[RFC] Linux kernel: 52 latent bugs found by static audit (still present in v7.2-rc6)
From: Lin INK
Date: Sun Aug 09 2026 - 04:47:10 EST
To: security@xxxxxxxxxx
Cc: linux-kernel@xxxxxxxxxxxxxxx
Bcc: subsystem maintainers (see individual patch To/Cc)
NOTE: This is a batch disclosure for bugs discovered by a systematic static
audit of the Linux kernel (initial snapshot v6.17-rc3, tag dated 2025-08-24).
All reported bugs below were re-verified against current mainline
(v7.2-rc6, snapshot 2026-08-08 / commit 06cf61899d64) on 2026-08-09 and are
confirmed to STILL BE PRESENT. Individual patches will follow as follow-up
emails, one per bug, to the relevant subsystem maintainers (in Cc via
scripts/get_maintainer.pl). Please treat this as a coordinated disclosure;
default disclosure timeline is 7 days, extensible on request.
Reported-by: [Your Name] <[your-email]>
This report was generated with the assistance of an automated auditing tool
(SpecAuditor). Each finding below was manually reviewed and re-checked against
the current kernel source before inclusion.
======================================================================
SUMMARY
======================================================================
Kernel version affected: v6.17-rc3 through v7.2-rc6 (current mainline)
Number of bugs reported: 52
Categories: out-of-bounds read, uninitialized stack disclosure,
reference-count / refcount leaks, missing NULL checks, missing error-path
cleanup, integer-arithmetic concerns.
Below is the full list. Each entry: [num] function (file) -- one-line summary.
Detailed per-bug analysis and proposed fixes are in the individual patches.
A. WIRELESS RX PATH -- OUT-OF-BOUNDS READS (drivers/net/wireless)
[16] ath10k_htt_rx_h_find_rfc1042 (drivers/net/wireless/ath/ath10k/htt_rx.c, L1645)
hdr_len derived from ieee80211_hdrlen() on untrusted frame control is
used in round_up(hdr_len) + round_up(crypto_len) without validating
against skb->len; A-MSDU/undecap math can read past the skb data.
[17] ath10k_htt_rx_h_get_pn (htt_rx.c, L1859)
ehdr = skb->data + ieee80211_hdrlen(hdr->frame_control); reads
ehdr[0..7] (PN) with no skb->len check -> OOB read.
[18] ath10k_htt_rx_h_undecap_eth (htt_rx.c, L1700-1709)
hdr_len = ieee80211_hdrlen() on untrusted first_hdr, then
memcpy(skb_push(msdu, hdr_len), hdr, hdr_len) -- no bounds check.
[19] ath10k_htt_rx_h_undecap_nwifi (htt_rx.c, L1593-1602)
Same unchecked hdr_len + skb_push/memcpy pattern. NOTE: the identical
bug was fixed in ath11k (commit 6b471e9aefee, 2026-05) and ath12k
(CVE-2025-37943); the ath10k instance remains unpatched.
[20] ath10k_htt_rx_h_undecap_raw (htt_rx.c, L1483-1496)
hdr_len then memcpy(skb_push(msdu,hdr_len),hdr,hdr_len) unchecked.
[21] ath10k_htt_rx_proc_rx_frag_ind_hl (htt_rx.c, L2825)
hdr_space = ieee80211_hdrlen() with no validation against skb->len.
[22] ath10k_htt_rx_proc_rx_ind_hl (htt_rx.c, L2612-2618)
offset = ieee80211_hdrlen() inside the protected-frame branch, then
memmove(skb->data-CCMP_HDR_LEN, data, offset) + skb_push(CCMP_HDR_LEN);
no skb->len check.
[23] ath10k_htt_rx_validate_amsdu (htt_rx.c, L2267)
subframe_hdr = hdr + round_up(hdr_len) + crypto_len then
ether_addr_equal(subframe_hdr, rfc1042_header) -- read past end if
subframe is truncated.
[24] ath11k_dp_rx_h_undecap_eth (drivers/net/wireless/ath/ath11k/dp_rx.c, L2145-2154)
hdr_len = ieee80211_hdrlen(first_hdr->frame_control) then
memcpy(skb_push(msdu,hdr_len),hdr,hdr_len) unchecked. The 2026 nwifi
check (6b471e9aefee) explicitly does NOT cover the ETH decap path.
[26] ath11k_dp_rx_h_undecap_raw (dp_rx.c, L2080-2085)
hdr_len then memmove(msdu->data+crypto_len, msdu->data, hdr_len) +
skb_pull(msdu, crypto_len) -- no skb->len check.
