A vulnerability in the Linux kernel's ip6_gre module related to obsolete ERSPAN PMTU update handling has been resolved. The issue involved a null pointer dereference caused by the legacy Path MTU (PMTU) update code treating a metadata destination as a route without an output device, leading to a kernel panic. The obsolete code was removed to align ERSPAN with current IPv6 GRE PMTU handling, eliminating the null pointer dereference.
A vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem was resolved. The flaw involved improper teardown of topsrv workqueues before closing subscriber connections, leading to race conditions. These races could cause use-after-free errors, queueing work on destroyed workqueues, and RCU stalls during network exit. The fix changes the teardown order, adds a shutdown flag to refuse lookups during teardown, and ensures workqueues are destroyed before closing connections.
A use-after-free vulnerability in the Linux kernel's memstick subsystem was resolved by ensuring that asynchronous requests complete before freeing the card structure. The issue occurred because wait_for_completion_timeout() was used, which could time out and free memory while requests were still in flight, leading to a kernel slab-use-after-free write.
A use-after-free vulnerability in the Linux kernel's ice driver was fixed. The flaw occurs in the dynamic port cleanup function ice_dealloc_dynamic_port(), where the code frees a VSI object before using its index to erase a dynamic port entry, leading to use-after-free. The fix involves erasing the xarray entry before freeing the VSI, following the reverse order of allocation.
A vulnerability in the Linux kernel workqueue subsystem was resolved that could cause a NULL pointer dereference when checking chained work. The issue arises because current_wq_worker() indicates a kworker but does not guarantee it is executing a work item, leading to a potential fault when worker->current_pwq is NULL during certain queue states.
A deadlock vulnerability in the Linux kernel's GVE driver was resolved. The issue occurs when disabling XSK pools, where unlocked versions of napi_disable and napi_enable are called while the netdev lock is already held, causing a deadlock. The fix updates these calls to use the locked versions to prevent the deadlock.
A race condition vulnerability in the Linux kernel's brcmfmac WiFi driver caused a kernel crash when the driver was removed while a user space process that created a P2P device was still exiting. This double removal of the P2P device interface leads to a use-after-free fault and kernel oops. The issue occurs due to concurrent removal paths attempting to unregister and free the same device interface.
A type confusion vulnerability in the Linux kernel's ati_remote2 driver was resolved by correcting device attribute handlers. The issue arose because attribute callbacks incorrectly treated usb_interface pointers as usb_device pointers, leading to invalid pointer usage. This was fixed by updating the callbacks to use the correct usb_interface pointers.
A reference leak vulnerability in the Linux kernel's Btrfs filesystem scrub functionality was fixed. The issue occurred in the scrub_print_warning_inode() function, where a reference obtained by btrfs_get_fs_root() was not properly released if paths_from_inode() failed, causing a local_root reference leak. This leak happened every time path resolution failed during scrub warning printing. The fix ensures the reference is dropped on the failure path to prevent the leak.
A race condition in the Linux kernel's cpuset subsystem related to CPU hotplug operations could lead to a NULL pointer dereference. This occurs because the update order of cpu_active_mask and cpu_online_mask allows a race window where the top cpuset may have no active CPU. The issue was fixed by reintroducing a NULL check in guarantee_active_cpus() to prevent dereferencing a NULL pointer.
A vulnerability in the Linux kernel's openvswitch component caused a soft lockup during netlink flow dumps on production compute nodes with many datapath flows. The issue arises because the softirq backlog refills as fast as it drains, causing the dumping thread to monopolize CPU time without rescheduling, leading to a system hang. The fix involves holding bottom halves off across the entire callback to prevent nested softirq draining, ensuring the CPU can reschedule properly.
A vulnerability in the Linux kernel's skb_copy_and_csum_bits() function could cause stale memory bytes to be sent in network packets. When the function encounters unreadable fragments, it copies only the linear part of the buffer and leaves the rest unchanged, potentially leaking residual memory data in ICMP error messages or driver transmit buffers. The issue has been resolved by zeroing the unfilled parts of the buffer to prevent unintended data leakage.
A vulnerability in the Linux kernel's SCSI changer driver (ch) caused references to data transfer element devices to be retained improperly. This led to scsi_device objects never being released after device removal, preventing the unloading of the low-level driver module and requiring a system reboot to recover. The issue was fixed by dropping the reference immediately after use and removing the unused array that caused the leak.
A vulnerability in the Linux kernel's packet_rcv_spkt() function could cause a kernel panic when processing packets on devices without a visible link layer header, such as CAN interfaces. The issue arises because packet_rcv_spkt() does not guard the link layer header push operation, leading to an invalid length calculation and a panic in skb_push(). This flaw was introduced when other receive paths were updated but packet_rcv_spkt() was not. The vulnerability has been resolved by adding the appropriate guard to prevent the panic.
A vulnerability in the Linux kernel's Xilinx axienet network driver was resolved. The issue involved the improper freeing of DMA buffers on dmaengine stop, causing a memory leak of SKBs and DMA mappings during interface shutdown. This could exhaust limited IOMMU aperture resources. The fix ensures all DMA-mapped buffers are properly unmapped and freed on stop, and adds synchronization to prevent race conditions between buffer callbacks and driver stop operations.
A vulnerability in the Linux kernel regulator driver for the LTC3676 chip involved reading write-only registers HRST and CLIRQ. These registers trigger hardware reset and interrupt clear commands when written, but reading them causes unintended board resets. The issue was resolved by making these registers writable only and preventing reads that cause resets.
A vulnerability in the Linux kernel's TPS6594 regulator driver was resolved involving an out-of-bounds array access due to an incorrect count of linear voltage ranges. The issue affects the TPS65224 BUCK2, BUCK3, and BUCK4 descriptors, as well as TPS652G1, where the code reads beyond the defined array when checking voltage selectors. This could cause improper handling of voltage constraints during regulator registration.
A use-after-free vulnerability in the Linux kernel's net/smc subsystem was resolved. The flaw occurs in the smc_getname() function, which dereferences a pointer to a CLC socket without proper locking, allowing a race condition where the socket may be released asynchronously. This can lead to either a use-after-free or a NULL pointer dereference during getsockname() calls. The fix involves holding the clcsock_release_lock to serialize access and returning an error if the socket has already been released.
A vulnerability in the Linux kernel's RISC-V architecture under CONFIG_SHADOW_CALL_STACK allowed an unprivileged user to bypass kernel shadow call stack pointer reload checks by manipulating the user-writable tp register. This could lead to arbitrary kernel memory write and control-flow hijacking. The issue was fixed by changing the check to rely on the hardware sstatus.SPP bit, which cannot be forged by user mode, ensuring correct reload of the shadow call stack pointer on user traps.
A vulnerability in the Linux kernel's network team driver was resolved involving improper handling of broadcast packets when no transmitable port is available. The function bc_transmit() sends the original socket buffer (skb) through the last transmitable port, but if no port is transmitable, it returns false without consuming the skb. However, team_xmit() incorrectly returns NETDEV_TX_OK, causing AF_PACKET sockets to retain the skb and its associated socket write-memory charge, potentially leading to resource leaks. The fix ensures the original skb is freed on the no-port path while maintaining existing drop accounting.