A vulnerability in the Linux kernel's mac80211 Wi-Fi subsystem related to channel context management has been resolved. The issue involved premature freeing of an old channel context (chanctx) while its replacement still referenced it, potentially leading to use-after-free conditions. The fix ensures that the old chanctx remains alive until the replacement pair is fully torn down, preventing stale pointer dereferences.
A vulnerability in the Linux kernel's KVM x86 memory management unit (MMU) was resolved that caused a NULL pointer dereference during shadow page table walks if the root was invalid or a dummy. This occurred when memslot creation raced with a stage-2 page fault, leading to kernel crashes. The fix terminates shadow walks immediately when encountering a dummy root to prevent the NULL dereference.
A vulnerability in the Linux kernel's Thunderbolt driver related to DisplayPort (DP) tunnel activation callback handling has been resolved. The issue involved a missing mandatory callback in the tb_tunnel_alloc_dp() function, causing a reference leak for every tunnel without a callback. This flaw also caused hibernation restore to block for up to 12 seconds. The fix enforces the callback requirement and removes the synchronous path, improving stability and resource management.
A vulnerability in the Linux kernel's iio proximity pulsedlight driver was fixed. The issue involved the iio_device remaining registered in the system after a power management setup failure during device probe, leading to sysfs and character device nodes pointing to freed memory. This could cause use-after-free conditions. The fix unregisters the iio device properly on error to prevent stale references.
A vulnerability in the Linux kernel's iio adc xilinx-xadc driver was resolved by changing the order of resource management to free IRQ before cancelling the unmask worker on unbind. This prevents the IRQ handler from queuing work after the associated data structure has been freed, which could cause use-after-free conditions.
A use-after-free vulnerability in the Linux kernel Bluetooth mesh management subsystem was resolved. The flaw occurs when a mesh transmission object is freed but a queued work entry retains a pointer to it, leading to use-after-free during later processing. The fix involves properly dequeuing pending entries before freeing and ensuring the transmission queue advances correctly to avoid deadlocks.
A vulnerability in the Linux kernel's drm/bridge samsung-dsim driver was fixed by correcting the handling of the TE GPIO lifetime during host attach operations. The issue involved improper management of GPIO descriptors leading to potential resource mismanagement when the DSI host was detached and reattached without device destruction.
A vulnerability in the Linux kernel's fbnic Ethernet driver related to incorrect usage of the Rx queue NAPI pointer has been resolved. The issue involved the queue management code incorrectly mapping Rx queues to Tx NAPI vectors when standalone Tx vectors were present, potentially causing use of freed memory or invalid pointers during queue restart or PCIe recovery scenarios. The fix uses the correct napi pointer stored in netdev_rx_queue.napi, ensuring safe queue management under locking. No CVSS score is available for this issue.
A vulnerability in the Linux kernel's FireWire cdev component involving improper state transitions in the iso_resource_auto client resource has been resolved. The issue allowed the state to incorrectly transition backwards due to concurrent access, potentially causing inconsistent resource management.
A race condition vulnerability in the Linux kernel's net: libwx Tx timestamp handling was resolved. The issue involved improper synchronization of shared skb pointers between transmission, timestamp worker, and cleanup paths, potentially causing double frees or reference leaks. A dedicated spinlock was introduced to serialize access and prevent these race conditions. This fix addresses stability and memory management issues in the affected kernel component.
A vulnerability in the Linux kernel's stmmac network driver was resolved by clearing a stale buffer page pointer after a failed skb build operation. The issue involved a stale pointer to a recycled page that could cause inconsistent buffer lifecycle management in the receive path.
A refcount leak vulnerability in the Linux kernel's perf subsystem was fixed in the attach_perf_ctx_data() function. The issue arises due to a race condition between global and non-global cases when attaching performance context data, potentially causing a reference count leak. This can lead to resource management issues within the kernel's performance monitoring infrastructure.
A race condition vulnerability in the Linux kernel's NFC LLCP socket handling was resolved. The flaw involved concurrent unlinking and releasing of the same child socket due to improper synchronization between socket release and accept dequeue operations, leading to potential use-after-free or NULL pointer dereference. The fix replaces a bottom-half lock with a process-context lock, defers final resource release to a workqueue to avoid sleeping in atomic context, and adds safeguards to prevent object resurrection and listener hangs. The vulnerability affects the NFC LLCP socket lifecycle and was addressed with multiple synchronization and lifecycle management improvements.
A vulnerability in the Linux kernel's gpio: arizona driver was fixed to address a runtime power management (PM) reference leak. The issue occurred when switching a persistent GPIO line from input to output; if an internal update operation failed, the acquired runtime PM reference was not released, potentially causing resource leaks.
A vulnerability in the Linux kernel's amdgpu driver caused a runtime power management (PM) reference leak in the function amdgpu_debugfs_test_ib_show(). This leak occurs when the function's attempt to acquire a reset domain semaphore is interrupted, leading to the GPU remaining awake unnecessarily. The issue has been fixed by ensuring the runtime PM reference is properly dropped on error paths.
A vulnerability in the Linux kernel's gpio driver for the Zynq platform causes a runtime power management (PM) usage counter leak when pm_runtime_get_sync() fails during gpio request. This leak prevents the controller from runtime-suspending, leaving its clock enabled unnecessarily. The issue is fixed by switching to pm_runtime_resume_and_get(), which increments the usage counter only on success.
A vulnerability in the Linux kernel's drm/nouveau driver caused a runtime power management (PM) reference leak in the nouveau_connector_detect() function. If the function nvif_outp_edid_get() fails, nouveau_connector_detect() would return early without releasing the runtime PM reference, causing the device to remain powered on unnecessarily until the next successful detection. This issue has been fixed by ensuring the runtime PM reference is properly balanced on all error paths.
A race condition in the Linux kernel's memory management subsystem (anon_vma handling) on arm64 servers can cause a deadlock or hung task due to a missing memory barrier between anon_vma initialization and publication. This leads to use-after-free of anon_vma->root, causing inconsistent locking states and potential indefinite blocking of tasks.
A vulnerability in the Linux kernel's nouveau DRM driver was resolved that involved incorrect handling of pin counts when a re-pin operation failed. Specifically, the function nouveau_bo_pin_locked() would increment the pin count even when the re-pin failed due to incompatible memory domains, leading to a mismatch in pin/unpin operations and triggering warnings in the kernel. This issue was discovered through fuzz testing and could cause kernel warnings related to resource management.
A vulnerability in the Linux kernel's memory management subsystem related to huge page table entry (PTE) updates has been resolved. The issue involves the damon_hugetlb_mkold() function, which updates page table entries without properly handling concurrent hardware-driven updates, potentially causing loss of hardware-updated bits such as dirty bits. The fix avoids parallel updates by clearing the page table entry atomically during read operations. Since hugetlbfs is an in-memory filesystem and huge pages cannot be reclaimed, no critical impact is expected. The vulnerability was discovered by Sashiko and has been addressed in the Linux kernel.