Greg Kroah-Hartman

An issue exists in the Linux kernel where the `xe vm madvise ioctl()` function fails to validate Page Attribute Table (PAT) indices. Specifically, using the `XE COH NONE` coherency mode with CPU cached buffers allows a GPU to bypass CPU caches and read stale, sensitive data directly from DRAM. This occurs because when the kernel clears pages before reallocation, the clear operation may remain in the CPU cache as dirty data, potentially leaking information from previously freed pages belonging to other processes.

An issue exists in the `memcg reparent list lrus()` function where the xarray entry of a dying memory control group (memcg) is cleared using `xas store(&xas, NULL)` before its per-node lists are reparented. This sequence creates a race condition where a concurrent `list lru del()` operation may fail to find the entry via `xa load()`, proceed to the parent memcg in `lock list lru of memcg()`, and execute `list del init()` on an item still linked to the dying memcg's list. If another thread simultaneously holds the dying memcg's per-node lock—such as during another `list lru del()` or a `list lru walk one()` isolate callback—both threads may modify the `->next` and `->prev` pointers of the same physical list using different locks, leading to the corruption of adjacent items' links.

A heap overflow exists in the `get manuf info()` function. The issue occurs because the function reads a number of bytes specified by the `Size` field from a device I2C EEPROM into a buffer allocated with `kmalloc obj()`, which has a fixed size of 10 bytes. While the `Size` field is validated in `check i2c image()` to ensure it does not exceed 16384 bytes, it is not checked against the actual destination buffer size. A malicious USB device can set the `Size` field to a value up to 16377, leading to a heap overflow of up to 16367 bytes. Additionally, the `valid csum()` function iterates through the buffer based on the `Size` field, further compounding the out-of-bounds access.

An issue exists in the `accel/ivpu` component where the `get info ioctl()` function fails to validate the info size returned from the metric stream info query against the allocated buffer size. This lack of validation could lead to a buffer overflow if the firmware returns a size larger than the available buffer.

A use-after-free issue exists in the Linux kernel due to a missing zerocopy reference in the `pskb carve inside header()` and `pskb carve inside nonlinear()` functions. Both functions copy the `skb shared info` header into a new buffer using `memcpy()`, which includes the `destructor arg` pointer (`uarg`) for MSG ZEROCOPY skbs. Because these functions fail to call `net zcopy get()` for the new `shinfo`, the reference count `uarg->refcnt` can be driven to zero prematurely. This leads to the premature freeing of `ubuf info msgzc` while TX skbs still hold active `destructor arg` pointers. This flaw has been verified to allow an unprivileged local user to achieve full root privilege escalation on a default kernel configuration.

An issue exists in the thunderbolt component where the `tb xdp properties request()` function derives the per-packet copy length from the response header without verifying if it fits within the previously allocated data buffer. A malicious peer can manipulate the length field to be larger than the declared `data length`, leading to a memory corruption where `memcpy` writes beyond the `kcalloc` allocation.

A flaw exists in the `af alg` cryptography module of the Linux kernel. An arithmetic overflow occurs when processing associated data lengths during the transmit buffer size check. A remote attacker can trigger this by providing a specially crafted associated data length, which may result in a denial of service (DoS) caused by system instability.

An integer overflow exists in the `kvm reset dirty gfn()` function within the Kernel-based Virtual Machine (KVM) component. A local attacker with access to `/dev/kvm` can manipulate dirty ring entries to cause a u64 wrap during an unchecked addition. This allows the attacker to bypass a bounds check, leading to an out-of-bounds load of a `kvm rmap head` and a subsequent conditional clear of `PT WRITABLE MASK` in the memory location pointed to by the loaded pointer. This flaw can result in information disclosure or a denial of service.

A desynchronization issue exists in the `nft inner parse l2l3()` function when processing inner IPv6 packets. While the `ipv6 find hdr()` function correctly calculates the transport header offset by traversing extension headers, this value is incorrectly overwritten by a calculation that only accounts for the IPv6 base header. This results in a mismatch between `inner thoff`, which incorrectly points to the start of the extension header, and `l4proto`, which correctly identifies the protocol (e.g., IPPROTO TCP). This discrepancy allows for transport header forgery and potential firewall bypass.

A flaw exists in the drm/xe/dma-buf subsystem involving race conditions when handling the `invalidate mappings` hook during buffer object initialization and attachment. These races occur because a buffer object may be visible on the attachments list before it is fully initialized or after it has been freed following an initialization failure. An attacker could exploit these conditions to trigger a Use-After-Free (UAF) or a NULL pointer dereference in `evict flags`, potentially leading to system instability, crashes, and a Denial of Service (DoS).

