A vulnerability in the Linux kernel SMB client related to the handling of pagecache when extending a file via zero range has been resolved. The issue involved the pagecache not being fully discarded past the end of file (EOF) when extending a file, potentially exposing stale data from memory-mapped files as file content after extension.
A vulnerability in the Linux kernel SMB client was resolved that involved improper discarding of pagecache data when extending a file via clone range. Specifically, the pagecache for folios overlapping the destination region was discarded, but the folio straddling the old EOF was not, potentially exposing stale data beyond the original EOF as file content after extension.
A vulnerability in the Linux kernel SMB client affects the fallocate emulation for small interior ranges. The issue arises because the client queries allocated ranges without first flushing and committing data, leading to potential data corruption when interacting with Windows servers. This is due to FSCTL_QUERY_ALLOCATED_RANGES not guaranteeing coherence with recently written data unless the data is flushed. The flaw was confirmed against Windows Server 2022, where live data could be overwritten with zeroes. The fix involves flushing dirty pages, draining outstanding I/O, and issuing an SMB2 FLUSH before querying allocated ranges.
A vulnerability in the Linux kernel's SMB client implementation was fixed to ensure dirty data is flushed before zeroing a range. Previously, when zeroing an interior range that did not reach the end of file (EOF), dirty data overlapping the range could be written back after zeroing, causing stale data to be read instead of zeroed data. The fix enforces unconditional flushing of dirty data before invalidating the page cache and issuing the zeroing command to the server.
A vulnerability in the Linux kernel SMB client affects the server-side copy and clone operations. The flaw involves improper synchronization of the destination page cache during these operations, which can lead to asynchronous writeback completing after the server-side copy/clone, causing stale data to overwrite the updated region and corrupt the file. This issue has been fixed by ensuring proper locking and draining of in-flight I/O before the copy/clone ioctl is issued.
A race condition vulnerability in the Linux kernel's SMB client was fixed by splitting certain bitfields in the cifsFileInfo structure into separate boolean fields. This prevents concurrent updates from overwriting each other due to byte-level read-modify-write operations on shared bitfield bytes.
A memory leak and improper state handling vulnerability was identified and fixed in the Linux kernel driver for the Kionix KX022A accelerometer. The issue occurs when memory allocated during buffer enabling is not freed if a regmap operation fails, and hardware state flags and configurations are not properly reverted, potentially leaving interrupts and buffers enabled incorrectly.
A vulnerability in the Linux kernel's IIO core for the kxcjk-1013 accelerometer driver allows duplicate disable event requests to cause a runtime PM usage count underflow warning. This occurs because repeated disable requests improperly drop a runtime PM reference that was not acquired, potentially leading to incorrect power management state handling.
A vulnerability in the Linux kernel's AD4030 ADC driver was fixed by correcting invalid input validation of the oversampling_ratio parameter. The function ad4030_set_avg_frame_len() previously computed a logarithm on the input before validating it, which could lead to undefined behavior if zero or negative values were passed.
A use-after-free vulnerability was fixed in the Linux kernel's ad_sigma_delta ADC driver. The issue occurred because a buffer allocated at runtime was freed before the device unregistration disabled the data ready interrupt, allowing the interrupt handler to access freed memory. The fix involves preallocating the buffer earlier to ensure it is freed only after the interrupt handler is properly drained.
A NULL pointer dereference vulnerability was identified and fixed in the Linux kernel's ADE9000 ADC driver during clock output registration. The issue occurs because the driver passes a NULL register address when registering a divider clock, leading to a crash when probing an ADE9000 configured as a clock provider with an external input clock. The fix registers CLKOUT as a 1:1 fixed-factor clock, which does not require register access, preventing the NULL pointer dereference. This fix does not affect configurations using the internal clock.
A vulnerability in the Linux kernel's ADE9000 ADC driver caused Phase C dip events to be unreported due to an off-by-one error in scanning event bits. The issue was fixed by adjusting the scanning range to include the highest event bit, ensuring proper handling of Phase C dip events.
A vulnerability in the Linux kernel's iio adc adi-axi-adc driver was fixed by initializing a state mutex that was previously uninitialized. The issue involved the AXI ADC register access paths which serialize transactions using a mutex lock that was not initialized during probe, potentially leading to improper synchronization.
A vulnerability in the Linux kernel's iio adc pac1934 driver involves improper handling of ACPI label duplication. The issue occurs when a label duplication failure reaches the terminating-byte write, potentially causing improper access to missing labels. The flaw was detected by static analysis and reviewed with AI-assisted source auditing. The vulnerability affects specific Linux kernel versions and has been assigned a low severity rating.
A vulnerability in the Linux kernel's stm32-adc driver could cause a division by zero error when processing ADC channel data if the conversion fails or returns zero. This issue arises because the driver does not properly check for error conditions or zero values before processing the data, which can lead to invalid operations. The flaw has been fixed by adding checks to handle these cases appropriately.
A vulnerability in the Linux kernel's sun4i-gpadc-iio driver causes improper cleanup when thermal zone registration fails. Specifically, if devm_thermal_of_zone_register() fails, the probe function returns without unregistering the IIO map array or disabling runtime power management, potentially leading to resource leaks.
A vulnerability in the Linux kernel's xilinx-xadc driver involves freeing an IRQ before cancelling a delayed workqueue on device unbind. This can lead to a race condition where the IRQ handler queues work after the associated data structure has been freed. The issue was identified through static analysis and affects specific Linux kernel versions.
A vulnerability in the Linux kernel's Industrial I/O (iio) subsystem involves improper synchronization during buffer teardown. The flaw occurs because iio_device_unregister() disables and deactivates buffers without acquiring the necessary mlock, potentially invalidating buffer state while a buffer-mode claim is held. This issue has been resolved by ensuring proper locking order to maintain buffer-mode claim guarantees.
A vulnerability in the Linux kernel's Industrial I/O (iio) buffer handling allows uninitialized heap memory to be leaked to userspace when data passed is not aligned to 8 bytes and timestamping is enabled. This occurs because the bounce buffer used in the unaligned case is not zeroed properly. The issue has been fixed by ensuring the buffer is zeroed during allocation.
A vulnerability in the Linux kernel's iio frequency driver for adf4377 involves incomplete initialization of clk_init_data and clk_parent_data structures. This can cause crashes when certain kernel stack initialization configurations are enabled. The issue arises because some members of these structures remain uninitialized, leading to potential instability.