Linux kernel vulnerabilities

In the Linux kernel's NTFS filesystem, ntfs_lookup_inode_by_name() returns MFT references read from directory index entries on disk, which are untrusted. The function can return an error-marked MFT reference without validation, causing callers to misinterpret the result. The fix normalizes all such references to ERR_MREF(-EIO) across all four return paths.

In the Linux kernel's NTFS filesystem, system files such as $Bitmap can be written from userspace, leading to volume corruption and writeback deadlock. The fix marks base metadata files as immutable during inode read so the VFS rejects write, mmap, truncate, and unlink with -EPERM.

In the Linux kernel's NTFS filesystem, ntfs_map_runlist_nolock() can encounter a resident attribute where a non-resident one is expected, previously triggering only a WARN_ON and leading to reading the wrong union member. The fix replaces the WARN_ON with an -EIO error return, causing crafted images to be rejected during mount.

A vulnerability was found in the Linux kernel's tcp_connect() function related to TCP and MD5 authentication. In one code branch, the tcp_md5sig_info structure and tcp_md5sig_key entries are freed without respecting the RCU grace period, causing a race condition with softirq readers. This leads to a use-after-free of MD5 key memory.

In the Linux kernel, the xfrm module has a double-free issue in nat_keepalive_send(). When the IPv4 or IPv6 helper reports an error, the keepalive packet is freed, but if the packet has already been handed to the network stack, it may be freed again, leading to unsafe operation.

In the Linux kernel, the nvmet-auth module has a heap out-of-bounds write vulnerability in nvmet_execute_auth_receive(). The function trusts the AUTH_RECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In SUCCESS1 and FAILURE1 states, a short buffer can lead to writing past the allocated memory.

In the Linux kernel, the nvmet-rdma module has an issue with handling inline data with a nonzero offset. The function nvmet_rdma_use_inline_sg() maps the host-controlled offset but assumes the data begins in the first inline page. For offsets larger than the page size, a length underflow can occur, leading to out-of-bounds reads.

In the Linux kernel, the dm-verity module has a buffer overflow in FEC calculation. The bug allows writing beyond the bounds of the lambda array in the RS decoder, which can corrupt the syndrome buffer. The fix addresses this overflow.

In the Linux kernel scsi: xen: scsiback driver, on error paths before command submission, there is a double-put of se_cmd with refcount 0, leading to refcount underflow and tag leak. The fix adds a helper that just returns the tag and sends the error response.

A vulnerability in the Linux kernel SCSI target subsystem affects parsing of PERSISTENT RESERVE OUT buffers. The TransportID parser was not given the buffer length, allowing out-of-bounds reads via a malformed iSCSI identifier. It is reachable through any fabric delivering PR OUT to an iSCSI TPG, including vhost-scsi.

A use-after-free vulnerability was found in the Linux kernel's SCSI target subsystem, affecting the REGISTER AND MOVE operation in Persistent Reserve Out. The issue arises from using a pointer to a mapped buffer after it has been unmapped, potentially leading to reads from freed memory.

In the Linux kernel, the RT locking mechanism has a use-after-free vulnerability due to incorrect RCU protection in rt_spin_unlock(). The function releases RCU protection before unlocking, enabling a race condition that leads to use of freed memory.

In the Linux kernel, the net: mana driver lacks validation of the packet length reported by the NIC in the RX CQE. The length is passed to skb processing without verification, which can lead to errors.

In the Linux kernel, the net: mana driver lacks DMA synchronization for page pool RX fragments in the receive path. When RX buffers are allocated from page pool fragments, they are not synced for CPU before being passed to the network stack, which can cause issues in configurations requiring explicit DMA sync.

A vulnerability in the Linux kernel's GVE (Google Virtual Ethernet) driver causes header buffer corruption when header-split and HW-GRO are enabled. The issue stems from incorrect indexing of header buffers by queue position instead of buffer ID, leading to wrong header reads and reuse of buffers still owned by the device when completions arrive out of order.

In the Linux kernel ESPINTCP subsystem, a vulnerability exists related to partial sends. Using sk_msg_free_partial() ensures skmsg consistency in each iteration, simplifying code and fixing bugs in skmsg accounting when not sending the full contents.

