Threat database

A vulnerability in the Linux kernel's unshare system call was resolved. The issue involved dropping active namespace references that were never taken, leading to reference count inconsistencies. This could cause namespaces the caller lives in to no longer be listed by listns(). The problem occurred when set_cred_ucounts() failed during ksys_unshare(), causing improper reference decrementing. The fix involved properly freeing nsproxy structures that were prepared but never installed.

A vulnerability in the Linux kernel related to mount namespaces and the open_tree(OPEN_TREE_NAMESPACE) operation has been resolved. The issue involved improper handling of covered mounts during the creation of new mount namespaces, potentially allowing unprivileged users to access hidden mount points. The fix ensures that covered mounts remain covered and that unprivileged users cannot reveal mounts that should be hidden by container runtimes or administrators.

A vulnerability in the Linux kernel's ice driver was resolved by restoring ordered MMIO writes for transmit doorbells. The issue involved a race condition due to the use of writel_relaxed() instead of writel(), causing the NIC to start transmitting before the queue accounting update was globally visible. This could lead to a kernel BUG triggered by an invalid state in the transmit queue accounting, resulting in a kernel crash under sustained network load on arm64 systems using Intel Ethernet Controller E810-XXV hardware.

A vulnerability in the Linux kernel's Btrfs filesystem code related to io_uring read extent failure handling has been resolved. The issue involved improper unlocking of inode and extent locks on failure paths, potentially leading to resource management inconsistencies. The fix ensures that unlocking occurs in the caller on all failure returns, aligning with the expected error handling behavior.

A reference leak vulnerability in the Linux kernel's devlink component has been resolved. The issue occurs when notify work is pending and the devlink_rel reference is not properly released, leading to a memory leak. This can happen when nested devlink instances are registered and unregistered repeatedly while the parent lock is held. The vulnerability allows leaking of devlink_rel objects due to improper handling of work scheduling and reference counting.

A vulnerability in the Linux kernel's drm/imagination driver was resolved involving incorrect handling of reference counts and vm_bo linkage during GPU virtual address remapping. The flaw caused reference leaks and mismatches in object linkage when a memory map overlaps an existing mapping, potentially leading to resource leaks and warnings in kernel logs.

A vulnerability in the Linux kernel's PFCP packet processing was resolved by ensuring the SEID field is fully linearized before being read. The pfcp_encap_recv() function previously only ensured the UDP and PFCP headers were linear, but when the S flag was set, pfcp_session_recv() read the 8-byte SEID without verifying it was fully in the linear area. This could cause out-of-bounds reads from fragmented or short packets. The fix involves pulling up to the end of the SEID before reading and dropping packets that are too short.

A vulnerability in the Linux kernel's mt76 WiFi driver was resolved that involved incorrect accounting of non-AQL frames per peer rather than per link. The driver increments and decrements counters for frames on different links, causing the count to drift upwards and potentially block the station. The fix ensures the count is maintained on the primary link's wcid, aligning with other peer-wide state management.

A vulnerability in the Linux kernel's btrfs subsystem related to improper freeing of iov memory when the function btrfs_uring_read_extent() fails has been resolved. The issue was that on failure, the caller skipped freeing the iov memory except in a specific error case (-EIOCBQUEUED), potentially causing a memory leak. The fix ensures that on failure, the code correctly frees the iov memory by falling through to the appropriate cleanup path.

A vulnerability in the Linux kernel's Btrfs filesystem code was resolved by changing the return value of btrfs_uring_read_extent_endio to always return -EIOCBQUEUED. Previously, if all bios finished before btrfs_encoded_read_regular_fill_pages() returned, a negative errno caused double cleanup of resources, potentially leading to use-after-free or double-free conditions.

A vulnerability in the Linux kernel's btrfs filesystem involving io_uring encoded data handling has been resolved. The issue occurs when returning -EAGAIN while leaving btrfs_uring_encoded_data in the command PDU, potentially causing data leaks if requests are cancelled or the ring exits before reissue. The vulnerability relates to improper freeing of driver PDU allocations on cleanup in io_uring operations. The fix ensures that allocations are freed appropriately on error returns to prevent leaks.

