Nicht bewertetEPSS 0,2%Keine Korrektur veröffentlicht
OPP: Fix cleanup ordering
In the Linux kernel, the following vulnerability has been resolved:
OPP: Fix cleanup ordering
Commit 173e02d67494 ("OPP: Initialize scope-based pointers inline")
added initialization for all pointers. In some cases, the ordering was
changed so that *opp_table was initialized after *opp. This also changes
the order of the registered cleanup functions.
When the cleanup happens, this can cause use-after-free errors when the
last reference is released and the release function _opp_kref_release
tries to access the already freed opp->opp_table.
Initialize *opp_table before *opp again to fix this and ensure the
correct cleanup order.
Nicht bewertetEPSS 0,21%Keine Korrektur veröffentlicht
drm/amd/display: Fix DM I2C teardown race
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix DM I2C teardown race
DM I2C adapters can remain visible to userspace while DM teardown is
already in progress. A concurrent i2c-dev transfer may then enter
amdgpu_dm_i2c_xfer() after the backing DM state has been torn down,
leading to a NULL pointer dereference.
Create a devres group around the DM I2C adapter lifetime and release it
at the start of dm_hw_fini(), before HPD, IRQ, and DM state are torn
down. This removes the I2C adapters first and waits for in-flight users
to drain before the structures used by amdgpu_dm_i2c_xfer() disappear.
This fixes
Nicht bewertetEPSS 0,18%Keine Korrektur veröffentlicht
drm/bridge: tc358767: clamp the reported AUX read size to the request
In the Linux kernel, the following vulnerability has been resolved:
drm/bridge: tc358767: clamp the reported AUX read size to the request
tc_aux_transfer() clamps an AUX read to the payload limit:
size_t size = min_t(size_t, DP_AUX_MAX_PAYLOAD_BYTES - 1, msg->size);
After the transfer it replaces size with the byte count the controller
reports in AUX_BYTES:
if (size)
size = FIELD_GET(AUX_BYTES, auxstatus);
AUX_BYTES is GENMASK(15, 8), so it can be up to 255. Nothing clamps it
back to the request. tc_aux_read_data() reads that many bytes into the
16-byte auxrdata stack buffer, then copies them into the caller buffer. A
reported count
Nicht bewertetEPSS 0,17%Keine Korrektur veröffentlicht
x86/mm/pat: Take cpa_lock around large-page collapse
In the Linux kernel, the following vulnerability has been resolved:
x86/mm/pat: Take cpa_lock around large-page collapse
Loading and unloading modules concurrently on several CPUs on a KASAN
build, with a short delay injected at the CPA page-table lookup to
widen the window, faults within minutes:
BUG: KASAN: use-after-free in __change_page_attr+0x7cc/0x7e0
Write of size 8 at addr ffff888181139718 by task modprobe
...
The buggy address belongs to the physical page:
pfn:0x181139 ... page_type: f2(table)
cpa_collapse_large_pages() rebuilds a leaf PMD from its 4K PTEs and
frees the old PTE-table pages, while __change_page_attr() f
Nicht bewertetEPSS 0,17%Keine Korrektur veröffentlicht
wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs
The loop counter 'count' was declared as u8 while num_pc is u32.
If firmware advertises more than 255 PC entries the counter wraps
back to zero and the loop never terminates potentially causing an
infinite loop or reading past the allocated pc_data array.
Change the declaration to u32 to match num_pc.
Nicht bewertetEPSS 0,17%Keine Korrektur veröffentlicht
wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser
iwl_mvm_frob_txf_key_iter() tracks the last matched byte position
in loop variable 'i'. When a full key match is found (match ==
keylen), 'i' points at the last byte of the matched key. The
memset start offset should therefore be i + 1 - keylen, not
i - keylen; the current code zeroes one byte before the match
and leaves the final key byte un-sanitised.
wifi: iwlwifi: mei: check SAP message length before reading it
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mei: check SAP message length before reading it
Verify the SAP message size is not larger than the local buffer before
reading the message to avoid buffer overflow.
