In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: unregister debugfs entries on teardown

ucsiregister() creates per-instance debugfs entries, but ucsiunregister() keeps them around until ucsidestroy().

Drivers like ucsiglink that unregister/register the same UCSI instance across remoteproc restart then try to create an already existing debugfs directory and log:

debugfs: 'pmicglink.ucsi.0' already exists in 'ucsi'

Unregister debugfs entries as part of ucsiunregister(), and clear ucsi->debugfs after freeing it so repeated unregister paths remain safe.

Bluetooth: hcicore: Fix race condition during device registration

btrfs: fix the possible bioclist memory leak during error

btrfs: do not force reloc root creation during qgroupaccountsnapshot()

In the Linux kernel, the following vulnerability has been resolved:

ipvs: fix reversed sequence option serialization

htonseq() expects the host-order source first and the unaligned network-order destination second. The version 1 sync sender passes these arguments in reverse for both sequence blocks. This leaves 24 bytes of the kmalloc-backed message unwritten. It may disclose stale heap data and replace the live connection sequence state with values read from the buffer.

Pass the connection sequence state as the source and the message payload as the destination for both blocks.

In the Linux kernel, the following vulnerability has been resolved:

bpf: Mark signal tracepoint siginfo arguments as scalar

The signalgenerate and signaldeliver tracepoints declare their info argument as a struct kernelsiginfo pointer. btfctxaccess() therefore treats it as a trusted pointer for tpbtf programs.

Signal delivery also uses SENDSIGNOINFO and SENDSIGPRIV as special values for this argument. Those values are zero and one respectively, and are not pointers. A tpbtf program can currently dereference either value and fault the kernel. In particular, signalgenerate can run from timer interrupt context, turning the fault into a kernel panic.

Record both tracepoints in rawtpnullargs[] and mark argument one as a non-pointer. This preserves scalar access to the cookie while rejecting direct and helper-mediated pointer use. Merely marking it nullable would not suffice because SENDSIGPRIV is nonzero.

In the Linux kernel, the following vulnerability has been resolved:

ASoC: Intel: avs: Fix unbalanced module reference count

straceopen() invokes trymoduleget() which on success takes the module reference. If any follow up operation causes straceopen() to fail, the refcount shall be put down.

In the Linux kernel, the following vulnerability has been resolved:

net: bcmasp: fix txspbringfull() checking same slot cnt times

The loop initialised nextindex from intf->txspbindex on every iteration, so incrring() always produced the same result and only one slot was ever tested. Move the initialisation before the loop so each iteration advances nextindex and the function correctly checks that cnt consecutive descriptor slots are available before allowing a new transmission.

gpio: eic-sprd: use rawspinlockt in the irq startup path

In the Linux kernel, the following vulnerability has been resolved:

iouring/nop: fix file reference leak with IOSQEFIXEDFILE

NOP file-acquisition support choses between a fixed (registered) file and a normal fget()'d file based on its own IORINGNOPFIXEDFILE flag in sqe->nopflags. However, a request's REQFFIXEDFILE is set independently from the generic IOSQEFIXEDFILE sqe flag during request init, before the issue handler runs.

If a NOP is submitted with IOSQEFIXEDFILE set (so REQFFIXEDFILE is set) but without IORINGNOPFIXEDFILE, ionop() takes the normal path and grabs a real reference via iofilegetnormal(). On completion, ioputfile() only drops the reference when REQFFIXEDFILE is clear, so the fget()'d file is never released and leaks:

BUG: memory leak unreferenced object 0xffff88800f42c240 (size 176): kmemcacheallocnoprof+0x358/0x440 allocemptyfile+0x57/0x180 pathopenat+0x44/0x1e50 dofileopen+0x121/0x200 dosysopenat2+0xa7/0x150 x64sysopenat+0x82/0xf0

Decide between fixed and normal file acquisition from REQFFIXEDFILE, the same way ioassignfile() does for every other opcode, and fold IORINGNOPFIXEDFILE into REQFFIXEDFILE at prep time.

