Linux kernel vulnerabilities

In the Linux kernel's MPTCP implementation, a vulnerability was found due to improper management of suboption status. Zeroing the bitmask before parsing is insufficient to ensure state consistency, leading to uninitialized bitfields and a KMSAN bug.

In the Linux kernel, a vulnerability in the netfilter conntrack module has been fixed, where after insertion of a conntrack entry, a clash can occur, leading to freeing skb->_nfct and setting it to an already-confirmed entry. This was not found before because the conntrack entry and extension space were freed after an RCU grace period, and the race requires events enabled to trigger.

In the Linux kernel, the NFSv4 subsystem has a bug causing free of an uninitialized nfs4_label during referral lookup. The fix sends the already-allocated fattr along with nfs4_fs_locations and drops the memcpy of fattr, fixing a crash during 'ls' operations.

In the Linux kernel, a vulnerability in the DLM module causes an invalid memory read during file unlock (plock) operations. The bug occurs when a 'plock_op' structure is cast to 'plock_xop' and fields not present in the original structure are accessed, leading to a slab-out-of-bounds read. The fix moves the 'callback' field to 'struct plock_op' to indicate when such casting is allowed.

In the Linux kernel, in the nfsd_file_put() function in NFSD, a potential use-after-free was fixed. Since nfsd_file_put_noref() can free @nf, it should not be dereferenced after return.

In the Linux kernel, in the svc_rdma_build_writes() function in SUNRPC, an overflow issue with RDMA segments was fixed by preventing walking off the end of the segment array.

In the Linux kernel, in the nfssvc_decode_writeargs() function in NFSD, an underflow issue with 'args->len' was fixed by changing the type to unsigned.

In the Linux kernel, in the hisilicon/sec crypto driver, a bug with the aead software fallback was fixed. Misuse of the subreq pointer caused occasional OS panics when setting the 64K page.

In the Linux kernel, the bcmgenet driver has an issue with ordering of device register reads/writes. GCC12 optimizes memory operations in a way that breaks the assumed ordering, leading to transmit queue timeouts and NETDEV WATCHDOG warnings. The fix replaces relaxed variants with safer readl/writel functions.

In the Linux kernel's rxrpc module, a race between call timer start and call destruction can lead to a timer being restarted after it was stopped, causing an oops. The fix takes a reference on the rxrpc_call struct before starting the timer.

In the Linux kernel, in the net/tls module, a slab-out-of-bounds bug in decrypt_internal was fixed. The issue was due to incorrect IV size for AES128-CCM, causing an out-of-bounds read.

In the Linux kernel, a vulnerability in the cifs driver was fixed that could lead to a buffer overflow when handling symbolic links. The issue was due to a missing check that link_len does not exceed the size of the link_str buffer. A check was added.

In the Linux kernel, a double free of the hostname field in the TCP_Server_Info structure was found in the CIFS/SMB client. The issue occurs when the cifsd thread, during server shutdown, continues to attempt reconnection to multiple DFS targets before exiting the loop, leading to a race condition and double free.

In the Linux kernel, in the netfilter module (nf_set_pipapo), there is a bug in the initialization of the fill map during set lookup. The initial buffer is initialized to all-ones, but the restriction to the size of the first field is missing, causing bit leakage into subsequent rounds and incorrect matching results for sets where the first field is not the largest.

In the dwmac-tegra driver for MGBE controllers in the Linux kernel, a vulnerability was found where the IOMMU Stream ID (SID) is hardcoded to MGBE0's SID instead of being read from the device tree. This causes incorrect SID to be written to the MGBE_WRAP_AXI_ASID0_CTRL register for other controllers (e.g., MGBE1), leading to softirq timeouts and kernel panics.

In the Linux kernel, in the RDMA/bnxt_re driver, there is an issue with the maximum number of SGEs for work requests. For Gen P7, 13 SGEs are reported, but the WQE software structure can only hold 6, leading to traffic failures and system crashes.

In the Linux kernel, in the gve driver, the XDP XMIT NDO callback lacks a guard to check for the existence of dedicated XDP queues. When no XDP program is installed or the interface is down, a divide-by-zero error or NULL TX pointer access can occur.

A vulnerability in the Linux kernel's MPTCP implementation involves incorrect TCP option length computation, leading to buffer overflow. In certain circumstances, the ADD_ADDR option is not properly excluded from DSS, causing memory corruption (nr_frags) and potentially leading to a kernel panic.

