Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> cxl/region: Validate partition index before array access<br /> <br /> construct_region() reads cxled-&gt;part and uses it to index<br /> cxlds-&gt;part[] without checking for a negative value. If the<br /> partition was never resolved, part remains at its initial value<br /> of -1, causing an out-of-bounds array access.<br /> <br /> Add a guard to return -EBUSY when part is negative.<br /> <br /> The check was dropped during a merge.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq<br /> <br /> cp_ecc_error_irq is acquired in amdgpu_gfx_ras_late_init() but<br /> released in gfx_v9_0_hw_fini(), so the put site has to query<br /> amdgpu_irq_enabled() because the get is skipped on SR-IOV VF.<br /> <br /> ras_late_init / ras_fini have no suspend counterpart, so move the<br /> put to amdgpu_gfx_ras_suspend() / amdgpu_gfx_ras_fini() and add a<br /> matching ras_suspend callback that is invoked from<br /> amdgpu_ras_suspend() before disable_all_features(). The get and<br /> put now sit in the same place and check the same condition (not<br /> VF, funcs registered), no refcount querying needed.<br /> <br /> An active flag gates ras_fini so the<br /> suspend-then-unload-without-resume path falls into<br /> amdgpu_ras_block_late_fini_default() instead of double-releasing<br /> what ras_suspend already cleaned up.<br /> <br /> Drop the cp_ecc_error_irq put from gfx_v9_0_hw_fini(). gfx_v8_0<br /> manages cp_ecc_error_irq locally and is unaffected; no other GFX<br /> generation has this IRQ.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu: fix buffer overflow during vBIOS update<br /> <br /> Clamp the buffer postion to write by setting the bin attribute<br /> to the maximum buffer size so that VFS layer will block the<br /> out-of-bounds accessing.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error<br /> <br /> Return the parse error before acquiring PM access.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amd/pm: bound pp_dpm_set_pp_table() memcpy<br /> <br /> The powerplay path allocates hardcode_pp_table once with kmemdup(...,<br /> soft_pp_table_size). memcpy(..., size) used the sysfs store count (up to<br /> PAGE_SIZE) with no upper bound, causing heap overflow. Reject<br /> writes where size exceeds soft_pp_table_size.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu: harden FRU PIA parsing with bounded helpers<br /> <br /> Replace the open-coded TLV walk with fru_pia_advance()<br /> and fru_pia_copy_field() helpers that bound every read<br /> by the actual EEPROM data length, preventing out-of-bounds<br /> reads on truncated or malformed FRU data.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdkfd: fix UAF race in destroy_queue_cpsch<br /> <br /> wait_on_destroy_queue() drops locks to wait for queue resume, allowing<br /> a concurrent destroy to free the queue. Use is_being_destroyed flag to<br /> serialize destruction.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend()<br /> <br /> mt8365_afe_suspend() allocates the register backup buffer with<br /> devm_kcalloc(), but does not check for allocation failure before using the<br /> returned pointer. This may lead to a NULL pointer dereference when<br /> accessing afe-&gt;reg_back_up[i].<br /> <br /> Add the missing NULL check and return -ENOMEM on allocation failure after<br /> disabling the main clock.<br /> <br /> Also propagate the return value of mt8365_afe_suspend() in<br /> mt8365_afe_dev_runtime_suspend() so that the suspended state is not updated<br /> when suspend fails.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF<br /> <br /> ROOT_REF and ROOT_BACKREF items contain a struct btrfs_root_ref followed<br /> by the subvolume name. Several readers assume that this layout is already<br /> valid and then use the on-disk name length directly. A corrupted item can<br /> therefore make those readers address bytes outside the item, and<br /> BTRFS_IOC_GET_SUBVOL_INFO can copy too many bytes into its fixed-size UAPI<br /> name buffer.<br /> <br /> Validate ROOT_REF and ROOT_BACKREF items in tree-checker before any reader<br /> uses them. Reject records that do not contain a non-empty name, whose<br /> name_len does not exactly describe the remaining item payload, or whose<br /> name exceeds BTRFS_NAME_LEN.<br /> <br /> For BTRFS_IOC_GET_SUBVOL_INFO, copy only the validated on-disk name_len<br /> instead of deriving the copy length from the item size. The ioctl result is<br /> zeroed when allocated. That leaves the existing trailing zero byte<br /> untouched.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk()<br /> <br /> [BUG]<br /> Running btrfs balance can trigger a null-ptr-deref before relocating a<br /> data chunk when metadata corruption leaves a chunk in the chunk tree<br /> without a corresponding block group in the in-memory cache:<br /> <br /> KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f]<br /> RIP: 0010:btrfs_may_alloc_data_chunk+0x40/0x1c0 fs/btrfs/volumes.c:3601<br /> Call Trace:<br /> __btrfs_balance fs/btrfs/volumes.c:4217 [inline]<br /> btrfs_balance+0x2516/0x42b0 fs/btrfs/volumes.c:4604<br /> btrfs_ioctl_balance fs/btrfs/ioctl.c:3577 [inline]<br /> btrfs_ioctl+0x25cf/0x5b90 fs/btrfs/ioctl.c:5313<br /> ...<br /> <br /> [CAUSE]<br /> __btrfs_balance() iterates the on-disk chunk tree and passes the chunk<br /> logical bytenr to btrfs_may_alloc_data_chunk() before relocating a data<br /> chunk. That helper then queries the in-memory block group cache:<br /> <br /> cache = btrfs_lookup_block_group(fs_info, chunk_offset);<br /> chunk_type = cache-&gt;flags; /* cache may be NULL */<br /> <br /> A corrupt image can contain a chunk item whose matching block group<br /> item is missing, so no block group is ever inserted into the cache. In<br /> that case btrfs_lookup_block_group() returns NULL.<br /> <br /> The code only guards this with ASSERT(cache), which becomes a no-op when<br /> CONFIG_BTRFS_ASSERT is disabled. The subsequent dereference of<br /> cache-&gt;flags therefore crashes the kernel.<br /> <br /> [FIX]<br /> Add a NULL check after btrfs_lookup_block_group() in<br /> btrfs_may_alloc_data_chunk() and print and error message for clarity.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()<br /> <br /> The timestamp-only fast path dereferences the option stream as<br /> *(__be32 *)ptr, which assumes 4-byte alignment that the TCP option<br /> stream does not guarantee. Use get_unaligned_be32() instead, which<br /> reads the value safely and already returns host byte order, so the<br /> htonl() on the comparison constant can be dropped.<br /> <br /> This matches the existing get_unaligned_be32() use later in the same<br /> function.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: es18xx: check control allocation before private data setup<br /> <br /> snd_es18xx_mixer() creates controls with snd_ctl_new1() and then stores<br /> bookkeeping pointers or sets private_free before calling snd_ctl_add().<br /> snd_ctl_new1() can return NULL on allocation failure, so those writes<br /> can dereference a NULL control pointer.<br /> <br /> Check the returned control pointers before using them and return -ENOMEM<br /> on allocation failure.