In the Linux kernel, the following vulnerability has been resolved:

mm/shrinker: do not hold RCU lock in shrinkerdebugfscountshow()

Reading the debugfs "count" file of a memcg-aware shrinker can sleep inside an RCU read-side critical section:

BUG: sleeping function called from invalid context at kernel/cgroup/rstat.c:421 RCU nest depth: 1, expected: 0 cssrstatflush memcgroupflushstats zswapshrinkercount shrinkerdebugfscountshow

shrinkerdebugfscountshow() invokes the ->countobjects() callback under rcureadlock(). The zswap callback flushes memcg stats via cssrstatflush(), which may sleep, so it must not run under RCU.

The RCU lock is not needed here. memcgroupiter() takes RCU internally and returns a memcg holding a css reference (dropped on the next iteration or by memcgroupiterbreak()), so the memcg stays alive without it. The shrinker is kept alive by the open debugfs file: shrinkerfree() removes the debugfs entries via debugfsremoverecursive(), which waits for in-flight readers to drain, before callrcu(..., shrinkerfreercucb). The sibling "scan" handler already invokes the sleeping ->scanobjects() callback with no RCU section.

Drop the rcureadlock()/rcureadunlock().

In the Linux kernel, the following vulnerability has been resolved:

mm: shrinker: fix NULL pointer dereference in debugfs

shrinkerdebugfsadd() creates both "count" and "scan" debugfs files unconditionally.

That assumes every shrinker implements both countobjects() and scanobjects(), which is not guaranteed. For example, the xen-backend shrinker sets countobjects() but leaves scanobjects() NULL, so writing to its scan file calls through a NULL function pointer and panics the kernel:

BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. Call Trace: <TASK> shrinkerdebugfsscanwrite+0x12e/0x270 fullproxywrite+0x5f/0x90 vfswrite+0xde/0x420 ? filpflush+0x75/0x90 ? filpclose+0x1d/0x30 ? dodup2+0xb8/0x120 ksyswrite+0x68/0xf0 ? filpflush+0x75/0x90 dosyscall64+0xb3/0x5b0 entrySYSCALL64afterhwframe+0x76/0x7e

The count path has the same issue in principle if a shrinker omits countobjects().

To fix it, only create "count" and "scan" debugfs files when the corresponding callbacks are present.

In the Linux kernel, the following vulnerability has been resolved:

mm/swap: add condresched() in swapreclaimfullclusters to prevent softlockup

We hit a real softlockup in an internal stress test environment. The workload was LTP memory/swap stress on a large arm64 machine, with 320 CPUs, about 1TB memory and an 8.6GB swap device. The system was under heavy load and the swap device had a large number of full clusters. The softlockup was triggered during a stress test after about 3 days.

So, add periodic condresched() calls during large fullclusters reclaim operations to prevent softlockup issues.

Detailed call trace as follow:

PID: 3817773 TASK: ffff0883bb28b780 CPU: 48 COMMAND: "kworker/48:7" #0 [ffff800080183d10] crashkexec at ffffa4c1361e5de4 #1 [ffff800080183d90] panic at ffffa4c1360d5e9c #2 [ffff800080183e20] watchdogtimerfn at ffffa4c136231fa8 ... #16 [ffff8000c4ad3cb0] swapcachedelfolio at ffffa4c1363e1614 #17 [ffff8000c4ad3ce0] trytoreclaimswap at ffffa4c1363e4bfc #18 [ffff8000c4ad3d40] swapreclaimfullclusters at ffffa4c1363e5474 #19 [ffff8000c4ad3da0] swapreclaimwork at ffffa4c1363e550c #20 [ffff8000c4ad3dc0] processonework at ffffa4c136102edc #21 [ffff8000c4ad3e10] workerthread at ffffa4c136103398 #22 [ffff8000c4ad3e70] kthread at ffffa4c13610d95c

In the Linux kernel, the following vulnerability has been resolved:

mm: swapcgroup: fix NULL deref in lookupswapcgroupid on swapless host

lookupswapcgroupid() passes swapcgroupctrl[type].map to swapcgroupidlookup() without checking that the type was ever registered via swapcgroupswapon(). On a swapless host every ctrl->map is NULL, so swapcgroupidlookup() dereferences NULL + a scaled swpoffset().

