Linux kernel vulnerabilities

A vulnerability in the Linux kernel's ISOFS filesystem related to zisofs compression has been found. The zisofs_uncompress_block() function returns an incorrect byte count for empty blocks, ignoring the poffset, leading to an out-of-bounds read of the page array when handling compressed files on ISO9660 images. A crafted Rock Ridge "ZF" record can trigger this bug during a normal file read.

In the Linux kernel, nfsd_setattr() checked the NFSD_MAY_TRUNC permission using a file size sampled without the inode lock, while the actual size update was applied later under inode_lock(). This created a TOCTOU window for append-only files where a concurrent append could extend the file before a real truncation was applied without the required check.

In the Linux kernel, nfsd4_ssc_expire_umount() walked nfsd_ssc_mount_list while dropping nfsd_ssc_lock for mntput(), but kept the tmp pointer saved by list_for_each_entry_safe. Another NFSD thread could delete and free the item that was the saved tmp during that window, leading to a use-after-free.

A use-after-free vulnerability was fixed in the Linux kernel's nfsd (NFS server) module. After a DESTROY_SESSION, the rpciod thread could still dereference the freed session structure via the cl_cb_session pointer, leading to access of freed memory. The fix converts cl_cb_session to an RCU-protected pointer and changes session freeing from kfree() to kfree_rcu().

A vulnerability was fixed in the Linux kernel's nfsd subsystem affecting the nfsd_fh_verify and nfsd_fh_verify_err tracepoints. The server sockaddr slot in the trace buffer was sized by xpt_remotelen but filled with data of length xpt_locallen, so when xpt_locallen exceeded xpt_remotelen, the memcpy wrote past the reserved ring-buffer slot. The issue is reachable for NFSv2/v3 requests over UDP, where xpt_remotelen remains 0 for the transport's lifetime.

In the Linux kernel, nfsd4_create_file() may call fh_compose() with the wrong dentry. dentry_create() can hypothetically return a different dentry than the one passed in, potentially leading to a use-after-free. The fix moves the fh_compose() call until the final dentry is certain.

In the Linux kernel, nfsd4_copy() for async COPY has an initialization order bug. nfs4_init_copy_state() is called before dup_copy_fields(), so the s2s_cp_stateids IDR entry points to the COMPOUND buffer memory that is reused by the next request. This can lead to use-after-free or memory corruption, causing kernel crashes or potential code execution.

A use-after-free (UAF) vulnerability was fixed in the Linux kernel's NFS asynchronous copy mechanism (nfsd). A race between the copy kthread and teardown callers (OFFLOAD_CANCEL, nfsd4_shutdown_copy, nfsd4_cancel_copy_by_sb) could free or use an already-freed copy structure, double-put nfsd_file, and dereference a freed task_struct.

In the Linux kernel, nfsd4_ff_encode_layoutget() has multiple XDR buffer size calculation errors. These errors can result in an out-of-bounds write or leaking uninitialized kernel memory to the client. The worst case occurs with short strings, where the function writes up to 5 bytes past the reserved XDR buffer.

In the Linux kernel, nfsacld_proc_setacl() for NFSACL v2 SETACL has a bug that can lead to unintended ACL removal. When a SETACL request contains only NFS_ACL, the other pointer (acl_default) remains NULL, and set_posix_acl() with NULL removes the directory's default ACL. Similarly, mask=0 removes both ACLs.

In the Linux kernel, nfsd3_proc_setacl() for NFSv3 SETACL has a bug that can lead to unintended ACL removal. When a SETACL request contains only NFS_ACL, the acl_default pointer remains NULL, and set_posix_acl() with NULL removes the directory's default ACL. Similarly, mask=0 removes both ACLs.

In the Linux kernel, nfsd4_copy_notify() published the cpntf state into the IDR and the parent's list before finishing initialization and before recording the owning clientid. A racing OFFLOAD_CANCEL could free the entry, turning the caller's stateid read and cp_p_stateid/cp_p_clid writes into a use-after-free.

