A potential CAN frame reception race flaw was found in isotp_rcv() in the Linux kernel. This vulnerability may lead to a crash.

A flaw was found in the Linux kernel. A local attacker could exploit a missing call to `m_can_class_free_dev()` in the `m_can_pci_remove()` and `m_can_pci_probe()` error handling paths. This oversight leads to a memory leak, which could result in a denial of service (DoS) due to resource exhaustion.

A flaw was found in the Linux kernel's CAN (Controller Area Network) networking subsystem. This flaw allows a local user to cause a Denial of Service (DoS) by binding a CAN socket with crafted CAN identifiers. Because the kernel fails to properly sanitize these identifiers before performing address checks, the protocol state machine enters an invalid state, resulting in a system crash.

In the Linux kernel, the following vulnerability has been resolved: powerpc/papr_scm: don't requests stats with '0' sized stats buffer Sachin reported [1] that on a POWER-10 lpar he is seeing a kernel panic being reported with vPMEM when papr_scm probe is being called. The panic is of the form below and is observed only with following option disabled(profile) for the said LPAR 'Enable Performance Information Collection' in the HMC: Kernel attempted to write user page (1c) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on write at 0x0000001c Faulting instruction address: 0xc008000001b90844 Oops: Kernel access of bad area, sig: 11 [#1] <snip> NIP [c008000001b90844] drc_pmem_query_stats+0x5c/0x270 [papr_scm] LR [c008000001b92794] papr_scm_probe+0x2ac/0x6ec [papr_scm] Call Trace: 0xc00000000941bca0 (unreliable) papr_scm_probe+0x2ac/0x6ec [papr_scm] platform_probe+0x98/0x150 really_probe+0xfc/0x510 __driver_probe_device+0x17c/0x230 <snip> ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Fatal exception On investigation looks like this panic was caused due to a 'stat_buffer' of size==0 being provided to drc_pmem_query_stats() to fetch all performance stats-ids of an NVDIMM. However drc_pmem_query_stats() shouldn't have been called since the vPMEM NVDIMM doesn't support and performance stat-id's. This was caused due to missing check for 'p->stat_buffer_len' at the beginning of papr_scm_pmu_check_events() which indicates that the NVDIMM doesn't support performance-stats. Fix this by introducing the check for 'p->stat_buffer_len' at the beginning of papr_scm_pmu_check_events(). [1] https://lore.kernel.org/all/6B3A522A-6A5F-4CC9-B268-0C63AA6E07D3@linux.ibm.com

A flaw was found in the Linux kernel's Extensible Firmware Interface (EFI) subsystem. During early boot on systems equipped with Apple T2 hardware, the kernel attempts to read Unified Extensible Firmware Interface (UEFI) Secure Boot certificate variables, triggering a firmware page fault. This failure results in a Denial of Service (DoS) by disabling EFI runtime services and preventing the system from importing certificates into kernel keyrings. A local user with access during the boot sequence can trigger this flaw, degrading system stability and disabling runtime firmware features.

In the Linux kernel, the following vulnerability has been resolved: powerpc/xics: fix refcount leak in icp_opal_init() The of_find_compatible_node() function returns a node pointer with refcount incremented, use of_node_put() on it when done.

A flaw was found in the Linux kernel. The PowerPC External Interrupt Virtualization Engine (XIVE) driver for virtualized environments fails to release a device tree node reference during system initialization. Although this leads to an unreleased reference count and minor resource leak, it cannot be directly exploited by unprivileged users and poses minimal risk to system availability.

In the Linux kernel, the following vulnerability has been resolved: list: fix a data-race around ep->rdllist ep_poll() first calls ep_events_available() with no lock held and checks if ep->rdllist is empty by list_empty_careful(), which reads rdllist->prev. Thus all accesses to it need some protection to avoid store/load-tearing. Note INIT_LIST_HEAD_RCU() already has the annotation for both prev and next. Commit bf3b9f6372c4 ("epoll: Add busy poll support to epoll with socket fds.") added the first lockless ep_events_available(), and commit c5a282e9635e ("fs/epoll: reduce the scope of wq lock in epoll_wait()") made some ep_events_available() calls lockless and added single call under a lock, finally commit e59d3c64cba6 ("epoll: eliminate unnecessary lock for zero timeout") made the last ep_events_available() lockless. BUG: KCSAN: data-race in do_epoll_wait / do_epoll_wait write to 0xffff88810480c7d8 of 8 bytes by task 1802 on cpu 0: INIT_LIST_HEAD include/linux/list.h:38 [inline] list_splice_init include/linux/list.h:492 [inline] ep_start_scan fs/eventpoll.c:622 [inline] ep_send_events fs/eventpoll.c:1656 [inline] ep_poll fs/eventpoll.c:1806 [inline] do_epoll_wait+0x4eb/0xf40 fs/eventpoll.c:2234 do_epoll_pwait fs/eventpoll.c:2268 [inline] __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline] __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275 __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffff88810480c7d8 of 8 bytes by task 1799 on cpu 1: list_empty_careful include/linux/list.h:329 [inline] ep_events_available fs/eventpoll.c:381 [inline] ep_poll fs/eventpoll.c:1797 [inline] do_epoll_wait+0x279/0xf40 fs/eventpoll.c:2234 do_epoll_pwait fs/eventpoll.c:2268 [inline] __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline] __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275 __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0xffff88810480c7d0 -> 0xffff888103c15098 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 1799 Comm: syz-fuzzer Tainted: G W 5.17.0-rc7-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

A flaw was found in the Linux kernel's powerpc/xive/spapr component. An incorrect bitmap allocation size can lead to a slab-out-of-bounds write. A local attacker could exploit this vulnerability to cause a denial of service or potentially disclose sensitive information.

A flaw was found in the Linux kernel's Integrity Measurement Architecture (IMA). This flaw can lead to a Denial of Service (DoS) caused by a memory leak during system startup. If the subsystem encounters an error while allocating cryptographic resources in the ima_init_crypto() function, it exits without releasing previously allocated memory structures. Under specific resource-constrained boot conditions, this failure leaves kernel memory permanently unrecovered.

A flaw was found in the Linux kernel's Integrity Measurement Architecture (IMA). A local user can cause a denial of service (DoS) due to an integer overflow during file integrity verification. Under configurations where module signatures are evaluated, negative return values are mishandled during measurement appraisal, leading to kernel instability and potential system crashes.

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Fix memory leak problem This reverts commit 46bbe5c671e06f070428b9be142cc4ee5cedebac. As commit 46bbe5c671e0 ("tracing: fix double free") said, the "double free" problem reported by clang static analyzer is: > In parse_var_defs() if there is a problem allocating > var_defs.expr, the earlier var_defs.name is freed. > This free is duplicated by free_var_defs() which frees > the rest of the list. However, if there is a problem allocating N-th var_defs.expr: + in parse_var_defs(), the freed 'earlier var_defs.name' is actually the N-th var_defs.name; + then in free_var_defs(), the names from 0th to (N-1)-th are freed; IF ALLOCATING PROBLEM HAPPENED HERE!!! -+ \ | 0th 1th (N-1)-th N-th V +-------------+-------------+-----+-------------+----------- var_defs: | name | expr | name | expr | ... | name | expr | name | /// +-------------+-------------+-----+-------------+----------- These two frees don't act on same name, so there was no "double free" problem before. Conversely, after that commit, we get a "memory leak" problem because the above "N-th var_defs.name" is not freed. If enable CONFIG_DEBUG_KMEMLEAK and inject a fault at where the N-th var_defs.expr allocated, then execute on shell like: $ echo 'hist:key=call_site:val=$v1,$v2:v1=bytes_req,v2=bytes_alloc' > \ /sys/kernel/debug/tracing/events/kmem/kmalloc/trigger Then kmemleak reports: unreferenced object 0xffff8fb100ef3518 (size 8): comm "bash", pid 196, jiffies 4295681690 (age 28.538s) hex dump (first 8 bytes): 76 31 00 00 b1 8f ff ff v1...... backtrace: [<0000000038fe4895>] kstrdup+0x2d/0x60 [<00000000c99c049a>] event_hist_trigger_parse+0x206f/0x20e0 [<00000000ae70d2cc>] trigger_process_regex+0xc0/0x110 [<0000000066737a4c>] event_trigger_write+0x75/0xd0 [<000000007341e40c>] vfs_write+0xbb/0x2a0 [<0000000087fde4c2>] ksys_write+0x59/0xd0 [<00000000581e9cdf>] do_syscall_64+0x3a/0x80 [<00000000cf3b065c>] entry_SYSCALL_64_after_hwframe+0x46/0xb0

A flaw was found in the Linux kernel's usbnet driver. In error-handling paths during asynchronous command processing, the driver improperly manages allocated buffers, resulting in a memory leak. A local user could exploit this vulnerability by triggering specific error conditions during network operations over USB, potentially causing memory exhaustion and a Denial of Service (DoS).

