ASoC: codecs: rt712-sdca-dmic: fix uninitialized streamconfig->type

In the Linux kernel, the following vulnerability has been resolved:

media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity

vdecav1slicesetuptile() copies tilecols + 1 / tilerows + 1 entries into micolstarts[] / mirowstarts[] from the bitstream tileinfo. Bound the copy to the array capacity.

In the Linux kernel, the following vulnerability has been resolved:

wifi: libipw: fix key index receive bound checks

libipwrx() reads skb->data[hdrlen + 3] to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the existing guard only checks skb->len >= hdrlen + 3, which proves bytes up to hdrlen + 2 but not the byte at hdrlen + 3.

Require hdrlen + 4 bytes before reading that item in both paths. This is a local source-boundary check only; it does not change the key index semantics.

In the Linux kernel, the following vulnerability has been resolved:

nexthop: Initialize extack in removenhgrpentry()

removenhgrpentry() prints the extack message when a listener fails to replace the reduced nexthop group. However, extack is not initialized and listeners are not required to set a message when returning an error. Neither netdevsim nor mlxsw do so when an allocation fails, resulting in the dereference of an uninitialized stack pointer.

Fix by zero-initializing extack, as was done in commit 6347c5314cee ("nexthop: initialize extack in nhresbucketmigrate()").

Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMMCONNINFO

btrfs: tree-checker: validate INODEREF's namelen

drm/gud: fix out-of-bounds write in gudplaneatomiccheck()

Bluetooth: hcicore: Fix UAF in hciunregisterdev()

In the Linux kernel, the following vulnerability has been resolved:

PCI: iproc: Protect root bus removal with rescan lock

Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes.

[bhelgaas: commit log]

In the Linux kernel, the following vulnerability has been resolved:

RDMA/bnxtre: Proper rollback if the ioremap fails

bnxtqpliballocdpi returns success even if ioremap fails. Add the proper rollback when the ioremap fails and return -ENOMEM status.

ACPICA: Fix integer overflow in acpiexopcode3A1T1R() (midop)

ALSA: bcd2000: Fix race between rawmidi and disconnect

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: fix WKS SAP hijacking via prefix match in nfcllcpwkssap()

nfcllcpwkssap() compares only servicenamelen bytes, so a short servicename like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring exact length match before strncmp().

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: acpi: validate WGDS table revision index

Check tblrev bounds before BIT(tblrev) to avoid undefined shifts when firmware reports an invalid revision value.

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmsmac: fix UAF in brcmsfreetimer()

brcmsfreetimer() calls brcmsdeltimer() which uses the non-synchronous canceldelayedwork() to cancel the timer's underlying delayed work. If the work callback (brcmstimer) is already running, canceldelayedwork() returns false without waiting, and brcmsfreetimer() proceeds to kfree(t) while the callback still accesses t through containerof().

Add an explicit canceldelayedworksync() after brcmsdeltimer() to guarantee that any in-flight callback has completed before the timer structure is freed.

In the Linux kernel, the following vulnerability has been resolved:

USB: cdc-acm: skip URB restart in portshutdown if disconnected

acmportshutdown() is called from the tty-port machinery whenever the last user closes the port. acmdisconnect() sets acm->disconnected and calls ttyportttyvhangup(), which eventually triggers portshutdown(). At that point acmdisconnect() has already called acmpoisonurbs() and is about to free the control and read URBs.

However, acmportshutdown() unconditionally calls acmunpoisonurbs() and, when the ALWAYSPOLLCTRL quirk is set, immediately re-submits the ctrlurb and all read URBs. If the concurrent acmdisconnect() then frees those URBs and their DMA buffers while they are in-flight, the result is a use-after-free in acmctrlirq() or acmreadbulkcallback() accessing the freed DMA memory.

Fix by checking acm->disconnected after draining the delayed anchor and returning early: if we are in a disconnect path the URBs must remain poisoned and must not be resubmitted.

The early return is placed after the delayed-anchor drain loop because that loop only cancels write-side accounting (wb->use = false and autopm counter) and does not touch the hardware path.

ACPICA: Prevent adding invalid references

ALSA: usbusx2y: fix in04last array size mismatch with in04buf

btrfs: fix reloc root cleanup in mergerelocroots()

In the Linux kernel, the following vulnerability has been resolved:

spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM

The runtime PM functions had incomplete error handling that could leave the system in an inconsistent state. If any operation failed midway through suspend or resume, some resources would be left in the wrong state while others were already changed, leading to potential clock/power imbalances.

Reorder the suspend/resume sequences to avoid brownout risk by ensuring the performance state is set appropriately before clocks are enabled and clocks are disabled before dropping the performance state.

Fix by adding proper error checking for all operations and using goto-based cleanup to ensure all successfully acquired resources are properly released on any error.

ASoC: sprd: validate compress buffer sizes against fixed allocations

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: validate staid in BA window status notif

BAWINDOWSTATUSNOTIFICATIONID extracts a 5-bit staid from the firmware notification and uses it to index fwidtomacid[] without bounds checking. Validate staid before array access to prevent out-of-bounds indexing.

drm/amdkfd: fix UAF race in destroyqueuecpsch

ieee802154: 6lowpan: fix NULL dereference in lowpannewlink

In the Linux kernel, the following vulnerability has been resolved:

mac802154: fix use-after-free of sdata via queued RX frames

The RX softirq producer ieee802154subifframe() queues received beacon and MAC-command frames onto local->rxbeaconlist / rxmaccmdlist and schedules a process-context worker, storing a raw macpkt->sdata (and skb->dev == sdata->dev) with neither a reference nor any locking:

- the lists have no lock: the softirq producer listaddtail()s while the macwq worker listdel()s, so sibling interfaces on the same phy corrupt the list;

- the workers dereference the interface after it may have been freed. mac802154rxmaccmdworker() touches macpkt->sdata directly, and mac802154rxbeaconworker() -> mac802154processbeacon() dereferences skb->dev (== sdata->dev). Removing an interface frees its sdata (netdevpriv) while a queued frame still points at it, so a later worker run is a use-after-free.

