Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: rtw89: correct drop logic for malformed AMPDU frames<br /> <br /> The previous commit aims to fix issue caused by malformed AMPDU frames.<br /> But the drop logic fails to deal with the first AMPDU packet paired with<br /> certain range of sequence number, and leads to unexpected packet drop.<br /> It is more likely to encounter this failure when there are busy traffic<br /> during rekey process and could lead to disconnection from the AP.<br /> Fix this by adding a initial state judgement and only reset status<br /> during pairwise rekey.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iio: adc: ad_sigma_delta: fix CS held asserted and state leaks<br /> <br /> In ad_sigma_delta_single_conversion(), set_mode(AD_SD_MODE_IDLE) and<br /> disable_one() were called from the out: block while keep_cs_asserted<br /> was still true. This caused any SPI transfer issued by those callbacks<br /> to carry cs_change=1, leaving CS permanently asserted after the<br /> conversion. Fix by moving both calls into the out_unlock: block, after<br /> keep_cs_asserted is cleared, matching the pattern already used in<br /> ad_sd_calibrate().<br /> <br /> In the error path of ad_sd_buffer_postenable(), if an operation fails<br /> after set_mode(AD_SD_MODE_CONTINUOUS) has already succeeded (e.g.<br /> spi_offload_trigger_enable()), the device is left in continuous<br /> conversion mode with CS physically asserted. Additionally,<br /> bus_locked remaining true after spi_bus_unlock() causes subsequent<br /> SPI operations to call spi_sync_locked() without the bus lock actually<br /> held, allowing concurrent SPI access.<br /> <br /> Fix the error path by clearing keep_cs_asserted first, then calling<br /> set_mode(AD_SD_MODE_IDLE) to revert the device mode and deassert CS,<br /> then clearing bus_locked before releasing the bus.<br /> <br /> For devices that implement neither set_mode nor disable_one (such as<br /> MAX11205, which has no physical CS pin), no SPI transfer is issued<br /> during cleanup and the cs_change flag has no effect on any physical<br /> line.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices<br /> <br /> ad_sigma_delta_clear_pending_event() falls through to the status register<br /> read path for devices with has_registers = false and no rdy_gpiod. For<br /> such devices, ad_sd_read_reg() skips the address byte entirely and clocks<br /> raw MISO bytes with no address phase — making it byte-for-byte identical<br /> to reading conversion data. If a pending conversion result is present,<br /> this partially consumes it and corrupts the data stream for the subsequent<br /> ad_sd_read_reg() call in ad_sigma_delta_single_conversion().<br /> <br /> Furthermore, with num_resetclks = 0 on these devices, data_read_len<br /> evaluates to 0. If the clocked byte has bit 7 clear, pending_event is set<br /> and the code attempts memset(data + 2, 0xff, 0 - 1), overflowing to<br /> SIZE_MAX and corrupting the heap.<br /> <br /> Fix by returning 0 immediately when neither rdy_gpiod nor has_registers<br /> is set. This is safe for all current registerless devices: ad7191 and<br /> ad7780 (with powerdown GPIO) are reset between conversions by CS<br /> deassertion, so there is no stale result to drain; ad7780 (without<br /> powerdown GPIO) and max11205 are continuously-converting and cycle ~DRDY<br /> at the output data rate regardless of whether the previous result was<br /> read, so the next falling edge fires naturally.<br /> <br /> A future registerless device that holds ~DRDY asserted until data is read<br /> would be broken by this early return and would require either<br /> num_resetclks set or a rdy-gpio.<br /> <br /> The same heap corruption is reachable on any device with rdy_gpiod set<br /> but num_resetclks = 0: if the GPIO indicates a pending event, the drain<br /> path executes memset(data + 2, 0xff, 0 - 1) regardless of has_registers.<br /> Add an explicit data_read_len == 0 guard after the pending event check;<br /> the stale result is then consumed by the first ad_sd_read_reg() call in<br /> ad_sigma_delta_single_conversion().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: gadget: function: rndis: add length check for header<br /> <br /> Add a length check for the rndis header in rndis_rm_hdr, to ensure that<br /> MessageType, MessageLength, DataOffset, and DataLength fields are<br /> present before they are accessed.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> x86/bugs: Enable IBPB flush on BPF JIT allocation<br /> <br /> Enable hardening against JIT spraying when Spectre-v2 mitigations are in<br /> use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip<br /> enabling the IBPB flush if the BPF dispatcher is already using a retpoline<br /> sequence.