A vulnerability in the Linux kernel's libertas wifi driver was resolved that involved improper handling of short monitor mode TX frames. The function lbs_hard_start_xmit() incorrectly processes frames by casting data to a radiotap TX header and copying the 802.11 destination address without sufficient length checks, potentially causing out-of-bounds reads. The fix requires verifying that the frame has enough bytes for the radiotap TX header and destination address before accessing them.
A vulnerability in the Linux kernel's AMD GPU driver was resolved. The issue involved scheduling thermal work on a queue that was not initialized when Dynamic Power Management (DPM) was disabled via the amdgpu.dpm=0 module parameter. This could lead to improper handling of thermal work scheduling.
A race condition vulnerability in the Linux kernel's imx mailbox driver was resolved by adding a channel shutdown field. The issue involved a timing window where the RX event could be re-enabled by an interrupt service routine while the shutdown process was waiting on free_irq(), potentially causing problems on shared interrupt handlers. This could lead to the irq-core shutting down the interrupt with a 'nobody cared' message if the removed channel triggered an interrupt.
A vulnerability in the Linux kernel's imx mailbox driver was resolved by adjusting the power management runtime enablement sequence. The issue involved early usage of the device before probe completion, which could lead to improper device removal and shutdown handling. The fix delays pm_runtime_enable() to the removal path and reorders device registration to ensure proper cleanup.
A vulnerability in the Linux kernel's ksmbd component related to lease break and acknowledgment state handling has been resolved. The issue involved improper handling of valid lease states containing WRITE_CACHING when breaking level-II/read leases for writes and truncates. The fix ensures lease break acknowledgments comply with SMB2 protocol rules, applying acknowledged states correctly and maintaining pending breaks on failed acknowledgments.
A vulnerability in the Linux kernel's arm_scmi firmware component was resolved by validating the payload size of BASE_ERROR_EVENT messages. The flaw involved the notification parser using a count of message reports without verifying that the payload contained all reported entries, potentially leading to processing of truncated payloads. The fix rejects truncated payloads before copying the report array.
A vulnerability in the Linux kernel's drm/amd/ras component related to CPER ring overflow handling has been resolved. The issue occurs when corrupt CPER data causes the read pointer not to advance, resulting in a recovery loop that hangs the worker writing the next CPER record. The fix resets the CPER ring to an empty state upon detecting no progress in the read pointer update, preventing the system from spinning indefinitely.
A vulnerability in the Linux kernel's CPSW driver was resolved where the devlink instance remained registered if port registration failed during probe. This occurred because the error handling path did not unregister the devlink after a failed cpsw_register_ports() call, potentially leaving stale devlink state.
A vulnerability in the Linux kernel's ksmbd component related to lease break handling has been resolved. The issue involved holding a read lock (ci->m_lock) while waiting for a lease break acknowledgment, causing a deadlock scenario that delayed lease break resolution by up to 35 seconds. This resulted in significantly increased operation times in tests with leases enabled. The fix changes the locking strategy to avoid holding the lock during the wait, preventing the deadlock.
A vulnerability in the Linux kernel's drm/amdkfd component was resolved that involved improper state cleanup when kfd_dbg_trap_enable() fails during copy_to_user operations. The failure to unwind the trap state and release resources on copy_to_user failure could lead to inconsistent trap states and reference count imbalances, potentially affecting subsequent debug trap enable/disable operations.
A vulnerability in the Linux kernel's netfilter ipset component related to improper marking of RCU locked areas has been resolved. The issue involves unnecessary retention of the RCU lock when bumping the uref counter and incorrect locking in the mtype_gc function. This fix ensures proper synchronization and locking mechanisms are used.
A vulnerability in the Linux kernel's mac80211 WiFi component was resolved by validating the deauthentication frame length before accessing the reason code. The function ieee80211_rx_mgmt_deauth() previously read the deauthentication reason code without first confirming that the frame contained the expected fixed field, potentially leading to improper handling of malformed frames.
A vulnerability in the Linux kernel's drm/amdkfd component related to CRIU restore was resolved. The issue involved missing a call to properly acquire queue buffers in the set_queue_properties_from_criu() function, leading to uninitialized buffer fields in queue_properties. This could cause problems when subsequent code expects these buffer fields to be non-null. The fix added the missing call and corrected type casts.
A vulnerability in the Linux kernel's xen/gntalloc component was resolved by validating the grant count before allocation. The function gntalloc_ioctl_alloc() previously allocated memory for the grant-id array before verifying if the requested count was within the global grant limit, potentially leading to improper memory allocation. The fix involves rejecting counts above the limit before allocation and using a subtraction-based check under a mutex to prevent integer wraparound during count addition. Additionally, 64-bit arithmetic is used for page-size multiplication to ensure correctness.
A use-after-free (UAF) vulnerability in the Linux kernel's Thunderbolt hotplug handling was resolved. The issue occurred because hotplug events could be processed after the domain was removed, potentially leading to unsafe memory access. The fix involves taking a domain reference before scheduling the hotplug handler to prevent this condition.
A vulnerability in the Linux kernel's arm_scmi firmware component was resolved by adding validation for the SENSOR_UPDATE payload size. The issue involved the parser not verifying that the received payload contained the expected number of sensor readings before parsing, potentially leading to processing truncated update notifications. The fix rejects truncated notifications before reading the variable array.
A vulnerability in the Linux kernel's irqchip/gic-v4 component was resolved. The issue occurs when the kernel parameter kvm-arm.vgic_v4_enable=1 is set on a system lacking an MSI controller device tree node and GICv4, causing a NULL pointer dereference and kernel panic. The fix involves disabling vLPI support at initialization if the host has no ITS, preventing the kernel from accessing a NULL gic_domain pointer.
A deadlock vulnerability in the Linux kernel's crypto CCP SEV initialization failure path has been resolved. The issue occurs when the function __sev_platform_init_handle_init_ex_path() calls rmp_mark_pages_firmware() with an incorrect lock status, leading to a potential deadlock during cleanup after an RMPUPDATE failure. This deadlock happens because the parent function already holds the sev_cmd_mutex lock, but the called function does not honor this lock state. The fix involves passing the correct lock status to prevent the deadlock.
A vulnerability in the Linux kernel's freevxfs filesystem code caused a kernel crash when encountering unknown typed-extent types during ioctl(FIBMAP) operations on regular files. The issue was due to the vxfs_bmap_typed() function calling BUG() on unexpected extent types, leading to a kernel panic. The vulnerability has been resolved by replacing the BUG() call with WARN_ON_ONCE() and returning 0 to fail cleanly without crashing the kernel.
A vulnerability in the Linux kernel's drm/nouveau/gsp component related to the SEC2 falcon on GA100 chip tables has been resolved. The issue involved a NULL pointer dereference during the GSP-RM boot process caused by missing .sec2 entries, leading to a crash. This was fixed by adding SEC2 to the GA100 chip table to ensure proper device->sec2 access during booter initialization.