In the Linux kernel, the following vulnerability has been resolved:
wifi: nl80211: free RNR data on MBSSID mismatch
nl80211parsebeacon() rejects EMA RNR data when there are fewer RNR entries than MBSSID entries.
The rejected RNR allocation has not been attached to the beacon data yet, so free it before returning the error.
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: validate PMSR FTM preamble range
PMSR FTM request parsing accepts preamble values outside the enumerated nl80211 preamble range.
Reject out-of-range values before using them in the parser capability bit test using the policy.
[drop unnecessary check]
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: bound element ID read when checking non-inheritance
cfg80211iselementinherited() reads the first data octet of the candidate element (id = elem->data[0]) to look it up in an extension non-inheritance list. It does so after testing elem->id, but without verifying that the element actually has a data octet. A zero-length extension element (WLANEIDEXTENSION with length 0) therefore makes it read one octet past the end of the element.
ieee80211parseelemsfull() runs this check for every element of a frame once a non-inheritance context exists -- e.g. while parsing a per-STA profile of a Multi-Link element in a (re)association response, or a non-transmitted BSS profile -- so a crafted frame from an AP can trigger a one-octet slab-out-of-bounds read during element parsing:
BUG: KASAN: slab-out-of-bounds in cfg80211iselementinherited Read of size 1 ... in net/wireless/scan.c
Return early (treat the element as inherited) when an extension element carries no data, mirroring the existing handling of empty ID lists.
The bug was found by fuzzing ieee80211parseelemsfull() under KASAN.
ata: satadwc460ex: enable SATA interrupts only after IRQ handler is registered
Bluetooth: mgmt: hold reference for hciconn in mgmtpendingcmds
In the Linux kernel, the following vulnerability has been resolved:
smb/client: handle overlapping allocated ranges in fallocate
smb3simplefallocaterange() can skip holes when an allocated range returned by the server starts before the current fallocate offset. The skipped hole is not zero-filled, but fallocate still returns success. A later write to that hole may therefore fail with ENOSPC.
The function queries allocated ranges so that it can preserve existing contents and write zeroes only into holes. However, the server may return a range that starts before the current fallocate offset.
For example, assume the fallocate request is [100, 400) and the only allocated range returned by the server is [0, 200):
Request: [100, 400) Server range: [ 0, 200) allocated
Correct: [100, 200) allocated data, skip [200, 400) hole, zero-fill
Current: [100, 300) skipped [300, 400) zero-filled afterwards
The current code adds the full server range length, 200, to the current offset 100 and moves to 300. As a result, the hole in [200, 300) is skipped without being zero-filled.
Fix this by advancing only over the part of the allocated range that overlaps the current fallocate offset. Ignore ranges that end before the current offset and reject ranges whose end offset overflows.
This also prevents a malformed range length from causing an out-of-bounds zero-buffer read.
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: pin conn during async oplock break notification
smb2oplockbreaknoti() and smb2leasebreaknoti() store a ksmbdconn pointer in an async ksmbdwork and then queue that work on ksmbd-io. The work only increments conn->rcount, which prevents teardown from passing the pending-request wait after the increment, but it does not pin the struct ksmbdconn object.
If connection teardown races with an oplock break notification, the last conn reference can be dropped before the queued worker finishes. The worker then uses the freed conn in ksmbdconnwrite() and ksmbdconnrcountdec().
Take a real conn reference when publishing the conn pointer to the async work item, and drop it after the notification work has decremented rcount. Apply the same lifetime rule to lease break notification, which uses the same work->conn pattern.
In the Linux kernel, the following vulnerability has been resolved:
net/sched: acttunnelkey: Defer dstrelease to RCU callback
Fix a race-condition use-after-free in tunnelkeyreleaseparams().
