Sleep-in-atomic-context denial of service in the Linux kernel btrfs filesystem driver allows a local low-privileged user to crash the system by triggering file sync operations while kernel tracing is active. The btrfs_sync_file trace event erroneously calls dput() - a function that may sleep - within an atomic context where sleeping is forbidden, producing a kernel BUG splat and potential panic. No active exploitation has been identified, EPSS is 0.16% (6th percentile), and the vulnerability requires a non-default kernel tracing configuration to be exploitable, substantially limiting real-world exposure.
Kernel panic in the Linux kernel's kprobes self-test module (test_kprobes) allows a local attacker or privileged user with debugfs write access to crash the kernel by triggering the KUnit kprobes test suite twice in succession. The root cause is that static kprobe and kretprobe variables retain stale address and flag data after unregister_kprobe, causing re-registration to fail with -EINVAL and subsequently triggering a kernel paging fault on the second test run. No public exploit is identified at time of analysis; EPSS at the 6th percentile and absence from CISA KEV confirm this as low-priority in production contexts.
Resource exhaustion in the Linux kernel erofs filesystem driver allows a local low-privileged attacker to leak folio references via error paths in erofs_init_inode_xattrs(), potentially causing kernel memory resource exhaustion or denial of service. Affected systems are those running Linux kernel versions from 5.17 through the fix commits, where erofs filesystems with extended attributes (xattrs) are mounted. No public exploit code exists and the vulnerability is absent from CISA KEV; vendor-released patches are available in stable branches targeting 7.0.11 and 7.1.
Permanent battery hardware damage on Uniwell-based laptops can be triggered via the platform/x86/uniwill-laptop kernel driver by enabling the battery charging limit through the 'force' module parameter. Affected hardware is limited to older Uniwell OEM models manufactured around 2020 where the charging limit circuitry is incompatible with the feature and causes irreversible battery degradation. No public exploit exists and EPSS stands at 0.16% (6th percentile), reflecting the narrow hardware and configuration prerequisites; however, the impact is severe and permanent - affected batteries cannot be recovered once damaged.
NULL pointer dereference in the Linux kernel's PCM512x ASoC audio codec driver crashes the kernel when a local low-privileged user writes to the overclocking mixer kcontrol. The driver's pcm512x_overclock_xxx_put() handler incorrectly invokes snd_soc_dapm_kcontrol_to_dapm() on a standard mixer kcontrol - an accessor only valid for DAPM kcontrols - returning NULL and triggering a kernel panic. No public exploit has been identified and EPSS stands at 0.16% (6th percentile), reflecting low exploitation likelihood; impact is confined to denial of service on systems with PCM512x audio hardware.
Memory exhaustion in the Linux kernel WWAN IOSM driver allows a local low-privileged attacker to deplete kernel memory by repeatedly triggering error paths in `ipc_imem_init()` where memory allocated by `ipc_protocol_init()` is never released. Affected systems running kernel versions from 5.14 through the unpatched branches of 5.15, 6.1, 6.6, 6.12, 6.18, 7.0, and pre-7.1 with Intel WWAN IOSM modem hardware loaded are vulnerable to availability-impact memory exhaustion. No public exploit exists and EPSS probability sits at 0.16% (6th percentile), indicating negligible real-world exploitation likelihood; however, patched stable releases are available across all major kernel branches.
Crash kernel panic in Linux kernel's KHO (Kexec Handover) subsystem causes kdump capture to fail due to a missing crash-kernel guard in kho_fill_kimage(). Systems configured with both KHO and a crash kernel (kdump) are affected: when a kernel crash transfers control to the crash kernel, KHO metadata pointing outside the reserved crash region triggers an invalid phys_to_virt() translation in kho_memory_init(), crashing the crash kernel itself and defeating the crash dump mechanism. No public exploit exists and EPSS at 0.16% (6th percentile) reflects appropriately low exploitation probability given the local-only, configuration-dependent nature of the flaw.
Resource leak in the Linux kernel's ov8856 OmniVision I2C camera driver exposes systems with that hardware to local denial-of-service via kernel memory exhaustion. The driver's ov8856_init_controls() function fails to call v4l2_ctrl_handler_free() on error exit paths, leaving the control handler's allocated memory unreleased each time control registration fails. No public exploit exists and EPSS probability sits at 0.16% (6th percentile), reflecting that this hardware-specific driver code is rarely reachable in practice.
