Linux kernel vulnerabilities

A use-after-free (UAF) vulnerability was found in the Linux kernel's smc_cdc_rx_handler() function for the SMC-R protocol. The issue occurs because no socket reference is held after releasing the conns_lock, allowing a concurrent close() to free memory before sock_hold() is called.

In the NVMe/TCP subsystem of the Linux kernel, when a data digest mismatch occurs on a non-final H2C_DATA PDU, nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit() without marking the command as completed. This leads to a double call to nvmet_req_uninit() during queue teardown, resulting in a double free and potential use-after-free (UAF).

In the NVMe/TCP subsystem of the Linux kernel, in nvmet_tcp_try_recv_ddgst(), the call to nvmet_req_uninit() is unconditional. If the command arrived via the nvmet_tcp_handle_req_failure() path, the percpu_ref was never taken, leading to a refcount underflow and potential use-after-free.

A vulnerability in the Linux kernel involves the TC_ACT_CONSUMED case in the tcf_qevent_handle function in net/sched/cls_api.c. When tcf_classify() returns TC_ACT_CONSUMED, the skb is held by the defragmentation engine and must not be touched further. Missing handling leads to a use-after-free (UAF) in red_enqueue().

In the Linux kernel net/handshake mechanism, a long-lived file reference was missing during handshake request processing. Using sock_hold() did not protect the socket structure from being destroyed by the consumer, potentially leading to use-after-free.

In the Linux kernel, the tcp_ao_destroy_sock function removed the call_rcu() call, breaking RCU synchronization. During connection setup (TCP_SYN_SENT), the socket is visible to other CPUs, which may read the ao_info pointer just before it is freed, leading to a use-after-free vulnerability.

In the Linux kernel, a vulnerability in the TIPC broadcast mechanism allows an out-of-bounds read. The tipc_get_gap_ack_blks() function fails to verify that the Gap ACK block record fits within the message data area, enabling an attacker to trigger a kmemdup() read beyond the allocated skb buffer.

In the Linux kernel's crypto: krb5 module, a use-after-free occurs when using async AEAD implementations. Cryptographic functions set a NULL callback and treat any negative return as an error, freeing the buffer. When the implementation is async, it returns -EINPROGRESS and the buffer is freed while the backend still uses it.

In the Linux kernel netfilter flowtable subsystem, hardware offload for IPIP tunnels is not yet supported. Despite this, offload attempts are queued to a worker and then ignored, causing unnecessary overhead. The patch adds early checking and bail-out for IPIP tunnel offload.

In the Linux kernel ksmbd SMB server, the FSCTL_DUPLICATE_EXTENTS_TO_FILE function lacks write permission checks at the share and handle levels, allowing a client to overwrite destination file data even on a read-only share or with a FILE_WRITE_ATTRIBUTES handle.

In the Linux kernel, the ksmbd filesystem has a concurrency issue with directory queries. Concurrent QUERY_DIRECTORY requests for the same file handle can overwrite a stack pointer, leading to a use-after-free.

In the Linux kernel, the ksmbd filesystem runs SET_INFO operations with the current ksmbd worker credentials instead of the credentials of the user who opened the handle. This can bypass owner-based and LSM access controls.

In the Linux kernel, the ksmbd filesystem runs the delete-on-close operation with the ksmbd worker credentials instead of the credentials of the user who opened the handle. This can bypass filesystem permission checks.

In the Linux kernel, the ksmbd filesystem runs alternate data stream (ADS) I/O operations with the current task credentials instead of the credentials of the user who opened the SMB handle. This can bypass inode permission and LSM checks.

In the Linux kernel, SMB client has a double-free vulnerability in query directory replay. A response-bearing attempt can free its buffer, and if SMB2_query_directory_init() fails before the next send, cleanup frees the same buffer again. The fix resets response bookkeeping before each attempt.

In the Linux kernel, SMB client has a double-free vulnerability in query_info() replay. A response-bearing attempt can free its buffer, and if SMB2_query_info_init() fails before the next send, cleanup frees the same buffer again. The fix resets response bookkeeping before each attempt.

In the Linux kernel, SMB client has a double-free vulnerability in SMB2_ioctl() replay. A response-bearing attempt can free its buffer, and if SMB2_ioctl_init() fails before the next send, cleanup frees the same buffer again. The fix resets response bookkeeping before each attempt.