In the Linux kernel orangefs filesystem, a vulnerability exists where the directory entry size is stored in a 32-bit variable, which can wrap and bypass bounds checks, leading to out-of-bounds read and kernel panic.

In the Linux kernel, in the ip_vs_conn_new() function, the full ip_vs_seq structures are not reset, which can lead to use of uninitialized data from slab. The fix resets both struct ip_vs_seq members before publishing the connection to prevent TCP flow corruption.

In the Linux kernel's DRBD module, there is a vulnerability due to not rejecting data replies with an out-of-range payload size. A malicious or man-in-the-middle DRBD peer can send a reply with a negative size, leading to copying data beyond a bio page and corrupting kernel memory.

In the Linux kernel's IPVS, there are errors in calculating IPv6 transport offsets. The TCP app code assumed an IPv4 network header, which can cause issues with apps over IPv6. The ICMPV6 header offset was also corrected.

In the Linux kernel's IPVS, after calling skb_ensure_writable(), which may reallocate skb->head, the IP header pointer was not reloaded, potentially leading to use of a stale pointer.

In the Linux kernel ksmbd (SMB) server, FSCTL operations such as SET_SPARSE, SET_ZERO_DATA, and SET_COMPRESSION operate on an open SMB handle but call VFS helpers with the current ksmbd worker credentials. This can lead to revalidation of inode permissions, ownership, and LSM policy independently of the SMB handle access mask. The fix runs each operation with the credentials captured in the target file when the handle was opened.

In the Linux kernel's ksmbd server, there is a missing validation of the minimum PDU size for transform requests. A packet with SMB2_TRANSFORM_PROTO_NUM bypasses the check, potentially leading to out-of-bounds read and disclosure of data to an unauthenticated client.

In the Linux kernel, the xfrm subsystem has a vulnerability where skb->prev becomes stale after async crypto steals a GSO segment. If the last segment is stolen, the head's ->prev pointer is not updated, leading to a write through a dangling pointer (use-after-free) in validate_xmit_skb_list(). The fix repoints skb->prev at the last retained segment before returning.

In the Linux kernel, the SMB client has a vulnerability in the fallocate function that can skip holes when the server returns an allocated range starting before the current offset. This can cause later writes to the skipped area to fail with ENOSPC.

In the Linux kernel on s390 architecture, there is a vulnerability in csum_partial() that on machines without vector facility calculates the checksum from address zero instead of the source buffer. This results in incorrect checksums.

In the Linux kernel, the SMB server (ksmbd) has a use-after-free vulnerability during asynchronous oplock break notification. The pointer to the ksmbd_conn structure is stored in an async work without proper reference counting, which can lead to access to freed memory.

In the Linux kernel, the SMB client's parse_dfs_referrals() did not validate the PathConsumed value in DFS responses. A malicious response with an oversized PathConsumed can cause subsequent DFS path parsing to advance beyond the end of the path.

In the Linux kernel, the AMT (Automatic Multicast Tunneling) module has a use-after-free vulnerability. Several packet receive and transmit paths cache a pointer to the skb header and then call functions that can reallocate the head, leaving the pointer dangling. An attacker could exploit this to escalate privileges or leak information.

In the Linux kernel SCTP subsystem, sctp_auth_chunk_verify() returns true unconditionally when chunk->auth_chunk is NULL, bypassing authentication verification. The fix checks sctp_auth_recv_cid() in such cases and drops the chunk if authentication is required.

In the Linux kernel, a vulnerability was found in the MPTCP implementation, involving a stale skb->sk pointer to a closing subflow. The backlog cleanup was performed without proper synchronization, which could lead to a use-after-free condition.

In the Linux kernel, SCTP UDP tunnel sockets were not closed during network namespace teardown, potentially leading to races and improper state. The fix closes these sockets in sctp_ctrlsock_exit() after unregistering the sysctl table.

In the Linux kernel, a pre-auth out-of-bounds read vulnerability was found in ceph_handle_caps(). An attacker or compromised MDS can set snaptrace_len to 0xFFFFFFFF, leading to reads beyond the message buffer and further out-of-bounds reads.

