A vulnerability in the Linux kernel's Xilinx axienet network driver was resolved. The issue involved the improper freeing of DMA buffers on dmaengine stop, causing a memory leak of SKBs and DMA mappings during interface shutdown. This could exhaust limited IOMMU aperture resources. The fix ensures all DMA-mapped buffers are properly unmapped and freed on stop, and adds synchronization to prevent race conditions between buffer callbacks and driver stop operations.
A vulnerability in the Linux kernel's device mapper ioctl interface was resolved where a buffer over-read could occur due to incorrect calculation of a data pointer. This issue involves the struct dm_ioctl, which has trailing padding causing the data_start pointer to run past the allocated buffer size. Although this results in an out-of-bounds read, it can only be triggered by root privileges and is therefore not considered a security bug. The fix clamps the data_start pointer to the buffer size to prevent the over-read.
A race condition vulnerability in the Linux kernel's brcmfmac WiFi driver caused a kernel crash when the driver was removed while a user space process that created a P2P device was still exiting. This double removal of the P2P device interface leads to a use-after-free fault and kernel oops. The issue occurs due to concurrent removal paths attempting to unregister and free the same device interface.
A vulnerability in the Linux kernel's WireGuard implementation involving the Noise protocol handshake was resolved. The flaw allowed two threads to process the same response message concurrently, potentially causing a race condition where a handshake state could be incorrectly reused. Although the issue is considered nearly impossible to exploit in practice, a fix was implemented to ensure the ephemeral private key is compared to the latest handshake state to prevent this condition.
A vulnerability in the Linux kernel workqueue subsystem was resolved that could cause a NULL pointer dereference when checking chained work. The issue arises because current_wq_worker() indicates a kworker but does not guarantee it is executing a work item, leading to a potential fault when worker->current_pwq is NULL during certain queue states.
A vulnerability in the Linux kernel's xen/netfront component caused a memory leak when xennet_fill_frags() fails due to response chains having more slots than fit in the skb's fragments. The error path did not free the skb properly, leading to resource leakage. This issue has been resolved by ensuring the skb is put back on the temporary queue before error handling proceeds.
A race condition vulnerability in the Linux kernel's strparser component was resolved. The issue involved the __strp_recv function potentially running concurrently while the parser was being torn down, which could lead to use-after-free (UAF) conditions. The vulnerability affects only the espintcp user of strp_recv, and a patch was introduced to add locking mechanisms to prevent this race. The general mode of strp, which could also crash, is unused and slated for removal. A proof-of-concept exploit has been published, but no known exploits are currently in the wild.
A vulnerability in the Linux kernel's TPS6594 regulator driver was resolved involving an out-of-bounds array access due to an incorrect count of linear voltage ranges. The issue affects the TPS65224 BUCK2, BUCK3, and BUCK4 descriptors, as well as TPS652G1, where the code reads beyond the defined array when checking voltage selectors. This could cause improper handling of voltage constraints during regulator registration.
A vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem was resolved. The flaw involved improper teardown of topsrv workqueues before closing subscriber connections, leading to race conditions. These races could cause use-after-free errors, queueing work on destroyed workqueues, and RCU stalls during network exit. The fix changes the teardown order, adds a shutdown flag to refuse lookups during teardown, and ensures workqueues are destroyed before closing connections.
A use-after-free vulnerability in the Linux kernel's TIPC subsystem was resolved. The function tipc_node_find_by_name() returned a node pointer after dropping its RCU read lock without taking a reference, leading to a race condition where handlers could access a freed node. This could cause kernel memory corruption and instability. The issue was detected by KASAN and fixed by acquiring a reference to the node before leaving the RCU read lock and releasing it appropriately after use.
A vulnerability in the Linux kernel's RISC-V architecture under CONFIG_SHADOW_CALL_STACK allowed an unprivileged user to bypass kernel shadow call stack pointer reload checks by manipulating the user-writable tp register. This could lead to arbitrary kernel memory write and control-flow hijacking. The issue was fixed by changing the check to rely on the hardware sstatus.SPP bit, which cannot be forged by user mode, ensuring correct reload of the shadow call stack pointer on user traps.
A vulnerability in the Linux kernel's SELinux implementation related to NFSv4 filesystem mounts has been resolved. When an NFSv4 filesystem exported with security_label is mounted a second time, the superblock reuse logic failed to preserve the SECURITY_LSM_NATIVE_LABELS flag, causing per-file security labeling to be silently disabled for both mounts. This issue was fixed by ensuring the SECURITY_LSM_NATIVE_LABELS flag is set correctly on reused superblocks during mount option processing.
A vulnerability in the Linux kernel related to the RISCV architecture's ghostwrite errata has been resolved. The issue involved improper detection and mitigation of the ghostwrite vulnerability during early boot stages when certain kernel configuration options were set inconsistently. This could cause the system to incorrectly report that a vulnerable CPU was not affected and fail to apply the necessary mitigation. The fix ensures that the vulnerability is detected early and mitigated properly by selecting RISCV_ALTERNATIVE_EARLY in the kernel configuration.
A vulnerability in the Linux kernel's Xilinx GPIO driver caused a runtime PM (power management) leak on the request error path. The issue arises because pm_runtime_get_sync() increments the usage counter even on failure, and the error path does not properly decrement it, leading to a leaked reference. This prevents the controller from runtime-suspending and keeps its clock enabled unnecessarily. The fix involves switching to pm_runtime_resume_and_get(), which increments the usage counter only on success.
A vulnerability in the Linux kernel's RISC-V futex implementation allows an unprivileged process to perform atomic read-modify-write operations on arbitrary kernel addresses due to improper handling of tagged user pointers. The issue arises because the futex atomic operations use the raw tagged address without untagging it after access_ok() validation, enabling potential kernel memory manipulation. This vulnerability has been resolved by ensuring the pointer is untagged before the atomic operations.
A vulnerability in the Linux kernel's ibmveth driver was resolved, involving improper cleanup of the logical LAN resource on failure during the open operation. Specifically, if buffer pool allocation fails after the logical LAN is registered, the cleanup function h_free_logical_lan() was not called, leaving the buffer-list page owned by PHYP when unmapped. This could lead to resource mismanagement. The fix moves the cleanup call to a shared path ensuring deregistration before unmapping the buffer list.
A use-after-free vulnerability in the Linux kernel's ice driver was fixed by correcting metadata_dst reference count handling during representor teardown. The issue involved improper freeing of metadata_dst objects while references were still held, potentially leading to memory corruption.
A use-after-free vulnerability in the Linux kernel Bluetooth subsystem was resolved. The flaw involved improper handling of socket buffer (skb) lifetimes during passive scan setup, leading to potential use of freed memory. The issue was caused by lack of proper locking around command skb references, allowing concurrent workqueues to free and replace command data while still in use.
A use-after-free vulnerability in the Linux kernel Bluetooth ISO subsystem was resolved. The flaw occurs due to improper handling of concurrent BIS listener setups on the same broadcast socket, leading to a stale socket access and potential memory corruption. The issue was fixed by adding rechecks and rejecting competing setups to prevent connection reference leaks and stale accesses.
A vulnerability in the Linux kernel's ip6_gre module related to obsolete ERSPAN PMTU update handling has been resolved. The issue involved a null pointer dereference caused by the legacy Path MTU (PMTU) update code treating a metadata destination as a route without an output device, leading to a kernel panic. The obsolete code was removed to align ERSPAN with current IPv6 GRE PMTU handling, eliminating the null pointer dereference.