Nicht bewertetEPSS 0,21%Keine Korrektur veröffentlicht
wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments
Make sure we don't end-up with a num_frags = 0 situation.
For that, check that the required size is not 0 and put a checker on
num_frags as well.
Nicht bewertetEPSS 0,22%Keine Korrektur veröffentlicht
gpu: host1x: Avoid stack over-read in debug output helpers
In the Linux kernel, the following vulnerability has been resolved:
gpu: host1x: Avoid stack over-read in debug output helpers
host1x_debug_output() and host1x_debug_cont() used vsnprintf(), which
returns the length the formatted string would have reached with an
unbounded buffer. That return value was passed straight to o->fn as
the number of bytes to emit.
This could cause a read past end of the output buffer if a call to
host1x_debug_* produced a string longer than 256 bytes. This only
affected the debugfs files as the printk debug sink ignores the
number of bytes. In practice, this is very unlikely to occur.
Fix by switching to vscnpr
Nicht bewertetEPSS 0,2%Keine Korrektur veröffentlicht
drm/msm/adreno: fix use after free on error path in a6xx_gpu_init()
In the Linux kernel, the following vulnerability has been resolved:
drm/msm/adreno: fix use after free on error path in a6xx_gpu_init()
The a6xx_destroy() function frees "a6xx_gpu" and so "adreno_gpu" points
to freed memory. Preserve the error code before freeing the memory to
avoid a use after free.
Patchwork: https://patchwork.freedesktop.org/patch/732275/
Nicht bewertetEPSS 0,21%Keine Korrektur veröffentlicht
drm/msm: Fix task_struct reference leak in recover_worker
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: Fix task_struct reference leak in recover_worker
get_pid_task() increments the task reference count, but the
corresponding put_task_struct() was missing in the else branch,
leaking a reference on every GPU hang recovery.
Patchwork: https://patchwork.freedesktop.org/patch/730662/
Nicht bewertetEPSS 0,21%Keine Korrektur veröffentlicht
drm/msm: Only fini scheduler after successful init
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: Only fini scheduler after successful init
msm_ringbuffer_new() destroys a partially initialized ring through
msm_ringbuffer_destroy() when an allocation or scheduler setup step
fails.
If drm_sched_init() fails before it finishes initializing the scheduler,
the failure path still calls drm_sched_fini(). That teardown path assumes
the scheduler work items, lists, and workqueue state were initialized.
Track successful scheduler initialization and call drm_sched_fini() only
after drm_sched_init() returned 0.
This issue was found by a static analysis checker and conf
Nicht bewertetEPSS 0,2%Keine Korrektur veröffentlicht
scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context
TX EQTR may run while devfreq gear scaling has quiesced the UFS
tagset. In that context, functions ufshcd_tx_eqtr(), __ufshcd_tx_eqtr()
and ufs_qcom_get_rx_fom() allocate memory with GFP_KERNEL. If direct
reclaim is triggered, reclaim/writeback can depend on I/O to UFS
device. Because the queue is quiesced, this can cause deadlock.
Use memalloc_noio_save/restore() in ufshcd_tx_eqtr() to cover all
allocations in the TX EQTR call tree, including:
- params->eqtr_record in ufshcd_tx_eqtr()
- eqtr_da
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_uac1_legacy: remove broken string configfs attributes
The UAC1_STR_ATTRIBUTE macro defines configfs show/store handlers for
the fn_play, fn_cap, and fn_cntl string options. The store function
contains an inverted null check on the kstrndup() return value.
This means every write attempt returns -ENOMEM on success and
dereferences a NULL pointer on allocation failure. The attributes
have been broken and unused for many years.
