Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/xe/userptr: Hold notifier_lock for write on inject test path<br /> <br /> When CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y, xe_pt_svm_userptr_pre_commit()<br /> runs vma_check_userptr() with the svm notifier_lock taken for read. The<br /> test injection causes vma_check_userptr() to call<br /> xe_vma_userptr_force_invalidate(), which feeds into<br /> xe_vma_userptr_do_inval() with drm_gpusvm_ctx.in_notifier=true. That<br /> flag tells drm_gpusvm_unmap_pages() the caller already holds<br /> notifier_lock for write and only asserts the mode. Because the caller<br /> actually holds it for read, the assertion fires:<br /> <br /> WARNING: drivers/gpu/drm/drm_gpusvm.c:1669 at \<br /> drm_gpusvm_unmap_pages+0xd4/0x130 [drm_gpusvm_helper]<br /> Call Trace:<br /> xe_vma_userptr_do_inval+0x40d/0xfd0 [xe]<br /> xe_vma_userptr_invalidate_pass1+0x3e6/0x8d0 [xe]<br /> xe_vma_userptr_force_invalidate+0xde/0x290 [xe]<br /> vma_check_userptr.constprop.0+0x1c6/0x220 [xe]<br /> xe_pt_svm_userptr_pre_commit+0x6a3/0xc60 [xe]<br /> ...<br /> xe_vm_bind_ioctl+0x3a0a/0x4480 [xe]<br /> <br /> Acquire notifier_lock for write in pre-commit when the inject Kconfig<br /> is enabled, via new helpers xe_pt_svm_userptr_notifier_lock()/_unlock().<br /> Rename xe_svm_assert_held_read() to<br /> xe_svm_assert_held_read_or_inject_write() so it asserts the correct<br /> mode under each build configuration. Production builds<br /> (CONFIG_DRM_XE_USERPTR_INVAL_INJECT=n) keep the existing read-mode<br /> behavior bit-for-bit.<br /> <br /> (cherry picked from commit 80ccbd97ffee8ad2e73167d826fe7be548364365)

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg<br /> <br /> Sashiko found that user can cause this WARN_ON_ONCE() easily<br /> with adding a kprobe event based on a raw address with BTF<br /> parameter.<br /> <br /> Since this is not an unexpected condition, remove the<br /> WARN_ON_ONCE().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> accel/amdxdna: Fix iommu domain lifetime race during device removal<br /> <br /> When force_iova mode is enabled, amdxdna_remove() frees xdna-&gt;domain. If<br /> amdxdna_gem_obj_free() is called after device removal, it may attempt to<br /> access xdna-&gt;domain, resulting in a use-after-free.<br /> <br /> Fix the race by adding freeing xdna-&gt;domain as a managed release action,<br /> so its lifetime is managed by DRM and remains valid until all managed<br /> resources are released.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> qede: fix out-of-bounds check for cqe-&gt;len_list[]<br /> <br /> Move index check before element access.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: enetc: fix potential divide-by-zero when num_vsi is zero<br /> <br /> For i.MX94 series, all the standalone ENETCs do not support SR-IOV, so<br /> pf-&gt;caps.num_vsi is zero. This leads to a divide-by-zero in<br /> enetc4_default_rings_allocation() when distributing rings among PF and<br /> VFs.<br /> <br /> Division by zero is undefined behavior in C. On ARM64, the UDIV/SDIV<br /> instructions silently return zero rather than raising an exception, so<br /> the issue does not cause a visible crash. However, relying on this<br /> behavior is incorrect and poses a cross-platform compatibility risk.<br /> <br /> Add an explicit check for num_vsi == 0 and return early after the PF&amp;#39;s<br /> rings have been configured.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing<br /> <br /> The driver parses CDC union descriptors in ims_pcu_get_cdc_union_desc()<br /> by iterating through the extra descriptor data. However, it does not<br /> verify that the bLength of each descriptor is at least 2. A malicious<br /> device could provide a descriptor with bLength = 0, leading to an<br /> infinite loop in the driver.<br /> <br /> Add a check to ensure bLength is at least 2 before proceeding with<br /> parsing.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Input: ims-pcu - add response length checks<br /> <br /> The driver processes response data from device buffers without verifying<br /> that the device actually sent enough data. This can lead to<br /> out-of-bounds reads or processing stale data.<br /> <br /> Add checks for the expected response length before accessing the<br /> buffers.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Input: ims-pcu - only expose sysfs attributes on control interface<br /> <br /> When the driver was converted to use the driver core to instantiate device<br /> attributes (via .dev_groups in the usb_driver structure), the attributes<br /> started appearing on all interfaces bound to the driver. Since the ims-pcu<br /> driver manually claims the secondary data interface during probe, the<br /> driver core automatically creates the sysfs attributes for that interface<br /> as well.<br /> <br /> However, the driver only supports these attributes on the primary control<br /> interface. Data interfaces lack the necessary descriptors and internal<br /> state to handle these requests, and accessing them can lead to unexpected<br /> behavior or crashes.<br /> <br /> Fix this by updating the is_visible() callbacks for both the main and OFN<br /> attribute groups to verify that the interface being accessed is indeed the<br /> control interface.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mtd: maps: vmu-flash: fix NULL pointer dereference in initialization<br /> <br /> The mtd_info contains a struct device, which must be linked to its<br /> parent. Without this, the initialization of the MTD fails with a NULL<br /> pointer dereference.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ntfs3: fix out-of-bounds read in decompress_lznt<br /> <br /> decompress_lznt() does not validate array index bounds before accessing<br /> the decompression table. A corrupted NTFS3 image with invalid compressed<br /> data can trigger an out-of-bounds read.<br /> <br /> Add index bounds checking to prevent the OOB access.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> batman-adv: dat: ensure accessible eth_hdr proto field<br /> <br /> When batadv_get_vid() accesses the proto field of the ethernet header, it<br /> is not checking if the data itself is accessible. The caller is responsible<br /> for it. But in contrast to other call sites, batadv_dat_get_vid() and its<br /> caller didn&amp;#39;t make sure this is true. This could have caused an<br /> out-of-bounds access.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> batman-adv: dat: acquire ARP hw source only after skb realloc<br /> <br /> The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer<br /> behind the skb. Variables which were pointing to the old buffer need to be<br /> reassigned to avoid an use-after-free.