kernel: security/keys: fix missed RCU read section on lookup

A flaw was found in the Linux kernel's keyring code. The assocarrayfind function, used for looking up keys, was called without holding the necessary Read-Copy-Update RCU read lock. This oversight allows for a memory corruption vulnerability, particularly affecting persistent key handling, as the...

kernel: Bluetooth: virtio_bt: clamp rx length before skb_put

A flaw was found in the Linux kernel's virtio Bluetooth virtiobt driver. A malicious or faulty virtualized Bluetooth device could send a specially crafted message with an incorrect length. This could lead to the kernel reading uninitialized memory, potentially exposing sensitive information from...

kernel: vfio/pci: Clean up DMABUFs before disabling function

A flaw was found in the Linux kernel's vfio/pci subsystem. During device shutdown, an improper order of operations in cleaning up Direct Memory Access Buffers DMABUFs before disabling the function creates a brief window. In this window, a device's Base Address Registers BARs could still be access...

kernel: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses

A flaw was found in the Linux kernel. The mt7925 Wi-Fi driver incorrectly dispatches a memory-mapped I/O MMIO specific event to non-MMIO buses, such as USB. This improper handling leads to a NULL pointer dereference when attempting to clean up DMA transmit queues. A remote attacker could exploit...

kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER

A flaw was found in the Linux kernel's Bluetooth subsystem. Improper handling of locking within the hciconnrequestevt function, particularly when the HCIPROTODEFER protocol is active, can result in a Use-After-Free UAF vulnerability. This condition arises when a connection object is accessed afte...

kernel: wifi: mac80211: fix MLE defragmentation

A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. This vulnerability arises from incorrect handling of Multi-Link Element MLE defragmentation. When a reconf or EPCS Enhanced Power Save MLE is present in a non-transmitted profile, the defragmentation routine uses an incorrect pointe...

kernel: wifi: mt76: mt7925: fix crash in reset link replay

A flaw was found in the MediaTek mt7925 Wi-Fi driver within the Linux kernel. During a reset recovery process, the driver can attempt to access a network configuration that no longer exists. This can lead to a null pointer dereference, causing the system to crash and resulting in a Denial of...

kernel: wifi: mac80211: defer link RX stats percpu free to RCU

A flaw was found in the mac80211 Wi-Fi driver of the Linux kernel. When an MLO Multi-Link Operation link is removed, the RX statistics per-CPU buffer is freed immediately, while the link container is deferred to RCU Read-Copy-Update. This timing issue can lead to a use-after-free vulnerability,...

kernel: nvmet-auth: validate reply message payload bounds against transfer length

A flaw was found in the Linux kernel's nvmet-auth component. A remote attacker, by sending a specially crafted NVMe-oF NVMe over Fabrics authentication reply message, can cause an out-of-bounds read in the kernel's memory. This vulnerability, exploitable pre-authentication, can lead to the...

kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page

A flaw was found in the Linux kernel's nvmet subsystem. An unauthenticated remote attacker could exploit an out-of-bounds heap read vulnerability in the Discovery Get Log Page function. By sending a specially crafted request with a manipulated offset, an attacker could read sensitive kernel memor...

kernel: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()

A flaw was found in the Linux kernel's Server Message Block SMB client. A missing lock around the tccount increment in the smb2findsmbsesstconunlocked function creates a race condition. This vulnerability, caused by an incomplete refactoring of locking mechanisms, could lead to unexpected behavio...

kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership()

A flaw was found in the Linux kernel's iouring/poll component. A logic error exists in the iopollgetownership function due to an incorrect signed comparison. This flaw prevents the necessary slowpath from being triggered when the IOPOLLCANCELFLAG is set, potentially leading to unexpected behavior...

kernel: netfilter: nat: use kfree_rcu to release ops

A flaw was found in the Linux kernel's netfilter component, specifically within the Network Address Translation NAT subsystem. This vulnerability involves improper memory management when releasing network filter operation structures. This could potentially allow an attacker to cause a system cras...

kernel: can: bcm: add locking for bcm_op runtime updates

A flaw was found in the Linux kernel's Controller Area Network CAN broadcast manager BCM. Improper locking during runtime updates of internal counters in the bcmcantx function allows a local attacker to trigger a slab-out-of-bounds read access. This vulnerability can lead to information disclosur...

kernel: smb: client: fix change notify replay double-free

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability occurs due to a double-free error when handling change notify replies. If a response attempt returns a replayable error and frees its buffer, and then SMB2notifyinit fails, the same buffer can be freed agai...

kernel: nvmet-auth: validate reply message payload bounds against transfer length

A flaw was found in the Linux kernel's nvmet-auth component. A remote attacker, by sending a specially crafted NVMe-oF NVMe over Fabrics authentication reply message, can cause an out-of-bounds read in the kernel's memory. This vulnerability, exploitable pre-authentication, can lead to the...

kernel: smb: client: fix double-free in SMB2_close() replay

A flaw was found in the Linux kernel's Server Message Block SMB client. A vulnerability exists in the SMB2close replay mechanism where a response buffer can be freed twice. This double-free condition can lead to memory corruption, potentially resulting in a denial of service or the execution of...

kernel: net: add pskb_may_pull() to skb_gro_receive_list()

A flaw was found in the Linux kernel's network Generic Receive Offload GRO handling. An attacker sending specially crafted network packets could trigger a bug in the skbgroreceivelist function. This occurs when the system attempts to process network data that is not in the expected linear memory...

kernel: ipv6: anycast: insert aca into global hash under idev->lock

A flaw was found in the Linux kernel, specifically within its management of IPv6 anycast addresses. A timing issue, known as a race condition, can occur when these addresses are added and removed from a system's internal list. This can lead to the system attempting to access memory that has alrea...

kernel: ipv6: sit: reload inner IPv6 header after GSO offloads

A flaw was found in the Linux kernel's Simple Internet Transition SIT tunnel driver for IPv6. When processing network traffic with Generic Segmentation Offload GSO enabled, the driver may use a stale pointer to the inner IPv6 header after the socket buffer skb head has been reallocated. This can...