[RFC] Linux kernel: 52 latent bugs found by static audit (still present in v7.2-rc6)

Subject: [SECURITY][PATCH 0/N] Linux kernel: several latent bugs in v6.17-rc3 that remain in current mainline (v7.2-rc6)

To: [email protected]
Cc: [email protected]
Bcc: subsystem maintainers (see individual patch To/Cc)

NOTE: This is a batch disclosure for bugs discovered by a systematic static
audit of the Linux kernel (initial snapshot v6.17-rc3, tag dated 2025-08-24).
All reported bugs below were re-verified against current mainline
(v7.2-rc6, snapshot 2026-08-08 / commit 06cf61899d64) on 2026-08-09 and are
confirmed to STILL BE PRESENT. Individual patches will follow as follow-up
emails, one per bug, to the relevant subsystem maintainers (in Cc via
scripts/get_maintainer.pl). Please treat this as a coordinated disclosure;
default disclosure timeline is 7 days, extensible on request.

Reported-by: [Your Name] <[your-email]>
This report was generated with the assistance of an automated auditing tool
(SpecAuditor). Each finding below was manually reviewed and re-checked against
the current kernel source before inclusion.

======================================================================
SUMMARY
======================================================================

Kernel version affected: v6.17-rc3 through v7.2-rc6 (current mainline)
Number of bugs reported: 52
Categories: out-of-bounds read, uninitialized stack disclosure,
reference-count / refcount leaks, missing NULL checks, missing error-path
cleanup, integer-arithmetic concerns.

Below is the full list. Each entry: [num] function (file) -- one-line summary.
Detailed per-bug analysis and proposed fixes are in the individual patches.

A. WIRELESS RX PATH -- OUT-OF-BOUNDS READS (drivers/net/wireless)

  [16] ath10k_htt_rx_h_find_rfc1042 (drivers/net/wireless/ath/ath10k/htt_rx.c, L1645)
       hdr_len derived from ieee80211_hdrlen() on untrusted frame control is
       used in round_up(hdr_len) + round_up(crypto_len) without validating
       against skb->len; A-MSDU/undecap math can read past the skb data.
  [17] ath10k_htt_rx_h_get_pn (htt_rx.c, L1859)
       ehdr = skb->data + ieee80211_hdrlen(hdr->frame_control); reads
       ehdr[0..7] (PN) with no skb->len check -> OOB read.
  [18] ath10k_htt_rx_h_undecap_eth (htt_rx.c, L1700-1709)
       hdr_len = ieee80211_hdrlen() on untrusted first_hdr, then
       memcpy(skb_push(msdu, hdr_len), hdr, hdr_len) -- no bounds check.
  [19] ath10k_htt_rx_h_undecap_nwifi (htt_rx.c, L1593-1602)
       Same unchecked hdr_len + skb_push/memcpy pattern. NOTE: the identical
       bug was fixed in ath11k (commit 6b471e9aefee, 2026-05) and ath12k
       (CVE-2025-37943); the ath10k instance remains unpatched.
  [20] ath10k_htt_rx_h_undecap_raw (htt_rx.c, L1483-1496)
       hdr_len then memcpy(skb_push(msdu,hdr_len),hdr,hdr_len) unchecked.
  [21] ath10k_htt_rx_proc_rx_frag_ind_hl (htt_rx.c, L2825)
       hdr_space = ieee80211_hdrlen() with no validation against skb->len.
  [22] ath10k_htt_rx_proc_rx_ind_hl (htt_rx.c, L2612-2618)
       offset = ieee80211_hdrlen() inside the protected-frame branch, then
       memmove(skb->data-CCMP_HDR_LEN, data, offset) + skb_push(CCMP_HDR_LEN);
       no skb->len check.
  [23] ath10k_htt_rx_validate_amsdu (htt_rx.c, L2267)
       subframe_hdr = hdr + round_up(hdr_len) + crypto_len then
       ether_addr_equal(subframe_hdr, rfc1042_header) -- read past end if
       subframe is truncated.
  [24] ath11k_dp_rx_h_undecap_eth (drivers/net/wireless/ath/ath11k/dp_rx.c, L2145-2154)
       hdr_len = ieee80211_hdrlen(first_hdr->frame_control) then
       memcpy(skb_push(msdu,hdr_len),hdr,hdr_len) unchecked. The 2026 nwifi
       check (6b471e9aefee) explicitly does NOT cover the ETH decap path.
  [26] ath11k_dp_rx_h_undecap_raw (dp_rx.c, L2080-2085)
       hdr_len then memmove(msdu->data+crypto_len, msdu->data, hdr_len) +
       skb_pull(msdu, crypto_len) -- no skb->len check.
  [9]  adm8211_tx (drivers/net/wireless/admtek/adm8211.c, L1689)
       hdrlen = ieee80211_hdrlen(hdr->frame_control);
       memcpy(skb->cb, skb->data, hdrlen); skb_pull(skb, hdrlen) -- no
       skb->len check (low reachability: TX path, frame_control usually
       validated, but the unchecked pattern is unpatched).

