Threat database

A vulnerability in the Linux kernel's statmount functionality allowed reading the parent of an unmounted mount under mount_lock, potentially leading to dereferencing a mount that has already been freed. This issue arises because statmount_mnt_basic() reads the parent mount's IDs without proper synchronization when the mount has been unmounted but kept alive by a file descriptor. The flaw has been resolved in the Linux kernel.

A vulnerability in the Linux kernel's mount notification system allows a mount to be queued multiple times for notifications, leading to use-after-free memory access. This occurs because mnt_notify_add() does not check if a mount is already on the notification list, causing corrupted list state and potential kernel memory errors. The issue affects mounts with the MNT_SHRINKABLE flag, such as submounts of NFS, AFS, CIFS, and tracefs. The flaw has been resolved by initializing the notification list properly and preventing duplicate queueing of mounts.

A use-after-free vulnerability in the Linux kernel's drm/xe component was resolved by fixing stale pinned_link list entries when framebuffer pins perform the final unpin. The issue arises when buffer objects (bo) are pinned both externally and as framebuffers, leading to stale list entries after the final unpin and potential memory corruption.

A vulnerability in the Linux kernel's AMDGPU driver was resolved by restricting doorbell buffer objects (BOs) to only those created in the doorbell domain. The flaw allowed any BO passed as a doorbell handle to be pinned into the doorbell domain, which could cause loss of buffer contents when moved improperly. This could be exploited by a client sharing a buffer with another client on the same device. The fix rejects BOs not created in the doorbell domain.

A vulnerability in the Linux kernel's drm/panthor driver was resolved that involved improper validation of the userspace queue count against the number of initialized firmware slots. Unprivileged userspace could request more queues than the firmware had initialized, leading to potential crashes due to dereferencing uninitialized stream interfaces.

A use-after-free vulnerability in the Linux kernel's drm/xe/i2c driver was resolved. The issue occurs because a work item related to the i2c client device can remain queued or running after the adapter is unregistered and its memory freed, leading to dereferencing freed memory. The fix involves reordering the teardown process to unregister the bus notifier before client device teardown and canceling the work to prevent new scheduling and drain queued work items.

A vulnerability in the Linux kernel's drm/bridge th1520-dw-hdmi driver was fixed by correcting the remove() callback. The driver incorrectly handled a pointer type during teardown, which could cause improper cleanup.

A vulnerability in the Linux kernel's namespace handling was resolved by ensuring the old parent's ->overmount pointer is reset in the mnt_change_mountpoint() function. Previously, this pointer could become a dangling reference after certain mount operations, leading to use-after-free (UAF) conditions. This issue arises when mounts are reparented and the old parent's ->overmount is not cleared, potentially allowing references to freed mount structures.

A vulnerability in the Linux kernel's drm/xe component caused incorrect shrinker accounting due to double-subtraction of pages when nested external pins occur on buffer objects. This desynchronization can lead to excessive invocation of the shrinker under memory pressure. The issue was fixed by ensuring accounting updates only occur on the outermost pin and final unpin, and by excluding imported dma-bufs from shrinker accounting to prevent underflows.

A vulnerability in the Linux kernel's XFS filesystem was resolved involving the XFS_IOC_EXCHANGE_RANGE ioctl with the TO_EOF flag. The flaw allowed file size inconsistencies where files could end up with shared blocks beyond EOF, which is invalid. This incorrect file size handling could lead to improper clearing of reflink flags and potential data corruption during writes. The issue was fixed by correcting how file sizes are exchanged and managed during the operation.

A vulnerability in the Linux kernel related to namespace handling has been resolved. The issue involves pseudo dentries, which are special directory entries for pipes, sockets, and other files that are not part of the normal filesystem hierarchy. These pseudo dentries should not become the root of a mount, but bind mounting /proc/self/fd/<fd> can cause this to happen. This leads to a race condition where a dentry can be freed while still being accessed, potentially causing instability. The fix prevents cloning a mount whose root is a pseudo dentry with the DCACHE_NORCU flag.

A vulnerability in the Linux kernel's namespace handling allows the owner of a user namespace to replace its locked /proc or root mount. This occurs due to improper transfer of the locked property when a propagated copy of a mount is moved beneath another mount, potentially exposing files that should remain covered and locked. The issue has been resolved by ensuring the locked property is only transferred to mounts placed by the caller, maintaining proper mount locking behavior.

A vulnerability in the Linux kernel related to the removal of fsnotify marks from a mount namespace in process context has been resolved. The issue involved improper removal of fanotify marks in an invalid context, causing kernel locking bugs and potential system instability. The flaw allowed a root user in a user namespace to leave marks on a mount namespace that could trigger a BUG due to sleeping functions called from invalid contexts during namespace release. The fix ensures marks are removed in process context before the namespace is handed to RCU, preventing the invalid context issue.

A vulnerability in the Linux kernel's drm_bridge_add() function was resolved. The issue involved modifying linked lists without holding the required bridge_lock, potentially causing list corruption when re-adding a previously removed bridge. This could affect the stability of the drm bridge subsystem.

A vulnerability in the Linux kernel's mount namespace handling has been resolved. The flaw involves attach_recursive_mnt() not properly considering the topmost mount in a mount namespace file chain, leading to incorrect mountpoint attachment. This can cause mounts to become inaccessible and prevent synchronous unmounting due to lingering child mounts.

A vulnerability in the Linux kernel's unshare system call was resolved. The issue involved dropping active namespace references that were never taken, leading to reference count inconsistencies. This could cause namespaces the caller lives in to no longer be listed by listns(). The problem occurred when set_cred_ucounts() failed during ksys_unshare(), causing improper reference decrementing. The fix involved properly freeing nsproxy structures that were prepared but never installed.

A vulnerability in the Linux kernel related to mount namespaces and the open_tree(OPEN_TREE_NAMESPACE) operation has been resolved. The issue involved improper handling of covered mounts during the creation of new mount namespaces, potentially allowing unprivileged users to access hidden mount points. The fix ensures that covered mounts remain covered and that unprivileged users cannot reveal mounts that should be hidden by container runtimes or administrators.

A vulnerability in the Linux kernel's ice driver was resolved by restoring ordered MMIO writes for transmit doorbells. The issue involved a race condition due to the use of writel_relaxed() instead of writel(), causing the NIC to start transmitting before the queue accounting update was globally visible. This could lead to a kernel BUG triggered by an invalid state in the transmit queue accounting, resulting in a kernel crash under sustained network load on arm64 systems using Intel Ethernet Controller E810-XXV hardware.

A vulnerability in the Linux kernel's Btrfs filesystem code related to io_uring read extent failure handling has been resolved. The issue involved improper unlocking of inode and extent locks on failure paths, potentially leading to resource management inconsistencies. The fix ensures that unlocking occurs in the caller on all failure returns, aligning with the expected error handling behavior.

A reference leak vulnerability in the Linux kernel's devlink component has been resolved. The issue occurs when notify work is pending and the devlink_rel reference is not properly released, leading to a memory leak. This can happen when nested devlink instances are registered and unregistered repeatedly while the parent lock is held. The vulnerability allows leaking of devlink_rel objects due to improper handling of work scheduling and reference counting.