Linux kernel vulnerabilities

In the Linux kernel, the ksmbd module now prevents guest users from using multichannel. If a session is bound to a guest, the server returns STATUS_NOT_SUPPORTED.

In the Linux kernel MPTCP stack, races between subflow failure and new subflow creation are fixed by adding a separate flag protected by the fallback lock, preventing additional subflow creation in certain socket states.

In the Linux kernel, the libwx network driver has an uninitialized 'dma' field in wx_rx_buffer, potentially causing DMA errors or use-after-free.

A use-after-free vulnerability in the Linux kernel's SMB client (cifs) was found in cifs_oplock_break() due to a race condition during unmount. The cinode structure is accessed after the superblock is released, leading to memory corruption.

In the Linux kernel, a double free in the libwx driver's page_pool_put_full_page() function causes a kernel panic. The issue occurs when the function is called inappropriately, leading to list corruption and system crash.

A use-after-free vulnerability was found in the crypt_message function of the Linux kernel's SMB client module. The issue occurs when hardware crypto accelerators perform asynchronous operations. After removing async handling in the CVE-2024-50047 fix, the request buffer is freed before the crypto operation completes, leading to kernel crashes.

A use-after-free vulnerability was found in the Linux kernel's rpl_do_srh_inline() function in the RPL module. The function fetches an IPv6 header pointer and accesses it after calling skb_cow_head(), which can lead to accessing freed memory. The fix changes the pointer to a local struct.

A crash in the Linux kernel's nf_conntrack module occurs when removing an uninitialized entry from the hash bucket list due to a race condition. The confirmed bit (IPS_CONFIRMED) is set before the entry is added to the hash table, leading to a null pointer dereference.

In the Linux kernel, a use-after-free bug was found in the TLS subsystem when reading a socket. After TCP changes that compact skbs more aggressively, TLS may try to operate on a freed skb while checking the queue's decryption state.

In the Linux kernel, the bnxt_en driver has a vulnerability where the DMA unmap length is incorrectly set to 0 for XDP_REDIRECT packets. This triggers a warning and potential issues on systems with IOMMU enabled.

In the Linux kernel NFSD, nfsd4_spo_must_allow() does not check if the request is a v4 compound. If not, examining cstate can yield undefined results.

In the Linux kernel MHI EP driver, the read pointer (rd_offset) is updated before the buffer is written, potentially causing race conditions where the host sees an updated pointer before the element is fully written, leading to data corruption.

In the Linux kernel, a double put of a request was found in the netfs subsystem. If a netfs request finishes during the pause loop, the IN_PROGRESS flag is cleared, but the subsequent wait loop may release the reference again, leading to incorrect behavior.

In the Linux kernel, a race condition was found between file rename and directory logging in the Btrfs filesystem. This bug can cause the log replay to delete the file being renamed if a crash or power failure occurs before the rename completes.

In the Linux kernel ksmbd (SMB) server, the free_transport function for TCP connections can be called from smbdirect context, causing a kernel oops. A free_transport operation was added to the connection structure with separate implementations for TCP and smbdirect.

In the Linux kernel, a vulnerability in the bnxt_en driver causes improper flushing of XDP redirect lists, leading to list corruption and kernel panic during XDP_REDIRECT processing.

In the Linux kernel's RDMA/iwcm subsystem, a use-after-free vulnerability was found on work objects after cm_id destruction. The issue occurs when the last reference to cm_id is removed in the event handler context, leading to memory corruption and potential code execution.

In the Linux kernel, a vulnerability in the nvme-tcp driver causes a use-after-free bug due to improper tag set management during the second admin queue configuration. The first call succeeds, but the second fails without removing the tag set, leading to access to freed memory.

In the Linux kernel, a vulnerability in the openvswitch module causes an infinite loop when parsing MPLS packets. An unexpected MPLS packet may lack the bottom label stack, and with many labels the counter wraps, leading to a dead loop and CPU soft lockup.

A vulnerability in the Linux kernel's netfs write-retry mechanism incorrectly resets the subrequest iterator, causing a slab-out-of-bounds read detected by KASAN. This can lead to a system oops.

In the Linux kernel t7xx WWAN driver, a NAPI RX poll issue occurs: after network interface disconnection (dellink), the netdev is freed but still used during skb processing in polling, causing a kernel panic (NULL pointer dereference).

In the Linux kernel netfilter nf_set_pipapo_avx2 module, an initial map fill bug: if the first field doesn't cover the entire start map, remaining bits are not zeroed, leaking those bits into the next match round. The fix for the C implementation was incomplete.

In the Linux kernel's sunrpc module, a vulnerability was found allowing remote crashes. A crafted packet can cause SVC_GARBAGE to be returned without setting the rq_accept_statp pointer, leading to NULL dereference and system crash.

In the Linux kernel, a race condition in the SCSI target iSCSI subsystem causes the NOPIN response timer to restart after connection deletion, leading to a NULL pointer dereference and system crash.

A vulnerability was found in the Linux kernel's BPF subsystem where the bpf_redirect_peer function does not scrub redirected packets. This allows information from one network namespace to be misused in another, causing issues such as Cilium dropping IPsec traffic.

In the mtk_eth_soc Ethernet driver (Linux kernel), a bug was found causing a system panic with 4GB+ RAM. The mtk_poll_rx() function incorrectly handled the MTK_RESETTING flag, leading to processing of an incorrect SDP descriptor and a panic.

