A vulnerability in the Linux kernel's usb subsystem (xusbatm driver) was resolved. The issue involved incorrect pointer arithmetic on the USB device ID table when dynamic IDs are used, leading to out-of-bounds indexing. The fix involved avoiding reliance on pointer arithmetic and disabling dynamic ID support for xusbatm.
A vulnerability in the Linux kernel's USB Pegasus driver involves incorrect pointer arithmetic when handling dynamic USB device IDs. The existing code incorrectly calculates an index when dynamic IDs are involved, potentially leading to out-of-bounds pointer usage. The issue is addressed by updating the dynamic ID parsing to use the driver_info field instead of relying on pointer arithmetic and removing the problematic loop.
A vulnerability in the Linux kernel's ath9k_htc WiFi driver was resolved. The issue involved storing the usb_device_id, which is not guaranteed to persist beyond the probe phase due to dynamic IDs. The fix involves storing only driver_data, which is reliably retrievable from the usb_device structure.
A vulnerability in the Linux kernel's XFS filesystem code could cause a memory leak when the rhashtable insertion fails during quota accounting. Specifically, the function xqcheck_mod_live_ino_dqtrx does not free a newly allocated dqa object if the insertion into the rhashtable fails, leading to resource leakage. This issue has been resolved in certain Linux kernel versions.
A vulnerability in the Linux kernel's XFS filesystem code could cause a locked buffer to be leaked if an IO error occurs during buffer list write operations. This issue has been resolved in specific linux-hwe-edge kernel versions.
A vulnerability in the Linux kernel's XFS filesystem code could cause the system to spin indefinitely when processing zero-length directory entries during directory salvage operations. This issue has been resolved to prevent infinite spinning on such malformed entries.
A vulnerability in the Linux kernel's bnxt_en driver was resolved that involved improper freeing of memory related to the live ring's TPA state on queue restart failure. Specifically, during a queue restart failure, the live ring's memory could be freed while still in use due to shallow copying and incomplete pointer initialization in the clone structure. This could lead to use-after-free conditions. The fix involved initializing the clone's pointers to NULL to prevent inadvertent freeing of live ring state memory.
A vulnerability in the Linux kernel's io_uring/net subsystem was resolved that caused overconsumption of buffers when using recv/recvmsg with the MSG_TRUNC flag. When the incoming packet is larger than the provided buffer, the net layer incorrectly returns the full packet length instead of the actual copied bytes, leading io_uring to advance the buffer ring more than it should. This issue affects specific versions of linux-hwe-edge kernel. The vulnerability has been fixed to correctly consume only the filled buffer region while preserving MSG_TRUNC semantics.
A vulnerability in the Linux kernel's filesystem freezing mechanism causes incorrect error reporting during nested thaw operations. This leads to a leaked freeze count on block devices when multiple freeze holders are involved, preventing the device from being mounted again until reboot or device destruction. The issue affects certain Linux kernel versions and disrupts block device management after freeze and thaw sequences involving device-mapper or LVM snapshots.
A vulnerability in the Linux kernel's Bluetooth btrtl component was resolved. The issue involved leaking an uninitialized return code when parsing firmware format v2, specifically when the key_id from the chip is zero and security headers are ignored. The flaw caused the function rtlbt_parse_firmware_v2() to leak return codes from previous sections due to improper control flow in a switch statement. This has been fixed by correctly skipping the loop iteration with a continue statement.
A vulnerability in the Linux kernel's tracing/user_events subsystem was fixed where fields of a trace event could be destroyed prematurely if event removal failed, leaving the event in an inconsistent state. This could cause subsequent interactions with the event to operate on an empty field list while the event remains visible in tracefs.
A vulnerability in the Linux kernel's tracing subsystem was resolved to prevent dereferencing a freed trace_event_file during deferred trigger free operations. The issue involved the enable_event trigger deferring a reference decrement to a kernel thread, which could access a trace_event_file that had already been freed when the instance was removed. The fix keeps the trace_event_call directly in enable_trigger_data to avoid accessing freed memory.
