Ming Lei

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A use-after-free issue has been identified in the Linux kernel's ublk module. This occurs when the `add disk()` function fails, potentially causing the `gendisk` to be freed before `ublk abort requests()` is called. As a result, a use-after-free condition can arise when attempting to access the disk's reference within `ublk abort requests()`. The issue is triggered when exiting the uring context or handling timeouts, and it affects the `ublk abort requests()` function, which grabs the `gendisk` to abort all inflight requests. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: A vulnerability has been resolved in the Linux kernel related to the `ublk` module. The issue concerns the `UBLK F USER COPY` feature, which requires userspace to call `write()` on the `ublk` character device to fill the request buffer. Since unprivileged devices cannot be trusted, the kernel now disallows user copy for unprivileged devices to prevent potential exploitation. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.6.37 **Description** The issue is related to the blk-cgroup component in the Linux kernel, where list corruption can occur when resetting io stat. This happens because each iostat instance is added to the blkcg percpu list, and the `blkcg reset stats()` function cannot reset the stat instance using `memset()`, which may cause the llist to be corrupted. The problem is fixed by only resetting the counter part. **Recommendations** To resolve the issue, update the Linux kernel to version 6.6.37 or later. As a temporary workaround, consider restricting access to the vulnerable `blkcg reset stats()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the corruption of the `q->blkg list` during disk rebind in the Linux kernel. When multiple gendisk instances are allocated or added for a single request queue in case of disk rebind, `blkg` may still stay in `q->blkg list` when calling `blkcg init disk()` for rebind, resulting in corruption of `q->blkg list`. The corruption is caused by a commit that delays removing `blkg` from `q->blkg list` into `blkg free workfn()`. The fix involves initializing `q->blkg list` and `q->blkcg mutex` using `blkg init queue()` and moving the call to `blkg init queue()` into `blk alloc queue()`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the `scsi host busy()` function in the Linux kernel, which can cause a hard lockup when acquiring a host lock during recovery. This occurs when there are a large number of hardware queues and a high queue depth, leading to a significant number of iterations over tag/requests. The problem is resolved by calling `scsi host busy()` outside the host lock, as the host lock is not necessary for getting the busy count. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A use-after-free issue in the Linux kernel has been resolved. The problem occurred in the blk-mq component, specifically in the `blk mq run hw queues()` function, which could be executed when there were no queued requests and after the queue was cleaned up. At this point, the `tagset` is freed because its lifetime is managed by the driver and is often released after `blk cleanup queue()` returns. To avoid this issue, the kernel no longer accesses the `->tagset` to determine the current default `hctx` by using the mapping built into the request queue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A issue in the Linux kernel has been identified where a poll request is not completed when it times out, causing the request to be leaked and never completed. This occurs because when a poll request is timed out, it is removed from the poll list but not completed. **Recommendations** For the Linux kernel, fix the issue by ending the poll request in the timeout handler.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the Linux kernel, where a vulnerability has been resolved. The vulnerability is associated with the device mapper (DM) and its interaction with the block multiqueue (blk-mq) subsystem. Specifically, the DM uses blk-mq's quiesce/unquiesce mechanism to stop and start the device mapper queue. However, the unquiesce operation may be triggered by outside events, such as elevator switches or updates to nr requests, which can cause requests to be queued during suspend. To address this, the fix involves asking blk-mq to requeue the request. This resolves a kernel panic issue that occurs when running the updating nr requests and dm-mpath suspend/resume stress test. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a memory leak in the Linux kernel's SCSI core. When a device is initialized via `device initialize()` or its name is set via `dev set name()`, it must be freed via `put device()` to prevent a memory leak. The leak occurs because the device name is allocated dynamically in `dev set name()`. The fix involves replacing `kfree()` with `put device()` and removing special-casing for IDA and kthread removal from the error handling, as `scsi host dev release()` properly handles these. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Android kernel **Description** The issue is related to a possible use after free due to a race condition in the blk-mq-tag-to-rq function. This could potentially lead to local escalation of privilege. **Recommendations** For Android kernel, consider applying a patch to fix the race condition in the blk mq tag to rq function to prevent use after free and potential privilege escalation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.