Linux kernel vulnerabilities

In the Linux kernel netfilter flowtable, the function nf_flow_ip4_tunnel_proto() does not validate the iph->ihl field before using it to compute the header size, which can lead to out-of-bounds access with malformed IP headers. The fix adds a sanity check for the ihl field and uses iph->protocol instead of the hardcoded IPPROTO_IPIP constant when setting ctx->tun.proto, and references ctx->tun.hdr_size when updating ctx->offset.

In the Linux kernel, on s390/mm there is an issue with the _PAGE_UNUSED bit. This bit is not cleared in some pte-setting paths, which may lead to guest memory corruption.

In the Linux kernel, in the geneve subsystem, a vulnerability was fixed where geneve_gro_complete() did not check the gs->gro_hint flag, allowing an attacker to supply a crafted packet with a hint option, leading to an out-of-bounds read (KASAN: slab-out-of-bounds). The fix involves honoring the gs->gro_hint flag in the complete path as well.

In the Linux kernel, in the geneve subsystem, a vulnerability was fixed where geneve_gro_complete() did not validate the inner network offset, which could lead to an out-of-bounds read. The fix adds a check that the computed offset does not exceed the recorded inner network header.

In the Linux kernel's enetc driver, the number of BDs needed for xdp_frame is not checked. The xdp_redirect_arr array has size ENETC_MAX_SKB_FRAGS, but the number of fragments in xdp_frame can be greater or equal, leading to an out-of-bounds array access.

In the Linux kernel's SCTP protocol, when cookie authentication is disabled, the INIT after cookie unpacking is not re-verified. This could allow processing of tampered data. Added INIT verification after unpacking and chunk type check in cookie.

In the Linux kernel's fbnic driver, fbnic_tx_lso() calls skb_cow_head() which may reallocate the skb including shared info. The pointer calculated before the call becomes stale, leading to a use-after-free.

A use-after-free vulnerability was found in the Linux kernel's ksmbd (SMB server) module. The issue is a race between reading fp->owner.name during durable handle owner comparison and freeing it in the reopen path. An attacker could exploit this to gain unauthorized access or cause a system crash.

In the Linux kernel netfs module, netfs_create_write_req() skips caching if the fscache cookie is disabled, but this is problematic because async cache object creation might not have completed. The fix removes the cookie checks and delegates this to fscache_begin_write_operation().

In the Linux kernel, the netfs module has a barriering issue when walking the subrequest list during retry. There is a possibility of seeing a subrequest that was just added by the application thread.

In the Linux kernel, the GUE module has a vulnerability due to missing validation of the REMCSUM private option length. guehdr_priv_flags_len() returns 0 even when GUE_PFLAG_REMCSUM is set, allowing malformed packets to pass and read missing fields from subsequent bytes.

In the Linux kernel, the netfilter ip6tables module mishandles malformed IPv6 extension headers. For ah, hbh, and rt matches, the advertised header length checks are missing or outdated. The fix adds the missing check for ah and updates checks for hbh and rt, also setting hotdrop to true to drop malformed packets.

In the Linux kernel's qede driver, there is an off-by-one error in BD ring consumption when skb building fails. The functions qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a NULL return from qede_build_skb(), leading to excessive BD consumption and desynchronization of the BD ring, which can corrupt DMA page reference counts and cause SLUB freelist corruption.

In the Linux kernel's liquidio driver, there is an issue with caching VF pci_dev pointers without proper reference counting, potentially leading to use-after-free when handling FLR requests.

In the Linux kernel's IPv4 IGMP module, there is a race condition between device teardown and IGMP query processing, which can lead to use-after-free in igmp_gq_start_timer().

In the Linux kernel's IPv6 MLD module, there is a race condition between device teardown and MLD query processing, which can lead to use-after-free in the MLD delayed work.

In the Linux kernel, the netfilter nft_lookup module has a bug in catchall element handling with inverted lookups. The 'found' variable is not recomputed after 'ext' is replaced by the catchall lookup, which can lead to incorrect matching or skipping of the catchall element in negated queries.

