New Spectre-v2 attack classes have been discovered within CPU architectures that enable self-training exploitation of speculative execution within the same privilege domain. These novel techniques bypass existing hardware and software mitigations, including IBPB, eIBRS, and BHI_NO, by leveraging in-kernel gadgets (potentially accessible via SECCOMP/cBPF), Branch Target Buffer (BTB) aliasing, and direct-to-indirect branch predictor training. While the root cause lies in CPU architectural behavior, the vulnerability manifests through kernel-level speculation paths, allowing attackers to potentially leak sensitive memory.

A flaw was found in AMD processors. This transient execution vulnerability may allow an unprivileged local attacker to cause information disclosure of privileged data. By exploiting how the processor speculatively processes instructions ahead of time, an attacker can infer sensitive data from previous memory store operations that should remain protected.

A flaw was found in AMD processors. An authenticated local attacker can exploit this transient execution vulnerability to cause information disclosure across privilege boundaries. By observing microarchitectural side-channel behavior, an attacker can infer sensitive data residing in the Level 1 Data (L1D) cache.

A flaw was found in the Linux kernel's Intel Xe graphics driver. A use-after-free vulnerability can occur when dereferencing memory during buffer object movement trace logging events. A local privileged user could exploit this flaw on systems with active kernel tracing to cause a Denial of Service (DoS) through a system crash or potentially disclose sensitive kernel memory.

A flaw was found in the Intel Gigabit Ethernet (igb) network driver within the Linux kernel. When driver registration fails during initialization, the driver fails to properly unregister its Direct Cache Access (DCA) notification handler. A local attacker could exploit this condition upon driver initialization failure, leading to an invalid memory access and causing a system crash that results in a Denial of Service (DoS).

A flaw was found in the Linux kernel's exFAT file system implementation. When reading a corrupted or maliciously crafted exFAT volume with invalid directory cluster pointers, the driver fails to properly validate cluster boundaries, resulting in an out-of-bounds memory access. A local user capable of mounting or accessing such a file system could trigger this issue, leading to further file system corruption or a system crash that causes a Denial of Service (DoS).

A flaw was found in the Linux kernel's Network File System daemon (nfsd). A local user can trigger a use-after-free condition when export cache entries are prematurely released during read operations. This issue may lead to memory corruption, potentially causing a system crash and resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel's zram driver. This vulnerability can lead to a Denial of Service (DoS) by causing a system crash. During device initialization, a timing window allows a local user to access the device attributes through the sysfs interface before compression algorithms are properly initialized, triggering a NULL pointer dereference.

A flaw was found in Xen hypercall page handling within virtualized guest environments. The Xen hypercall page contains code generated by the hypervisor that lacks awareness of guest operating system CPU speculation mitigations, such as return instruction transforms, and Control-flow Integrity (CFI) protections. A local user or guest-level attacker can exploit this lack of hardening to bypass speculative execution defenses, potentially leading to information disclosure through side-channel attacks.

A flaw was found in the Linux kernel's Network File System (NFS) client subsystem. A local authenticated user with privileges to configure Remote Procedure Call (RPC) clients or initiate NFS mounts could trigger a Denial of Service (DoS) or memory corruption. This issue arises because the sysfs interface copies RPC program names into a fixed-size buffer without bounds checking. An attacker supplying an oversized name could cause a buffer overflow, resulting in a system crash.

A flaw was found in the Linux kernel's ACPI (Advanced Configuration and Power Interface) NFIT driver. A local user with administrative privileges can trigger an out-of-bounds memory read by providing an undersized buffer to the control interface. This issue primarily results in a system crash and Denial of Service (DoS), and may potentially expose sensitive kernel memory.

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. A local attacker with permission to attach BPF programs can trigger a use-after-free vulnerability due to mismatched Read-Copy-Update (RCU) synchronization grace periods when detaching non-sleepable programs from user space probes. This flaw can lead to privilege escalation or a system crash resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel's parallel cryptography (pcrypt) subsystem. When processor cores are brought online or taken offline while cryptographic operations are active, an unexpected error condition is returned. On systems configured to halt on kernel warnings, this unexpected return code triggers a system crash. A local user can exploit this vulnerability to cause a Denial of Service (DoS).

A flaw was found in the Linux kernel's packet socket implementation. A local user with permissions to create raw packet sockets can cause a Denial of Service (DoS) by triggering a system crash. When an application inspects network datagrams using the MSG_PEEK flag, the kernel improperly modifies shared socket buffers during protocol extraction. This unexpected state results in a kernel panic, rendering the system unavailable.

A flaw was found in the Linux kernel's packet socket implementation. A local user with permissions to create packet sockets, such as within an unprivileged user namespace, can trigger a kernel panic by receiving Virtual Local Area Network (VLAN) tagged network traffic using the MSG_PEEK flag. This flaw leads to a system crash, resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel's netfs (network filesystem) subsystem. When file caching is temporarily disabled, write requests on certain network filesystems are discarded without being properly canceled or cleaned up. A local user could exploit this flaw by performing specific file operations, leaving operations incomplete and causing the system to hang, resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel's network filesystem (netfs) subsystem. A local user with write permissions to a Ceph file system configured with local caching can trigger a kernel hang, resulting in a denial of service (DoS). This issue occurs because memory tracking entries are cleared prematurely during write operations, preventing the caching mechanism from locating the required data.

A flaw was found in the Linux kernel's memory control group (cgroup) subsystem. This vulnerability can lead to a Denial of Service (DoS) when handling out-of-memory (OOM) conditions. When a memory cgroup contains an unusually large number of processes and runs out of memory, the kernel scans through every task without yielding CPU execution time. A local attacker can exploit this flaw by spawning thousands of tasks within a single cgroup and forcing an out-of-memory event, triggering a CPU soft lockup that halts system execution.

A flaw was found in the Linux kernel's USB eXtensible Host Controller Interface (xHCI) driver. This vulnerability allows an attacker to cause a denial of service (DoS) by triggering a system crash. By connecting a specially crafted or malfunctioning USB peripheral that aborts commands under specific ring buffer conditions, the driver attempts to access a non-existent command structure, resulting in a NULL pointer dereference and a kernel panic.

A flaw was found in the Linux kernel. This vulnerability allows a local user to cause a Denial of Service (DoS) via a system crash. A race condition between table resizing and state lookup operations in the IPsec packet transformation (xfrm) subsystem can cause the kernel to perform an out-of-bounds memory read during concurrent state lookups.

A flaw was found in the Linux kernel's Synopsys DesignWare I3C master driver. A race condition during driver cleanup allows background tasks to access memory structures after they have already been released. A local attacker could exploit this use-after-free flaw to potentially escalate privileges or cause a Denial of Service (DoS) by crashing the system.

A flaw was found in the Linux kernel's Human Interface Device (HID) subsystem. This vulnerability allows a local attacker with physical access or the ability to attach a virtual device to cause a Denial of Service (DoS). By providing a specially crafted HID report descriptor that lacks expected logical collection structures, descriptor processing triggers an invalid assumption and causes a kernel crash.

A NULL pointer access may result in compromised availability.

A flaw was found in the Linux kernel's Broadcom Bluetooth driver. When retrieving a board name, the driver fails to check whether memory allocation succeeded before referencing the pointer. A local attacker could exploit this condition during memory allocation failures to trigger a kernel crash, resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel's MediaTek MT7925 wireless network driver. Under low-memory conditions, the driver fails to verify whether a memory allocation succeeds when changing virtual interface links. A local user with administrative privileges could trigger this flaw, leading to a null pointer dereference and a kernel crash that results in a Denial of Service (DoS).

A flaw was found in the Linux kernel's ath12k wireless driver. When reconfiguring a wireless network interface across different radios, an internal interface pointer is freed and subsequently read before being reassigned. A local user with administrative privileges could exploit this use-after-free condition to cause a system crash resulting in a Denial of Service (DoS) or potential kernel memory corruption.