A vulnerability in the Linux kernel's NET/ROM protocol was found, where nr_route_frame does not check the buffer length before accessing data. This can lead to an uninitialized memory read, as reported by Syzkaller.

In the Linux kernel, a NULL pointer dereference in the RDMA/rtrs subsystem was fixed. The declaration of the 'ib_sge list' variable was moved outside the 'always_invalidate' block to ensure accessibility throughout the function, eliminating the 'BUG: kernel NULL pointer dereference' crash.

In the Linux kernel, in the virtio-net driver, there is an overflow bug in virtnet_rq_alloc. When a frag is one page in size and the total size of the buffer plus virtnet_rq_dma exceeds one page, an overflow can occur, leading to system crashes or SCP failures.

In the Linux kernel, in the virt: tdx-guest module, there is a vulnerability where in CoCo VMs an untrusted host can cause set_memory_decrypted() to fail, resulting in shared memory being returned to the page allocator. This could lead to functional or security issues. The fix leaks the decrypted memory on error, without printing an error since set_memory_decrypted() will call WARN_ONCE().

In the Linux kernel's net/smc module, when receiving a proposal message on the server, the fields iparea_offset and ipv6_prefixes_cnt come from the remote client and are not fully trusted. If iparea_offset exceeds the maximum value, it may lead to accessing an incorrect address and system crash. The patch adds validation of these fields before use.

In the Linux kernel, the net/smc module when receiving proposal messages on the server, the fields v2_ext_offset, eid_cnt, and ism_gid_cnt come from the remote client and are not fully trusted. Invalid values can lead to accessing wrong addresses and crashes. The fix adds checks for these fields before use.

In the Linux kernel's net/smc module, when receiving a proposal message on the server, the field smcd_v2_ext_offset comes from the remote client and is not fully trusted. If the value of smcd_v2_ext_offset exceeds the maximum value, it may lead to accessing an incorrect address and system crash. The patch adds validation of smcd_v2_ext_offset before use.

A vulnerability in the Linux kernel's NFS server (nfsd) causes a memory leak during concurrent file open operations (nfsd4_open). The issue stems from improper handling of nfs4_openowner objects when two parallel open requests for the same file are processed by different nfsd threads. In extreme cases, this can lead to a kernel panic when shutting down the NFS server.

In the Linux kernel, a bug in the stmmac driver's DMA handling for TSO causes an oops. The issue stems from a delayed assignment of the DMA cookie in stmmac_tso_xmit(), violating DMA API requirements. This leads to DMA mapping failures and messages about freeing unallocated DMA memory.

In the Linux kernel, in the CAN subsystem (J1939), there is a reference counting bug in the j1939_session_new() function. The j1939_session_skb_queue() function performs an extra skb_get() for each new skb, but it does not do so for the initial one, leading to a refcount underflow.

In the Linux kernel, the bnxt_en driver has a vulnerability related to incorrect receive ring space parameters when changing MTU with XDP active. Changing MTU after attaching an XDP multi-buffer can lead to inconsistent aggregation ring configuration, resulting in random memory corruption and crashes.

In the Linux kernel, in the TCP stack, there is a use-after-free vulnerability in the reqsk_timer_handler() function. A previous fix replaced inet_csk_reqsk_queue_drop_and_put() with __inet_csk_reqsk_queue_drop() and reqsk_put(), but it passes the wrong pointer (req instead of oreq) to reqsk_put(), which can lead to use-after-free.

In the Linux kernel, in the ksmbd module, there is a vulnerability due to a race condition between SMB request handling in ksmbd_conn_handler_loop() and the freeing of ksmbd_conn in the workqueue handler handle_ksmbd_work(). This leads to a use-after-free (UAF). The fix addresses this issue.

A use-after-free of the signing key in the SMB client of the Linux kernel was found. A race between mount operations and packet sending can lead to accessing freed memory during signature calculation.

In the Linux kernel, a vulnerability in the CIFS/SMB filesystem causes a kernel BUG during unmount. A race between unmount and cached directory operations prevents dentries from being dropped, triggering a kernel panic. The fix moves dentry dropping to a workqueue and adds proper synchronization.

In the Linux kernel, a potential integer overflow was found in the NFSD module. If the tag length is >= U32_MAX - 3, the "length + 4" addition can overflow. The fix splits the decoding into several steps to avoid arithmetic on the unsafe length value.

