Linux Kernel and FUD

posted by Roy Schestowitz on May 01, 2025

• Linux

  • Kernel Space

    • LWN ☛ DMA addresses for UIO

      The Userspace I/O (UIO) subsystem was first added to the kernel by Hans J. Koch for the 2.6.23 release in 2007. Its purpose is to facilitate the writing of drivers (mostly) in user space; to that end, it provides access to a number of resources that user-space code normally cannot touch. One piece that is missing, though, is DMA addresses. A proposal to fill that gap from Bastien Curutchet is running into some opposition, though.

      While UIO drivers reside mostly in user space, they still require a small in-kernel component; it is essentially a bit of glue that can probe for a device and handle interrupts, and which informs the kernel of any memory-mapped I/O (MMIO) regions that should be made available to user space. Showing its age, UIO also has a mechanism to make x86 I/O ports available. Once that module is loaded, a user-space driver can open the appropriate /dev/uioX device, map the memory regions into its address space, use that mapping to program the device, and read from the device file descriptor to wait for interrupts. The mapped MMIO areas are usually all that is needed to operate the device.

• Fear, Uncertainty, Doubt/Fear-mongering/Dramatisation

  • Shelltrail Uncovers IXON VPN Flaws Exposing Windows & Linux Systems to Hackers

    Three major flaws in IXON’s VPN software could let hackers take control of industrial systems with just a few lines of code.

    Cybersecurity firm Shelltrail recently disclosed vulnerabilities in the IXON VPN client that allow local privilege escalation (LPE) on both Windows and Linux platforms.

    Two of the bugs, now identified as "CVE-2025-ZZZ-02" and "CVE-2025-ZZZ-03," stem from how the VPN client handles temporary configuration files.

  • The Register UK ☛ Watch out for any Linux malware sneakily evading syscall-watching antivirus

    A proof-of-concept program has been released to demonstrate a so-called monitoring "blind spot" in how some Linux antivirus and other endpoint protection tools use the kernel's io_uring interface.

  • Upgraded Albabat ransomware can now target Mac and Linux OS

    The latest versions of the Albabat ransomware could allegedly allow threat actors to target multiple operating systems and upgrade the efficiency of its operations.