A vulnerability in the Linux kernel's vmgenid driver was resolved by changing the order of operations during driver initialization. The issue involved registering notification handlers before setting the driver_data pointer, which could lead to a NULL pointer dereference and kernel panic if a notification arrived early. This affected both device tree and ACPI probe paths. The fix ensures driver_data is assigned before handler registration, preventing the NULL dereference.
A vulnerability in the Linux kernel related to the ASoC SDCA component's power management runtime error handling in the function probe has been resolved. The fix adds a common error path to balance the runtime PM reference. No CVSS score or detailed impact information is provided.
A vulnerability in the Linux kernel's EDAC/altera driver was resolved by removing the __init attribute from ECC setup functions. These functions were previously marked __init and could be called after their memory was freed due to deferred probing or manual unbind/rebind actions, leading to use-after-free conditions. The fix ensures these functions remain valid at runtime, preventing potential dereferencing of freed memory.
A memory leak vulnerability in the Linux kernel's iwlegacy driver for Intel 3945 wireless devices was resolved. The issue occurs because EEPROM data allocated during device probe is not freed upon device removal, leading to a memory leak. This was identified through manual code inspection and fixed by freeing the EEPROM data in the device removal function.
A vulnerability in the Linux kernel's iio proximity pulsedlight driver was fixed. The issue involved the iio_device remaining registered in the system after a power management setup failure during device probe, leading to sysfs and character device nodes pointing to freed memory. This could cause use-after-free conditions. The fix unregisters the iio device properly on error to prevent stale references.
A vulnerability in the Linux kernel's MTK Ethernet driver was resolved where net_devices were not properly unregistered on probe failure, causing a kernel BUG due to freeing devices still marked as registered.
A vulnerability in the Linux kernel's tg3 driver was resolved involving improper cleanup of PHYLIB resources on probe failure. The tg3_get_invariants() function can register an MDIO bus and connect a PHY for USE_PHYLIB devices, but if tg3_init_one() fails afterward, the error path does not properly release these PHYLIB resources. The fix ensures the PHY is disconnected and the MDIO bus unregistered before completing teardown, preventing resource leaks.
A vulnerability in the Linux kernel's ena driver was resolved that involved a memory leak of a coherent DMA buffer during probe failure. Specifically, if ena_probe() fails after ena_device_init() succeeds, the allocated MMIO read buffer is not properly freed, leading to a resource leak. This was fixed by ensuring the buffer is destroyed in the probe error path.
A vulnerability in the Linux kernel's RTC spear driver was fixed by initializing the IRQ state before requesting the alarm IRQ. The issue was that devm_request_irq() enables the interrupt before returning, potentially causing the interrupt handler to run while the device probe is still initializing. This could lead to race conditions or unstable device behavior.
A use-after-free vulnerability exists in the Linux kernel ALSA caiaq driver where the input device is not unregistered if probe initialization fails, leading to potential kernel memory corruption when accessing freed memory. This issue occurs because the input device remains registered after failure in snd_card_register() or snd_usb_caiaq_control_init(), causing a slab-use-after-free error upon reading the device's uevent attribute. The flaw has been fixed by ensuring the input device is unregistered on probe failure, matching the behavior of snd_disconnect().
A use-after-free vulnerability in the Linux kernel's rtc ac100 driver was fixed. The issue occurs when the probe function fails after registering clocks that are not device-managed, leaving dangling pointers in the global clock provider list. This can lead to use of freed memory and resource leaks, causing later probe failures for the same device. The fix ensures proper device-managed registration and cleanup on probe failure.
A vulnerability in the Linux kernel's rtc: mpfs driver was fixed where an error pointer returned by devm_clk_get() was not checked before being passed to clk_get_rate(). This could cause a kernel crash during device probe if the clock provider had not registered clocks yet, due to dereferencing an error pointer instead of handling the error properly.
A vulnerability in the Linux kernel's wifi cfg80211 subsystem involves improper handling of beacon information elements (IEs) for hidden-group probe-response entries. The flaw allows double freeing of memory due to shared ownership of beacon IEs between group and associated entries. This can lead to use-after-free conditions when the group's beacon entry is released, potentially causing system instability or crashes. The issue has been fixed by skipping beacon IE replacement for entries belonging to hidden groups while preserving other processing steps.
A NULL pointer dereference vulnerability in the Linux kernel's bcmgenet network driver occurs when setting Rx coalescing parameters on an interface that has not been opened. This leads to a kernel oops and networking becoming unresponsive until reboot. The issue is fixed by initializing necessary data structures at probe time rather than at interface open.
A resource leak vulnerability in the Linux kernel's Mediatek DRM driver was fixed. The issue involved the OVL adaptor platform device not being unregistered properly on probe failure or during driver removal, potentially causing resource leaks. The fix ensures proper tracking and unregistration of the OVL adaptor device in failure and removal paths.