A vulnerability in the Linux kernel's socket lookup functions can return a pointer to inet_timewait_sock, which when passed to sock_put() instead of sock_gen_put() causes a memory access violation and system crash.

In the Linux kernel's 9p/net module, a vulnerability was found in handling negative read/write replies. A server can reply with success but a negative byte count, causing comparison errors and potential NULL pointer dereference.

In the Linux kernel, the NVMe target subsystem (nvmet) has a use-after-free (UAF) vulnerability in nvmet_req_complete(). The queue_response() operation implementation may free the request passed as an argument, and then percpu_ref_put() may dereference the freed pointer. The fix saves the sq pointer in a local variable before calling __nvmet_req_complete() to avoid dereferencing the freed pointer.

In the Linux kernel, the ceph module has a double-free vulnerability when decoding snaps fails. This can lead to random use-after-free, BUG_ON, or other issues.

In the Linux kernel, the ksmbd subsystem (SMB server) has a dangling pointer issue in krb_authenticate. The function frees sess->user but does not set the pointer to NULL. It then calls ksmbd_krb5_authenticate, which may not reinitialize sess->user, leading to access of freed memory in smb2_sess_setup.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's SMB client during decryption with multichannel. After code changes, channels started reusing the AEAD TFM from the primary channel, causing concurrent access from multiple threads and a race condition that leads to accessing freed memory.

In the Linux kernel, the netfilter nfnetlink_queue subsystem uses an uninitialized 'ctx' variable in nfqnl_build_packet_message(), potentially causing memory allocation errors.

In the Linux kernel, the RDMA/erdma driver's erdma_accept_newconn() function calls erdma_cep_put() on the new_cep structure and then continues to use it, leading to a use-after-free (UAF) vulnerability.

In the Linux kernel, the fix for CVE-2024-54680 (TCP timer deadlock after rmmod) has been reverted because it did not resolve the original issue and introduced a new vulnerability: TCP socket leak in FIN_WAIT_1 state, potentially exhausting the tcp_max_orphans limit.

In the Linux kernel, in ksmbd, there is a null pointer dereference in alloc_preauth_hash(). The client sends a malformed SMB2 negotiate request, ksmbd returns an error, but the client can then send an SMB2 session setup even though conn->preauth_info is not allocated. The patch adds the KSMBD_SESS_NEED_SETUP connection status to ignore session setup requests if the SMB2 negotiate phase is not complete.

In the Linux kernel's netfilter subsystem, the nf_sk_lookup_slow_v6 function lacks a conntrack lookup for SNATed IPv6 packets, unlike its IPv4 counterpart. This causes xt_socket rules with --transparent to fail for IPv6 traffic after address translation.

In the netfs subsystem of the Linux kernel, a bug was found in the read_collect function. When multiple subrequests donated data to the same request, they overwrote the prev_donated field, causing data corruption and a BUG() panic.

In the Linux kernel's netmem subsystem, there is no protection against transmitting (xmit) packets that are unreadable by the CPU. Forwarding such a packet to a network driver can cause DMA operations on invalid addresses.

In the Linux kernel's nvme-tcp module, a memory corruption vulnerability was found in nvme_tcp_recv_pdu(). The function does not validate the header length, allowing an attacker to write data outside the allocated memory area.

In the Linux kernel, the CIFS subsystem (SMB client) has a bug causing an oops due to an uncleared server->smbd_conn pointer during reconnection. In smbd_destroy(), the pointer is not cleared after freeing the smbd_connection struct, which can confuse reconnection attempts.

In the NVMe over Fabrics subsystem (nvmet) of the Linux kernel, a bug was found causing a crash when disabling a namespace. The percpu counter protecting pending I/O was not properly handled, leading to a crash when trying to disable a namespace with active I/O.

In the Linux kernel, the RDMA/rxe driver triggers a warning during resource cleanup when too many rdma resources are allocated. The current timeout is too short to release all resources correctly, causing a warning.

In the Linux kernel's RDMA/rtrs driver, the deinit() function is missing during disconnection, so the IB event handler registration is not undone. This leads to list corruption when repeatedly connecting and disconnecting.

In the Linux kernel NFSD subsystem, a use-after-free vulnerability occurs when fetching acl_default fails. Both acl_access and acl_default are released, but acl_access retains a pointer to the freed posix_acl, triggering a kernel warning and panic.

In the Linux kernel, a vulnerability was found in the ndisc_send_skb() function, which can be called without RTNL or RCU lock. The lack of proper RCU protection allows a use-after-free (UAF) when accessing the device's network namespace.

In the Linux kernel, the mld_newpack() function lacked RCU protection, potentially causing data races. The fix replaces sock_alloc_send_skb() with alloc_skb() and charges the socket under RCU protection.

In the Linux kernel's ksmbd module, an integer overflow vulnerability was found on 32-bit systems. Addition operations in ipc_msg_alloc() can overflow, leading to potential memory corruption.

In the Linux kernel, the PCI dwc ep driver has a vulnerability due to lack of protection against changing BAR size/flags in pci_epc_set_bar(). This allows setting a new BAR size that is smaller than the size determined by the host, potentially allowing reads past the new BAR size.