Linux kernel vulnerabilities

In the Linux kernel's ceph module, a potential use-after-free bug exists when trimming caps. After releasing 'session->s_cap_lock', another thread may remove the cap, and using stale memory in callbacks causes a crash. The fix checks cap existence after acquiring 'ci->i_ceph_lock'.

In the Linux kernel, the veth interface has a race condition related to the xdp_no_direct section. After NAPI completion, another CPU may start a new NAPI instance, leading to concurrent access to the BPF context and a potential race.

In the Linux kernel's atlantic driver for Aquantia network cards, a vulnerability exists due to missing fragment count validation in the RX path. Packets with more than 17 fragments cause an out-of-bounds write in skb_add_rx_frag_netmem(), leading to a kernel panic.

In the Linux kernel's libceph, a use-after-free vulnerability was found in have_mon_and_osd_map(). Lack of locking when accessing monmap and osdmap can cause dereference of freed memory, as shown by KASAN errors.

In the Linux kernel's libceph library, the handle_auth_session_key() function lacks validation of the length field from network packets. The len field originates from untrusted packets, potentially leading to out-of-bounds writes when decrypting the connection secret or processing service tickets.

In the Linux kernel's USB network driver qmi_wwan, the qmimux_rx_fixup function does not initialize the MAC header offset for raw IP packets. This leaves skb->mac_header uninitialized, potentially causing a kernel panic on ARM64 when subsystems like xfrm access the offset.

In the mlx5e driver (Linux kernel), a bug was found in XDP buffer handling for striding RQ. XDP programs can change the xdp_buff layout, but the driver assumed it was unchanged, leading to erroneous skb generation or a kernel warning.

In the Linux kernel's nvmet-fc module, a double scheduling of association deletion was found. When forcefully shutting down a port via configfs, both nvmet_port_del_ctrls() and nvmet_disable_port() can schedule the same association for deletion, leading to double resource freeing.

In the Linux kernel, in the RDMA/siw subsystem, a bug was fixed where QP destruction did not wait for all references to be dropped. The destruction completion was delayed until all siw references to the QP are released, preventing a use-after-free.

In the Linux kernel's cifs module, a session state check issue during reconnect can lead to a use-after-free. The fix prevents collecting an exiting session in smb2_reconnect_server() because it will be released soon.

In the Linux kernel, the sev-guest module now double-buffers messages. Previously, encryption algorithms read and wrote directly to shared unencrypted memory, potentially leaking information and allowing the host to tamper with message integrity.

In the Linux kernel, cifs has a potential use-after-free in TCP_Server_Info::hostname. Protecting access outside the reconnect path prevents potential use-after-free bugs.

In the SMB client (cifs) in the Linux kernel, a potential use-after-free vulnerability was found in smb2_query_info_compound. During retries, a previously allocated cfid could be freed, and the lack of pointer reset led to use-after-free.

In the Linux kernel, the NVMe over Fabrics (nvme-fc) driver has a vulnerability due to incorrect call ordering during controller deletion. The `nvme_fc_delete_association()` function can queue `->ioerr_work` after `cancel_work_sync()` has already been called, leading to list corruption and kernel panic.

In the Linux kernel, a refcount leak in nfsd_set_fh_dentry() occurs when an NFSv3 (or v2) client uses a pseudo-root filehandle. The export is stored in svc_fh but the reference is dropped, leading to a double free and potential use-after-free.

In the Linux kernel TLS subsystem, if tls_strp_msg_hold fails for async decryption, it can lead to use-after-free (UAF) of the skb or writing to userspace memory after recv() returns.

In the Linux kernel, the CIFS module's parse_dfs_referrals function lacks input validation for SMB server replies. A malicious server can send a reply smaller than expected or with an invalid number of referrals, causing an out-of-bounds memory read.

In the IPv4 stack of the Linux kernel, functions icmpv4_xrlim_allow() and ip_defrag() were changed to prevent a potential use-after-free vulnerability. Also, dst_dev_rcu() with lockdep support was added to several other functions.

In the Linux kernel, the SMB client's smb2_compound_op() function uses incorrect indices when processing compound command responses. This can lead to improper handling of results and, if the index exceeds MAX_COMPOUND, to out-of-bounds memory accesses.

A vulnerability in the Linux kernel's 'ice' network driver causes a memory page leak when handling multi-buffer frames. The issue occurs when hardware posts a descriptor with size 0, skipping buffer release and leaving a stale page in the RX ring.

In the Linux kernel, a vulnerability was found in the ksmbd module (SMB server) in SMBDirect data transfer handling. Invalid data_offset and data_length fields in the smb_direct_data_transfer structure can lead to out-of-bounds memory access.

In the Linux kernel SMB client, the recv_done function did not properly verify the data_offset, data_length, and remaining_data_length fields, potentially leading to incorrect handling of server responses.

In the Linux kernel's SMB client (cifs) driver, a vulnerability was found due to missing synchronization during RDMA connection destruction. The smbd_destroy() function does not wait for post_send_credits_work to complete, potentially causing use-after-free and triggering errors in the RDMA stack (rxe).

In the Linux kernel TIPC module, during link MTU negotiation, a malicious peer can send an Activate message with a very small MTU (e.g., 4). Without checking the minimum MTU, this value is set as the link MTU, leading to an integer overflow when calculating message size and potentially causing a system crash.

