In the Linux kernel, the following vulnerability has been resolved:

nvmet-auth: fix out-of-bounds write in nvmetauthchallenge()

nvmetauthchallenge() receives its output buffer as a void pointer. sizeof(d) therefore evaluates to one with GCC and undercounts the fixed challenge header by 15 bytes. A short AUTHRECEIVE buffer can pass the check before the challenge is copied past the end of its allocation.

Use the typed challenge pointer when calculating the response size.

BUG: KASAN: slab-out-of-bounds in nvmetexecuteauthreceive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569) Write of size 32 by task kworker/1:1H/64 Workqueue: nvmettcpwq nvmettcpiowork Call Trace: nvmetexecuteauthreceive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569) nvmettcptryrecvpdu (drivers/nvme/target/tcp.c:1119 drivers/nvme/target/tcp.c:1243) nvmettcpiowork (drivers/nvme/target/tcp.c:1350 drivers/nvme/target/tcp.c:1382 drivers/nvme/target/tcp.c:1445) processonework (kernel/workqueue.c:3322) workerthread (kernel/workqueue.c:3405 kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) retfromfork (arch/x86/kernel/process.c:158) retfromforkasm (arch/x86/entry/entry64.S:245) The buggy address is located 16 bytes inside of allocated 33-byte region [ffff888000554e80, ffff888000554ea1) Kernel panic - not syncing: KASAN: paniconwarn set ...

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: bound check rqpages index in inline path

svcrdmacopyinlinerange indexed rqstp->rqpages[rccurpage] without verifying rccurpage stays within the allocated page array. Add guards before the first use and after advancing to a new page.

ftrace: Add global mutex to serialize traceparser access

In the Linux kernel, the following vulnerability has been resolved:

NFSv4: remove callback IDR entry on client allocation failure

nfs4allocclient() allocates an NFSv4.0 callback identifier before it finishes setting up the client. If any later initialization step fails, the error path frees the nfsclient directly with nfsfreeclient(). That bypasses nfsputclient(), which is where the callback IDR entry is removed during normal teardown.

A failed allocation can therefore leave cbidentidr pointing at a freed nfsclient. A later NFSv4.0 callback lookup by cbident would find the stale pointer and take a reference to it.

Make the callback IDR removal helper callable by the allocation failure path, and remove the callback identifier before freeing the client.

This was found by a local static-analysis checker for publish-before-free lifetime bugs and confirmed by manual inspection.

In the Linux kernel, the following vulnerability has been resolved:

wifi: wlcore: release runtime PM ref on regdomain config failure

wlcoreregdomainconfig() gets a runtime PM reference before sending the regulatory-domain command. When wlcorecmdregdomainconfiglocked() fails, the function queues recovery and returns without dropping that reference.

Release the reference after handling the command result so both success and failure paths balance the preceding pmruntimeresumeandget(). The recovery worker takes a separate runtime PM reference and cannot release the reference held here.

In the Linux kernel, the following vulnerability has been resolved:

wifi: p54: validate curve data length in the calibration curve converters

p54convertrev0() and p54convertrev1() read calibration curve data from the device-supplied EEPROM entry using channel and points-per-channel counts taken verbatim from that same entry, so an entry that declares more data than it carries drives an out-of-bounds read past the EEPROM buffer (verified with a KASAN reproducer of the conversion loop). The sibling converters p54convertoutputlimits() and p54convertdb() already validate their counts against the entry length; this path was missed.

Reject the entry when the counts do not fit in the entry data.

In the Linux kernel, the following vulnerability has been resolved:

mmc: sdhci-of-aspeed: Remove children before releasing SDC resources

Probe failure and removal leave SDHCI child devices registered after the parent clock and managed resources are released.

Unregister the OF children in reverse order before disabling the parent clock on both paths. Use ofplatformdevicedestroy() because manual child creation does not set the flag required by ofplatformdepopulate().

This issue was identified during our ongoing static-analysis research while reviewing kernel code.

