A vulnerability in the Linux kernel's pivot_root() function involves improper checks of mount points before reading their parent mounts. The issue arises when new_root or the caller's root is a file descriptor to a mount that has been unmounted but still kept alive by the file descriptor, potentially leading to a use-after-free condition. The vulnerability causes a read operation on freed memory, resulting in a kernel bug detected by KASAN. The fix involves verifying that both mounts are in the caller's mount namespace before accessing their parents, preventing the unsafe read. All error paths return EINVAL, so no other side effects occur.
A vulnerability in the Linux kernel's drm/vc4 component involved a memory leak where the BO cache size list was not freed during teardown, leading to resource leakage on every unbind operation. This issue has been resolved by ensuring the size list is freed properly in vc4_bo_cache_destroy().
A vulnerability in the Linux kernel's cxgb4 driver related to ch_ktls handling has been resolved. The issue involves improper locking when erasing entries from a shared tid_list array, which can lead to a spinlock deadlock due to softirqs not being disabled during xa_erase operations. The fix involves using xa_erase_bh() to properly disable softirqs and prevent lock contention.
A vulnerability in the Linux kernel's dcache handling has been resolved. The issue involves improper handling of mountpoints on dentries that are being removed, allowing a bind mount of a directory being removed to be moved beneath an existing mount. This causes the mount to remain on the removed directory indefinitely, preventing its detachment. The flaw arises due to a race condition between detach_mounts() and d_delete(), where the victim dentry is still hashed and not properly locked during mount operations.
A use-after-free vulnerability in the Linux kernel's AMT relay component was resolved. The issue involved queuing a packet buffer (skb) referencing a tunnel that could be freed before the packet was processed, leading to a use-after-free in amt_dev_xmit(). The fix changes the relay's General Query sending method to avoid queuing and referencing freed tunnels, removing unsafe skb control block usage. This eliminates the use-after-free condition and related kernel warnings.
A use-after-free (UaF) vulnerability in the Linux kernel's cgroup cpuset subsystem was resolved by avoiding direct access to a potentially stale pointer in the is_in_v2_mode() function. The fix introduces a new flag to safely indicate cpuset v2 mode, preventing unsafe memory access during cgroup filesystem rebind operations.
A vulnerability in the Linux kernel's XFS filesystem handling was resolved that involved improper management of reflink flags during file extent exchanges. The flaw caused reflink flags to be incorrectly transferred between files during certain extent exchange operations, potentially leading to data corruption due to writes occurring in place instead of copy-on-write. The fix stops exchanging reflink flags during these operations and ensures both inodes retain the flag as appropriate. The vulnerability affects the XFS_IOC_SWAPEXT operation as well, which was corrected by setting reflink flags on both inodes and ensuring copy-on-write forks exist. The reflink flags remain set until explicitly removed by specific operations.
A vulnerability in the Linux kernel related to mount locking for automounts across user namespaces has been resolved. The issue involved improper locking of mounts when mounts are propagated across user namespaces, causing the host's mount to be locked instead of the child's copy. This could prevent the host from changing mount flags correctly. The fix ensures that the lock is applied to the mount in the namespace where the mount actually occurs, preserving correct mount flag management.
A vulnerability in the Linux kernel's namei component allowed refwalk operations to reveal overmounted entries due to a race condition when a mountpoint was unlinked. This could cause a refwalk to expose underlying filesystem entries that should have been hidden. The issue was addressed by adding checks to detect dentries marked as unlinked during refwalk traversal, preventing exposure of detached mounts.
A vulnerability in the Linux kernel's unshare system call was resolved. The issue involved dropping active namespace references that were never taken, leading to reference count inconsistencies. This could cause namespaces the caller lives in to no longer be listed by listns(). The problem occurred when set_cred_ucounts() failed during ksys_unshare(), causing improper reference decrementing. The fix involved properly freeing nsproxy structures that were prepared but never installed.