A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) subsystem. A divide-by-zero error can occur within the Dynamic Interrupt Moderation (DIM) mechanism when comparing statistics that evaluate to a zero value. A local attacker can trigger this issue during network operations to crash the system, resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel's TUN/TAP device driver. This vulnerability allows a local user with network configuration privileges to cause a denial of service (DoS) by crashing the system. By detaching network queues and closing the device, an attacker can trigger a race condition during cleanup where internal device structures are not properly unlinked.

A flaw was found in the Linux kernel's Controller Area Network (CAN) J1939 subsystem. A local attacker with permission to create J1939 sockets can cause a Denial of Service (DoS) and crash the system. This issue occurs in the j1939_send_one() function due to a missing initialization of CAN frame header fields when preparing network buffers. Accessing these uninitialized data elements during transmission leads to unexpected kernel behavior and instability.

In the Linux kernel, the following vulnerability has been resolved: intel_th: Fix a resource leak in an error handling path If an error occurs after calling 'pci_alloc_irq_vectors()', 'pci_free_irq_vectors()' must be called as already done in the remove function.

In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: avoid scheduling in rtas_os_term() It's unsafe to use rtas_busy_delay() to handle a busy status from the ibm,os-term RTAS function in rtas_os_term(): Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b BUG: sleeping function called from invalid context at arch/powerpc/kernel/rtas.c:618 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1, name: swapper/0 preempt_count: 2, expected: 0 CPU: 7 PID: 1 Comm: swapper/0 Tainted: G D 6.0.0-rc5-02182-gf8553a572277-dirty #9 Call Trace: [c000000007b8f000] [c000000001337110] dump_stack_lvl+0xb4/0x110 (unreliable) [c000000007b8f040] [c0000000002440e4] __might_resched+0x394/0x3c0 [c000000007b8f0e0] [c00000000004f680] rtas_busy_delay+0x120/0x1b0 [c000000007b8f100] [c000000000052d04] rtas_os_term+0xb8/0xf4 [c000000007b8f180] [c0000000001150fc] pseries_panic+0x50/0x68 [c000000007b8f1f0] [c000000000036354] ppc_panic_platform_handler+0x34/0x50 [c000000007b8f210] [c0000000002303c4] notifier_call_chain+0xd4/0x1c0 [c000000007b8f2b0] [c0000000002306cc] atomic_notifier_call_chain+0xac/0x1c0 [c000000007b8f2f0] [c0000000001d62b8] panic+0x228/0x4d0 [c000000007b8f390] [c0000000001e573c] do_exit+0x140c/0x1420 [c000000007b8f480] [c0000000001e586c] make_task_dead+0xdc/0x200 Use rtas_busy_delay_time() instead, which signals without side effects whether to attempt the ibm,os-term RTAS call again.

In the Linux kernel, the following vulnerability has been resolved: can: isotp: split tx timer into transmission and timeout The timer for the transmission of isotp PDUs formerly had two functions: 1. send two consecutive frames with a given time gap 2. monitor the timeouts for flow control frames and the echo frames This led to larger txstate checks and potentially to a problem discovered by syzbot which enabled the panic_on_warn feature while testing. The former 'txtimer' function is split into 'txfrtimer' and 'txtimer' to handle the two above functionalities with separate timer callbacks. The two simplified timers now run in one-shot mode and make the state transitions (especially with isotp_rcv_echo) better understandable.

A flaw was found in the Linux kernel's xsk_diag interface. This vulnerability, a use-after-free error, occurs when the xsk_diag interface is used after a socket has been unbound from its device, such as during socket closure or device removal. A local attacker could exploit this flaw to cause a system crash, leading to a Denial of Service (DoS).

A flaw was found in the Linux kernel. A local attacker can cause a Denial of Service (DoS) or memory corruption by exploiting a use-after-free condition in the Shared Memory Communications (SMC) subsystem. This vulnerability occurs when an SMC socket is closed without properly stopping its underlying network timers, allowing a timer handler to access socket memory after it has already been freed.

A race condition was found in the Linux kernel's inotify subsystem. When inotify_freeing_mark() races with inotify_handle_inode_event(), the event handler may read i_mark->wd after it has been reset to -1. This causes an invalid watch descriptor value of -1 to be reported to userspace applications, potentially confusing inotify listeners.

A flaw was found in the Linux kernel. A local user with low privileges could exploit a deadlock vulnerability in the Controller Area Network (CAN) bus J1939 protocol implementation. This occurs when specific data transfer and error queue handling events coincide with a network interface going down. Successful exploitation can lead to a Denial of Service (DoS), rendering the system unresponsive.

A race condition was found in the SMC (Shared Memory Communications) networking subsystem. The smc_llc_srv_add_link() function lacks proper locking, allowing concurrent link additions that can corrupt link group state and crash the kernel.

A race condition was found in the SMC networking subsystem. Iterating over the link group list in smcr_port_add() without holding the lock can cause crashes when concurrent add/remove operations modify the list.

A flaw was found in the Linux kernel's netfilter component, specifically within the `nfnetlink_queue` module. A local attacker with low privileges could trigger a race condition by calling `nf_reinject()` without the required `rcu_read_lock()` in the `instance_destroy_rcu()` function. This could lead to suspicious RCU (Read-Copy-Update) usage, potentially resulting in memory corruption and a denial of service (DoS).

A flaw was found in AMD processors. This transient execution vulnerability may allow an unprivileged local attacker to cause information disclosure of privileged data. By exploiting how the processor speculatively processes instructions ahead of time, an attacker can infer sensitive data from previous memory store operations that should remain protected.

A flaw was found in AMD processors. An authenticated local attacker can exploit this transient execution vulnerability to cause information disclosure across privilege boundaries. By observing microarchitectural side-channel behavior, an attacker can infer sensitive data residing in the Level 1 Data (L1D) cache.

A flaw was found in the Linux kernel. Incorrect memory mapping of the `cmd-db` shared memory region as Write-Back (WB) instead of Write-Combine (WC) can lead to a Denial of Service (DoS). When a hypervisor other than the Qualcomm Hypervisor is in use, the eXtended Protection Unit (XPU) may falsely detect cache evictions as unauthorized writes, triggering a secure interrupt and an endless loop within the Trust Zone.

A vulnerability was found in the Linux kernel involving the use of uninitialized resources. When a corrupted symbolic link size read is called from the disk, it causes an uninitialized page, resulting in loss of availability of the system.

A flaw was found in the Linux kernel. A local attacker could exploit a race condition during the eviction of inodes (index nodes). This race condition occurs when two threads simultaneously attempt to evict the same inode. Successful exploitation could lead to a system crash, resulting in a denial of service (DoS).

A flaw was found in the Linux kernel. Userspace can deceive the kernel into performing MMIO (Memory-Mapped IO) operations in TDX (Trust Domain Extensions) on its behalf, allowing a #VE (Virtualization Exception) to be incorrectly handled as a in-kernel MMIO operation.

