A vulnerability in the Linux kernel's USB DWC3 gadget driver causes an interrupt storm leading to a kernel panic. The issue arises when the dwc3_check_event_buf() function reads an invalid event buffer count exceeding the buffer length and fails to clear the interrupt source, resulting in a level-triggered IRQ storm and eventual kernel crash.
A vulnerability in the Linux kernel's dummy-hcd USB gadget driver was resolved. The issue involved improper synchronization in the wait for outstanding request completions, potentially allowing a gadget driver's unbind routine to run before all request completions finished. This could lead to the gadget driver's module being unloaded while a completion handler is still running.
A use-after-free vulnerability in the Linux kernel's nitro_enclaves component was fixed. The flaw occurs when ne_create_vm_ioctl() fails the SLOT_ALLOC request after anon_inode_getfile() succeeds, leading to a use-after-free in ne_enclave_release() due to improper handling of enclave_file->private_data. This causes a kernel slab-use-after-free error detected by KASAN. The patch clears private_data before fput() to prevent dereferencing freed memory, ensuring safe error handling without affecting normal enclave operations.
A use-after-free vulnerability in the Linux kernel's usb cdns3 driver was resolved. The flaw involved cdns3_gadget_exit() not properly waiting for deferred work to complete before freeing resources, potentially allowing use of freed memory. The fix ensures that all queued work completes before releasing endpoints and buffers. This vulnerability was identified via static analysis and has no known exploits in the wild.
A race condition vulnerability in the Linux kernel's tty subsystem involving break signalling on hangup has been resolved. The issue arises when break ioctls race with hangup events, potentially causing calls into tty drivers for devices that are no longer present or powered down. Proper driver handling of this race is required, and the TCSBRK and TCSBRKP ioctls should be aborted to prevent callbacks after user-controlled timeouts or device reopenings. Drivers are advised to disable break state on shutdown to avoid race conditions during hangup.
A vulnerability in the Linux kernel's USB core was resolved by ensuring that both input and output endpoint pointers are cleared when disabling non-ep0 control endpoints. Previously, only one direction was cleared, potentially leaving stale pointers to disabled or freed endpoints. This fix prevents possible inconsistencies in USB endpoint management.
A vulnerability in the Linux kernel's USB Type-C driver (tipd) was resolved by zero-initializing the typec_partner_desc structure in the tps6598x_connect() function. The flaw involved uninitialized fields in a stack-allocated descriptor, which could lead to garbage function pointers being stored and potentially invoked, as well as leaking stack data via sysfs. This issue was fixed by ensuring all fields are properly zero-initialized before use.
A vulnerability in the Linux kernel's USB Type-C TCPM driver was resolved by improving recovery after failure to start the FAST_ROLE_SWAP (FRS) Alternate Mode State (AMS). The issue involved the port failing to reset properly when the FRS AMS failed to start, causing VBUS power to remain sourced incorrectly. This could occur when some cables incorrectly signal an FRS during disconnection, potentially leaving the port in an invalid state with VBUS still on.
A use-after-free vulnerability in the Linux kernel's USB cdc-acm driver was resolved. The flaw occurs when the driver attempts to restart USB Request Blocks (URBs) during port shutdown after a device disconnect, leading to potential access of freed DMA memory. The fix prevents URB resubmission if the device is disconnected, avoiding unsafe memory access.
A vulnerability in the Linux kernel's tty subsystem was resolved by ensuring the TTY_IO_ERROR flag is restored on activation failure. Without this fix, there is a risk of kernel panic or NULL-pointer dereferences due to I/O attempts on powered down or deregistered ports during races between ioctl, hangup, and open operations.
A vulnerability in the Linux kernel's USB dwc2 driver was resolved by ensuring the wakeup timer is properly shut down before freeing the host controller driver (HCD) state. The issue involved the dwc2_wakeup_detected() function potentially rearming a timer after the HCD state was freed, due to improper timer deletion sequencing. The fix involves stopping and shutting down the timer in dwc2_hcd_release() before freeing HCD resources, covering both initialization error paths and normal removal.
A vulnerability in the Linux kernel's tty vcc component involved a stack-allocated control packet structure that was only partially initialized. Specifically, the tag.stype_env field was left uninitialized before being sent via ldc_write(), which could lead to leakage of kernel stack data to the LDC peer. This issue has been resolved by zero-initializing the control packet in the vcc_send_ctl() function.
A use-after-free vulnerability in the Linux kernel's max3100 serial driver was resolved. The issue occurs because the polling timer is not properly shut down before the port is freed, potentially allowing the timer callback to access freed memory. The fix involves adding final timer teardown in the remove function, synchronizing timer shutdown, freeing the IRQ, and destroying the workqueue to prevent race conditions.
A use-after-free vulnerability in the Linux kernel's USB Type-C UCSI glink component was resolved. The issue occurs because work items can run after the UCSI instance has been unregistered and freed, leading to dereferencing freed memory. The fix involves disabling work items before unregistering and ensuring the instance is only unregistered if still registered. This vulnerability was identified by an internal static analysis tool.
A vulnerability in the Linux kernel's USB gadget function f_uac1_legacy allows out-of-bounds memory access due to improper validation of the bRequest index in generic_set_cmd() and generic_get_cmd(). This can be triggered by a malicious USB host sending crafted class-specific SET_CUR or GET_CUR requests, causing heap memory corruption.
A use-after-free vulnerability in the Linux kernel's tty vcc component was resolved. The issue occurs because vcc_cleanup() clears the port->tty pointer without holding the port lock, causing a race condition with vcc_event() callbacks that access tty->port under the lock. This can lead to dereferencing freed memory.
A concurrency vulnerability in the Linux kernel ALSA sequencer interface was resolved. The issue involved the compat port-info ioctl path not properly serializing handler calls with the ioctl_mutex, unlike the native ioctl path. This allowed concurrent CREATE_PORT requests to bypass port-count checks, potentially causing port index wraparound and duplicate port addresses. Such duplicates could lead to subscriber teardown resolving to the wrong port and accessing freed memory.
A NULL pointer dereference vulnerability in the Linux kernel's Cadence USBSS controller driver (cdns3) was resolved. The issue occurs during PCI device probing when the second function probes before the first function has set its driver data, causing a kernel crash. The fix involves returning -EPROBE_DEFER to retry probing after the first function completes.
A vulnerability in the Linux kernel's usb typec anx7411 driver has been resolved. The issue involved not stopping the IRQ before destroying the workqueue, which could allow the IRQ to queue work while the queue is being torn down. The fix disables the IRQ first to prevent this condition.
A use-after-free vulnerability in the Linux kernel's Bluetooth hci_core component was resolved. The issue arises from improper serialization of fragmented ISO packet queueing, where concurrent access to the packet queue can lead to memory corruption and use-after-free conditions. This flaw was detected by KASAN and involves the hci_queue_iso() and hci_sched_iso() functions. The fix involves holding the queue lock across the entire fragment batch to prevent concurrent modifications.