A vulnerability in the Linux kernel's net/sched cls_api subsystem was resolved to prevent excessive CPU usage and system hangs caused by repeated RTM_GETCHAIN requests on netlink sockets without reading responses. The issue arises when tc_ctl_chain() replays RTM_GETCHAIN requests unnecessarily, leading to CPU hogging and a hung task state. The fix restricts replay logic to RTM_NEWCHAIN requests only. This vulnerability affects specific versions of the linux-hwe-edge kernel.
A vulnerability in the Linux kernel's ice network driver was resolved to prevent dereferencing invalid pointers in TP_printk() trace events. The issue involved double dereferencing pointers after event recording, which could lead to invalid memory access when printing trace events. This was fixed by copying scalar values into the event instead of dereferencing pointers later.
A vulnerability in the Linux kernel's vhost-vdpa component was resolved that involved improper handling of the eventfd_ctx_fdget() return value in the vhost_vdpa_set_config_call() function. The function swapped the return value into a configuration context field before checking for errors, briefly allowing an error pointer (ERR_PTR) to be stored. This could cause a rejected file descriptor to disrupt configuration interrupts, silently stopping them until a new file descriptor was installed by userspace.
A vulnerability in the Linux kernel related to BPF (Berkeley Packet Filter) handling has been resolved. The issue involves incorrect prediction of JMP32 pointer versus zero comparisons, causing the kernel to misinterpret certain jump instructions. This affects specific Linux kernel versions used in various Ubuntu HWE edge releases. The vulnerability has a CVSS score of 7.0, indicating a medium severity with high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. A fix has been applied to the affected versions.
A vulnerability in the Linux kernel's BPF subsystem related to the handling of scalar IDs in linked registers has been resolved. The issue involves improper resurrection of scalar IDs dropped by the collect_linked_regs() function, potentially causing synchronization inconsistencies in register states during BPF program execution. This flaw was addressed by adjusting the order of linked register collection to prevent incorrect register state propagation.
A vulnerability in the Linux kernel's BPF verifier allows it to incorrectly infer that a pointer with an unbounded offset is non-NULL based solely on its type. This can lead to a NULL pointer dereference at runtime when the verifier accepts an invalid pointer arithmetic scenario. The issue is addressed by requiring the offset to be within a defined bound in the reg_not_null() function.
A vulnerability in the Linux kernel related to the eBPF subsystem's handling of bpf_fastcall patterns has been resolved. The issue involved incorrect rewriting of instruction patterns when jumps interrupted the expected 'spill; call; fill' sequence, potentially causing unsound behavior in the kernel's BPF verifier or execution. This flaw was fixed by ensuring that jump-targeted instructions are properly recorded and that pattern growth stops at such instructions, preserving the integrity of the rewrite process.
In the Linux kernel, the following vulnerability has been resolved: erofs: disable LZ4 rolling decompression for now LZ4 rolling decompression [1] was introduced to reduce the memory footprint of temporary pages: For many cases, it is needed for users to read small data within a compressed extent (pcluster), either due to random small read, or since uptodate folios (typically order-0) cannot be reused for decompression again since decompression algorithm refills already-uptodate folios. Rolling decompression works because LZ4 is LZ77-based and only refers to the most recent 64 KiB of decompressed data, so in theory only a bounded rolling window of temporary pages is needed when decompressing. It can save a lot of temporary memory, e.g. 601,960-byte data can be compressed into a 256k LZ4 compressed extent, which means it needs 146 extra pages per request in the worst case if rolling decompression is disabled. However, the upstream LZ4 implementation is not under EROFS' control: For example, the literal copy memmove() may still **copy long literals backward** on x86 based on the address comparison even when the source and destination ranges do not overlap (IOWs, inline decompression doesn't need to be considered here). That breaks the rolling assumption and makes the optimization broken. Disable it for now to make sure the data correctness first since EROFS is used everywhere now: The rolling window approach can be revived once we either ensure that the official LZ4 code always copies forward for non-overlapping ranges or maintain our own LZ4 implementation in EROFS. The main impact is a higher runtime memory footprint; However, recent commit 0f6273ab4637 ("erofs: add a reserved buffer pool for lz4 decompression") helps mitigate this when enabled but it's still not perfect. [1] https://www.usenix.org/conference/atc19/presentation/gao § 3.3 Decompression