A flaw was found in the Linux kernel's Intel Xe graphics driver. A use-after-free vulnerability can occur when dereferencing memory during buffer object movement trace logging events. A local privileged user could exploit this flaw on systems with active kernel tracing to cause a Denial of Service (DoS) through a system crash or potentially disclose sensitive kernel memory.

A flaw was found in the Linux kernel's rxrpc module. A race condition exists during the setup of a socket and its associated I/O thread. A remote attacker could send a specially crafted User Datagram Protocol (UDP) packet, which might be processed by rxrpc_encap_rcv() before the I/O thread is fully initialized. This could lead to a kernel 'oops', resulting in a system crash and a denial of service.

A flaw was found in the Linux kernel. A local attacker with low privileges could trigger a denial of service (DoS) in the io_uring subsystem. By generating a large number of overflow entries, the attacker could cause a prolonged flush operation, making the system unresponsive.

A flaw was found in the Linux kernel's `posix-clock` component. A local attacker with low privileges could exploit a missing validation check in the `pc_clock_settime()` function. By providing invalid time values, such as a negative `tv_sec` or an out-of-range `tv_nsec`, the attacker could cause certain drivers to write these unchecked values directly to hardware registers. This could lead to system instability, a denial of service (DoS), and potentially impact system integrity.

A flaw was found in the Linux kernel. A local user can cause a Denial of Service (DoS) due to missing locking in the RxRPC network protocol subsystem. When a queued client call is aborted before being processed, improper synchronization allows a race condition that can corrupt the pending call queue and cause connection requests to hang indefinitely.

A flaw was found in the Intel Gigabit Ethernet (igb) network driver within the Linux kernel. When driver registration fails during initialization, the driver fails to properly unregister its Direct Cache Access (DCA) notification handler. A local attacker could exploit this condition upon driver initialization failure, leading to an invalid memory access and causing a system crash that results in a Denial of Service (DoS).

A flaw was found in the Linux kernel's io_uring subsystem. A local user with administrative privileges can cause a Denial of Service (DoS) by triggering a system deadlock. This issue occurs when direct input/output (I/O) write requests are processed during an active filesystem freeze without verifying non-blocking execution status. As a result, the freeze operation and pending write tasks wait on each other indefinitely, causing affected storage operations to hang.

A flaw was found in the Linux kernel's AFS (Andrew File System) implementation. A local user could exploit this vulnerability to cause a Denial of Service (DoS) by triggering a system crash. The issue occurs during the handling of asynchronous requests when attempting to release a queued network call while an internal notification lock is already held, resulting in lock recursion and a kernel deadlock.

A flaw was found in the Linux kernel's virtio/vsock subsystem. Due to a race condition during socket destruction, incoming connection requests can be added to the queue after it has already been cleared, leaving unreleased sockets in memory. A local attacker could exploit this timing issue to cause a kernel memory leak, potentially exhausting system resources and leading to a Denial of Service (DoS).

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem. In guest/host mode for Intel Processor Trace (Intel PT), the hypervisor fails to properly validate virtual processor configurations and manage tracing states during virtual machine transitions. A local user or guest administrator can exploit this issue by supplying unsupported processor configurations or invalid tracing states. This flaw can trigger hardware errors and deadlocks, leading to a Denial of Service (DoS) and host or guest instability.

A flaw was found in the Linux kernel's block layer. When a storage disk is removed or unregistered, improper state handling fails to clear request mappings, leaving stale references to released memory. A local user with administrative privileges could exploit this use-after-free vulnerability (accessing memory after it has been released) during queue iteration to cause a kernel crash, resulting in a Denial of Service (DoS), or potentially achieve arbitrary code execution.

A flaw was found in the Linux kernel's Soft-RoCE (rdma_rxe) driver. When an InfiniBand queue pair enters an error state, the driver fails to properly update the status of queued work requests during flush operations. A connected peer or user communicating over Remote Direct Memory Access (RDMA) can trigger this condition, potentially leading to a kernel crash and denial of service (DoS).

A flaw was found in Xen hypercall page handling within virtualized guest environments. The Xen hypercall page contains code generated by the hypervisor that lacks awareness of guest operating system CPU speculation mitigations, such as return instruction transforms, and Control-flow Integrity (CFI) protections. A local user or guest-level attacker can exploit this lack of hardening to bypass speculative execution defenses, potentially leading to information disclosure through side-channel attacks.

A flaw was found in the Linux kernel's IP Virtual Server (IPVS) module. This vulnerability can lead to a Denial of Service (DoS) via a kernel crash caused by an uninitialized stack buffer during protocol initialization. Under certain build configurations, compilers may omit proper function return instructions, causing execution to fall through into adjacent code when the module is loaded or initialized. A local user with permissions to load the module can trigger this flaw to crash the system.

A flaw was found in the Linux kernel's Network File System (NFS) client subsystem. A local authenticated user with privileges to configure Remote Procedure Call (RPC) clients or initiate NFS mounts could trigger a Denial of Service (DoS) or memory corruption. This issue arises because the sysfs interface copies RPC program names into a fixed-size buffer without bounds checking. An attacker supplying an oversized name could cause a buffer overflow, resulting in a system crash.

A flaw was found in the Linux kernel's CAN (Controller Area Network) subsystem. When an error occurs during socket creation, an internal socket object is released without clearing its associated reference, leaving a dangling pointer. A local user could exploit this use-after-free condition to cause a Denial of Service (DoS) or potentially execute arbitrary code.

A flaw was found in the Linux kernel's Controller Area Network (CAN) J1939 networking subsystem. An improper reference counting issue in the session initialization logic can lead to a socket buffer reference count underflow. A local attacker with permissions to create CAN J1939 sockets could exploit this vulnerability to cause a system crash, resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel's ACPI (Advanced Configuration and Power Interface) NFIT driver. A local user with administrative privileges can trigger an out-of-bounds memory read by providing an undersized buffer to the control interface. This issue primarily results in a system crash and Denial of Service (DoS), and may potentially expose sensitive kernel memory.

A flaw was found in the Linux kernel's block control group (blk-cgroup) subsystem. When traversing the control group hierarchy during unpinning operations, the blkcg_unpin_online() function accesses a parent group's data structure after it has already been freed. A local user with administrative privileges could exploit this race condition to trigger a use-after-free condition, potentially causing a Denial of Service (DoS) via a system crash or arbitrary code execution.

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. A local attacker with permission to attach BPF programs can trigger a use-after-free vulnerability due to mismatched Read-Copy-Update (RCU) synchronization grace periods when detaching non-sleepable programs from user space probes. This flaw can lead to privilege escalation or a system crash resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel's parallel cryptography (pcrypt) subsystem. When processor cores are brought online or taken offline while cryptographic operations are active, an unexpected error condition is returned. On systems configured to halt on kernel warnings, this unexpected return code triggers a system crash. A local user can exploit this vulnerability to cause a Denial of Service (DoS).

A flaw was found in the Linux kernel's io_uring subsystem. When a task terminates, deferred asynchronous work can still execute and attempt to access an internal work queue that has already been closed. A local attacker can exploit this race condition to cause a system crash, resulting in a Denial of Service (DoS).

A vulnerability was found in the Linux kernel's RTC driver in the rtc_timer_do_work() function, where the __rtc_read_time call may fail. This issue results in uninitialized data in the rtc_time struct. It can lead to the generation of extremely large values, causing periodic timer failures and potentially triggering a kernel softlockup, impacting system stability.

No description is available for this CVE.

A flaw was found in the Linux kernel's USB eXtensible Host Controller Interface (xHCI) driver. This vulnerability allows an attacker to cause a denial of service (DoS) by triggering a system crash. By connecting a specially crafted or malfunctioning USB peripheral that aborts commands under specific ring buffer conditions, the driver attempts to access a non-existent command structure, resulting in a NULL pointer dereference and a kernel panic.

A flaw was found in the Linux kernel. This vulnerability allows a local user to cause a Denial of Service (DoS) via a system crash. A race condition between table resizing and state lookup operations in the IPsec packet transformation (xfrm) subsystem can cause the kernel to perform an out-of-bounds memory read during concurrent state lookups.

