Ben Greear

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: A vulnerability in the Linux kernel has been resolved by reverting a commit that removed unnecessary RCU-bh critical section protection. The `dev queue xmit nit` function is expected to be called with BH disabled, and the ` dev queue xmit` function has a lock to prevent soft irqs for various locks below and stops preemption for RCU. The referenced commit removed this protection, triggering a lockdep warning due to inconsistent lock state. The warning indicates a possible unsafe locking scenario that could lead to a deadlock. Recommendations: To resolve the issue, update to Linux kernel version 6.6.58 or later. As a temporary workaround, consider disabling the `vrf` module until a patch is available. Restrict access to the `dev queue xmit nit` function to minimize the risk of exploitation. Avoid using the `rcu read lock bh` function in the affected code path until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: A vulnerability has been resolved in the Linux kernel where the `alloc tag module unload` function must wait for pending `kfree rcu` calls. This issue occurs when the `nf nat` module exit calls `kfree rcu` on addresses, but the free operation is still pending when `alloc tag` checks for leaks. Waiting for outstanding `kfree rcu` operations to complete before checking resolves this warning. A reproducer is provided using `unshare`, `iptables-nft`, and `rmmod` commands. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to the debugfs feature in the Linux kernel, where a logic error in the wait/cancellation handling during remove operations can cause deadlocks. Specifically, when the refcount hits zero, the completion can be finished without waiting, but if it doesn't, all cancellations need to be triggered. However, the current implementation can never enter the loop to trigger these cancellations. This problem occurs even when debugfs cancellations are used, and it happens during concurrent debugfs remove operations while files are being accessed.

توجد حالة تنافسية من نوع «use-after-free» في نواة لينكس، وتحديدًا في الوحدة النمطية mt76، تتعلق بحالة tx عند إزالة المحطة. هناك نافذة زمنية قصيرة يمكن خلالها أن تؤدي نشاطات «tx» الجارية إلى إضافة skb إلى idr لتتبع الحالة بعد مسحه، مما يبقي wcid مرتبطًا بقائمة استطلاع الحالة. تحدث هذه المشكلة بسبب توقيت إعادة تعيين مؤشر wcid إلى الصفر في dev->wcid أثناء تنفيذ mt76 sta pre rcu remove.

توجد مشكلة «استخدام بعد التحرير» (use-after-free) في الدالة `mt7921 stop()` داخل الوحدة النمطية `drivers/net/wireless/mediatek/mt76/mt7921/main.c` الخاصة ببرنامج تشغيل محول Mediatek اللاسلكي. تحدث هذه المشكلة عندما تفشل بطاقة واجهة الشبكة (NIC) في التشغيل ويكون `reset work` قد تم جدولته بالفعل؛ فإذا تم استدعاء عملية التنظيف قبل تنفيذ عنصر العمل، فقد يؤدي ذلك إلى تعطل النظام. قد يؤثر استغلال هذه المشكلة على سرية وسلامة وتوافر المعلومات المحمية.

The issue is related to the mac80211 subsystem in the Linux kernel, which allows attackers to cause a denial of service by injecting a frame with 802.11a rates when a device supporting only 5 GHz is used. This results in a NULL pointer dereference in the radiotap parser.

A vulnerability in the Linux kernel has been resolved, specifically in the mt76 module for the mt7915 device. The issue was related to the tx skb dma unmap, where the first pointer in the txp needed to be unmapped to prevent leaking DMA mapping entries.