Reference leak in the Linux kernel DAMON sysfs-schemes subsystem allows a local low-privilege attacker to cause a denial of service through accumulated cgroup object reference exhaustion. Affected are kernel builds from Linux 6.3 (commit 29cbb9a13f05b20f0777c60db9603730b487a4e0) through stable branches prior to 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1, on systems where DAMON is active and cgroup-path-based memory schemes are configured via sysfs. No public exploit has been identified and EPSS is 0.16% (5th percentile), consistent with a kernel resource-management flaw requiring specific local conditions.
Reference count leaking in the Linux kernel's hardware memory poison accounting subsystem (drivers/base/memory) causes memory block device objects to remain unreleased across repeated hardware memory error events, gradually degrading system stability. Affected kernels span multiple stable branches from introducing commit 5033091de814 through their respective fix commits, with patched releases available at 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code exists and no active exploitation is recorded (EPSS 0.16%, 5th percentile); this is a slow-accumulating resource leak rather than an immediately weaponizable flaw.
Memory hotplug removal in the Linux kernel leaks device references because `find_memory_block()` acquires a kobject reference inside `remove_memory_blocks_and_altmaps()` that is never released, allowing the reference count to accumulate unchecked across repeated memory block removal cycles. Systems with memory hotplug support - including virtual machines using ACPI memory balloon drivers and bare-metal servers with hot-pluggable DIMM slots - are affected across multiple stable kernel branches, with patches confirmed for 6.12.92, 6.18.34, 7.0.11, and 7.1. No public exploit code exists and exploitation probability is extremely low (EPSS 0.16%), though the availability impact is rated high: leaked references accumulated over repeated hotplug cycles can eventually precipitate a kernel panic.
Error pointer dereference in the Linux kernel ep93xx SPI driver causes kernel panic (denial of service) under specific driver lifecycle conditions on Cirrus Logic EP93xx ARM SoC hardware. When DMA channel setup fails during driver probe and falls back to PIO mode, the driver fails to clear the DMA channel pointers; any subsequent probe error or driver unbind then dereferences those stale error pointers, triggering a kernel oops or panic. No public exploit exists and EPSS of 0.16% (5th percentile) reflects negligible real-world exploitation probability - this is a targeted stability fix for a niche embedded platform.
Missing upper bound validation on `num_of_nodes` in the AMD KFD ioctl handler `kfd_ioctl_get_process_apertures_new` allows a local low-privileged user with access to AMD GPU compute devices to crash the kernel, causing a denial of service. Affected are Linux kernel branches prior to 6.6.140, 6.12.90, 6.18.32, 7.0.9, and 7.1, restricted to systems with AMD GPU hardware and the amdkfd module loaded. EPSS is 0.16% (5th percentile), no public exploit or CISA KEV listing exists, and patched stable releases are available across all active stable branches.
Incorrect zero_point calculation in the Linux kernel netfs layer's netfs_release_folio() function causes short reads and application-level I/O failures on network filesystem mounts when local pagecache size (i_size) exceeds the server-reported file size (remote_i_size). The bug affects local users on systems mounting CIFS or other netfs-backed shares with caching enabled, and was reproducible via a specific sequence of truncate, write, mapread, and copy_range operations on CIFS with the default cache option. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.15% at the 5th percentile, and patches are confirmed available for kernel stable branches 7.0.11 and 7.1.
NULL pointer dereference in the Linux kernel netfilter x_tables subsystem allows a local attacker to crash the kernel via a race condition during network namespace teardown. The flaw exists because arp/ip(6)t_register_table() adds a table to the per-netns linked list before allocating its per-namespace hook ops structure, leaving a window where ops=NULL is visible to concurrent readers. If a network namespace exit runs concurrently during this window, nf_unregister_net_hooks() receives a NULL ops pointer and triggers a general protection fault. No public exploit has been identified at time of analysis, and EPSS is very low at 0.15%.
Preempt count leak in four hv-gpci sysfs show() callbacks in the Linux kernel powerpc subsystem causes progressive kernel stability degradation on IBM Power systems compiled with CONFIG_PREEMPT=y. Each successful read of the affected sysfs nodes leaves one preempt_disable() unmatched, incrementally raising preempt_count; once the count becomes non-zero on return to userspace, the next page fault is misidentified as occurring in an atomic context, generating SIGSEGV and triggering 'BUG: scheduling while atomic' during the resulting coredump. Patches are available across the 6.6, 7.0, and 7.1 stable kernel trees, with no public exploit identified at time of analysis.
