A vulnerability in the Linux kernel's AMD display driver was resolved by adding a NULL check for the dc_state_create_copy() function in the dm_suspend() routine. The function dc_state_create_copy() can return NULL on allocation failure, but dm_suspend() previously did not handle this correctly, leading to a NULL pointer dereference during GPU reset recovery in dm_resume(). The fix returns an error immediately if the copy fails, preventing the NULL cached state from causing a crash.
A use-after-free vulnerability in the Linux kernel's futex private hash resizing logic has been resolved. The issue arises because the order of assignments in the futex pivot hash function allows a grace period to start between setting batches and updating the hash pointer, potentially causing a reader to access freed memory. The fix involves reordering these assignments to prevent this race condition and removing an unnecessary scoped guard.
A vulnerability in the Linux kernel's binder driver was fixed related to the handling of the is_failure flag during cleanup of superseded transactions. The flaw caused the cleanup handler to misinterpret stale buffer contents as valid file descriptor numbers, potentially closing unrelated file descriptors. The fix ensures the is_failure flag is set correctly to true for undelivered transactions, aligning with other cleanup paths.
A race condition vulnerability in the Linux kernel's tty port handling was resolved. The function tty_port_tty_vhangup() could return before the port was fully shut down if it raced with another hangup, potentially causing use-after-free and NULL-pointer dereferences during concurrent ioctl or hangup operations. The fix adds serialization to ensure the function does not return until the port shutdown is complete, preventing these race conditions.
A vulnerability in the Linux kernel's USB gadget MIDI2 driver was resolved by correcting the jack descriptor array sizes. The jack in/out descriptor arrays were incorrectly sized as MAX_CABLES, but since entries are added for both inputs and outputs, the arrays needed to be sized at twice MAX_CABLES. This mismatch could lead to out-of-bounds (OOB) access when a large number of jacks are configured via configfs. The issue was fixed by adjusting the array sizes to MAX_CABLES * 2.
A NULL pointer dereference vulnerability in the Linux kernel's usb gadget FunctionFS endpoint descriptor handling was resolved. The issue occurs when user space sets up FunctionFS with only full-speed descriptors but the gadget operates at a higher speed. The kernel attempts to access a descriptor index that is NULL, causing a kernel panic. The fix implements fallback logic to use lower speed descriptors if the current speed descriptor is missing, preventing the NULL dereference.
A vulnerability in the Linux kernel ASoC codec driver rt1017-sdca-sdw was fixed by zero-initializing the stream_config structure before use. The uninitialized stream_config->type field could contain garbage data, which was then copied to stream->type, potentially causing undefined behavior. The fix involved zero-initializing stream_config so that type defaults to SDW_STREAM_PCM and refactoring to use a helper function for configuration.
A vulnerability in the Linux kernel's USB Type-C driver (tipd) was resolved by zero-initializing a stack-allocated typec_partner_desc structure in the cd321x_update_work() function. Previously, some fields were left uninitialized, potentially causing garbage function pointers to be stored and later invoked, and leaking stack data via sysfs. This could lead to undefined behavior when a USB device is linked to the port.
A use-after-free vulnerability in the Linux kernel's USB serial drivers for multiport devices has been resolved. The issue arises from a race condition where completion handlers access port driver data that may have been freed during port teardown. The fix involves reordering disconnect handling to ensure ports are not deregistered until all I/O operations have stopped and the driver disconnect callback has completed.
A vulnerability in the Linux kernel's rust_binder component was resolved by ensuring deferred work items on a thread's todo list are properly canceled when the thread exits. Previously, these deferred work items were not cleaned up in the Thread::release() method if the thread died while having an active outgoing transaction.
A vulnerability in the Linux kernel ALSA ua101 driver was resolved that involved mismatched capture and playback packet sizes. The driver failed to properly relate the maximum packet size and number of channels between capture and playback endpoints, leading to out-of-bounds memory writes during PCM node open operations. Genuine UA-101/UA-1000 hardware is unaffected due to proportional packet sizes. The issue was detected by KASAN as a slab-out-of-bounds write in start_usb_playback().
A race condition vulnerability in the Linux kernel's TTY subsystem related to resetting saved termios state on device registration has been resolved. The issue arises when a minor device number is reused for a different device without properly resetting the saved termios state, potentially causing a use-after-free condition during TTY closure and re-registration. The fix introduces a new flag to ensure saved termios state is reset appropriately for affected drivers.
A vulnerability in the Linux kernel's ASoC max98363 codec driver was resolved by zero-initializing the stream_config structure to prevent the type field from containing uninitialized data. This issue involved the stream_config->type field being uninitialized before being passed to sdw_stream_add_slave(), potentially causing unpredictable behavior.
A use-after-free vulnerability in the Linux kernel's usb gadget driver for aspeed-vhub was resolved. The issue occurs because a wake_work item is not properly cancelled during device removal, allowing a work item to run after the device and its ports have been freed. The fix involves cancelling the work item atomically with device unbinding and refusing wakeup requests once the device is unregistered. This vulnerability was discovered via static analysis and has no known exploits in the wild.
A NULL pointer dereference vulnerability in the Linux kernel's serial core subsystem was resolved. The issue occurs in the function serial_core_unregister_port() when port->port_dev is NULL, leading to a potential kernel crash. The flaw arises because port->port_dev can be cleared on teardown or never set if registration fails, but the function attempts to dereference it without checking. The fix involves returning early if no port device is present and ensuring proper synchronization with port_mutex. Additionally, port->port_dev is cleared on error paths during registration to prevent this condition.
A use-after-free (UAF) vulnerability in the Linux kernel's binderfs subsystem was resolved. The issue occurs when binderfs_binder_device_create() publishes a new device entry and releases locks and references, allowing a concurrent unlink operation to free the device. Subsequent access in binder_add_device() leads to a write to freed memory, causing a UAF condition.
A vulnerability in the Linux kernel's ma35d1 serial driver caused a clock reference leak due to missing release of clock references obtained via of_clk_get(). This flaw was fixed by ensuring the clock reference is properly released on error paths and when the serial port is removed.
A vulnerability in the Linux kernel arm64/fpsimd signal handling was resolved that could cause a task to erroneously have non-streaming SVE state on SME-only systems. This improper state restoration can lead to fatal undefined instruction exceptions (EL1 UNDEF) during kernel operations. The issue arises when the kernel restores a crafted SVE signal context with inconsistent flags and payload presence, causing kernel crashes.
A use-after-free vulnerability in the Linux kernel's serial driver for 8250_bcm7271 was resolved by changing the order of operations in the brcmuart_remove() function. The flaw allowed a timer callback to access freed memory due to a race condition between unregistering the port and cancelling a high-resolution timer. This issue was identified via static analysis and fixed by unregistering the port before cancelling the timer to prevent the callback from running on freed memory.
A vulnerability in the Linux kernel's usb storage driver for Sierra Wireless devices allows a malicious USB device to cause a partial information leak. The flaw occurs because the driver accepts short USB control message transfers without verifying the full expected data length, leading to uninitialized kernel memory being exposed via a sysfs attribute. This can disclose up to 5 bytes of stale kernel heap memory to unprivileged userspace per read. The issue is resolved by rejecting short transfers and only accepting full data structures.