In the Linux kernel, SMB client has a double-free vulnerability in change notify replay. A response-bearing attempt can free its buffer, and if SMB2_notify_init() fails before the next send, cleanup frees the same buffer again. The fix resets response bookkeeping before each attempt.

In the Linux kernel, SMB client has a double-free vulnerability in SMB2_flush() replay. SMB2_flush() keeps response buffer bookkeeping across replay attempts. If a replayable flush response is received and the retry fails before storing a new response, flush_exit frees the stale pointer again. The fix reinitializes resp_buftype and rsp_iov at the top of the replay loop.

In the Linux kernel, a problem was found in the devmap broadcast redirect for BPF with fragmented XDP frames. Cloning such frames leaves the XDP_FLAGS_HAS_FRAGS flag set without valid fragment metadata, leading to out-of-bounds access during frame release. The fix rejects fragmented frames in dev_map_enqueue_clone and dev_map_redirect_clone.

A vulnerability in the Linux kernel's nvmet_execute_disc_get_log_page() function allows an unauthenticated attacker to perform an out-of-bounds heap read when processing a Discovery Get Log Page request. Missing validation of offset and data length can lead to kernel memory leak or system panic.

In the Linux kernel, the NVMe over Fabrics (nvmet-auth) subsystem has a vulnerability due to missing bounds validation of hl and dhvlen fields in the DHCHAP_REPLY message. An attacker can send a crafted message with a small transfer length but large hl/dhvlen values, leading to out-of-bounds heap read.

In the Linux kernel's fsl-lpspi SPI driver, a bug was fixed where the RX channel was not terminated when DMA preparation for the TX channel failed. This could lead to memory corruption or a use-after-free bug, as DMA continued writing to buffers that had already been unmapped.

In the Linux kernel RDMA/rtrs-srv component, a vulnerability was found where the RDMA-Write length was not bounded to the chunk size. A malicious client can send a crafted READ request with an inflated descriptor length, causing memory read beyond the mapped chunk region.

In the Linux kernel, the RDMA/siw driver lacks validation of Read Response segment lengths against the sink buffer size. A remote peer can send oversized segments, causing an out-of-bounds write in kernel memory.

In the Linux kernel SMB (CIFS) client, a vulnerability exists where responses with overlapping data areas are rejected. The __smb2_calc_size() function clears data_length, which can make an invalid response appear valid.

A vulnerability was found in the Linux kernel's blk_insert_cloned_request() function, which did not recompute the nr_integrity_segments for cloned requests. This can trigger a BUG_ON() during segment mapping when the bottom queue has stricter segmentation settings than the top queue.

In the Linux kernel's netfs subsystem, a use-after-free vulnerability was found in netfs_unlock_abandoned_read_pages(). The function accesses the folio index after clearing the NETFS_RREQ_IN_PROGRESS flag, potentially leading to dereference of freed memory.

In the Linux kernel, the idpf driver has a bug in idpf_ptp_init() where the read_dev_clk_lock spinlock is initialized after the PTP auxiliary worker is scheduled, which can immediately try to acquire the lock, causing a lockdep warning about registering a non-static key.

In the Linux kernel, a vulnerability was found in the netfs mechanism, involving potential tearing when reading and writing the ->remote_i_size and ->zero_point fields. The issue stems from insufficient synchronization, which could lead to data corruption.

In the Linux kernel, a bug was found in the netfilter nft_inner module's error path where local_bh_enable() is called before local_unlock_nested_bh(), potentially causing incorrect lock state and synchronization issues.

In the Linux kernel's ksmbd (SMB3) subsystem, two related vulnerabilities were found: reuse of the fp->node list head causing list corruption and a reference count race leading to use-after-free (UAF) during durable handle cleanup by ksmbd_durable_scavenger().

In the Linux kernel, a missing lock around the tc_count increment in smb2_find_smb_sess_tcon_unlocked() was found. This issue arose after a refactoring of CIFS code that changed locking from cifs_tcp_ses_lock to tc_lock but did not cover this specific location.

A vulnerability was found in the Linux kernel's IOAM implementation for IPv6. The ipv6_hop_ioam() function fails to refresh the hdr pointer after a potential data buffer reallocation by skb_ensure_writable(), leading to a Use-After-Free condition.