[9] adm8211_tx (drivers/net/wireless/admtek/adm8211.c, L1689)
hdrlen = ieee80211_hdrlen(hdr->frame_control);
memcpy(skb->cb, skb->data, hdrlen); skb_pull(skb, hdrlen) -- no
skb->len check (low reachability: TX path, frame_control usually
validated, but the unchecked pattern is unpatched).
B. INFINIBAND SA -- UNINITIALIZED STACK (drivers/infiniband/core/sa_query.c)
[63] ib_nl_process_good_resolve_rsp (L934-986)
struct sa_path_rec recs[RDMA_PRIMARY_PATH_MAX_REC_NUM] declared without
zero-init; ib_unpack() partially fills; uninitialized bytes can be
propagated to userspace via the path-record callback.
[64] ib_sa_classport_info_rec_callback (L2072-2091)
struct opa_class_port_info rec declared without {} init; ib_unpack()
partially fills -> potential stack info leak.
[65] ib_sa_guidinfo_rec_callback (L1960)
struct ib_sa_guidinfo_rec rec declared without zero-init.
[66] ib_sa_mcmember_rec_callback (L1869)
struct ib_sa_mcmember_rec rec declared without zero-init.
C. FILESYSTEMS (fs/)
[2] __ceph_setxattr (fs/ceph/xattr.c, L1234; blob-size math at L878)
required_blob_size = 4 + count*(4+4) + names_size + vals_size computed
in signed int with no overflow guard before ceph_buffer_new().
[83] ni_decompress_file (fs/ntfs3/frecord.c, L2022-2023)
for (vcn; vcn < end; vcn += clen) loop checks only err from
attr_data_get_block(), not clen==0 -> possible infinite loop / stall.
[85] ntfs_compress_write (fs/ntfs3/file.c, L1018)
clen from attr_data_get_block() used without !clen validation.
[86] ntfs_fallocate (fs/ntfs3/file.c, L669-670)
for (vcn; vcn < cend; vcn += clen) loop uses clen without !clen check.
D. DRM / GPU (drivers/gpu/drm/)
[40] cdv_intel_dp_get_modes (drivers/gpu/drm/gma500/cdv_intel_dp.c, L1770-1771)
drm_mode_duplicate() result passed to drm_mode_probed_add() without
NULL check (OOM NULL-deref).
[51] drm_gem_object_init (drivers/gpu/drm/drm_gem.c, L184-200)
On shmem_file_setup() failure, returns error after
drm_gem_private_object_init() without matching
drm_gem_private_object_fini() cleanup.
[55] etnaviv_gem_new_handle (drivers/gpu/drm/etnaviv/etnaviv_gem.c, L626-644)
error path after drm_gem_object_init failure calls drm_gem_object_put()
on an object never added to the GEM list.
[59] fsl_dcu_unload (drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c, L155-158)
drm_atomic_helper_shutdown() called before drm_kms_helper_poll_fini()
(teardown ordering).
[61] gem_create_obj (drivers/gpu/drm/xen/xen_drm_front_gem.c, L126-128)
After drm_gem_object_init() failure, kfree(xen_obj) without
drm_gem_object_release().
[80] mtk_drm_of_get_ddp_ep_cid (drivers/gpu/drm/mediatek/mtk_drm_drv.c, L856-931)
of_graph_get_remote_port_parent() ref leaked on caller error path.
[88] of_dp_aux_populate_bus (drivers/gpu/drm/display/drm_dp_aux_bus.c, L272-312)
of_get_next_available_child() ref not put on success path (leak).
[102] tegra_bo_alloc_object (drivers/gpu/drm/tegra/gem.c, L316-329)
kfree(bo) without drm_gem_object_release() on init failure.
[47] dce_v6_0_sw_fini (drivers/gpu/drm/amd/amdgpu/dce_v6_0.c, L2808-2810)
drm_edid_free(bios_hardcoded_edid) before drm_kms_helper_poll_fini()
(free-before-flush ordering).
[13] amdgpu_cs_submit (drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c, L1343)
p->fence = dma_fence_get(&leader->base.s_fence->finished); verify
reference balance (put exists in amdgpu_cs_parser_fini L1406) -- listed
for maintainer confirmation.
E. CXL / FPGA / CLK / BUS (drivers/)
[43] cxl_acpi_qos_class (drivers/cxl/acpi.c, L315-318)
cxl_root->port.uport_dev used with dev_is_platform() without NULL check.
[45] cxl_port_setup_regs (drivers/cxl/core/port.c, L776)
dev_is_platform(port->uport_dev) without NULL check.
