In the Linux kernel, the following vulnerability has been resolved:

dpaa2-switch: add bounds check for ifid in IRQ handler

The IRQ handler extracts ifid from the upper 16 bits of the hardware status register and uses it to index into ethsw->ports[] without validation. Since ifid can be any 16-bit value (0-65535) but the ports array is only allocated with swattr.numifs elements, this can lead to an out-of-bounds read potentially.

Add a bounds check before accessing the array, consistent with the existing validation in dpaa2switchrx().

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx4: Prevent shift wrapping in setusersqsize()

The ucmd->logsqbbcount variable is controlled by the user so this shift can wrap. Fix it by using checkshloverflow() in the same way that it was done in commit 515f60004ed9 ("RDMA/hns: Prevent undefined behavior in hnsrocesetusersqsize()").

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: ISO: Fix possible UAF on isoconnfree

This attempt to fix similar issue to scoconnfree where if the conn->sk is not set to NULL may lead to UAF on isoconnfree.

In the Linux kernel, the following vulnerability has been resolved:

ice: Fix PTP NULL pointer dereference during VSI rebuild

Fix race condition where PTP periodic work runs while VSI is being rebuilt, accessing NULL vsi->rxrings.

The sequence was: 1. iceptpprepareforreset() cancels PTP work 2. iceptprebuild() immediately queues PTP work 3. VSI rebuild happens AFTER iceptprebuild() 4. PTP work runs and accesses NULL vsi->rxrings

Fix: Keep PTP work cancelled during rebuild, only queue it after VSI rebuild completes in icerebuild().

Added iceptpqueuework() helper function to encapsulate the logic for queuing PTP work, ensuring it's only queued when PTP is supported and the state is ICEPTPREADY.

Error log: [ 121.392544] ice 0000:60:00.1: PTP reset successful [ 121.392692] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 121.392712] #PF: supervisor read access in kernel mode [ 121.392720] #PF: errorcode(0x0000) - not-present page [ 121.392727] PGD 0 [ 121.392734] Oops: Oops: 0000 [#1] SMP NOPTI [ 121.392746] CPU: 8 UID: 0 PID: 1005 Comm: ice-ptp-0000:60 Tainted: G S 6.19.0-rc6+ #4 PREEMPT(voluntary) [ 121.392761] Tainted: [S]=CPUOUTOFSPEC [ 121.392773] RIP: 0010:iceptpupdatecachedphctime+0xbf/0x150 [ice] [ 121.393042] Call Trace: [ 121.393047] <TASK> [ 121.393055] iceptpperiodicwork+0x69/0x180 [ice] [ 121.393202] kthreadworkerfn+0xa2/0x260 [ 121.393216] ? pfxiceptpperiodicwork+0x10/0x10 [ice] [ 121.393359] ? pfxkthreadworkerfn+0x10/0x10 [ 121.393371] kthread+0x10d/0x230 [ 121.393382] ? pfxkthread+0x10/0x10 [ 121.393393] retfromfork+0x273/0x2b0 [ 121.393407] ? pfxkthread+0x10/0x10 [ 121.393417] retfromforkasm+0x1a/0x30 [ 121.393432] </TASK>

In the Linux kernel, the following vulnerability has been resolved:

ublk: fix use-after-free in ublkpartitionscanwork

A race condition exists between the async partition scan work and device teardown that can lead to a use-after-free of ub->ubdisk:

1. ublkctrlstartdev() schedules partitionscanwork after adddisk() 2. ublkstopdev() calls ublkstopdevunlocked() which does: - delgendisk(ub->ubdisk) - ublkdetachdisk() sets ub->ubdisk = NULL - putdisk() which may free the disk 3. The worker ublkpartitionscanwork() then dereferences ub->ubdisk leading to UAF

Fix this by using ublkgetdisk()/ublkputdisk() in the worker to hold a reference to the disk during the partition scan. The spinlock in ublkgetdisk() synchronizes with ublkdetachdisk() ensuring the worker either gets a valid reference or sees NULL and exits early.

Also change flushwork() to cancelworksync() to avoid running the partition scan work unnecessarily when the disk is already detached.

In the Linux kernel, the following vulnerability has been resolved:

media: v4l2-core: Fix a potential resource leak in v4l2fwnodeparselink()

If fwnodegraphgetremoteendpoint() fails, 'fwnode' is known to be NULL, so fwnodehandleput() is a no-op.

Release the reference taken from a previous fwnodegraphgetportparent() call instead.

Also handle fwnodegraphgetportparent() failures.

In order to fix these issues, add an error handling path to the function and the needed gotos.

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Add a length limitation for the ivrsacpihid command-line parameter

The 'acpiid' buffer in the parseivrsacpihid function may overflow, because the string specifier in the format string sscanf() has no width limitation.

Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE.

In the Linux kernel, the following vulnerability has been resolved:

clk: tegra: Fix refcount leak in tegra114clockinit

offindmatchingnode() returns a node pointer with refcount incremented, we should use ofnodeput() on it when not need anymore. Add missing ofnodeput() to avoid refcount leak.

In the Linux kernel, the following vulnerability has been resolved:

pfifotailenqueue: Drop new packet when sch->limit == 0

Expected behaviour: In case we reach scheduler's limit, pfifotailenqueue() will drop a packet in scheduler's queue and decrease scheduler's qlen by one. Then, pfifotailenqueue() enqueue new packet and increase scheduler's qlen by one. Finally, pfifotailenqueue() return NETXMITCN status code.

Weird behaviour: In case we set sch->limit == 0 and trigger pfifotailenqueue() on a scheduler that has no packet, the 'drop a packet' step will do nothing. This means the scheduler's qlen still has value equal 0. Then, we continue to enqueue new packet and increase scheduler's qlen by one. In summary, we can leverage pfifotailenqueue() to increase qlen by one and return NETXMITCN status code.

The problem is: Let's say we have two qdiscs: QdiscA and QdiscB. - QdiscA's type must have '->graft()' function to create parent/child relationship. Let's say QdiscA's type is hfsc. Enqueue packet to this qdisc will trigger hfscenqueue. - QdiscB's type is pfifoheaddrop. Enqueue packet to this qdisc will trigger pfifotailenqueue. - QdiscB is configured to have sch->limit == 0. - QdiscA is configured to route the enqueued's packet to QdiscB.

Enqueue packet through QdiscA will lead to: - hfscenqueue(QdiscA) -> pfifotailenqueue(QdiscB) - QdiscB->q.qlen += 1 - pfifotailenqueue() return NETXMITCN - hfscenqueue() check for NETXMITSUCCESS and see NETXMITCN => hfscenqueue() don't increase qlen of QdiscA.

The whole process lead to a situation where QdiscA->q.qlen == 0 and QdiscB->q.qlen == 1. Replace 'hfsc' with other type (for example: 'drr') still lead to the same problem. This violate the design where parent's qlen should equal to the sum of its childrens'qlen.

Bug impact: This issue can be used for user->kernel privilege escalation when it is reachable.