Persistent GPU denial-of-service in the Linux kernel's drm/msm Qualcomm GPU driver allows a local low-privileged user to render the GPU permanently hung by submitting a single ring workload that triggers an unrecovered fault. The recover_worker function advances the hung ring's fence and early-exits when it detects no further queued work, bypassing the actual GPU reset sequence - leaving the hardware stuck until a reboot. No public exploit has been identified and EPSS is 0.15% (5th percentile), consistent with the narrow hardware and local-access prerequisites.
Runtime PM reference count leak in the Linux kernel's Tegra I2C driver permanently prevents the affected I2C controller from entering runtime suspend when tegra_i2c_mutex_lock() returns an error. The asymmetric acquire-without-release of pm_runtime_get_sync() causes device power management to malfunction on NVIDIA Tegra SoC hardware, covering Linux 7.0 through pre-7.0.11 and pre-7.1. No public exploit exists and EPSS at 0.14% (4th percentile) reflects minimal exploitation interest; this is a stability and power management correctness defect rather than a security attack vector in the conventional sense.
Memory leaks in the Linux kernel's DRM colorop subsystem allow a local low-privileged attacker to gradually exhaust kernel memory by triggering repeated DRM atomic state lifecycle operations, ultimately causing denial of service via out-of-memory conditions. Affected systems are those running Linux kernel versions between the introduction of the colorop subsystem (commit cfc27680ee208cdf7a61cda817b4158c4142595f) and the upstream fix commits, with patched versions available at 7.0.9 and 7.1. No active exploitation is confirmed (not in CISA KEV) and EPSS is extremely low at 0.14% (4th percentile), making this a low-urgency but legitimate kernel hygiene issue requiring patching during normal maintenance cycles.
Insufficient session expiration in django-oauth-toolkit 3.3.0 allows authenticated network attackers to exploit the `_load_id_token` function in `oauth2_provider/oauth2_validators.py`, bypassing token expiration enforcement and maintaining access beyond their authorized session lifetime. The CVSS 4.0 score of 5.3 with PR:L confirms exploitation requires low-privilege access (a valid or expired token), and impacts confidentiality, integrity, and availability at a low level. No public exploit or active exploitation has been confirmed; the issue was submitted via a GitHub issue report and the project has not yet issued a response or patch.
Improper authorization across multiple dashboard API endpoints in MoviePilot through version 2.13.5 allows any authenticated low-privilege user to access administrative telemetry that should be restricted to superusers. The root cause, confirmed by patch commit dc2b6910a423b3bfadeffaa303e1ba75cfb33900, is that route handlers in `app/api/endpoints/dashboard.py` used `verify_token` (any valid session) rather than `get_current_active_superuser` for endpoints exposing system stats, storage, CPU/memory usage, downloader metrics, and scheduler information. No public exploit has been identified and this CVE is not listed in the CISA KEV catalog.
Race condition in awesto django-shop's Purchase Stock Handler allows a remotely authenticated attacker with low privileges to manipulate inventory data by triggering concurrent purchase requests. Affected versions span all releases up to and including 1.2.4. A publicly available proof-of-concept exists in the project's GitHub issue tracker, and the vendor has not responded to responsible disclosure - no patch has been released. EPSS data is absent, but the CVSS 4.0 score of 2.3 reflects the high attack complexity and limited impact scope.
Race condition in Allegro Ralph's hostname allocation handler allows adjacent, low-privileged attackers to corrupt hostname assignment logic, producing duplicate or incorrect hostname entries. The flaw resides in the AssetLastHostname.increment_hostname function within src/ralph/assets/models/assets.py, where concurrent manipulation of the counter argument creates a time-of-check/time-of-use window. The project maintainers were notified via an issue report but have not yet responded, leaving no available patch; a proof-of-concept exploit has been publicly disclosed on GitHub. No public exploit identified at time of analysis beyond the PoC, and KEV status is not confirmed.
