A vulnerability in the Linux kernel's mlx5e driver related to XDP redirect to AF_XDP sockets could cause stale buffer pointers to be freed twice, leading to double publication of UMEM frames. This occurs when the RX ring is full and a refill retry partially succeeds, leaving some WQEs with stale buffer pointers. The issue was detected with high packet rates and causes silent failures without kernel warnings. A fix has been implemented to mark WQEs as released immediately after freeing buffers, preventing double free and stale pointer use.
A vulnerability in the Linux kernel's mlx5e driver related to AF_XDP zero-copy buffer management has been resolved. The issue involved stale XSK buffer releases during MPWQE refill retries, which could cause double freeing of buffers through stale pointers. The fix ensures that buffer release retries become idempotent by properly managing the release bitmap in error paths. Extensive testing showed no invalid descriptors, WQE errors, or kernel warnings after the fix.
A vulnerability in the Linux kernel's IPv4 UDP handling allowed off-path attackers to perform a side-channel attack on the FIB nexthop exception (FNHE) cache to discover ephemeral UDP port numbers. The issue arises because FNHE entries were only created when a UDP packet matched an existing socket, enabling attackers to infer port information by observing cache behavior. Previous mitigations involving hash randomization were bypassable. The fix ensures FNHE entries are always created before socket matching, preventing attackers from distinguishing valid from invalid guesses based on cache state.
A vulnerability in the Linux kernel's IPv6 UDP exception cache handling allowed off-path attackers to conduct side-channel attacks to discover ephemeral UDP ports. The issue was due to exceptions being created only when a UDP packet matched an existing socket. The fix ensures exceptions are always created before socket matching, preventing this side-channel. This change may cause additional route lookups and exceptions but does not increase the ability of attackers to create exceptions beyond previous capabilities.
A vulnerability in the Linux kernel related to IPv4 route notification sizing has been resolved. The issue involves improper handling of nexthop groups when they shrink, leading to a potential null pointer dereference in fib_nexthop_nlmsg_size(). This occurs because the code does not stop sizing when an indexed path is absent after a nexthop group replacement with fewer paths. The fix prevents dereferencing a null pointer by stopping sizing in such cases.
A vulnerability in the Linux kernel related to IPv4 route notification size race conditions has been resolved. The issue involves asynchronous route notifications for hardware flag changes where concurrent modifications can cause legitimate size errors, leading to warnings that were not indicative of actual bugs. The fix removes these misleading warnings while maintaining proper error handling.
A vulnerability in the Linux kernel's IPv6 route notification handling was addressed by removing an incorrect warning related to route notification size races. The issue involved fib6_info_hw_flags_set() sizing a socket buffer and later filling it, where concurrent changes could cause legitimate size errors that were previously misinterpreted as bugs. The fix removes the misleading warning while preserving the existing error handling path.
A vulnerability in the Linux kernel's skb_copy_and_csum_bits() function could cause stale memory bytes to be sent in network packets. When the function encounters unreadable fragments, it copies only the linear part of the buffer and leaves the rest unchanged, potentially leaking residual memory data in ICMP error messages or driver transmit buffers. The issue has been resolved by zeroing the unfilled parts of the buffer to prevent unintended data leakage.
A reference leak vulnerability in the Linux kernel's Btrfs filesystem scrub functionality was fixed. The issue occurred in the scrub_print_warning_inode() function, where a reference obtained by btrfs_get_fs_root() was not properly released if paths_from_inode() failed, causing a local_root reference leak. This leak happened every time path resolution failed during scrub warning printing. The fix ensures the reference is dropped on the failure path to prevent the leak.
A memory leak vulnerability in the Linux kernel's sparx5 network driver was fixed. The issue involved sparx5_tc_matchall_replace() allocating memory for matchall filters without freeing it upon deletion, causing leaked entries. The fix ensures that the allocated entries are freed after being unlinked, preventing memory leaks.
A vulnerability in the Linux kernel's Xilinx axienet network driver was resolved. The issue involved the improper freeing of DMA buffers on dmaengine stop, causing a memory leak of SKBs and DMA mappings during interface shutdown. This could exhaust limited IOMMU aperture resources. The fix ensures all DMA-mapped buffers are properly unmapped and freed on stop, and adds synchronization to prevent race conditions between buffer callbacks and driver stop operations.
A vulnerability in the Linux kernel's device mapper ioctl interface was resolved where a buffer over-read could occur due to incorrect calculation of a data pointer. This issue involves the struct dm_ioctl, which has trailing padding causing the data_start pointer to run past the allocated buffer size. Although this results in an out-of-bounds read, it can only be triggered by root privileges and is therefore not considered a security bug. The fix clamps the data_start pointer to the buffer size to prevent the over-read.
A race condition vulnerability in the Linux kernel's brcmfmac WiFi driver caused a kernel crash when the driver was removed while a user space process that created a P2P device was still exiting. This double removal of the P2P device interface leads to a use-after-free fault and kernel oops. The issue occurs due to concurrent removal paths attempting to unregister and free the same device interface.
A vulnerability in the Linux kernel's WireGuard implementation involving the Noise protocol handshake was resolved. The flaw allowed two threads to process the same response message concurrently, potentially causing a race condition where a handshake state could be incorrectly reused. Although the issue is considered nearly impossible to exploit in practice, a fix was implemented to ensure the ephemeral private key is compared to the latest handshake state to prevent this condition.
A vulnerability in the Linux kernel workqueue subsystem was resolved that could cause a NULL pointer dereference when checking chained work. The issue arises because current_wq_worker() indicates a kworker but does not guarantee it is executing a work item, leading to a potential fault when worker->current_pwq is NULL during certain queue states.
A vulnerability in the Linux kernel's xen/netfront component caused a memory leak when xennet_fill_frags() fails due to response chains having more slots than fit in the skb's fragments. The error path did not free the skb properly, leading to resource leakage. This issue has been resolved by ensuring the skb is put back on the temporary queue before error handling proceeds.
A race condition vulnerability in the Linux kernel's strparser component was resolved. The issue involved the __strp_recv function potentially running concurrently while the parser was being torn down, which could lead to use-after-free (UAF) conditions. The vulnerability affects only the espintcp user of strp_recv, and a patch was introduced to add locking mechanisms to prevent this race. The general mode of strp, which could also crash, is unused and slated for removal. A proof-of-concept exploit has been published, but no known exploits are currently in the wild.
A vulnerability in the Linux kernel's TPS6594 regulator driver was resolved involving an out-of-bounds array access due to an incorrect count of linear voltage ranges. The issue affects the TPS65224 BUCK2, BUCK3, and BUCK4 descriptors, as well as TPS652G1, where the code reads beyond the defined array when checking voltage selectors. This could cause improper handling of voltage constraints during regulator registration.
A vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem was resolved. The flaw involved improper teardown of topsrv workqueues before closing subscriber connections, leading to race conditions. These races could cause use-after-free errors, queueing work on destroyed workqueues, and RCU stalls during network exit. The fix changes the teardown order, adds a shutdown flag to refuse lookups during teardown, and ensures workqueues are destroyed before closing connections.
A use-after-free vulnerability in the Linux kernel's TIPC subsystem was resolved. The function tipc_node_find_by_name() returned a node pointer after dropping its RCU read lock without taking a reference, leading to a race condition where handlers could access a freed node. This could cause kernel memory corruption and instability. The issue was detected by KASAN and fixed by acquiring a reference to the node before leaving the RCU read lock and releasing it appropriately after use.