Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict<br /> <br /> If kvmalloc_array() fails in drm_gpusvm_range_evict(), the MM<br /> reference acquired earlier is not released, resulting in a reference<br /> leak.<br /> <br /> Fix this by dropping the MM reference on the kvmalloc_array()<br /> failure path.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/vc4: Shut down BO cache timer before teardown<br /> <br /> The BO cache timer callback schedules time_work, and time_work can rearm<br /> the timer through vc4_bo_cache_free_old().<br /> <br /> vc4_bo_cache_destroy() deletes the timer and then cancels the work, which<br /> does not break that cycle: the work being cancelled can rearm the timer,<br /> and the timer then queues work again after teardown.<br /> <br /> Use timer_shutdown_sync() instead, so the timer cannot be rearmed and the<br /> cycle ends with cancel_work_sync().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amd/display: set new_stream to NULL after release<br /> <br /> In dm_update_crtc_state(), the skip_modeset path releases new_stream<br /> via dc_stream_release() but does not set the pointer to NULL.<br /> <br /> If a later error (e.g., color management failure) triggers the fail<br /> label, the error path calls dc_stream_release() again on the same<br /> dangling pointer, causing a double release and potential use-after-free.<br /> <br /> Fix this by setting new_stream to NULL after the initial release.<br /> <br /> (cherry picked from commit 99f3af19073b3ddbfd96e789124cce12c4277b28)

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe<br /> <br /> Both mxc_isi_crossbar_init() and mxc_isi_pipe_init() call<br /> v4l2_subdev_init_finalize() which allocates the subdev active state,<br /> but neither mxc_isi_crossbar_cleanup() nor mxc_isi_pipe_cleanup()<br /> calls v4l2_subdev_cleanup() to free it.<br /> <br /> This causes a memory leak on every rmmod, reported by kmemleak:<br /> <br /> unreferenced object 0xffff0000d06fc800 (size 192):<br /> comm "(udev-worker)", pid 254, jiffies 4294913455<br /> backtrace (crc 36eeae58):<br /> kmemleak_alloc+0x34/0x40<br /> __kvmalloc_node_noprof+0x5f8/0x7d8<br /> __v4l2_subdev_state_alloc+0x1fc/0x30c<br /> __v4l2_subdev_init_finalize+0x178/0x368<br /> <br /> Add the missing v4l2_subdev_cleanup() calls before media_entity_cleanup()<br /> in both crossbar and pipe cleanup paths.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> media: nuvoton: npcm-video: fix memory leaks in probe and remove<br /> <br /> npcm_video_probe() allocates the npcm_video structure with kzalloc_obj()<br /> but never frees it on any probe error path or in npcm_video_remove(),<br /> leaking the allocation on every failed probe and every normal unbind.<br /> <br /> Additionally, when npcm_video_setup_video() fails, the reserved memory<br /> association established by of_reserved_mem_device_init() in<br /> npcm_video_init() is not released, leaking the rmem_assigned_device<br /> entry on the global list.<br /> <br /> Fix both by adding kfree(video) to all probe error paths and to<br /> npcm_video_remove(), and adding the missing<br /> of_reserved_mem_device_release() call when npcm_video_setup_video()<br /> fails.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> media: msi2500: Return queued buffers on start_streaming() failure<br /> <br /> The vb2 framework hands buffers to the driver via buf_queue() before<br /> calling start_streaming(). If start_streaming() returns an error<br /> without first returning those buffers via vb2_buffer_done(),<br /> vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued<br /> buffers leak.<br /> <br /> msi2500_start_streaming() had five error paths that all hit this trap<br /> and were further tangled by ret-overwriting between calls:<br /> <br /> - -ENODEV when the USB device was already disconnected<br /> - -ERESTARTSYS when mutex_lock_interruptible() was interrupted<br /> - msi2500_set_usb_adc() failure: ret was silently overwritten by<br /> the next call (msi2500_isoc_init), so the error was lost entirely<br /> - msi2500_isoc_init() failure: cleanup_queued_bufs was called, but<br /> the function then fell through to msi2500_ctrl_msg() and again<br /> masked the original error by overwriting ret<br /> - msi2500_ctrl_msg(CMD_START_STREAMING) failure: no cleanup at all,<br /> leaving isoc URBs submitted with no way for the driver to consume<br /> them<br /> <br /> Consolidate the error paths into a small goto chain. Every failure<br /> now stops the function, drains the queued-buffer list, and returns<br /> the real error code. The ctrl_msg failure path also rolls back the<br /> preceding msi2500_isoc_init() via msi2500_isoc_cleanup() before<br /> unlocking and draining.<br /> <br /> The cleanup helper takes a vb2_buffer_state argument so that the<br /> start_streaming error paths can pass VB2_BUF_STATE_QUEUED (as<br /> expected by userspace on start_streaming failure) while stop_streaming<br /> keeps its existing VB2_BUF_STATE_ERROR semantics.<br /> <br /> This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo:<br /> Return queued buffers on start_streaming() failure").

