A vulnerability in the Linux kernel's RDMA/erdma subsystem involving the use of non-IRQ-safe XArray helpers for QP and CQ tables has been resolved. The issue caused locked QP and CQ lookups from EQ interrupts to deadlock with create-path XArray updates due to improper locking. This could result in a lookup spinning indefinitely when an interrupt arrives while the create path holds the plain xa_lock. The fix involves using IRQ-safe XArray helpers for all QP and CQ create-path updates and initializing arrays with XA_FLAGS_LOCK_IRQ to preserve interrupt state during sleeping allocations.
A use-after-free vulnerability in the Linux kernel's drm/msm component was resolved by changing the freeing method of scheduler-containing objects to use kfree_rcu() instead of kfree(). This fixes an issue where a finished fence exported to userspace could reference freed memory, leading to a kernel slab-use-after-free read. The vulnerability affects specific Linux kernel versions used in various Ubuntu distributions.
A vulnerability in the Linux kernel's hwmon driver for w83791d devices was resolved. The issue involved the fan/pwm 4-5 sysfs group not being properly removed during driver unbind, leaving behind sysfs files that access freed driver data. This could lead to use-after-free conditions. The flaw was found by manual code inspection and affects specific Linux kernel versions.
A vulnerability in the Linux kernel's IB/hfi1 driver related to incorrect handling of the PIO_CRED credit-return mmap in hfi1_file_mmap() has been resolved. The issue involves incorrect pointer arithmetic and improper use of the DMA API, causing user space to receive the wrong credit-return page. This leads to kernel crashes (Oops) and send PIO operations stalling indefinitely. The flaw affects specific Linux kernel versions and was tested on hardware using Intel IOMMU and Omni-Path 100. The vulnerability has a CVSS score of 7.1, indicating medium severity.
A vulnerability in the Linux kernel affects MIPS I6500 CPU cores due to improper ordering guarantees in load-linked/store-conditional (lld/scd) instructions. This can cause kernel paging faults and system crashes when the CPU reorders these instructions, violating assumptions about atomic operations. The issue has been resolved by injecting synchronization instructions around the lld/scd loops using existing infrastructure. The vulnerability impacts specific Linux kernel versions used in various Ubuntu LTS releases.
A use-after-free vulnerability in the Linux kernel's xfrm_input() function was resolved. The issue occurs because the function stores the current xfrm_state in the skb secpath but some input paths reset the secpath before xfrm_input() finishes dereferencing the state, leading to potential dereferencing of freed memory. This affects certain receive callback users such as VTI and XFRM interfaces. The fix involves saving the state protocol on the stack while the state is still valid to avoid post-reset dereferences.
A use-after-free vulnerability in the Linux kernel's xfrm subsystem was resolved by changing the deletion method for state_cache and state_cache_input lists to prevent double deletion and memory corruption. This fix prevents write and read use-after-free conditions caused by improper list handling.
A use-after-free vulnerability in the Linux kernel's lan743x network driver was fixed. The flaw occurs in lan743x_rx_process_buffer() when handling multi-buffer receive packets, leading to a write after free of skb fragment metadata. This can happen after a live MTU increase when old buffer sizes persist. The issue was confirmed by a KUnit test and resolved by setting ip_summed on the surviving head skb instead of the freed fragment. The fix was applied to specific linux-hwe-edge kernel versions.
A vulnerability in the Linux kernel's IPv6 XFRM code mishandles socket references in local error paths, leading to potential out-of-bounds reads. This occurs because the code incorrectly assumes skb->sk always points to a full IPv6 socket, which is not guaranteed. The flaw affects specific Linux kernel versions and has a CVSS score of 7.8, indicating a medium severity.
A vulnerability in the Linux kernel's openvswitch component was resolved that involved unsafe reallocation of confirmed conntrack labels. The issue occurred because confirmed conntrack entries could be read locklessly, and adding a labels extension could cause reallocation and freeing of memory while another CPU was accessing it. The fix ensures that extensions are only added for unconfirmed conntracks, preventing unsafe memory operations.