In the Linux kernel, the mlx5e driver for kTLS has an incorrect page refcounting issue. Mixing get_page() and page_ref_inc() APIs for incrementing references and using only put_page() on release leads to over-dereferencing the folio page, potentially causing memory errors.

In the Linux kernel, the RDMA/siw driver lacks a sendpage_ok() check, leading to the use of a slab page in sendpage and triggering a warning in skb_splice_from_iter(). The issue occurs during ISER over SIW operation.

A KMSAN warning about uninitialized value in decode_getfattr_attrs() in the Linux kernel's NFS subsystem was found. The fattr->mdsthreshold field is not initialized, which can lead to incorrect behavior.

In the Linux kernel, the stmmac network driver has a vulnerability related to unbalanced DMA mapping/unmapping for non-paged SKB data in TSO context. Incorrect assignment of the DMA buffer address to the wrong tx_skbuff_dma array entry causes premature unmapping before the DMA engine finishes using it. This can lead to corrupted data transmission or IOMMU faults.

Slab-use-after-free vulnerability in the Linux kernel's ksmbd module in ksmbd_smb2_session_create. There is a race condition between this function and ksmbd_expire_session, requiring the addition of missing session table locking when adding/removing sessions from the global table.

In the Linux kernel, a slab-use-after-free vulnerability in the ksmbd server was fixed in the smb3_preauth_hash_rsp function. The ksmbd_user_session_put call should be made within smb3_preauth_hash_rsp to avoid freeing the session before use.

A vulnerability in the Linux kernel Vertexcom MSE102x driver was fixed, which could lead to a double-free of the TX skb. The issue occurred when the TX skb needed to be expanded — the original skb was freed instead of the temporary one, causing a second free in mse102x_tx_work() and a system crash.

In the Linux kernel, in the net: ethernet: mtk_eth_soc module, there is a vulnerability causing memory corruption during fq dma init. The loop responsible for allocating up to MTK_FQ_DMA_LENGTH buffers touches too many descriptors, corrupting unrelated memory. The fix corrects the loop iteration count.

In the Linux kernel, the SMB client (smb2_set_ea()) has a possible double free vulnerability. The bug occurs when after the first free, the variable 'ea' is not re-initialized before another attempt, leading to a second free of the same memory.

In the Linux kernel, the ksmbd module has a use-after-free (UAF) issue during SMB2 session log off. There is a race between session log off and session setup, leading to UAF. The fix adds session lock when setting SMB2_SESSION_EXPIRED and reference count to session struct to prevent freeing while in use.

In the Linux kernel, the NFS server (nfsd) has an issue in FREE_STATEID handling. Sending multiple FREE_STATEIDs for the same delegation stateid can lead to use-after-free or counter refcount underflow. The fix addresses the critical section in nfsd4_free_stateid() where the lock is dropped before calling nfs4_put_stid(), allowing the stateid to be found again.

A vulnerability was found in the Linux kernel's slhc_remember() function in the SLIP driver, which improperly validated network packets. Missing checks could lead to reading uninitialized memory, as reported by syzbot.

A vulnerability in the Linux kernel's NVMe subsystem was found, where the nvme_ns_head list is not properly protected by SRCU in nvme_mpath_revalidate_paths(). Lack of synchronization when removing namespaces can lead to use-after-free during concurrent scan work.

In the Linux kernel, the mana network driver has a race condition on the per-CQ variable napi work_done. After calling napi_complete_done(), the NAPIF_STATE_SCHED bit may be cleared, and another CPU can start the napi thread and access the per-CQ variable cq->work_done. If another thread sets it to a value >= budget, this thread will continue to run when it should stop, potentially causing memory corruption and panic. The fix saves the work_done variable in a local variable before napi_complete_done() to avoid corruption.

A vulnerability related to buffer overflow when parsing NFS reparse points has been fixed in the Linux kernel. The issue stemmed from incorrect calculation of the data buffer size, leading to access beyond its bounds.

In the Linux kernel, the nbd module has a race between timeout and normal completion. If timeout is handled by nbd_requeue_cmd(), normal completion must be stopped to avoid use-after-free. The fix clears NBD_CMD_INFLIGHT in nbd_requeue_cmd() and ensures cmd->lock is grabbed before clearing the flag and requeueing.