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> media: meson: vdec: Fix memory leak in error path of vdec_open<br /> <br /> The vdec_open() function previously jumped directly to<br /> err_m2m_release when vdec_init_ctrls() failed, skipping<br /> release of the m2m context. This caused a resource leak.<br /> <br /> Fix it by introducing a proper err_m2m_ctx_release label<br /> that calls v4l2_m2m_ctx_release(sess-&gt;m2m_ctx) before<br /> releasing the m2m device.<br /> <br /> This was identified via kmemleak:<br /> unreferenced object 0xffff0000205d6878 (size 8):<br /> comm "v4l_id", pid 5289, jiffies 4294938580<br /> hex dump (first 8 bytes):<br /> 40 d2 49 18 00 00 ff ff @.I.....<br /> backtrace (crc d3204599):<br /> kmemleak_alloc+0xc8/0xf0<br /> __kvmalloc_node_noprof+0x60c/0x850<br /> v4l2_ctrl_handler_init_class+0x1b4/0x2e8 [videodev]<br /> vdec_open+0x1f4/0x788 [meson_vdec]<br /> v4l2_open+0x144/0x460 [videodev]<br /> chrdev_open+0x1ac/0x500<br /> do_dentry_open+0x3f0/0xfe8<br /> vfs_open+0x68/0x320<br /> do_open+0x2d8/0x9a8<br /> path_openat+0x1d0/0x4f0<br /> do_filp_open+0x190/0x380<br /> do_sys_openat2+0xf8/0x1b0<br /> __arm64_sys_openat+0x13c/0x1e8<br /> invoke_syscall+0xdc/0x268<br /> el0_svc_common.constprop.0+0x178/0x258<br /> do_el0_svc+0x4c/0x70

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> media: mali-c55: Fix possible ERR_PTR in enable_streams<br /> <br /> The media_pad_remote_pad_unique() function returns either a valid<br /> pointer or an ERR_PTR() on failure (-ENOTUNIQ if multiple links are<br /> enabled, -ENOLINK if no connected pad is found). The return value<br /> was assigned directly to isp-&gt;remote_src and dereferenced in the<br /> next line without checking for errors, which could lead to an<br /> ERR_PTR dereference.<br /> <br /> Add proper error checking with IS_ERR() before dereferencing the<br /> pointer. Also set isp-&gt;remote_src to NULL on error to maintain<br /> consistency with other error paths in the function.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> media: i2c: alvium: fix critical pointer access in alvium_ctrl_init<br /> <br /> The current implementation of alvium_ctrl_init creates several controls in<br /> function alvium_ctrl_init and uses the returned pointer without check. That<br /> can cause write access over NULL-pointer for several controls. The reworked<br /> code checks the pointers before adding flags.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> media: cx23885: add ioremap return check and cleanup<br /> <br /> Add a check for the return value of pci_ioremap_bar()<br /> in cx23885_dev_setup().<br /> If ioremap for BAR0 fails, release the already allocated<br /> PCI memory region,<br /> decrement the device count, and return -ENODEV.<br /> <br /> This prevents a potential null pointer dereference and<br /> ensures proper cleanup<br /> on memory mapping failure.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> media: cx231xx: fix devres lifetime<br /> <br /> USB drivers bind to USB interfaces and any device managed resources<br /> should have their lifetime tied to the interface rather than parent USB<br /> device. This avoids issues like memory leaks when drivers are unbound<br /> without their devices being physically disconnected (e.g. on probe<br /> deferral or configuration changes).<br /> <br /> Fix the driver state lifetime so that it is released on driver unbind.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> media: saa7134: Fix a possible memory leak in saa7134_video_init1<br /> <br /> In saa7134_video_init1(), the return value of the first<br /> saa7134_pgtable_alloc() is not checked. If it fails, the function<br /> continues as if successful, leaving the driver with an invalid page<br /> table. Additionally, if vb2_queue_init() for the VBI queue fails after<br /> the video queue page table has been allocated, the allocated memory is<br /> not freed before returning. The second saa7134_pgtable_alloc() also<br /> lacks a return value check. Errors occur during device probing before<br /> the device is fully registered, the normal cleanup path in<br /> saa7134_finidev() is not executed, leading to memory leaks and<br /> potential use of uninitialized DMA resources.<br /> <br /> Check the return value of both saa7134_pgtable_alloc() calls and<br /> propagate errors. On failure of any later step, free allocated page<br /> tables to avoid memory leaks. Ensure control handlers are also<br /> released on error to prevent further resource leakage.<br /> <br /> Found by code review.