B. INFINIBAND SA -- UNINITIALIZED STACK (drivers/infiniband/core/sa_query.c)

  [63] ib_nl_process_good_resolve_rsp (L934-986)
       struct sa_path_rec recs[RDMA_PRIMARY_PATH_MAX_REC_NUM] declared without
       zero-init; ib_unpack() partially fills; uninitialized bytes can be
       propagated to userspace via the path-record callback.
  [64] ib_sa_classport_info_rec_callback (L2072-2091)
       struct opa_class_port_info rec declared without {} init; ib_unpack()
       partially fills -> potential stack info leak.
  [65] ib_sa_guidinfo_rec_callback (L1960)
       struct ib_sa_guidinfo_rec rec declared without zero-init.
  [66] ib_sa_mcmember_rec_callback (L1869)
       struct ib_sa_mcmember_rec rec declared without zero-init.

C. FILESYSTEMS (fs/)

  [2]  __ceph_setxattr (fs/ceph/xattr.c, L1234; blob-size math at L878)
       required_blob_size = 4 + count*(4+4) + names_size + vals_size computed
       in signed int with no overflow guard before ceph_buffer_new().
  [83] ni_decompress_file (fs/ntfs3/frecord.c, L2022-2023)
       for (vcn; vcn < end; vcn += clen) loop checks only err from
       attr_data_get_block(), not clen==0 -> possible infinite loop / stall.
  [85] ntfs_compress_write (fs/ntfs3/file.c, L1018)
       clen from attr_data_get_block() used without !clen validation.
  [86] ntfs_fallocate (fs/ntfs3/file.c, L669-670)
       for (vcn; vcn < cend; vcn += clen) loop uses clen without !clen check.

D. DRM / GPU (drivers/gpu/drm/)

  [40] cdv_intel_dp_get_modes (drivers/gpu/drm/gma500/cdv_intel_dp.c, L1770-1771)
       drm_mode_duplicate() result passed to drm_mode_probed_add() without
       NULL check (OOM NULL-deref).
  [51] drm_gem_object_init (drivers/gpu/drm/drm_gem.c, L184-200)
       On shmem_file_setup() failure, returns error after
       drm_gem_private_object_init() without matching
       drm_gem_private_object_fini() cleanup.
  [55] etnaviv_gem_new_handle (drivers/gpu/drm/etnaviv/etnaviv_gem.c, L626-644)
       error path after drm_gem_object_init failure calls drm_gem_object_put()
       on an object never added to the GEM list.
  [59] fsl_dcu_unload (drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c, L155-158)
       drm_atomic_helper_shutdown() called before drm_kms_helper_poll_fini()
       (teardown ordering).
  [61] gem_create_obj (drivers/gpu/drm/xen/xen_drm_front_gem.c, L126-128)
       After drm_gem_object_init() failure, kfree(xen_obj) without
       drm_gem_object_release().
  [80] mtk_drm_of_get_ddp_ep_cid (drivers/gpu/drm/mediatek/mtk_drm_drv.c, L856-931)
       of_graph_get_remote_port_parent() ref leaked on caller error path.
  [88] of_dp_aux_populate_bus (drivers/gpu/drm/display/drm_dp_aux_bus.c, L272-312)
       of_get_next_available_child() ref not put on success path (leak).
  [102] tegra_bo_alloc_object (drivers/gpu/drm/tegra/gem.c, L316-329)
       kfree(bo) without drm_gem_object_release() on init failure.
  [47] dce_v6_0_sw_fini (drivers/gpu/drm/amd/amdgpu/dce_v6_0.c, L2808-2810)
       drm_edid_free(bios_hardcoded_edid) before drm_kms_helper_poll_fini()
       (free-before-flush ordering).
  [13] amdgpu_cs_submit (drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c, L1343)
       p->fence = dma_fence_get(&leader->base.s_fence->finished); verify
       reference balance (put exists in amdgpu_cs_parser_fini L1406) -- listed
       for maintainer confirmation.