A refcount bug in the Linux kernel's RDMA core component (iwpm_get_nlmsg_request function) was fixed. The vulnerability involved initializing the reference count after adding the object to a global list, allowing concurrent CPUs to incorrectly increment a zero refcount, causing a refcount 'addition on 0' bug. The fix initializes the refcount before adding to the list and ensures all fields are initialized beforehand. This affects specific linux-aws kernel versions.
A vulnerability in the Linux kernel's RDMA/ucma subsystem related to multicast join and leave operations has been resolved. The issue involves improper serialization of join and leave calls on copy_to_user failure, which could lead to use-after-free conditions. This occurs when two concurrent join multicast calls with the same address cause a race condition, potentially allowing an older worker to dereference freed memory. The fix ensures the mutex is held properly during these operations to prevent this race.
A vulnerability in the Linux kernel's swiotlb component caused incorrect handling of high memory page lookups during DMA operations, leading to data being copied to or from incorrect memory pages. This flaw affects certain Linux kernel versions and has been resolved.
In the Linux kernel, the following vulnerability has been resolved: signal: Prevent exec() race Hyunwoo debugged the following KASAN UAF splat: BUG: KASAN: slab-use-after-free in __send_signal_locked+0xb27/0xba0 Write of size 8 at addr ffff888007ed80c8 by task poc/79 ... Call Trace: __send_signal_locked+0xb27/0xba0 do_send_sig_info+0xa7/0x160 do_send_specific+0x76/0xa0 __x64_sys_tgkill+0x193/0x270 ... Allocated by task 80: do_timer_create+0x1a4/0x1030 __x64_sys_timer_create+0x145/0x190 ... Freed by task 12: kmem_cache_free_bulk+0x1f8/0x4a0 kvfree_rcu_bulk+0x14f/0x1c0 kfree_rcu_work+0x128/0x1a0 ... Last potentially related work creation: kvfree_call_rcu+0x39/0x390 __flush_itimer_signals+0x211/0x320 flush_itimer_signals+0x47/0x90 begin_new_exec+0xa6b/0x28c0 It turned out that this happens with a non-leader exec() as Hyunwoo explained: de_thread() calls exchange_tids() before release_task(leader), so the struct pid held by a SIGEV_THREAD_ID timer created against the leader's tid now points to the thread which called execve(). pid_task() returns that thread and lock_task_sighand() on it succeeds. If the timer signal is blocked, its sigqueue stays queued on the leader's task::pending. The next expiry of that timer can then run while release_task() flushes the queue. posixtimer_send_sigqueue() checks whether the sigqueue is already queued with a plain list_empty(), which only reads list_head::next. list_del_init() is not atomic and INIT_LIST_HEAD() stores list_head::next before list_head::prev, so the check can pass in between. list_add_tail() queues the entry on the task::pending of the live thread, and the list_head::prev store from the flush then overwrites the list_head::prev link that list_add_tail() has just set. __flush_itimer_signals() does not undo that either. With list_head::prev pointing at the entry itself, its list_del_init() only stores the same values again, so the entry is not removed from the list. It is still there after the last reference is dropped and the timer is freed by RCU, and the list_add_tail() of a later tgkill() follows that list_head::prev into the freed timer. This problem surfaced with the recent commit which moved the sigqueue flush out of the sighand lock held region. Hyonwoo proposed to fix this by using list_del_init_careful(), but that just papers over the problem. After some disucssions and various attempts to solve it, Eric pointed out that there is no reason to flush task::pending late in release_task() and it should be done in exit_signals() already. As nothing can collect and deliver signals which are queued in a dying task's pending queue, there is no reason to delay it further. But it has to be ensured that no signals can be queued into it after that point. exit_signals() sets PF_EXITING in task::flags, which can be used as an indicator for this. Cure it by: - Preventing signal queueing for task private signals (PIDTYPE_PID) when the task has PF_EXITING set in __send_signal_locked() and in posixtimer_send_sigqueue(). - Protecting the unlocked setting of PF_EXITING in exit_signals() for the task group empty and the group exit case with sighand lock - Flushing task::pending signals right there. Optimize that by moving the whole pending list to an on-stack list head under sighand lock and free the signals without the lock held. There has been quite some discussion about the lockless flush and the non-leader exec case on weakly ordered systems. The problem is that a third party which tries to send a posix timer signal relies on the PID lookup to find the target task and that lookup might result in the new leader when the signal was originaly directed to the old leader. In case that the signal was queued on the old leader then the lockless flush raised a concern over the following situation: old_leader new_leader third party A: flush_list() // list_del_in ---truncated---
A vulnerability in the Linux kernel's RDS over InfiniBand (rds: ib) protocol handling was resolved. The issue occurs when a peer negotiates a protocol version older than the supported compatibility version, causing a deadlock in connection shutdown due to improper lock handling. This leads to stalled RDS connection workqueues and denial of service. The vulnerability affects specific Linux kernel versions and has a CVSS score of 7.5, indicating a medium severity impact primarily causing availability disruption.
