A vulnerability in the Linux kernel's SELinux implementation related to NFSv4 filesystem mounts has been resolved. When an NFSv4 filesystem exported with security_label is mounted a second time, the superblock reuse logic failed to preserve the SECURITY_LSM_NATIVE_LABELS flag, causing per-file security labeling to be silently disabled for both mounts. This issue was fixed by ensuring the SECURITY_LSM_NATIVE_LABELS flag is set correctly on reused superblocks during mount option processing.
A vulnerability in the Linux kernel's memstick subsystem related to the rtsx_usb_ms driver has been resolved. The issue involved requests being dropped silently after a card eject event, causing the removal process to hang indefinitely. This was due to the memstick_check() function passing a removal check just before eject/removing flags were set, leading to requests not being completed and blocking workqueues. The fix ensures requests are always completed, failing them gracefully once eject is set, preventing hangs during device removal.
A vulnerability in the Linux kernel's dm-crypt subsystem was resolved that caused a kernel oops when using the lmk IV mode with AEAD ciphers. This occurs because the lmk mode sets a count of 64 transforms, but only one transform is allocated, leading to out-of-bounds memory access during key setting. The issue is not considered a security bug since exploitation requires root privileges.
A vulnerability in the Linux kernel's WireGuard implementation involving the Noise protocol handshake was resolved. The flaw allowed two threads to process the same response message concurrently, potentially causing a race condition where a handshake state could be incorrectly reused. Although the issue is considered nearly impossible to exploit in practice, a fix was implemented to ensure the ephemeral private key is compared to the latest handshake state to prevent this condition.
A vulnerability in the Linux kernel's io_uring/net subsystem was resolved that involved incorrect handling of IPv6 sockaddr length in connection filtering. The issue caused connect filters to see zeroed port and address fields when the sockaddr_in6 length was 24 bytes (SIN6_LEN_RFC2133), allowing filters that deny connections based on port or address to be bypassed. The fix aligns the length threshold to SIN6_LEN_RFC2133, ensuring filters correctly see the real destination address and port.
A race condition vulnerability in the Linux kernel's strparser component was resolved. The issue involved the __strp_recv function potentially running concurrently while the parser was being torn down, which could lead to use-after-free (UAF) conditions. The vulnerability affects only the espintcp user of strp_recv, and a patch was introduced to add locking mechanisms to prevent this race. The general mode of strp, which could also crash, is unused and slated for removal. A proof-of-concept exploit has been published, but no known exploits are currently in the wild.
A vulnerability in the Linux kernel's gve driver related to AF_XDP zero-copy (ZC) mode caused a buffer leak when the error bit was set in the RX completion descriptor. The issue was that the XSK buffer was not freed properly on error, leading to resource leakage. This vulnerability has been resolved in the Linux kernel.
A vulnerability in the Linux kernel's Xilinx GPIO driver caused a runtime PM (power management) leak on the request error path. The issue arises because pm_runtime_get_sync() increments the usage counter even on failure, and the error path does not properly decrement it, leading to a leaked reference. This prevents the controller from runtime-suspending and keeps its clock enabled unnecessarily. The fix involves switching to pm_runtime_resume_and_get(), which increments the usage counter only on success.
A use-after-free vulnerability in the Linux kernel's TIPC subsystem was resolved. The function tipc_node_find_by_name() returned a node pointer after dropping its RCU read lock without taking a reference, leading to a race condition where handlers could access a freed node. This could cause kernel memory corruption and instability. The issue was detected by KASAN and fixed by acquiring a reference to the node before leaving the RCU read lock and releasing it appropriately after use.
A vulnerability in the Linux kernel's gve driver caused XSK buffers to leak when rings were stopped. Specifically, the driver did not free XSK buffers when resetting ring state during queue stoppage, leading to resource leakage. This issue was observed in production environments and has been resolved by ensuring XSK buffers attached to allocated buf_state are freed when stopping rings.
A vulnerability in the Linux kernel's ip6_gre module related to obsolete ERSPAN PMTU update handling has been resolved. The issue involved a null pointer dereference caused by the legacy Path MTU (PMTU) update code treating a metadata destination as a route without an output device, leading to a kernel panic. The obsolete code was removed to align ERSPAN with current IPv6 GRE PMTU handling, eliminating the null pointer dereference.
A use-after-free vulnerability in the Linux kernel's MediaTek SD card driver (mtk-sd) was resolved by ensuring proper cancellation of delayed work during device removal. The issue involved a timeout callback accessing freed resources after the driver had unbound and released host resources. This could lead to kernel memory corruption detected by KASAN during testing.
A vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem was resolved. The flaw involved improper teardown of topsrv workqueues before closing subscriber connections, leading to race conditions. These races could cause use-after-free errors, queueing work on destroyed workqueues, and RCU stalls during network exit. The fix changes the teardown order, adds a shutdown flag to refuse lookups during teardown, and ensures workqueues are destroyed before closing connections.
A use-after-free vulnerability in the Linux kernel's memstick subsystem was resolved by ensuring that asynchronous requests complete before freeing the card structure. The issue occurred because wait_for_completion_timeout() was used, which could time out and free memory while requests were still in flight, leading to a kernel slab-use-after-free write.
A use-after-free vulnerability in the Linux kernel's ice driver was fixed. The flaw occurs in the dynamic port cleanup function ice_dealloc_dynamic_port(), where the code frees a VSI object before using its index to erase a dynamic port entry, leading to use-after-free. The fix involves erasing the xarray entry before freeing the VSI, following the reverse order of allocation.
A vulnerability in the Linux kernel workqueue subsystem was resolved that could cause a NULL pointer dereference when checking chained work. The issue arises because current_wq_worker() indicates a kworker but does not guarantee it is executing a work item, leading to a potential fault when worker->current_pwq is NULL during certain queue states.
A race condition vulnerability in the Linux kernel's key management subsystem was resolved. The flaw allowed a writer with write permission on a destination keyring to bypass keyring restrictions by exploiting a timing issue between restriction installation and key linking. This could result in unauthorized keys being linked despite reject-all restrictions. The issue was confirmed through repeated testing and fixed by reordering operations to ensure proper serialization of restriction checks with semaphore locking.
A deadlock vulnerability in the Linux kernel's GVE driver was resolved. The issue occurs when disabling XSK pools, where unlocked versions of napi_disable and napi_enable are called while the netdev lock is already held, causing a deadlock. The fix updates these calls to use the locked versions to prevent the deadlock.
An OS command injection vulnerability exists in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware versions 0.3.9.7 through 0.6.6.9 on Android. A local unprivileged process can exploit this by writing a crafted line to the Android log (logcat), which the helper reads and executes with root privileges. This allows arbitrary command execution as root.
A heap out-of-bounds write vulnerability in the Linux kernel's ksmbd component was fixed in the krb5_authenticate() function. The flaw occurs because the calculation of available buffer space (out_len) for the Kerberos AP-REP token does not account for prior responses in a compounded SMB2 request, leading to an overestimation of buffer headroom. This causes a length check to erroneously pass, allowing memcpy() to write beyond the allocated buffer into adjacent kernel heap memory. The issue is resolved by correctly subtracting the offset of prior responses when computing the available buffer space.