A race condition vulnerability in the Linux kernel's key management subsystem was resolved. The flaw allowed a writer with write permission on a destination keyring to bypass keyring restrictions by exploiting a timing issue between restriction installation and key linking. This could result in unauthorized keys being linked despite reject-all restrictions. The issue was confirmed through repeated testing and fixed by reordering operations to ensure proper serialization of restriction checks with semaphore locking.
A vulnerability in the Linux kernel's statmount functionality allowed reading the parent of an unmounted mount under mount_lock, potentially leading to dereferencing a mount that has already been freed. This issue arises because statmount_mnt_basic() reads the parent mount's IDs without proper synchronization when the mount has been unmounted but kept alive by a file descriptor. The flaw has been resolved in the Linux kernel.
A vulnerability in the Linux kernel's mount notification system allows a mount to be queued multiple times for notifications, leading to use-after-free memory access. This occurs because mnt_notify_add() does not check if a mount is already on the notification list, causing corrupted list state and potential kernel memory errors. The issue affects mounts with the MNT_SHRINKABLE flag, such as submounts of NFS, AFS, CIFS, and tracefs. The flaw has been resolved by initializing the notification list properly and preventing duplicate queueing of mounts.
A vulnerability in the Linux kernel's namespace handling was resolved by preventing the MNT_UMOUNT flag from being inherited in clone_mnt(). The issue involved mounts that were lazily unmounted but kept alive by file descriptors still being copied with the MNT_UMOUNT flag set, causing multiple bugs including mount namespace leaks, improper unmount behavior, and corrupted mount propagation. The fix adds MNT_UMOUNT to internal flags so it is not copied during cloning, preventing these issues.
A vulnerability in the Linux kernel's mount propagation logic allowed synchronous unmount operations to succeed even when the mount was still in use. This was due to propagate_mount_busy() not properly checking certain mount copies with children, leading to mounts being silently unmounted while still referenced. The flaw could affect container environments sharing mount trees with the host, causing mounts to be detached unexpectedly.
A vulnerability in the Linux kernel's RISC-V futex implementation allows an unprivileged process to perform atomic read-modify-write operations on arbitrary kernel addresses due to improper handling of tagged user pointers. The issue arises because the futex atomic operations use the raw tagged address without untagging it after access_ok() validation, enabling potential kernel memory manipulation. This vulnerability has been resolved by ensuring the pointer is untagged before the atomic operations.
A vulnerability in the Linux kernel related to namespace handling and unmounting submounts has been resolved. The issue involves the unmounting process where busy mounts may be incorrectly unmounted due to improper reference checks, potentially leading to mounts being marked as synchronously unmounted while still in use. This affects mounts with the MNT_SHRINKABLE flag, such as automounted submounts of NFS, AFS, CIFS, and certain debugfs mounts. The fix ensures that each mount is checked for references right before unmounting under appropriate locks to maintain correctness.
A vulnerability in the Linux kernel related to the RISCV architecture's ghostwrite errata has been resolved. The issue involved improper detection and mitigation of the ghostwrite vulnerability during early boot stages when certain kernel configuration options were set inconsistently. This could cause the system to incorrectly report that a vulnerable CPU was not affected and fail to apply the necessary mitigation. The fix ensures that the vulnerability is detected early and mitigated properly by selecting RISCV_ALTERNATIVE_EARLY in the kernel configuration.
A vulnerability in the Linux kernel Bluetooth RFCOMM implementation causes a memory leak when the data link connection (DLC) has no owner. Specifically, the skb (socket buffer) is not freed in certain conditions, leading to resource leakage. This occurs because the socket implementation does not free the skb when the DLC owner is cleared, unlike the tty implementation which does. The leak can grow indefinitely while the remote device continues sending data.
A use-after-free vulnerability in the Linux kernel's drm/xe component was resolved by fixing stale pinned_link list entries when framebuffer pins perform the final unpin. The issue arises when buffer objects (bo) are pinned both externally and as framebuffers, leading to stale list entries after the final unpin and potential memory corruption.
A vulnerability in the Linux kernel's drm/imagination driver caused incorrect sizing of page table preallocation. The issue stemmed from miscalculating the size of memory preallocation, leading to excessive allocation of MMU pages. This could exhaust system memory and cause an out of memory (OOM) panic. The vulnerability has been resolved by correcting the calculation to count tables properly and prevent underflow errors when mappings cross page table boundaries.
A vulnerability in the Linux kernel's mount namespace handling allows recursive bind mounts of mount namespace files, which can cause cycles and unlimited resource leaks. The issue arises because the kernel does not fully check for mount namespace loops when performing recursive bind mounts with MS_REC, allowing a process to create a bind-mount stack of mount namespace file descriptors that leaks kernel memory.
A vulnerability in the Linux kernel's AMDGPU driver was resolved by restricting doorbell buffer objects (BOs) to only those created in the doorbell domain. The flaw allowed any BO passed as a doorbell handle to be pinned into the doorbell domain, which could cause loss of buffer contents when moved improperly. This could be exploited by a client sharing a buffer with another client on the same device. The fix rejects BOs not created in the doorbell domain.
A vulnerability in the Linux kernel's drm/vmwgfx component was resolved by validating the pitch value received from userspace along with box dimensions before copying data. This fix addresses potential out-of-bounds reads that could occur during cursor snooping.
A vulnerability in the Linux kernel's drm/panthor driver was resolved that involved improper validation of the userspace queue count against the number of initialized firmware slots. Unprivileged userspace could request more queues than the firmware had initialized, leading to potential crashes due to dereferencing uninitialized stream interfaces.
A use-after-free vulnerability in the Linux kernel's drm/xe/i2c driver was resolved. The issue occurs because a work item related to the i2c client device can remain queued or running after the adapter is unregistered and its memory freed, leading to dereferencing freed memory. The fix involves reordering the teardown process to unregister the bus notifier before client device teardown and canceling the work to prevent new scheduling and drain queued work items.
A concurrency vulnerability in the Linux kernel Bluetooth ISO socket connect function (iso_sock_connect) has been resolved. The flaw allowed concurrent connect calls to bypass socket state checks, potentially leading to use-after-free conditions due to race conditions in connection setup and teardown. The fix serializes concurrent connect calls by marking the connect operation in progress and rejecting concurrent attempts until completion. This prevents destination overwrites and stranded connection references.
A vulnerability in the Linux kernel's drm/fb-helper component was resolved. The issue involved improper handling of failures in drm_fb_helper_single_fb_probe(), where failures other than -EAGAIN did not mark the fb_helper for deferred setup. This caused stale mode_set configurations to be committed later, triggering warnings. The fix ensures deferred setup is marked on any failure, preventing stale commits until a successful re-probe occurs.
A vulnerability in the Linux kernel's drm/bridge th1520-dw-hdmi driver was fixed by correcting the remove() callback. The driver incorrectly handled a pointer type during teardown, which could cause improper cleanup.
A vulnerability in the Linux kernel's namespace handling was resolved by ensuring the old parent's ->overmount pointer is reset in the mnt_change_mountpoint() function. Previously, this pointer could become a dangling reference after certain mount operations, leading to use-after-free (UAF) conditions. This issue arises when mounts are reparented and the old parent's ->overmount is not cleared, potentially allowing references to freed mount structures.