In the Linux kernel, the IPVS module has an issue ensuring that inner headers in ICMP errors are in the skb headroom. After stripping outer headers with pskb_pull(), the inner IP headers may not be available for functions like ipv4_update_pmtu(), icmp_send(), and IP_VS_DBG(). Additional length checks for inner headers were added.

In the Linux kernel, the cifs module has a vulnerability due to lack of validation of string offsets in DFS responses. A malicious server can provide offsets pointing outside the response buffer, leading to out-of-bounds memory read during path name processing.

In the Linux kernel SUNRPC subsystem, a use-after-free vulnerability exists in the TLS connect path. Nothing pins the upper rpc_clnt across the delayed connect_worker, which can lead to dereferencing freed memory when a TLS connection fails (e.g., mTLS error).

In the Linux kernel TIPC subsystem, a vulnerability was found where the tracepoint in tipc_sk_enqueue() dumped the sk_receive_queue without proper locking, leading to a use-after-free condition reported by KASAN. The fix restricts the dump to the spinlock-protected backlog queue only.

In the Linux kernel, the ife_decode() function does not guarantee that the inner Ethernet header is accessible in the linear data area, which can lead to a crash with malformed IFE frames.

In the Linux kernel for KVM on s390, try_get_locked_pte() had an unlikely race that could occur if puds or pmds were unmapped between p?dp_get() and p?d_offset(). The fix eliminates this race.

In the Linux kernel for KVM on arm64, vgic_prune_ap_list() had an issue during interrupt migration to another vCPU. After reacquiring locks, it only checked affinity, not whether the interrupt still belonged to this vCPU. The fix adds a check irq->vcpu == vcpu before moving.

In the Linux kernel for KVM on arm64, vgic_prune_ap_list() had a race between interrupt affinity change and LPI disabling, which could lead to use-after-free (UAF). The fix takes a reference on the interrupt before dropping locks and does not attempt to migrate the pending bit.

In the Linux kernel, KVM arm64 (nested mode) mapping of L1 VNCR into host stage-1 did not respect read-only PFNs. The fix caches PFN writability and constrains mapping permissions, also fixing a page leak.

In the Linux kernel, KVM arm64 (nested mode) did not re-translate the VNCR address on a page fault. The fix invalidates the VNCR TLB entry and re-fetches the translation to allow write mapping on the second attempt.

In the Linux kernel, KVM arm64 (nested mode) unconditionally used cacheable memory attributes for L1 VNCR mappings, even if the underlying PFN is not memory. The fix rejects anything that isn't normal memory to avoid SError issues.

In the Linux kernel, the nf_nat_sip netfilter module has a vulnerability due to a stale data pointer after buffer reallocation. This can lead to packet header corruption.

In the Linux kernel, the netfilter flowtable module has a vulnerability due to using the route from the opposite direction when pushing the IPIP header. This can lead to incorrect headroom calculation and field settings.

In the Linux kernel, the netfilter flowtable module has a vulnerability that causes a crash during IPIP tunnel transmission with direct xmit. The lack of dst_entry leads to invalid dst usage and can trigger a crash.

In the Linux kernel x86/virt/sev subsystem, a previous fix regarding WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN was reverted. The call to wbinvd_on_all_cpus() before SNP_INIT_EX was restored to meet SNP specification requirements for clean cache lines.

In the Linux kernel's batman-adv module, after pskb_may_pull() is called by batadv_get_vid(), the skb buffer may be reallocated. The unicast_packet pointer was not reassigned after this reallocation, potentially leading to a use-after-free.

In the Linux kernel's batman-adv module, the number of VLANs in a TT unicast TVLV is of type u16 and is multiplied by the size of struct batadv_tvlv_tt_vlan_data (8 bytes). This can overflow the u16, invalidating all additional safety checks and potentially leading to an out-of-bounds read.

In the Linux kernel's SUNRPC subsystem, a use-after-free vulnerability exists in the asynchronous TLS handshake handling. The svc_xprt pointer is stored without taking a reference, leading to a race where the callback can write to freed memory. The issue affects NFS servers with TLS enabled when connection close overlaps with the tlshd downcall delivery window.

