A resource leak vulnerability in the Linux kernel's mlxsw spectrum_flower component was fixed. The flaw involved port range registers acquired during flow template parsing that were not properly released, leading to a resource leak. The fix ensures that these registers are released correctly to prevent the leak.
A vulnerability in the Linux kernel related to the HID steam driver has been resolved. The issue involved improper locking behavior, specifically that RCU (Read-Copy-Update) accesses were not properly guarded behind locks. This fix cleans up several locking issues to improve kernel stability and security.
A vulnerability in the Linux kernel scheduler extension (sched_ext) was resolved by changing how cid tables are built and published. Previously, cid tables were visible while being modified, allowing race conditions that could expose uninitialized memory or torn updates to tracing or syscall programs. The fix involves building cid tables privately and publishing them only when fully constructed, ensuring readers always see consistent and valid data. Additionally, the fix includes proper synchronization and NULL checks to prevent stale or invalid reads.
A vulnerability in the Linux kernel's btrfs filesystem involving io_uring encoded data handling has been resolved. The issue occurs when returning -EAGAIN while leaving btrfs_uring_encoded_data in the command PDU, potentially causing data leaks if requests are cancelled or the ring exits before reissue. The vulnerability relates to improper freeing of driver PDU allocations on cleanup in io_uring operations. The fix ensures that allocations are freed appropriately on error returns to prevent leaks.
A vulnerability in the Linux kernel related to the HID steam driver has been resolved. The issue involved improper handling of registration and unregistration flows, which could leave a lingering power_supply object after the steam object was torn down. The fix refactors the registration logic, removing assumptions about serial numbers and correcting the omission of unregistering the battery when registration steps fail.
A vulnerability in the Linux kernel's XFS filesystem was resolved involving the XFS_IOC_EXCHANGE_RANGE ioctl with the TO_EOF flag. The flaw allowed file size inconsistencies where files could end up with shared blocks beyond EOF, which is invalid. This incorrect file size handling could lead to improper clearing of reflink flags and potential data corruption during writes. The issue was fixed by correcting how file sizes are exchanged and managed during the operation.
A vulnerability in the Linux kernel related to namespace handling has been resolved. The issue involves pseudo dentries, which are special directory entries for pipes, sockets, and other files that are not part of the normal filesystem hierarchy. These pseudo dentries should not become the root of a mount, but bind mounting /proc/self/fd/<fd> can cause this to happen. This leads to a race condition where a dentry can be freed while still being accessed, potentially causing instability. The fix prevents cloning a mount whose root is a pseudo dentry with the DCACHE_NORCU flag.
A vulnerability in the Linux kernel's namespace handling allows the owner of a user namespace to replace its locked /proc or root mount. This occurs due to improper transfer of the locked property when a propagated copy of a mount is moved beneath another mount, potentially exposing files that should remain covered and locked. The issue has been resolved by ensuring the locked property is only transferred to mounts placed by the caller, maintaining proper mount locking behavior.
A vulnerability in the Linux kernel related to the removal of fsnotify marks from a mount namespace in process context has been resolved. The issue involved improper removal of fanotify marks in an invalid context, causing kernel locking bugs and potential system instability. The flaw allowed a root user in a user namespace to leave marks on a mount namespace that could trigger a BUG due to sleeping functions called from invalid contexts during namespace release. The fix ensures marks are removed in process context before the namespace is handed to RCU, preventing the invalid context issue.
A vulnerability in the Linux kernel's drm_bridge_add() function was resolved. The issue involved modifying linked lists without holding the required bridge_lock, potentially causing list corruption when re-adding a previously removed bridge. This could affect the stability of the drm bridge subsystem.
A vulnerability in the Linux kernel related to namespace handling and locked mounts has been resolved. Locked mounts are designed to protect underlying files and directories from being revealed. The flaw allowed an unlocked ancestor mount to expire a locked mount beneath it, potentially exposing protected directories. The fix ensures that locked mounts are not expired independently but only as part of their parent mount, preventing the exposure of hidden files. Lazy unmounts still remove the entire mount tree including locked mounts. This vulnerability is addressed by changes to the expiry logic and mount locking behavior.
A vulnerability in the Linux kernel's mount namespace handling has been resolved. The flaw involves attach_recursive_mnt() not properly considering the topmost mount in a mount namespace file chain, leading to incorrect mountpoint attachment. This can cause mounts to become inaccessible and prevent synchronous unmounting due to lingering child mounts.
A vulnerability in the Linux kernel namespace handling was resolved involving the order of unhashing a dentry before detaching mounts on it. The issue allowed a race condition during unlink(), rmdir(), and rename() operations where the dentry remained hashed and visible between detach_mounts() and d_delete(), potentially exposing mount points that should have been hidden. This race window could be exploited by concurrent lookups to observe mounts that were supposed to be detached. The fix changes the order to unhash the dentry before detaching mounts, preventing lookups from seeing stale mount information.
A vulnerability in the Linux kernel's net/sched subsystem was resolved that involved improper handling of unterminated algorithm names in the em_text module. The flaw allowed an out-of-bounds read and potential kernel memory disclosure when a 16-byte algorithm name without a NUL terminator was passed, causing the kernel to read adjacent memory and invoke a usermode helper with unintended data. The issue was fixed by rejecting attributes lacking a NUL terminator within the expected byte size.
A vulnerability in the Linux kernel's pivot_root() function involves improper checks of mount points before reading their parent mounts. The issue arises when new_root or the caller's root is a file descriptor to a mount that has been unmounted but still kept alive by the file descriptor, potentially leading to a use-after-free condition. The vulnerability causes a read operation on freed memory, resulting in a kernel bug detected by KASAN. The fix involves verifying that both mounts are in the caller's mount namespace before accessing their parents, preventing the unsafe read. All error paths return EINVAL, so no other side effects occur.
A vulnerability in the Linux kernel's drm/vc4 component involved a memory leak where the BO cache size list was not freed during teardown, leading to resource leakage on every unbind operation. This issue has been resolved by ensuring the size list is freed properly in vc4_bo_cache_destroy().
A vulnerability in the Linux kernel's cxgb4 driver related to ch_ktls handling has been resolved. The issue involves improper locking when erasing entries from a shared tid_list array, which can lead to a spinlock deadlock due to softirqs not being disabled during xa_erase operations. The fix involves using xa_erase_bh() to properly disable softirqs and prevent lock contention.
A vulnerability in the Linux kernel's dcache handling has been resolved. The issue involves improper handling of mountpoints on dentries that are being removed, allowing a bind mount of a directory being removed to be moved beneath an existing mount. This causes the mount to remain on the removed directory indefinitely, preventing its detachment. The flaw arises due to a race condition between detach_mounts() and d_delete(), where the victim dentry is still hashed and not properly locked during mount operations.
A use-after-free vulnerability in the Linux kernel's AMT relay component was resolved. The issue involved queuing a packet buffer (skb) referencing a tunnel that could be freed before the packet was processed, leading to a use-after-free in amt_dev_xmit(). The fix changes the relay's General Query sending method to avoid queuing and referencing freed tunnels, removing unsafe skb control block usage. This eliminates the use-after-free condition and related kernel warnings.
A use-after-free (UaF) vulnerability in the Linux kernel's cgroup cpuset subsystem was resolved by avoiding direct access to a potentially stale pointer in the is_in_v2_mode() function. The fix introduces a new flag to safely indicate cpuset v2 mode, preventing unsafe memory access during cgroup filesystem rebind operations.