A flaw was found in the Linux kernel's Intel IPU6 driver. A local user could trigger this vulnerability to cause a Denial of Service (DoS) through a system crash. The issue occurs because the driver fails to remove CPU latency Quality of Service (QoS) requests during error handling before releasing associated memory, resulting in linked list corruption within the kernel power management subsystem.

A flaw was found in the Linux kernel's TPM (Trusted Platform Module) driver. A local user with administrative access or compromised platform firmware can supply an oversized ACPI (Advanced Configuration and Power Interface) event log buffer during system boot. This condition causes a contiguous memory allocation failure, triggering a kernel warning and preventing the TPM event log from loading, which leads to a localized denial of service.

A flaw was found in the Linux kernel's Peripheral Component Interconnect Express (PCIe) DesignWare endpoint driver. When dynamically reconfiguring a Base Address Register (BAR), the driver fails to verify that the new BAR size and flags match the existing configuration. If a smaller size is configured, memory read requests from the connected host device can bypass address translation, allowing the host to read unauthorized system memory.

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params Each cpu DAI should associate with a widget. However, the topology might not create the right number of DAI widgets for aggregated amps. And it will cause NULL pointer deference. Check that the DAI widget associated with the CPU DAI is valid to prevent NULL pointer deference due to missing DAI widgets in topologies with aggregated amps.

A flaw was found in the Linux kernel's Bluetooth subsystem. A use-after-free flaw exists when processing Bluetooth advertisement monitor removal requests while the device is being powered off. A local user with access to Bluetooth management sockets could exploit this flaw by issuing specific management commands, causing a system crash and Denial of Service (DoS), or potentially disclosing sensitive kernel memory.

A flaw was found in the Linux kernel's brcmsmac wireless driver. A missing gain range check during calibration routines can lead to an out-of-bounds memory read when handling gain parameters. A local attacker on a system with affected wireless hardware could exploit this flaw to cause a system crash, resulting in a Denial of Service (DoS), or potentially access sensitive kernel memory.

A flaw was found in the Linux kernel's ath12k wireless driver. When formatting driver debug statistics, an incorrect array length calculation leads to an out-of-bounds memory read. A local user with administrative privileges could exploit this flaw to cause a Denial of Service (DoS) via a system crash or disclose sensitive kernel memory.

A flaw was found in the Linux kernel's Human Interface Device (HID) multitouch driver. This flaw allows a local user to cause a denial of service (DoS) by triggering a kernel crash. When a multitouch device is connected or emulated under low-memory conditions, the driver fails to verify that memory allocation succeeded during input configuration, leading to a null pointer dereference.

A flaw was found in the Linux kernel's Intel Infrastructure Data Path Function (IDPF) network driver. This flaw allows a local attacker to cause a Denial of Service (DoS) and potential system crash by heavily consuming processor resources on a targeted CPU core. Because the driver's background tasks were bound to specific processor cores rather than distributed across available processors, heavy CPU contention can starve critical driver worker threads, leading to operational timeouts and system failure.

A flaw was found in the Linux kernel's mac80211 wireless subsystem. A local user with access to write to the debugfs interface can deactivate all wireless links on a network interface. This invalid state triggers an internal kernel assertion, potentially leading to system instability and a Denial of Service (DoS).

A flaw was found in the Linux kernel's PCF85063 real-time clock (RTC) driver. When reading from the non-volatile memory (NVMEM) interface with a buffer smaller than four bytes, the driver writes data past the boundary of the allocated buffer. A local user with access to the device could exploit this issue to trigger kernel memory corruption, leading to a system crash, denial of service (DoS), or potential privilege escalation.

A flaw was found in the rtlwifi driver within the Linux kernel. During device initialization, if a probe operation fails, the driver does not remove internal data structures from a global list. A privileged local user can exploit this behavior by initiating a subsequent device probe, leading to access of previously freed memory. This flaw can result in a system crash, leading to a Denial of Service (DoS), or potentially allow arbitrary code execution.

A flaw was found in the Linux kernel's NVIDIA Tegra cryptographic driver. During system memory exhaustion, cryptographic initialization routines fail to properly handle errors and proceed to transfer requests. A local user could exploit this flaw to trigger a kernel crash, resulting in a Denial of Service (DoS).

In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback commit 1f5664351410 ("ASoC: lower "no backend DAIs enabled for ... Port" log severity") ignores -EINVAL error message on common soc_pcm_ret(). It is used from many functions, ignoring -EINVAL is over-kill. The reason why -EINVAL was ignored was it really should only be used upon invalid parameters coming from userspace and in that case we don't want to log an error since we do not want to give userspace a way to do a denial-of-service attack on the syslog / diskspace. So don't use soc_pcm_ret() on .prepare callback is better idea.

A flaw was found in the Linux kernel. This vulnerability allows a local user with administrative privileges to cause a Denial of Service (DoS) through a kernel deadlock. The issue occurs during the cleanup of Berkeley Packet Filter (BPF) control group (cgroup) storage when specific tracing programs are attached, creating competing lock acquisitions that freeze the system.

A flaw was found in the Linux kernel's io_uring subsystem. When error handling fails during the setup of a submission queue polling (SQPOLL) thread context, an internal task reference is not properly cleared. A local user could exploit this use-after-free vulnerability under error conditions to cause memory corruption, potentially leading to a system crash and a Denial of Service (DoS).

A flaw was found in the Linux kernel's CAKE (Common Applications Kept Enhanced) network queue scheduler. A missing bounds check allows an internal traffic counter to underflow when processing network flows. A local attacker can exploit this vulnerability by sending crafted network traffic on a system configured with the CAKE queuing discipline, triggering an out-of-bounds memory read. This failure can result in a Denial of Service (DoS) via a system crash or lead to unauthorized information disclosure.

A flaw was found in the Linux kernel's IPVLAN driver. A race condition during network interface removal can allow link status monitoring routines to access memory after the underlying device has already been freed. A local attacker with network administration privileges could exploit this flaw to crash the system, resulting in a denial of service (DoS), or potentially escalate privileges.

A flaw was found in the Linux kernel's io_uring subsystem. In certain race conditions during event notification handling, memory structures are released prematurely before other kernel tasks finish accessing them. A local attacker could exploit this flaw to corrupt kernel memory, potentially leading to a Denial of Service (DoS) or privilege escalation.

A flaw was found in the Linux kernel's zram driver. When initializing a compressed memory (zram) device encounters an early memory allocation failure, the driver frees the internal table without clearing its reference. A local user with administrative privileges could trigger a use-after-free condition by attempting to reset the failed and uninitialized device. This issue can lead to a system crash, resulting in a denial of service (DoS).

A flaw was found in the Linux kernel's packet generator (pktgen) module. An improper boundary check when parsing Internet Mix (IMIX) network traffic configuration entries allows a local user to trigger an out-of-bounds array access. This vulnerability primarily results in a Denial of Service (DoS) through a system crash, and may potentially lead to local privilege escalation.

A flaw was found in the Linux kernel. The cachestat() system call lacks proper permission checks for file ownership or write access when reporting memory cache statistics. An authenticated local attacker can exploit this flaw to determine whether specific file pages are held in system memory, leading to unauthorized information disclosure and enabling potential side-channel timing attacks.

A flaw was found in the Linux kernel's compressed swap cache (zswap) subsystem. During memory compression or decompression operations, a race condition can occur if a processor core is dynamically removed (hot-unplugged) while its per-CPU resources are still being accessed. A local attacker could exploit this use-after-free condition to cause a kernel crash resulting in a denial of service (DoS), or potentially execute arbitrary code.

A flaw was found in the Linux kernel. A local user can trigger a Denial of Service (DoS) by executing a specific sequence of memory remapping and protection operations on memory regions configured with userfaultfd write tracking (a mechanism allowing user-space applications to manage page faults). Due to an inconsistency in clearing write-protection flags during remapping, a subsequent protection change causes an internal kernel state check failure, leading to a system crash.

