A use-after-free vulnerability in the Linux kernel's EDAC altera driver was fixed. The issue occurred in error paths of altr_edac_a10_device_add() and altr_portb_setup() where a dci structure was freed before unregistering IRQ handlers, potentially allowing IRQs to access freed memory.
A vulnerability in the Linux kernel IPv6 segment routing code (seg6_make_flowlabel) was resolved by using skb_get_hash_net() to properly obtain a network pointer. The issue arose when seg6_make_flowlabel() was called with an skb lacking both skb->dev and skb->sk pointers, which could occur in specific network scenarios involving TIPC UDP bearers and IPv4 routes with seg6 encapsulation enabled. This was fixed by ensuring the function uses skb_get_hash_net() to retrieve the network namespace pointer correctly.
A vulnerability in the Linux kernel related to x86 memory management was resolved by removing an unnecessary PMD page copy during page freeing. The issue caused a possible deadlock on systems with discrete GPUs due to a circular locking dependency involving mmap locks and memory reclaim operations. The fix detaches the original PMD page earlier and frees page tables without additional allocations, eliminating the locking cycle.
A vulnerability in the Linux kernel's MACsec driver was resolved by initializing the SecY component before registering the network device. The issue caused warnings and potential reporting of uninitialized SecY attributes during device registration, particularly when MAC offload was used over an LRO-capable lower device with IPv4 forwarding enabled. The fix involves reordering initialization steps to ensure SecY and related attributes are properly set before notifications are emitted.
A vulnerability in the Linux kernel's filesystem code caused hung tasks when unmounting filesystems after disk removal. The issue stemmed from repeated scans of inodes during eviction, which could block unmount operations and trigger hung-task reports. A patch was applied to change the inode eviction process to avoid repeated scanning and ensure proper inode disposal without blocking. Testing confirmed the fix resolves the issue without introducing regressions.
A vulnerability in the Linux kernel's ASoC qcom lpass-cpu driver was resolved. The issue involved incorrect indexing of the DAI driver table when configuring certain hardware ports, leading to out-of-bounds memory access. This was due to using the hardware port ID as an index instead of the correct loop index. The fix uses the loop index to update playback channel constraints, preventing incorrect memory writes.
A NULL pointer dereference vulnerability in the Linux kernel's SPI-NAND driver was fixed. The issue occurs when the device tree sets "nand-no-ecc-engine", causing the ECC engine pointer to remain NULL while the code dereferences it unconditionally, leading to a kernel oops during device probing. The fix introduces a helper function to safely check the ECC engine pointer before use.
A vulnerability in the Linux kernel's KVM s390 subsystem related to IRQ injection with SIGP Stop and Store Status has been resolved. The issue involved storing status information while holding a spinlock, which could cause faults due to writing into userspace. The fix changes the behavior to defer the status storage outside the spinlock context, preventing potential faults.
A vulnerability in the Linux kernel ext4 filesystem allows a crash due to a NULL pointer dereference when large folios are enabled on encrypted inodes. This occurs because enabling the encrypt feature on a mounted filesystem bypasses a check that disables large folios, leading to a kernel crash during encrypted data writes. The issue affects Linux kernel versions from 6.19 up to but not including 7.3, where the code was refactored to prevent this. The vulnerability has been resolved by disabling large folios on encrypted inodes, similar to the handling of inodes using data journaling.
A vulnerability in the Linux kernel's AMD display driver (drm/amd/display) related to improper handling of the optional stream->sink pointer in DPMS sequences has been resolved. The issue involved dereferencing a potentially null pointer without proper checks, which could lead to inconsistencies or errors. The fix replaces usage of stream->sink->link with stream->link, adds assertions where sink is required, and improves resource access consistency.
A vulnerability in the Linux kernel's RTC driver was resolved by zero-initializing the struct rtc_wkalrm to prevent information leakage. The issue involved uninitialized kernel stack data in padding holes of the struct being exposed to userspace via the RTC_WKALRM_RD ioctl call. This could lead to unintended disclosure of kernel memory contents. The vulnerability has been fixed by initializing the struct at declaration, eliminating the risk of leaking sensitive information.
A vulnerability in the Linux kernel arm64 io subsystem related to ioremap_prot() was resolved. The issue involved improper handling of non-user protection flags in memory mappings, causing spurious warnings when reading process cmdline via /proc. The fix ensures ioremap_prot() rejects protection values without PTE_USER, preventing invalid warnings and cleanly failing access for PROT_NONE and execute-only mappings.
A vulnerability in the Linux kernel's BPF sockmap implementation caused double-counting of the copied_seq TCP sequence number during self-redirects of packets back to the same socket. This led to warnings and potential TCP receive buffer inconsistencies. The issue was fixed by changing the handling of self-redirect verdicts to avoid double advancement of copied_seq.
A vulnerability in the Linux kernel's ath11k WiFi driver was resolved by ensuring the 'num_stations' counter is reset properly on hardware restart. Without this fix, multiple hardware restarts could cause the driver to refuse new station or mesh peer associations, leading to connectivity issues and kernel warnings.
A vulnerability in the Linux kernel's KVM module for arm64 architecture related to the handling of the Scalable Vector Extension (SVE) feature bit at EL2 has been resolved. The issue involved inconsistent derivation and use of the GUEST_HAS_SVE flag, which could lead to a virtual CPU (vCPU) having a NULL SVE state. This inconsistency arose because the flag was taken separately from the host, but the actual feature bit was tested differently, potentially causing improper SVE state loading in guests. The fix derives the GUEST_HAS_SVE flag directly from the SVE feature bit and removes redundant code related to protected VMs, which do not allow SVE.
A vulnerability in the Linux kernel's emac network driver caused a kernel crash due to a NULL pointer dereference during driver initialization. The issue was triggered because netdev_ops were not set before calling of_phy_connect(), leading to a crash on certain PowerPC platforms. The fix involved moving the setting of netdev_ops earlier in the initialization sequence to prevent the crash. This bug appeared starting with kernel version 7.3-rc1 and was resolved by adjusting the initialization order in the emac driver code.
A vulnerability in the Linux kernel's ice driver was resolved by restoring ordered MMIO writes for transmit doorbells. The issue involved a race condition due to the use of writel_relaxed() instead of writel(), causing the NIC to start transmitting before the queue accounting update was globally visible. This could lead to a kernel BUG triggered by an invalid state in the transmit queue accounting, resulting in a kernel crash under sustained network load on arm64 systems using Intel Ethernet Controller E810-XXV hardware.
A vulnerability in the Linux kernel's network stack related to the handling of Generic Segmentation Offload (GSO) packets in the __virtio_net_hdr_to_skb() function has been resolved. The issue involved improper flow dissection of GSO packets when skb->network_header was zero, leading to potential out-of-bounds reads in TCP header processing. This could occur with malformed network headers or packets carrying IP options or IPv6 extension headers. The fix involves proper initialization of skb fields and ensuring all GSO packets are fully dissected and validated.
A vulnerability in the Linux kernel's drm/vc4 driver was resolved by disabling the V3D interrupt across runtime suspend transitions. The issue involved the interrupt handler potentially running after the power domain was off, causing spurious interrupts and unexpected behavior due to the ARMCTRL interrupt controller lacking an active state. This could lead to scheduling of overflow memory work after the interrupt was disabled.
A vulnerability in the Linux kernel's riscv ptrace implementation was resolved by zero-initializing regset buffers before copying user data. The flaw involved uninitialized stack buffer data when a PTRACE_SETREGSET request provided a short iov_len, potentially causing garbage data to be copied into the target's vstate or shadow stack pointer.