A use-after-free vulnerability in the Linux kernel's AMT relay component was resolved. The issue involved queuing a packet buffer (skb) referencing a tunnel that could be freed before the packet was processed, leading to a use-after-free in amt_dev_xmit(). The fix changes the relay's General Query sending method to avoid queuing and referencing freed tunnels, removing unsafe skb control block usage. This eliminates the use-after-free condition and related kernel warnings.
A vulnerability in the Linux kernel's cxgb4 driver related to ch_ktls handling has been resolved. The issue involves improper locking when erasing entries from a shared tid_list array, which can lead to a spinlock deadlock due to softirqs not being disabled during xa_erase operations. The fix involves using xa_erase_bh() to properly disable softirqs and prevent lock contention.
A vulnerability in the Linux kernel bonding driver related to XDP program replacement has been resolved. The issue involved a program leak when the XDP program was replaced or removed, due to failure to release the reference on the old BPF program. This was detected through AI-assisted testing and will be addressed with a selftest in future kernel releases.
A vulnerability in the Linux kernel's nvmet subsystem was resolved involving improper handling of local P2P device references during metadata allocation failure. Specifically, if data allocation succeeds but metadata allocation fails, a cleanup function uses an uninitialized device pointer, potentially causing improper resource handling.
A vulnerability in the Linux kernel's Btrfs filesystem was resolved involving the replacement of extended attributes (xattrs) when multiple xattrs are packed in the same directory item. The issue occurs when replacing an xattr value with a different size, leading to an uninitialized directory item and filesystem corruption detected during extent buffer writeback. This can cause transaction aborts and loss of xattr data.
A vulnerability in the Linux kernel's mt7915 WiFi driver was resolved by properly disabling the receive NAPI (New API) when removing the device. Previously, unloading the mt7915e module with a MT7916 chipset caused multiple warnings and system instability due to the driver not disabling NAPI before destruction. This issue affected module reloads required to change frequency parameters, leading to system instability.
A vulnerability in the Linux kernel's ASoC adau1372 driver has been resolved. The issue involved the use of gpiod_set_value() which emits a WARN when used with GPIO providers that can sleep, such as I2C controlled GPIO expanders. The driver incorrectly used a non-sleep variant for powerdown GPIOs, which are manipulated in process context. The fix involved switching to the _cansleep variant, allowing the use of sleepy GPIOs to power off the chip without warnings.
A vulnerability in the Linux kernel's flow_dissector component caused incorrect computation of the transport header offset (thoff) due to 16-bit truncation of skb->len. This could lead to the transport header pointer being set incorrectly inside the Ethernet header. The issue affects handling of large skbs (socket buffers) exceeding 64KB, which are common with certain network features like GSO and BIG TCP. The vulnerability has been resolved by changing the comparison to use 32-bit integers and capping the offset when it cannot fit in 16 bits, reporting dissection failure instead of returning incorrect offsets.
A vulnerability in the Linux kernel's network stack related to the handling of Generic Segmentation Offload (GSO) packets in the __virtio_net_hdr_to_skb() function has been resolved. The issue involved improper flow dissection of GSO packets when skb->network_header was zero, leading to potential out-of-bounds reads in TCP header processing. This could occur with malformed network headers or packets carrying IP options or IPv6 extension headers. The fix involves proper initialization of skb fields and ensuring all GSO packets are fully dissected and validated.
A vulnerability in the Linux kernel's riscv ptrace implementation was resolved by zero-initializing regset buffers before copying user data. The flaw involved uninitialized stack buffer data when a PTRACE_SETREGSET request provided a short iov_len, potentially causing garbage data to be copied into the target's vstate or shadow stack pointer.
A vulnerability in the Linux kernel's flow_dissector component was resolved to prevent u16 truncation of the hlen parameter in the bpf_flow_dissect() function. The issue caused offsets to be incorrectly clamped when hlen exceeded 65535, potentially forcing offset values to zero even if valid. This bug is similar to a previously fixed truncation issue but affected the BPF path specifically. The fix involves capping hlen to the maximum value of a 16-bit unsigned integer before clamping. The vulnerability was discovered during code review and has been addressed.
A resource leak vulnerability in the Linux kernel's mlxsw spectrum_flower component was fixed. The flaw involved port range registers acquired during flow template parsing that were not properly released, leading to a resource leak. The fix ensures that these registers are released correctly to prevent the leak.
A memory leak vulnerability in the Linux kernel's vsock component was fixed in the function vmci_transport_recv_dgram_cb(). The leak occurs during the closure of a datagram socket when packets are moved between the socket's backlog and receive queue improperly, leading to unreleased memory. The fix involves adding a receive queue cleanup in the socket destructor.
A vulnerability in the Linux kernel's drm/vc4 driver was resolved by disabling the V3D interrupt across runtime suspend transitions. The issue involved the interrupt handler potentially running after the power domain was off, causing spurious interrupts and unexpected behavior due to the ARMCTRL interrupt controller lacking an active state. This could lead to scheduling of overflow memory work after the interrupt was disabled.
A vulnerability in the Linux kernel's HID steam driver has been fixed by rearranging the teardown sequence. The issue involved a narrow timing window during cleanup where callbacks could be scheduled referencing a freed steam struct, leading to potential use-after-free conditions. The fix also ensures that work canceling for rumble and mode switch occurs properly during steam device unregistration.
A vulnerability in the Linux kernel related to the HID steam driver has been resolved. The issue involved improper handling of registration and unregistration flows, which could leave a lingering power_supply object after the steam object was torn down. The fix refactors the registration logic, removing assumptions about serial numbers and correcting the omission of unregistering the battery when registration steps fail.
A vulnerability in the Linux kernel related to the HID steam driver has been resolved. The issue involved improper locking behavior, specifically that RCU (Read-Copy-Update) accesses were not properly guarded behind locks. This fix cleans up several locking issues to improve kernel stability and security.
A vulnerability in the Linux kernel scheduler extension (sched_ext) was resolved by changing how cid tables are built and published. Previously, cid tables were visible while being modified, allowing race conditions that could expose uninitialized memory or torn updates to tracing or syscall programs. The fix involves building cid tables privately and publishing them only when fully constructed, ensuring readers always see consistent and valid data. Additionally, the fix includes proper synchronization and NULL checks to prevent stale or invalid reads.
A vulnerability in the Linux kernel's ASoC qcom lpass-cpu driver was resolved. The issue involved incorrect indexing of the DAI driver table when configuring certain hardware ports, leading to out-of-bounds memory access. This was due to using the hardware port ID as an index instead of the correct loop index. The fix uses the loop index to update playback channel constraints, preventing incorrect memory writes.
A vulnerability in the Linux kernel's perf subsystem allowed users with kernel profiling privileges to bypass intended permission checks when requesting kernel callchain data. The flaw was due to an incomplete permission check that did not enforce kernel profiling privilege for kernel callchain collection when kernel sampling was excluded. This issue has been resolved by updating the permission checks to properly gate kernel callchain requests, preventing unprivileged access.