The function releases the metadatadst of the old params synchronously via dstrelease() while deferring the params struct free with kfreercu(). A concurrent tunnelkeyact() reader on the datapath may still hold the old params pointer (under rcureadlockbh) and proceed to call dstclone(¶ms->tcftencmetadata->dst) after the writer's dstrelease has already pushed the dst's rcuref to RCUREFDEAD.
zdi-disclosures@trendmicro.com produced a poc which i (and Victor) verified that KASAN reports:
================================================================== BUG: KASAN: slab-use-after-free in instrumentatomicreadwrite include/linux/instrumented.h:112 BUG: KASAN: slab-use-after-free in atomicsubreturnrelease include/linux/atomic/atomic-instrumented.h:326 BUG: KASAN: slab-use-after-free in rcurefput include/linux/rcuref.h:109 BUG: KASAN: slab-use-after-free in rcurefput include/linux/rcuref.h:173 BUG: KASAN: slab-use-after-free in dstrelease+0x5b/0x370 net/core/dst.c:168 Write of size 4 at addr ffff88806158de40 by task poc/9388
CPU: 0 UID: 0 PID: 9388 Comm: poc Tainted: G W 7.1.0-rc7 #7 PREEMPT(lazy) Tainted: [W]=WARN Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> dumpstack lib/dumpstack.c:94 dumpstacklvl+0x100/0x190 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:378 printreport+0x139/0x4ad mm/kasan/report.c:482 kasanreport+0xe4/0x1d0 mm/kasan/report.c:595 checkregioninline mm/kasan/generic.c:186 kasancheckrange+0x125/0x200 mm/kasan/generic.c:200 instrumentatomicreadwrite include/linux/instrumented.h:112 atomicsubreturnrelease include/linux/atomic/atomic-instrumented.h:326 rcurefput include/linux/rcuref.h:109 rcurefput include/linux/rcuref.h:173 dstrelease+0x5b/0x370 net/core/dst.c:168 refdstdrop include/net/dst.h:272 skbdstdrop include/net/dst.h:284 skbreleaseheadstate+0x293/0x400 net/core/skbuff.c:1163 skbreleaseall net/core/skbuff.c:1187 [..] Allocated by task 9391: kasansavestack+0x30/0x50 mm/kasan/common.c:57 kasansavetrack+0x14/0x30 mm/kasan/common.c:78 poisonkmallocredzone mm/kasan/common.c:398 kasankmalloc+0x9a/0xb0 mm/kasan/common.c:415 kasankmalloc include/linux/kasan.h:263 dokmallocnode mm/slub.c:5296 kmallocnoprof+0x2f1/0x830 mm/slub.c:5308 kmallocnoprof include/linux/slab.h:954 kzallocnoprof include/linux/slab.h:1188 offloadactionalloc+0x2f/0x130 net/core/flowoffload.c:35 tcfactionoffloadaddex+0x1ba/0x880 net/sched/actapi.c:258 tcfactionoffloadadd net/sched/actapi.c:293 tcfactioninit+0x66e/0xa20 net/sched/actapi.c:1547 tcfactionadd+0xf6/0x5d0 net/sched/actapi.c:2101 [..] Freed by task 9391: kasansavestack+0x30/0x50 mm/kasan/common.c:57 kasansavetrack+0x14/0x30 mm/kasan/common.c:78 kasansavefreeinfo+0x3b/0x70 mm/kasan/generic.c:584 poisonslabobject mm/kasan/common.c:253 kasanslabfree+0x6b/0x90 mm/kasan/common.c:285 kasanslabfree include/linux/kasan.h:235 slabfreehook mm/slub.c:2689 slabfree mm/slub.c:6251 kfree+0x21f/0x6b0 mm/slub.c:6566 tcfactionoffloadaddex+0x4ad/0x880 net/sched/actapi.c:284 tcfactionoffloadadd net/sched/actapi.c:293 tcfactioninit+0x66e/0xa20 net/sched/actapi.c:1547 tcfactionadd+0xf6/0x5d0 net/sched/actapi.c:2101
The buggy address belongs to the object at ffff88806158de00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 64 bytes inside of freed 256-byte region [ffff88806158de00, ffff88806158df00)
The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806158d600 pfn:0x6158c head: order:1 mapcount:0 entiremap ---truncated---
hwmon: (corsair-cpro) Stop device IO before calling hidhwstop
hwmon: (nzxt-smart2) Stop device IO before calling hidhwstop
In the Linux kernel, the following vulnerability has been resolved:
watchdog: pretimeout: Fix UAF in watchdogunregistergovernor()
When a watchdog governor is unregistered, it updates existing watchdog devices that were using this governor by falling back to defaultgov.