Unrestricted file upload in SourceCodester Pizzafy Ecommerce System 1.0 exposes the admin panel's `save_settings` function to arbitrary file upload via the `img` parameter in `/admin/admin_class_novo.php`. The CVSS 4.0 vector (PR:H) confirms exploitation requires authenticated administrator-level access, but once achieved, a PHP webshell can be uploaded to the server and potentially executed, escalating effective impact well beyond the base score's conservative VC:L/VI:L ratings. No public exploit code and no CISA KEV listing exist at time of analysis.
Cleartext storage of blog entry protection passwords in django-blog-zinnia (all versions through 0.20) exposes those passwords to any local actor with read access to the application's storage layer. The flaw resides in the Protected Entry Password Handler at `zinnia/views/mixins/entry_protection.py`, where passwords used to gate access to individual blog entries are persisted without hashing or encryption. No public exploit code exists and no actively exploited status has been confirmed; the project maintainer has not responded to the coordinated disclosure, making a vendor-issued patch unlikely.
IP allowlist bypass in Sipeed PicoClaw's First Run Setup middleware allows remote unauthenticated attackers to circumvent CIDR-based access controls by injecting a spoofed trusted IP address into the `X-Forwarded-For` header, exploiting the pre-patch logic that blindly trusted the leftmost header value without validating intermediate proxies. All versions through 0.2.9 are affected via the `web/backend/middleware/access_control.go` component. A public proof-of-concept is confirmed (CVSS 4.0 E:P), though high attack complexity and the narrow setup-phase window substantially limit real-world impact; no active exploitation has been confirmed in CISA KEV.
Race condition in django-tastypie's throttle module (versions up to 0.15.1) allows authenticated remote users to bypass API rate limiting controls by exploiting a time-of-check to time-of-use (TOCTOU) window in the CacheThrottle and CacheDBThrottle classes. The CVSS 4.0 score of 2.3 with high attack complexity (AC:H) and low-privilege requirement (PR:L) reflects the limited real-world risk; impacts are constrained to minor information disclosure and throttle bypass without subsequent-system effects. No public exploit has been identified and the project maintainers have not yet responded to the disclosure.
Improper exception handling in devpush's storage reset worker exposes a limited integrity-impact flaw for adjacent network attackers with low-privilege access. The `reset_storage` function in `app/workers/tasks/storage.py` fails to correctly check or handle exceptional conditions (CWE-703), meaning that under specific error scenarios, the storage reset process may enter an inconsistent or exploitable state. With a CVSS 4.0 score of 2.1, no public exploit code identified, and no active exploitation confirmed, this represents a low-priority finding that nonetheless warrants a vendor patch given the unresponsive upstream maintainer.
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() A DIRECTORY entry's value field is used as the dir_offset for a recursive call into __tb_property_parse_dir() with no depth counter. A crafted peer that chains DIRECTORY entries into a back-reference loop drives the parser until the kernel stack is exhausted and the guard page fires. Any untrusted XDomain peer (cable, dock, in-line inspector, adjacent host) that reaches the PROPERTIES_REQUEST control-plane exchange can trigger this without authentication. Thread a depth counter through tb_property_parse() and __tb_property_parse_dir(), and reject blocks that exceed TB_PROPERTY_MAX_DEPTH = 8. That is comfortably larger than any observed legitimate XDomain layout. Operators who do not need XDomain host-to-host discovery can disable the path entirely with thunderbolt.xdomain=0 on the kernel command line.
