The ARM PL011 UART driver in drivers/serial/uartpl011.c fails to acknowledge receive error interrupts. On the PL011, the framing, parity, break, and overrun error interrupts (PL011IMSCERRORMASK) are cleared only by writing the interrupt-clear register UARTICR; reading the data register clears the RX interrupt and the per-byte RSR status but not the error interrupt status in MIS. The interrupt service routine pl011isr() acknowledged only the CTS modem-status interrupt and never wrote icr for the error bits, so an asserted error interrupt remains pending after the ISR returns.

When an application enables error-interrupt reporting via the public uartirqerrenable() API, an attacker who controls the serial peer can deterministically assert these error bits by injecting line errors on the RX line — a baud/stop-bit mismatch or mid-character break (framing/break error), a flipped parity bit (parity error), or FIFO flooding (overrun error). Because the error interrupt is never cleared, the interrupt line stays asserted and the CPU re-enters pl011isr() immediately and indefinitely, producing an interrupt-storm livelock from which the core makes no forward progress.

The impact is an availability-only denial of service (permanent hang), reachable from an external or removable UART peer. Exploitation is gated by configuration: the error interrupt is off by default and no in-tree subsystem enables it, so only applications that explicitly call uartirqerrenable() on a PL011-based, interrupt-driven port are affected. The fix makes pl011isr() acknowledge the pending error bits via uart->icr, breaking the loop, and additionally clears the latched RSR status in pl011errcheck().

An authentication bypass vulnerability in the network driver of Palo Alto Networks Prisma® Access Agent on Windows enables a local administrator to bypass security inspection, subsequently allowing them to inject and intercept arbitrary network traffic.

The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected.

An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent.

The Prisma Access Agent on macOS, Windows, iOS, Android, and Chrome OS is not affected.

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled.

The SF32LB MPI QSPI NOR flash driver (drivers/flash/flashsf32lbmpiqspinor.c) validated the flash offset and length on its read and write paths with the test (offset + size) > data->size. Because offset is a signed offt while size is unsigned, a negative offset is converted to a large unsigned value and the addition can wrap to a small result that passes the check. The read path then performs memcpy(dst, (void )(data->base + offset), size) and the write path programs flash at offset and cache-invalidates data->base + offset, in both cases accessing memory outside the mapped flash window. The driver's erase path already rejected negative offsets, but read and write did not.

In builds with CONFIGUSERSPACE, flashread and flashwrite are syscalls whose verifiers validate the device object and the caller's buffer but deliberately delegate offset bounds checking to the driver. An unprivileged thread that has been granted access to this flash device can therefore call the syscall with a crafted negative offset and a buffer valid in its own memory domain, and reach the unchecked access.

The most direct impact is on the read path: by choosing a negative offset and matching size, an attacker slides the memcpy source below the flash base and copies arbitrary CPU-addressable memory into its own buffer, disclosing memory it is not authorized to read. The write path additionally allows programming flash at an out-of-range address and invalidating an attacker-chosen cache range, affecting integrity and availability. Reachability requires userspace to be enabled and the raw flash device object to be granted to an untrusted thread.

The fix replaces the check with qspinorrangeisvalid(), which rejects negative offsets and performs the bound comparison in overflow-safe 64-bit arithmetic on both paths, and additionally adds an SRAM DMA bounce buffer plus source/destination overlap rejection to prevent a separate DMA bus-hang condition.

