A race condition in the Linux kernel's cpuset subsystem related to CPU hotplug operations could lead to a NULL pointer dereference. This occurs because the update order of cpu_active_mask and cpu_online_mask allows a race window where the top cpuset may have no active CPU. The issue was fixed by reintroducing a NULL check in guarantee_active_cpus() to prevent dereferencing a NULL pointer.
A vulnerability in the Linux kernel's CIPSO option handling was resolved. The cipso_v4_skbuff_delattr() function removed CIPSO bytes but failed to adjust cached offsets for subsequent options, causing consumers to access incorrect bytes. This could lead to improper interpretation of packet data and potential memory corruption when copying option data into fixed-size storage.
A vulnerability in the Linux kernel's vsock/virtio subsystem related to incorrect accounting of unread bytes in the read_skb() function has been resolved. The flaw caused the rx_bytes counter to underflow after partial stream receives, leading to incorrect socket status reporting and potentially hiding queued data until additional bytes arrived. This issue was identified during a manual source audit following a previous related vulnerability (CVE-2024-50169).
A vulnerability in the Linux kernel's mt7603 WiFi driver involved the use of an uninitialized global station WCID for frames without a station or vif, including those injected via a monitor interface. This led to a NULL pointer dereference causing kernel crashes. The issue was fixed by initializing the WCID before publishing it, preventing crashes during frame transmission.
A vulnerability in the Linux kernel's TCP zerocopy receive mapping was resolved. The issue involved dereferencing a NULL pointer when handling net_iov fragments in zerocopy receive mapping hints, leading to a kernel panic under certain conditions. The fix rejects all net_iov fragments before accessing page mappings, preventing the NULL pointer dereference and associated crash.
A deadlock vulnerability in the Linux kernel's GVE driver was resolved. The issue occurs when disabling XSK pools, where unlocked versions of napi_disable and napi_enable are called while the netdev lock is already held, causing a deadlock. The fix updates these calls to use the locked versions to prevent the deadlock.
A vulnerability in the Linux kernel's gve driver caused XSK buffers to leak when rings were stopped. Specifically, the driver did not free XSK buffers when resetting ring state during queue stoppage, leading to resource leakage. This issue was observed in production environments and has been resolved by ensuring XSK buffers attached to allocated buf_state are freed when stopping rings.
A vulnerability in the Linux kernel's gve driver related to AF_XDP zero-copy (ZC) mode caused a buffer leak when the error bit was set in the RX completion descriptor. The issue was that the XSK buffer was not freed properly on error, leading to resource leakage. This vulnerability has been resolved in the Linux kernel.
A vulnerability in the Linux kernel's dm-integrity device was resolved that caused a NULL pointer dereference crash when the device was activated with the 'R' flag and the SB_FLAG_DIRTY_BITMAP flag was set. The issue occurred in the dm_integrity_resume function when it attempted to read the journal containing the bitmap. The fix prevents writes during resume if the device is activated in 'R' mode.
A use-after-free vulnerability in the Linux kernel's ice driver was fixed. The flaw occurs in the dynamic port cleanup function ice_dealloc_dynamic_port(), where the code frees a VSI object before using its index to erase a dynamic port entry, leading to use-after-free. The fix involves erasing the xarray entry before freeing the VSI, following the reverse order of allocation.
A heap out-of-bounds write vulnerability in the Linux kernel's ksmbd component was fixed in the krb5_authenticate() function. The flaw occurs because the calculation of available buffer space (out_len) for the Kerberos AP-REP token does not account for prior responses in a compounded SMB2 request, leading to an overestimation of buffer headroom. This causes a length check to erroneously pass, allowing memcpy() to write beyond the allocated buffer into adjacent kernel heap memory. The issue is resolved by correctly subtracting the offset of prior responses when computing the available buffer space.
A vulnerability in the Linux kernel's KVM x86 implementation related to the per-vCPU MMIO cache has been resolved. The issue involved improper use of memslots in System Management Mode (SMM) address space, which could cause stale cache entries to remain valid after switching address spaces. This could lead to incorrect MMIO exits and bypass of KVM's write-tracking, potentially causing inconsistent nested EPT table states. The fix ensures the use of active memslots for caching and validation, preventing stale entries across address spaces.
A vulnerability in the Linux kernel's bnxt_en driver caused incorrect DMA mapping length for padded small packets, leading to potential DMA read overruns and Intel IOMMU faults. The issue arises when packets smaller than 52 bytes are padded but the DMA mapping length is not updated accordingly, causing the NIC to read beyond the mapped buffer. This was fixed by adjusting the padding method to ensure the DMA mapping length matches the padded packet size.
A long-standing memory leak issue involving xarray nodes in the Linux kernel's clear_inode() function has been resolved. The leak, difficult to trigger previously, has been made more accessible through recent techniques involving madvise. The fix involves calling xa_destroy() to free excess xarray nodes and cycle the i_pages lock, addressing the leak more comprehensively.
A vulnerability in the Linux kernel's mlx5e driver related to XDP redirect to AF_XDP sockets could cause stale buffer pointers to be freed twice, leading to double publication of UMEM frames. This occurs when the RX ring is full and a refill retry partially succeeds, leaving some WQEs with stale buffer pointers. The issue was detected with high packet rates and causes silent failures without kernel warnings. A fix has been implemented to mark WQEs as released immediately after freeing buffers, preventing double free and stale pointer use.
A vulnerability in the Linux kernel's mlx5e driver related to AF_XDP zero-copy buffer management has been resolved. The issue involved stale XSK buffer releases during MPWQE refill retries, which could cause double freeing of buffers through stale pointers. The fix ensures that buffer release retries become idempotent by properly managing the release bitmap in error paths. Extensive testing showed no invalid descriptors, WQE errors, or kernel warnings after the fix.
A vulnerability in the Linux kernel's IPv4 UDP handling allowed off-path attackers to perform a side-channel attack on the FIB nexthop exception (FNHE) cache to discover ephemeral UDP port numbers. The issue arises because FNHE entries were only created when a UDP packet matched an existing socket, enabling attackers to infer port information by observing cache behavior. Previous mitigations involving hash randomization were bypassable. The fix ensures FNHE entries are always created before socket matching, preventing attackers from distinguishing valid from invalid guesses based on cache state.
A vulnerability in the Linux kernel's IPv6 UDP exception cache handling allowed off-path attackers to conduct side-channel attacks to discover ephemeral UDP ports. The issue was due to exceptions being created only when a UDP packet matched an existing socket. The fix ensures exceptions are always created before socket matching, preventing this side-channel. This change may cause additional route lookups and exceptions but does not increase the ability of attackers to create exceptions beyond previous capabilities.
A vulnerability in the Linux kernel related to IPv4 route notification sizing has been resolved. The issue involves improper handling of nexthop groups when they shrink, leading to a potential null pointer dereference in fib_nexthop_nlmsg_size(). This occurs because the code does not stop sizing when an indexed path is absent after a nexthop group replacement with fewer paths. The fix prevents dereferencing a null pointer by stopping sizing in such cases.
A vulnerability in the Linux kernel related to IPv4 route notification size race conditions has been resolved. The issue involves asynchronous route notifications for hardware flag changes where concurrent modifications can cause legitimate size errors, leading to warnings that were not indicative of actual bugs. The fix removes these misleading warnings while maintaining proper error handling.