In the Linux kernel's libceph module, the length of pg_temp, pg_upmap, and pg_upmap_items lists was not bounded to CEPH_PG_MAX_SIZE, potentially leading to a stack out-of-bounds write. The fix rejects entries longer than 32 during decoding.

In the Linux kernel's libceph module, a multiplication overflow during osdmap decoding can lead to incorrect bounds checking and out-of-bounds reads. The fix uses check_mul_overflow() to detect overflow and reject corrupted messages.

In the Linux kernel's libceph module, after an authorizer update, the auth->authorizer_buf may point to freed memory, leading to a use-after-free. The fix refreshes these pointers after a successful authorizer rebuild.

In the Linux kernel's libceph module, CRUSH bucket type 0 was accepted, potentially leading to indexing the OSD weight array with a negative value. The fix rejects such types during CRUSH map decoding.

In the Linux kernel's phonet module (PEP subsystem), the function pep_get_sb() does not consider that pskb_may_pull() might have relocated the skb data, and continues to access the older pointer, leading to a use-after-free. The issue was confirmed by KASAN.

In the Linux kernel's net/x25 subsystem, there is a use-after-free vulnerability in x25_kill_by_neigh(). The function walks the global X.25 socket list but does not pin the socket's lifetime after dropping the list lock. A concurrent close can free the socket, and the function then uses the freed object. The fix takes a reference with sock_hold() and rechecks the connection.

A vulnerability in the Linux kernel's GRO (Generic Receive Offload) mechanism allows re-aggregation of packets marked with the flush flag. The lack of validation in skb_gro_receive_list() leads to corruption of the frag_list chain, potentially causing a kernel panic during packet transmission.

In the Linux kernel ILA module, after calling pskb_may_pull(), the IPv6 header pointer may become stale, leading to use-after-free. The fix reloads the pointer after each pskb_may_pull().

A vulnerability in the Linux kernel's MCTP serial driver allows zero-length frames to bypass validation and cause out-of-bounds writes. An attacker with CAP_NET_ADMIN can trigger a buffer overflow via the tty receive path.

In the Linux kernel openvswitch module, during GSO segmentation for userspace actions, a length underflow can occur, leading to incorrect skb_zerocopy() behavior. The fix stores the maximum preserved length and bounds consumers.

In the Linux kernel, the tipc_sk_create() function fails to clear sock->sk on the failed-insert path, leading to a use-after-free in the accept() path. The issue occurs when the socket hash table reaches its maximum size (about 2 million sockets per network namespace).

In the Linux kernel, the ksmbd (SMB) server has a vulnerability in path resolution in ksmbd_vfs_kern_path_create. An attacker can use '..' components to escape the shared resource, leading to privilege escalation or unauthorized access.

In the Linux kernel, the decode_lockers() function in libceph contains two unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads. Missing bounds checks before reading the locker count and lock type can lead to unauthorized memory reads. The vulnerability is fixed by replacing the unsafe operations with safe variants that include bounds checking.

In the Linux kernel, the SMB client has a double-free vulnerability in SMB2_close() during replay. If a response-bearing attempt returns a replayable error and frees its response buffer, and then SMB2_close_init() fails before the next send, the buffer is freed again.

In the Linux kernel, xfrm iptfs fails to propagate the SKBFL_SHARED_FRAG flag when copying fragments in iptfs_skb_add_frags(). If the source SKB has shared fragments, the new inner SKB may be incorrectly treated as having private fragments, leading to writes to memory still referenced by the outer SKB. The fix sets the flag in the loop after each fragment addition.

In the Linux kernel, a use-after-free vulnerability exists in SCTP's ASCONF processing. An attacker can send a crafted ASCONF packet that frees the transport used for processing, then leverages the dangling pointer, leading to memory corruption and potential code execution.

In the Linux kernel, SCTP's handling of STALE_COOKIE error in COOKIE_ECHOED state reads the staleness field from the first error cause instead of the STALE_COOKIE cause, leading to out-of-bounds read and uninitialized memory leak.