Remove the UAC1_STR_ATTRIBUTE macro and the three attributes it
generated. The internal defaults (FILE_PCM_PLAYBACK, FILE_PCM_CAPTURE,
Nicht bewertetEPSS 0,18%Keine Korrektur veröffentlicht
UDF symlink pathComponent header OOB read
In the Linux kernel, the following vulnerability has been resolved:
UDF symlink pathComponent header OOB read
udf_symlink_filler() can enter udf_pc_to_char() with a partial pathComponent header.
Validate that enough input remains for a complete pathComponent header
before accessing it. Reject malformed symlink data that would otherwise
make udf_pc_to_char() perform an out-of-bounds read.
uio: Fix stale info pointer in failed registration path
In the Linux kernel, the following vulnerability has been resolved:
uio: Fix stale info pointer in failed registration path
After device_add(), the UIO device is visible to userspace and /dev/uioX
can be opened. If a later setup step fails, __uio_register_device()
unwinds the device but leaves idev->info pointing at the caller-owned
struct uio_info.
That is unsafe when an opener races with the failed registration path.
The open file keeps a reference to the uio_device, while the caller sees
registration failure and may free its struct uio_info. Later file
operations can then follow idev->info and dereference freed memory.
Handle post-devi
Nicht bewertetEPSS 0,18%Keine Korrektur veröffentlicht
speakup: keyhelp: guard letter_offsets possible out-of-range indexing
In the Linux kernel, the following vulnerability has been resolved:
speakup: keyhelp: guard letter_offsets possible out-of-range indexing
help_init() builds letter_offsets[] by using the first byte of each
function name as an index via `(start & 31) - 1`. If function_names are
overridden from sysfs (root) with a name starting outside [a–z], the
index underflows or exceeds the array, leading to OOB write.
Function names can be overridden with the following commands as root:
modprobe speakup_soft
echo "0 _bad" > /sys/accessibility/speakup/i18n/function_names
# then press Insert+2 on /dev/tty
This fix checks the first letter in
Nicht bewertetEPSS 0,21%Keine Korrektur veröffentlicht
misc: bcm-vk: Use acquire/release for msgq_inited
In the Linux kernel, the following vulnerability has been resolved:
misc: bcm-vk: Use acquire/release for msgq_inited
bcm_vk_sync_msgq() fills the message queue information and then sets
msgq_inited. Readers call bcm_vk_drv_access_ok() before accessing the
message queues and their cached queue information.
atomic_set()/atomic_read() do not order those accesses. A reader can see
msgq_inited set while still seeing stale queue information. Use release
when publishing the initialized queues and acquire when checking the gate.
Keep the clear in bcm_vk_blk_drv_access() as atomic_set(). It closes the
gate and does not publish queue state to read
Nicht bewertetEPSS 0,22%Keine Korrektur veröffentlicht
misc: ad525x_dpot: use driver core groups for sysfs files
In the Linux kernel, the following vulnerability has been resolved:
misc: ad525x_dpot: use driver core groups for sysfs files
ad_dpot_probe() creates per-RDAC sysfs files manually and then
optionally creates the command sysfs group. This leaves probe responsible
for rolling back partial sysfs state and makes remove responsible for
matching every file that probe created.
Move the device attributes into driver core dev_groups for the I2C and
SPI drivers and use an is_visible() callback to expose only the
attributes supported by the probed device. With this shape, the driver
core creates the sysfs files only after probe succeeds and removes t
Nicht bewertetEPSS 0,21%Keine Korrektur veröffentlicht
ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove
In the Linux kernel, the following vulnerability has been resolved:
ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove
Three issues arise when the device is removed while a tty session is
still active:
1. UAF of struct ipoctal: the remove callback frees ipoctal via
kfree() while tty ops may still access it. Fix by introducing
kref-based lifetime management — kref is taken in install() when
a tty is opened and released in cleanup() when the tty is finally
destroyed; remove() uses kref_put() instead of kfree().
2. NULL dereference in ipoctal_write_tty(): __ipoctal_remove()
frees xmit_buf via tty