A flaw was found in the Linux kernel's Human Interface Device (HID) subsystem. This vulnerability allows a local attacker with physical access or the ability to attach a virtual device to cause a Denial of Service (DoS). By providing a specially crafted HID report descriptor that lacks expected logical collection structures, descriptor processing triggers an invalid assumption and causes a kernel crash.

A NULL pointer access may result in compromised availability.

A flaw was found in the Linux kernel's Broadcom Bluetooth driver. When retrieving a board name, the driver fails to check whether memory allocation succeeded before referencing the pointer. A local attacker could exploit this condition during memory allocation failures to trigger a kernel crash, resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel's MediaTek MT7925 wireless network driver. Under low-memory conditions, the driver fails to verify whether a memory allocation succeeds when changing virtual interface links. A local user with administrative privileges could trigger this flaw, leading to a null pointer dereference and a kernel crash that results in a Denial of Service (DoS).

A flaw was found in the Linux kernel's MediaTek MT7925 wireless driver. An off-by-one boundary check error in the driver's firmware loading logic allows an authorized local user on a system with affected wireless hardware to trigger an out-of-bounds memory read and write. This issue can result in memory corruption, system instability, or a Denial of Service (DoS).

In the Linux kernel, the following vulnerability has been resolved: HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check syzbot has found a type mismatch between a USB pipe and the transfer endpoint, which is triggered by the hid-thrustmaster driver[1]. There is a number of similar, already fixed issues [2]. In this case as in others, implementing check for endpoint type fixes the issue. [1] https://syzkaller.appspot.com/bug?extid=040e8b3db6a96908d470 [2] https://syzkaller.appspot.com/bug?extid=348331f63b034f89b622

A flaw was found in the Linux kernel's ath12k wireless driver. When reconfiguring a wireless network interface across different radios, an internal interface pointer is freed and subsequently read before being reassigned. A local user with administrative privileges could exploit this use-after-free condition to cause a system crash resulting in a Denial of Service (DoS) or potential kernel memory corruption.

A flaw was found in the Linux kernel's Operating Performance Points (OPP) subsystem. A missing index boundary check when querying clock frequencies allows an unprivileged local user to trigger an out-of-bounds read. This flaw can lead to a system crash, resulting in a Denial of Service (DoS), or the potential disclosure of sensitive kernel memory.

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params Each cpu DAI should associate with a widget. However, the topology might not create the right number of DAI widgets for aggregated amps. And it will cause NULL pointer deference. Check that the DAI widget associated with the CPU DAI is valid to prevent NULL pointer deference due to missing DAI widgets in topologies with aggregated amps.

A flaw was found in the Linux kernel's brcmsmac wireless driver. A missing gain range check during calibration routines can lead to an out-of-bounds memory read when handling gain parameters. A local attacker on a system with affected wireless hardware could exploit this flaw to cause a system crash, resulting in a Denial of Service (DoS), or potentially access sensitive kernel memory.

A flaw was found in the Linux kernel's ath12k wireless driver. When formatting driver debug statistics, an incorrect array length calculation leads to an out-of-bounds memory read. A local user with administrative privileges could exploit this flaw to cause a Denial of Service (DoS) via a system crash or disclose sensitive kernel memory.

A flaw was found in the Linux kernel's Intel Infrastructure Data Path Function (IDPF) network driver. This flaw allows a local attacker to cause a Denial of Service (DoS) and potential system crash by heavily consuming processor resources on a targeted CPU core. Because the driver's background tasks were bound to specific processor cores rather than distributed across available processors, heavy CPU contention can starve critical driver worker threads, leading to operational timeouts and system failure.

A flaw was found in the Linux kernel's Intel Wi-Fi driver (iwlwifi). A local user can trigger a Denial of Service (DoS) during virtual wireless network interface link operations. Because the driver fails to verify whether a link pointer is valid before accessing it, the system encounters a null pointer dereference, causing the kernel to crash.

A flaw was found in the Linux kernel's Operating Performance Points (OPP) framework. A local user can cause a Denial of Service (DoS) by triggering a kernel crash. This issue occurs when a driver attempts to query bandwidth values from an OPP table that was not initialized due to missing interconnect properties, resulting in a null pointer dereference.

A flaw was found in the rtlwifi driver within the Linux kernel. During device initialization, if a probe operation fails, the driver does not remove internal data structures from a global list. A privileged local user can exploit this behavior by initiating a subsequent device probe, leading to access of previously freed memory. This flaw can result in a system crash, leading to a Denial of Service (DoS), or potentially allow arbitrary code execution.

A flaw was found in the Linux kernel's NVIDIA Tegra cryptographic driver. During system memory exhaustion, cryptographic initialization routines fail to properly handle errors and proceed to transfer requests. A local user could exploit this flaw to trigger a kernel crash, resulting in a Denial of Service (DoS).

In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback commit 1f5664351410 ("ASoC: lower "no backend DAIs enabled for ... Port" log severity") ignores -EINVAL error message on common soc_pcm_ret(). It is used from many functions, ignoring -EINVAL is over-kill. The reason why -EINVAL was ignored was it really should only be used upon invalid parameters coming from userspace and in that case we don't want to log an error since we do not want to give userspace a way to do a denial-of-service attack on the syslog / diskspace. So don't use soc_pcm_ret() on .prepare callback is better idea.

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem. A local authenticated user with permissions to create virtual machines can cause a Denial of Service (DoS) by triggering a use-after-free condition. When an invalid or uninitialized virtual CPU (vCPU) is requested, the kernel fails to verify that the processor is online before referencing it. If virtual machine initialization fails and the associated memory is released, an improper reference causes the host kernel to crash.

A flaw was found in the Linux kernel. This vulnerability allows a local user with administrative privileges to cause a Denial of Service (DoS) through a kernel deadlock. The issue occurs during the cleanup of Berkeley Packet Filter (BPF) control group (cgroup) storage when specific tracing programs are attached, creating competing lock acquisitions that freeze the system.

A flaw was found in the Linux kernel. A use-after-free vulnerability exists in the Budget Fair Queueing (BFQ) input/output (I/O) scheduler due to improper process reference handling during queue splitting. A local attacker can exploit this issue to execute arbitrary code with elevated privileges or crash the system, resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel's CAKE (Common Applications Kept Enhanced) network queue scheduler. A missing bounds check allows an internal traffic counter to underflow when processing network flows. A local attacker can exploit this vulnerability by sending crafted network traffic on a system configured with the CAKE queuing discipline, triggering an out-of-bounds memory read. This failure can result in a Denial of Service (DoS) via a system crash or lead to unauthorized information disclosure.

A flaw was found in the Linux kernel's netfilter connection tracking subsystem. A local user with administrative privileges can trigger this issue by resizing the connection tracking table to an excessively large size. Because the hashtable capacity is not properly bounded, this can lead to memory allocation failures and kernel warnings, potentially resulting in a denial of service (DoS) or excessive log spam.

A flaw was found in the Linux kernel's zram driver. When initializing a compressed memory (zram) device encounters an early memory allocation failure, the driver frees the internal table without clearing its reference. A local user with administrative privileges could trigger a use-after-free condition by attempting to reset the failed and uninitialized device. This issue can lead to a system crash, resulting in a denial of service (DoS).

A flaw was found in the Linux kernel's Andrew File System (AFS) implementation. When handling errors while parsing address preference configuration entries, the kernel fails to release an internal lock before returning control to user space. A local authenticated user can exploit this vulnerability by submitting invalid configuration data, resulting in a locked resource that causes a system hang and a Denial of Service (DoS).

A flaw was found in the Linux kernel. The cachestat() system call lacks proper permission checks for file ownership or write access when reporting memory cache statistics. An authenticated local attacker can exploit this flaw to determine whether specific file pages are held in system memory, leading to unauthorized information disclosure and enabling potential side-channel timing attacks.