In the Linux kernel, __destroy_client() releases open owners, but a lock owner whose only reference is a blocked lock (nbl) stays on cl_ownerstr_hashtbl. During client teardown the laundromat can free the owner as __destroy_client() dereferences it, causing a NULL dereference in remove_blocked_locks().

In the Linux kernel, the NFSD module has a use-after-free vulnerability during administrative state revocation. The nfsd4_revoke_states() function drops the client_lock, allowing a concurrent teardown to free the client before the state revocation completes. The issue involves a race between state revocation and client destruction.

In the Linux kernel, the NFSD module has a use-after-free vulnerability during delegation revocation. The nfs4_laundromat() function unhashes an expired delegation from cl_delegations, drops deleg_lock, and then revoke_delegation() attempts to use a client that may have already been freed. The lack of client pinning via cl_rpc_users enables a race with client teardown.

In the Linux kernel, the NFSD module has a use-after-free vulnerability during NFSv4.0 revoked-state cleanup. The nfs40_clean_admin_revoked() function drops the client_lock, and then nfsd4_drop_revoked_stid() uses a client that may have been freed by a concurrent teardown. The lack of client pinning enables a race.

In the Linux kernel, the libceph module has a vulnerability due to failure to reject buckets with mismatched CRUSH ids. The crush_decode() function stores data by array slot, and a malformed map can cause one bucket to reuse another bucket's workspace, leading to an out-of-bounds write. KASAN reports an out-of-bounds write in bucket_perm_choose().

In the Linux kernel, the __kick_flushing_caps() function in the ceph module contains a use-after-free vulnerability. The function iterates over the i_cap_flush_list but drops the i_ceph_lock while sending cap messages, allowing handle_cap_flush_ack() to free a cf entry that the original thread later dereferences after reacquiring the lock.

In the Linux kernel, the check_new_map() function in the ceph subsystem contains a use-after-free vulnerability. The function drops mdsc->mutex to perform per-session operations, but three code paths (address changed, reconnect, active transition) fail to take a reference on the session object beforehand. Another thread can free the session during this unlock window, leading to access of freed memory.

In the Linux kernel, the ceph module has a vulnerability due to failure to reject export_targets ranks >= CEPH_MAX_MDS during mdsmap decode. The check_new_map() function uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can cause set_bit() to write past the array.

In the Linux kernel, the ceph module has a vulnerability due to failure to bound the copied dentry name length in NFS export get_name. The ceph_get_name() function copies the MDS-supplied name into a NAME_MAX-sized buffer without checking dname_len, leading to a buffer overflow. __get_snap_name() copies data in the same unchecked way.

In the Linux kernel, ceph_mdsmap_decode() lacked bounds checking for the num_export_targets array in MDS info records with version 2 or 3. A malicious or compromised Ceph monitor can send an MDS map with an oversized num_export_targets value, causing an out-of-bounds read in the CephFS client kernel.

A vulnerability exists in the Linux kernel's __build_xattrs() function in the Ceph subsystem, which decodes xattr attributes supplied by the MDS server. Missing bounds checking on the last attribute's value length allows a malicious or compromised metadata server to set a length larger than the actual buffer size, leading to an out-of-bounds read. The fix adds the required ceph_decode_need() check, returning -EIO instead of storing the invalid length.

In the Linux kernel, audit_del_rule() has a use-after-free on fsnotify rule autoremove. The unconditional audit_put_tree() assumes the template case, so for mixed AUDIT_DIR and AUDIT_EXE rules an autoremove event drops the installed rule's live tree reference. Repeating this can free the tree while another rule still references it, leading to dereferencing a freed pathname. The fix moves the temporary tree put to audit_rule_change().

In the Linux kernel SMB client, the is_valid_oplock_break() function no longer effectively validates the DataOffset field. Due to an earlier change in RFC1002 header handling, the expression used for validation always evaluates to zero, so the check never rejects invalid values.

In the Linux kernel, the NTFS mapping pairs decoder validated the starting LCN but did not check whether the run extends beyond the volume boundary. A malformed NTFS image with a crafted mapping pairs array could cause the kernel to access memory beyond the volume boundary, potentially leading to memory corruption and privilege escalation.

