A vulnerability in the Linux kernel's CAN BCM (Broadcast Manager) subsystem involving stale receive (rx) and transmit (tx) operations after device removal has been fixed. The issue caused improper handling of rx setup updates and tx operations, leading to potential indefinite timer execution and stale operation states. This flaw could result in denial of service or impact system stability. The vulnerability affects specific Linux kernel versions and has a CVSS score of 7.1 (medium severity). A patch is available to address the issue.
A vulnerability in the Linux kernel's CAN BCM driver was resolved, specifically in bcm_rx_setup() where frame length validation for RTR replies was missing. This flaw allowed improper frame length handling, unlike bcm_tx_setup() which validated frame length before transmission. The issue affects specific Linux kernel versions and has a CVSS score of 7.8, indicating a high impact on confidentiality, integrity, and availability. A patch is available to address this vulnerability.
A concurrency vulnerability in the Linux kernel's CAN BCM subsystem was resolved. The issue involved improper tracking of source interfaces for ANYDEV timeout/throttle operations, leading to race conditions that could cause spurious RX_TIMEOUT notifications and corruption of last_frames data. The fix adds tracking of the first interface delivering matching frames to prevent interference from other interfaces during active timers.
A vulnerability in the Linux kernel's sparx5 network driver was fixed where the blocking notifier was not unregistered properly on initialization failure. This could lead to inconsistent notifier states. The issue has been addressed by adding proper error handling to unregister the blocking notifier if workqueue allocation fails.
A data race vulnerability in the Linux kernel's can: bcm subsystem was resolved. The issue involved concurrent writes to rx_stamp and rx_ifindex fields without proper locking, potentially causing torn stores on 32-bit platforms and inconsistent timestamp/ifindex reporting. The fix places these assignments within a locked section to prevent race conditions. This vulnerability affects specific Linux kernel versions and has been patched.
A race condition vulnerability in the Linux kernel's CAN BCM subsystem was resolved. The issue involved lockless reads of socket binding state leading to inconsistent observations, potentially causing a socket bound to a specific CAN interface to behave as if bound to any interface. Additionally, a silent failure in bcm_rx_setup() was fixed to correctly report device disappearance errors. The vulnerability affects specific Linux kernel versions and has a CVSS score of 7.3 (medium severity). A patch is available to address these issues.
A use-after-free (UAF) vulnerability was resolved in the Linux kernel's CAN BCM driver related to deferred deallocation of rx_op structures. The issue involved a race condition where a timer callback could access freed memory, causing potential system instability or compromise. The fix defers timer cancellation and memory deallocation to a dedicated workqueue to avoid unsafe operations in atomic context and prevent use-after-free conditions.
A vulnerability in the Linux kernel's CAN ISO-TP protocol implementation allowed race conditions in the transmit (TX) state machine due to insufficient serialization of TX state transitions. This could lead to state corruption between concurrent contexts managing message transmission and timer callbacks. The issue has been resolved by serializing TX state transitions under the socket's receive lock (so->rx_lock), ensuring consistent state management and preventing concurrent access issues.
A vulnerability in the Linux kernel's mtd: slram subsystem was resolved. The issue involved the device list retaining partially initialized entries if memory allocation or device registration failed, potentially leading to dereferencing or freeing invalid memory during cleanup. This flaw could cause system instability or crashes. The vulnerability has a CVSS score of 7.8 and affects specific Linux kernel versions. A patch is available to address this issue.
A use-after-free vulnerability in the Linux kernel's batman-adv module was fixed. The issue involved retrieving the ethernet header after a potential skb buffer reallocation during packet reception, where variables pointing to the old buffer were not properly reassigned. This flaw could lead to use-after-free conditions affecting TT and AP isolation handling. The vulnerability has a high CVSS score of 8.8 and affects multiple specific Linux kernel versions. A patch is available to address this issue.
A potential memory leak vulnerability in the Linux kernel's broadsheetfb framebuffer driver was fixed. The issue involved memory allocated for pagerefs in fb_deferred_io_init() not being freed on error paths, which could lead to resource exhaustion. The fix involves calling fb_deferred_io_cleanup() to properly free memory. This vulnerability affects specific versions of the linux-hwe-edge kernel and has been patched.
