A vulnerability in the Linux kernel's RISC-V architecture under CONFIG_SHADOW_CALL_STACK allowed an unprivileged user to bypass kernel shadow call stack pointer reload checks by manipulating the user-writable tp register. This could lead to arbitrary kernel memory write and control-flow hijacking. The issue was fixed by changing the check to rely on the hardware sstatus.SPP bit, which cannot be forged by user mode, ensuring correct reload of the shadow call stack pointer on user traps.
A vulnerability in the Linux kernel's SELinux implementation related to NFSv4 filesystem mounts has been resolved. When an NFSv4 filesystem exported with security_label is mounted a second time, the superblock reuse logic failed to preserve the SECURITY_LSM_NATIVE_LABELS flag, causing per-file security labeling to be silently disabled for both mounts. This issue was fixed by ensuring the SECURITY_LSM_NATIVE_LABELS flag is set correctly on reused superblocks during mount option processing.
A vulnerability in the Linux kernel related to the RISCV architecture's ghostwrite errata has been resolved. The issue involved improper detection and mitigation of the ghostwrite vulnerability during early boot stages when certain kernel configuration options were set inconsistently. This could cause the system to incorrectly report that a vulnerable CPU was not affected and fail to apply the necessary mitigation. The fix ensures that the vulnerability is detected early and mitigated properly by selecting RISCV_ALTERNATIVE_EARLY in the kernel configuration.
A vulnerability in the Linux kernel's Xilinx GPIO driver caused a runtime PM (power management) leak on the request error path. The issue arises because pm_runtime_get_sync() increments the usage counter even on failure, and the error path does not properly decrement it, leading to a leaked reference. This prevents the controller from runtime-suspending and keeps its clock enabled unnecessarily. The fix involves switching to pm_runtime_resume_and_get(), which increments the usage counter only on success.
A vulnerability in the Linux kernel's RISC-V futex implementation allows an unprivileged process to perform atomic read-modify-write operations on arbitrary kernel addresses due to improper handling of tagged user pointers. The issue arises because the futex atomic operations use the raw tagged address without untagging it after access_ok() validation, enabling potential kernel memory manipulation. This vulnerability has been resolved by ensuring the pointer is untagged before the atomic operations.
A vulnerability in the Linux kernel's ibmveth driver was resolved, involving improper cleanup of the logical LAN resource on failure during the open operation. Specifically, if buffer pool allocation fails after the logical LAN is registered, the cleanup function h_free_logical_lan() was not called, leaving the buffer-list page owned by PHYP when unmapped. This could lead to resource mismanagement. The fix moves the cleanup call to a shared path ensuring deregistration before unmapping the buffer list.
A use-after-free vulnerability in the Linux kernel's ice driver was fixed by correcting metadata_dst reference count handling during representor teardown. The issue involved improper freeing of metadata_dst objects while references were still held, potentially leading to memory corruption.
A use-after-free vulnerability in the Linux kernel Bluetooth subsystem was resolved. The flaw involved improper handling of socket buffer (skb) lifetimes during passive scan setup, leading to potential use of freed memory. The issue was caused by lack of proper locking around command skb references, allowing concurrent workqueues to free and replace command data while still in use.
A use-after-free vulnerability in the Linux kernel Bluetooth ISO subsystem was resolved. The flaw occurs due to improper handling of concurrent BIS listener setups on the same broadcast socket, leading to a stale socket access and potential memory corruption. The issue was fixed by adding rechecks and rejecting competing setups to prevent connection reference leaks and stale accesses.
A vulnerability in the Linux kernel's ip6_gre module related to obsolete ERSPAN PMTU update handling has been resolved. The issue involved a null pointer dereference caused by the legacy Path MTU (PMTU) update code treating a metadata destination as a route without an output device, leading to a kernel panic. The obsolete code was removed to align ERSPAN with current IPv6 GRE PMTU handling, eliminating the null pointer dereference.
A race condition vulnerability in the Linux kernel's key management subsystem was resolved. The flaw allowed a writer with write permission on a destination keyring to bypass keyring restrictions by exploiting a timing issue between restriction installation and key linking. This could result in unauthorized keys being linked despite reject-all restrictions. The issue was confirmed through repeated testing and fixed by reordering operations to ensure proper serialization of restriction checks with semaphore locking.
A use-after-free vulnerability in the Linux kernel's Bluetooth SCO connection handling was resolved. The flaw involved improper synchronization of the sco_conn lifetime against sco_recv_scodata(), leading to potential use of freed memory. The fix ensures proper locking and reference counting to prevent concurrent access to freed objects.
A use-after-free vulnerability in the Linux kernel's memstick subsystem was resolved by ensuring that asynchronous requests complete before freeing the card structure. The issue occurred because wait_for_completion_timeout() was used, which could time out and free memory while requests were still in flight, leading to a kernel slab-use-after-free write.
A vulnerability in the Linux kernel's memstick subsystem related to the rtsx_usb_ms driver has been resolved. The issue involved requests being dropped silently after a card eject event, causing the removal process to hang indefinitely. This was due to the memstick_check() function passing a removal check just before eject/removing flags were set, leading to requests not being completed and blocking workqueues. The fix ensures requests are always completed, failing them gracefully once eject is set, preventing hangs during device removal.
A vulnerability in the Linux kernel's dm-crypt subsystem was resolved that caused a kernel oops when using the lmk IV mode with AEAD ciphers. This occurs because the lmk mode sets a count of 64 transforms, but only one transform is allocated, leading to out-of-bounds memory access during key setting. The issue is not considered a security bug since exploitation requires root privileges.
A race condition in the Linux kernel device mapper (dm) subsystem was fixed that could cause reading of freed memory during concurrent ioctl calls. This issue occurs when do_resume calls dm_table_get_mode(new_map) without holding locks, potentially leading to use-after-free scenarios. The vulnerability is not considered a security bug because only root can trigger it, and common tools do not invoke the relevant ioctls concurrently. The fix involves reading the mode of the new table before swapping it to prevent the race condition.
A use-after-free vulnerability in the Linux kernel's MediaTek SD card driver (mtk-sd) was resolved by ensuring proper cancellation of delayed work during device removal. The issue involved a timeout callback accessing freed resources after the driver had unbound and released host resources. This could lead to kernel memory corruption detected by KASAN during testing.
A vulnerability in the Linux kernel's drm/imagination driver caused incorrect sizing of page table preallocation. The issue stemmed from miscalculating the size of memory preallocation, leading to excessive allocation of MMU pages. This could exhaust system memory and cause an out of memory (OOM) panic. The vulnerability has been resolved by correcting the calculation to count tables properly and prevent underflow errors when mappings cross page table boundaries.
A vulnerability in the Linux kernel's mmc sdhci-sprd driver was resolved. The issue involved improper runtime power management (PM) cleanup during device removal, where runtime PM was enabled on probe but not properly disabled on remove. This could lead to clocks being disabled twice or in an inconsistent state if the device was runtime suspended during removal. The fix ensures the device is resumed before removal and runtime PM is properly disabled before clocks are turned off.
A vulnerability in the Linux kernel's packet_rcv_spkt() function could cause a kernel panic when processing packets on devices without a visible link layer header, such as CAN interfaces. The issue arises because packet_rcv_spkt() does not guard the link layer header push operation, leading to an invalid length calculation and a panic in skb_push(). This flaw was introduced when other receive paths were updated but packet_rcv_spkt() was not. The vulnerability has been resolved by adding the appropriate guard to prevent the panic.