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: copy only received bytes on short ep0 read ffs_ep0_read() allocates its control-OUT data buffer with kmalloc() (not kzalloc) at the Length value from the Setup packet, then copies that full len to userspace regardless of how many bytes were actually received: data = kmalloc(len, GFP_KERNEL); ... ret = __ffs_ep0_queue_wait(ffs, data, len); if ((ret > 0) && (copy_to_user(buf, data, len))) ret = -EFAULT; __ffs_ep0_queue_wait() returns req->actual, which on a short control OUT transfer is strictly less than len. The copy_to_user() call still copies len bytes, so on a short OUT the last (len - ret) bytes of the kmalloc() buffer -- uninitialised slab residue -- are delivered to the FunctionFS daemon. Short ep0 OUT completions are specified USB control-transfer behavior and are produced by in-tree UDCs: * dwc2 continues on req->actual < req->length for ep0 DATA OUT (short-not-ok is the only ep0-OUT stall path). * aspeed_udc ends ep0 OUT on rx_len < ep->ep.maxpacket. * renesas_usbf logs "ep0 short packet" and completes the request. * dwc3 stalls on short IN but not on short OUT. A short ep0 OUT is therefore not evidence of a broken UDC; it is a normal condition f_fs has to cope with. The sibling gadgetfs implementation in drivers/usb/gadget/legacy/inode.c already does this correctly via min(len, dev->req->actual) before copy_to_user(). This patch brings f_fs.c to the same safe pattern rather than trimming at a defensive layer. The bug is reached from the FunctionFS device node, which in real deployments is owned by the privileged gadget daemon (adbd, UMS, composite gadget services, etc.); it is not reachable from unprivileged userspace. Linux host stacks normally reject short-wLength control OUTs before they reach the gadget, so reproducing this required a build that bypasses that host-side check. With the bypass in place, a 1-byte payload on a 64-byte Setup produces 63 bytes of non-canary slab residue in the daemon's read buffer. Fix by copying only ret (actually received) bytes to userspace.
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow On the non-root path, __tb_property_parse_dir() takes dir_len from entry->length (u16 widened to size_t). Two distinct OOB conditions follow when entry->length < 4: 1. The non-root path begins with kmemdup(&block[dir_offset], sizeof(*dir->uuid), ...) which always reads 4 dwords from dir_offset. tb_property_entry_valid() only enforces dir_offset + entry->length <= block_len, so a crafted entry with dir_offset close to the end of the property block and entry->length in 0..3 passes that gate but lets the UUID copy run off the block (e.g. dir_offset = 497, dir_len = 3 in a 500-dword block reads block[497..501]). 2. After the kmemdup, content_len = dir_len - 4 underflows size_t to ~SIZE_MAX, nentries becomes SIZE_MAX / 4, and the entry walk runs OOB on each iteration until an entry fails validation or the kernel oopses on an unmapped page. Reject dir_len < 4 on the non-root path *before* the UUID kmemdup, which closes both holes. Also move INIT_LIST_HEAD(&dir->properties) up to immediately after the dir allocation so the new error-return path (and the existing uuid-alloc failure path) calling tb_property_free_dir() sees a walkable list rather than the zero-initialized NULL next/prev that list_for_each_entry_safe() would oops on.
In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer The tagged FIFO path declares iio_buff on the stack with __aligned(8) but no initializer, but there is a hole in the structure, which will then leak to userspace as ST_LSM6DSX_SAMPLE_SIZE bytes (6) will be copied, but the space between that and the timestamp are not initialized. Commit c14edb4d0bdc ("iio:imu:st_lsm6dsx Fix alignment and data leak issues") moved the untagged FIFO path to a kzalloc'd buffer in hw->scan, but for the tagged path it only added the alignment qualifier and not the initializer :( Fix this by just zero-initializing the structure on the stack.
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: reject firmware images without a ':' record header do_flash() locates the first .cyacd record with p = strnchr(fw->data, fw->size, ':'); while (p < eof) { s = strnchr(p + 1, eof - p - 1, ':'); ... } If the firmware image contains no ':' byte, strnchr() returns NULL. NULL compares less than the valid kernel pointer eof, so the loop body runs and strnchr() is called with p + 1 == (void *)1 and a length of roughly (unsigned long)eof, causing a wonderful crash. The not_signed_fw fallthrough earlier in do_flash() and the chip-state branches in ccg_fw_update_needed() allow an unsigned blob to reach this loop, so a root user who can place a crafted file under /lib/firmware and write the do_flash sysfs attribute can trigger the oops. Bail out with -EINVAL when the initial strnchr() returns NULL.
In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: validate count before reading Status Update VDO A broken/malicious device can send the incorrect count for a status update VDO, which will cause the kernel to read uninitialized stack data and send it off elsewhere. Fix this up by correctly verifying the count for the update object.