A use-after-free vulnerability in the Linux kernel's POSIX CPU timer code was resolved. The issue arises from a race condition involving the timer's firing state and expiry list management, potentially leading to use-after-free when a timer is freed while still queued. This flaw affects specific Linux kernel versions used in various Ubuntu HWE edge releases.
In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after de_thread() A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that thread's posix_cputimers. The task is looked up by that PID. When a non-leader thread exec()s, de_thread() changes which task owns that PID. pid_task(timer->it.cpu.pid, PIDTYPE_PID) then returns NULL, but the node is still queued on tsk, which is alive. timer_lock_sighand() takes a failed lookup to mean that the node is already dequeued, so it has nothing to undo. begin_new_exec() calls posix_cpu_timers_exit(me) right after exec_task_namespaces() and that removes the leftover node, so the state normally stays invisible. But bprm->point_of_no_return is set before de_thread(), so if unshare_files(), set_mm_exe_file(), exec_mmap() or exec_task_namespaces() fails, the task dies before it gets there. exit_itimers() then frees the k_itimer while its node is still queued, and reaping tsk later erases that freed node from the rbtree. In short: the non-leader thread B the parent timer_create(CLOCK_THREAD_CPUTIME_ID) timer_settime() arm_timer() // the node is queued on B execve() de_thread(B) exchange_tids(B, leader) // B's PID now belongs to the leader release_task(leader) __exit_signal(leader) posix_cpu_timers_exit(leader) // cleans leader's queue, not B's __unhash_process(leader) // that PID has no task anymore exec_mmap() mmap_read_lock_killable(old_mm) kill(B, SIGKILL) // -EINTR get_signal() do_exit() exit_itimers() posix_timer_delete() posix_cpu_timer_del() posix_timer_unhash_and_free() // freed while still queued wait4() release_task(B) posix_cpu_timers_exit(B) cleanup_timerqueue() timerqueue_del() // use-after-free Move the POSIX timer cleanup right after de_thread() before any of the later failure conditions brings the task into do_exit(). [ tglx: Move the cleanup right after de_thread() ]
A use-after-free vulnerability in the Linux kernel's CIFS implementation was fixed. The flaw occurred in the cifs_chan_skip_or_disable() function when handling secondary channels no longer supported by the server. The function dropped the channel reference before safely signaling the server, potentially leading to use of freed memory. This could cause system crashes or allow an attacker to execute arbitrary code with kernel privileges.
A vulnerability in the Linux kernel's network subsystem involves improper locking of socket flags in the sock_gettstamp() function. This flaw allows a race condition where sk_flags can be modified without holding the socket lock, leading to a use-after-free scenario on UDP sockets. The issue was reported by Jungwoo Lee and Wongi Lee and results from concurrent ioctl and bind() operations racing on socket flags. This can cause premature socket freeing while references still exist, potentially leading to kernel memory corruption.
A vulnerability in the Linux kernel futex subsystem related to the handling of private hash allocation on vfork() has been resolved. The issue involves the potential to access the memory management (mm) through vfork(), which requires allocating a private hash for vfork() and other CLONE_VM users to prevent having private futex waiters before the private hash allocation. This vulnerability affects specific versions of the linux-hwe-edge kernel and has a CVSS score of 7.8, indicating a high impact on confidentiality, integrity, and availability.