Gregkh

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An issue exists during device shutdown where the `vfio pci core close device()` function may not revoke DMABUF access before the function is disabled via `vfio pci core disable()`. This creates a small window of time where the function's Memory Space Enable (MSE) is cleared, but Base Address Registers (BARs) remain accessible via the DMABUF. Consequently, these resources could be freed and potentially accessed by a different driver. DMABUF is a framework in the Linux kernel that allows sharing buffers between different drivers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An issue exists in the thunderbolt component where the `tb xdp properties request()` function derives the per-packet copy length from the response header without verifying if it fits within the previously allocated data buffer. A malicious peer can manipulate the length field to be larger than the declared `data length`, leading to a memory corruption where `memcpy` writes beyond the `kcalloc` allocation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An issue exists in the `accel/ivpu` component where the `get info ioctl()` function fails to validate the info size returned from the metric stream info query against the allocated buffer size. This lack of validation could lead to a buffer overflow if the firmware returns a size larger than the available buffer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A heap overflow exists in the `get manuf info()` function. The issue occurs because the function reads a number of bytes specified by the `Size` field from a device I2C EEPROM into a buffer allocated with `kmalloc obj()`, which has a fixed size of 10 bytes. While the `Size` field is validated in `check i2c image()` to ensure it does not exceed 16384 bytes, it is not checked against the actual destination buffer size. A malicious USB device can set the `Size` field to a value up to 16377, leading to a heap overflow of up to 16367 bytes. Additionally, the `valid csum()` function iterates through the buffer based on the `Size` field, further compounding the out-of-bounds access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An issue exists in the `memcg reparent list lrus()` function where the xarray entry of a dying memory control group (memcg) is cleared using `xas store(&xas, NULL)` before its per-node lists are reparented. This sequence creates a race condition where a concurrent `list lru del()` operation may fail to find the entry via `xa load()`, proceed to the parent memcg in `lock list lru of memcg()`, and execute `list del init()` on an item still linked to the dying memcg's list. If another thread simultaneously holds the dying memcg's per-node lock—such as during another `list lru del()` or a `list lru walk one()` isolate callback—both threads may modify the `->next` and `->prev` pointers of the same physical list using different locks, leading to the corruption of adjacent items' links. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A double-free flaw exists in the Transparent Inter-Process Communication (TIPC) module. The issue occurs within the `tipc buf append()` function when it incorrectly handles memory after a socket buffer (skb) reallocation. Specifically, `tipc msg validate()` may reallocate the skb it is validating and free the old one; if validation subsequently fails, the error handling path frees the original skb pointer again. This memory corruption can lead to system instability, denial of service, or potentially arbitrary code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An issue exists in the checkpoint/restore sysctl path where the `ipc idr alloc()` function forwards requests to `idr alloc()` with an open-ended upper bound. When the valid SysV IPC id space is full, allocations can exceed `ipc mni`, resulting in IDs that use normal index encoding but target incorrect slots during lookup and removal. This process breaks the IDR state and can leave a dangling pointer in the IDR entry. Specifically, for shared memory, `shm destroy()` may free an object while leaving a stale entry that, when accessed via `/proc/sysvipc/shm`, leads to a dereference of freed memory. The flaw is located in the `ipc idr alloc()` function, specifically when `ids->next id` is passed to `idr alloc()` with a zero upper bound. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An integer overflow exists in the `kvm reset dirty gfn()` function within the Kernel-based Virtual Machine (KVM) component. A local attacker with access to `/dev/kvm` can manipulate dirty ring entries to cause a u64 wrap during an unchecked addition. This allows the attacker to bypass a bounds check, leading to an out-of-bounds load of a `kvm rmap head` and a subsequent conditional clear of `PT WRITABLE MASK` in the memory location pointed to by the loaded pointer. This flaw can result in information disclosure or a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** Two error handling issues exist within the `drm/xe` graphics driver in the `xe exec queue create ioctl()` function. The first issue occurs when `xe hw engine group add exec queue()` fails; the error path skips `xe exec queue kill()`, which leaves the queue on the VM's compute exec queue list if the VM is in preempt fence mode, resulting in a dangling pointer. The second issue occurs when `xa alloc()` fails after `xe hw engine group add exec queue()` succeeds; the error path fails to call `xe hw engine group del exec queue()`, leaving the queue linked into the hw engine group while it is being freed, causing a use-after-free. A local attacker could exploit these flaws to cause a system crash or gain elevated privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A flaw in the netfilter conntrack module occurs due to the use of the `sprintf()` function and insufficient buffer sizing within the `mangle content len()` function. This can lead to a stack-out-of-bounds write, a type of memory corruption where data is written beyond the boundaries of a fixed-length buffer on the stack. This issue could potentially be exploited to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A Use-After-Free (UAF) error exists in the IPv6 implementation of the Linux kernel. This issue occurs within the `icmpv6 rcv()` function due to the incorrect caching of source and destination addresses (`saddr` and `daddr`) before a `pskb pull()` operation, which can cause