A vulnerability in the Linux kernel's Bluetooth component (btintel_pcie) was resolved by rejecting oversized transmit packets in the send_frame() function. The flaw allowed a user-space process with HCI_CHANNEL_USER access to inject packets larger than the fixed DMA buffer size, potentially causing a buffer overflow. The fix involves rejecting packets exceeding the buffer size minus the PCIe header length.
A use-after-free vulnerability in the Linux kernel's Bluetooth hci_core component was resolved. The flaw involved improper serialization of SCO and ISO scheduling with connection teardown, leading to potential access of freed memory. The issue was fixed by holding a device lock across connection selection and transmission, preventing concurrent access after connection removal.
A vulnerability in the Linux kernel's nvme-multipath component related to ANA log bounds checks has been resolved. The issue involves underflow in size calculations when parsing ANA log buffers, potentially allowing reads beyond the buffer limits. The fix involves improved bounds checking to prevent parsing inconsistent or truncated ANA data.
A vulnerability in the Linux kernel's nvme-multipath subsystem was resolved by changing when the BLK_FEAT_ZONED feature flag is set. Previously, the namespace head was marked as zoned based on the command set identifier before zone information was confirmed. This could lead to incorrect handling when the zone size was zero, causing issues with zone reporting and writes due to invalid calculations.
A vulnerability in the Linux kernel Bluetooth subsystem (btintel_pcie) involving an integer overflow in the plen calculation has been resolved. The plen variable, originally a 16-bit unsigned integer, could overflow when adding HDR_SIZE and dlen, allowing packet truncation checks to be bypassed. This issue was fixed by widening plen to a 32-bit unsigned integer to prevent overflow.
A vulnerability in the Linux kernel's block2mtd module allowed a divide error when the erase_size parameter was set to zero. This caused a divide-by-zero error during a modulo operation, leading to a kernel crash. The issue is fixed by rejecting zero erase_size values before the modulo operation, ensuring proper error handling and device cleanup.
A vulnerability in the Linux kernel related to x86 memory management was resolved. The issue involved incorrect application of virtual address alignment (va_align) to hugetlb mappings on AMD F15h processors, causing address misalignment and kernel BUG_ON triggers during huge page teardown. This affects specific AMD processors such as Carrizo and FX-8370E. The fix involved adjusting the alignment logic to skip randomization for hugetlbfs mappings.
A use-after-free vulnerability in the Linux kernel's Bluetooth hci_sync component was resolved. The issue arises from improper locking during inquiry cache lookups and updates, leading to potential access of freed memory. The fix involves holding the appropriate lock across lookups and copying remote addresses before unlocking to prevent stale pointer usage.
A vulnerability in the Linux kernel's nvmet-auth component caused an out-of-bounds write in the nvmet_auth_challenge() function due to incorrect buffer size calculation. This flaw could lead to memory corruption and kernel panic. The issue was identified and resolved by correcting the size calculation to use the typed challenge pointer. No CVSS score is available for this vulnerability.
A use-after-free vulnerability in the Linux kernel Bluetooth subsystem (hci_core) was resolved. The issue arises because ACL scheduling and channel deletion are not properly serialized, allowing a channel to be freed while still in use. This leads to a use-after-free condition detected by KASAN. The fix involves holding a device mutex to serialize channel selection, transmission, and teardown, preventing concurrent access to freed channels.
A vulnerability in the Linux kernel's nvmet pci-epf component allows a host to control an SGL segment's length improperly, leading to an out-of-bounds read. Specifically, if the segment length is nonzero but smaller than one SGL descriptor, the function nvmet_pci_epf_get_sgl_segment() reads memory before the allocated buffer. This issue was confirmed by kernel address sanitizer (KASAN) tests causing kernel panic. The fix involves rejecting SGL segments that are too short to hold a descriptor before processing them.
A vulnerability in the Linux kernel's nvmet subsystem was resolved involving improper copying of the hostid into the controller structure before creating persistent reservation (PR) pc_refs. This caused the hostid used for matching preempted registrants to be a nil UUID, preventing correct identification and handling of in-flight I/O during Preempt and Abort operations. As a result, Preempt and Abort silently degraded to plain Preempt, potentially leaving victim I/O unhandled during reconnects. The fix involves copying the hostid earlier in the connection process before the controller is published and before the snapshot for reservations is taken.
A race condition vulnerability in the Linux kernel's Bluetooth RFCOMM implementation was resolved. The issue involves improper handling of the initial port reference in RFCOMM_RELEASE_ONHUP devices, where concurrent install and release operations can cause a use-after-free condition. This occurs because both rfcomm_tty_install() and __rfcomm_release_dev() functions can drop the same reference due to a race in setting and testing the RFCOMM_TTY_OWNED bit. The flaw was detected by KASAN as a slab-use-after-free error.
A use-after-free vulnerability in the Linux kernel Bluetooth subsystem (hci_conn) was resolved. The flaw occurs during enhanced SCO setup when the parent ACL connection can be freed while still being accessed, due to missing locking around parent access. This can lead to a kernel memory use-after-free error.
A bounds check off-by-four vulnerability in the Linux kernel's tpm2_get_random() function was fixed. The flaw allowed memcpy() to read up to 4 bytes beyond the end of a truncated TPM response, potentially leaking stale buffer contents as random data. The issue was addressed by correcting the length check to account for the skipped parameter size field in the response.
A use-after-free vulnerability in the Linux kernel Bluetooth subsystem was resolved. The issue involved unsynchronized access to remote Out-Of-Band (OOB) data during SMP pairing commands, allowing concurrent removal of data while it was being read. This could lead to memory corruption or kernel crashes. The fix introduced a dedicated mutex to serialize access to remote OOB data without causing lock order inversions.
A vulnerability in the Linux kernel's EDAC/altera driver was resolved by removing the __init attribute from ECC setup functions. These functions were previously marked __init and could be called after their memory was freed due to deferred probing or manual unbind/rebind actions, leading to use-after-free conditions. The fix ensures these functions remain valid at runtime, preventing potential dereferencing of freed memory.
A buffer over-read vulnerability in the Linux kernel Bluetooth component 'btintel' was fixed. The issue involved reading beyond the end of a 12-byte payload due to improper string termination handling in the btintel_hw_error() function. This could cause out-of-bounds memory access when printing exception information.
A vulnerability in the Linux kernel's mac80211 WiFi subsystem related to power-save (PS) delivery work during station teardown has been resolved. The issue involves a race condition where work delivering PS frames can continue after a station has been marked dead and removed, potentially causing inconsistent driver state. The fix involves reordering work cancellation to ensure proper synchronization during station removal.
A vulnerability in the Linux kernel's Thunderbolt driver was resolved involving improper management of router references for allocated HopIDs. The tb_stop() function drops references to DP tunnels without deactivating them, allowing tunnels to outlive their expected lifecycle and causing operations on freed IDAs, which triggers warnings. This issue can occur when unbinding the driver while a DP tunnel is still active, notably during Apple NHI device unplug events. The fix involves holding a router reference for each allocated HopID to ensure proper lifecycle management.