In the Linux kernel, the following vulnerability has been resolved:

net: wwan: t7xx: validate the netif index in t7xxccmnirecvskb()

The netif index carried in the DPMAIF PIT header is five bits wide, but ccmniinst[] only has room for NICDEVMAX (21) entries. t7xxccmnirecvskb() indexes the array without a bounds check, so indexes 21 to 31 read past it. The out-of-bounds value lands in the callback table that follows the array, which is never NULL, so the existing !ccmni check does not catch it and the driver dereferences whatever sits there as a struct t7xxccmni.

Drop the skb when the index is out of range.

Verified in a QEMU guest with a fault injector setting the netif index to 25: the unpatched driver reads a value past ccmniinst[], which lands in the callback table, and dereferences it far enough to queue the skb. With this check the packet is dropped. Well-formed traffic on index 0 is unaffected.

Changes in v2: none.

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Bound fragmented header copies by the remaining length

siwgethdr() can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still limits the copy to hdrlen - MINDDPHDR instead of the number of missing bytes. This makes the destination move past the end of the header and overwrite the receive state, including fpdupartrcvd. A later callback can then use a negative fpdupartrcvd value as a copy offset, which creates an OOB write.

Use the number of header bytes already received when calculating the next copy length.

In the Linux kernel, the following vulnerability has been resolved:

wifi: p54: require a full expif record in PDRINTERFACELIST

The PDRINTERFACELIST loop only checks that the record start is within the entry before reading an entire struct expif from it. A truncated trailing record makes the ifid/variant reads cross the entry boundary into the heap beyond the EEPROM buffer (verified with a KASAN reproducer of the loop). The variant also feeds the synth front-end selection, so this is not only a leak.

Advance only while a full record still fits in the entry.

In the Linux kernel, the following vulnerability has been resolved:

nvme: fix FDP fdpcidx bounds check

The fdpcidx bounds check sets n = NUMFDPC + 1 but used > instead of >=, incorrectly accepting fdpidx when it equals n (i.e. NUMFDPC + 1).

In the Linux kernel, the following vulnerability has been resolved:

media: atomisp: gc2235: fix UAF and memory leak

gc2235probe() handles its error paths incorrectly.

If mediaentitypadsinit() fails, gc2235remove() is called, which tears down the subdev and frees dev, but then still falls through to atomispregisteri2cmodule(). This results in use-after-free.

If atomispregisteri2cmodule() fails, the media entity and control handler are left initialized and dev is leaked.

gc2235remove() unconditionally calls mediaentitycleanup() and v4l2ctrlhandlerfree(), but these are not initialized at every error path in gc2235probe().

Replace gc2235remove() calls in the probe error paths with explicit unwind labels that free only the resources initialized at each point of failure, in reverse order of initialization.

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent client use-after-free during admin state revocation

A stateid holds only a bare pointer to its nfs4client; a stateid reference does not pin it. The client survives only because destroyclient() drains its stateids before freeclient() runs.

nfsd4revokestates() drops nn->clientlock across revokeonestid(), which dereferences the client to revoke a stateid and read clp->clminorversion. A teardown racing the dropped lock can free the client first.

Pinning clrpcusers under clientlock blocks the DESTROYCLIENTID and EXCHANGEID teardown, which refuses while clrpcusers is non-zero. forceexpireclient() ignores it: once its wait for clrpcusers to reach zero has passed, a later pin goes unnoticed.

Under clientlock, skip a client whose cltime is already zero -- forceexpireclient() clears it there before waiting -- otherwise pin clrpcusers before dropping the lock. The walk then either sees the expiry and skips, or pins in time for that wait to cover the revoke.

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: cortina: Make RX SKB per-port

The SKB used to assemble packets from fragments in gmacrx() is static local, but the Gemini has two ethernet ports, meaning there can be races between the ports on a bad day if a device is using both.

Make the RX SKB a per-port variable and carry it over between invocations in the port struct instead.

Zero the pointer once we call napigrofrags(), on error (after calling napifreefrags()) or if the port is stopped.

