A vulnerability in the Linux kernel's drm/bridge th1520-dw-hdmi driver was fixed by correcting the remove() callback. The driver incorrectly handled a pointer type during teardown, which could cause improper cleanup.
A vulnerability in the Linux kernel's namespace handling was resolved by ensuring the old parent's ->overmount pointer is reset in the mnt_change_mountpoint() function. Previously, this pointer could become a dangling reference after certain mount operations, leading to use-after-free (UAF) conditions. This issue arises when mounts are reparented and the old parent's ->overmount is not cleared, potentially allowing references to freed mount structures.
A vulnerability in the Linux kernel's drm/xe component caused incorrect shrinker accounting due to double-subtraction of pages when nested external pins occur on buffer objects. This desynchronization can lead to excessive invocation of the shrinker under memory pressure. The issue was fixed by ensuring accounting updates only occur on the outermost pin and final unpin, and by excluding imported dma-bufs from shrinker accounting to prevent underflows.
A vulnerability in the Linux kernel's XFS filesystem was resolved involving the XFS_IOC_EXCHANGE_RANGE ioctl with the TO_EOF flag. The flaw allowed file size inconsistencies where files could end up with shared blocks beyond EOF, which is invalid. This incorrect file size handling could lead to improper clearing of reflink flags and potential data corruption during writes. The issue was fixed by correcting how file sizes are exchanged and managed during the operation.
A vulnerability in the Linux kernel related to namespace handling has been resolved. The issue involves pseudo dentries, which are special directory entries for pipes, sockets, and other files that are not part of the normal filesystem hierarchy. These pseudo dentries should not become the root of a mount, but bind mounting /proc/self/fd/<fd> can cause this to happen. This leads to a race condition where a dentry can be freed while still being accessed, potentially causing instability. The fix prevents cloning a mount whose root is a pseudo dentry with the DCACHE_NORCU flag.
A vulnerability in the Linux kernel's namespace handling allows the owner of a user namespace to replace its locked /proc or root mount. This occurs due to improper transfer of the locked property when a propagated copy of a mount is moved beneath another mount, potentially exposing files that should remain covered and locked. The issue has been resolved by ensuring the locked property is only transferred to mounts placed by the caller, maintaining proper mount locking behavior.
A vulnerability in the Linux kernel related to the removal of fsnotify marks from a mount namespace in process context has been resolved. The issue involved improper removal of fanotify marks in an invalid context, causing kernel locking bugs and potential system instability. The flaw allowed a root user in a user namespace to leave marks on a mount namespace that could trigger a BUG due to sleeping functions called from invalid contexts during namespace release. The fix ensures marks are removed in process context before the namespace is handed to RCU, preventing the invalid context issue.
A vulnerability in the Linux kernel's drm_bridge_add() function was resolved. The issue involved modifying linked lists without holding the required bridge_lock, potentially causing list corruption when re-adding a previously removed bridge. This could affect the stability of the drm bridge subsystem.
A vulnerability in the Linux kernel's mount namespace handling has been resolved. The flaw involves attach_recursive_mnt() not properly considering the topmost mount in a mount namespace file chain, leading to incorrect mountpoint attachment. This can cause mounts to become inaccessible and prevent synchronous unmounting due to lingering child mounts.
A vulnerability in the Linux kernel's unshare system call was resolved. The issue involved dropping active namespace references that were never taken, leading to reference count inconsistencies. This could cause namespaces the caller lives in to no longer be listed by listns(). The problem occurred when set_cred_ucounts() failed during ksys_unshare(), causing improper reference decrementing. The fix involved properly freeing nsproxy structures that were prepared but never installed.
A vulnerability in the Linux kernel related to mount namespaces and the open_tree(OPEN_TREE_NAMESPACE) operation has been resolved. The issue involved improper handling of covered mounts during the creation of new mount namespaces, potentially allowing unprivileged users to access hidden mount points. The fix ensures that covered mounts remain covered and that unprivileged users cannot reveal mounts that should be hidden by container runtimes or administrators.
A vulnerability in the Linux kernel's ice driver was resolved by restoring ordered MMIO writes for transmit doorbells. The issue involved a race condition due to the use of writel_relaxed() instead of writel(), causing the NIC to start transmitting before the queue accounting update was globally visible. This could lead to a kernel BUG triggered by an invalid state in the transmit queue accounting, resulting in a kernel crash under sustained network load on arm64 systems using Intel Ethernet Controller E810-XXV hardware.
A vulnerability in the Linux kernel's Btrfs filesystem code related to io_uring read extent failure handling has been resolved. The issue involved improper unlocking of inode and extent locks on failure paths, potentially leading to resource management inconsistencies. The fix ensures that unlocking occurs in the caller on all failure returns, aligning with the expected error handling behavior.
A reference leak vulnerability in the Linux kernel's devlink component has been resolved. The issue occurs when notify work is pending and the devlink_rel reference is not properly released, leading to a memory leak. This can happen when nested devlink instances are registered and unregistered repeatedly while the parent lock is held. The vulnerability allows leaking of devlink_rel objects due to improper handling of work scheduling and reference counting.
A vulnerability in the Linux kernel's drm/imagination driver was resolved involving incorrect handling of reference counts and vm_bo linkage during GPU virtual address remapping. The flaw caused reference leaks and mismatches in object linkage when a memory map overlaps an existing mapping, potentially leading to resource leaks and warnings in kernel logs.
A vulnerability in the Linux kernel's PFCP packet processing was resolved by ensuring the SEID field is fully linearized before being read. The pfcp_encap_recv() function previously only ensured the UDP and PFCP headers were linear, but when the S flag was set, pfcp_session_recv() read the 8-byte SEID without verifying it was fully in the linear area. This could cause out-of-bounds reads from fragmented or short packets. The fix involves pulling up to the end of the SEID before reading and dropping packets that are too short.
A vulnerability in the Linux kernel's mt76 WiFi driver was resolved that involved incorrect accounting of non-AQL frames per peer rather than per link. The driver increments and decrements counters for frames on different links, causing the count to drift upwards and potentially block the station. The fix ensures the count is maintained on the primary link's wcid, aligning with other peer-wide state management.
A vulnerability in the Linux kernel's btrfs subsystem related to improper freeing of iov memory when the function btrfs_uring_read_extent() fails has been resolved. The issue was that on failure, the caller skipped freeing the iov memory except in a specific error case (-EIOCBQUEUED), potentially causing a memory leak. The fix ensures that on failure, the code correctly frees the iov memory by falling through to the appropriate cleanup path.
A vulnerability in the Linux kernel's Btrfs filesystem code was resolved by changing the return value of btrfs_uring_read_extent_endio to always return -EIOCBQUEUED. Previously, if all bios finished before btrfs_encoded_read_regular_fill_pages() returned, a negative errno caused double cleanup of resources, potentially leading to use-after-free or double-free conditions.
A vulnerability in the Linux kernel's btrfs filesystem involving io_uring encoded data handling has been resolved. The issue occurs when returning -EAGAIN while leaving btrfs_uring_encoded_data in the command PDU, potentially causing data leaks if requests are cancelled or the ring exits before reissue. The vulnerability relates to improper freeing of driver PDU allocations on cleanup in io_uring operations. The fix ensures that allocations are freed appropriately on error returns to prevent leaks.