A vulnerability in the Linux kernel's KVM arm64 nested virtualization implementation was resolved by fixing the lifecycle management of the nested_mmus array. This array holds shadow page tables used during nested guest execution. Previously, if a VCPU_INIT event occurred while a virtual CPU was running a nested context and the nested_mmus array needed relocation, the vCPU could continue using a pointer to a freed structure, leading to use-after-free conditions. The fix changes the nested_mmus array to an array of pointers allocated at VM creation to avoid reallocations and clarifies object lifecycles.

A vulnerability in the Linux kernel's Rust IRQ handling was resolved by changing how RegistrationInner is passed as a cookie to request_irq. The issue involved accessing uninitialized memory in the IRQ callback due to the IRQ being enabled before RegistrationInner was fully initialized. This flaw was fixed by ensuring RegistrationInner's fields are initialized before passing it as the IRQ cookie. The vulnerability does not affect mainline Linux kernels where a related commit removed the problematic pattern.

A vulnerability in the Linux kernel USB hub driver related to USB3 root hubs has been resolved by reducing the post-resume hold time from 200ms to 120ms. The previous 200ms hold time could trigger an issue on AMD platforms, causing crashes when Android adb repeatedly polls and wakes the USB subsystem. The fix optimizes the hold time for USB3 root hubs without affecting external hubs, improving stability and preventing crashes.

A vulnerability in the Linux kernel related to x86 memory management was resolved by removing an unnecessary PMD page copy during page freeing. The issue caused a possible deadlock on systems with discrete GPUs due to a circular locking dependency involving mmap locks and memory reclaim operations. The fix detaches the original PMD page earlier and frees page tables without additional allocations, eliminating the locking cycle.

A vulnerability in the Linux kernel ext4 filesystem allows a crash due to a NULL pointer dereference when large folios are enabled on encrypted inodes. This occurs because enabling the encrypt feature on a mounted filesystem bypasses a check that disables large folios, leading to a kernel crash during encrypted data writes. The issue affects Linux kernel versions from 6.19 up to but not including 7.3, where the code was refactored to prevent this. The vulnerability has been resolved by disabling large folios on encrypted inodes, similar to the handling of inodes using data journaling.

A vulnerability in the Linux kernel arm64 io subsystem related to ioremap_prot() was resolved. The issue involved improper handling of non-user protection flags in memory mappings, causing spurious warnings when reading process cmdline via /proc. The fix ensures ioremap_prot() rejects protection values without PTE_USER, preventing invalid warnings and cleanly failing access for PROT_NONE and execute-only mappings.

A vulnerability in the Linux kernel's KVM module for arm64 architecture related to the handling of the Scalable Vector Extension (SVE) feature bit at EL2 has been resolved. The issue involved inconsistent derivation and use of the GUEST_HAS_SVE flag, which could lead to a virtual CPU (vCPU) having a NULL SVE state. This inconsistency arose because the flag was taken separately from the host, but the actual feature bit was tested differently, potentially causing improper SVE state loading in guests. The fix derives the GUEST_HAS_SVE flag directly from the SVE feature bit and removes redundant code related to protected VMs, which do not allow SVE.

A vulnerability in the Linux kernel's emac network driver caused a kernel crash due to a NULL pointer dereference during driver initialization. The issue was triggered because netdev_ops were not set before calling of_phy_connect(), leading to a crash on certain PowerPC platforms. The fix involved moving the setting of netdev_ops earlier in the initialization sequence to prevent the crash. This bug appeared starting with kernel version 7.3-rc1 and was resolved by adjusting the initialization order in the emac driver code.

A vulnerability in the Linux kernel's DAMON subsystem was resolved involving the use of an unaligned address in damon_ptep_mkold(). This caused an out-of-bounds write during page table walks on arm64 architectures, potentially corrupting adjacent memory or causing kernel crashes. The issue was triggered by the kernel selftest suite and could lead to kernel faults or silent memory corruption depending on the memory page permissions. The fix ensures a page-aligned address is used in the affected function, preventing the out-of-bounds access.