A flaw was found in the Linux kernel's compressed swap cache (zswap) subsystem. During memory compression or decompression operations, a race condition can occur if a processor core is dynamically removed (hot-unplugged) while its per-CPU resources are still being accessed. A local attacker could exploit this use-after-free condition to cause a kernel crash resulting in a denial of service (DoS), or potentially execute arbitrary code.

A flaw was found in the Linux kernel. A local user can trigger a Denial of Service (DoS) by executing a specific sequence of memory remapping and protection operations on memory regions configured with userfaultfd write tracking (a mechanism allowing user-space applications to manage page faults). Due to an inconsistency in clearing write-protection flags during remapping, a subsequent protection change causes an internal kernel state check failure, leading to a system crash.

A flaw was found in the Linux kernel's network packet scheduling subsystem. A local attacker can exploit this vulnerability to achieve privilege escalation by configuring specific network queueing disciplines with a zero packet limit. When processing network packets under this condition, the scheduler fails to properly account for queue lengths between parent and child queues, resulting in an inconsistent internal kernel state.

A flaw was found in the Linux kernel's mlx5 driver. This flaw could allow a local attacker with access to Remote Direct Memory Access (RDMA) interfaces to cause a denial of service (DoS) or potentially execute arbitrary code. When invalidating memory regions in On-Demand Paging (ODP), the driver may queue a cleanup task twice, resulting in a use-after-free condition when the freed memory is subsequently accessed.

A flaw was found in the Linux kernel's parallel execution mechanism (padata). A race condition between cryptographic request processing and algorithm removal can cause a use-after-free (accessing memory after it has been released) condition during work reordering. A local user could exploit this vulnerability to trigger a denial of service (DoS) through a system crash or potentially cause memory corruption.

A use-after-free vulnerability was found in the Linux kernel's padata subsystem, in the `padata_reorder()` function. Caused by improper synchronization controls, this vulnerability can occur when a reference-counted data structure (`pd`) is decremented in one thread, freeing it, while another thread still holds a pointer to it and attempts to access it via `padata_find_next()`. This vulnerability can lead to system instability, denial of service, and potential privilege escalation.

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. A privileged local user can trigger a denial of service (DoS) and crash the system by loading an attached BPF program that calls the bpf_send_signal function in a non-preemptible execution context. Because this function can enter a sleeping state in a context where rescheduling is forbidden, it causes an invalid kernel state leading to a system crash.

A flaw was found in the linux kernel. A race between cancel_hw_scan and hw_scan completion may lead to compromised availability.

A flaw was found in the Linux kernel's ATA storage subsystem. A local attacker with administrative privileges or direct device access can issue a crafted SCSI (Small Computer System Interface) pass-through command to an ATA device. This action causes the driver to write data outside the allocated buffer, leading to kernel memory corruption and a Denial of Service (DoS) via a system crash.

A flaw was found in the Linux kernel's Universal Flash Storage (UFS) driver. During device initialization error handling or driver removal, cryptographic profile structures are released before their associated cleanup handlers execute, resulting in a use-after-free condition. A local attacker capable of triggering device unbinding or probe errors could exploit this vulnerability to cause memory corruption, leading to a denial of service (DoS) or potentially privilege escalation.

A flaw was found in the Linux kernel's block control group (blk-cgroup) subsystem. When iterating over block devices while gathering root input/output (I/O) statistics, the kernel fails to properly release device iterator references, resulting in a reference count leak. A local authenticated attacker can exploit this issue by repeatedly querying root block performance metrics, potentially causing resource exhaustion and a Denial of Service (DoS).

A flaw was found in the Linux kernel's Synaptics input driver. A race condition can occur when enabling a pass-through port if a hardware interrupt arrives before the mouse driver has finished attaching to the port. A local user can trigger this issue to cause an uninitialized memory access, resulting in a system crash and Denial of Service (DoS).

A flaw was found in the Linux kernel's IPv6 networking subsystem. A local attacker can trigger a race condition during network namespace deletion where internal network structures lack proper synchronization. This issue results in an invalid memory access, leading to a system crash and a Denial of Service (DoS).

A vulnerability was found in the Linux kernel's work queue subsystem, which manages background task execution. The issue stems from improper handling of the "rescuer" thread during the cleanup of unbound work queues.

A flaw was found in the Linux kernel's network teaming driver. A local user with access to generic Netlink interfaces can supply configuration strings lacking proper null termination, causing an uninitialized memory read during processing. This flaw can lead to a system crash, resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel's Virtual Extensible LAN (VXLAN) driver. The initialization sequence fails to properly check the return value of an internal group setup routine, allowing an incomplete initialization state to persist. A local authenticated user with administrative network privileges could exploit this vulnerability during network device creation or teardown, triggering a null pointer dereference that results in a kernel crash and a system Denial of Service (DoS).

A use-after-free vulnerability was found in the Linux kernel. l3mdev_l3_out() can be called without RCU being held, causing damage to the availability of the system.

A flaw was found in the Linux kernel's Network File System daemon (NFSD). When an NFSv4 client enters an inactive courtesy state, the server continues attempting to send callback requests rather than skipping them. This issue causes server callback shutdown routines to stall, allowing a client to trigger a temporary Denial of Service (DoS) by delaying server callback operations until network timeouts expire.

A flaw was found in the Linux kernel's Network File System daemon (nfsd). This flaw can lead to a Denial of Service (DoS) when a client issues specific NFS requests that encounter errors during Access Control List (ACL) processing. Because the kernel fails to reset internal pointers after releasing memory, subsequent cleanup operations attempt to free already-released memory, causing a reference count underflow and a kernel crash.

In the Linux kernel, the following vulnerability has been resolved: net: let net.core.dev_weight always be non-zero The following problem was encountered during stability test: (NULL net_device): NAPI poll function process_backlog+0x0/0x530 \ returned 1, exceeding its budget of 0. ------------[ cut here ]------------ list_add double add: new=ffff88905f746f48, prev=ffff88905f746f48, \ next=ffff88905f746e40. WARNING: CPU: 18 PID: 5462 at lib/list_debug.c:35 \ __list_add_valid_or_report+0xf3/0x130 CPU: 18 UID: 0 PID: 5462 Comm: ping Kdump: loaded Not tainted 6.13.0-rc7+ RIP: 0010:__list_add_valid_or_report+0xf3/0x130 Call Trace: ? __warn+0xcd/0x250 ? __list_add_valid_or_report+0xf3/0x130 enqueue_to_backlog+0x923/0x1070 netif_rx_internal+0x92/0x2b0 __netif_rx+0x15/0x170 loopback_xmit+0x2ef/0x450 dev_hard_start_xmit+0x103/0x490 __dev_queue_xmit+0xeac/0x1950 ip_finish_output2+0x6cc/0x1620 ip_output+0x161/0x270 ip_push_pending_frames+0x155/0x1a0 raw_sendmsg+0xe13/0x1550 __sys_sendto+0x3bf/0x4e0 __x64_sys_sendto+0xdc/0x1b0 do_syscall_64+0x5b/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e The reproduction command is as follows: sysctl -w net.core.dev_weight=0 ping 127.0.0.1 This is because when the napi's weight is set to 0, process_backlog() may return 0 and clear the NAPI_STATE_SCHED bit of napi->state, causing this napi to be re-polled in net_rx_action() until __do_softirq() times out. Since the NAPI_STATE_SCHED bit has been cleared, napi_schedule_rps() can be retriggered in enqueue_to_backlog(), causing this issue. Making the napi's weight always non-zero solves this problem. Triggering this issue requires system-wide admin (setting is not namespaced).

A flaw was found in the Linux kernel's netfilter subsystem. In the nf_tables component, the total key length is not properly validated against concatenated field length descriptions when setting up packet filtering rules. A local attacker with network administration privileges or access to unprivileged user namespaces can exploit this vulnerability by submitting mismatched key sets, leading to kernel memory corruption and a Denial of Service (DoS) through a system crash.