[58] fme_pr (drivers/fpga/dfl-fme-pr.c, L128-137)
fpga_image_info_alloc() result (info) not freed on !fme/!region error
paths (ref leak).
[89] of_fpga_region_parse_ov (drivers/fpga/of-fpga-region.c, L234-237)
On devm_kstrdup() failure returns ERR_PTR(-ENOMEM) without
fpga_image_info_free(info).
[30] bcm2835_register_pll_divider (drivers/clk/bcm/clk-bcm2835.c, L1387-1390)
devm_kasprintf() failure returns NULL; caller at L2319 stores unchecked
NULL into hws[i].
[90] omap2_clk_provider_init (drivers/clk/ti/clk.c, L405-416)
of_get_child_by_name(parent,"clocks") ref not put on kzalloc-fail path.
[1] __cci_ace_get_port (drivers/bus/arm-cci.c, L167)
of_parse_phandle(dn,"cci-control-port",0) ref never released
(of_node ref leak).
[6] acpi_os_terminate (drivers/acpi/osl.c, L1724-1740)
GPE0/GPE1/PM1a/PM1b/reset unmap sequence unchanged (verify ref/resource
lifetime vs acpi_os_map_generic_address).
F. MTD / DSA / NET / SOUND / MISC
[74] ma35_nand_read_oob_hwecc (drivers/mtd/nand/raw/nuvoton-ma35d1-nand-controller.c, L695)
nand_read_oob_op() return unchecked before using chip->oob_poi.
[75] ma35_nand_read_page_hwecc (same file, L669)
Same unchecked nand_read_oob_op().
[73] ksz_mdio_register (drivers/net/dsa/microchip/ksz_common.c, L2504-2511)
of_mdio_find_bus() ref stored in dev->parent_mdio_bus; no mdiobus_put()
anywhere (refcount leak).
[84] node_init_node_access (drivers/base/node.c, L173)
device_register() failure path does manual kfree_const+kfree without
put_device().
[48] device_register (drivers/base/core.c, L3851)
device_initialize()+device_add(); on add failure the device stays
initialized and callers must put_device() (documented; listed for
confirmation).
[70] isa_bus_init (drivers/base/isa.c, L170)
root_device_register() error path only unregisters bus.
[72] kcs_bmc_ipmi_add_device (drivers/char/ipmi/kcs_bmc_cdev_ipmi.c, L488)
devm allocations; alloc-failure check returns -EINVAL instead of
-ENOMEM (minor; listed for confirmation).
[103] test_multipart_messages (drivers/char/ipmi/ipmi_ssif.c, L1589)
i2c_smbus_write_block_data(..., 0, msg+64) zero-length MIDDLE-part test
unchanged (verify semantics).
[101] snd_usb_parse_datainterval (sound/usb/helper.c, L114)
get_endpoint(alts,0)->bInterval without checking bNumEndpoints >= 1.
[52] endpoint_set_syncinterval (sound/usb/endpoint.c, L737)
get_endpoint(alts, ep->ep_idx) without bNumEndpoints check (comment
L689-690 relies on caller guarantee).
[104] uaudio_populate_uac_desc (sound/usb/qcom/qc_audio_offload.c, L1321)
get_endpoint(alts,0)->wMaxPacketSize in UAC3 branch without
bNumEndpoints check.
[10] aie2_cmd_submit (drivers/accel/amdxdna/aie2_ctx.c, L1181)
job->out_fence = dma_fence_get(&job->base.s_fence->finished) after
drm_sched_job_arm(); put in aie2_job_release; listed for confirmation
of NULL s_fence handling on OOM.
======================================================================
Bugs verified as NO LONGER PRESENT in current mainline (not reported)
======================================================================
#44 cxl_fw_prepare -- fixed (cxl_mem_get_fw_info return checked, L927)
#46 dce_v11_0_sw_fini -- file removed (non-DC DCE 11 code deleted)
#87 ntfs_get_block_vbo -- function removed by iomap rewrite; successor
ntfs_iomap_begin now guards !clen (returns -EINVAL, L811)
======================================================================
NOTES FOR MAINTAINERS
======================================================================
1. Each individual fix patch will be sent as a separate follow-up email to the
appropriate subsystem maintainer list, with a "Fixes:" tag and Cc: stable
where appropriate.
2. For the wireless RX-path OOB group (A), the analogous fixes already exist
for ath11k (6b471e9aefee) and ath12k (CVE-2025-37943); the ath10k and
remaining ath11k decap paths still lack the equivalent validation.
3. Line numbers refer to v7.2-rc6 (commit 06cf61899d64). Please let me know
if any of these are already tracked elsewhere so I can drop them.
Signed-off-by: [Your Name] <[your-email]>