A flaw was found in the Linux kernel's network packet scheduling subsystem. A local attacker can exploit this vulnerability to achieve privilege escalation by configuring specific network queueing disciplines with a zero packet limit. When processing network packets under this condition, the scheduler fails to properly account for queue lengths between parent and child queues, resulting in an inconsistent internal kernel state.

A flaw was found in the Linux kernel's parallel execution mechanism (padata). A race condition between cryptographic request processing and algorithm removal can cause a use-after-free (accessing memory after it has been released) condition during work reordering. A local user could exploit this vulnerability to trigger a denial of service (DoS) through a system crash or potentially cause memory corruption.

A use-after-free vulnerability was found in the Linux kernel's padata subsystem, in the `padata_reorder()` function. Caused by improper synchronization controls, this vulnerability can occur when a reference-counted data structure (`pd`) is decremented in one thread, freeing it, while another thread still holds a pointer to it and attempts to access it via `padata_find_next()`. This vulnerability can lead to system instability, denial of service, and potential privilege escalation.

A flaw was found in the Linux kernel's mlx5 network driver. A race condition can occur when deregistering a memory region while concurrently invalidating memory under On-Demand Paging (ODP). A local user with access to Remote Direct Memory Access (RDMA) devices can trigger this flaw to place the driver queue into an error state, resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel's ATA storage subsystem. A local attacker with administrative privileges or direct device access can issue a crafted SCSI (Small Computer System Interface) pass-through command to an ATA device. This action causes the driver to write data outside the allocated buffer, leading to kernel memory corruption and a Denial of Service (DoS) via a system crash.

A flaw was found in the Linux kernel's Apple iPhone USB Ethernet (ipheth) driver. When processing network packets from a connected device, the driver fails to properly validate the number of header entries, leading to an out-of-bounds read. An attacker who attaches a malicious physical USB device, or emulates one in a virtualized guest environment, can supply malformed packet headers to cause a system crash resulting in a denial of service (DoS) or potentially disclose kernel memory.

A flaw was found in the Linux kernel's ipheth (Apple iPhone USB Ethernet) driver. An attacker with physical access or the ability to attach a malicious USB device can supply a malformed USB Request Block (URB) with header offsets that extend past the buffer boundary. This issue triggers an out-of-bounds read, which may result in a Denial of Service (DoS) through a system crash or the unauthorized disclosure of kernel memory.

A flaw was found in the Linux kernel's Apple iPhone USB Ethernet (ipheth) driver. An attacker with physical access to attach a malicious USB device, or administrative control over an emulated USB interface, can trigger an integer overflow during packet descriptor length validation. This failure can result in an out-of-bounds memory read, potentially causing a system crash and Denial of Service (DoS) or unauthorized information disclosure.

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Check the return value of of_property_read_string_index() Somewhen between 6.10 and 6.11 the driver started to crash on my MacBookPro14,3. The property doesn't exist and 'tmp' remains uninitialized, so we pass a random pointer to devm_kstrdup(). The crash I am getting looks like this: BUG: unable to handle page fault for address: 00007f033c669379 PF: supervisor read access in kernel mode PF: error_code(0x0001) - permissions violation PGD 8000000101341067 P4D 8000000101341067 PUD 101340067 PMD 1013bb067 PTE 800000010aee9025 Oops: Oops: 0001 [#1] SMP PTI CPU: 4 UID: 0 PID: 827 Comm: (udev-worker) Not tainted 6.11.8-gentoo #1 Hardware name: Apple Inc. MacBookPro14,3/Mac-551B86E5744E2388, BIOS 529.140.2.0.0 06/23/2024 RIP: 0010:strlen+0x4/0x30 Code: f7 75 ec 31 c0 c3 cc cc cc cc 48 89 f8 c3 cc cc cc cc 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <80> 3f 00 74 14 48 89 f8 48 83 c0 01 80 38 00 75 f7 48 29 f8 c3 cc RSP: 0018:ffffb4aac0683ad8 EFLAGS: 00010202 RAX: 00000000ffffffea RBX: 00007f033c669379 RCX: 0000000000000001 RDX: 0000000000000cc0 RSI: 00007f033c669379 RDI: 00007f033c669379 RBP: 00000000ffffffea R08: 0000000000000000 R09: 00000000c0ba916a R10: ffffffffffffffff R11: ffffffffb61ea260 R12: ffff91f7815b50c8 R13: 0000000000000cc0 R14: ffff91fafefffe30 R15: ffffb4aac0683b30 FS: 00007f033ccbe8c0(0000) GS:ffff91faeed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f033c669379 CR3: 0000000107b1e004 CR4: 00000000003706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __die+0x23/0x70 ? page_fault_oops+0x149/0x4c0 ? raw_spin_rq_lock_nested+0xe/0x20 ? sched_balance_newidle+0x22b/0x3c0 ? update_load_avg+0x78/0x770 ? exc_page_fault+0x6f/0x150 ? asm_exc_page_fault+0x26/0x30 ? __pfx_pci_conf1_write+0x10/0x10 ? strlen+0x4/0x30 devm_kstrdup+0x25/0x70 brcmf_of_probe+0x273/0x350 [brcmfmac]

A flaw was found in the Open vSwitch subsystem of the Linux kernel. Due to improper synchronization when retrieving virtual port information, the kernel may access memory after it has been released. A local user could exploit this use-after-free vulnerability to cause a Denial of Service (DoS) through a system crash or potentially achieve arbitrary code execution.

A flaw was found in the Linux kernel's IPv6 networking subsystem. A local attacker can trigger a race condition during network namespace deletion where internal network structures lack proper synchronization. This issue results in an invalid memory access, leading to a system crash and a Denial of Service (DoS).

A flaw was found in the Linux kernel's extensible scheduler (sched_ext) component. Due to improper tracking during process migration, the scheduler fails to correctly differentiate between moves across control groups (cgroups) and automatic process groups (autogroups). A local user with permissions to migrate tasks could trigger an invalid state, leading to kernel warnings and potential system instability or a denial of service (DoS).

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Validate the persistent meta data subbuf array The meta data for a mapped ring buffer contains an array of indexes of all the subbuffers. The first entry is the reader page, and the rest of the entries lay out the order of the subbuffers in how the ring buffer link list is to be created. The validator currently makes sure that all the entries are within the range of 0 and nr_subbufs. But it does not check if there are any duplicates. While working on the ring buffer, I corrupted this array, where I added duplicates. The validator did not catch it and created the ring buffer link list on top of it. Luckily, the corruption was only that the reader page was also in the writer path and only presented corrupted data but did not crash the kernel. But if there were duplicates in the writer side, then it could corrupt the ring buffer link list and cause a crash. Create a bitmask array with the size of the number of subbuffers. Then clear it. When walking through the subbuf array checking to see if the entries are within the range, test if its bit is already set in the subbuf_mask. If it is, then there is duplicates and fail the validation. If not, set the corresponding bit and continue.

A flaw was found in the Linux kernel. During processor cache detection on ARM64 systems featuring separate instruction and data caches, the kernel fails to properly account for cache entries against allocated array limits, resulting in an out-of-bounds memory write. A local attacker could leverage this vulnerability to cause memory corruption, potentially leading to system instability or a Denial of Service (DoS).

A vulnerability was found in the Linux kernel's work queue subsystem, which manages background task execution. The issue stems from improper handling of the "rescuer" thread during the cleanup of unbound work queues.

A flaw was found in the Linux kernel's Virtual Extensible LAN (VXLAN) driver. The initialization sequence fails to properly check the return value of an internal group setup routine, allowing an incomplete initialization state to persist. A local authenticated user with administrative network privileges could exploit this vulnerability during network device creation or teardown, triggering a null pointer dereference that results in a kernel crash and a system Denial of Service (DoS).