A flaw was found in the Linux kernel's mac80211 wireless subsystem. In ad-hoc wireless network configurations, if station insertion fails after authorization, the system attempts to flush station data that was never registered with the device driver. A local user with privileges to manage wireless interfaces can exploit this flaw to cause a system crash, leading to a Denial of Service (DoS).

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]" The Call Trace is as below: " <TASK> ? show_regs.cold+0x1a/0x1f ? __rxe_cleanup+0x12c/0x170 [rdma_rxe] ? __warn+0x84/0xd0 ? __rxe_cleanup+0x12c/0x170 [rdma_rxe] ? report_bug+0x105/0x180 ? handle_bug+0x46/0x80 ? exc_invalid_op+0x19/0x70 ? asm_exc_invalid_op+0x1b/0x20 ? __rxe_cleanup+0x12c/0x170 [rdma_rxe] ? __rxe_cleanup+0x124/0x170 [rdma_rxe] rxe_destroy_qp.cold+0x24/0x29 [rdma_rxe] ib_destroy_qp_user+0x118/0x190 [ib_core] rdma_destroy_qp.cold+0x43/0x5e [rdma_cm] rtrs_cq_qp_destroy.cold+0x1d/0x2b [rtrs_core] rtrs_srv_close_work.cold+0x1b/0x31 [rtrs_server] process_one_work+0x21d/0x3f0 worker_thread+0x4a/0x3c0 ? process_one_work+0x3f0/0x3f0 kthread+0xf0/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 </TASK> " When too many rdma resources are allocated, rxe needs more time to handle these rdma resources. Sometimes with the current timeout, rxe can not release the rdma resources correctly. Compared with other rdma drivers, a bigger timeout is used.

A flaw was found in the Linux kernel. A local user could exploit this flaw to cause data corruption by reusing a submission queue entry (SQE) before the corresponding command completes. This issue occurs because the io_uring command handler accesses data from the original entry after the preparation phase without maintaining a stable copy, resulting in the kernel reading stale data.

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem. An authenticated user within a guest virtual machine can cause a denial of service (DoS) or register state corruption, particularly in nested virtualization environments. When a guest updates its debug registers, KVM can overwrite the hardware register with an outdated value during certain virtual machine exits before saving the updated state. This state desynchronization can disrupt guest execution or cause the guest operating system to crash.

A flaw was found in the Linux kernel's SMB (Server Message Block) client subsystem. Under low-memory conditions while processing incoming encrypted traffic, the client fails to properly validate memory buffer allocation results, leading to a null pointer dereference. A malicious server or a local attacker can exploit this vulnerability during encrypted communication to crash the system, resulting in a denial of service (DoS).

A flaw was found in the Linux kernel's process accounting subsystem. When process accounting is configured to write to a file that performs an internal path lookup, the final write operation can execute after the exiting process has already released its filesystem context. A local user with administrative privileges could exploit this flaw to trigger a null pointer dereference, resulting in a system crash and a denial of service (DoS).

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() The nullity of sps->cstream should be checked similarly as it is done in sof_set_stream_data_offset() function. Assuming that it is not NULL if sps->stream is NULL is incorrect and can lead to NULL pointer dereference.

A flaw was found in the Netronome Network Flow Processor (NFP) driver within the Linux kernel. A local attacker with permission to manage offloaded extended Berkeley Packet Filter (eBPF) programs could cause a Denial of Service (DoS) by triggering a failure during control message allocation. Because the driver does not properly verify that message allocation succeeded, the failure leads to a null-pointer dereference and crashes the operating system.

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix softlockup in arena_map_free on 64k page kernel On an aarch64 kernel with CONFIG_PAGE_SIZE_64KB=y, arena_htab tests cause a segmentation fault and soft lockup. The same failure is not observed with 4k pages on aarch64. It turns out arena_map_free() is calling apply_to_existing_page_range() with the address returned by bpf_arena_get_kern_vm_start(). If this address is not page-aligned the code ends up calling apply_to_pte_range() with that unaligned address causing soft lockup. Fix it by round up GUARD_SZ to PAGE_SIZE << 1 so that the division by 2 in bpf_arena_get_kern_vm_start() returns a page-aligned value.

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. An internal lock held during memory mapping operations on BPF maps can lead to a deadlock condition. A local attacker with permission to interact with BPF maps can exploit this vulnerability to hang the system, resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel's IBM Virtual Network Interface Card (ibmvnic) driver. When transmitting network packets to a Virtual I/O Server (VIOS), the driver accesses packet memory after handing it off, racing against the server freeing the buffer. A local privileged user could exploit this race condition to cause a Denial of Service (DoS) through a system crash or potentially corrupt kernel memory.

A vulnerability was found in the Linux kernel's memory migration system in the migrate_device_finalize() function, where a folio that should be freed is erroneously added back into the Least Recently Used (LRU) list. This issue can lead to memory corruption caused by a use-after-free issue when a previously freed folio is reaccessed, leading to system instability or potential denial of service.

A flaw was found in the Linux kernel's io_uring subsystem. This vulnerability may allow an authenticated local user to cause information disclosure by submitting crafted I/O requests that exploit speculative execution. Because operation codes are not properly sanitized against processor speculation, an attacker can use side-channel analysis to observe sensitive kernel memory.

A flaw was found in the Linux kernel's Transmission Control Protocol (TCP) networking subsystem. A local user can cause a Denial of Service (DoS) by establishing compressed network traffic and subsequently deleting network namespaces. Due to deferred cleanup of packet buffers, lingering references to security path structures prevent clean namespace teardown, resulting in unreleased resources.

A flaw was found in the Linux kernel's USB Type-C Connector System Software Interface (UCSI) driver. Improper synchronization when polling status registers from the ACPI (Advanced Configuration and Power Interface) embedded controller with notifications disabled causes an unexpected kernel assertion failure. A local user on affected hardware can trigger this condition during device initialization or reset, resulting in system instability or a denial of service (DoS).

A flaw was found in the Linux kernel's Netfilter subsystem. When processing multiple Generic Network Virtualization Encapsulation (GENEVE) tunnel options in the nft_tunnel component, an incorrect pointer calculation leads to a heap-based out-of-bounds memory write. A local user with network administration privileges, or an unprivileged user capable of creating user namespaces, can exploit this vulnerability to cause a Denial of Service (DoS) by crashing the system or potentially achieve local privilege escalation.

A flaw was found in the Linux kernel's mlx5 Remote Direct Memory Access (RDMA) driver. When handling completion queue entries, the driver incorrectly matches firmware queue pair numbers against internal driver structures, leading to the selection of an invalid queue pair. A local user could exploit this issue during completion queue polling to trigger a null pointer dereference, causing a kernel crash and a Denial of Service (DoS).

A flaw was found in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem. Hardware counter sysfs attributes were unintentionally exposed to non-initial network namespaces. A local user operating within a non-initial network namespace could read these attributes, triggering an invalid pointer dereference that crashes the kernel, resulting in a denial of service.

In the Linux kernel, the following vulnerability has been resolved: PCI: Fix NULL dereference in SR-IOV VF creation error path Clean up when virtfn setup fails to prevent NULL pointer dereference during device removal. The kernel oops below occurred due to incorrect error handling flow when pci_setup_device() fails. Add pci_iov_scan_device(), which handles virtfn allocation and setup and cleans up if pci_setup_device() fails, so pci_iov_add_virtfn() doesn't need to call pci_stop_and_remove_bus_device(). This prevents accessing partially initialized virtfn devices during removal. BUG: kernel NULL pointer dereference, address: 00000000000000d0 RIP: 0010:device_del+0x3d/0x3d0 Call Trace: pci_remove_bus_device+0x7c/0x100 pci_iov_add_virtfn+0xfa/0x200 sriov_enable+0x208/0x420 mlx5_core_sriov_configure+0x6a/0x160 [mlx5_core] sriov_numvfs_store+0xae/0x1a0 [bhelgaas: commit log, return ERR_PTR(-ENOMEM) directly]

A flaw was found in the Linux kernel's Virtual Kernel Modesetting (VKMS) driver. If the driver encounters an error during initialization, the exit routine can improperly access and release memory that was not initialized or was already freed. A local privileged user could exploit this vulnerability to trigger memory corruption, potentially leading to a system crash and Denial of Service (DoS).