Since commit bea67dcc5eea ("mm: attempt to batch free swap entries for zappterange()"), zappterange() -> swapptebatch() calls lookupswapcgroupid() on any non-present, non-none PTE that decodes as a real swap entry, without first validating it against swapinfo[]. A single PTE corrupted into a type-0 swap entry takes the host down at process exit.

We hit this in production on a swapless 6.12.58 host: ~1s of "getswapdevice: Bad swap file entry 3f800204222bb" (doswappage() being correctly defensive about the same entry) followed by

BUG: unable to handle page fault for address: 000003f800204220 RIP: 0010:lookupswapcgroupid+0x2b/0x60 Call Trace: swapptebatch+0xbf/0x230 zappterange+0x4c8/0x780 unmappagerange+0x190/0x3e0 exitmmap+0xd9/0x3c0 doexit+0x20c/0x4b0

syzbot has reported the identical stack.

The source of the PTE corruption is a separate bug; this change makes the teardown path as robust as the fault path already is. Every other caller of lookupswapcgroupid() is downstream of a getswapdevice() that has already validated the entry, so the new branch is cold.

Bluetooth: btmtksdio: fix infinite loop in btmtksdiotxrxwork()

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: avoid NULL deref of conn in isoconnbigsync()

isoconnbigsync() drops the socket lock to call hcigetroute() and then re-acquires it, but dereferences isopi(sk)->conn->hcon afterwards without re-checking that conn is still valid.

While the lock is dropped, the connection can be torn down under the same socket lock: isodisconncfm() -> isoconndel() -> isochandel() sets isopi(sk)->conn to NULL (and the broadcast teardown path can also clear conn->hcon on its own). When isoconnbigsync() re-acquires the lock and reads conn->hcon, conn may be NULL, causing a NULL pointer dereference (hcon is the first member of struct isoconn).

This path is reached from isosockrecvmsg() for a PA-sync broadcast sink socket (BTSKDEFERSETUP | BTSKPASYNC), so the dropped-lock window can race with connection teardown driven by controller events.

Re-validate isopi(sk)->conn and its hcon after re-acquiring the socket lock and bail out if the connection went away, as already done in the sibling isosockrebindbc().

In the Linux kernel, the following vulnerability has been resolved:

firmwareloader: fix device reference leak in firmwareuploadregister()

firmwareuploadregister() -> fwcreateinstance() -> deviceinitialize()

After fwcreateinstance() succeeds, the lifetime of the embedded struct device is expected to be managed through the device core reference counting, since fwcreateinstance() has already called deviceinitialize().

In firmwareuploadregister(), if alloclookupfwpriv() fails after fwcreateinstance() succeeds, the code reaches freefwsysfs and frees fwsysfs directly instead of releasing the device reference with putdevice(). This may leave the reference count of the embedded struct device unbalanced, resulting in a refcount leak.

The issue was identified by a static analysis tool I developed and confirmed by manual review. Fix this by using putdevice(fwdev) in the failure path and letting fwdevrelease() handle the final cleanup, instead of freeing the instance directly from the error path.

cpufreq: Fix hotplug-suspend race during reboot

In the Linux kernel, the following vulnerability has been resolved:

proc: protect ptracemayaccess() with execupdatelock (part 1)

Fix the easy cases where procfs currently calls ptracemayaccess() without execupdatelock protection, where the fix is to simply add the extra lock or use mmaccess():

- dotaskstat(): grab execupdatelock - procpidwchan(): grab execupdatelock - procmapfileslookup(): use mmaccess() instead of gettaskmm() - procmapfilesreaddir(): use mmaccess() instead of gettaskmm() - procnsgetlink(): grab execupdatelock - procnsreadlink(): grab execupdatelock

In the Linux kernel, the following vulnerability has been resolved:

posix-cpu-timers: Fix pid refcount leak in docpunanosleep() error path

In docpunanosleep(), posixcputimercreate() takes a pid reference via getpid() and stores it in timer.it.cpu.pid. If the subsequent posixcputimerset() call fails, the function returns immediately without calling posixcputimerdel() to release the pid reference, causing a leak.

Fix it by calling posixcputimerdel() before the unlock-and-return on the error path, consistent with the other exit paths in the same function.