Reproduced under KASAN by flooding a victim interface with MAC command frames and removing it (the beacon path is the same class via skb->dev):

BUG: KASAN: slab-use-after-free in mac802154rxmaccmdworker+0x463/0x630 [mac802154] Read of size 4 at addr ffff888002f9ea18 by task kworker/u8:1/31 Workqueue: phy0-mac-cmds mac802154rxmaccmdworker [mac802154] Call Trace: mac802154rxmaccmdworker+0x463/0x630 [mac802154] processonework+0x611/0xe80 workerthread+0x52e/0xdc0 kthread+0x30c/0x630 retfromfork+0x2fd/0x3e0

Fix both lists together:

- add local->rxlock and take it around every list access: the softirq producer (plain spinlock, softirq context) and the workers and flush (spinlockbh, process context);

- pin the interface for the lifetime of a queued frame with netdevhold()/netdevput(), so the worker can safely dereference sdata / skb->dev even while the interface is being removed;

- dequeue under the lock at the head and loop-drain the whole list in the workers (they previously processed one frame per run and relied on a later enqueue to drain the rest);

- drop not-yet-started frames of an interface before it is unregistered, from ieee802154ifremove() (after the RCU grace period) and from the ieee802154removeinterfaces() loop -- the latter is the whole-phy teardown path, which does not go through ieee802154ifremove().

An in-flight worker that already dequeued a frame keeps its own netdev reference; unregisternetdevice() then waits it out in netdevruntodo(), which runs at rtnlunlock() (rtnl released) and after the interface has been closed, so it does not pin rtnl. A worker blocked in an association TX only delays that one interface's unregister (the usual "waiting for %s to become free"), it does not hold rtnl. netdevhold() is used for this reason instead of a cancelworksync() under rtnl, which would block on the worker's unbounded MLME TX wait via ieee802154syncqueue().

The mac-command worker additionally skips processing for a stopped interface (ieee802154sdatarunning()), avoiding a needless association response during teardown.

In the Linux kernel, the following vulnerability has been resolved:

nfc: port100: reject frames whose declared length exceeds the received data

port100recvresponse() passes the URB transfer buffer to port100rxframeisvalid(), which checksums le16tocpu(frame->datalen) bytes of frame->data. datalen is a 16-bit field supplied by the device and is never checked against the number of bytes actually received (urb->actuallength), so a device reporting a datalen larger than the received frame makes port100datachecksum() read out of bounds past the transfer buffer.

Reject a response whose declared frame size does not fit the received length before validating it.

Found by 0sec (https://0sec.ai) using automated source analysis; the missing bound is evident from source. Compile-tested.

In the Linux kernel, the following vulnerability has been resolved:

PCI: altera: Protect root bus removal with rescan lock

Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes.

[bhelgaas: commit log]

In the Linux kernel, the following vulnerability has been resolved:

serial: 8250: fix possible ISR soft lockup

There are rare cases in which the host gets stuck in the ISR because it is flooded with messages during the startup phase.

The reason for the soft lockup in the ISR is the missing FIFO error IRQ (FIFOE) handling. Not handling it and reporting IRQHANDLED triggers the IRQ immediately again.

Fix this by adding a check for the FIFOE status and clearing the FIFO if no data is ready (DR).

This behavior was observed on an AM62L device which uses the OMAP 8250 driver. Fix it for all 8250 drivers, since the OMAP driver's special IRQ setup handling may trigger this behavior more frequently, but it is not ensured that other 8250 drivers aren't affected.

drm/i915: Fix memory leak in queryperfconfiglist()

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: Fix race condition in acceptqueue lifecycle

In nfcllcpsocketrelease(), sockets and listener accept queues are walked under the local sockets rwlock and bhlocksock(). However, bhlocksock() does not synchronise against process-context locksock() held by nfcllcpacceptdequeue() during accept(). Because socketrelease() does not check sockownedbyuser(), both paths can concurrently unlink and release the same child socket, resulting in use-after-free or a NULL pointer dereference of child->parent in nfcllcpacceptunlink().

Fix this synchronisation race by having nfcllcpsocketrelease() use process-context locksock() instead of bhlocksock():

1. Pop sockets from the local sockets list under the write lock using nfcllcpsocklistpop() so locksock() can be acquired without holding the rwlock.

2. Because locksock() can sleep, defer the final release of the nfcllcplocal structure to a workqueue (releasework). This avoids a sleeping-in-atomic bug when the last local reference is dropped from softirq context. Additionally, hold a single device reference on local from registration until final destruction.

3. In nfcllcplocalget(), use krefgetunlesszero() to prevent resurrecting a local object whose teardown has been scheduled.

4. In llcpsockaccept(), verify that the listener socket state is still LLCPLISTEN after waking from scheduletimeout() to prevent hangs if the listener is closed concurrently.

5. When unlinking unaccepted child sockets during listener release, unlink them from local->sockets, call sockorphan(), and drop their initial skalloc creation reference via sockput().

6. Make nfcllcpacceptunlink() idempotent by guarding parent access with a NULL check.