In the Linux kernel, the following vulnerability has been resolved: usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() wcove_read_rx_buffer() copies the PD RX FIFO into the caller's struct pd_message with for (i = 0; i < USBC_RXINFO_RXBYTES(info); i++) regmap_read(wcove->regmap, USBC_RX_DATA + i, msg + i); which has two problems: USBC_RXINFO_RXBYTES() is a 5-bit field (max 31) while struct pd_message is 30 bytes (__le16 header + __le32 payload[PD_MAX_PAYLOAD], packed). The byte count latched in RXINFO is the number of bytes the port partner put on the wire, so a malicious partner that transmits a 31-byte frame can drive the loop one byte past the destination if the WCOVE BMC receiver does not enforce the PD object-count limit in hardware. The existing FIXME flagged this as unverified. Independently, regmap_read() takes an unsigned int * and stores a full unsigned int at the destination. Passing the byte pointer msg + i means each iteration writes four bytes; the high three are zero (val_bits is 8) and are normally overwritten by the next iteration, but the final iteration's high bytes are not. With RXBYTES == 30 the i == 29 iteration already writes three zero bytes past msg, which sits on the IRQ thread's stack in wcove_typec_irq(). Clamp the loop to sizeof(struct pd_message) and read each register into a local before storing only its low byte, so the copy can never exceed the destination regardless of what RXINFO reports.
In the Linux kernel, the following vulnerability has been resolved: USB: serial: safe_serial: fix memory corruption with small endpoint Make sure that the bulk-out buffer size is at least eight bytes to avoid user-controlled slab corruption in "safe" mode should a malicious device report a smaller size.
In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypress_m8: fix memory corruption with small endpoint Make sure that the interrupt-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption or NULL-pointer dereference should a malicious device report a smaller size.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn __set_chan_timer() takes a l2cap_chan reference via l2cap_chan_hold() before scheduling the delayed work. The normal path in l2cap_chan_timeout() drops this reference with l2cap_chan_put() at the end, but the early return when chan->conn is NULL skips the put, leaking the reference. Add the missing l2cap_chan_put() before the early return.
In the Linux kernel, the following vulnerability has been resolved: iio: gyro: itg3200: fix i2c read into the wrong stack location itg3200_read_all_channels() takes `__be16 *buf' as a parameter and fills the i2c_msg destination as `(char *)&buf'. Since `buf' is the parameter (a pointer), `&buf' is the address of the local pointer slot on the stack of itg3200_read_all_channels(), not the address of the caller's scan buffer. The (char *) cast hides the type mismatch. i2c_transfer() therefore writes ITG3200_SCAN_ELEMENTS * sizeof(s16) = 8 bytes into the parameter's stack slot, which is discarded when the function returns. The caller's scan buffer in itg3200_trigger_handler() is never written to, so iio_push_to_buffers_with_timestamp() pushes uninitialised stack contents to userspace via /dev/iio:deviceX every scan -- both a functional bug (no actual gyroscope or temperature data is delivered through the triggered buffer) and an information leak. The non-buffered read_raw() path is unaffected: it goes through itg3200_read_reg_s16() which uses `&out' on a local s16 value, where that is correct. Drop the spurious `&' so the i2c read writes into the caller's buffer.
In the Linux kernel, the following vulnerability has been resolved: iio: gyro: adis16260: fix division by zero in write_raw Add a validation check for the sampling frequency value before using it as a divisor. A user writing zero to the sampling_frequency sysfs attribute triggers a division by zero in the kernel.
In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: fix division by zero in write_raw Add a zero check for val2 before using it as a divisor when setting the sampling frequency. A user writing a zero fractional part to the sampling_frequency sysfs attribute triggers a division by zero in the kernel.
In the Linux kernel, the following vulnerability has been resolved: USB: serial: omninet: fix memory corruption with small endpoint Make sure that the bulk-out buffers are at least as large as the hardcoded transfer size to avoid user-controlled slab corruption should a malicious device report a smaller endpoint max packet size than expected.
In the Linux kernel, the following vulnerability has been resolved: Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem When a configuration file provides an object size that is larger than the driver's known mxt_obj_size(object), the driver intends to discard the extra bytes. The loop iterates using for (i = 0; i < size; i++). Inside the loop, the condition to skip processing extra bytes is: if (i > mxt_obj_size(object)) continue; Since i is a 0-based index, the valid indices for the object are 0 through mxt_obj_size(object) - 1. When i == mxt_obj_size(object), the condition evaluates to false, and the code processes the byte instead of discarding it. This causes the code to calculate byte_offset = reg + i - cfg->start_ofs and writes the byte there, overwriting exactly one byte of the adjacent instance or object. Update the boundary check to skip extra bytes correctly by using >=.