.NET Information Disclosure Vulnerability

.NET Security Feature Bypass Vulnerability

In the Linux kernel, the following vulnerability has been resolved:

ipv4: fib: free fibalias with kfreercu() on insert error path

fibtableinsert() publishes newfa into the leaf's falist with fibinsertalias() before calling the fib entry notifiers. When a notifier fails, the error path removes newfa with fibremovealias() (hlistdelrcu) and frees it right away with kmemcachefree().

fibtablelookup() walks that list under rcureadlock() only, so a concurrent lookup that already reached newfa keeps reading it after the free:

BUG: KASAN: slab-use-after-free in fibtablelookup (net/ipv4/fibtrie.c:1601) Read of size 1 at addr ffff88810676d4eb by task exploit/297 Call Trace: fibtablelookup (net/ipv4/fibtrie.c:1601) iprouteoutputkeyhashrcu (net/ipv4/route.c:2814) iprouteoutputkeyhash (net/ipv4/route.c:2705) ip4datagramconnect (net/ipv4/datagram.c:49) udpconnect (net/ipv4/udp.c:2144) sysconnect (net/socket.c:2167) x64sysconnect (net/socket.c:2173) dosyscall64 entrySYSCALL64afterhwframe which belongs to the cache ipfibalias of size 56

Triggering the error path needs CAPNETADMIN and a registered fib notifier that can reject a route; a netdevsim device whose IPv4 FIB resource is exhausted is enough.

Free newfa with aliasfreememrcu(), as fibtabledelete() already does for a fibalias removed from the trie.

Bluetooth: qca: fix NVM tag length underflow in TLV parser

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause the generation of error messages that contain sensitive information. A successful exploit of this vulnerability might lead to information disclosure.

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initialization. A successful exploit of this vulnerability might lead to denial of service and data tampering.

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initialization. A successful exploit of this vulnerability might lead to data tampering and denial of service.

crypto: asymmetrickeys - fix OOB read in pefiledigestpecontents

In the Linux kernel, the following vulnerability has been resolved:

mm/slab: do not limit zeroing to origsize when only red zoning is enabled

When init (zeroing) on allocation is requested, for kmalloc() we generally have to zero the full object size even if a smaller size is requested, in order to provide krealloc()'s GFPZERO guarantees.

But if we track the requested size, krealloc() uses that information to do the right thing, so we can zero only the requested size. With red zoning also enabled, any extra size became part of the red zone, so it must not be zeroed and thus we must zero only the requested size.

However the current check is imprecise, and will trigger also when only SLABREDZONE is enabled without SLABSTOREUSER (which enables tracking the requested size). This means enabling red zoning alone can compromise krealloc()'s GFPZERO contract.

Fix this by using slubdebugorigsize() instead, which is the exact check for whether the requested size is tracked. We don't need to care if red zoning is also enabled or not. Also update and expand the comment accordingly.

ACPI: NFIT: core: Fix possible NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved:

x86/bugs: Enable IBPB flush on BPF JIT allocation

Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip enabling the IBPB flush if the BPF dispatcher is already using a retpoline sequence.

This hardening applies only when BPF-JIT is in use. Guard the enabling under CONFIGBPFJIT so that bugs.c still builds with CONFIGBPFJIT=n.

ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser

ALSA: gus: check sndctlnew1() return value

In the Linux kernel, the following vulnerability has been resolved:

vfio: prevent infinite loop in vfiomiggetnextstate() on blocked arc

vfiomiggetnextstate() walks vfiofromfsmtable[] one step at a time, looping to skip optional states the device does not support until nextfsm is supported. A blocked transition is encoded as VFIODEVICESTATEERROR, which the trailing return reports as -EINVAL.

The skip loop does not account for the ERROR sentinel. stateflagstable[ERROR] is ~0U and vfiofromfsmtable[ERROR][] is ERROR, so once nextfsm becomes ERROR the loop condition stays true and nextfsm never changes. The blocked arcs STOPCOPY -> PRECOPY and STOPCOPY -> PRECOPYP2P map to ERROR yet pass the support check on a precopy-capable device, causing the loop to spin forever while holding the driver state mutex. This can result in a soft lockup, and a panic with softlockuppanic set.

Terminate the skip loop on the ERROR sentinel so a blocked transition falls through to the existing return and reports -EINVAL.

