Linux kernel vulnerabilities

A use-after-free vulnerability was found in the Linux kernel's IP fragment reassembly mechanism. During network namespace teardown, fqdir_pre_exit() flushes fragment queues but does not reset q->fragments_tail and q->last_run_head pointers, which still point to freed skbs. A fragment that obtained the queue before the flush may later dereference the freed memory, leading to a security breach.

In the Linux kernel's AF_RXRPC subsystem, a vulnerability was found in the ACK parser due to improper access to the SACK buffer in received UDP packets. The rxrpc_input_soft_acks() function modifies the skbuff and may incorrectly read data in case of packet fragmentation, potentially leading to parsing errors.

A vulnerability was found in the Linux kernel's netfilter subsystem where functions like `ip6t_eui64`, `xt_mac`, ipset types (`bitmap:ip,mac`, `hash:ip,mac`, `hash:mac`), and `nf_log_syslog` accessed the Ethernet header (`eth_hdr(skb)`) without first verifying that the skb is associated with an Ethernet device, that the MAC header is set, and that it spans at least a full Ethernet header. Missing these checks could lead to errors or potential security issues.

Vulnerability in the Linux kernel in the bcmgenet driver (Broadcom GENET Ethernet) due to an off-by-one error in bcmgenet_put_txcb. Incorrect pointer rewind may lead to improper cleanup of the transmit buffer.

In the Linux kernel, the bcmgenet driver has a flawed timeout handler: it stops all transmit queues when a single queue times out, causing race conditions with queues that are still functioning. The fix restarts only the timed-out queue.

In the Linux kernel's hisilicon/sec2 driver, a use-after-free vulnerability was found during packet transmission. Under heavy system load, hardware may complete packet processing and free the request memory (req) before the transmission function finishes, causing an error.

In the Linux kernel, the GFS2 filesystem lacked proper log locking in the gfs2_logd() function. Log flushing functions (gfs2_ail1_start(), gfs2_ail1_wait(), gfs2_ail1_empty()) were called without holding the sd_log_flush_lock, potentially causing race conditions with concurrent transactions. A new __gfs2_log_flush() function and proper locking were added to gfs2_logd().

In the Linux kernel, a use-after-free vulnerability was found in the ksmbd module related to the Qualcomm Crypto Engine (QCE). The ksmbd_crypt_message() function does not properly handle the -EINPROGRESS return code from async hardware, leading to premature DMA request freeing and freed memory dereference in the callback.

In the Linux kernel, the memory driver for Tegra124 (tegra124-emc) had a reversed check for DLL enable in the EMRS register. DLL is enabled when bit A0 is low, but the code checked the opposite.

In the Linux kernel's OCFS2 filesystem and its DLM (Distributed Lock Manager) component, a vulnerability was found due to missing validation of the `qr_numregions` field in the `dlm_match_regions()` function. An attacker can send a crafted DLM_QUERY_REGION network message with an inflated `qr_numregions` value, causing an out-of-bounds read beyond the `qr_regions` buffer.

In the Linux kernel, a use-after-free vulnerability was found in the ksmbd module's smb2_open function during durable reconnect. Premature release of the file descriptor reference leads to use of freed memory when accessing file properties upon error or scavenger access.

A vulnerability was found in the Linux kernel's icmpv6_rcv() function for IPv6. Caching source and destination addresses before calling pskb_pull() can lead to a use-after-free (UAF) because pskb_pull() may change the skb->head pointer.

In the Linux kernel netfilter/conntrack subsystem, a stack buffer overflow was found in the mangle_content_len() function. The fix replaces sprintf() with scnprintf() and increases the buffer size.

In the Linux kernel, a vulnerability in the netfilter nfnetlink_osf module causes an out-of-bounds read during TCP option matching. The bug occurs because the shared ctx->optp pointer is not restored after early return in nf_osf_match_one(), leading to garbage data reads and incorrect logging when NF_OSF_LOGLEVEL_ALL is enabled.

In the Linux kernel, a double-free vulnerability in tipc_buf_append() due to tipc_msg_validate() reallocating the buffer. This can lead to memory corruption and potentially privilege escalation.