In the Linux kernel, a race condition in the sunrpc module during TLS handshake cancellation was fixed. When wait_for_completion_interruptible_timeout() returns timeout or signal and cancellation loses the race, the handshake callback may not have committed its side effects, leading to double invocation of the handshake or connection teardown despite successful handshake. The fix waits for the callback to commit before checking flags.

In the Linux kernel's sunrpc subsystem, svc_release_rqst() executes the callback in rqstp->rq_procinfo->pc_release. If a worker thread hits an early error path before a valid rq_procinfo is installed, a stale release hook can be re-triggered against reused state from the previous RPC, leading to double-free or use-after-free. The fix hardens the rq_procinfo lifecycle by clearing it after pc_release, at request entry in svc_process(), and in svc_process_bc().

In the Linux kernel's SUNRPC module, xdr_buf_to_bvec() writes to the caller's array before checking if the slot is in range, potentially causing an out-of-bounds write. The rq_bvec array passed by nfsd_vfs_write() is allocated without slack, so the OOB store can corrupt adjacent memory.

In the Linux kernel's ntfs module, there is an ordering issue when growing the index root value. The larger header is published before resizing the resident value, which can lead to a transient state considered corrupt if the resize fails.

In the Linux kernel's ntfs module, there is an off-by-one error in bounds checks during mapping pairs decompression. Strict greater-than comparisons allow a one-byte out-of-bounds read when data ends exactly at the boundary.

A vulnerability in the Linux kernel's NTFS filesystem was found where ntfs_attr_find() and ntfs_external_attr_find() do not properly validate length fields in variable-length resident attributes. A crafted disk image can trigger an out-of-bounds read (slab-out-of-bounds) during filename lookup operations.

In the Linux kernel, a bounds check was added before accessing EA entries in the NTFS filesystem. In ntfs_ea_lookup and ntfs_listxattr, it verifies that there is enough space in the EA entry before accessing the next_entry_offset field.

In the Linux kernel, the NTFS filesystem no longer converts zero-length $DATA attributes to non-resident. Previously, when a resident attribute could not be grown in place, other resident attributes were converted to non-resident, but now zero-length $DATA attributes are skipped because fsck treats such non-resident attributes as corruption.

In the Linux kernel, the NTFS filesystem now performs stricter validation of the index block header. The ntfs_index_block_inconsisent() function was modified to validate INDEX_HEADER geometry in INDX blocks more thoroughly, and ntfs_lookup_inode_by_name() uses this function to validate INDX blocks.

In the Linux kernel, the NTFS filesystem now validates index entries on reading. Index entries are validated immediately after reading an index root or index block from disk, eliminating repeated checks in lookup and readdir and reducing the risk of missing checks in those paths.

In the Linux kernel, the NTFS filesystem detects mapping-pairs LCN accumulator overflow. The parser accumulates relative LCN deltas in a signed integer, and a corrupted attribute can drive the addition past the representable range. An overflow check is added before storing the next run.

In the Linux kernel, the NTFS filesystem now validates resident $INDEX_ROOT values on lookup. Resident $INDEX_ROOT values carry index header fields that callers consume after lookup. Validation of the header fields is added before returning the attribute, requiring 8-byte alignment, a sane entries_offset, index_length within allocated_size, allocated_size within the resident value, and enough entry space for at least an index entry header.

In the Linux kernel's NTFS3 filesystem, the indx_find_buffer function had no recursion depth limit, potentially leading to kernel stack overflow. The fix adds a depth parameter and a check against the limit.

In the Linux kernel's NTFS3 filesystem, a vulnerability allows an out-of-bounds write when promoting a full resident $INDEX_ROOT to $INDEX_ALLOCATION. A crafted NTFS image can cause memcpy of attacker-controlled data past the allocated buffer, leading to heap corruption.

In the Linux kernel's NTFS3 filesystem, a vulnerability allows out-of-bounds write due to missing validation of the split-point offset in indx_insert_into_buffer. A crafted NTFS image causes an integer underflow and a near-4GiB memmove, corrupting memory and panicking the kernel.