In the Linux kernel, the following vulnerability has been resolved: net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. SIOCBRDELIF is passed to dev_ioctl() first and later forwarded to br_ioctl_call(), which causes unnecessary RTNL dance and the splat below [0] under RTNL pressure. Let's say Thread A is trying to detach a device from a bridge and Thread B is trying to remove the bridge. In dev_ioctl(), Thread A bumps the bridge device's refcnt by netdev_hold() and releases RTNL because the following br_ioctl_call() also re-acquires RTNL. In the race window, Thread B could acquire RTNL and try to remove the bridge device. Then, rtnl_unlock() by Thread B will release RTNL and wait for netdev_put() by Thread A. Thread A, however, must hold RTNL after the unlock in dev_ifsioc(), which may take long under RTNL pressure, resulting in the splat by Thread B. Thread A (SIOCBRDELIF) Thread B (SIOCBRDELBR) ---------------------- ---------------------- sock_ioctl sock_ioctl `- sock_do_ioctl `- br_ioctl_call `- dev_ioctl `- br_ioctl_stub |- rtnl_lock | |- dev_ifsioc ' ' |- dev = __dev_get_by_name(...) |- netdev_hold(dev, ...) . / |- rtnl_unlock ------. | | |- br_ioctl_call `---> |- rtnl_lock Race | | `- br_ioctl_stub |- br_del_bridge Window | | | |- dev = __dev_get_by_name(...) | | | May take long | `- br_dev_delete(dev, ...) | | | under RTNL pressure | `- unregister_netdevice_queue(dev, ...) | | | | `- rtnl_unlock \ | |- rtnl_lock <-' `- netdev_run_todo | |- ... `- netdev_run_todo | `- rtnl_unlock |- __rtnl_unlock | |- netdev_wait_allrefs_any |- netdev_put(dev, ...) <----------------' Wait refcnt decrement and log splat below To avoid blocking SIOCBRDELBR unnecessarily, let's not call dev_ioctl() for SIOCBRADDIF and SIOCBRDELIF. In the dev_ioctl() path, we do the following: 1. Copy struct ifreq by get_user_ifreq in sock_do_ioctl() 2. Check CAP_NET_ADMIN in dev_ioctl() 3. Call dev_load() in dev_ioctl() 4. Fetch the master dev from ifr.ifr_name in dev_ifsioc() 3. can be done by request_module() in br_ioctl_call(), so we move 1., 2., and 4. to br_ioctl_stub(). Note that 2. is also checked later in add_del_if(), but it's better performed before RTNL. SIOCBRADDIF and SIOCBRDELIF have been processed in dev_ioctl() since the pre-git era, and there seems to be no specific reason to process them there. [0]: unregister_netdevice: waiting for wpan3 to become free. Usage count = 2 ref_tracker: wpan3@ffff8880662d8608 has 1/1 users at __netdev_tracker_alloc include/linux/netdevice.h:4282 [inline] netdev_hold include/linux/netdevice.h:4311 [inline] dev_ifsioc+0xc6a/0x1160 net/core/dev_ioctl.c:624 dev_ioctl+0x255/0x10c0 net/core/dev_ioctl.c:826 sock_do_ioctl+0x1ca/0x260 net/socket.c:1213 sock_ioctl+0x23a/0x6c0 net/socket.c:1318 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl fs/ioctl.c:892 [inline] __x64_sys_ioctl+0x1a4/0x210 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcb/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f

In the Linux kernel, the following vulnerability has been resolved: idpf: check error for register_netdev() on init Current init logic ignores the error code from register_netdev(), which will cause WARN_ON() on attempt to unregister it, if there was one, and there is no info for the user that the creation of the netdev failed. WARNING: CPU: 89 PID: 6902 at net/core/dev.c:11512 unregister_netdevice_many_notify+0x211/0x1a10 ... [ 3707.563641] unregister_netdev+0x1c/0x30 [ 3707.563656] idpf_vport_dealloc+0x5cf/0xce0 [idpf] [ 3707.563684] idpf_deinit_task+0xef/0x160 [idpf] [ 3707.563712] idpf_vc_core_deinit+0x84/0x320 [idpf] [ 3707.563739] idpf_remove+0xbf/0x780 [idpf] [ 3707.563769] pci_device_remove+0xab/0x1e0 [ 3707.563786] device_release_driver_internal+0x371/0x530 [ 3707.563803] driver_detach+0xbf/0x180 [ 3707.563816] bus_remove_driver+0x11b/0x2a0 [ 3707.563829] pci_unregister_driver+0x2a/0x250 Introduce an error check and log the vport number and error code. On removal make sure to check VPORT_REG_NETDEV flag prior to calling unregister and free on the netdev. Add local variables for idx, vport_config and netdev for readability.

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: init wiphy_work before allocating rfkill fails syzbort reported a uninitialize wiphy_work_lock in cfg80211_dev_free. [1] After rfkill allocation fails, the wiphy release process will be performed, which will cause cfg80211_dev_free to access the uninitialized wiphy_work related data. Move the initialization of wiphy_work to before rfkill initialization to avoid this issue. [1] INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe you didn't initialize this object before use? turning off the locking correctness validator. CPU: 0 UID: 0 PID: 5935 Comm: syz-executor550 Not tainted 6.14.0-rc6-syzkaller-00103-g4003c9e78778 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 assign_lock_key kernel/locking/lockdep.c:983 [inline] register_lock_class+0xc39/0x1240 kernel/locking/lockdep.c:1297 __lock_acquire+0x135/0x3c40 kernel/locking/lockdep.c:5103 lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5851 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 cfg80211_dev_free+0x30/0x3d0 net/wireless/core.c:1196 device_release+0xa1/0x240 drivers/base/core.c:2568 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1e4/0x5a0 lib/kobject.c:737 put_device+0x1f/0x30 drivers/base/core.c:3774 wiphy_free net/wireless/core.c:1224 [inline] wiphy_new_nm+0x1c1f/0x2160 net/wireless/core.c:562 ieee80211_alloc_hw_nm+0x1b7a/0x2260 net/mac80211/main.c:835 mac80211_hwsim_new_radio+0x1d6/0x54e0 drivers/net/wireless/virtual/mac80211_hwsim.c:5185 hwsim_new_radio_nl+0xb42/0x12b0 drivers/net/wireless/virtual/mac80211_hwsim.c:6242 genl_family_rcv_msg_doit+0x202/0x2f0 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x565/0x800 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2533 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline] netlink_unicast+0x53c/0x7f0 net/netlink/af_netlink.c:1338 netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1882 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:733 [inline] ____sys_sendmsg+0xaaf/0xc90 net/socket.c:2573 ___sys_sendmsg+0x135/0x1e0 net/socket.c:2627 __sys_sendmsg+0x16e/0x220 net/socket.c:2659 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 Close: https://syzkaller.appspot.com/bug?extid=aaf0488c83d1d5f4f029

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path If a shared IRQ is used by the driver due to platform limitation, then the IRQ affinity hint is set right after the allocation of IRQ vectors in ath11k_pci_alloc_msi(). This does no harm unless one of the functions requesting the IRQ fails and attempt to free the IRQ. This results in the below warning: WARNING: CPU: 7 PID: 349 at kernel/irq/manage.c:1929 free_irq+0x278/0x29c Call trace: free_irq+0x278/0x29c ath11k_pcic_free_irq+0x70/0x10c [ath11k] ath11k_pci_probe+0x800/0x820 [ath11k_pci] local_pci_probe+0x40/0xbc The warning is due to not clearing the affinity hint before freeing the IRQs. So to fix this issue, clear the IRQ affinity hint before calling ath11k_pcic_free_irq() in the error path. The affinity will be cleared once again further down the error path due to code organization, but that does no harm. Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-05266-QCAHSTSWPLZ_V2_TO_X86-1

An out-of-bounds access vulnerability was found in the Linux kernel's nvme subsystem in the `nvmet_enable_port()` function. The vulnerability can occur when a port is enabled without a transport type configured, causing the function to use the `NVMF_TRTYPE_MAX` value (255) as an array index into the `nvmet_transports` structure. The out-of-bounds read can lead to system instability, information leakage, and a denial of service.