In the Linux kernel, an invalid access bug was found in the libceph library to the ceph_connection_v1_info union. Generic code in messenger.c reads and writes to the v1 union member without checking if it is active (i.e., msgr1 is in use). This can lead to reading invalid values or writing to overlapping fields.

In the lpfc SCSI driver (Linux kernel), a use-after-free window was found in the deferred receive path. The bug was due to incorrect order of freeing the RQ buffer and clearing the context pointer, which could lead to double-free or UAF.

In the Linux kernel, NFSD has a send buffer overflow vulnerability in NFSv2 READ. A client can send an excessively large RPC record, shrinking the reply buffer and preventing full payload construction, potentially leading to overflow.

A vulnerability in the Linux kernel's SMC (Shared Memory Communications) module was found. When trying to use SMCRv2 and then falling back to SMCRv1, resources assigned to the connection are not reset, leading to a NULL pointer dereference and system crash.

In the Linux kernel, NFSv4.2 has a double-free of scratch buffer in READ_PLUS. The fix moves scratch handling to pageio code, preventing double-free and oops during decoding hole segments.

In the Linux kernel, the lwt (lightweight tunnels) subsystem has an issue with return values of BPF xmit ops. Functions skb_do_redirect and bpf_lwt_xmit_reroute can return various positive values that are incorrectly treated as LWTUNNEL_XMIT_CONTINUE, leading to use-after-free and kernel crashes. The fix discards skb_do_redirect return values and converts bpf_lwt_xmit_reroute return values.

A race condition between login_work and the login thread in the Linux kernel's iSCSI target subsystem was found. A malicious initiator can send data after a login PDU, causing login_work to never stop and, after connection drop, a freed socket structure is dereferenced, leading to a kernel crash.

In the Linux kernel, NFSD has a send buffer overflow vulnerability in NFSv2 READDIR. The previous limit on the @count argument was restored to prevent buffer overflow attacks.

In the Linux kernel, the RDMA/siw driver's siw_tcp_sendpages function incorrectly set the byte count in iov_iter and tcp_sendmsg_locked call, causing oversized iterations. This led to out-of-bounds reads and crashes after recent slab allocator changes.

The s390/ism driver in the Linux kernel lacks synchronization for request-response sequences, allowing concurrent commands to the same ISM function. This can cause command corruption, DMA errors, and the function entering an error state (PEC 2/3A), breaking existing connections and preventing new ones.

A vulnerability in the Linux kernel's HSR (High-availability Seamless Redundancy) layer causes a kernel panic (BUG) when processing HSR frames with an incomplete tag. The lack of proper frame length validation before adding the HSR tag leads to an skb underflow (skb_under_panic).

In the Linux kernel TLS, handling of zero-length records on the rx_list is flawed. When the initial record comes from rx_list and is zero-length, it can break processing logic as zero-length records should not be zero-copied.

In the Linux kernel ppp driver, ppp_fill_forward_path() had two race conditions: the channel list could change without locking, and pch->chan could be NULL, leading to kernel panics.

In the Linux kernel, the CIFS (SMB) subsystem has an uninitialized 'buffer' variable in smb3_init_transform_rq(), potentially causing an oops during folio buffer allocation.

A Use-After-Free (UAF) vulnerability was discovered in the Linux kernel's SMC (Shared Memory Communications) module. The issue occurs when smc_listen_out_connected() is called and newclcsock->sk becomes NULL because the application closes the socket immediately after accept. This leads to a NULL pointer dereference when trying to increment SMC statistics.

In the Linux kernel, a vulnerability in the CIFS module can cause a slab out-of-bounds read when mounting a share to a ksmbd server. The issue is due to a missing check in the parse_server_interfaces() function.

In the Linux kernel, the NFS server (nfsd) function nfsd4_setclientid_confirm() does not check the return value of get_client_locked(). A race with an expiring client can lead to use-after-free (UAF).

In the Linux kernel, the DRBD driver is missing a kref_get call in handle_write_conflicts when two-primaries is enabled. This leads to premature device destruction and use-after-free.

A vulnerability in the Linux kernel related to the handling of decryption requests in synchronous mode has been resolved. The handling of no-async decryption requests has been separated from async, simplifying the process and eliminating reference counting issues.

In the Linux kernel, the Ceph filesystem function parse_longname() uses strrchr() on a string that is not NUL-terminated. This may lead to incorrect behavior or potential security issues.

In the Linux kernel's sunrpc module, a vulnerability was found in server-side TLS alert handling. The tls_alert_recv() function incorrectly assumes it can read data from the msg iterator, causing issues with TLS control message processing.

In the Linux kernel's ksmbd module, a race condition was found regarding Preauh_HashValue. When a client sends multiple session requests, improper freeing of Preauh_HashValue memory can occur.

In the Linux kernel for x86/SEV-SNP, a cache coherency vulnerability requires manual cache line eviction during memory validation after a page state change to private. The mitigation involves touching the first and last byte of each 4K page.

In the Linux kernel, the ksmbd module added validation of command request sizes. Previously, except for SMB2_OPLOCK_BREAK_HE, request sizes of other commands were not checked, which could lead to improper processing.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds read in smb2_sess_setup. ksmbd does not consider the case of that smb2 session setup is in compound request. If this is the second payload of the compound, OOB read issue occurs while processing the first payload in the smb2_sess_setup().

In the Linux kernel, there is a vulnerability in ksmbd that involves missing validation of session ID and tree ID in compound requests. If the first operation in a compound request is SMB2 ECHO, validation is bypassed, which can lead to NULL pointer dereference and system crash.