Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY()<br /> <br /> ETDM2_IN_BE and ETDM1_OUT_BE are defined as COMP_EMPTY(),<br /> in the case the codec dai_name will be null.<br /> <br /> Avoid a crash if the device tree is not assigning a codec<br /> to these links.<br /> <br /> [ 1.179936] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000<br /> [ 1.181065] Mem abort info:<br /> [ 1.181420] ESR = 0x0000000096000004<br /> [ 1.181892] EC = 0x25: DABT (current EL), IL = 32 bits<br /> [ 1.182576] SET = 0, FnV = 0<br /> [ 1.182964] EA = 0, S1PTW = 0<br /> [ 1.183367] FSC = 0x04: level 0 translation fault<br /> [ 1.183983] Data abort info:<br /> [ 1.184406] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000<br /> [ 1.185097] CM = 0, WnR = 0, TnD = 0, TagAccess = 0<br /> [ 1.185766] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0<br /> [ 1.186439] [0000000000000000] user address but active_mm is swapper<br /> [ 1.187239] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP<br /> [ 1.188029] Modules linked in:<br /> [ 1.188420] CPU: 7 UID: 0 PID: 70 Comm: kworker/u32:1 Not tainted 6.14.0-rc4-next-20250226+ #85<br /> [ 1.189515] Hardware name: Radxa NIO 12L (DT)<br /> [ 1.190065] Workqueue: events_unbound deferred_probe_work_func<br /> [ 1.190808] pstate: 40400009 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)<br /> [ 1.191683] pc : __pi_strcmp+0x24/0x140<br /> [ 1.192170] lr : mt8195_mt6359_soc_card_probe+0x224/0x7b0<br /> [ 1.192854] sp : ffff800083473970<br /> [ 1.193271] x29: ffff800083473a10 x28: 0000000000001008 x27: 0000000000000002<br /> [ 1.194168] x26: ffff800082408960 x25: ffff800082417db0 x24: ffff800082417d88<br /> [ 1.195065] x23: 000000000000001e x22: ffff800082dbf480 x21: ffff800082dc07b8<br /> [ 1.195961] x20: 0000000000000000 x19: 0000000000000013 x18: 00000000ffffffff<br /> [ 1.196858] x17: 000000040044ffff x16: 005000f2b5503510 x15: 0000000000000006<br /> [ 1.197755] x14: ffff800082407af0 x13: 6e6f69737265766e x12: 692d6b636f6c6374<br /> [ 1.198651] x11: 0000000000000002 x10: ffff80008240b920 x9 : 0000000000000018<br /> [ 1.199547] x8 : 0101010101010101 x7 : 0000000000000000 x6 : 0000000000000000<br /> [ 1.200443] x5 : 0000000000000000 x4 : 8080808080000000 x3 : 303933383978616d<br /> [ 1.201339] x2 : 0000000000000000 x1 : ffff80008240b920 x0 : 0000000000000000<br /> [ 1.202236] Call trace:<br /> [ 1.202545] __pi_strcmp+0x24/0x140 (P)<br /> [ 1.203029] mtk_soundcard_common_probe+0x3bc/0x5b8<br /> [ 1.203644] platform_probe+0x70/0xe8<br /> [ 1.204106] really_probe+0xc8/0x3a0<br /> [ 1.204556] __driver_probe_device+0x84/0x160<br /> [ 1.205104] driver_probe_device+0x44/0x130<br /> [ 1.205630] __device_attach_driver+0xc4/0x170<br /> [ 1.206189] bus_for_each_drv+0x8c/0xf8<br /> [ 1.206672] __device_attach+0xa8/0x1c8<br /> [ 1.207155] device_initial_probe+0x1c/0x30<br /> [ 1.207681] bus_probe_device+0xb0/0xc0<br /> [ 1.208165] deferred_probe_work_func+0xa4/0x100<br /> [ 1.208747] process_one_work+0x158/0x3e0<br /> [ 1.209254] worker_thread+0x2c4/0x3e8<br /> [ 1.209727] kthread+0x134/0x1f0<br /> [ 1.210136] ret_from_fork+0x10/0x20<br /> [ 1.210589] Code: 54000401 b50002c6 d503201f f86a6803 (f8408402)<br /> [ 1.211355] ---[ end trace 0000000000000000 ]---

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nvmem: zynqmp_nvmem: unbreak driver after cleanup<br /> <br /> Commit 29be47fcd6a0 ("nvmem: zynqmp_nvmem: zynqmp_nvmem_probe cleanup")<br /> changed the driver to expect the device pointer to be passed as the<br /> "context", but in nvmem the context parameter comes from nvmem_config.priv<br /> which is never set - Leading to null pointer exceptions when the device is<br /> accessed.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> block: don&amp;#39;t use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work<br /> <br /> Bios queued up in the zone write plug have already gone through all all<br /> preparation in the submit_bio path, including the freeze protection.