In the Linux kernel's NVMe-over-TCP driver, a vulnerability was found where nvmet_tcp_build_pdu_iovec() fails to propagate errors (e.g., out-of-bounds PDU length) to its callers. Consequently, callers like nvmet_tcp_handle_h2c_data_pdu() proceed with an uninitialized message iterator, potentially reading network data into an invalid buffer.

In the Linux kernel, unsafe use of simple_strtoul in nf_conntrack_sip was replaced with a new port validation function. The fix prevents out-of-bounds memory access and rejects malformed or overly long port numbers.

A use-after-free vulnerability was discovered in the Linux kernel's rtl8150 driver for USB Ethernet devices. The issue occurs when rtl8150_start_xmit() reads skb->len after usb_submit_urb() is called, while the skb buffer has already been freed by the USB completion handler. This can lead to memory corruption and potential privilege escalation.

In the Linux kernel, a potential out-of-bounds access vulnerability was found in the osdmap_decode() function of the libceph library. The ceph_decode_need() check did not account for the correct number of elements, which could lead to reading beyond the allocated buffer when processing a crafted OSD map message.

In the Linux kernel, the crush_decode() function in libceph is vulnerable to an out-of-bounds access when two fields specifying the bucket algorithm in a CRUSH map differ. This can lead to memory corruption and potential exploitation.

In the Linux kernel, the batman-adv tp_meter module has a vulnerability where uninitialized sender-specific variables are used in batadv_tp_recv_ack() and batadv_tp_stop() when called on a receiver role. A malicious ACK packet can trigger undefined behavior.

A use-after-free vulnerability was found in the Linux kernel's SCTP implementation. When handling a Stale Cookie error (transition from COOKIE_ECHOED to COOKIE_WAIT), the outqueue is not purged, leaving stale scheduler pointers. An attacker can trigger a kernel crash by sending a crafted SCTP packet.

In the Linux kernel, the batman-adv module has a vulnerability due to incorrect payload length accounting during fragment reassembly. This flaw allows malformed fragment chains to bypass validation, potentially causing a local denial of service.

In the Linux kernel, the RDMA/rxe driver has a vulnerability due to incorrect iova-to-va conversion for memory regions (MR) with page sizes different from PAGE_SIZE. This bug causes wrong pointer calculations during memory access, potentially leading to a kernel panic.

In the Linux kernel, KVM/arm64 vgic-its has a bug in vgic_its_invalidate_cache() that can drop the same reference multiple times during concurrent cache invalidation, leading to use-after-free.

In the Linux kernel, a bug in the extract_kvec_to_sg function within the scatterlist library causes incorrect length calculations when extracting data from a kvec to a scatterlist. This can result in an sglist entry exceeding the page size, which is unintended. The vulnerability was introduced in kernel v6.3 and affects v6.5+.

In the Linux kernel, a vulnerability in RAW sockets using IPPROTO_RAW allows malicious ICMP packets to set the protocol field to 255 and match such a socket, leading to FNHE cache changes.

In the Linux kernel netfilter nft_inner module, there is a desynchronization between the transport offset and layer 4 protocol for inner IPv6 packets. The bug overwrites the correct offset calculated by ipv6_find_hdr() with a constant 40 bytes, enabling transport header forgery and potential firewall bypass. This affects stable kernel versions from 6.2.

In the Linux kernel's CIFS/SMB subsystem, a vulnerability was found due to missing validation of the DACL offset (dacloffset) before constructing DACL pointers. A malicious server can supply a dacloffset near U32_MAX, causing pointer wrapping on 32-bit builds and bypassing bounds checks, potentially leading to out-of-bounds memory access.

A vulnerability has been identified in the Linux kernel affecting the symlink_data() function. The issue arises from a lack of length validation for the symlink error response, which may lead to out-of-bounds reads.

A vulnerability has been identified in the Linux kernel that allows for out-of-bounds read in the smb2_compound_op() function. The issue occurs when a server sends a truncated response with a large OutputBufferLength, potentially leading to kernel memory leakage.

