Johan Hovold

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: A vulnerability in the Linux kernel has been resolved, specifically in the phy: qcom: qmp-usbc driver. The issue was caused by a commit that removed the initialisation of the platform device driver data, despite it still being used in the runtime PM callbacks. This led to a NULL-pointer dereference on runtime suspend. The bug was reproduced when the driver was copied to create the qmp-usbc driver. The fix involves restoring the driver data initialisation at probe. It is noted that runtime PM is not commonly used and needs to be enabled manually through sysfs. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.61 Description: A vulnerability in the Linux kernel has been resolved, specifically in the phy: qcom: qmp-usb module. The issue was caused by a commit that removed the initialisation of the platform device driver data, despite it still being used in the runtime PM callbacks. This led to a NULL-pointer dereference on runtime suspend. The vulnerability is resolved by restoring the driver data initialisation at probe. It is noted that runtime PM is not commonly used and needs to be enabled manually through sysfs with this driver. Recommendations: For Linux kernel versions prior to 6.6.61, update to version 6.6.61 or later to resolve the issue. As a temporary workaround, consider disabling runtime PM through sysfs to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.61 Description: A vulnerability in the Linux kernel has been resolved, specifically in the phy: qcom: qmp-usb-legacy driver. The issue arose from a commit that removed the initialisation of the platform device driver data, despite it still being used in the runtime PM callbacks. This bug was later reproduced when the driver was copied to create the qmp-usb-legacy driver. The vulnerability can cause a NULL-pointer dereference on runtime suspend. It is noted that runtime PM is not commonly used and needs to be enabled manually through sysfs. Recommendations: For Linux kernel versions prior to 6.6.61, update to version 6.6.61 or later to resolve the issue. As a temporary workaround, consider disabling runtime PM through sysfs to minimize the risk of exploitation.

The issue is related to a race condition during the initialization of the pmic glink child drivers in the Linux kernel. As pointed out by Stephen Boyd, the protection-domain notifiers may fire and schedule associated work before the client registration returns, resulting in a NULL pointer dereference as the `client` pointer is blindly dereferenced. This occurs when the protection domain registry is populated at the time of registration, which became more likely with the introduction of the commit '1ebcde047c54 ("soc: qcom: add pd-mapper implementation")'. The vulnerable code is identical across the altmode, battery manager, and usci child drivers.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to the Linux kernel, specifically the media: qcom: camss component. A vulnerability has been resolved by removing the use count guard in stop streaming. The use count check was introduced to handle multiple concurrent Raw Data Interfaces (RDIs) driven by different virtual channels (VCs) on the CSIPHY input driving the video pipeline. However, this is an invalid use of use count, as it pertains to the number of times a video entity has been opened by user-space, not the number of active streams. If use count and stream-on count don't agree, then stop streaming() will break, which has become apparent when using CAMSS with libcamera's released softisp 0.3. The use of use count like this is a bit hacky and breaks regular usage of CAMSS for a single stream case. Stopping qcam results in an error and cannot be started again, with attempts to do so failing with -EBUSY. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to the mos7840 driver in the Linux kernel, which can cause a crash on resume due to the lack of dedicated suspend and resume functions. This can be triggered when the USB serial core calls the generic resume implementation, and both port read URBs are submitted on resume for open ports, but the context pointer of the second URB is left set to the core rather than the mos7840 port structure. The problem was introduced after support for multiple read URBs was added in 2011.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to the qca component of the Linux kernel's Bluetooth functionality, where missing firmware sanity checks can lead to memory corruption beyond the vmalloced buffer when parsing firmware files. This can result in a denial of service. The vulnerability is caused by improper input validation. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to a component in the Linux kernel, specifically the qca component, which has a problem with incorrect input validation. This can lead to information leakage when fetching the firmware build ID. The vulnerability is resolved by adding missing sanity checks and moving the build-id buffer off the stack to prevent leaking stack data through debugfs in case of a malformed build-info reply. There is no information about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to a Bluetooth component in the Linux kernel, specifically the qca module, which has a problem with incorrect input validation. This can lead to an information leak when fetching the board id, potentially causing a denial of service (DoS). The missing sanity check when fetching the board id allows slab data to leak when later requesting the firmware. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to a NULL-pointer dereference in the Linux kernel's Bluetooth qca component. Qualcomm ROME controllers can be registered from the Bluetooth line discipline, and in this case, the HCI UART serdev pointer is NULL. A missing sanity check has been added to prevent the NULL-pointer dereference when the setup() function is called for a non-serdev controller. This could potentially allow an attacker to cause a denial of service.