Zero it in some place where not strictly necessary just to emphasize what is going on.

This was found by Sashiko during normal patch review.

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: publish GC-visible tuple last

nfflowtableiterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flowoffloadadd() is still inserting the reply node. Publish the reply node first and the original node last so GC never sees a partially installed flow.

KASAN can trigger slab-use-after-free read and write reports in the flowtable/rhashtable path (rhtdeferredworker, jhash, flowoffloaddel, flowoffloadlookup, etc.).

In the Linux kernel, the following vulnerability has been resolved:

s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs

There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for sending to a crypto card. This check is only active on custom device nodes but may lead to access heap memory behind perms->adm when an administrative CPRB is sent. Add correct limit (APDOMAINS = 256) checking to fix this.

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: fix refcount bug in iwpmgetnlmsgrequest()

iwpmgetnlmsgrequest() initializes refcount after listaddtail() making it accessible to global list where another CPU can krefget() on nlmsgrequest causing a refcount "addition on 0" bug. Fix this by initializing kref before listaddtail() so refcount for nlmsgrequest can be incremented/decremented normally. In addition, also initialize every field before listaddtail().

In the Linux kernel, the following vulnerability has been resolved:

KEYS: trusted: Fix tpm2loadcmd() boundary check

tpm2loadcmd() does boundary checks against the ASN.1 size i.e., payload->bloblen. Address this by passing the decoded blob size to tpm2loadcmd(), and use it for the boundary checks.

In the Linux kernel, the following vulnerability has been resolved:

wifi: virtwifi: free skb when disconnected

When the simulated link is disconnected, virtwifistartxmit() returns NETXMITDROP without freeing the skb. devhardstartxmit() treats this return value as consumed, so every packet sent while disconnected leaks its skb.

Free the skb before returning the drop status.

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix rlist race and missing initialization

TCPServerInfo.rlist is allocated via kzalloc which zeros both ->next and ->prev to NULL instead of pointing to itself, making listempty() always return false and listadd() dereference a NULL ->prev pointer.

Also, cifssignalcifsdforreconnect() can be called concurrently from multiple cifsd threads, allowing the same server's rlist node to be added twice into the local list, corrupting it.

ASoC: codecs: rt712-sdca-dmic: fix uninitialized streamconfig->type

In the Linux kernel, the following vulnerability has been resolved:

wifi: virtwifi: don't transfer operstate before register

virtwifinewlink() calls netifstackedtransferoperstate() before registernetdevice(). If the lower device is dormant, that queues the new netdev on lweventlist while it is still uninitialized. If registration fails after that, for example because of an invalid name such as "bad/name", freenetdev() immediately frees the object. A later linkwatchfireevent() then use-after-frees the list entry.

Move the transfer to after netdevupperdevlink(), as macvlan and ipvlan already do.

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: check IP header size in cfg80211classify8021d()

A frame that looks like IP can be transmitted, but be too short, so the DS field is read incorrectly:

BUG: KMSAN: uninit-value in cfg80211classify8021d+0x99d/0x12b0 net/wireless/util.c:1027 cfg80211classify8021d+0x99d/0x12b0 net/wireless/util.c:1027 ieee80211selectqueue+0x37a/0x9e0 net/mac80211/wme.c:180 ieee80211subifstartxmit+0x60f/0x1d90 net/mac80211/tx.c:4304 ieee80211subifstartxmit+0xa8/0x6d0 net/mac80211/tx.c:4538 ... packetsendmsg+0x9173/0xa2a0 net/packet/afpacket.c:3108

Use skbheaderpointer() like the MPLS case.

