A vulnerability in the Linux kernel's flow_dissector component caused incorrect computation of the transport header offset (thoff) due to 16-bit truncation of skb->len. This could lead to the transport header pointer being set incorrectly inside the Ethernet header. The issue affects handling of large skbs (socket buffers) exceeding 64KB, which are common with certain network features like GSO and BIG TCP. The vulnerability has been resolved by changing the comparison to use 32-bit integers and capping the offset when it cannot fit in 16 bits, reporting dissection failure instead of returning incorrect offsets.
A memory leak vulnerability in the Linux kernel's vsock component was fixed in the function vmci_transport_recv_dgram_cb(). The leak occurs during the closure of a datagram socket when packets are moved between the socket's backlog and receive queue improperly, leading to unreleased memory. The fix involves adding a receive queue cleanup in the socket destructor.
A vulnerability in the Linux kernel's Btrfs filesystem was resolved involving the replacement of extended attributes (xattrs) when multiple xattrs are packed in the same directory item. The issue occurs when replacing an xattr value with a different size, leading to an uninitialized directory item and filesystem corruption detected during extent buffer writeback. This can cause transaction aborts and loss of xattr data.
A vulnerability in the Linux kernel's PFCP packet processing was resolved by ensuring the SEID field is fully linearized before being read. The pfcp_encap_recv() function previously only ensured the UDP and PFCP headers were linear, but when the S flag was set, pfcp_session_recv() read the 8-byte SEID without verifying it was fully in the linear area. This could cause out-of-bounds reads from fragmented or short packets. The fix involves pulling up to the end of the SEID before reading and dropping packets that are too short.
A vulnerability in the Linux kernel's mt76 WiFi driver was resolved that involved incorrect accounting of non-AQL frames per peer rather than per link. The driver increments and decrements counters for frames on different links, causing the count to drift upwards and potentially block the station. The fix ensures the count is maintained on the primary link's wcid, aligning with other peer-wide state management.
A vulnerability in the Linux kernel's HID steam driver has been fixed by rearranging the teardown sequence. The issue involved a narrow timing window during cleanup where callbacks could be scheduled referencing a freed steam struct, leading to potential use-after-free conditions. The fix also ensures that work canceling for rumble and mode switch occurs properly during steam device unregistration.
A vulnerability in the Linux kernel's btrfs subsystem related to improper freeing of iov memory when the function btrfs_uring_read_extent() fails has been resolved. The issue was that on failure, the caller skipped freeing the iov memory except in a specific error case (-EIOCBQUEUED), potentially causing a memory leak. The fix ensures that on failure, the code correctly frees the iov memory by falling through to the appropriate cleanup path.
A vulnerability in the Linux kernel's Btrfs filesystem code was resolved by changing the return value of btrfs_uring_read_extent_endio to always return -EIOCBQUEUED. Previously, if all bios finished before btrfs_encoded_read_regular_fill_pages() returned, a negative errno caused double cleanup of resources, potentially leading to use-after-free or double-free conditions.
A resource leak vulnerability in the Linux kernel's mlxsw spectrum_flower component was fixed. The flaw involved port range registers acquired during flow template parsing that were not properly released, leading to a resource leak. The fix ensures that these registers are released correctly to prevent the leak.
A vulnerability in the Linux kernel's btrfs filesystem involving io_uring encoded data handling has been resolved. The issue occurs when returning -EAGAIN while leaving btrfs_uring_encoded_data in the command PDU, potentially causing data leaks if requests are cancelled or the ring exits before reissue. The vulnerability relates to improper freeing of driver PDU allocations on cleanup in io_uring operations. The fix ensures that allocations are freed appropriately on error returns to prevent leaks.
A vulnerability in the Linux kernel related to the HID steam driver has been resolved. The issue involved improper handling of registration and unregistration flows, which could leave a lingering power_supply object after the steam object was torn down. The fix refactors the registration logic, removing assumptions about serial numbers and correcting the omission of unregistering the battery when registration steps fail.
A vulnerability in the Linux kernel's KVM arm64 nested virtualization implementation was resolved by fixing the lifecycle management of the nested_mmus array. This array holds shadow page tables used during nested guest execution. Previously, if a VCPU_INIT event occurred while a virtual CPU was running a nested context and the nested_mmus array needed relocation, the vCPU could continue using a pointer to a freed structure, leading to use-after-free conditions. The fix changes the nested_mmus array to an array of pointers allocated at VM creation to avoid reallocations and clarifies object lifecycles.
A vulnerability in the Linux kernel's Rust IRQ handling was resolved by changing how RegistrationInner is passed as a cookie to request_irq. The issue involved accessing uninitialized memory in the IRQ callback due to the IRQ being enabled before RegistrationInner was fully initialized. This flaw was fixed by ensuring RegistrationInner's fields are initialized before passing it as the IRQ cookie. The vulnerability does not affect mainline Linux kernels where a related commit removed the problematic pattern.
A vulnerability in the Linux kernel USB hub driver related to USB3 root hubs has been resolved by reducing the post-resume hold time from 200ms to 120ms. The previous 200ms hold time could trigger an issue on AMD platforms, causing crashes when Android adb repeatedly polls and wakes the USB subsystem. The fix optimizes the hold time for USB3 root hubs without affecting external hubs, improving stability and preventing crashes.
A vulnerability in the Linux kernel's perf subsystem allowed users with kernel profiling privileges to bypass intended permission checks when requesting kernel callchain data. The flaw was due to an incomplete permission check that did not enforce kernel profiling privilege for kernel callchain collection when kernel sampling was excluded. This issue has been resolved by updating the permission checks to properly gate kernel callchain requests, preventing unprivileged access.
A use-after-free vulnerability in the Linux kernel's EDAC altera driver was fixed. The issue occurred in error paths of altr_edac_a10_device_add() and altr_portb_setup() where a dci structure was freed before unregistering IRQ handlers, potentially allowing IRQs to access freed memory.
A vulnerability in the Linux kernel IPv6 segment routing code (seg6_make_flowlabel) was resolved by using skb_get_hash_net() to properly obtain a network pointer. The issue arose when seg6_make_flowlabel() was called with an skb lacking both skb->dev and skb->sk pointers, which could occur in specific network scenarios involving TIPC UDP bearers and IPv4 routes with seg6 encapsulation enabled. This was fixed by ensuring the function uses skb_get_hash_net() to retrieve the network namespace pointer correctly.
A vulnerability in the Linux kernel related to x86 memory management was resolved by removing an unnecessary PMD page copy during page freeing. The issue caused a possible deadlock on systems with discrete GPUs due to a circular locking dependency involving mmap locks and memory reclaim operations. The fix detaches the original PMD page earlier and frees page tables without additional allocations, eliminating the locking cycle.
A vulnerability in the Linux kernel's MACsec driver was resolved by initializing the SecY component before registering the network device. The issue caused warnings and potential reporting of uninitialized SecY attributes during device registration, particularly when MAC offload was used over an LRO-capable lower device with IPv4 forwarding enabled. The fix involves reordering initialization steps to ensure SecY and related attributes are properly set before notifications are emitted.
A vulnerability in the Linux kernel's filesystem code caused hung tasks when unmounting filesystems after disk removal. The issue stemmed from repeated scans of inodes during eviction, which could block unmount operations and trigger hung-task reports. A patch was applied to change the inode eviction process to avoid repeated scanning and ensure proper inode disposal without blocking. Testing confirmed the fix resolves the issue without introducing regressions.