A use-after-free vulnerability in the Linux kernel's network team driver was resolved. The issue involved improper reuse of socket buffers (skb) after a queue override operation, leading to potential kernel memory corruption and panic. The flaw was due to incorrect handling of dev_queue_xmit() results and skb ownership, causing a slab-use-after-free error detected by KASAN. This vulnerability could cause kernel crashes and instability.
A vulnerability in the Linux kernel's regulator subsystem was resolved involving the function of_regulator_bulk_get_all(). This function returned an array with uninitialized supply name fields, which could lead to dereferencing uninitialized memory when the array is used by regulator_bulk_enable(). The fix involved copying supply names into the array's allocation to ensure proper initialization and memory safety.
A vulnerability in the Linux kernel's OP-TEE driver allowed TEE devices to be registered before full initialization, leading to potential use of uninitialized mutexes and NULL pointer dereferences. This occurred because tee_device_register() was called prematurely in optee_probe(), exposing devices to user and kernel space before the struct optee was fully set up. The issue has been fixed by deferring device registration until after complete initialization.
A memory leak vulnerability in the Linux kernel's sparx5 network driver was fixed. The issue involved sparx5_tc_matchall_replace() allocating memory for matchall filters without freeing it upon deletion, causing leaked entries. The fix ensures that the allocated entries are freed after being unlinked, preventing memory leaks.
A memory leak vulnerability in the Linux kernel's power sequencing component for pcie-m2 was fixed. The function of_regulator_bulk_get_all() allocates an array that the caller must free, but pwrseq-pcie-m2.c did not free this array, causing a memory leak. The fix adds an explicit kfree() call to release the allocated memory.
A vulnerability in the Linux kernel's CIPSO option handling was resolved. The cipso_v4_skbuff_delattr() function removed CIPSO bytes but failed to adjust cached offsets for subsequent options, causing consumers to access incorrect bytes. This could lead to improper interpretation of packet data and potential memory corruption when copying option data into fixed-size storage.
A vulnerability in the Linux kernel's xen/netfront component caused a memory leak when xennet_fill_frags() fails due to response chains having more slots than fit in the skb's fragments. The error path did not free the skb properly, leading to resource leakage. This issue has been resolved by ensuring the skb is put back on the temporary queue before error handling proceeds.
A use-after-free vulnerability in the Linux kernel's ice driver was fixed by correcting metadata_dst reference count handling during representor teardown. The issue involved improper freeing of metadata_dst objects while references were still held, potentially leading to memory corruption.
A race condition in the Linux kernel device mapper (dm) subsystem was fixed that could cause reading of freed memory during concurrent ioctl calls. This issue occurs when do_resume calls dm_table_get_mode(new_map) without holding locks, potentially leading to use-after-free scenarios. The vulnerability is not considered a security bug because only root can trigger it, and common tools do not invoke the relevant ioctls concurrently. The fix involves reading the mode of the new table before swapping it to prevent the race condition.
A vulnerability in the Linux kernel's CAN network subsystem was resolved by restoring skb header initialization in the init_can_skb() function. The issue was introduced when certain skb header reset calls were removed, causing RX skbs to carry an invalid mac_header value. This leads to an overflow in push length calculation in packet_rcv_spkt(), triggering a kernel panic and full machine crash. The problem was originally reported in 2014 and fixed then, but the recent commit reintroduced it. The vulnerability affects kernel stability and can cause denial of service via system crash.
A vulnerability in the Linux kernel's ibmveth driver was resolved, involving improper cleanup of the logical LAN resource on failure during the open operation. Specifically, if buffer pool allocation fails after the logical LAN is registered, the cleanup function h_free_logical_lan() was not called, leaving the buffer-list page owned by PHYP when unmapped. This could lead to resource mismanagement. The fix moves the cleanup call to a shared path ensuring deregistration before unmapping the buffer list.
A use-after-free vulnerability in the Linux kernel's gpio mpsse driver was resolved by fixing a race condition when arming the IRQ poll worker. The issue occurred because the poll worker could be scheduled before being properly published, leading to potential access of freed memory after device disconnect. The fix ensures atomic publication and arming of the worker under a spinlock and introduces a dying flag to safely handle teardown and memory freeing.
A vulnerability in the Linux kernel's TCP zerocopy receive mapping was resolved. The issue involved dereferencing a NULL pointer when handling net_iov fragments in zerocopy receive mapping hints, leading to a kernel panic under certain conditions. The fix rejects all net_iov fragments before accessing page mappings, preventing the NULL pointer dereference and associated crash.
A use-after-free vulnerability in the Linux kernel's fsverity subsystem was resolved by introducing an RCU-delay in freeing the struct fsverity_info. The issue arose because __fsverity_get_info() used rcu_read_lock() without proper synchronization with fsverity_remove_info(), leading to potential concurrent access to freed memory for different inodes.
A memory leak vulnerability in the Linux kernel ALSA ctxfi component was fixed by ensuring allocated memory for DAO input mappers is properly freed when clearing them. The issue was caused by missing kfree() calls in the dao_clear_input() function, leading to memory not being released on each call.
A vulnerability in the Linux kernel's mt7603 WiFi driver involved the use of an uninitialized global station WCID for frames without a station or vif, including those injected via a monitor interface. This led to a NULL pointer dereference causing kernel crashes. The issue was fixed by initializing the WCID before publishing it, preventing crashes during frame transmission.
A vulnerability in the Linux kernel's SELinux implementation related to NFSv4 filesystem mounts has been resolved. When an NFSv4 filesystem exported with security_label is mounted a second time, the superblock reuse logic failed to preserve the SECURITY_LSM_NATIVE_LABELS flag, causing per-file security labeling to be silently disabled for both mounts. This issue was fixed by ensuring the SECURITY_LSM_NATIVE_LABELS flag is set correctly on reused superblocks during mount option processing.
A vulnerability in the Linux kernel's memstick subsystem related to the rtsx_usb_ms driver has been resolved. The issue involved requests being dropped silently after a card eject event, causing the removal process to hang indefinitely. This was due to the memstick_check() function passing a removal check just before eject/removing flags were set, leading to requests not being completed and blocking workqueues. The fix ensures requests are always completed, failing them gracefully once eject is set, preventing hangs during device removal.
A vulnerability in the Linux kernel's dm-crypt subsystem was resolved that caused a kernel oops when using the lmk IV mode with AEAD ciphers. This occurs because the lmk mode sets a count of 64 transforms, but only one transform is allocated, leading to out-of-bounds memory access during key setting. The issue is not considered a security bug since exploitation requires root privileges.
A vulnerability in the Linux kernel's WireGuard implementation involving the Noise protocol handshake was resolved. The flaw allowed two threads to process the same response message concurrently, potentially causing a race condition where a handshake state could be incorrectly reused. Although the issue is considered nearly impossible to exploit in practice, a fix was implemented to ensure the ephemeral private key is compared to the latest handshake state to prevent this condition.