A vulnerability in the Linux kernel's mac80211 wifi subsystem was resolved by ensuring the correct band information is set for 802.3 encapsulation offload frames. Previously, the function ieee80211_8023_xmit() did not set the info->band field correctly on non-MLD interfaces, causing the transmission rate selection to use an incorrect band. The fix aligns this behavior with ieee80211_build_hdr() by dropping frames without a channel context and leaving the band at 0 on MLD interfaces.
A use-after-free (UAF) vulnerability in the Linux kernel's mac80211 wifi mesh fast transmit path was fixed. The issue involved mesh_fast_tx_cache() storing raw mesh_path pointers that could point to freed memory after path deletion and cache flushing. The fix involves setting a deletion flag before flushing and preventing insertion of cache entries for deleted paths, ensuring proper synchronization with locks and atomic updates.
A race condition vulnerability in the Linux kernel's USB serial driver related to dynamic ID driver deregistration has been resolved. The fix ensures that dynamic IDs are only freed after the driver is deregistered and the 'new_id' attribute is removed, preventing potential ID leaks caused by racing writes to the attribute.
A vulnerability in the Linux kernel's mac80211 WiFi subsystem allowed invalid 320 MHz channel switch announcements (CSA) bandwidths to be processed on non-6 GHz links. This caused an uninitialized read of the channel width field, which could trigger a kernel panic if panic_on_warn was enabled. The issue has been resolved by rejecting invalid channel definitions before processing them, preventing the uninitialized read and kernel panic.
A vulnerability in the Linux kernel's KVM nested virtualization (nVMX) component was resolved. The issue involved failure to refresh the MSR bitmap during nested VM-Enter when runtime eVMCS controls were modified. This could allow a nested guest (L2) or the first-level guest (L1) to read and write the host's (L0) Task Priority Register (TPR) when TPR virtualization was disabled, due to the bitmap not being updated properly.
A vulnerability in the Linux kernel USB serial driver modules related to improper driver deregistration order has been resolved. The issue involves the sequence in which USB drivers and USB serial bus drivers are deregistered when unloading a driver module. Incorrect order can lead to use-after-free conditions in completion handlers accessing port data. Additionally, the removal of "new_id" attributes is necessary to prevent new IDs from triggering probes after deregistration.
A vulnerability in the Linux kernel's Thunderbolt driver was resolved involving improper teardown of inactive DisplayPort (DP) tunnels when the domain is stopped. The function tb_stop() only tore down DMA tunnels, leaving DP tunnels waiting for completion work queued, which could cause operations to run against a domain already torn down. The fix ensures that inactive DP tunnels are also torn down, canceling queued work and preventing potential issues. Active tunnels for live displays remain unaffected.
A vulnerability in the Linux kernel's mac80211 Wi-Fi subsystem related to channel context management has been resolved. The issue involved premature freeing of an old channel context (chanctx) while its replacement still referenced it, potentially leading to use-after-free conditions. The fix ensures that the old chanctx remains alive until the replacement pair is fully torn down, preventing stale pointer dereferences.
A vulnerability in the Linux kernel's KVM arm64 implementation related to fine-grained undefined instruction (UNDEF) handling without FEAT_FGT has been resolved. The issue involved incorrect gating of fine-grained trap (FGT) configuration insertion, which could cause spurious warnings and improper trap handling in certain hardware configurations. The fix ensures that fine-grained undefined instruction traps (FGUs) are always applied correctly regardless of hardware support for FEAT_FGT, preventing unexpected behavior during virtualization.
A vulnerability in the Linux kernel's mac80211 wifi component related to handling empty FILS association request payloads has been resolved. The issue occurs when fils_encrypt_assoc_req() processes a (Re)Association Request frame with an empty FILS Session element, leading to a zero-length plaintext passed to aes_siv_encrypt(). This causes an invalid page to be placed into the scatterlist, potentially triggering a kernel BUG or passing a bogus page to the crypto backend. The fix involves properly handling the empty plaintext case before the CTR encryption step.
A vulnerability in the Linux kernel's KVM SEV implementation was resolved by ensuring cache maintenance is performed on the source VM before clearing the SEV active state during intra-host migration. The issue involved a timing window where memory could be reclaimed and returned to the host without a proper cache flush, potentially causing stale or incorrect data to be exposed or overwritten. This was fixed by explicitly flushing caches prior to clearing the SEV active flag.
A memory leak vulnerability in the Linux kernel's iwlegacy driver for Intel 3945 wireless devices was resolved. The issue occurs because EEPROM data allocated during device probe is not freed upon device removal, leading to a memory leak. This was identified through manual code inspection and fixed by freeing the EEPROM data in the device removal function.
A use-after-free vulnerability in the Linux kernel's mac80211 WiFi subsystem related to RX Block Acknowledgement (BA) session teardown has been resolved. The issue involves a session timer being left queued on freed memory, leading to potential timer callbacks running against freed tid_rx structures. This occurs because the RX BAR handler can access tid_rx under RCU before it is unpublished, allowing stale handlers to rearm timers after deletion synchronization. The fix involves using timer_shutdown_sync() to prevent timer rearming once teardown begins.
A vulnerability in the Linux kernel's KVM arm64 virtual generic interrupt controller (vgic) component has been resolved. The issue involved improper reference counting on interrupts referenced by last_lr_irq, which could vanish if a concurrently unmapped LPI (Locality-specific Peripheral Interrupt) occurred. The fix involves incrementing the reference count when populating last_lr_irq and decrementing it during LPI reclamation.
A use-after-free vulnerability in the Linux kernel's mac80211 WiFi subsystem was resolved. The issue involved improper counting of channel context reservations during replacement operations, which could lead to premature freeing of a channel context still in use. This flaw could cause instability or crashes during beacon generation in wireless networking.
A vulnerability in the Linux kernel's mac80211 minstrel_ht component allows out-of-bounds memory access via the fixed_rate_idx debugfs file. This file accepts any u32 value, which can lead to invalid indexing of internal arrays and kernel memory corruption. The debugfs file is only accessible to root users, so this is not a privilege escalation issue but remains a critical kernel memory safety bug.
A vulnerability in the Linux kernel's KVM x86 memory management unit (MMU) was resolved that caused a NULL pointer dereference during shadow page table walks if the root was invalid or a dummy. This occurred when memslot creation raced with a stage-2 page fault, leading to kernel crashes. The fix terminates shadow walks immediately when encountering a dummy root to prevent the NULL dereference.
A vulnerability in the Linux kernel's KVM SVM component was resolved by correcting the use of the active VMCB's MSR bitmap for checking intercepted MSR accesses. The fix ensures that the correct MSR permission bitmap is used when nested virtualization is active, preventing incorrect assumptions about which bitmap is in use.
A vulnerability in the Linux kernel's KVM SEV implementation related to improper handling of the 'have run CPUs' mask pointer has been resolved. The issue involves a double-free condition when freeing this mask if __sev_guest_init() fails. The fix nullifies the pointer properly to prevent double-free errors. This vulnerability does not have a CVSS score and no known exploits in the wild have been reported.
A vulnerability in the Linux kernel's KVM SVM implementation related to TLB control on failed VMRUN operations has been resolved. The issue involved improperly resetting the VMCB's TLB control state on a failed VMRUN, which could cause a requested TLB flush to be dropped. The fix involves preserving TLB control state and explicitly tracking the need to flush all ASIDs on a per-CPU basis. This correction prevents potential noisy neighbor issues caused by unnecessary flushing of all ASIDs after a failed VMRUN. The vulnerability is addressed by changes in the kernel code behavior and does not have known exploits in the wild.