A use-after-free vulnerability was found in the Linux kernel. l3mdev_l3_out() can be called without RCU being held, causing damage to the availability of the system.

A flaw was found in the Linux kernel's Network File System daemon (NFSD). When an NFSv4 client enters an inactive courtesy state, the server continues attempting to send callback requests rather than skipping them. This issue causes server callback shutdown routines to stall, allowing a client to trigger a temporary Denial of Service (DoS) by delaying server callback operations until network timeouts expire.

A flaw was found in the Linux kernel's Network File System daemon (nfsd). This flaw can lead to a Denial of Service (DoS) when a client issues specific NFS requests that encounter errors during Access Control List (ACL) processing. Because the kernel fails to reset internal pointers after releasing memory, subsequent cleanup operations attempt to free already-released memory, causing a reference count underflow and a kernel crash.

A flaw was found in the Linux kernel's netfilter subsystem. In the nf_tables component, the total key length is not properly validated against concatenated field length descriptions when setting up packet filtering rules. A local attacker with network administration privileges or access to unprivileged user namespaces can exploit this vulnerability by submitting mismatched key sets, leading to kernel memory corruption and a Denial of Service (DoS) through a system crash.

A flaw was found in the Linux kernel's mac80211 wireless subsystem. In ad-hoc wireless network configurations, if station insertion fails after authorization, the system attempts to flush station data that was never registered with the device driver. A local user with privileges to manage wireless interfaces can exploit this flaw to cause a system crash, leading to a Denial of Service (DoS).

A flaw was found in the Linux kernel. A local user could exploit this flaw to cause data corruption by reusing a submission queue entry (SQE) before the corresponding command completes. This issue occurs because the io_uring command handler accesses data from the original entry after the preparation phase without maintaining a stable copy, resulting in the kernel reading stale data.

A flaw was found in the Linux kernel's SMB (Server Message Block) client subsystem. Under low-memory conditions while processing incoming encrypted traffic, the client fails to properly validate memory buffer allocation results, leading to a null pointer dereference. A malicious server or a local attacker can exploit this vulnerability during encrypted communication to crash the system, resulting in a denial of service (DoS).

A flaw was found in the Linux kernel's process accounting subsystem. When process accounting is configured to write to a file that performs an internal path lookup, the final write operation can execute after the exiting process has already released its filesystem context. A local user with administrative privileges could exploit this flaw to trigger a null pointer dereference, resulting in a system crash and a denial of service (DoS).

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() The nullity of sps->cstream should be checked similarly as it is done in sof_set_stream_data_offset() function. Assuming that it is not NULL if sps->stream is NULL is incorrect and can lead to NULL pointer dereference.

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix softlockup in arena_map_free on 64k page kernel On an aarch64 kernel with CONFIG_PAGE_SIZE_64KB=y, arena_htab tests cause a segmentation fault and soft lockup. The same failure is not observed with 4k pages on aarch64. It turns out arena_map_free() is calling apply_to_existing_page_range() with the address returned by bpf_arena_get_kern_vm_start(). If this address is not page-aligned the code ends up calling apply_to_pte_range() with that unaligned address causing soft lockup. Fix it by round up GUARD_SZ to PAGE_SIZE << 1 so that the division by 2 in bpf_arena_get_kern_vm_start() returns a page-aligned value.

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. An internal lock held during memory mapping operations on BPF maps can lead to a deadlock condition. A local attacker with permission to interact with BPF maps can exploit this vulnerability to hang the system, resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel's IBM Virtual Network Interface Card (ibmvnic) driver. When transmitting network packets to a Virtual I/O Server (VIOS), the driver accesses packet memory after handing it off, racing against the server freeing the buffer. A local privileged user could exploit this race condition to cause a Denial of Service (DoS) through a system crash or potentially corrupt kernel memory.

A flaw was found in the Linux kernel's traffic control (net/sched) classifier subsystem. Flawed error handling during internal allocation wrapping can cause an action pointer to be set to NULL and subsequently accessed during filter rule updates. A privileged local attacker could exploit this vulnerability to crash the system, resulting in a Denial of Service (DoS).

A vulnerability was found in the Linux kernel's memory migration system in the migrate_device_finalize() function, where a folio that should be freed is erroneously added back into the Least Recently Used (LRU) list. This issue can lead to memory corruption caused by a use-after-free issue when a previously freed folio is reaccessed, leading to system instability or potential denial of service.

A flaw was found in the Linux kernel's io_uring subsystem. This vulnerability may allow an authenticated local user to cause information disclosure by submitting crafted I/O requests that exploit speculative execution. Because operation codes are not properly sanitized against processor speculation, an attacker can use side-channel analysis to observe sensitive kernel memory.

A flaw was found in the Linux kernel's Transmission Control Protocol (TCP) networking subsystem. A local user can cause a Denial of Service (DoS) by establishing compressed network traffic and subsequently deleting network namespaces. Due to deferred cleanup of packet buffers, lingering references to security path structures prevent clean namespace teardown, resulting in unreleased resources.

A flaw was found in the Linux kernel's USB Type-C Connector System Software Interface (UCSI) driver. Improper synchronization when polling status registers from the ACPI (Advanced Configuration and Power Interface) embedded controller with notifications disabled causes an unexpected kernel assertion failure. A local user on affected hardware can trigger this condition during device initialization or reset, resulting in system instability or a denial of service (DoS).

In the Linux kernel, the following vulnerability has been resolved: hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio Commit b15c87263a69 ("hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined) add page poison checks in do_migrate_range in order to make offline hwpoisoned page possible by introducing isolate_lru_page and try_to_unmap for hwpoisoned page. However folio lock must be held before calling try_to_unmap. Add it to fix this problem. Warning will be produced if folio is not locked during unmap: ------------[ cut here ]------------ kernel BUG at ./include/linux/swapops.h:400! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 4 UID: 0 PID: 411 Comm: bash Tainted: G W 6.13.0-rc1-00016-g3c434c7ee82a-dirty #41 Tainted: [W]=WARN Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : try_to_unmap_one+0xb08/0xd3c lr : try_to_unmap_one+0x3dc/0xd3c Call trace: try_to_unmap_one+0xb08/0xd3c (P) try_to_unmap_one+0x3dc/0xd3c (L) rmap_walk_anon+0xdc/0x1f8 rmap_walk+0x3c/0x58 try_to_unmap+0x88/0x90 unmap_poisoned_folio+0x30/0xa8 do_migrate_range+0x4a0/0x568 offline_pages+0x5a4/0x670 memory_block_action+0x17c/0x374 memory_subsys_offline+0x3c/0x78 device_offline+0xa4/0xd0 state_store+0x8c/0xf0 dev_attr_store+0x18/0x2c sysfs_kf_write+0x44/0x54 kernfs_fop_write_iter+0x118/0x1a8 vfs_write+0x3a8/0x4bc ksys_write+0x6c/0xf8 __arm64_sys_write+0x1c/0x28 invoke_syscall+0x44/0x100 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x30/0xd0 el0t_64_sync_handler+0xc8/0xcc el0t_64_sync+0x198/0x19c Code: f9407be0 b5fff320 d4210000 17ffff97 (d4210000) ---[ end trace 0000000000000000 ]---

A flaw was found in the Linux kernel's network memory (netmem) subsystem. This vulnerability allows a privileged local user to cause a Denial of Service (DoS) by crashing the system. By configuring network packet redirection rules, unreadable receive network memory buffers can be forwarded into a device's transmission path. This causes the network device driver to perform Direct Memory Access (DMA) mapping on invalid addresses, triggering a kernel failure.

A flaw was found in the Linux kernel's Hyper-V framebuffer driver. This flaw allows a local user to cause a Denial of Service (DoS) by unbinding a Hyper-V framebuffer device while it is still in active use. Because the driver attempts to forcefully release an in-use framebuffer rather than waiting for graceful framework cleanup, the system triggers a kernel warning and fails to free associated memory resources.

