A use-after-free vulnerability in the Linux kernel's network team driver was resolved. The issue involved improper reuse of socket buffers (skb) after a queue override operation, leading to potential kernel memory corruption and panic. The flaw was due to incorrect handling of dev_queue_xmit() results and skb ownership, causing a slab-use-after-free error detected by KASAN. This vulnerability could cause kernel crashes and instability.
A vulnerability in the Linux kernel's regulator subsystem was resolved involving the function of_regulator_bulk_get_all(). This function returned an array with uninitialized supply name fields, which could lead to dereferencing uninitialized memory when the array is used by regulator_bulk_enable(). The fix involved copying supply names into the array's allocation to ensure proper initialization and memory safety.
A vulnerability in the Linux kernel's OP-TEE driver allowed TEE devices to be registered before full initialization, leading to potential use of uninitialized mutexes and NULL pointer dereferences. This occurred because tee_device_register() was called prematurely in optee_probe(), exposing devices to user and kernel space before the struct optee was fully set up. The issue has been fixed by deferring device registration until after complete initialization.
A memory leak vulnerability in the Linux kernel's sparx5 network driver was fixed. The issue involved sparx5_tc_matchall_replace() allocating memory for matchall filters without freeing it upon deletion, causing leaked entries. The fix ensures that the allocated entries are freed after being unlinked, preventing memory leaks.
A memory leak vulnerability in the Linux kernel's power sequencing component for pcie-m2 was fixed. The function of_regulator_bulk_get_all() allocates an array that the caller must free, but pwrseq-pcie-m2.c did not free this array, causing a memory leak. The fix adds an explicit kfree() call to release the allocated memory.
A race condition in the Linux kernel device mapper (dm) subsystem was fixed that could cause reading of freed memory during concurrent ioctl calls. This issue occurs when do_resume calls dm_table_get_mode(new_map) without holding locks, potentially leading to use-after-free scenarios. The vulnerability is not considered a security bug because only root can trigger it, and common tools do not invoke the relevant ioctls concurrently. The fix involves reading the mode of the new table before swapping it to prevent the race condition.
A vulnerability in the Linux kernel's memstick subsystem related to the rtsx_usb_ms driver has been resolved. The issue involved requests being dropped silently after a card eject event, causing the removal process to hang indefinitely. This was due to the memstick_check() function passing a removal check just before eject/removing flags were set, leading to requests not being completed and blocking workqueues. The fix ensures requests are always completed, failing them gracefully once eject is set, preventing hangs during device removal.
A vulnerability in the Linux kernel's dm-crypt subsystem was resolved that caused a kernel oops when using the lmk IV mode with AEAD ciphers. This occurs because the lmk mode sets a count of 64 transforms, but only one transform is allocated, leading to out-of-bounds memory access during key setting. The issue is not considered a security bug since exploitation requires root privileges.
A vulnerability in the Linux kernel's io_uring/net subsystem was resolved that involved incorrect handling of IPv6 sockaddr length in connection filtering. The issue caused connect filters to see zeroed port and address fields when the sockaddr_in6 length was 24 bytes (SIN6_LEN_RFC2133), allowing filters that deny connections based on port or address to be bypassed. The fix aligns the length threshold to SIN6_LEN_RFC2133, ensuring filters correctly see the real destination address and port.
A use-after-free vulnerability in the Linux kernel's MediaTek SD card driver (mtk-sd) was resolved by ensuring proper cancellation of delayed work during device removal. The issue involved a timeout callback accessing freed resources after the driver had unbound and released host resources. This could lead to kernel memory corruption detected by KASAN during testing.
A race condition vulnerability in the Linux kernel's key management subsystem was resolved. The flaw allowed a writer with write permission on a destination keyring to bypass keyring restrictions by exploiting a timing issue between restriction installation and key linking. This could result in unauthorized keys being linked despite reject-all restrictions. The issue was confirmed through repeated testing and fixed by reordering operations to ensure proper serialization of restriction checks with semaphore locking.
A vulnerability in the Linux kernel's statmount functionality allowed reading the parent of an unmounted mount under mount_lock, potentially leading to dereferencing a mount that has already been freed. This issue arises because statmount_mnt_basic() reads the parent mount's IDs without proper synchronization when the mount has been unmounted but kept alive by a file descriptor. The flaw has been resolved in the Linux kernel.
A vulnerability in the Linux kernel's mount notification system allows a mount to be queued multiple times for notifications, leading to use-after-free memory access. This occurs because mnt_notify_add() does not check if a mount is already on the notification list, causing corrupted list state and potential kernel memory errors. The issue affects mounts with the MNT_SHRINKABLE flag, such as submounts of NFS, AFS, CIFS, and tracefs. The flaw has been resolved by initializing the notification list properly and preventing duplicate queueing of mounts.
A vulnerability in the Linux kernel's namespace handling was resolved by preventing the MNT_UMOUNT flag from being inherited in clone_mnt(). The issue involved mounts that were lazily unmounted but kept alive by file descriptors still being copied with the MNT_UMOUNT flag set, causing multiple bugs including mount namespace leaks, improper unmount behavior, and corrupted mount propagation. The fix adds MNT_UMOUNT to internal flags so it is not copied during cloning, preventing these issues.
A vulnerability in the Linux kernel's mount propagation logic allowed synchronous unmount operations to succeed even when the mount was still in use. This was due to propagate_mount_busy() not properly checking certain mount copies with children, leading to mounts being silently unmounted while still referenced. The flaw could affect container environments sharing mount trees with the host, causing mounts to be detached unexpectedly.
A vulnerability in the Linux kernel's RISC-V futex implementation allows an unprivileged process to perform atomic read-modify-write operations on arbitrary kernel addresses due to improper handling of tagged user pointers. The issue arises because the futex atomic operations use the raw tagged address without untagging it after access_ok() validation, enabling potential kernel memory manipulation. This vulnerability has been resolved by ensuring the pointer is untagged before the atomic operations.
A vulnerability in the Linux kernel related to namespace handling and unmounting submounts has been resolved. The issue involves the unmounting process where busy mounts may be incorrectly unmounted due to improper reference checks, potentially leading to mounts being marked as synchronously unmounted while still in use. This affects mounts with the MNT_SHRINKABLE flag, such as automounted submounts of NFS, AFS, CIFS, and certain debugfs mounts. The fix ensures that each mount is checked for references right before unmounting under appropriate locks to maintain correctness.
A vulnerability in the Linux kernel related to the RISCV architecture's ghostwrite errata has been resolved. The issue involved improper detection and mitigation of the ghostwrite vulnerability during early boot stages when certain kernel configuration options were set inconsistently. This could cause the system to incorrectly report that a vulnerable CPU was not affected and fail to apply the necessary mitigation. The fix ensures that the vulnerability is detected early and mitigated properly by selecting RISCV_ALTERNATIVE_EARLY in the kernel configuration.
A vulnerability in the Linux kernel Bluetooth RFCOMM implementation causes a memory leak when the data link connection (DLC) has no owner. Specifically, the skb (socket buffer) is not freed in certain conditions, leading to resource leakage. This occurs because the socket implementation does not free the skb when the DLC owner is cleared, unlike the tty implementation which does. The leak can grow indefinitely while the remote device continues sending data.
A use-after-free vulnerability in the Linux kernel's drm/xe component was resolved by fixing stale pinned_link list entries when framebuffer pins perform the final unpin. The issue arises when buffer objects (bo) are pinned both externally and as framebuffers, leading to stale list entries after the final unpin and potential memory corruption.