If the governor being unregistered is currently set as defaultgov, the defaultgov is never cleared. This leads to 2 use-after-free issues: 1. New watchdog devices registered after this point will inherit the dangling defaultgov. 2. Existing watchdog devices using the unregistered governor will have their wdd->gov reassigned to the dangling defaultgov.
Fix the UAF by clearing defaultgov if it matches the governor being unregistered.
firewire: net: Fix fragmented datagram reassembly
In the Linux kernel, the following vulnerability has been resolved:
wifi: carl9170: fix buffer overflow in rxstream failover path
The failover continuation in carl9170rxstream() copies the full tlen from the second USB transfer instead of capping at rxfailovermissing bytes. When both transfers are near maximum size, the total exceeds the 65535-byte failover SKB, triggering skboverpanic.
Limit the copy size to the missing byte count.
[Fix checkpatch CHECK:PARENTHESISALIGNMENT]
In the Linux kernel, the following vulnerability has been resolved:
smb: client: validate DFS referral PathConsumed
parsedfsreferrals() validates that the response contains the fixed referral entry array and, on for-next, the per-referral string offsets. However, the response also contains a PathConsumed value that is later used for DFS path parsing.
If a malformed response provides a PathConsumed value larger than the search name, later DFS parsing can advance beyond the end of the path.
Validate PathConsumed against the search name length before storing it in the parsed referral.
hwmon: occ: validate poll response sensor blocks
In the Linux kernel, the following vulnerability has been resolved:
iommu/amd: Bound the early ACPI HID map
The ivrsacpihid command-line parser appends entries to a fixed four-element earlyacpihidmap array. Unlike the sibling IOAPIC and HPET parsers, it does not reject a fifth entry before incrementing the map size.
Check the capacity at the common found label before parsing the HID and UID or writing the entry.
In the Linux kernel, the following vulnerability has been resolved:
iommu/intel: Fix out-of-bounds memset in dmarlatencydisable()
dmarlatencydisable() intends to zero out only the single latencystatistic entry for the given type, but the memset size was computed as sizeof(lstat) DMARLATENCYNUM, which clears the entire array starting from &lstat[type].
When type > 0, this writes beyond the end of the allocated array, corrupting adjacent memory.
Fix by using sizeof(lstat) to clear only the target entry.
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7915: guard HE capability lookups
mt7915mcubsshetlv() and mt7915mcustabfertlv() both run after checking HE support, then dereference the HE PHY capability returned by mt76connacgethephycap(). That helper can return NULL when no capability entry matches the vif type.
Fetch the capability before appending the TLV and skip the HE-specific setup when no matching capability is available.
amt: re-read skb header pointers after every pull
In the Linux kernel, the following vulnerability has been resolved:
sctp: auth: verify auth requirement when authchunk is NULL
sctpauthchunkverify() returns true unconditionally when chunk->authchunk is NULL, silently skipping authentication. This is incorrect when:
1. skbclone() failed in the BH receive path, leaving authchunk NULL. In sctpendpointbhrcv() asoc is NULL for new connections, so the early sctpauthrecvcid() check cannot catch this.
2. No AUTH chunk precedes COOKIE-ECHO, so skbclone() is never called and authchunk remains NULL.
Fix by checking sctpauthrecvcid() when authchunk is NULL: if authentication is required, return false to drop the chunk; otherwise continue normally.
drm/amd/display: set newstream to NULL after release
In the Linux kernel, the following vulnerability has been resolved:
media: pci: dm1105: Free allocated workqueue
Destroy allocated workqueue in remove() callback to free its resources, thus fixing memory leak.
In the Linux kernel, the following vulnerability has been resolved:
media: rtl2832: fix use-after-free in rtl2832remove()
canceldelayedworksync() is called before i2cmuxdeladapters() in rtl2832remove(). While the cancel waits for any running instance of i2cgatework to finish, it does not prevent the timer from being rescheduled by a concurrent thread.