<br /> <br /> Submitting them through submit_bio_noacct_nocheck duplicates the work<br /> and can can cause deadlocks when freezing a queue with pending bio<br /> write plugs.<br /> <br /> Go straight to -&gt;submit_bio or blk_mq_submit_bio to bypass the<br /> superfluous extra freeze protection and checks.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: ath12k: fix NULL access in assign channel context handler<br /> <br /> Currently, when ath12k_mac_assign_vif_to_vdev() fails, the radio handle<br /> (ar) gets accessed from the link VIF handle (arvif) for debug logging, This<br /> is incorrect. In the fail scenario, radio handle is NULL. Fix the NULL<br /> access, avoid radio handle access by moving to the hardware debug logging<br /> helper function (ath12k_hw_warn).<br /> <br /> Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1<br /> Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ACPI: platform_profile: Avoid initializing on non-ACPI platforms<br /> <br /> The platform profile driver is loaded even on platforms that do not have<br /> ACPI enabled. The initialization of the sysfs entries was recently moved<br /> from platform_profile_register() to the module init call, and those<br /> entries need acpi_kobj to be initialized which is not the case when ACPI<br /> is disabled.<br /> <br /> This results in the following warning:<br /> <br /> WARNING: CPU: 5 PID: 1 at fs/sysfs/group.c:131 internal_create_group+0xa22/0xdd8<br /> Modules linked in:<br /> CPU: 5 UID: 0 PID: 1 Comm: swapper/0 Tainted: G W 6.15.0-rc7-dirty #6 PREEMPT<br /> Tainted: [W]=WARN<br /> Hardware name: riscv-virtio,qemu (DT)<br /> epc : internal_create_group+0xa22/0xdd8<br /> ra : internal_create_group+0xa22/0xdd8<br /> <br /> Call Trace:<br /> <br /> internal_create_group+0xa22/0xdd8<br /> sysfs_create_group+0x22/0x2e<br /> platform_profile_init+0x74/0xb2<br /> do_one_initcall+0x198/0xa9e<br /> kernel_init_freeable+0x6d8/0x780<br /> kernel_init+0x28/0x24c<br /> ret_from_fork+0xe/0x18<br /> <br /> Fix this by checking if ACPI is enabled before trying to create sysfs<br /> entries.<br /> <br /> [ rjw: Subject and changelog edits ]

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create()<br /> <br /> The Amlogic DDR PMU driver meson_ddr_pmu_create() function incorrectly uses<br /> smp_processor_id(), which assumes disabled preemption. This leads to kernel<br /> warnings during module loading because meson_ddr_pmu_create() can be called<br /> in a preemptible context.<br /> <br /> Following kernel warning and stack trace:<br /> [ 31.745138] [ T2289] BUG: using smp_processor_id() in preemptible [00000000] code: (udev-worker)/2289<br /> [ 31.745154] [ T2289] caller is debug_smp_processor_id+0x28/0x38<br /> [ 31.745172] [ T2289] CPU: 4 UID: 0 PID: 2289 Comm: (udev-worker) Tainted: GW 6.14.0-0-MANJARO-ARM #1 59519addcbca6ba8de735e151fd7b9e97aac7ff0<br /> [ 31.745181] [ T2289] Tainted: [W]=WARN<br /> [ 31.745183] [ T2289] Hardware name: Hardkernel ODROID-N2Plus (DT)<br /> [ 31.745188] [ T2289] Call trace:<br /> [ 31.745191] [ T2289] show_stack+0x28/0x40 (C)<br /> [ 31.745199] [ T2289] dump_stack_lvl+0x4c/0x198<br /> [ 31.745205] [ T2289] dump_stack+0x20/0x50<br /> [ 31.745209] [ T2289] check_preemption_disabled+0xec/0xf0<br /> [ 31.745213] [ T2289] debug_smp_processor_id+0x28/0x38<br /> [ 31.745216] [ T2289] meson_ddr_pmu_create+0x200/0x560 [meson_ddr_pmu_g12 8095101c49676ad138d9961e3eddaee10acca7bd]<br /> [ 31.745237] [ T2289] g12_ddr_pmu_probe+0x20/0x38 [meson_ddr_pmu_g12 8095101c49676ad138d9961e3eddaee10acca7bd]<br /> [ 31.745246] [ T2289] platform_probe+0x98/0xe0<br /> [ 31.745254] [ T2289] really_probe+0x144/0x3f8<br /> [ 31.745258] [ T2289] __driver_probe_device+0xb8/0x180<br /> [ 31.745261] [ T2289] driver_probe_device+0x54/0x268<br /> [ 31.745264] [ T2289] __driver_attach+0x11c/0x288<br /> [ 31.745267] [ T2289] bus_for_each_dev+0xfc/0x160<br /> [ 31.745274] [ T2289] driver_attach+0x34/0x50<br /> [ 31.745277] [ T2289] bus_add_driver+0x160/0x2b0<br /> [ 31.745281] [ T2289] driver_register+0x78/0x120<br /> [ 31.745285] [ T2289] __platform_driver_register+0x30/0x48<br /> [ 31.745288] [ T2289] init_module+0x30/0xfe0 [meson_ddr_pmu_g12 8095101c49676ad138d9961e3eddaee10acca7bd]<br /> [ 31.745298] [ T2289] do_one_initcall+0x11c/0x438<br /> [ 31.745303] [ T2289] do_init_module+0x68/0x228<br /> [ 31.745311] [ T2289] load_module+0x118c/0x13a8<br /> [ 31.745315] [ T2289] __arm64_sys_finit_module+0x274/0x390<br /> [ 31.745320] [ T2289] invoke_syscall+0x74/0x108<br /> [ 31.745326] [ T2289] el0_svc_common+0x90/0xf8<br /> [ 31.745330] [ T2289] do_el0_svc+0x2c/0x48<br /> [ 31.745333] [ T2289] el0_svc+0x60/0x150<br /> [ 31.745337] [ T2289] el0t_64_sync_handler+0x80/0x118<br /> [ 31.745341] [ T2289] el0t_64_sync+0x1b8/0x1c0<br /> <br /> Changes replaces smp_processor_id() with raw_smp_processor_id() to<br /> ensure safe CPU ID retrieval in preemptible contexts.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> IB/cm: Drop lockdep assert and WARN when freeing old msg<br /> <br /> The send completion handler can run after cm_id has advanced to another<br /> message. The cm_id lock is not needed in this case, but a recent change<br /> re-used cm_free_priv_msg(), which asserts that the lock is held and<br /> WARNs if the cm_id&amp;#39;s currently outstanding msg is different than the one<br /> being freed.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk<br /> <br /> Smatch detected a potential use-after-free of an ndlp oject in<br /> dev_loss_tmo_callbk during driver unload or fatal error handling.<br /> <br /> Fix by reordering code to avoid potential use-after-free if initial<br /> nodelist reference has been previously removed.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: ath12k: fix node corruption in ar-&gt;arvifs list<br /> <br /> In current WLAN recovery code flow, ath12k_core_halt() only reinitializes<br /> the "arvifs" list head. This will cause the list node immediately following<br /> the list head to become an invalid list node. Because the prev of that node<br /> still points to the list head "arvifs", but the next of the list head<br /> "arvifs" no longer points to that list node.<br /> <br /> When a WLAN recovery occurs during the execution of a vif removal, and it<br /> happens before the spin_lock_bh(&amp;ar-&gt;data_lock) in<br /> ath12k_mac_vdev_delete(), list_del() will detect the previously mentioned<br /> situation, thereby triggering a kernel panic.<br /> <br /> The fix is to remove and reinitialize all vif list nodes from the list head<br /> "arvifs" during WLAN halt. The reinitialization is to make the list nodes<br /> valid, ensuring that the list_del() in ath12k_mac_vdev_delete() can execute<br /> normally.<br /> <br /> Call trace:<br /> __list_del_entry_valid_or_report+0xd4/0x100 (P)<br /> ath12k_mac_remove_link_interface.isra.0+0xf8/0x2e4 [ath12k]<br /> ath12k_scan_vdev_clean_work+0x40/0x164 [ath12k]<br /> cfg80211_wiphy_work+0xfc/0x100<br /> process_one_work+0x164/0x2d0<br /> worker_thread+0x254/0x380<br /> kthread+0xfc/0x100<br /> ret_from_fork+0x10/0x20<br /> <br /> The change is mostly copied from the ath11k patch:<br /> https://lore.kernel.org/all/20250320053145.3445187-1-quic_stonez@quicinc.com/<br /> <br /> Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: ath12k: Prevent sending WMI commands to firmware during firmware crash<br /> <br /> Currently, we encounter the following kernel call trace when a firmware<br /> crash occurs. This happens because the host sends WMI commands to the<br /> firmware while it is in recovery, causing the commands to fail and<br /> resulting in the kernel call trace.<br /> <br /> Set the ATH12K_FLAG_CRASH_FLUSH and ATH12K_FLAG_RECOVERY flags when the<br /> host driver receives the firmware crash notification from MHI. This<br /> prevents sending WMI commands to the firmware during recovery.