In the Linux kernel, the still_degraded variable in raid10_sync_request() was inverted (set to false instead of true) during conversion from int to bool. This causes the bitmap to be incorrectly cleared when recovering a device while another mirror is still missing, leading to silent data corruption after the missing device is re-added.

In the Linux kernel, mpls_select_multipath() caches the hdr pointer to the MPLS header and then calls pskb_may_pull(), which may replace the skb head and free the old one, leaving hdr pointing to freed memory. This leads to a use-after-free when reading the inner IP header.

In the Linux kernel, xdr_buf_trim() does not clamp the subtraction from buf->len, so when buf->len is smaller than the sum of iov_lens, an underflow occurs and wraps to near UINT_MAX. This state is reachable via gss_krb5_unwrap_v2(), and the wrapped value propagates as the authoritative stream bound into all downstream XDR decoders.

In the Linux kernel, svcauth_gss_unwrap_priv() only validated an upper bound on the wire-supplied opaque length before passing the buffer to gss_unwrap(), with no minimum length check. A token of 16 bytes or less (the RFC 4121 header size) reached gss_krb5_unwrap_v2(), where header reads ran past the token and rotate_left() could divide by zero. The fix adds a minimum-length check before the token reaches the krb5 unwrap core.

In the Linux kernel, a race occurs during backchannel receive when the NFS callback service is being torn down. xprt_enqueue_bc_request() may skip enqueueing or freeing the request if xprt->bc_serv has already been cleared, leading to a leak or use-after-free.

A vulnerability was fixed in the Linux kernel's SUNRPC gss_krb5_unwrap_v2() function, which read EC and RRC header fields out of bounds before validating the token length. Unsigned arithmetic underflow could trigger a ~UINT_MAX-byte memmove, and a zero-length buffer could cause a divide-by-zero. Four defense-in-depth guards were added to validate token and buffer lengths.

A vulnerability was fixed in the Linux kernel's SUNRPC gss_unwrap_resp_priv() function. Improper validation of the RPCSEC_GSS opaque length (opaque_len) allowed u32 arithmetic overflow and lacked a lower bound, enabling out-of-bounds reads in gss_krb5_unwrap_v2().

A vulnerability was fixed in the Linux kernel's gss_krb5_unwrap_v2() function in the SUNRPC module. A Kerberos v2 token with an 'extra count' (ec) field larger than the plaintext length, even when sent by an authenticated peer with a valid GSS context, left the xdr_buf in an inconsistent state (zero length, mismatched iov lengths). The fix rejects such tokens before calling xdr_buf_trim(), returning a GSS_S_DEFECTIVE_TOKEN error.

The Linux kernel has a vulnerability in the SUNRPC function gss_krb5_verify_mic_v2(), which fails to check the minimum length of a MIC token before reading its contents. A remote attacker (e.g., a malicious NFS server) can supply a short token, causing an out-of-bounds read of the allocated buffer. The issue was fixed by adding a length guard.

In the Linux kernel, xs_tls_handshake_sync() in the SUNRPC subsystem has a use-after-free race during TLS handshake cancellation. When handshake_req_cancel() returns false (because handshake_complete() already marked the request complete), the waiter may drop the lower transport reference before the xs_tls_handshake_done() callback finishes. This can free the transport while it is still in use.

A bug was fixed in the Linux kernel's svcrdma module in svc_rdma_read_chunk_range(), related to offset arithmetic when building a read range for RDMA chunks. Incorrect use of '>' instead of '>=' and improper min_t() bracketing caused u32 underflow, wrong DMA lengths, and potentially large memory allocations (multi-MiB kmalloc_array_node). The function also rejected valid zero-length requests.

A vulnerability exists in the Linux kernel's svcrdma component related to the pcl_for_each_segment macro. When a parsed chunk list contains a chunk with ch_segcount equal to zero, the inclusive upper bound calculation underflows, causing the loop to walk past the ch_segments flex array and resulting in an out-of-bounds read and a general protection fault. The issue is reachable from the wire via a Write or Reply chunk advertising zero segments when the transport has negotiated Send-With-Invalidate.