A vulnerability in the Linux kernel related to mptcp has been resolved, concerning the mptcp_pm_add_timer() function executed as a timer callback in softirq context. To avoid data races, the socket lock needs to be held with bh_lock_sock().

A race condition was found in the Linux kernel's NVMe/TCP driver (nvmet-tcp) between ICReq handling and queue teardown. Lack of synchronization allows overwriting the queue state, leading to a double kref_put and potential memory corruption.

A vulnerability in the Linux kernel related to out-of-bounds memory access in authentication message processing has been fixed. The issue occurred when a CEPH_MSG_AUTH_REPLY message contained a positive value in its result field, leading to improper processing and sending data beyond the allocated buffer.

A vulnerability has been identified in the Linux kernel within the biovec_phys_mergeable() function, which does not check if bvec segments belong to different dev_pagemaps. This can lead to memory management errors when segments are physically contiguous.

A vulnerability has been identified in the Linux kernel within the rxe_rcv function, which improperly validates the packet length before calculating the payload size. An attacker could exploit this to trigger an underflow error, potentially leading to security issues.

In the Linux kernel, a potential integer overflow in the rxgk_extract_token() function when checking the length of the ticket has been fixed. Instead of rounding up the value to be tested, the size of the available data is rounded down.

A vulnerability related to the re-decryption of RESPONSE packets has been fixed in the Linux kernel. If a RESPONSE packet encounters a temporary failure during processing, it may end up in a partially decrypted state and be requeued for retry.

A vulnerability was found in the Linux kernel's smb2_open_file() function in the SMB client. Failure to zero out @err_iov and @err_buftype pointers before retrying SMB2_open() can lead to a use-after-free (UAF) or double free when @data is not NULL.

In the Linux kernel RDMA/iwcm subsystem, a vulnerability causes workqueue list corruption. The issue stems from the incorrect assumption that queue_work() would not enqueue work if already pending, while each iwcm_work object has a unique work_struct. This allows multiple entries to be processed in a single handler run, freed to the free list, and reused, leading to list corruption.

An attacker sending TCP, IL, RUDP, or GRE packets with a length less than the header size can trigger a kernel panic.

In the Linux kernel, a vulnerability exists in handling the IPv6 Source Routing Header (SRH). During decompression and recompression of SRH, if the recompressed header is larger than the received one, an out-of-bounds write can occur in ipv6_rthdr_rcv. The issue arises when headroom is insufficient, leading to memory corruption.

In the Linux kernel, a vulnerability was found in the RxRPC protocol implementation where DATA and RESPONSE packet handlers did not check for shared page fragments (e.g., from splice()). This allowed in-place decryption on shared pages, potentially leading to data integrity issues.

In the Linux kernel, a double free of the fcport structure was found in the qla2xxx SCSI driver. The function qla2x00_els_dcmd_sp_free() frees fcport, and a subsequent kref_put() call triggers a second free, potentially causing memory corruption.

A vulnerability has been identified in the Linux kernel related to improper management of kthread exit paths, leading to a use-after-free issue. The problem was reported during KUnit testing, where crashes occurred due to corrupted RCU callback function pointers.

A vulnerability in the Linux kernel related to MAC comparison in the tcp-md5 protocol has been fixed to prevent timing attacks.

A vulnerability has been identified in the Linux kernel affecting the smb_lazy_parent_lease_break_close() function. The opinfo pointer is accessed after the RCU read unlock, leading to race conditions and potential use-after-free.

A vulnerability has been identified in the Linux kernel that allows for a buffer overflow in the ioam6_fill_trace_data() function. The issue arises from improper storage of the schema length, leading to a bypass of the remaining space check in the trace buffer.

A vulnerability was found in the Linux kernel's ESP (Encapsulating Security Payload) implementation for IPv4/IPv6. The UDP datagram append paths did not mark shared pipe pages with the SKBFL_SHARED_FRAG flag, allowing in-place decryption without making a private copy. An attacker could exploit this to read or modify ESP data in UDP packets originating from shared pages.

A vulnerability has been identified in the Linux kernel that has been resolved. The issue concerns passing flow_id to the set_rps_cpu() function, which may lead to out-of-bounds access and system crashes.