gfx6) caused firmware resources to leak during teardown. The issue was that firmware requested in gfx_v6_0_init_microcode() was not properly released when the GFX block was torn down. This was fixed by adding a function to free the microcode firmware and calling it during software finalization.
A reference leak vulnerability in the Linux kernel's drm/mediatek driver was fixed. The issue occurred in the mtk_drm_bind() function, where a device reference was taken but not released if the device was not the mmsys master. This could lead to resource leaks due to the missing reference drop in the non-master code path.
A vulnerability in the Linux kernel's BPF subsystem related to objects stuck in free_by_rcu_ttrace has been resolved. The issue arises because do_call_rcu_ttrace() returns early under certain conditions, leaving objects unreleased indefinitely. This can cause unbounded accumulation of such objects. The fix involves changing the state management of call_rcu_ttrace_in_progress to better track and free these objects, ensuring proper cleanup and preventing resource leakage.
A null pointer dereference vulnerability in the Linux kernel's net/mlx5e driver related to AF_XDP TX timestamp teardown has been fixed. The issue occurs during teardown of the XSK TX queue when outstanding descriptors are completed without a completion queue entry (CQE). If a TX timestamp was requested, the code dereferences a null CQE pointer, causing a potential crash. The fix returns zero when no CQE is available, preventing the null dereference.
A memory leak vulnerability in the Linux kernel's amdgpu driver was fixed. The issue occurs when kobject_add() fails during the initialization of ip_hw_instance, causing the allocated memory not to be freed. This happens because the failure return value is ignored and the initial kobject reference is not dropped, preventing normal cleanup. The fix involves calling kobject_put() on failure to properly release the allocation and avoid the leak.
A vulnerability in the Linux kernel's drm/amdgpu driver caused ACP MFD child devices to remain registered and not released if initialization failed after device registration. This device leak occurs when attaching a child device to the ACP power domain fails or when ACP reset or clock enable operations time out. The issue has been fixed by ensuring that child devices are properly unregistered and removed from the power domain upon such failures.
A vulnerability in the Linux kernel's AMD display driver (drm/amd/display) involving improper NULL checks on dc_sink dereferences during MST mode validation has been resolved. The flaw occurs because functions accessing dc_sink fields do so without verifying if dc_sink is NULL, leading to potential race conditions during MST unplug events. The fix ensures that port-support checks fail and skip certain processing paths when the sink is no longer present.
A vulnerability in the Linux kernel's BPF subsystem was fixed by adding missing migration protection in the __rhtab_map_lookup_and_delete_batch() function. The issue involved the use of this_cpu_ptr() without disabling CPU migration, which could cause a kernel BUG due to smp_processor_id() being used in preemptible code. The fix adds migrate_disable()/migrate_enable() calls around the delete loop to prevent CPU migration during this operation.
A vulnerability in the Linux kernel's drm/mediatek driver was fixed to address a platform device leak. The mtk_drm_probe() function creates an OVL adaptor platform device but fails to unregister it if later initialization steps fail, leading to resource leakage. The fix ensures proper tracking and unregistration of the OVL adaptor device on probe failure and during normal removal.
A vulnerability in the Linux kernel's binder driver caused leaked file descriptor fixups when a TF_UPDATE_TXN transaction supersedes a pending asynchronous transaction in a frozen process. This leak results from skipping a cleanup function, causing file references to remain pinned in memory indefinitely, potentially leading to resource exhaustion. The issue has been resolved by adding the missing cleanup call before freeing the outdated transaction.
A vulnerability in the Linux kernel's netfilter subsystem related to BPF NAT manipulation types has been resolved. The function bpf_ct_set_nat_info() did not validate the NAT manipulation type, allowing invalid values to be passed to nf_nat_setup_info(). This caused a WARN_ON() trigger and potential improper connection tracking cleanup. The fix involves validating the NAT manipulation type before processing and dropping packets if invalid types are detected.
A vulnerability in the Linux kernel's drm/mediatek driver was resolved by adding a missing IS_ERR check for the ovl_adaptor platform device. Without this check, a failure in platform_device_register_data() could lead to an invalid pointer being stored and passed to other kernel functions, potentially causing a kernel crash.
A race condition vulnerability in the Linux kernel's perf subsystem was resolved. The issue occurs between perf_event_exit_task() and perf_pending_task() during the begin_new_exec() process. The flaw involves a timing conflict where the PF_EXITING flag is not set on the task, causing perf_sigtrap() to execute improperly and trigger a warning. The fix involves checking if event->ctx->task equals TASK_TOMBSTONE to avoid redundant checks and race conditions.
A vulnerability in the Linux kernel's netfilter flowtable component has been resolved. The issue involved a race condition between the garbage collection (GC) worker and hardware offload handler due to improper handling of a pending status bit. The fix generalized the pending status bit to inhibit the GC worker until pending hardware offload work completes, preventing premature flow removal and race conditions.