A flaw was found in the Linux kernel's Network File System daemon (nfsd). When the server fails to queue a delegation recall request, it fails to release the associated state reference, causing an internal memory leak. A client interacting with an NFS server could repeatedly trigger this condition, eventually exhausting kernel memory and resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel's Netfilter subsystem. When processing multiple Generic Network Virtualization Encapsulation (GENEVE) tunnel options in the nft_tunnel component, an incorrect pointer calculation leads to a heap-based out-of-bounds memory write. A local user with network administration privileges, or an unprivileged user capable of creating user namespaces, can exploit this vulnerability to cause a Denial of Service (DoS) by crashing the system or potentially achieve local privilege escalation.

A flaw was found in the Linux kernel's mlx5 Remote Direct Memory Access (RDMA) driver. When handling completion queue entries, the driver incorrectly matches firmware queue pair numbers against internal driver structures, leading to the selection of an invalid queue pair. A local user could exploit this issue during completion queue polling to trigger a null pointer dereference, causing a kernel crash and a Denial of Service (DoS).

A flaw was found in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem. Hardware counter sysfs attributes were unintentionally exposed to non-initial network namespaces. A local user operating within a non-initial network namespace could read these attributes, triggering an invalid pointer dereference that crashes the kernel, resulting in a denial of service.

In the Linux kernel, the following vulnerability has been resolved: PCI: Fix NULL dereference in SR-IOV VF creation error path Clean up when virtfn setup fails to prevent NULL pointer dereference during device removal. The kernel oops below occurred due to incorrect error handling flow when pci_setup_device() fails. Add pci_iov_scan_device(), which handles virtfn allocation and setup and cleans up if pci_setup_device() fails, so pci_iov_add_virtfn() doesn't need to call pci_stop_and_remove_bus_device(). This prevents accessing partially initialized virtfn devices during removal. BUG: kernel NULL pointer dereference, address: 00000000000000d0 RIP: 0010:device_del+0x3d/0x3d0 Call Trace: pci_remove_bus_device+0x7c/0x100 pci_iov_add_virtfn+0xfa/0x200 sriov_enable+0x208/0x420 mlx5_core_sriov_configure+0x6a/0x160 [mlx5_core] sriov_numvfs_store+0xae/0x1a0 [bhelgaas: commit log, return ERR_PTR(-ENOMEM) directly]

In the Linux kernel, the following vulnerability has been resolved: bonding: check xdp prog when set bond mode Following operations can trigger a warning[1]: ip netns add ns1 ip netns exec ns1 ip link add bond0 type bond mode balance-rr ip netns exec ns1 ip link set dev bond0 xdp obj af_xdp_kern.o sec xdp ip netns exec ns1 ip link set bond0 type bond mode broadcast ip netns del ns1 When delete the namespace, dev_xdp_uninstall() is called to remove xdp program on bond dev, and bond_xdp_set() will check the bond mode. If bond mode is changed after attaching xdp program, the warning may occur. Some bond modes (broadcast, etc.) do not support native xdp. Set bond mode with xdp program attached is not good. Add check for xdp program when set bond mode. [1] ------------[ cut here ]------------ WARNING: CPU: 0 PID: 11 at net/core/dev.c:9912 unregister_netdevice_many_notify+0x8d9/0x930 Modules linked in: CPU: 0 UID: 0 PID: 11 Comm: kworker/u4:0 Not tainted 6.14.0-rc4 #107 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 Workqueue: netns cleanup_net RIP: 0010:unregister_netdevice_many_notify+0x8d9/0x930 Code: 00 00 48 c7 c6 6f e3 a2 82 48 c7 c7 d0 b3 96 82 e8 9c 10 3e ... RSP: 0018:ffffc90000063d80 EFLAGS: 00000282 RAX: 00000000ffffffa1 RBX: ffff888004959000 RCX: 00000000ffffdfff RDX: 0000000000000000 RSI: 00000000ffffffea RDI: ffffc90000063b48 RBP: ffffc90000063e28 R08: ffffffff82d39b28 R09: 0000000000009ffb R10: 0000000000000175 R11: ffffffff82d09b40 R12: ffff8880049598e8 R13: 0000000000000001 R14: dead000000000100 R15: ffffc90000045000 FS: 0000000000000000(0000) GS:ffff888007a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000d406b60 CR3: 000000000483e000 CR4: 00000000000006f0 Call Trace: <TASK> ? __warn+0x83/0x130 ? unregister_netdevice_many_notify+0x8d9/0x930 ? report_bug+0x18e/0x1a0 ? handle_bug+0x54/0x90 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? unregister_netdevice_many_notify+0x8d9/0x930 ? bond_net_exit_batch_rtnl+0x5c/0x90 cleanup_net+0x237/0x3d0 process_one_work+0x163/0x390 worker_thread+0x293/0x3b0 ? __pfx_worker_thread+0x10/0x10 kthread+0xec/0x1e0 ? __pfx_kthread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2f/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> ---[ end trace 0000000000000000 ]---

In the Linux kernel, the following vulnerability has been resolved: net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. SIOCBRDELIF is passed to dev_ioctl() first and later forwarded to br_ioctl_call(), which causes unnecessary RTNL dance and the splat below [0] under RTNL pressure. Let's say Thread A is trying to detach a device from a bridge and Thread B is trying to remove the bridge. In dev_ioctl(), Thread A bumps the bridge device's refcnt by netdev_hold() and releases RTNL because the following br_ioctl_call() also re-acquires RTNL. In the race window, Thread B could acquire RTNL and try to remove the bridge device. Then, rtnl_unlock() by Thread B will release RTNL and wait for netdev_put() by Thread A. Thread A, however, must hold RTNL after the unlock in dev_ifsioc(), which may take long under RTNL pressure, resulting in the splat by Thread B. Thread A (SIOCBRDELIF) Thread B (SIOCBRDELBR) ---------------------- ---------------------- sock_ioctl sock_ioctl `- sock_do_ioctl `- br_ioctl_call `- dev_ioctl `- br_ioctl_stub |- rtnl_lock | |- dev_ifsioc ' ' |- dev = __dev_get_by_name(...) |- netdev_hold(dev, ...) . / |- rtnl_unlock ------. | | |- br_ioctl_call `---> |- rtnl_lock Race | | `- br_ioctl_stub |- br_del_bridge Window | | | |- dev = __dev_get_by_name(...) | | | May take long | `- br_dev_delete(dev, ...) | | | under RTNL pressure | `- unregister_netdevice_queue(dev, ...) | | | | `- rtnl_unlock \ | |- rtnl_lock <-' `- netdev_run_todo | |- ... `- netdev_run_todo | `- rtnl_unlock |- __rtnl_unlock | |- netdev_wait_allrefs_any |- netdev_put(dev, ...) <----------------' Wait refcnt decrement and log splat below To avoid blocking SIOCBRDELBR unnecessarily, let's not call dev_ioctl() for SIOCBRADDIF and SIOCBRDELIF. In the dev_ioctl() path, we do the following: 1. Copy struct ifreq by get_user_ifreq in sock_do_ioctl() 2. Check CAP_NET_ADMIN in dev_ioctl() 3. Call dev_load() in dev_ioctl() 4. Fetch the master dev from ifr.ifr_name in dev_ifsioc() 3. can be done by request_module() in br_ioctl_call(), so we move 1., 2., and 4. to br_ioctl_stub(). Note that 2. is also checked later in add_del_if(), but it's better performed before RTNL. SIOCBRADDIF and SIOCBRDELIF have been processed in dev_ioctl() since the pre-git era, and there seems to be no specific reason to process them there. [0]: unregister_netdevice: waiting for wpan3 to become free. Usage count = 2 ref_tracker: wpan3@ffff8880662d8608 has 1/1 users at __netdev_tracker_alloc include/linux/netdevice.h:4282 [inline] netdev_hold include/linux/netdevice.h:4311 [inline] dev_ifsioc+0xc6a/0x1160 net/core/dev_ioctl.c:624 dev_ioctl+0x255/0x10c0 net/core/dev_ioctl.c:826 sock_do_ioctl+0x1ca/0x260 net/socket.c:1213 sock_ioctl+0x23a/0x6c0 net/socket.c:1318 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl fs/ioctl.c:892 [inline] __x64_sys_ioctl+0x1a4/0x210 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcb/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f

