A vulnerability in the Linux kernel's isofs filesystem code was resolved. The issue involved improper handling of set_blocksize failures because isofs uses buffer_heads, which do not handle block sizes larger than PAGE_SIZE correctly. This could cause a kernel BUG_ON failure during mounting due to an offset exceeding the folio size.
A vulnerability in the Linux kernel's mac80211_hwsim component allowed undersized HWSIM_ATTR_TX_INFO attributes to be accepted, leading to out-of-bounds reads. The issue was due to insufficient length validation of the attribute payload before casting and reading it as a struct hwsim_tx_rate pointer. This flaw has been resolved by enforcing exact length checks in the attribute policy to reject malformed inputs.
A vulnerability in the Linux kernel's GICv5 interrupt controller driver caused a delay in priority dropping after interrupt activation, potentially blocking new interrupts and causing a denial of service. The issue was due to the priority drop being performed during interrupt deactivation instead of immediately after acknowledgment. This was fixed by moving the priority drop to occur right after interrupt acknowledgment in the main interrupt handler.
A vulnerability in the Linux kernel's iwlwifi driver related to scheduled scan IE sizing has been resolved. The issue involved building the probe request before validating its length, allowing oversized information elements (IEs) to be copied into a fixed buffer. The fix moves the probe building after the length check and advertises the maximum scheduled scan IE length to userspace to prevent oversizing.
A vulnerability in the Linux kernel's mlx5 network driver related to handling miss tables in hardware steering (HWS) has been resolved. The issue involved improper removal of tables from a miss table list when a table with a miss table created by the 'mlx5hws_table_set_default_miss' API was deleted, potentially leaving garbage nodes in the list.
A vulnerability in the Linux kernel's lan966x network driver was resolved involving improper restoration of RX state after a reload failure. Specifically, certain fields related to RX page geometry and page pool registration were not restored correctly if resource reallocation failed, causing inconsistencies in RX buffer handling. This could lead to the XDP path advertising incorrect frame sizes, potentially causing buffer mismanagement.
A vulnerability in the Linux kernel's Btrfs filesystem was resolved by adding a lock to protect the sb_write_pointer() function. This function reads the super block from the block device page cache, and previously had a race condition related to block size changes. The fix involves taking the mapping invalidate lock around the read operation to serialize it against block size changes.
A vulnerability in the Linux kernel's md/raid5 component related to the handling of 32-bit sequence numbers (bm_seq) has been resolved. The issue involved incorrect comparison logic when the 32-bit sequence number wraps around, causing newer sequence numbers to appear smaller than older ones. This was addressed by implementing a wrap-safe comparison method.
A resource management vulnerability in the Linux kernel's Microchip Sparx5 driver was resolved. The flaw involved improper cleanup of PSFP (Per-Stream Filtering and Policing) resources when the flower setup process failed, potentially leading to resource leaks. Specifically, allocated stream gate, flow meter, and stream filter resources were not released on error paths. Additionally, incorrect handling of flow meter IDs could cause erroneous deletion attempts and reference count inconsistencies.
A vulnerability in the Linux kernel's libertas wifi driver was resolved that involved improper handling of short monitor mode TX frames. The function lbs_hard_start_xmit() incorrectly processes frames by casting data to a radiotap TX header and copying the 802.11 destination address without sufficient length checks, potentially causing out-of-bounds reads. The fix requires verifying that the frame has enough bytes for the radiotap TX header and destination address before accessing them.
A vulnerability in the Linux kernel's AMD GPU driver was resolved. The issue involved scheduling thermal work on a queue that was not initialized when Dynamic Power Management (DPM) was disabled via the amdgpu.dpm=0 module parameter. This could lead to improper handling of thermal work scheduling.
A race condition vulnerability in the Linux kernel's imx mailbox driver was resolved by adding a channel shutdown field. The issue involved a timing window where the RX event could be re-enabled by an interrupt service routine while the shutdown process was waiting on free_irq(), potentially causing problems on shared interrupt handlers. This could lead to the irq-core shutting down the interrupt with a 'nobody cared' message if the removed channel triggered an interrupt.
A vulnerability in the Linux kernel's imx mailbox driver was resolved by adjusting the power management runtime enablement sequence. The issue involved early usage of the device before probe completion, which could lead to improper device removal and shutdown handling. The fix delays pm_runtime_enable() to the removal path and reorders device registration to ensure proper cleanup.
A vulnerability in the Linux kernel's ksmbd component related to lease break and acknowledgment state handling has been resolved. The issue involved improper handling of valid lease states containing WRITE_CACHING when breaking level-II/read leases for writes and truncates. The fix ensures lease break acknowledgments comply with SMB2 protocol rules, applying acknowledged states correctly and maintaining pending breaks on failed acknowledgments.
A vulnerability in the Linux kernel's arm_scmi firmware component was resolved by validating the payload size of BASE_ERROR_EVENT messages. The flaw involved the notification parser using a count of message reports without verifying that the payload contained all reported entries, potentially leading to processing of truncated payloads. The fix rejects truncated payloads before copying the report array.
A vulnerability in the Linux kernel's drm/amd/ras component related to CPER ring overflow handling has been resolved. The issue occurs when corrupt CPER data causes the read pointer not to advance, resulting in a recovery loop that hangs the worker writing the next CPER record. The fix resets the CPER ring to an empty state upon detecting no progress in the read pointer update, preventing the system from spinning indefinitely.
A vulnerability in the Linux kernel's CPSW driver was resolved where the devlink instance remained registered if port registration failed during probe. This occurred because the error handling path did not unregister the devlink after a failed cpsw_register_ports() call, potentially leaving stale devlink state.
A vulnerability in the Linux kernel's ksmbd component related to lease break handling has been resolved. The issue involved holding a read lock (ci->m_lock) while waiting for a lease break acknowledgment, causing a deadlock scenario that delayed lease break resolution by up to 35 seconds. This resulted in significantly increased operation times in tests with leases enabled. The fix changes the locking strategy to avoid holding the lock during the wait, preventing the deadlock.
A vulnerability in the Linux kernel's drm/amdkfd component was resolved that involved improper state cleanup when kfd_dbg_trap_enable() fails during copy_to_user operations. The failure to unwind the trap state and release resources on copy_to_user failure could lead to inconsistent trap states and reference count imbalances, potentially affecting subsequent debug trap enable/disable operations.
A vulnerability in the Linux kernel's netfilter ipset component related to improper marking of RCU locked areas has been resolved. The issue involves unnecessary retention of the RCU lock when bumping the uref counter and incorrect locking in the mtype_gc function. This fix ensures proper synchronization and locking mechanisms are used.