In the Linux kernel, the following vulnerability has been resolved:

s390: Revert support for DCACHEWORDACCESS

loadunalignedzeropad() reads eight bytes from unaligned addresses and may cross page boundaries. It handles exceptions which may happen if reading from the second page results in an exception.

For pages which are donated to the Ultravisor for secure execution purposes the dosecurestorageaccess() exception handler however does not handle such exceptions correctly. Such an exception may result in an endless exception loop which will never be resolved.

An attempt to fix this [1] turned out to be not sufficient. For now revert loadunalignedzeropad() until this problem has been resolved in a proper way.

Note that the implementation of loadunalignedzeropad() itself is correct. The revert is just a temporary workaround until there is complete fix for secure storage access exceptions.

[1] commit b00be77302d7 ("s390/mm: Add missing secure storage access fixups for donated memory")

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: reject CLEANSEGMENTS ioctl with out-of-range segment numbers

Syzbot reported a hung task in nilfstransactionbegin() where multiple tasks performing chmod() on a nilfs2 mount blocked for over 143 seconds waiting to acquire nssegctorsem for read:

INFO: task syz.0.17:5918 blocked for more than 143 seconds. Call Trace: schedule+0x164/0x360 rwsemdownreadslowpath+0x6d9/0x940 downread+0x99/0x2e0 nilfstransactionbegin+0x364/0x710 fs/nilfs2/segment.c:221 nilfssetattr+0x124/0x2c0 fs/nilfs2/inode.c:921 notifychange+0xc1a/0xf40 chmodcommon+0x273/0x4a0 dofchmodat+0x12d/0x230

The writer holding nssegctorsem was a concurrent NILFSIOCTLCLEANSEGMENTS caller, stuck inside printk while emitting per-element warnings from nilfssufileupdatev():

nilfsmsg+0x373/0x450 fs/nilfs2/super.c:78 nilfssufileupdatev+0x21c/0x6d0 fs/nilfs2/sufile.c:186 nilfssufilefreev fs/nilfs2/sufile.h:93 [inline] nilfsfreesegments fs/nilfs2/segment.c:1140 [inline] nilfssegctorcollectblocks fs/nilfs2/segment.c:1261 [inline] nilfssegctordoconstruct+0x1f55/0x76c0 nilfscleansegments+0x3bd/0xa50 nilfsioctlcleansegments fs/nilfs2/ioctl.c:922 [inline] nilfsioctl+0x261f/0x2780

The root cause is that user-supplied segment numbers are not validated before nilfscleansegments() begins doing work; the range check on each segnum is performed deep inside the call chain by nilfssufileupdatev(), which emits a nilfswarn() per invalid entry while still holding the segctor lock and the sufile misem. Under load (repeated invocations across multiple mounts saturating the global printk path), the cumulative printk latency keeps nssegctorsem held long enough to trip the hungtask watchdog, blocking concurrent operations such as chmod() that need nssegctorsem for read.

Fix by validating the contents of kbufs[4] in nilfscleansegments() immediately after acquiring nssegctorsem via nilfstransactionlock(). Holding nssegctorsem serializes the check against nilfsioctlresize(), which can modify nsnsegments, so the validation uses a consistent value. Out-of-range segment numbers are rejected with -EINVAL before any segment-cleaning work begins, so the bad entries never reach the per-element diagnostic path inside nilfssufileupdatev().

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix memory leak in xfsdqinodemetadircreate()

If xfsmetadircreate() fails in xfsdqinodemetadircreate(), the current code returns directly, leaking the allocated update and transaction state. If the subsequent commit fails, the caller-owned inode reference is left behind.

Fix this memory leak by routing the create failure path through xfsmetadircancel(). For both create and commit failures, finish and release any inode returned to the caller, mirroring the unwind pattern in xfsmetadirmkdir().

The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1.1.

An x8664 allyesconfig build showed no new warnings. Runtime validation used kprobe fault injection during mount -o uquota on a metadir XFS image. Injecting xfsmetadircreate() reproduced the old active-update path that left mount stuck later in mount setup; after this change, the same injection reported cancelhits=1 and irelehits=1. Injecting xfsmetadircommit() exercised the old inode-reference leak path; after this change, it reported irelehits=1.