A vulnerability exists in the Linux kernel's svcrdma module (RPC-over-RDMA). A client can request a reply without providing a Write list or Reply chunk, causing the linearization function to copy past the end of the sc_xprt_buf buffer and corrupt adjacent slab memory. The oversized length is then stored in sc_sges[0].length and posted, causing the device to read beyond the mapped region.

In the Linux kernel svcrdma module, the RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim. xdr_count_read_segments() checks only 4-byte alignment and never compares the position against the received inline body length, so in the single-chunk path a position past the inline body underflows the tail length and exposes adjacent slab memory, while in the multi-chunk path overlapping chunks cause unsigned underflows and copies past the receive buffer.

A use-after-free vulnerability exists in the Linux kernel's SCTP handling. A remote peer can bundle COOKIE ECHO, SHUTDOWN and SHUTDOWN ACK chunks in a single packet, causing the association and its transports to be freed, after which the endpoint loop writes to freed memory. This occurs when the packet is processed from the socket backlog in task context.

In the Linux kernel, sctp_rcv() resolves the transport once per packet and keeps it in chunk->transport until processing completes. An authenticated ASCONF DEL-IP can remove and free that transport via RCU in the meantime, and a subsequent delayed SACK then reads the freed transport's state. This results in a use-after-free.

In the Linux kernel, detect_intel_iommu() did not include tboot in the conditions for requesting ACS, potentially causing a misconfiguration with ACS disabled while IOMMU is later forced on by tboot_force_iommu(). The fix adds a tboot check in detect_intel_iommu().

In the Linux kernel, xdp_convert_zc_to_xdp_frame() clones an XSK packet into an order-0 page and advertises PAGE_SIZE as its frame size, allowing the copied frame to occupy the page tail needed by skb_shared_info. This causes the skb to overlap skb_shared_info or be placed beyond the allocated page, resulting in a KASAN slab-out-of-bounds in skb_gro_receive.

In the Linux kernel, a flaw exists in net/smc where the peer rkey counts in SMC-Rv2 LLC messages are not bounded. On links with a device having max_recv_sge == 1, smc_llc_save_add_link_rkeys() reads the v2 extension beyond the allocated buffer, causing a slab-out-of-bounds read. This occurs on every SMC-Rv2 link addition regardless of what the peer sends.

In the Linux kernel, smc_llc_srv_add_link() in the net/smc subsystem contains a use-after-free flaw. The add_llc pointer references a queue entry that is freed by smc_llc_flow_qentry_del() and then used by smc_llc_save_add_link_rkeys() on a link without a shared v2 receive buffer. The issue has been fixed.

In the Linux kernel's net/smc subsystem, three connection state flags (killed, freed, out_of_sync) are single-bit bitfields sharing one byte of struct smc_connection. Because they are not written under a common lock, storing one flag performs a read-modify-write that corrupts the neighbouring bits, causing a race and inconsistent connection state.

A vulnerability exists in the Linux kernel's IPv6 segment routing (SRv6) handling. The decap_and_validate() function fails to reset the IPv6 control block (IP6CB) after decapsulation, allowing an unprivileged user to trigger a slab-out-of-bounds read in ip6_protocol_deliver_rcu().

In the Linux kernel, the iaa crypto driver has a bug during hardware decompression. On a hardware analytics error, the decompress path retries through the software fallback, which writes req->dst while it is still mapped as DMA_FROM_DEVICE. With SWIOTLB active, the later dma_unmap_sg() copies the stale bounce buffer over req->dst, corrupting the result.

In the Linux kernel's KVM subsystem (x86 MMU), a use-after-free vulnerability was found. The issue stems from violating the invariant that invalid shadow pages are not on the active MMU page list, leading to incorrect use of list_add() instead of list_move() when processing an invalid shadow page. The fix explicitly clears role.invalid when creating a child shadow page and adds a WARN if the parent is invalid.