Sasha Levin

A reference counting issue in the Linux kernel has been identified, specifically in the atmel nand controller init function. This issue occurs in several error handling paths where the function returns an error code without properly balancing the reference count of the `nc->dmac` object, which was previously increased by `dma request channel()`. This can lead to refcount leaks.

A vulnerability in the Linux kernel has been resolved. The issue occurs when the SCM driver fails during the probe, leaving the global ' scm' variable assigned. This can cause external users of the driver to assume the probe finished successfully, potentially leading to a NULL pointer exception. The problem is triggered by introducing probe deferral in the SCM driver.

The issue concerns a NULL dereference in the `nfsd4 process cb update()` function. Specifically, the `@ses` variable is initialized to NULL. If the ` nfsd4 find backchannel()` function does not find an available backchannel session, the `setup callback client()` function will attempt to dereference `@ses`, resulting in a segmentation fault.

A possible ABBA deadlock vulnerability has been identified in the Linux kernel, specifically in the netfilter IDLETIMER module. This issue occurs when the deletion of the last rule referencing a given idletimer happens simultaneously with a read of its file in sysfs, resulting in a possible circular locking dependency. A simple reproducer for this issue is provided, demonstrating how the deadlock can occur. The vulnerability is resolved by freeing the `list mutex` immediately after deleting the element from the list and then continuing with the teardown.

A use-after-free issue was encountered in the Linux kernel, specifically in the net/smc component. This issue manifested as the LGR/link refcnt reaching 0 early and entering the clear process, making resource access unsafe. The problem is caused by repeated release of LGR/link refcnt, potentially due to smc conn free() being called repeatedly without sock lock protection.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: A vulnerability in the Linux kernel has been resolved, related to the `net: arc` module, specifically with the `dma map single` and `dma unmap single` functions. The issue arises because `ndev->dev` and `pdev->dev` are not the same device, and using `ndev->dev.parent` is necessary as it has a `dma mask`. This vulnerability could cause a warning, as seen in the kernel log, indicating a potential issue with CPU and PID. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue concerns memory corruption caused by array indices being out of bounds. To address this, checks have been added to ensure array indices stay within bounds, specifically in the drm/amd/display component of the Linux kernel.

A critical vulnerability in the Linux kernel's PCI keystone component has been fixed. The issue involved the `ks pcie quirk()` function, where an if-statement expression accidentally used `&&` instead of `||`, potentially resulting in a NULL dereference. This fix corrects the if-statement expression to use the correct condition.

The issue occurs when a monitor connected after an MST hub is unplugged, resulting in a null pointer dereference. This happens because `dc sink` is released immediately in `early unregister()` or `detect ctx()`, and committing a new state that refers to information stored in `dc sink` causes a null pointer dereference. The problem is resolved by removing a redundant checking condition and resetting `dsc aux` to NULL when the connector is disconnected.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: A string buffer overrun vulnerability has been resolved in the Linux kernel. The issue occurs when copying `media name` and `if name` to `name parts`, which may overwrite the destination. This is due to the use of `strcpy()` with insufficient buffer size checks, as reported by Smatch. The vulnerable code is located in `bearer.c` at lines 166 and 167, where `media name` and `if name` are too large for `name parts->media name` and `name parts->if name`, respectively. The vulnerability was introduced by commit `b97bf3fd8f6a` ("[TIPC] Initial merge"). Recommendations: For Linux kernel versions prior to 6.6.58, update to version 6.6.58 or later to resolve the vulnerability. As a temporary workaround, consider using `strscpy()` instead of `strcpy()` and failing if truncation occurs to prevent buffer overruns. Restrict access to the vulnerable `bearer name validate()` function until the issue is resolved. Avoid using the `media name` and `if name` variables in the affected code paths until the update is applied.

The issue is related to a race condition in the Linux kernel's drm/lima component. This race condition can occur when a rendering job takes long enough to trigger the drm sched job timeout handler but still completes before the hard reset is done by the timeout handler. In some cases, this can result in a refcount imbalance on lima pm idle. The problem can be prevented by masking the irqs at the beginning of the timeout handler.

In CoCo VMs, it is possible for the untrusted host to cause `set memory encrypted()` or `set memory decrypted()` to fail, resulting in shared memory. Callers need to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. The `netvsc` driver could free decrypted/shared pages if `set memory decrypted()` fails. Checking the `decrypted` field in the `gpadl` can decide whether to free the memory.

The issue is related to the Bluetooth L2CAP protocol in the Linux kernel, where user input is not properly validated for the setsockopt function. This could potentially lead to issues when copying data if the user input length is not checked beforehand.

The issue is related to an out-of-bounds access in the mmhub client id handling, specifically with cid 0x140. This has been resolved by properly handling the cid.

The issue is related to a functional regression in the Linux kernel's swiotlb component, which causes double-allocation of slots due to broken alignment handling. This can lead to buffer corruption and/or a hang when using vsock in a virtual machine with a restricted DMA SWIOTLB pool. The problem occurs because swiotlb alloc() expects a page-aligned allocation but returns a pointer to the 'struct page' corresponding to the allocation, resulting in double-allocation of the first half of the 4KiB page. The issue is resolved by treating the allocation alignment separately from any additional alignment requirements from the device.

The vulnerability is related to the NFS component of the Linux kernel. It is caused by incorrect locking in the `nfs netfs issue read()` function, which can lead to a deadlock when interrupts are not disabled while iterating through pages in the xarray to submit for NFS read. This issue can be reproduced with a specific test and may cause inconsistent lock state warnings on a lockdep-enabled kernel. The problem can occur when another page in the mapping is processed for writeback inside an interrupt, leading to a potential deadlock.

The issue is related to the I/O page fault handler in the Linux kernel, which currently locates the PCI device by calling `pci get domain bus and slot()`. This function searches the list of all PCI devices until the desired device is found. To improve lookup efficiency, it is replaced with `device rbtree find()` to search the device within the probed device rbtree. The I/O page fault is initiated by the device, which does not have any synchronization mechanism with the software to ensure that the device stays in the probed device tree. Theoretically, a device could be released by the IOMMU subsystem after `device rbtree find()` and before `iopf get dev fault param()`, which would cause a use-after-free problem. A mutex is added to synchronize the I/O page fault reporting path and the IOMMU release device path.

The issue is related to the ubifs component of the Linux kernel, where page cache reads are lockless. This allows a simultaneous reader to see old data if the freshly allocated page is set uptodate before the new data is copied into it. The vulnerability can be exploited to cause a denial of service. The `SetPageUptodate` call has been moved to `ubifs write end()`, after the new data has been copied into the page, to resolve the issue. The functions `write begin slow()`, `ubifs write begin()`, and `ubifs write end()` in `fs/ubifs/file.c` are involved in the vulnerability.

The issue is related to the drm/amd/display component of the Linux kernel, where two problems have been fixed: a comparison with a wider integer type in a loop condition that can cause infinite loops, and a pointer dereference before a null check.

The issue is related to a null pointer dereference in the `ice ptp.c` file of the Linux kernel, specifically with the `devm kasprintf()` function, which can return a null pointer upon failure. This can potentially allow an attacker to cause a denial of service.