A use-after-free flaw was found in KVM for arm64 in the Linux Kernel, if the kvm_arch_vcpu_create() fails to share the vCPU page with the hypervisor. This vulnerability could even lead to a kernel information leak problem.

A flaw was found in the Linux kernel's USB Type-C Connector System Software Interface (UCSI) DisplayPort driver. When a USB Type-C DisplayPort device is disconnected, the driver does not ensure that pending background tasks finish executing before removing partner resources. A user with physical access could exploit this by unplugging the device during active operations, triggering a NULL pointer dereference and resulting in a system crash and Denial of Service (DoS).

A flaw was found in the HFSC queueing discipline implementation in the Linux kernel. When a packet is enqueued and the child qdisc's peek() function is called before properly updating the HFSC queue's length and backlog counters, a race condition can occur. In some cases, the peek operation may trigger an immediate dequeue and drop, leading to inconsistent queue accounting. This may leave an empty HFSC class in the active list, eventually causing use-after-free (UAF) conditions. Due to the nature of this memory corruption (use-after-free or list corruption) in kernel scheduler code, a successful exploit could lead to privilege escalation, data leakage, or denial of service. Therefore, the CIA impact is assessed as HHH to reflect a worst-case.

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request Make sure that n_channels is set after allocating the struct cfg80211_registered_device::int_scan_req member. Seen with syzkaller: UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:1208:5 index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]') This was missed in the initial conversions because I failed to locate the allocation likely due to the "sizeof(void *)" not matching the "channels" array type.

A flaw was found in the Linux kernel. The iSCSI (Internet Small Computer System Interface) target subsystem, which manages network-based storage connections, contains a vulnerability where a NOPIN response timer can improperly expire and restart on a deleted connection. This can lead to a NULL pointer dereference, a programming error that causes the system to crash. A local attacker could exploit this to cause a denial of service (DoS) on the affected system.

A flaw was found in the Linux kernel's ath12k wireless driver. When device initialization fails, the driver does not properly unregister an internal notification handler before its memory is freed during module unloading. A local privileged user could exploit this use-after-free vulnerability upon subsequent access to the handler, leading to a Denial of Service (DoS) through a system crash.

A flaw was found in the Linux kernel's Intel ice network driver. When attaching an eXpress Data Path (XDP) program to an affected network interface, a failure during transmit scheduler configuration is improperly rolled back, leaving network queues in an inconsistent state. A local user with administrative privileges can trigger this condition while loading network programs, resulting in a kernel crash and a Denial of Service (DoS).

A flaw was found in the Linux kernel's real-time scheduler. This vulnerability allows a local user to cause a Denial of Service (DoS) through a system crash. A race condition during task balancing across multiple processor cores can cause the scheduler to mismanage task migrations, leading to memory faults and kernel panics.

In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels Correct kernel call trace when calling smp_processor_id() when called in preemptible kernels by using raw_smp_processor_id(). smp_processor_id() checks to see if preemption is disabled and if not, issue an error message followed by a call to dump_stack(). Brief example of call trace: kernel: check_preemption_disabled: 436 callbacks suppressed kernel: BUG: using smp_processor_id() in preemptible [00000000] code: kworker/u1025:0/2354 kernel: caller is pqi_scsi_queue_command+0x183/0x310 [smartpqi] kernel: CPU: 129 PID: 2354 Comm: kworker/u1025:0 kernel: ... kernel: Workqueue: writeback wb_workfn (flush-253:0) kernel: Call Trace: kernel: <TASK> kernel: dump_stack_lvl+0x34/0x48 kernel: check_preemption_disabled+0xdd/0xe0 kernel: pqi_scsi_queue_command+0x183/0x310 [smartpqi] kernel: ...

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix crash in icl_update_topdown_event() The perf_fuzzer found a hard-lockup crash on a RaptorLake machine: Oops: general protection fault, maybe for address 0xffff89aeceab400: 0000 CPU: 23 UID: 0 PID: 0 Comm: swapper/23 Tainted: [W]=WARN Hardware name: Dell Inc. Precision 9660/0VJ762 RIP: 0010:native_read_pmc+0x7/0x40 Code: cc e8 8d a9 01 00 48 89 03 5b cd cc cc cc cc 0f 1f ... RSP: 000:fffb03100273de8 EFLAGS: 00010046 .... Call Trace: <TASK> icl_update_topdown_event+0x165/0x190 ? ktime_get+0x38/0xd0 intel_pmu_read_event+0xf9/0x210 __perf_event_read+0xf9/0x210 CPUs 16-23 are E-core CPUs that don't support the perf metrics feature. The icl_update_topdown_event() should not be invoked on these CPUs. It's a regression of commit: f9bdf1f95339 ("perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read") The bug introduced by that commit is that the is_topdown_event() function is mistakenly used to replace the is_topdown_count() call to check if the topdown functions for the perf metrics feature should be invoked. Fix it.

A flaw was found in the Linux kernel's lpfc driver. When handling the storage adapter BIOS version string, string concatenation triggers kernel memory safety checks that detect an unexpected buffer size and force a kernel panic. A local user or hardware initialization event can trigger this issue to crash the system, resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel. A local user can bypass security controls enforced by Linux Security Modules (LSM) when creating secret memory regions. Due to improper handling of internal security flags during anonymous file creation in the secret memory subsystem, the kernel fails to apply mandatory access controls such as Security-Enhanced Linux (SELinux). This issue allows an attacker to access protected memory descriptors without proper authorization, undermining system-level isolation.

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. sof_pdata->tplg_filename can have address allocated by kstrdup() and can be overwritten. Memory leak was detected with kmemleak: unreferenced object 0xffff88812391ff60 (size 16): comm "kworker/4:1", pid 161, jiffies 4294802931 hex dump (first 16 bytes): 73 6f 66 2d 68 64 61 2d 67 65 6e 65 72 69 63 00 sof-hda-generic. backtrace (crc 4bf1675c): __kmalloc_node_track_caller_noprof+0x49c/0x6b0 kstrdup+0x46/0xc0 hda_machine_select.cold+0x1de/0x12cf [snd_sof_intel_hda_generic] sof_init_environment+0x16f/0xb50 [snd_sof] sof_probe_continue+0x45/0x7c0 [snd_sof] sof_probe_work+0x1e/0x40 [snd_sof] process_one_work+0x894/0x14b0 worker_thread+0x5e5/0xfb0 kthread+0x39d/0x760 ret_from_fork+0x31/0x70 ret_from_fork_asm+0x1a/0x30

A flaw was found in the Linux kernel's SMB (Server Message Block) client. A timing race condition during the unmounting of a network file share can cause memory resources to be prematurely freed while an opportunistic lock break operation is still executing. A local user could exploit this use-after-free vulnerability to crash the system, resulting in a denial of service (DoS), or potentially escalate privileges.

A flaw was found in the Linux kernel's Bluetooth HCI UART driver. A race condition exists where the `hci_uart_write_work()` function may attempt to access uninitialized private data if a TTY write wakeup occurs during the protocol initialization phase. This can lead to a NULL pointer dereference, potentially causing a system crash and resulting in a Denial of Service (DoS).

A memory leak flaw was found in the Linux kernel's CIFS/SMB client. In the smb2_open_file() function, request buffers are not properly freed when performing direct I/O writes to a read-only SMB share. This causes slab cache objects to remain allocated, which can prevent the cifs module from unloading cleanly and lead to gradual memory exhaustion with repeated operations.