E. CXL / FPGA / CLK / BUS (drivers/)

  [43] cxl_acpi_qos_class (drivers/cxl/acpi.c, L315-318)
       cxl_root->port.uport_dev used with dev_is_platform() without NULL check.
  [45] cxl_port_setup_regs (drivers/cxl/core/port.c, L776)
       dev_is_platform(port->uport_dev) without NULL check.
  [58] fme_pr (drivers/fpga/dfl-fme-pr.c, L128-137)
       fpga_image_info_alloc() result (info) not freed on !fme/!region error
       paths (ref leak).
  [89] of_fpga_region_parse_ov (drivers/fpga/of-fpga-region.c, L234-237)
       On devm_kstrdup() failure returns ERR_PTR(-ENOMEM) without
       fpga_image_info_free(info).
  [30] bcm2835_register_pll_divider (drivers/clk/bcm/clk-bcm2835.c, L1387-1390)
       devm_kasprintf() failure returns NULL; caller at L2319 stores unchecked
       NULL into hws[i].
  [90] omap2_clk_provider_init (drivers/clk/ti/clk.c, L405-416)
       of_get_child_by_name(parent,"clocks") ref not put on kzalloc-fail path.
  [1]  __cci_ace_get_port (drivers/bus/arm-cci.c, L167)
       of_parse_phandle(dn,"cci-control-port",0) ref never released
       (of_node ref leak).
  [6]  acpi_os_terminate (drivers/acpi/osl.c, L1724-1740)
       GPE0/GPE1/PM1a/PM1b/reset unmap sequence unchanged (verify ref/resource
       lifetime vs acpi_os_map_generic_address).

F. MTD / DSA / NET / SOUND / MISC

  [74] ma35_nand_read_oob_hwecc (drivers/mtd/nand/raw/nuvoton-ma35d1-nand-controller.c, L695)
       nand_read_oob_op() return unchecked before using chip->oob_poi.
  [75] ma35_nand_read_page_hwecc (same file, L669)
       Same unchecked nand_read_oob_op().
  [73] ksz_mdio_register (drivers/net/dsa/microchip/ksz_common.c, L2504-2511)
       of_mdio_find_bus() ref stored in dev->parent_mdio_bus; no mdiobus_put()
       anywhere (refcount leak).
  [84] node_init_node_access (drivers/base/node.c, L173)
       device_register() failure path does manual kfree_const+kfree without
       put_device().
  [48] device_register (drivers/base/core.c, L3851)
       device_initialize()+device_add(); on add failure the device stays
       initialized and callers must put_device() (documented; listed for
       confirmation).
  [70] isa_bus_init (drivers/base/isa.c, L170)
       root_device_register() error path only unregisters bus.
  [72] kcs_bmc_ipmi_add_device (drivers/char/ipmi/kcs_bmc_cdev_ipmi.c, L488)
       devm allocations; alloc-failure check returns -EINVAL instead of
       -ENOMEM (minor; listed for confirmation).
  [103] test_multipart_messages (drivers/char/ipmi/ipmi_ssif.c, L1589)
       i2c_smbus_write_block_data(..., 0, msg+64) zero-length MIDDLE-part test
       unchanged (verify semantics).
  [101] snd_usb_parse_datainterval (sound/usb/helper.c, L114)
       get_endpoint(alts,0)->bInterval without checking bNumEndpoints >= 1.
  [52]  endpoint_set_syncinterval (sound/usb/endpoint.c, L737)
       get_endpoint(alts, ep->ep_idx) without bNumEndpoints check (comment
       L689-690 relies on caller guarantee).
  [104] uaudio_populate_uac_desc (sound/usb/qcom/qc_audio_offload.c, L1321)
       get_endpoint(alts,0)->wMaxPacketSize in UAC3 branch without
       bNumEndpoints check.
  [10]  aie2_cmd_submit (drivers/accel/amdxdna/aie2_ctx.c, L1181)
       job->out_fence = dma_fence_get(&job->base.s_fence->finished) after
       drm_sched_job_arm(); put in aie2_job_release; listed for confirmation
       of NULL s_fence handling on OOM.

======================================================================
Bugs verified as NO LONGER PRESENT in current mainline (not reported)
======================================================================

  #44 cxl_fw_prepare   -- fixed (cxl_mem_get_fw_info return checked, L927)
  #46 dce_v11_0_sw_fini -- file removed (non-DC DCE 11 code deleted)
  #87 ntfs_get_block_vbo -- function removed by iomap rewrite; successor
      ntfs_iomap_begin now guards !clen (returns -EINVAL, L811)

======================================================================
NOTES FOR MAINTAINERS
======================================================================

1. Each individual fix patch will be sent as a separate follow-up email to the
   appropriate subsystem maintainer list, with a "Fixes:" tag and Cc: stable
   where appropriate.
2. For the wireless RX-path OOB group (A), the analogous fixes already exist
   for ath11k (6b471e9aefee) and ath12k (CVE-2025-37943); the ath10k and
   remaining ath11k decap paths still lack the equivalent validation.
3. Line numbers refer to v7.2-rc6 (commit 06cf61899d64). Please let me know
   if any of these are already tracked elsewhere so I can drop them.

Signed-off-by: [Your Name] <[your-email]>