A race condition exists in the Input/Output Memory Management Unit (IOMMU) subsystem, which manages how devices access system memory. This occurs during device recovery when multiple memory domains are attached concurrently. Specifically, the ` iommu group set domain internal()` function rejects concurrent domain attachments if any device in the group is recovering, which triggers a WARN ON in ` iommu group set domain nofail()`. This can lead to a Use-After-Free (UAF) condition—where the system attempts to use memory that has already been released—potentially allowing a local attacker to execute unauthorized code or cause a system crash (denial of service).

A use-after-free flaw exists in the `ipc idr alloc()` function within the checkpoint/restore path for SysV Inter-Process Communication (IPC) ID allocation. The function forwards requests to `idr alloc()` with an open-ended upper bound. When the valid SysV IPC ID space is full, allocations can exceed `ipc mni`, resulting in IDs that use normal index encoding but target incorrect slots during lookup and removal. This breaks the IDR state and can leave a dangling pointer in the IDR entry. Specifically, for shared memory, the `shm destroy()` function may free an object while leaving a stale entry that, when accessed via `/proc/sysvipc/shm`, leads to a dereference of freed memory. This issue can be exploited by local attackers to achieve local privilege escalation to root. Technical details include: - **Vulnerable Function**: `ipc idr alloc()` - **Vulnerable Variable**: `ids->next id` passed to `idr alloc()` with a zero upper bound.

A use-after-free or type confusion issue exists in the SCTP implementation of the Linux kernel. In the `sctp sendmsg()` function, the `SCTP SENDALL` path iterates through associations using `list for each entry safe()`, which caches the next entry in the `tmp` variable. The function calls `sctp sendmsg to asoc()`, which may drop the socket lock within `sctp wait for sndbuf()`. While the lock is released, another thread can migrate the cached association to a new endpoint via `sctp sock migrate()` or free it due to a network ABORT. Because the `tmp` variable is not revalidated after the lock is re-acquired, the iterator may advance to a stale pointer, leading to a use-after-free if the socket was closed, or type confusion if the association was migrated. The type confusion path can allow a controlled indirect call via the `outqueue.sched->init sid` pointer.

A use-after-free or double-free condition exists in the mac80211 wireless subsystem when debugfs is enabled. This occurs during MLO (Multi-Link Operation) connections if connection preparation fails, causing the interface to reset to non-MLD (Multi-Link Device). In this scenario, the system fails to remove the associated station, leading to memory corruption because the virtual interface (vif) recreates its entire debugfs structure.

Two error handling issues exist within the `drm/xe` graphics driver in the `xe exec queue create ioctl()` function. The first issue occurs when `xe hw engine group add exec queue()` fails; the error path skips `xe exec queue kill()`, which leaves the queue on the VM's compute exec queue list if the VM is in preempt fence mode, resulting in a dangling pointer. The second issue occurs when `xa alloc()` fails after `xe hw engine group add exec queue()` succeeds; the error path fails to call `xe hw engine group del exec queue()`, leaving the queue linked into the hw engine group while it is being freed, causing a use-after-free. A local attacker could exploit these flaws to cause a system crash or gain elevated privileges.

A Use-After-Free issue exists in the xfrm component of the Linux kernel. After asynchronous crypto completes, the `xfrm input resume()` function calls `dev put()` immediately upon re-entry before the socket buffer (skb) reaches transport finish. Because the `skb->dev` pointer is subsequently used inside NF HOOK and its okfn, a race condition can occur with device teardown.

A double-free flaw exists in the Transparent Inter-Process Communication (TIPC) module. The issue occurs within the `tipc buf append()` function when it incorrectly handles memory after a socket buffer (skb) reallocation. Specifically, `tipc msg validate()` may reallocate the skb it is validating and free the old one; if validation subsequently fails, the error handling path frees the original skb pointer again. This memory corruption can lead to system instability, denial of service, or potentially arbitrary code execution.

An issue exists in the `authencesn` component of the crypto subsystem where the `crypto authenc esn create()` function fails to validate the `auth->digestsize` before copying it into `inst->alg.maxauthsize`. This allows the creation of instances with an invalid default `authsize` between 1 and 3 bytes when using an ahash with a corresponding digest size, such as `cbcmac(cipher null)`. Consequently, the `AF ALG` interface can trigger ESN tail handling with an insufficient tag length, leading to an out-of-bounds access.

A flaw in the netfilter conntrack module occurs due to the use of the `sprintf()` function and insufficient buffer sizing within the `mangle content len()` function. This can lead to a stack-out-of-bounds write, a type of memory corruption where data is written beyond the boundaries of a fixed-length buffer on the stack. This issue could potentially be exploited to cause a denial of service.

A flaw in the ice network driver occurs during network packet transmission. When the `ice tso()` or `ice tx csum()` functions fail, the error path in `ice xmit frame ring()` frees the network buffer (skb), but the transmit buffer (`tx buf`) continues to point to it and remains marked as valid. If the network interface is brought down before another packet is transmitted to overwrite the buffer, the `ice clean tx ring()` function calls `ice unmap and free tx buf()`, which frees the skb a second time. This double-free can result in a system crash or denial of service (DoS).