In the Linux kernel, the following vulnerability has been resolved:

usb: xhci: Fix sleep in atomic context in xhcifreestreams()

When a USB device with active stream endpoints is disconnected, xhcifreestreams() is called from the hubevent workqueue to free the stream resources. It calls xhcifreestreaminfo() while holding xhci->lock with irqs disabled.

xhcifreestreaminfo() invokes xhcifreestreamctx(), which calls dmafreecoherent() for large stream context arrays.

dmafreecoherent() can sleep (e.g. via vunmap), triggering a BUG when called from atomic context.

Call trace: dmafreeattrs+0x174/0x220 xhcifreestreaminfo+0xd0/0x11c xhcifreestreams+0x278/0x37c usbfreestreams+0x98/0xc0 usbunbindinterface+0x1b8/0x2f8 devicereleasedriverinternal+0x1d4/0x2cc devicereleasedriver+0x18/0x28 busremovedevice+0x160/0x1a4 devicedel+0x1ec/0x350 usbdisabledevice+0x98/0x214 usbdisconnect+0xf0/0x35c hubevent+0xab4/0x19ec processonework+0x278/0x63c

Fix this by saving the streaminfo pointers and clearing the ep references under the lock, then calling xhcifreestreaminfo() outside the lock where sleeping is allowed.

Bluetooth: MGMT: Fix UAF of hciconnparams in adddevicecomplete

gpio: eic-sprd: use rawspinlockt in the irq startup path

Bluetooth: btmtksdio: fix infinite loop in btmtksdiotxrxwork()

cpufreq: Fix hotplug-suspend race during reboot

In the Linux kernel, the following vulnerability has been resolved:

posix-cpu-timers: Fix pid refcount leak in docpunanosleep() error path

In docpunanosleep(), posixcputimercreate() takes a pid reference via getpid() and stores it in timer.it.cpu.pid. If the subsequent posixcputimerset() call fails, the function returns immediately without calling posixcputimerdel() to release the pid reference, causing a leak.

Fix it by calling posixcputimerdel() before the unlock-and-return on the error path, consistent with the other exit paths in the same function.

bpf: Allow LPM map access from sleepable BPF programs

In the Linux kernel, the following vulnerability has been resolved:

usb: cdnsp: fix stream context array leak in cdnspallocstreaminfo()

cdnspallocstreaminfo() allocates streaminfo->streamctxarray with cdnspallocstreamctx(). If a later stream ring allocation or stream mapping update fails, the error path frees the allocated stream rings and streamrings array, but leaves streamctxarray allocated.

Free the stream context array before falling through to the streamrings cleanup path.

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: udc: Fix use-after-free in gadgetmatchdriver

The udc structure acts as the management structure for the gadget, but their lifecycles are decoupled. A race condition exists where usbdelgadget() frees the udc memory (e.g., via mode-switch work) while gadgetmatchdriver() concurrently accesses the freed udc memory (e.g., via configfs), causing a Use-After-Free (UAF) that triggers a NULL pointer dereference when the freed memory is zeroed:

[39430.908615][ T1171] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [39430.911397][ T1171] pc : pistrcmp+0x20/0x140 [39430.911441][ T1171] lr : gadgetmatchdriver+0x34/0x60 ... [39430.911890][ T1171] usbgadgetregisterdriverowner+0x50/0xf8 [39430.911910][ T1171] gadgetdevdescUDCstore+0xf4/0x140 [39430.931308][ T1171] configfswriteiter+0xec/0x134

[39430.957058][ T1171] Workqueue: eventsfreezable dwc3setmode [39430.957287][ T1171] dwc3gadgetexit+0x34/0x8c [39430.957304][ T1171] dwc3setmode+0xc0/0x664

Fix this by ensuring the udc structure remains allocated until the gadget is released. To achieve this, introduce a new usbgadgetrelease() routine to the core. When the gadget is added, usbaddgadget() stores the gadget's release routine in the udc structure and takes a reference to the udc. When the gadget is released, usbgadgetrelease() drops the reference to the udc and then calls the gadget's release routine.

block: skip syncblockdev() on surprise removal in bdevmarkdead()

crypto: drbg - Fix returning success on failure in CTRDRBG