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix exchmaps reservation limit check

xfsexchmapsestimateoverhead() adds the bmbt and rmapbt overhead to a local resblks variable, but the final UINTMAX check still tests req->resblks. That is the reservation value from before the overhead was added.

The computed value is stored back in req->resblks and later passed to xfstransalloc(), whose block reservation argument is unsigned int. Check the computed reservation so the existing limit applies to the value that will be used.

In the Linux kernel, the following vulnerability has been resolved:

usb: cdnsp: fix stream context array leak in cdnspallocstreaminfo()

cdnspallocstreaminfo() allocates streaminfo->streamctxarray with cdnspallocstreamctx(). If a later stream ring allocation or stream mapping update fails, the error path frees the allocated stream rings and streamrings array, but leaves streamctxarray allocated.

Free the stream context array before falling through to the streamrings cleanup path.

In the Linux kernel, the following vulnerability has been resolved:

net: usb: kalmia: bound RX frame length in kalmiarxfixup()

kalmiarxfixup() computes usbpacketlength = skb->len - (2 KALMIAHEADERLENGTH) as a u16, guarded only by a pre-loop check that skb->len is at least KALMIAHEADERLENGTH, which is 6. A device can deliver a short bulk-IN frame with skb->len in the 6 to 11 range, or leave a short trailing remainder on a later loop iteration. Either case underflows usbpacketlength to about 65530.

That bypasses the usbpacketlength < etherpacketlength truncation path. The device-supplied etherpacketlength, a le16 up to 65535 read from headerstart[2], then drives a memcmp() and the following skbtrim() and skbpull() past the end of the rx buffer. The rx buffer is hardmtu 10, which is 14000 bytes. That is an out of bounds read.

Require both the start and end framing headers to be present before subtracting them, on every loop iteration.

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: composite: fix dead empty check in the USBDTOTG handler

The OTG branch of compositesetup() falls back to the first configuration when none is selected:

if (cdev->config) config = cdev->config; else config = listfirstentry(&cdev->configs, struct usbconfiguration, list); if (!config) goto done; ... memcpy(req->buf, config->descriptors[0], value);

listfirstentry() never returns NULL. On an empty list it returns containerof() of the list head. So the "if (!config)" check is dead.

When cdev->configs is empty, config points at the head inside struct usbcompositedev. config->descriptors[0] reads whatever sits at that offset. The memcpy copies up to wlength bytes of it into the response buffer.

cdev->configs can be empty in two cases. One is a teardown race on gadget unbind with a control transfer in flight. The other is a driver that sets isotg before it adds a config. A reproducer that holds cdev->configs empty triggers a KASAN fault in this branch.

Use listfirstentryornull() so the existing check does its job.

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: fprinter: take kref only for successful open

printeropen() returns -EBUSY when the character device is already open, but it increments dev->kref regardless of the return value. VFS does not call ->release() for a failed open, so every rejected second open permanently leaks one reference.

Move krefget() into the successful-open branch.

In the Linux kernel, the following vulnerability has been resolved:

usb: mtu3: unmap request DMA on queue failure

mtu3gadgetqueue() maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request list if mtu3preparetransfer() fails.

Normal completion and dequeue paths unmap requests from mtu3reqcomplete(), but this error path never reaches that helper, so the DMA mapping is left active. Unmap the request before returning from the failed queue path.

In the Linux kernel, the following vulnerability has been resolved:

USB: misc: uss720: unregister parport on probe failure

uss720probe() registers a parport before reading the 1284 register used to detect unsupported Belkin F5U002 adapters. If get1284register() fails, the error path drops the driver private data and the USB device reference, but leaves the parport device registered.

Leaving the port registered is more than a private allocation leak: parportregisterport() has already reserved a parport number and registered the parport bus device, while pp->privatedata still points at the private data that the common error path is about to release.

Undo the pre-announce registration in the get1284register() failure branch before jumping to the common private-data cleanup path. Clear priv->pp first, matching the disconnect path and avoiding a stale pointer in the private data.

This issue was identified during our ongoing static-analysis research while reviewing kernel code.