the memory address of the socket buffer head (`skb->head`) to change. This memory corruption may result in a denial of service or arbitrary code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A flaw in the ice network driver occurs during network packet transmission. When the `ice tso()` or `ice tx csum()` functions fail, the error path in `ice xmit frame ring()` frees the network buffer (skb), but the transmit buffer (`tx buf`) continues to point to it and remains marked as valid. If the network interface is brought down before another packet is transmitted to overwrite the buffer, the `ice clean tx ring()` function calls `ice unmap and free tx buf()`, which frees the skb a second time. This double-free can result in a system crash or denial of service (DoS). **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A flaw exists in the Berkeley Packet Filter (BPF) verifier within the `regsafe()` function. The issue occurs when comparing two scalar registers that both carry `BPF ADD CONST` values; the `check scalar ids()` function maps their full compound IDs as a single entry but fails to verify that the underlying base IDs are consistent with existing mappings. This inconsistency allows for the construction of verifier states where state pruning incorrectly succeeds, potentially enabling a bypass of security mechanisms and allowing unauthorized operations or unexpected system behavior. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An issue exists in the BPF (Berkeley Packet Filter) verifier regarding linked register delta tracking. When the source register `src reg` and destination register `dst reg` are pointers to the same `bpf reg state` within the `adjust reg min max vals()` function, the destination register is modified in-place. Consequently, subsequent calls to `is reg const(src reg)` and `reg const value(src reg)` read the value after the addition or subtraction instead of the original source value. This results in an incorrect delta that `sync linked regs()` propagates to linked registers, leading to a mismatch between the verifier and the actual runtime behavior. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A race condition exists in the Input/Output Memory Management Unit (IOMMU) subsystem, which manages how devices access system memory. This occurs during device recovery when multiple memory domains are attached concurrently. Specifically, the ` iommu group set domain internal()` function rejects concurrent domain attachments if any device in the group is recovering, which triggers a WARN ON in ` iommu group set domain nofail()`. This can lead to a Use-After-Free (UAF) condition—where the system attempts to use memory that has already been released—potentially allowing a local attacker to execute unauthorized code or cause a system crash (denial of service). **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An issue exists in the Linux kernel where the `xe vm madvise ioctl()` function fails to validate Page Attribute Table (PAT) indices. Specifically, using the `XE COH NONE` coherency mode with CPU cached buffers allows a GPU to bypass CPU caches and read stale, sensitive data directly from DRAM. This occurs because when the kernel clears pages before reallocation, the clear operation may remain in the CPU cache as dirty data, potentially leaking information from previously freed pages belonging to other processes. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A use-after-free or type confusion issue exists in the SCTP implementation of the Linux kernel. In the `sctp sendmsg()` function, the `SCTP SENDALL` path iterates through associations using `list for each entry safe()`, which caches the next entry in the `tmp` variable. The function calls `sctp sendmsg to asoc()`, which may drop the socket lock within `sctp wait for sndbuf()`. While the lock is released, another thread can migrate the cached association to a new endpoint via `sctp sock migrate()` or free it due to a network ABORT. Because the `tmp` variable is not revalidated after the lock is re-acquired, the iterator may advance to a stale pointer, leading to a use-after-free if the socket was closed, or type confusion if the association was migrated. The type confusion path can allow a controlled indirect call via the `outqueue.sched->init sid` pointer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) openSUSE Tumbleweed versions prior to kernel-devel-7.0.11-1.1 **Description** A use-after-free or double-free condition exists in the mac80211 wireless subsystem when debugfs is enabled. This occurs during MLO (Multi-Link Operation) connections if connection preparation fails, causing the interface to reset to non-MLD (Multi-Link Device). In this scenario, the system fails to remove the associated station, leading to memory corruption because the virtual interface (vif) recreates its entire debugfs structure. **Recommendations** Update to a version where the fix for the mac80211 station removal is implemented. Update to kernel-devel-7.0.11-1.1 or a newer version.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A Use-After-Free (UAF) issue exists in the ALSA loopback driver. The `loopback check format()` function may stop the capture side when playback starts with parameters that do not match a running capture stream. While peer lookup is performed under `cable->lock`, the `snd pcm stop()` function executes after the lock is released. A concurrent close operation can remove the capture entry from `cable->streams[]` and free its runtime while the playback trigger path still holds a stale peer substream pointer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A use-after-free issue exists in the Linux kernel due to a missing zerocopy reference in the `pskb carve inside header()` and `pskb carve inside nonlinear()` functions. Both functions copy the `skb shared info` header into a new buffer using `memcpy()`, which includes the `destructor arg` pointer (`uarg`) for MSG ZEROCOPY skbs. Because these functions fail to call `net zcopy get()` for the new `shinfo`, the reference count `uarg->refcnt` can be driven to zero prematurely. This leads to the premature freeing of `ubuf info msgzc` while TX skbs still hold active `destructor arg` pointers. This flaw has been verified to allow an unprivileged local user to achieve full root privilege escalation on a default kernel configuration. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.