In the Linux kernel, the following vulnerability has been resolved: idpf: check error for register_netdev() on init Current init logic ignores the error code from register_netdev(), which will cause WARN_ON() on attempt to unregister it, if there was one, and there is no info for the user that the creation of the netdev failed. WARNING: CPU: 89 PID: 6902 at net/core/dev.c:11512 unregister_netdevice_many_notify+0x211/0x1a10 ... [ 3707.563641] unregister_netdev+0x1c/0x30 [ 3707.563656] idpf_vport_dealloc+0x5cf/0xce0 [idpf] [ 3707.563684] idpf_deinit_task+0xef/0x160 [idpf] [ 3707.563712] idpf_vc_core_deinit+0x84/0x320 [idpf] [ 3707.563739] idpf_remove+0xbf/0x780 [idpf] [ 3707.563769] pci_device_remove+0xab/0x1e0 [ 3707.563786] device_release_driver_internal+0x371/0x530 [ 3707.563803] driver_detach+0xbf/0x180 [ 3707.563816] bus_remove_driver+0x11b/0x2a0 [ 3707.563829] pci_unregister_driver+0x2a/0x250 Introduce an error check and log the vport number and error code. On removal make sure to check VPORT_REG_NETDEV flag prior to calling unregister and free on the netdev. Add local variables for idx, vport_config and netdev for readability.

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: init wiphy_work before allocating rfkill fails syzbort reported a uninitialize wiphy_work_lock in cfg80211_dev_free. [1] After rfkill allocation fails, the wiphy release process will be performed, which will cause cfg80211_dev_free to access the uninitialized wiphy_work related data. Move the initialization of wiphy_work to before rfkill initialization to avoid this issue. [1] INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe you didn't initialize this object before use? turning off the locking correctness validator. CPU: 0 UID: 0 PID: 5935 Comm: syz-executor550 Not tainted 6.14.0-rc6-syzkaller-00103-g4003c9e78778 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 assign_lock_key kernel/locking/lockdep.c:983 [inline] register_lock_class+0xc39/0x1240 kernel/locking/lockdep.c:1297 __lock_acquire+0x135/0x3c40 kernel/locking/lockdep.c:5103 lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5851 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 cfg80211_dev_free+0x30/0x3d0 net/wireless/core.c:1196 device_release+0xa1/0x240 drivers/base/core.c:2568 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1e4/0x5a0 lib/kobject.c:737 put_device+0x1f/0x30 drivers/base/core.c:3774 wiphy_free net/wireless/core.c:1224 [inline] wiphy_new_nm+0x1c1f/0x2160 net/wireless/core.c:562 ieee80211_alloc_hw_nm+0x1b7a/0x2260 net/mac80211/main.c:835 mac80211_hwsim_new_radio+0x1d6/0x54e0 drivers/net/wireless/virtual/mac80211_hwsim.c:5185 hwsim_new_radio_nl+0xb42/0x12b0 drivers/net/wireless/virtual/mac80211_hwsim.c:6242 genl_family_rcv_msg_doit+0x202/0x2f0 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x565/0x800 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2533 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline] netlink_unicast+0x53c/0x7f0 net/netlink/af_netlink.c:1338 netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1882 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:733 [inline] ____sys_sendmsg+0xaaf/0xc90 net/socket.c:2573 ___sys_sendmsg+0x135/0x1e0 net/socket.c:2627 __sys_sendmsg+0x16e/0x220 net/socket.c:2659 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 Close: https://syzkaller.appspot.com/bug?extid=aaf0488c83d1d5f4f029

In the Linux kernel, the following vulnerability has been resolved: block: fix adding folio to bio >4GB folio is possible on some ARCHs, such as aarch64, 16GB hugepage is supported, then 'offset' of folio can't be held in 'unsigned int', cause warning in bio_add_folio_nofail() and IO failure. Fix it by adjusting 'page' & trimming 'offset' so that `->bi_offset` won't be overflow, and folio can be added to bio successfully.

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path If a shared IRQ is used by the driver due to platform limitation, then the IRQ affinity hint is set right after the allocation of IRQ vectors in ath11k_pci_alloc_msi(). This does no harm unless one of the functions requesting the IRQ fails and attempt to free the IRQ. This results in the below warning: WARNING: CPU: 7 PID: 349 at kernel/irq/manage.c:1929 free_irq+0x278/0x29c Call trace: free_irq+0x278/0x29c ath11k_pcic_free_irq+0x70/0x10c [ath11k] ath11k_pci_probe+0x800/0x820 [ath11k_pci] local_pci_probe+0x40/0xbc The warning is due to not clearing the affinity hint before freeing the IRQs. So to fix this issue, clear the IRQ affinity hint before calling ath11k_pcic_free_irq() in the error path. The affinity will be cleared once again further down the error path due to code organization, but that does no harm. Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-05266-QCAHSTSWPLZ_V2_TO_X86-1

An out-of-bounds read vulnerability exists in the ppp_sync_txmunge() function in the Linux kernel's PPP subsystem. Insufficient bounds checking on incoming PPP packets may lead to a kernel crash if a packet with an empty or truncated payload is processed.

In the Linux kernel, the following vulnerability has been resolved: sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash There is a code path in dequeue_entities() that can set the slice of a sched_entity to U64_MAX, which sometimes results in a crash. The offending case is when dequeue_entities() is called to dequeue a delayed group entity, and then the entity's parent's dequeue is delayed. In that case: 1. In the if (entity_is_task(se)) else block at the beginning of dequeue_entities(), slice is set to cfs_rq_min_slice(group_cfs_rq(se)). If the entity was delayed, then it has no queued tasks, so cfs_rq_min_slice() returns U64_MAX. 2. The first for_each_sched_entity() loop dequeues the entity. 3. If the entity was its parent's only child, then the next iteration tries to dequeue the parent. 4. If the parent's dequeue needs to be delayed, then it breaks from the first for_each_sched_entity() loop _without updating slice_. 5. The second for_each_sched_entity() loop sets the parent's ->slice to the saved slice, which is still U64_MAX. This throws off subsequent calculations with potentially catastrophic results. A manifestation we saw in production was: 6. In update_entity_lag(), se->slice is used to calculate limit, which ends up as a huge negative number. 7. limit is used in se->vlag = clamp(vlag, -limit, limit). Because limit is negative, vlag > limit, so se->vlag is set to the same huge negative number. 8. In place_entity(), se->vlag is scaled, which overflows and results in another huge (positive or negative) number. 9. The adjusted lag is subtracted from se->vruntime, which increases or decreases se->vruntime by a huge number. 10. pick_eevdf() calls entity_eligible()/vruntime_eligible(), which incorrectly returns false because the vruntime is so far from the other vruntimes on the queue, causing the (vruntime - cfs_rq->min_vruntime) * load calulation to overflow. 11. Nothing appears to be eligible, so pick_eevdf() returns NULL. 12. pick_next_entity() tries to dereference the return value of pick_eevdf() and crashes. Dumping the cfs_rq states from the core dumps with drgn showed tell-tale huge vruntime ranges and bogus vlag values, and I also traced se->slice being set to U64_MAX on live systems (which was usually "benign" since the rest of the runqueue needed to be in a particular state to crash). Fix it in dequeue_entities() by always setting slice from the first non-empty cfs_rq.