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent lock owner use-after-free during client teardown

destroyclient() releases a client's open owners, but a lock owner whose only reference is a blocked lock (nbl) stays on clownerstrhashtbl. clienthasstate() does not count a bare owner, so DESTROYCLIENTID can reach destroyclient() with such owners present.

destroyclient() then walks the table, calling removeblockedlocks() on each owner without a reference. Freeing a blocked lock drops the owner reference held via flcowner. The per-net laundromat reaps blocked locks from nn->blockedlockslru independently of client state. The two paths share blockedlockslock only for the list splice, not the owner's lifetime. The laundromat therefore frees the owner as destroyclient() dereferences it, a NULL dereference in removeblockedlocks().

nfsd4releaselockowner() holds a reference across the same call; destroyclient() does not. Hold cllock across the walk, taking a reference and unhashing each owner, then drop it before removeblockedlocks() and nfs4putstateowner(), which take blockedlockslock and cllock.

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: cortina: Carry over frag counter

The gmacrx() NAPI poll function assembles packets in an SKB from a ring buffer.

If the ring buffer gets completely emptied during a poll cycle, we exit gmacrx(), but the packet is not yet completely assembled in the SKB, yet the fragment counter fragnr is reset to zero on the next invocation.

Solve this by making the RX fragment counter a part of the port struct, and carry it over between invocations.

Reset the fragment counter only right after calling napigrofrags(), on error (after calling napifreefrags()) or if stopping the port.

Reset it in some place where not strictly necessary just to emphasize what is going on.

This was found by Sashiko during normal patch review.

btrfs: do not trim a device which is not writeable

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Fix endpoint/socket association handling

Disassociating a socket from an endpoint via siwsocketdisassoc() may release the last reference on that endpoint and free it. Therefore, don't clear the endpoints socket pointer after calling that function, but within.

This fixes a:

BUG: KASAN: slab-use-after-free in siwcmworkhandler (drivers/infiniband/sw/siw/siwcm.c:1053 drivers/infiniband/sw/siw/siwcm.c:1075)

which occurred after processing a malformed MPA request during connection establishment, causing the new endpoint to be closed.

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: bound Read Response placement to the RREAD length

In drivers/infiniband/sw/siw/siwqprx.c, siwprocrresp() places each inbound Read Response DDP segment at sge->laddr + wqe->processed and then accumulates wqe->processed, but it never checks the running total against the sink buffer length on continuation segments. siwchecksge() resolves and validates the sink memory only on the first fragment (the if (!mem) branch), and siwrrespcheckntoh() compares the cumulative length against wqe->bytes only on the final segment (the !frx->moreddpsegs guard).

A connected siw peer that answers an outstanding RREAD with Read Response segments that keep the DDP Last flag clear, carrying more total payload than the RREAD requested, drives wqe->processed past the validated sink buffer; the next siwrxdata() call writes out of bounds at sge->laddr + wqe->processed. siw runs iWARP over ordinary routable TCP, so the peer is the remote end of an established RDMA connection and needs no local privilege.

Bound every segment before placement, exactly as siwprocsend() and siwprocwrite() already do for their tagged and untagged paths, and terminate the connection with a base-or-bounds DDP error when the Read Response would overrun the sink buffer.

This is the second receive-path length fix for this file. A separate change rejects an MPA FPDU length that underflows the per-fragment remainder in the header decode; that guard does not cover this case, because here each individual segment length is self-consistent and only the accumulated placement offset overruns the buffer.

arm64: hibernate: pass HVCSETVECTORS args to the resume hvc

In the Linux kernel, the following vulnerability has been resolved:

media: saa7134: Fix a possible memory leak in saa7134videoinit1

In saa7134videoinit1(), the return value of the first saa7134pgtablealloc() is not checked. If it fails, the function continues as if successful, leaving the driver with an invalid page table. Additionally, if vb2queueinit() for the VBI queue fails after the video queue page table has been allocated, the allocated memory is not freed before returning. The second saa7134pgtablealloc() also lacks a return value check. Errors occur during device probing before the device is fully registered, the normal cleanup path in saa7134finidev() is not executed, leading to memory leaks and potential use of uninitialized DMA resources.

Check the return value of both saa7134pgtablealloc() calls and propagate errors. On failure of any later step, free allocated page tables to avoid memory leaks. Ensure control handlers are also released on error to prevent further resource leakage.

Found by code review.