A vulnerability in the Linux kernel's gpio: exar driver was resolved by correcting the initialization order of an ID before registering its cleanup action. The issue involved improper handling of allocated IDs during failure in registering cleanup actions, potentially causing ID leaks and incorrect freeing of device IDs.
A vulnerability in the Linux kernel's namespace handling allowed automounts to be added below a mount that is not in the caller's mount namespace. This could lead to a kernel crash (general protection fault) due to a null pointer dereference when accessing certain filesystem layers via fanotify. The issue arises because an internal mount flag (MNT_NS_INTERNAL) was incorrectly treated as a valid mount namespace, causing unsafe operations. The flaw has been resolved by using a safer check that rejects unmounted and internal mounts, preventing the crash and restoring expected behavior.
A vulnerability in the Linux kernel related to mount namespaces and the open_tree(OPEN_TREE_NAMESPACE) operation has been resolved. The issue involved improper handling of covered mounts during the creation of new mount namespaces, potentially allowing unprivileged users to access hidden mount points. The fix ensures that covered mounts remain covered and that unprivileged users cannot reveal mounts that should be hidden by container runtimes or administrators.
A vulnerability in the Linux kernel's ice driver was resolved by restoring ordered MMIO writes for transmit doorbells. The issue involved a race condition due to the use of writel_relaxed() instead of writel(), causing the NIC to start transmitting before the queue accounting update was globally visible. This could lead to a kernel BUG triggered by an invalid state in the transmit queue accounting, resulting in a kernel crash under sustained network load on arm64 systems using Intel Ethernet Controller E810-XXV hardware.
A vulnerability in the Linux kernel's network stack related to the handling of Generic Segmentation Offload (GSO) packets in the __virtio_net_hdr_to_skb() function has been resolved. The issue involved improper flow dissection of GSO packets when skb->network_header was zero, leading to potential out-of-bounds reads in TCP header processing. This could occur with malformed network headers or packets carrying IP options or IPv6 extension headers. The fix involves proper initialization of skb fields and ensuring all GSO packets are fully dissected and validated.
A vulnerability in the Linux kernel's drm/vc4 driver was resolved by disabling the V3D interrupt across runtime suspend transitions. The issue involved the interrupt handler potentially running after the power domain was off, causing spurious interrupts and unexpected behavior due to the ARMCTRL interrupt controller lacking an active state. This could lead to scheduling of overflow memory work after the interrupt was disabled.
A vulnerability in the Linux kernel's riscv ptrace implementation was resolved by zero-initializing regset buffers before copying user data. The flaw involved uninitialized stack buffer data when a PTRACE_SETREGSET request provided a short iov_len, potentially causing garbage data to be copied into the target's vstate or shadow stack pointer.
A vulnerability in the Linux kernel's Btrfs filesystem code related to io_uring read extent failure handling has been resolved. The issue involved improper unlocking of inode and extent locks on failure paths, potentially leading to resource management inconsistencies. The fix ensures that unlocking occurs in the caller on all failure returns, aligning with the expected error handling behavior.
A vulnerability in the Linux kernel's mt7915 WiFi driver was resolved by properly disabling the receive NAPI (New API) when removing the device. Previously, unloading the mt7915e module with a MT7916 chipset caused multiple warnings and system instability due to the driver not disabling NAPI before destruction. This issue affected module reloads required to change frequency parameters, leading to system instability.
A vulnerability in the Linux kernel's flow_dissector component was resolved to prevent u16 truncation of the hlen parameter in the bpf_flow_dissect() function. The issue caused offsets to be incorrectly clamped when hlen exceeded 65535, potentially forcing offset values to zero even if valid. This bug is similar to a previously fixed truncation issue but affected the BPF path specifically. The fix involves capping hlen to the maximum value of a 16-bit unsigned integer before clamping. The vulnerability was discovered during code review and has been addressed.