A vulnerability in the Linux kernel's IPv6 UDP exception cache handling allowed off-path attackers to conduct side-channel attacks to discover ephemeral UDP ports. The issue was due to exceptions being created only when a UDP packet matched an existing socket. The fix ensures exceptions are always created before socket matching, preventing this side-channel. This change may cause additional route lookups and exceptions but does not increase the ability of attackers to create exceptions beyond previous capabilities.
A vulnerability in the Linux kernel's device mapper ioctl interface was resolved where a buffer over-read could occur due to incorrect calculation of a data pointer. This issue involves the struct dm_ioctl, which has trailing padding causing the data_start pointer to run past the allocated buffer size. Although this results in an out-of-bounds read, it can only be triggered by root privileges and is therefore not considered a security bug. The fix clamps the data_start pointer to the buffer size to prevent the over-read.
A vulnerability in the Linux kernel related to IPv4 route notification sizing has been resolved. The issue involves improper handling of nexthop groups when they shrink, leading to a potential null pointer dereference in fib_nexthop_nlmsg_size(). This occurs because the code does not stop sizing when an indexed path is absent after a nexthop group replacement with fewer paths. The fix prevents dereferencing a null pointer by stopping sizing in such cases.
A vulnerability in the Linux kernel's IPv4 UDP handling allowed off-path attackers to perform a side-channel attack on the FIB nexthop exception (FNHE) cache to discover ephemeral UDP port numbers. The issue arises because FNHE entries were only created when a UDP packet matched an existing socket, enabling attackers to infer port information by observing cache behavior. Previous mitigations involving hash randomization were bypassable. The fix ensures FNHE entries are always created before socket matching, preventing attackers from distinguishing valid from invalid guesses based on cache state.
A vulnerability in the Linux kernel's CIPSO option handling was resolved. The cipso_v4_skbuff_delattr() function removed CIPSO bytes but failed to adjust cached offsets for subsequent options, causing consumers to access incorrect bytes. This could lead to improper interpretation of packet data and potential memory corruption when copying option data into fixed-size storage.
A vulnerability in the Linux kernel's xen/netfront component caused a memory leak when xennet_fill_frags() fails due to response chains having more slots than fit in the skb's fragments. The error path did not free the skb properly, leading to resource leakage. This issue has been resolved by ensuring the skb is put back on the temporary queue before error handling proceeds.
A use-after-free vulnerability in the Linux kernel's ice driver was fixed by correcting metadata_dst reference count handling during representor teardown. The issue involved improper freeing of metadata_dst objects while references were still held, potentially leading to memory corruption.
A vulnerability in the Linux kernel's CAN network subsystem was resolved by restoring skb header initialization in the init_can_skb() function. The issue was introduced when certain skb header reset calls were removed, causing RX skbs to carry an invalid mac_header value. This leads to an overflow in push length calculation in packet_rcv_spkt(), triggering a kernel panic and full machine crash. The problem was originally reported in 2014 and fixed then, but the recent commit reintroduced it. The vulnerability affects kernel stability and can cause denial of service via system crash.
A vulnerability in the Linux kernel's ibmveth driver was resolved, involving improper cleanup of the logical LAN resource on failure during the open operation. Specifically, if buffer pool allocation fails after the logical LAN is registered, the cleanup function h_free_logical_lan() was not called, leaving the buffer-list page owned by PHYP when unmapped. This could lead to resource mismanagement. The fix moves the cleanup call to a shared path ensuring deregistration before unmapping the buffer list.
A use-after-free vulnerability in the Linux kernel's gpio mpsse driver was resolved by fixing a race condition when arming the IRQ poll worker. The issue occurred because the poll worker could be scheduled before being properly published, leading to potential access of freed memory after device disconnect. The fix ensures atomic publication and arming of the worker under a spinlock and introduces a dying flag to safely handle teardown and memory freeing.
A vulnerability in the Linux kernel's TCP zerocopy receive mapping was resolved. The issue involved dereferencing a NULL pointer when handling net_iov fragments in zerocopy receive mapping hints, leading to a kernel panic under certain conditions. The fix rejects all net_iov fragments before accessing page mappings, preventing the NULL pointer dereference and associated crash.
A use-after-free vulnerability in the Linux kernel's fsverity subsystem was resolved by introducing an RCU-delay in freeing the struct fsverity_info. The issue arose because __fsverity_get_info() used rcu_read_lock() without proper synchronization with fsverity_remove_info(), leading to potential concurrent access to freed memory for different inodes.
A memory leak vulnerability in the Linux kernel ALSA ctxfi component was fixed by ensuring allocated memory for DAO input mappers is properly freed when clearing them. The issue was caused by missing kfree() calls in the dao_clear_input() function, leading to memory not being released on each call.
A vulnerability in the Linux kernel's mt7603 WiFi driver involved the use of an uninitialized global station WCID for frames without a station or vif, including those injected via a monitor interface. This led to a NULL pointer dereference causing kernel crashes. The issue was fixed by initializing the WCID before publishing it, preventing crashes during frame transmission.
A vulnerability in the Linux kernel's SELinux implementation related to NFSv4 filesystem mounts has been resolved. When an NFSv4 filesystem exported with security_label is mounted a second time, the superblock reuse logic failed to preserve the SECURITY_LSM_NATIVE_LABELS flag, causing per-file security labeling to be silently disabled for both mounts. This issue was fixed by ensuring the SECURITY_LSM_NATIVE_LABELS flag is set correctly on reused superblocks during mount option processing.
A vulnerability in the Linux kernel's WireGuard implementation involving the Noise protocol handshake was resolved. The flaw allowed two threads to process the same response message concurrently, potentially causing a race condition where a handshake state could be incorrectly reused. Although the issue is considered nearly impossible to exploit in practice, a fix was implemented to ensure the ephemeral private key is compared to the latest handshake state to prevent this condition.
A race condition vulnerability in the Linux kernel's strparser component was resolved. The issue involved the __strp_recv function potentially running concurrently while the parser was being torn down, which could lead to use-after-free (UAF) conditions. The vulnerability affects only the espintcp user of strp_recv, and a patch was introduced to add locking mechanisms to prevent this race. The general mode of strp, which could also crash, is unused and slated for removal. A proof-of-concept exploit has been published, but no known exploits are currently in the wild.
A vulnerability in the Linux kernel's gve driver related to AF_XDP zero-copy (ZC) mode caused a buffer leak when the error bit was set in the RX completion descriptor. The issue was that the XSK buffer was not freed properly on error, leading to resource leakage. This vulnerability has been resolved in the Linux kernel.
A vulnerability in the Linux kernel's Xilinx GPIO driver caused a runtime PM (power management) leak on the request error path. The issue arises because pm_runtime_get_sync() increments the usage counter even on failure, and the error path does not properly decrement it, leading to a leaked reference. This prevents the controller from runtime-suspending and keeps its clock enabled unnecessarily. The fix involves switching to pm_runtime_resume_and_get(), which increments the usage counter only on success.
A use-after-free vulnerability in the Linux kernel's TIPC subsystem was resolved. The function tipc_node_find_by_name() returned a node pointer after dropping its RCU read lock without taking a reference, leading to a race condition where handlers could access a freed node. This could cause kernel memory corruption and instability. The issue was detected by KASAN and fixed by acquiring a reference to the node before leaving the RCU read lock and releasing it appropriately after use.