A vulnerability in the Linux kernel's powerpc iommu component was fixed by correcting overflow validation in the iommu_tce_check_ioba function. The issue involved improper handling of the npages parameter, which could lead to an arithmetic overflow and potentially allow the requested range to exceed the table capacity. This flaw was addressed by properly checking npages and ensuring the entire range is within bounds.
A use-after-free vulnerability in the Linux kernel's KVM PPC Book3S HV component was fixed. The flaw involved improper reference counting in the function kvmhv_emulate_tlbie_all_lpid(), which could lead to accessing freed memory during nested guest IDR iteration. This issue affects specific Linux kernel versions and was resolved by adjusting reference counting to prevent dangling pointers.
A vulnerability in the Linux kernel's Bluetooth RFCOMM implementation could cause a socket lock inversion leading to a potential deadlock during listener cleanup. This issue arises from the order in which locks are acquired and released when closing unaccepted child sockets. The flaw has been resolved by changing the locking strategy to prevent deadlocks and rejecting new connections once cleanup starts.
A use-after-free vulnerability in the Linux kernel's virt_wifi module was resolved. The issue occurs because the operstate transfer happens before the virtual WiFi device is fully registered, leading to a potential use-after-free if registration fails. This was fixed by moving the operstate transfer to after the device linking step.
A vulnerability in the Linux kernel SMB client was resolved that involved improper validation of absolute native symlink targets before NT fixups. When symlinkroot is unset, absolute targets are copied without conversion to an NT drive path, leading to buffer overflows due to incorrect assumptions about NT prefix presence. A user with write access to a mounted share could trigger these overflows, potentially causing high impact on confidentiality, integrity, and availability.
A vulnerability in the Linux kernel's netfilter flowtable component was resolved. The issue involved premature release of connection tracking (ct) references, which could lead to referencing incorrect conntrack entries in the flowtable datapath. The fix ensures the ct reference is held until the flow is released after the RCU grace period, preventing use-after-free conditions.
A vulnerability in the Linux kernel's RDMA/siw component allows an out-of-bounds write due to improper handling of fragmented header copies in the siw_get_hdr() function. This occurs when an extended DDP/RDMAP header is received across multiple TCP callbacks, causing the destination buffer to be overwritten beyond the header's end. This can corrupt receive state and lead to an out-of-bounds write.
A vulnerability in the Linux kernel's dmaengine pxa driver caused double counting of hardware descriptors due to improper handling of the descriptor count variable nb_desc. This could lead to incorrect freeing of descriptors and potential memory corruption. The issue was fixed by explicitly setting nb_desc and removing an erroneous increment in the code.
A vulnerability in the Linux kernel's wifi cfg80211 subsystem related to handling wiphy objects during network namespace destruction has been resolved. The issue occurs when moving a wiphy out of a dying network namespace fails due to allocation errors, leaving a dangling pointer that can cause kernel faults. The fix ensures interfaces that cannot be moved are removed, preventing the wiphy from being left in an invalid state.
A vulnerability in the Linux kernel's mac80211 wireless subsystem can cause a kernel BUG due to improper handling of virtual interfaces (vifs) when their network device (netdev) is unregistered. This occurs if the netdev is unregistered without going through the usual interface removal process, potentially leading to a stale interface reference and a kernel crash.
A vulnerability in the Linux kernel's wifi cfg80211 component was resolved. The issue involved improper filtering by BSS type when removing stale entries, which could cause a warning and potential instability when a rogue AP or device changed the BSS type unexpectedly. This was fixed by removing the BSS type check during stale entry removal.
A use-after-free vulnerability in the Linux kernel's wifi cfg80211 subsystem was resolved. The issue occurs when a network interface goes down during an ongoing scan, causing asynchronous cancellation confusion that leads the driver to incorrectly believe it owns the scan request, resulting in a use-after-free condition. This vulnerability affects specific linux-aws kernel versions and has a CVSS score of 7.8.
A vulnerability in the Linux kernel's wifi libipw component allows malformed association responses that are too short to cause a buffer over-read. The libipw_handle_assoc_resp() function incorrectly calculates the length of information elements due to unsigned integer wraparound, leading to reading beyond the receive buffer. This issue affects specific Linux kernel versions and has been verified via testing under emulation.
A vulnerability in the Linux kernel's wifi libipw driver allows processing of too-short beacon and probe response frames. The libipw_process_probe_response() and libipw_network_init() functions assume a full 36-byte frame prefix, but some receive paths only verify a 24-byte header, causing length miscalculations that lead to out-of-bounds reads. This flaw was identified through AI-assisted code review and verified via testing under Generic KASAN on arm64 in QEMU.
A use-after-free vulnerability in the Linux kernel's IB/isert subsystem was resolved by ensuring deferred control PDU completions are fully processed before releasing connection resources. The flaw allowed queued work items to access freed memory due to improper synchronization between completion handling and connection teardown. This could lead to kernel memory corruption and system instability.
A vulnerability in the Linux kernel's RDMA core component related to unregistering network devices has been resolved. The issue involves the function ib_get_eth_speed using a net_device after it has started unregistering, potentially causing use of an unregistered device. The fix ensures that the device's registration state is checked under RTNL lock before use, preventing unsafe access during unregistering.
A use-after-free vulnerability in the Linux kernel's RDMA rxe driver was resolved by changing the timing of multicast group insertion into the mcg_tree. The flaw allowed a local userspace RDMA client to trigger a condition where a freed multicast group structure could be dereferenced, causing memory corruption. The fix ensures the multicast group is only published after successful programming of the backing Ethernet multicast address, preventing concurrent access to a group being torn down.
A vulnerability in the Linux kernel's RDMA/rxe component allowed unprivileged users to overwrite read-only page cache memory via On-Demand Paging (ODP) write operations. This occurred because a recent commit removed an access permission check, enabling RDMA traffic to modify pages mapped read-only, potentially affecting sensitive files like /etc/passwd or setuid binaries. The issue was resolved by restoring the HMM_PFN_WRITE check in the fault handling path to prevent unauthorized writes.
A use-after-free vulnerability in the Linux kernel's xfrm subsystem was resolved. The issue occurs because the code reads a network device pointer without holding a proper reference, leading to a potential use-after-free when the device is concurrently replaced. This can cause memory corruption and impact confidentiality, integrity, and availability. The vulnerability has a CVSS score of 7.8, indicating a high severity level. Multiple specific Linux kernel versions are affected. The fix involves changing how the device reference is accessed and held during bundle creation.
A vulnerability in the Linux kernel's RDMA rxe driver allowed an integer overflow in the mr_check_range() function, leading to out-of-bounds memory access. This flaw could be triggered by a remote unauthenticated peer crafting specific RDMA-Write/Read requests, causing a kernel crash (oops). The issue has been fixed by rewriting the range check to prevent integer overflow and out-of-bounds access.