The issue is related to a NULL-pointer dereference in the Linux kernel's qca component, specifically in the `wakeup()` function when called for a non-serdev controller during suspend. Qualcomm ROME controllers can be registered from the Bluetooth line discipline, and in this case, the HCI UART serdev pointer is NULL. The vulnerability can be exploited to cause a denial of service.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: A use-after-free issue has been identified in the Linux kernel, specifically in the pmic glink altmode driver. This issue arises due to a race condition where the dp-hpd bridge is registered before all resources have been acquired, allowing it to be deregistered on probe deferrals. As a result, when the display controller is initialized, it may trigger a use-after-free error when attaching bridges, potentially causing the display subsystem to fail to initialize or resulting in NULL-pointer dereferences. The issue has been observed in machines like the Lenovo ThinkPad X13s. The fix involves moving the bridge registration in the pmic glink altmode driver to after all resources have been looked up. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A potential deadlock can occur when enabling ASPM during the probe of Qualcomm PCIe controllers, as reported by lockdep. This issue is caused by a possible recursive locking scenario where a task tries to acquire a lock that it already holds, leading to a deadlock. The deadlock can be easily reproduced on machines like the Lenovo ThinkPad X13s by adding a delay to increase the race window during asynchronous probe, allowing another thread to take a write lock.

The issue is related to a NULL pointer dereference in the `i2c hid of probe()` function in the Linux kernel's HID device driver for I2C. This occurs when the I2C HID implementation is split into ACPI and OF parts, but the new OF driver fails to initialize the client pointer, which is then dereferenced on power-up failures. This could allow an attacker to cause a denial of service.

The issue is related to the Qualcomm SPMI PMIC revid implementation, which is broken in multiple ways. It assumes a sibling base device is bound to a driver after registration, potentially triggering a NULL-pointer dereference. The implementation also accesses driver data directly without locking, allowing the data to be freed during access, and leaks a struct device reference. This could lead to a denial of service. The revid lookup has been reimplemented to fix these issues, doing the lookup only at the probe of the PMIC device.

The issue is related to the wifi: ath11k: fix htt pktlog locking in the Linux kernel. The ath11k active pdevs are protected by RCU, but the htt pktlog handling code calling `ath11k mac get ar by pdev id()` was not marked as a read-side critical section. This could lead to potential use-after-free issues. The code in question has been marked as an RCU read-side critical section to avoid these issues.

The issue is related to the wifi: ath11k: fix dfs radar event locking in the Linux kernel. The ath11k active pdevs are protected by RCU, but the DFS radar event handling code calling `ath11k mac get ar by pdev id()` was not marked as a read-side critical section. This could lead to potential use-after-free issues. The code in question has been marked as an RCU read-side critical section to avoid these issues.

The issue is related to the wifi: ath12k module in the Linux kernel, where the DFS-radar and temperature event handling code was not properly marked as a read-side critical section, potentially leading to use-after-free issues. The `ath12k mac get ar by pdev id()` function is involved in this issue. The temperature event handler is currently a placeholder but could still trigger an RCU lockdep splat.

The issue is related to a NULL pointer dereference in the EFI initialization error path. When runtime services are not supported or have been disabled, the runtime services workqueue is never allocated. To avoid dereferencing a NULL pointer, the workqueue should not be destroyed unconditionally in the event of EFI initialization failure. This issue may allow an attacker to cause a denial of service.

A issue in the Linux kernel has been resolved, related to a struct clk leak on probe errors in the phy: qcom-qmp module. The problem occurred when a late probe error happened, such as probe deferral, and the pipe clock reference was not released.