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame brcmf_notify_auth_frame_rx() takes the frame length from the firmware event and copies the frame body with the management header offset subtracted: u32 mgmt_frame_len = e->datalen - sizeof(struct brcmf_rx_mgmt_data); ... memcpy(&mgmt_frame->u, frame, mgmt_frame_len - offsetof(struct ieee80211_mgmt, u)); The only length check is e->datalen >= sizeof(*rxframe), so mgmt_frame_len can be anything from 0 up. offsetof(struct ieee80211_mgmt, u) is 24. When mgmt_frame_len is below that, the subtraction wraps as an unsigned value to a huge length. The memcpy then runs far past the kzalloc'd buffer. A malicious or malfunctioning AP can make the frame short during the external SAE auth exchange, so this is a remotely triggered heap overflow. Reject frames shorter than the management header offset before the copy.
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read regular header address fields before unsupported extension subtypes are dropped. mac80211 currently only handles S1G beacon extension frames. Drop other extension subtypes before they can reach regular-header RX processing. For S1G beacons, linearize the SKB with the management-frame path and require the fixed S1G beacon header, including optional fixed fields indicated by frame control, before generic RX dispatch. Route S1G beacons through the station/default-link RX path without regular-header station lookup. Avoid regular-header address reads in the mac80211 RX paths that process S1G extension beacons, including accept-frame, duplicate-detection, address-copy, and MLO address-translation paths. Also make ieee80211_get_bssid() length-safe before returning the S1G source-address pointer.
The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a capability-agnostic nonce that any edit_posts user obtains from the Elementor editor), so a Contributor can write a data-source binding into any post — including admin-authored pages — whose attacker-controlled values are rendered into a widget's repeater output without sanitization, executing JavaScript in the session of any visitor or administrator who views the page.
A vulnerability in the Linux kernel's rxrpc subsystem caused a reference leak when using recvmsg with the MSG_PEEK flag. The flaw was that rxrpc_recvmsg() did not properly drop the reference on an already-released call if MSG_PEEK was specified, potentially leading to resource leaks. This issue has been fixed in multiple Linux kernel versions starting from 5.11, 6.2, 6.6.145, 6.12.97, and 6.16.
A memory leak vulnerability was identified and fixed in the Linux kernel's ath12k driver, specifically in the ath12k_wifi7_dp_rx_h_verify_tkip_mic() function. The issue occurs when an invalid NWIFI header length causes early function termination, leading to the affected MSDU not being freed properly. This flaw affects multiple Linux kernel versions prior to the fixed releases.
In the Linux kernel, the following vulnerability has been resolved:
bnxt: fix head underflow on XDP head-grow
The xdp.py test test_xdp_native_adjst_head_grow_data crashes when run on
a bnxt machine (and also crashes in NIPA).
It seems that the bug is an underflow in bnxt_rx_multi_page_skb, which
builds the skb head:
napi_build_skb(data_ptr - bp->rx_offset, rxr->rx_page_size);
The problem with this expression is that in page mode, rx_offset is:
bp->rx_offset = NET_IP_ALIGN + XDP_PACKET_HEADROOM;
Which evaluates (at least on x86_64) to 258.
The test test_xdp_native_adjst_head_grow_data tests a case where the
head is adjusted by -256.
When this test runs, data_ptr is shifted to frag_start + 2 (where
frag_start = page_address(page) + offset).
Then, bnxt_rx_multi_page_skb is invoked and the napi_build_skb
expression subtracts 258, landing at an address before frag_start. This
could be either the previous fragment or the previous physical page when
the offset is < 256 (e.g. if the fragment started at offset 0).
When the skb is freed, the page pool fragment reference is dropped on
either the wrong page or the wrong frag of the right page. In either
case, the corrupted reference count can lead to the page being
prematurely recycled while still in use. Once (incorrectly) recycled, it
can be handed out again and on driver teardown this would result in a
double free.
The commit under fixes updated this code to handle the case where the
native page size is >= 64k, but it unintentionally broke the head grow
case.
To fix this, add an offset field to struct bnxt_sw_rx_bd, mirroring the
existing offset field in struct bnxt_sw_rx_agg_bd. Populate it on
allocation and preserve it on reuse.