In the bcmgenet driver for Broadcom chips, a vulnerability causes RX traffic to stall after EEE activation. Setting RBUF_EEE_EN and RBUF_PM_EN bits in RBUF_ENERGY_CTRL prevents RBUF from forwarding frames to DMA, stopping rx_packets increment and potentially causing a paging fault. Reproduced on Pi 4B and Broadcom 4908-family boards.

In the Linux kernel, a use-after-free vulnerability was found in the mlx5e driver in the mlx5e_tx_reporter_timeout_recover function. The issue occurs when the function accesses sq->netdev after mlx5e_safe_reopen_channels() has torn down and freed the channel (and its SQs). The fix replaces three sq->netdev references with priv->netdev, which is safe because priv outlives channel teardown.

In the Linux kernel's ixgbevf driver, a use-after-free vulnerability was found in ixgbevf_clean_rx_irq(). During VEPA multicast source pruning, after freeing the skb buffer, the pointer is not nullified, leading to a dereference of freed memory in the next loop iteration.

In the Linux kernel's KVM for ARM64, a vulnerability was found in the emulated ITS (Interrupt Translation Service) controller. The function restoring Device Table Entries (DTE) did not validate the number of EventID bits, allowing restoration of an out-of-range value larger than supported by the virtual ITS.

In the Linux kernel, the RDMA/siw (Soft-iWARP) driver lacks validation of the MPA header length in received FPDU frames. A malicious remote peer can send a frame with an mpa_len smaller than the required DDP/RDMAP header, causing a signed integer underflow and leading to a use-after-free memory read.

A TOCTOU (time-of-check time-of-use) vulnerability was found in the Linux kernel's batman-adv implementation. During local TT-based TVLV generation, the VLAN count is checked first, then a buffer is allocated. Despite holding a lock, the number of TT entries per VLAN can increase between check and allocation, causing a buffer overflow.

In the Linux kernel, the batman-adv module has a vulnerability where the last_changeset_len field is declared as signed short (s16) but never intended to hold negative values. Assigning a value greater than 32767 wraps it to a negative signed integer, causing incorrect sign extension when widened to s32 in batadv_send_my_tt_response(). This results in allocating a full-sized buffer but populating only a small portion, leaving the rest uninitialized.

In the Linux kernel, a use-after-free vulnerability was found in the ARM FFA firmware driver's notification handling. Notification handlers look up a callback pointer under a lock but invoke it after dropping the lock, allowing a concurrent unregister to delete and free the memory.

A vulnerability was found in the Linux kernel's netfs filesystem, related to cancellation of DIO and single read requests. The bug occurs when preparation of a new read subrequest fails and the subrequest has already been added to the list, leading to improper reference management and potential race conditions.

In the Linux kernel, missing locking was found when adding new subrequests in retry functions for read and write operations in the netfs filesystem. This vulnerability could lead to data races and system instability.

In the Linux kernel's netfs subsystem, missing memory barriers were found when accessing the stream->subrequests list without locks. Reader functions may see incomplete data because the NETFS_SREQ_IN_PROGRESS flag might not be visible yet. The fix adds proper release/acquire barriers to list operations.

A vulnerability was found in the Linux kernel's netfs_read_to_pagecache() function, which fails to pause the generation of new subrequests after a subrequest failure. The fix adds a pause in subrequest generation upon error.

A use-after-free vulnerability was found in the Linux kernel's netfs subsystem in netfs_read_gaps(), where a sink folio was released prematurely. This can lead to memory corruption and potential exploitation.

In the Linux kernel, a vulnerability was found in the cortina (Gemini Ethernet) network driver. A static local SKB buffer used for reassembling packets from fragments in gmac_rx() is shared between two Ethernet ports, potentially causing race conditions when both ports are used simultaneously.

In the Linux kernel, a vulnerability was found in the Cortina Ethernet driver where the fragment counter (frag_nr) is reset during packet reception in the gmac_rx() function. When the ring buffer is completely emptied during a poll cycle, the fragment counter is reset even though the packet is not yet fully assembled in the SKB, potentially causing incorrect packet reassembly.

In the Linux kernel, a vulnerability was found in the TLS implementation due to an off-by-one error when chaining wrapped sk_msg rings using sg_chain(). The chain pointer is placed at MAX_SKB_FRAGS instead of the last entry, potentially causing incorrect cryptographic operations.