<br /> <br /> This hardening applies only when BPF-JIT is in use. Guard the enabling<br /> under CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf: Support for hardening against JIT spraying<br /> <br /> The BPF JIT allocator packs many small programs into larger executable<br /> allocations and reuses space within those allocations as programs are<br /> loaded and freed. When fresh code is written into space that a previous<br /> program occupied, an indirect jump into the new program can reuse a branch<br /> prediction left behind by the old one.<br /> <br /> Flush the indirect branch predictors before reusing JIT memory so that<br /> indirect jumps into a newly written program don&amp;#39;t reuse predictions from an<br /> old program that occupied the same space.<br /> <br /> Introduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush<br /> static call for flushing the branch predictors on JIT memory reuse.<br /> Architectures that need a flush, can update it to a predictor flush<br /> function. By default, its a NOP and does not emit any CALL.<br /> <br /> Allocations larger than a pack are not covered by this flush. That is safe<br /> because cBPF programs (the unprivileged attack surface) are bounded well<br /> below a pack size. Issue a warning if this assumption is ever violated<br /> while the flush is active.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iio: temperature: tmp006: use devm_iio_trigger_register<br /> <br /> tmp006_probe() allocates the DRDY trigger with devm_iio_trigger_alloc()<br /> but registers it with plain iio_trigger_register(). The driver has no<br /> .remove() callback, so on module unload the trigger stays in the global<br /> trigger list while its memory is freed by devm, leaving a dangling<br /> entry.<br /> <br /> Switch to devm_iio_trigger_register() so the registration is undone in<br /> the same devm scope as the allocation.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iio: pressure: mpl115: fix runtime PM leak on read error<br /> <br /> mpl115_read_raw() takes a runtime PM reference with pm_runtime_get_sync()<br /> before reading the processed pressure or raw temperature, but on the read<br /> error path it returns without calling pm_runtime_put_autosuspend(). Each<br /> failed read therefore leaks a runtime PM reference and prevents the device<br /> from autosuspending.<br /> <br /> Drop the reference before checking the return value so both the success<br /> and error paths are balanced.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iio: light: gp2ap002: fix runtime PM leak on read error<br /> <br /> gp2ap002_read_raw() calls pm_runtime_get_sync() before reading the<br /> lux value, but if gp2ap002_get_lux() fails, it returns directly. This<br /> skips the pm_runtime_put_autosuspend() call at the "out" label,<br /> permanently leaking a runtime PM reference and preventing the device<br /> from autosuspending.<br /> <br /> Replace the direct return with a "goto out" to ensure the reference<br /> is properly dropped on the error path.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iio: gyro: bmg160: bail out when bandwidth/filter is not in table<br /> <br /> bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry<br /> matching the bw_bits value read from the chip:<br /> <br /> for (i = 0; i

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iio: chemical: scd30: Cleanup initializations and fix sign-extension bug<br /> <br /> Include linux/bitfield.h for FIELD_GET().<br /> <br /> Create new macros for bit manipulation in combination with manual bit<br /> manipulation being replaced with FIELD_GET().<br /> <br /> The current variable declaration and initializations are barely readable<br /> and use comma separations across multiple lines. Refactor the<br /> initializations so that mantissa and exp have separate declarations and<br /> sign gets initialized later.<br /> <br /> In addition (and due to the nature of the cleanup), fix a sign-extension<br /> bug where, float32 would get bitwise anded with ~BIT(31)<br /> (which is 0xFFFFFFFF7FFFFFFF) which corrupted the exponent.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iio: buffer: hw-consumer: free scan_mask on buffer release<br /> <br /> The scan_mask lifetime changed in commit 9a2e1233d38c ("iio: buffer:<br /> hw-consumer: remove redundant scan_mask flexible array").<br /> <br /> Before that change, the scan mask storage was embedded in struct<br /> hw_consumer_buffer, so iio_hw_buf_release() could free the whole<br /> allocation with a single kfree(hw_buf).<br /> <br /> That commit moved the scan mask to a separate bitmap_zalloc() allocation<br /> stored in buffer.scan_mask, but left iio_hw_buf_release() unchanged.<br /> <br /> Free the scan mask in iio_hw_buf_release() before freeing the buffer<br /> wrapper.