A use-after-free vulnerability in the Linux kernel's net/sched subsystem was fixed in the __tcf_action_put() function. The flaw occurs because the function decrements the reference count before the binding count, allowing another thread to free the action prematurely. This leads to an access of freed memory, which is detected by KASAN as a slab-use-after-free error.
A vulnerability in the Linux kernel's RDS subsystem causes a kernel crash due to an uninitialized pointer dereference in the RDMA CM event handler when handling connect requests on non-InfiniBand RDMA devices such as iWARP. This flaw leads to a NULL pointer dereference and kernel oops, crashing the system. The issue arises because the transport pointer is only assigned for InfiniBand devices, but is dereferenced unconditionally for other device types. The fix initializes the transport pointer explicitly, rejects connect requests on non-IB devices, and prevents route resolution on such devices.
A vulnerability in the Linux kernel SCTP implementation allows a NULL pointer dereference leading to a kernel panic. This occurs when message interleaving is enabled and the first send waits for association establishment, during which the output stream count can be reduced and extensions freed. Subsequent sending operations may dereference a NULL extension, causing a fatal kernel panic.
A vulnerability in the Linux kernel spi: imx driver caused slab corruption due to undersized DMA bounce buffers. The driver allocated DMA buffers smaller than the size used for DMA operations, leading to memory corruption and kernel crashes under heavy load. This issue was fixed by aligning buffer allocation size with the DMA mapping size.
A vulnerability in the Linux kernel's tracing/histograms subsystem allows improper handling of synthetic stacktrace fields. Specifically, non-stacktrace fields can be incorrectly accepted as stacktrace fields, leading to dereferencing of scalar values as kernel stacktrace pointers. This flaw affects certain Linux kernel versions and has been fixed in later releases.
A use-after-free (UAF) vulnerability was identified and fixed in the Linux kernel's GPIO shared proxy handling. The issue involved the GPIO lookup table outliving the kobject whose name string address was assigned to lookup->dev_id, potentially causing a UAF condition. The fix involved duplicating the string to prevent this unsafe memory reference.
A resource leak vulnerability was identified and fixed in the Linux kernel's viai2c-wmt driver. The issue involved the clock reference count not being decremented properly in the wmt_i2c_probe() function, leading to a clock leak. The fix involved switching from manual clock management with of_clk_get() to automatic management using devm_clk_get().
A vulnerability in the Linux kernel's ring-buffer implementation causes a NULL pointer dereference when accessing buffer_meta files for CPUs that never came online. This occurs because buffer_meta files are created for all possible CPUs, but the underlying buffer is only allocated when the CPU is online. The issue has been fixed by failing the open operation with -ENODEV for CPUs without a buffer.
A vulnerability in the Linux kernel's ring-buffer implementation was fixed in version 6.12. The function rb_meta_subbuf_idx() could return an incorrect sub-buffer index, causing an off-by-one error that led to a NULL pointer dereference when userspace mapped trace_pipe_raw. This flaw affected the handling of persistent ring buffers and could cause the loss of trace data from previous boots.
A vulnerability in the Linux kernel's ring buffer handling was fixed to address a false warning triggered by the mmap reader when it catches up with a writer still committing events. The issue involved incorrect error treatment of a NULL return from rb_get_reader_page(), leading to unnecessary warnings. The fix ensures that NULL is handled gracefully without warning and removes redundant checks.
A buffer overflow vulnerability in the Linux kernel's SCSI bsg interface was fixed by adjusting the reply buffer size to accommodate larger UFS ARPMB replies. The original buffer was 96 bytes, but the UFS RPMB reply structure requires 104 bytes, causing an 8-byte overflow when handling Advanced RPMB commands.
A use-after-free race condition was identified and fixed in the Linux kernel's SCSI tape driver (st). The issue occurred due to improper ordering in st_remove() where the scsi_tape structure could be freed while still accessible via an index, leading to potential use-after-free during concurrent open operations.
A vulnerability in the Linux kernel's xen/scsifront driver allows a malicious or buggy backend to cause a guest system crash by sending a backend response with an invalid request ID (rqid). The flaw occurs because the driver dereferences a NULL shadow entry without checking if it is populated, leading to a NULL pointer dereference. This issue affects Linux kernel version 5.19 and has been fixed in subsequent commits.
A vulnerability in the Linux kernel's libiscsi SCSI subsystem allows a negative task index to be used in parse_pdu_itt, leading to an out-of-bounds read from the session commands array. This occurs because the index is only bounded from above, not below, allowing negative values to access memory before the array. The issue is related to the beiscsi driver forwarding unsolicited NOP-In PDUs without properly sanitizing the ITT value. The flaw has been fixed by adding a lower bound check on the index in the relevant lookups.
A vulnerability in the Linux kernel's iSCSI implementation allows improper validation of the Initiator Task Tag (ITT) reflected in a Reject Protocol Data Unit (PDU). This flaw can cause the kernel to complete in-flight SCSI commands incorrectly, potentially returning incorrect data without warning. The issue arises because the reflected ITT is not properly validated, leading to possible task reference underflows and kernel warnings. The vulnerability has been fixed by improving validation of the reflected ITT to ensure it corresponds to an in-flight task.
A vulnerability in the Linux kernel's iSCSI implementation allows a target to reference invalid task slots in the task pool, leading to null pointer dereferences and kernel crashes. This occurs because the task validation in management responses does not sufficiently verify that the task is active and valid. The issue has been fixed by requiring that tasks be in flight and not SCSI commands, preventing invalid task references.
A NULL pointer dereference vulnerability was identified and fixed in the Linux kernel's drm/amd/display USB4 bandwidth functions. The issue arises because ASSERT checks on stream->sink are compiled out in production, allowing a NULL stream->sink to cause a crash. The fix replaces ASSERTs with proper NULL checks and adds guards to prevent dereferencing NULL pointers.
A vulnerability in the Linux kernel's AMDGPU driver (amdgpu_gpr) causes a runtime power management reference count underflow when reading wave registers on Navi31 hardware. This occurs because the runtime PM reference is dropped twice if copying data to userspace fails, potentially leading to improper power management state.
A vulnerability in the Linux kernel's AMDGPU driver caused a GEM object memory leak when the amdgpu_hmm_range_alloc() function fails during the userptr ioctl operation. This occurs because the error path returns early without proper cleanup, leaving behind allocated GEM objects and associated references.
A vulnerability in the Linux kernel's AMDGPU driver (version 6.16) involves improper handling of the eviction fence for buffer objects (BO). The eviction fence is detached prematurely when closing any handle to a BO, even if other handles remain open, potentially allowing the BO to be evicted while still in use by user queues. This issue has been fixed by ensuring the eviction fence remains until the last handle to the BO is closed.