A use-after-free flaw was found in KVM for arm64 in the Linux Kernel, if the kvm_arch_vcpu_create() fails to share the vCPU page with the hypervisor. This vulnerability could even lead to a kernel information leak problem.

A flaw was found in the Linux kernel's USB Type-C Connector System Software Interface (UCSI) DisplayPort driver. When a USB Type-C DisplayPort device is disconnected, the driver does not ensure that pending background tasks finish executing before removing partner resources. A user with physical access could exploit this by unplugging the device during active operations, triggering a NULL pointer dereference and resulting in a system crash and Denial of Service (DoS).

A flaw was found in the Linux kernel sched_ext BPF iterator. bpf_iter_scx_dsq_new() can return an error without clearing the iterator, and a later next() call dereferences that uninitialized state. A local user who can load that BPF program can crash the kernel.

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request Make sure that n_channels is set after allocating the struct cfg80211_registered_device::int_scan_req member. Seen with syzkaller: UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:1208:5 index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]') This was missed in the initial conversions because I failed to locate the allocation likely due to the "sizeof(void *)" not matching the "channels" array type.

In the Linux kernel, the following vulnerability has been resolved: rseq: Fix segfault on registration when rseq_cs is non-zero The rseq_cs field is documented as being set to 0 by user-space prior to registration, however this is not currently enforced by the kernel. This can result in a segfault on return to user-space if the value stored in the rseq_cs field doesn't point to a valid struct rseq_cs. The correct solution to this would be to fail the rseq registration when the rseq_cs field is non-zero. However, some older versions of glibc will reuse the rseq area of previous threads without clearing the rseq_cs field and will also terminate the process if the rseq registration fails in a secondary thread. This wasn't caught in testing because in this case the leftover rseq_cs does point to a valid struct rseq_cs. What we can do is clear the rseq_cs field on registration when it's non-zero which will prevent segfaults on registration and won't break the glibc versions that reuse rseq areas on thread creation.

A flaw was found in the Linux kernel's ath12k wireless driver. When device initialization fails, the driver does not properly unregister an internal notification handler before its memory is freed during module unloading. A local privileged user could exploit this use-after-free vulnerability upon subsequent access to the handler, leading to a Denial of Service (DoS) through a system crash.

In the Linux kernel, the following vulnerability has been resolved: net: phy: mscc: Fix memory leak when using one step timestamping Fix memory leak when running one-step timestamping. When running one-step sync timestamping, the HW is configured to insert the TX time into the frame, so there is no reason to keep the skb anymore. As in this case the HW will never generate an interrupt to say that the frame was timestamped, then the frame will never released. Fix this by freeing the frame in case of one-step timestamping.

A flaw was found in the Linux kernel's i40e network driver. When an attached device supplies malformed responses during driver operations, an integer underflow can occur. This issue leads to an invalid write operation in Memory-Mapped I/O (MMIO) space, which can cause a kernel crash and result in a Denial of Service (DoS).

A flaw was found in the Linux kernel's ext4 file system. This vulnerability allows a local user to cause a Denial of Service (DoS) through a system crash by mounting or manipulating a crafted file system. When handling symbolic links during file truncation while data journaling is active, the kernel attempts to execute unassigned memory operations, triggering a NULL pointer dereference.

A flaw was found in the Linux kernel's real-time scheduler. This vulnerability allows a local user to cause a Denial of Service (DoS) through a system crash. A race condition during task balancing across multiple processor cores can cause the scheduler to mismanage task migrations, leading to memory faults and kernel panics.

In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels Correct kernel call trace when calling smp_processor_id() when called in preemptible kernels by using raw_smp_processor_id(). smp_processor_id() checks to see if preemption is disabled and if not, issue an error message followed by a call to dump_stack(). Brief example of call trace: kernel: check_preemption_disabled: 436 callbacks suppressed kernel: BUG: using smp_processor_id() in preemptible [00000000] code: kworker/u1025:0/2354 kernel: caller is pqi_scsi_queue_command+0x183/0x310 [smartpqi] kernel: CPU: 129 PID: 2354 Comm: kworker/u1025:0 kernel: ... kernel: Workqueue: writeback wb_workfn (flush-253:0) kernel: Call Trace: kernel: <TASK> kernel: dump_stack_lvl+0x34/0x48 kernel: check_preemption_disabled+0xdd/0xe0 kernel: pqi_scsi_queue_command+0x183/0x310 [smartpqi] kernel: ...

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix crash in icl_update_topdown_event() The perf_fuzzer found a hard-lockup crash on a RaptorLake machine: Oops: general protection fault, maybe for address 0xffff89aeceab400: 0000 CPU: 23 UID: 0 PID: 0 Comm: swapper/23 Tainted: [W]=WARN Hardware name: Dell Inc. Precision 9660/0VJ762 RIP: 0010:native_read_pmc+0x7/0x40 Code: cc e8 8d a9 01 00 48 89 03 5b cd cc cc cc cc 0f 1f ... RSP: 000:fffb03100273de8 EFLAGS: 00010046 .... Call Trace: <TASK> icl_update_topdown_event+0x165/0x190 ? ktime_get+0x38/0xd0 intel_pmu_read_event+0xf9/0x210 __perf_event_read+0xf9/0x210 CPUs 16-23 are E-core CPUs that don't support the perf metrics feature. The icl_update_topdown_event() should not be invoked on these CPUs. It's a regression of commit: f9bdf1f95339 ("perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read") The bug introduced by that commit is that the is_topdown_event() function is mistakenly used to replace the is_topdown_count() call to check if the topdown functions for the perf metrics feature should be invoked. Fix it.

In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Fix OOB memory read access in KUnit test (wmfw info) KASAN reported out of bounds access - cs_dsp_mock_wmfw_add_info(), because the source string length was rounded up to the allocation size.

In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Fix OOB memory read access in KUnit test (ctl cache) KASAN reported out of bounds access - cs_dsp_ctl_cache_init_multiple_offsets(). The code uses mock_coeff_template.length_bytes (4 bytes) for register value allocations. But later, this length is set to 8 bytes which causes test code failures. As fix, just remove the lenght override, keeping the original value 4 for all operations.

A flaw was found in the Linux kernel's lpfc driver. When handling the storage adapter BIOS version string, string concatenation triggers kernel memory safety checks that detect an unexpected buffer size and force a kernel panic. A local user or hardware initialization event can trigger this issue to crash the system, resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel's Intel Data Streaming Accelerator (IDXD) driver. When running workloads inside a container that shares access to host device files, terminating the container's parent process can cause the driver to reference an already released work queue. A local user running such workloads can trigger this condition, causing a system crash that leads to a Denial of Service (DoS).

