Syzbot

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An issue exists in the High-availability Seamless Redundancy (HSR) implementation where a warning is incorrectly triggered in the `hsr addr is self()` function. The problem occurs because `hsr->self node` is cleared in `hsr del self node()`, which is called by `hsr dellink()`. Since `hsr dellink()` is executed before `unregister netdevice many()`, a timing window is created where a user can still access the device while `hsr->self node` has already been cleared, leading to an erroneous `WARN ONCE()` trigger. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An issue exists in the `ovl iterate merged()` function where the `err` variable is assigned the value of `PTR ERR(cache)` before verifying if `cache` is an error using `IS ERR(cache)`. When the operation is successful, `err` retains a truncated cache pointer, which may then be returned as an incorrect non-zero error. This behavior can be triggered during an overlay-on-overlay readdir operation involving the `getdents64` system call and the `ovl cache get()` function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An issue exists where an uninitialized stack variable is used within the `rseq exit user update()` function. This occurs because the evaluation order of expressions in an initializer list is indeterminately sequenced according to the C standard. Specifically, the compiler may evaluate `cpu to node(ids.cpu id)` before `ids.cpu id` has been initialized with `task cpu(t)`, leading to a kernel-infoleak in `rseq set ids get csaddr()`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An issue exists in the TCP implementation where a reference count underflow can occur in the ` inet csk reqsk queue drop()` function, potentially leading to a use-after-free condition. This occurs when `PREEMPT RT` is enabled and the `reqsk queue hash req()` function is preempted after the `mod timer()` call but before `refcount set()`. In this scenario, a timer may trigger and abort the request socket due to the listener closing, causing the request socket to miss necessary reference counts for both the ehash and the timer. The vulnerability involves the `reqsk->rsk refcnt` variable. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A slab-use-after-free issue exists in the `ipv6 chk acast addr()` function. The problem occurs when an anycast address (aca) is allocated and added to the `idev->ac list` under `idev->lock`, but is inserted into the global `inet6 acaddr lst[]` hash after the lock is released. A concurrent device teardown process can remove the aca from the `ac list` and attempt to delete it from the hash before the insertion has actually occurred. Consequently, the aca is later inserted into the hash and subsequently freed while still linked, leading to a dangling node that readers may dereference. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A null-pointer dereference occurs in the `remove waiter()` function when triggered via `FUTEX CMP REQUEUE PI`. This happens because `task blocks on rt mutex()` does not arm the waiter during deadlock detection, resulting in `waiter->task` being nil. Additionally, `rt mutex start proxy lock()` incorrectly calls `remove waiter()` after successfully grabbing the rtmutex. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An issue exists in the hfsplus module where the `hfs brec read()` function fails to validate that the on-disk record size matches the expected size for the record type being read. When mounting a corrupted filesystem, the function may perform a partial read, leaving parts of the data structure uninitialized. This uninitialized data in `tmp.thread.nodeName` is subsequently copied by `hfsplus cat build key uni()` and used by `hfsplus strcasecmp()`, which triggers a memory error when the uninitialized bytes are used as array indices in `case fold()`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 7.0.11-1.1 **Description** A reference count leak occurs in the ALSA caiaq component of the Linux kernel during probe failure. The `create card()` function increases the reference count of the USB device using `usb get dev()`, but the corresponding `usb put dev()` is only executed via the `card free()` destructor. Because the `->private free` destructor is assigned late in the `init card()` process, any failure occurring before this assignment—such as errors in `usb set interface()`, endpoint type checks, `usb submit urb()`, or the `EP1 CMD GET DEVICE INFO` exchange—prevents `card free()` from running. This results in a leak of the `struct usb device`, its descriptor allocations, and `device private` data. **Recommendations** Update to version 7.0.11-1.1 or newer.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An issue exists in the f2fs file system where the `f2fs finish read bio()` function may access uninitialized data in a folio if the system fails to read data from the device into that folio. This can lead to an uninitialized value access within the `f2fs sanity check node footer()` function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An uninitialized value bug exists where `flags valid` is not initialized before the `vfs fileattr get()` function is called. This issue occurs because the `fa` variable is not handled with the same initialization mechanism as the internal `file kattr` structure, potentially leading to instability in filesystem handlers, including those used in WSL and Azure containers. The issue was identified via a KMSAN report involving the `fuse fileattr get()` function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A locking and synchronization error exists in the USB dummy-hcd component. A race condition can occur between a USB reset and a driver unbind process. Specifically, the `stop activity()` function may drop and re-acquire the `dum->lock` spinlock. If this occurs within `set link state()` after checking `dum->ints enabled` but before incrementing `dum->callback usage`, another thread performing a driver unbind can clear `dum->ints enabled` and `dum->driver`. This leads to the `usb gadget udc reset()` function being called with a NULL driver argument, resulting in an addressing exception and system crash. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An issue exists in the hfs component where the use of `BUG ON` to detect overflows in `next id`, `folder count`, and `file count` within the super block info can be triggered if the MDB (Master Directory Block) is corrupted. This leads to a system crash instead of graceful error handling. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A reference count leak occurs in `struct xfrm state` within the Linux kernel. This issue arises because the `xfrm dev unregister()` function was implemented as a no-op, even though `xfrm dev state add()` (called via `xfrm state construct()`) acquires a reference to `struct net device`. Consequently, when a `NETDEV UNREGISTER` event occurs, the reference to the network device is not properly released, leading to a memory leak. The problem is exacerbated when the `NETIF F HW ESP` bit is cleared after the reference has been acquired, as the system fails to unconditionally flush the state and policy. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An overflow occurs in the 16-bit UDP length field when processing oversized PPPoL2TP packets with UDP encapsulation. The `l2tp xmit core()` function fails to check for overflows during the assignment of the UDP length field, causing the value to be trimmed to 16 bits. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An issue exists in the OCFS2 file system where the `ocfs2 validate inode block()` function fails to validate the size of inline data when reading an inode from disk. In cases of filesystem corruption, the `i size` variable can exceed the actual inline data capacity (`id count`). This discrepancy leads the `ocfs2 dir foreach blk id()` function to iterate beyond the inline data buffer, resulting in a use-after-free (UAF) condition—where the system continues to use a pointer after it has been freed—when accessing directory entries via the `ocfs2 check dir entry()` function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An issue exists in the erofs component where plain data is incorrectly classified as interlaced plain extents if the start position and on-disk physical length are not both aligned to the block size. In such cases, the data should be treated as shifted plain extents. This can lead to an out-of-bounds (OOB) read—a condition where the system reads data past the end of the intended buffer—within the `z erofs transform plain()` function when processing a crafted compressed image containing plain extents with unaligned physical lengths. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A circular locking dependency exists in the ntfs3 component, specifically within the `run unpack ex()` function. This issue occurs due to an AB-BA deadlock scenario where `ntfs extend mft()` acquires `ni->file.run lock` followed by `wnd->rw lock`, while `run unpack ex()` acquires `wnd->rw lock` and subsequently attempts to acquire `ni->file.run lock` inside `ntfs refresh zone()`. An AB-BA deadlock is a situation where two different threads are waiting for each other to release locks, causing the system to hang. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A use-after-free condition exists in the f2fs component of the Linux kernel. The issue occurs in the `f2fs write end io()` function when `sbi->nr pages[F2FS WB CP DATA]` is decremented to zero. This can lead to a NULL pointer dereference in the `f2fs in warm node list()` function because `f2fs put super()` may set `sbi->node inode` to NULL concurrently. This race condition results in a system panic when the kernel attempts to check if a folio belongs to the node inode. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A use-after-free issue exists in the Linux kernel within the `sk psock verdict data ready()` function. The problem occurs in `unix stream sendmsg()` when the peer socket's `sk data ready()` is called after the `unix state lock()` has been dropped. While the sender socket maintains the peer's reference count, it does not prevent the peer's `sock orphan()` process, which can lead to the peer's `sk socket` being freed after one RCU (Read-Copy-Update) grace period. RCU is a synchronization mechanism that allows multiple readers to access data while a writer updates it. This can result in a slab-use-after-free when accessing `sk->sk socket` and `sk->sk socket->ops`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel version 6.19.0-rc8 **Description** A soft lockup can occur in the `mptcp recvmsg()` function. When receiving data with `MSG PEEK` and `MSG WAITALL` flags, the socket buffer (skb) is not removed from the `sk receive queue`. This causes the `sk wait data()` function to continuously find available data without performing an actual wait, resulting in an infinite loop and a system soft lockup. **Recommendations** Update the Linux kernel to a version where the `mptcp recvmsg()` function has been patched to include a `last` parameter for tracking the last peeked socket buffer.