In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: Fix use after free bug in vudc_remove due to race condition This patch follows up Zheng Wang's 2023 report of a use-after-free in vudc_remove(). The original thread stalled on Shuah Khan's request for runtime testing of the unplug/unbind path. This patch supplies that testing and keeps Zheng's original fix shape. In vudc_probe(), v_init_timer() binds udc->tr_timer.timer to v_timer(). usbip_sockfd_store() starts the timer via v_start_timer()/v_kick_timer(). vudc_remove() can then free the containing struct vudc while the timer is still pending or executing. KASAN confirms the race on an unpatched x86_64 QEMU guest with CONFIG_KASAN=y, CONFIG_USBIP_VUDC=y, CONFIG_USB_ZERO=y, and a tight loop that repeatedly writes a socket fd to usbip_sockfd, closes the socket pair, and unbinds/rebinds usbip-vudc.0: BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x8ba/0x8e0 Write of size 8 at addr ffff888001b80740 by task trigger_and_unb/239 Allocated by task 239: vudc_probe+0x4d/0xaa0 Freed by task 239: kfree+0x18f/0x520 device_release_driver_internal+0x388/0x540 unbind_store+0xd9/0x100 This lands in the timer core rather than v_timer() itself because the embedded timer_list is being walked after its containing struct vudc has already been freed. The underlying lifetime bug is the same one Zheng reported. With v_stop_timer() called from vudc_remove() and the timer deleted synchronously, the same harness completed 5000 bind/unbind iterations with no KASAN report.
In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: check URB actual_length for interrupt-IN notifications USBTMC devices can use an optional interrupt endpoint for notification messages. These typically contain two-byte headers indicating the payload format, but the driver does not check if these headers are present before accessing the data buffers. In cases where the URB actual_length is not enough to fit these headers, the driver will either cause an out-of-bounds read, or consume stale leftover data from a previous notification. Fix by checking if actual_data contains enough bytes for the headers, otherwise resubmit URB to the interrupt endpoint.
In the Linux kernel, the following vulnerability has been resolved: USB: serial: belkin_sa: validate interrupt status length The Belkin interrupt callback treats interrupt data as a four-byte status report and reads LSR/MSR fields at offsets 2 and 3. The interrupt-in buffer length is derived from endpoint wMaxPacketSize, and short interrupt transfers may complete successfully with a smaller actual_length. Check the completed interrupt packet length before parsing status fields so short interrupt endpoints and short successful packets are ignored instead of causing out-of-bounds or stale status-byte reads. KASAN report as below: BUG: KASAN: slab-out-of-bounds in belkin_sa_read_int_callback() Read of size 1 Call trace: belkin_sa_read_int_callback() (drivers/usb/serial/belkin_sa.c:202) __usb_hcd_giveback_urb() (drivers/usb/core/hcd.c:1630) dummy_timer() (?:?)
In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypress_m8: validate interrupt packet headers cypress_read_int_callback() parses the interrupt-in buffer according to the selected Cypress packet format. Format 1 has a two-byte status/count header and format 2 has a one-byte combined status/count header. The usb-serial core sizes the interrupt-in buffer from the endpoint descriptor's wMaxPacketSize, and successful interrupt transfers can complete short when URB_SHORT_NOT_OK is not set. Check that the completed packet contains the selected header before reading it. Malformed short reports are ignored and the interrupt URB is resubmitted through the existing retry path, preventing out-of-bounds header-byte reads. KASAN report as below: KASAN slab-out-of-bounds in cypress_read_int_callback+0x240/0x7f0 Read of size 1 Call trace: cypress_read_int_callback() (drivers/usb/serial/cypress_m8.c:1009) __usb_hcd_giveback_urb() dummy_timer() [ johan: use constants in header length sanity checks ]
In the Linux kernel, the following vulnerability has been resolved: USB: serial: digi_acceleport: fix memory corruption with small endpoints Add the missing bulk-out buffer size sanity checks to avoid out-of-bounds memory accesses or slab corruption should a malicious device report smaller buffers than expected.
In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspan: fix missing indat transfer sanity check Add the missing sanity check on the size of usa49wg indat transfers to avoid parsing stale or uninitialised slab data.
In the Linux kernel, the following vulnerability has been resolved: USB: serial: mxuport: fix memory corruption with small endpoint Make sure that the bulk-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption should a malicious device report a smaller size.