In the Linux kernel, the following vulnerability has been resolved: nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. syzbot reported a warning below [1] following a fault injection in nfs_fs_proc_net_init(). [0] When nfs_fs_proc_net_init() fails, /proc/net/rpc/nfs is not removed. Later, rpc_proc_exit() tries to remove /proc/net/rpc, and the warning is logged as the directory is not empty. Let's handle the error of nfs_fs_proc_net_init() properly. [0]: FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 UID: 0 PID: 6120 Comm: syz.2.27 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:123) should_fail_ex (lib/fault-inject.c:73 lib/fault-inject.c:174) should_failslab (mm/failslab.c:46) kmem_cache_alloc_noprof (mm/slub.c:4178 mm/slub.c:4204) __proc_create (fs/proc/generic.c:427) proc_create_reg (fs/proc/generic.c:554) proc_create_net_data (fs/proc/proc_net.c:120) nfs_fs_proc_net_init (fs/nfs/client.c:1409) nfs_net_init (fs/nfs/inode.c:2600) ops_init (net/core/net_namespace.c:138) setup_net (net/core/net_namespace.c:443) copy_net_ns (net/core/net_namespace.c:576) create_new_namespaces (kernel/nsproxy.c:110) unshare_nsproxy_namespaces (kernel/nsproxy.c:218 (discriminator 4)) ksys_unshare (kernel/fork.c:3123) __x64_sys_unshare (kernel/fork.c:3190) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> [1]: remove_proc_entry: removing non-empty directory 'net/rpc', leaking at least 'nfs' WARNING: CPU: 1 PID: 6120 at fs/proc/generic.c:727 remove_proc_entry+0x45e/0x530 fs/proc/generic.c:727 Modules linked in: CPU: 1 UID: 0 PID: 6120 Comm: syz.2.27 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:remove_proc_entry+0x45e/0x530 fs/proc/generic.c:727 Code: 3c 02 00 0f 85 85 00 00 00 48 8b 93 d8 00 00 00 4d 89 f0 4c 89 e9 48 c7 c6 40 ba a2 8b 48 c7 c7 60 b9 a2 8b e8 33 81 1d ff 90 <0f> 0b 90 90 e9 5f fe ff ff e8 04 69 5e ff 90 48 b8 00 00 00 00 00 RSP: 0018:ffffc90003637b08 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88805f534140 RCX: ffffffff817a92c8 RDX: ffff88807da99e00 RSI: ffffffff817a92d5 RDI: 0000000000000001 RBP: ffff888033431ac0 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffff888033431a00 R13: ffff888033431ae4 R14: ffff888033184724 R15: dffffc0000000000 FS: 0000555580328500(0000) GS:ffff888124a62000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f71733743e0 CR3: 000000007f618000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> sunrpc_exit_net+0x46/0x90 net/sunrpc/sunrpc_syms.c:76 ops_exit_list net/core/net_namespace.c:200 [inline] ops_undo_list+0x2eb/0xab0 net/core/net_namespace.c:253 setup_net+0x2e1/0x510 net/core/net_namespace.c:457 copy_net_ns+0x2a6/0x5f0 net/core/net_namespace.c:574 create_new_namespaces+0x3ea/0xa90 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:218 ksys_unshare+0x45b/0xa40 kernel/fork.c:3121 __do_sys_unshare kernel/fork.c:3192 [inline] __se_sys_unshare kernel/fork.c:3190 [inline] __x64_sys_unshare+0x31/0x40 kernel/fork.c:3190 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa1a6b8e929 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c ---truncated---

A flaw was found in the Linux kernel's dell-wmi-sysman driver. The driver fails to validate Windows Management Instrumentation (WMI) data blocks retrieved during sysfs interface operations before accessing their contents. A local user with sysfs access can exploit this vulnerability to cause a Denial of Service (DoS) through a kernel crash or potentially expose sensitive kernel memory.

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. sof_pdata->tplg_filename can have address allocated by kstrdup() and can be overwritten. Memory leak was detected with kmemleak: unreferenced object 0xffff88812391ff60 (size 16): comm "kworker/4:1", pid 161, jiffies 4294802931 hex dump (first 16 bytes): 73 6f 66 2d 68 64 61 2d 67 65 6e 65 72 69 63 00 sof-hda-generic. backtrace (crc 4bf1675c): __kmalloc_node_track_caller_noprof+0x49c/0x6b0 kstrdup+0x46/0xc0 hda_machine_select.cold+0x1de/0x12cf [snd_sof_intel_hda_generic] sof_init_environment+0x16f/0xb50 [snd_sof] sof_probe_continue+0x45/0x7c0 [snd_sof] sof_probe_work+0x1e/0x40 [snd_sof] process_one_work+0x894/0x14b0 worker_thread+0x5e5/0xfb0 kthread+0x39d/0x760 ret_from_fork+0x31/0x70 ret_from_fork_asm+0x1a/0x30

A flaw was found in the Linux kernel's traffic control subsystem. A local attacker with network administration privileges, such as within an unprivileged user namespace, can cause a Denial of Service (DoS) by triggering a kernel crash. By configuring specific nested queueing disciplines with traffic control commands, an operation in the Hierarchical Token Bucket (HTB) scheduler encounters an unexpected empty data structure and triggers a kernel assertion failure.

In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix panic during namespace deletion with VF The existing code move the VF NIC to new namespace when NETDEV_REGISTER is received on netvsc NIC. During deletion of the namespace, default_device_exit_batch() >> default_device_exit_net() is called. When netvsc NIC is moved back and registered to the default namespace, it automatically brings VF NIC back to the default namespace. This will cause the default_device_exit_net() >> for_each_netdev_safe loop unable to detect the list end, and hit NULL ptr: [ 231.449420] mana 7870:00:00.0 enP30832s1: Moved VF to namespace with: eth0 [ 231.449656] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 231.450246] #PF: supervisor read access in kernel mode [ 231.450579] #PF: error_code(0x0000) - not-present page [ 231.450916] PGD 17b8a8067 P4D 0 [ 231.451163] Oops: Oops: 0000 [#1] SMP NOPTI [ 231.451450] CPU: 82 UID: 0 PID: 1394 Comm: kworker/u768:1 Not tainted 6.16.0-rc4+ #3 VOLUNTARY [ 231.452042] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 11/21/2024 [ 231.452692] Workqueue: netns cleanup_net [ 231.452947] RIP: 0010:default_device_exit_batch+0x16c/0x3f0 [ 231.453326] Code: c0 0c f5 b3 e8 d5 db fe ff 48 85 c0 74 15 48 c7 c2 f8 fd ca b2 be 10 00 00 00 48 8d 7d c0 e8 7b 77 25 00 49 8b 86 28 01 00 00 <48> 8b 50 10 4c 8b 2a 4c 8d 62 f0 49 83 ed 10 4c 39 e0 0f 84 d6 00 [ 231.454294] RSP: 0018:ff75fc7c9bf9fd00 EFLAGS: 00010246 [ 231.454610] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 61c8864680b583eb [ 231.455094] RDX: ff1fa9f71462d800 RSI: ff75fc7c9bf9fd38 RDI: 0000000030766564 [ 231.455686] RBP: ff75fc7c9bf9fd78 R08: 0000000000000000 R09: 0000000000000000 [ 231.456126] R10: 0000000000000001 R11: 0000000000000004 R12: ff1fa9f70088e340 [ 231.456621] R13: ff1fa9f70088e340 R14: ffffffffb3f50c20 R15: ff1fa9f7103e6340 [ 231.457161] FS: 0000000000000000(0000) GS:ff1faa6783a08000(0000) knlGS:0000000000000000 [ 231.457707] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 231.458031] CR2: 0000000000000010 CR3: 0000000179ab2006 CR4: 0000000000b73ef0 [ 231.458434] Call Trace: [ 231.458600] <TASK> [ 231.458777] ops_undo_list+0x100/0x220 [ 231.459015] cleanup_net+0x1b8/0x300 [ 231.459285] process_one_work+0x184/0x340 To fix it, move the ns change to a workqueue, and take rtnl_lock to avoid changing the netdev list when default_device_exit_net() is using it.

A race condition flaw was found in the Linux kernel's netfs subsystem. In the netfs_read_unlock_folios() function, a folio (memory page) may be unlocked prematurely before the ZERO subrequest completes clearing the tail portion of the page beyond the end-of-file. This allows an application using mmap to observe uninitialized kernel memory contents in the uncleared tail region, potentially leading to information disclosure.

A flaw was found in the Linux kernel's Bluetooth HCI UART driver. A race condition exists where the `hci_uart_write_work()` function may attempt to access uninitialized private data if a TTY write wakeup occurs during the protocol initialization phase. This can lead to a NULL pointer dereference, potentially causing a system crash and resulting in a Denial of Service (DoS).

A memory leak flaw was found in the Linux kernel's CIFS/SMB client. In the smb2_open_file() function, request buffers are not properly freed when performing direct I/O writes to a read-only SMB share. This causes slab cache objects to remain allocated, which can prevent the cifs module from unloading cleanly and lead to gradual memory exhaustion with repeated operations.