In bnxt_rx_multi_page_skb, use the newly added offset field to compute
the fragment start and pass that to napi_build_skb. Adjust the layout
with skb_reserve.
There are two cases, the non-adjustment case and the adjustment case.
In both cases, the skb is built at page_address(page) + offset to
account for the case where the native page size >= 64K and skb_reserve
is called with data_ptr - (page_address(page) + offset). That
difference equals bp->rx_offset when data_ptr was not moved, or
bp->rx_offset + xdp_adjust when XDP adjusted the head.
Re-running the failing test with this commit applied causes the test to
run successfully to completion.
The other rx_skb_func implementations don't have this issue.
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix publication race for priv->channel_stats[]
mlx5e_channel_stats_alloc() publishes a new entry to
priv->channel_stats[] and then increments priv->stats_nch as a
publication token, but neither store carries any memory barrier:
priv->channel_stats[ix] = kvzalloc_node(...);
if (!priv->channel_stats[ix])
return -ENOMEM;
priv->stats_nch++;
Concurrent readers compute the loop bound from priv->stats_nch and
then dereference priv->channel_stats[i] using plain accesses, e.g.
for (i = 0; i < priv->stats_nch; i++) {
struct mlx5e_channel_stats *cs = priv->channel_stats[i];
... cs->rq.packets ...
}
On weakly-ordered architectures (ARM, PowerPC, RISC-V) the writes to
channel_stats[ix] and stats_nch may become visible to other CPUs out
of program order. A reader can observe stats_nch == N while still
seeing channel_stats[N-1] == NULL, leading to a NULL pointer
dereference in the channel_stats loop.
This has been observed in production on BlueField-3 DPUs (arm64),
where ovs-vswitchd queries netdev statistics over netlink during NIC
bringup, racing mlx5e_open_channel() -> mlx5e_channel_stats_alloc()
on another CPU:
Unable to handle kernel NULL pointer dereference at virtual address 0x840
Hardware name: BlueField-3 DPU
pc : mlx5e_fold_sw_stats64+0x30/0x180 [mlx5_core]
Call trace:
mlx5e_fold_sw_stats64+0x30/0x180 [mlx5_core]
dev_get_stats+0x50/0xc0
ovs_vport_get_stats+0x38/0xac [openvswitch]
ovs_vport_cmd_fill_info+0x194/0x290 [openvswitch]
ovs_vport_cmd_get+0xbc/0x10c [openvswitch]
genl_family_rcv_msg_doit+0xd0/0x160
genl_rcv_msg+0xec/0x1f0
netlink_rcv_skb+0x64/0x130
genl_rcv+0x40/0x60
netlink_unicast+0x2fc/0x370
netlink_sendmsg+0x1dc/0x454
...
__arm64_sys_sendmsg+0x2c/0x40
Add mlx5e_stats_nch_write() and mlx5e_stats_nch_read() helpers in en.h
that wrap the smp_store_release()/smp_load_acquire() pair on stats_nch.
The release/acquire pair establishes the contract:
stats_nch == N => channel_stats[0..N-1] are visible and non-NULL.
Publish the stats_nch increment via mlx5e_stats_nch_write() in the
writer (mlx5e_channel_stats_alloc()), and read stats_nch via
mlx5e_stats_nch_read() in all readers: mlx5e RX/TX queue stats,
mlx5e_get_base_stats(), ethtool channels stats, IPoIB stats, the
sw_stats fold and the HV VHCA stats agent.
CVE-2026-72072 is a use-after-free vulnerability in the Linux kernel's mlx5e macsec module. It occurs when an offloaded MACsec RX SC is deleted, leading to improper freeing of metadata_dst and potential access to freed memory by concurrent readers. The flaw is fixed by correcting reference handling and ensuring proper initialization and publishing of data structures.
CVE-2026-72065 is a critical vulnerability in the Linux kernel's mana network driver where the packet length reported by the NIC in the RX Completion Queue Entry (CQE) was not properly validated before processing. This flaw could allow an attacker to exploit incorrect packet length information supplied by the NIC, potentially leading to severe impacts on confidentiality, integrity, and availability. The vulnerability affects Linux kernel version 5.13 and has been fixed in subsequent commits.