During probe, the r820tattach() call attempts I2C transfers through the mux adapter. These transfers go through i2cmuxmasterxfer(), which calls rtl2832deselect() after the transfer completes, rescheduling i2cgatework via scheduledelayedwork(). If this transfer is still in flight when rtl2832remove() runs, rtl2832deselect() can reschedule i2cgatework after it has been cancelled, causing a use-after-free when kfree(dev) is called.
Fix this by calling i2cmuxdeladapters() before canceldelayedworksync(). Once the mux adapter is unregistered, no new I2C transfers can go through it, so rtl2832deselect() can no longer reschedule i2cgatework. The subsequent canceldelayedworksync() is then guaranteed to be final.
In the Linux kernel, the following vulnerability has been resolved:
media: saa7134: Fix a possible memory leak in saa7134videoinit1
In saa7134videoinit1(), the return value of the first saa7134pgtablealloc() is not checked. If it fails, the function continues as if successful, leaving the driver with an invalid page table. Additionally, if vb2queueinit() for the VBI queue fails after the video queue page table has been allocated, the allocated memory is not freed before returning. The second saa7134pgtablealloc() also lacks a return value check. Errors occur during device probing before the device is fully registered, the normal cleanup path in saa7134finidev() is not executed, leading to memory leaks and potential use of uninitialized DMA resources.
Check the return value of both saa7134pgtablealloc() calls and propagate errors. On failure of any later step, free allocated page tables to avoid memory leaks. Ensure control handlers are also released on error to prevent further resource leakage.
Found by code review.
In the Linux kernel, the following vulnerability has been resolved:
media: stm32: dcmi: unregister notifier on probe failure
dcmigraphinit() registers the async notifier before dcmiprobe() toggles the reset line. If resetcontrolassert() or resetcontroldeassert() fails afterwards, probe returns through errcleanup and the driver core will not call dcmiremove().
Unregister the notifier before cleaning it up on that error path, matching the successful remove path and the V4L2 async notifier lifetime rules.
[hverkuil: added Fixes tag]
In the Linux kernel, the following vulnerability has been resolved:
media: ti: vpe: unwind v4l2 device registration on probe error
If the vpetop resource is missing, vpeprobe() returns -ENODEV after v4l2deviceregister() has succeeded. Probe failures do not call the driver's remove callback, so the v4l2 device remains registered on that error path.
Route that failure through the existing v4l2deviceunregister() unwind label, matching the other errors after v4l2deviceregister().
In the Linux kernel, the following vulnerability has been resolved:
intelth: fix MSC output device reference leak
intelthoutputopen() looks up the output device with busfinddevicebydevt(), which returns the device with a reference that must be dropped after use.
commit 95fc36a234da ("intelth: fix device leak on output open()") attempted to drop the reference from intelthoutputrelease(). However, a successful open replaces file->fop with the output driver file operations before returning, so close runs the output driver release callback instead.
For MSC outputs, close runs intelthmscrelease(), which only removes the per-file iterator and does not drop the device reference taken by intelthoutputopen(). Consequently, every successful MSC output open leaks one device reference.
Drop the device reference from intelthmscrelease(), which is the release path actually used for MSC output files. Remove the now-unused intelthoutputrelease() callback from intelthoutputfops.
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev
If the mmiopipeopen() fails to find a PCI device, the hiter->dev will be assigned to NULL. The mmiotrace read() function dereferences the hiter->dev if hiter exists.
Change the test of the read to not only check hiter being NULL, but also the hiter->dev before dereferencing it.
ceph: fix pre-auth out-of-bounds read on snaptrace in cephhandlecaps()
In the Linux kernel, the following vulnerability has been resolved:
libceph: Fix multiplication overflow in decodenewupstateweight()
If a message of type CEPHMSGOSDMAP contains a (maliciously) corrupted osdmap, out-of-bounds memory accesses may occur in decodenewupstateweight(). This happens because the bounds check for the newstate part is based on calculating its length depending on a len value read from the incoming message. This calculation may overflow leading to an incorrect bounds check. Subsequently, out-of-bounds reads may occur when decoding this part.
This patch switches the multiplication to use checkmuloverflow() to abort processing the osdmap if an overflow occurred. Therefore, osdmaps/messages containing large values for len that result in a multiplication overflow are treated as invalid.
[ idryomov: rename newstatelen -> newstateitemsize, formatting ]