<br /> <br /> Call Trace:<br /> <br /> dump_stack_lvl+0x75/0xc0<br /> register_lock_class+0x6be/0x7a0<br /> ? __lock_acquire+0x644/0x19a0<br /> __lock_acquire+0x95/0x19a0<br /> lock_acquire+0x265/0x310<br /> ? ath12k_ce_send+0xa2/0x210 [ath12k]<br /> ? find_held_lock+0x34/0xa0<br /> ? ath12k_ce_send+0x56/0x210 [ath12k]<br /> _raw_spin_lock_bh+0x33/0x70<br /> ? ath12k_ce_send+0xa2/0x210 [ath12k]<br /> ath12k_ce_send+0xa2/0x210 [ath12k]<br /> ath12k_htc_send+0x178/0x390 [ath12k]<br /> ath12k_wmi_cmd_send_nowait+0x76/0xa0 [ath12k]<br /> ath12k_wmi_cmd_send+0x62/0x190 [ath12k]<br /> ath12k_wmi_pdev_bss_chan_info_request+0x62/0xc0 [ath1<br /> ath12k_mac_op_get_survey+0x2be/0x310 [ath12k]<br /> ieee80211_dump_survey+0x99/0x240 [mac80211]<br /> nl80211_dump_survey+0xe7/0x470 [cfg80211]<br /> ? kmalloc_reserve+0x59/0xf0<br /> genl_dumpit+0x24/0x70<br /> netlink_dump+0x177/0x360<br /> __netlink_dump_start+0x206/0x280<br /> genl_family_rcv_msg_dumpit.isra.22+0x8a/0xe0<br /> ? genl_family_rcv_msg_attrs_parse.isra.23+0xe0/0xe0<br /> ? genl_op_lock.part.12+0x10/0x10<br /> ? genl_dumpit+0x70/0x70<br /> genl_rcv_msg+0x1d0/0x290<br /> ? nl80211_del_station+0x330/0x330 [cfg80211]<br /> ? genl_get_cmd_both+0x50/0x50<br /> netlink_rcv_skb+0x4f/0x100<br /> genl_rcv+0x1f/0x30<br /> netlink_unicast+0x1b6/0x260<br /> netlink_sendmsg+0x31a/0x450<br /> __sock_sendmsg+0xa8/0xb0<br /> ____sys_sendmsg+0x1e4/0x260<br /> ___sys_sendmsg+0x89/0xe0<br /> ? local_clock_noinstr+0xb/0xc0<br /> ? rcu_is_watching+0xd/0x40<br /> ? kfree+0x1de/0x370<br /> ? __sys_sendmsg+0x7a/0xc0<br /> <br /> Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: ath12k: fix invalid access to memory<br /> <br /> In ath12k_dp_rx_msdu_coalesce(), rxcb is fetched from skb and boolean<br /> is_continuation is part of rxcb.<br /> Currently, after freeing the skb, the rxcb-&gt;is_continuation accessed<br /> again which is wrong since the memory is already freed.<br /> This might lead use-after-free error.<br /> <br /> Hence, fix by locally defining bool is_continuation from rxcb,<br /> so that after freeing skb, is_continuation can be used.<br /> <br /> Compile tested only.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: ath11k: fix node corruption in ar-&gt;arvifs list<br /> <br /> In current WLAN recovery code flow, ath11k_core_halt() only<br /> reinitializes the "arvifs" list head. This will cause the<br /> list node immediately following the list head to become an<br /> invalid list node. Because the prev of that node still points<br /> to the list head "arvifs", but the next of the list head "arvifs"<br /> no longer points to that list node.<br /> <br /> When a WLAN recovery occurs during the execution of a vif<br /> removal, and it happens before the spin_lock_bh(&amp;ar-&gt;data_lock)<br /> in ath11k_mac_op_remove_interface(), list_del() will detect the<br /> previously mentioned situation, thereby triggering a kernel panic.<br /> <br /> The fix is to remove and reinitialize all vif list nodes from the<br /> list head "arvifs" during WLAN halt. The reinitialization is to make<br /> the list nodes valid, ensuring that the list_del() in<br /> ath11k_mac_op_remove_interface() can execute normally.<br /> <br /> Call trace:<br /> __list_del_entry_valid_or_report+0xb8/0xd0<br /> ath11k_mac_op_remove_interface+0xb0/0x27c [ath11k]<br /> drv_remove_interface+0x48/0x194 [mac80211]<br /> ieee80211_do_stop+0x6e0/0x844 [mac80211]<br /> ieee80211_stop+0x44/0x17c [mac80211]<br /> __dev_close_many+0xac/0x150<br /> __dev_change_flags+0x194/0x234<br /> dev_change_flags+0x24/0x6c<br /> devinet_ioctl+0x3a0/0x670<br /> inet_ioctl+0x200/0x248<br /> sock_do_ioctl+0x60/0x118<br /> sock_ioctl+0x274/0x35c<br /> __arm64_sys_ioctl+0xac/0xf0<br /> invoke_syscall+0x48/0x114<br /> ...<br /> <br /> Tested-on: QCA6698AQ hw2.1 PCI WLAN.HSP.1.1-04591-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1