Linux kernel vulnerabilities

A vulnerability was found in the Linux kernel's TCP stack in reqsk_queue_hash_req(). Preemption between mod_timer() and refcount_set() can cause premature timer expiration and a refcount underflow, leading to use-after-free.

In the Linux kernel's mtk_eth_soc network driver, a use-after-free vulnerability was found. The mtk_free_dev() function calls metadata_dst_free() which immediately frees the metadata_dst memory, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer, which can lead to accessing freed memory if any skb still holds that pointer during driver teardown.

In the Linux kernel SCTP stack, the length of a cached INIT chunk in COOKIE_ECHO processing was not validated. Missing validation can lead to out-of-bounds reads and potential memory corruption.

In the Linux kernel, a vulnerability in the SIT (Simple Internet Transition) IPv6 module uses a stale inner IPv6 header pointer after GSO offloads. The ipip6_tunnel_xmit() function caches the pointer at entry, but iptunnel_handle_offloads() may relocate the skb buffer, causing reads from freed memory.

A vulnerability was found in the Linux kernel's SCTP stack in the __sctp_rcv_asconf_lookup() function. An unauthenticated peer can send a truncated ASCONF chunk that declares an IPv6 address but ends after the parameter header, causing uninitialized memory to be read.

In the Linux kernel, sctp_unpack_cookie() lacked validation of the embedded INIT chunk length and address list length in SCTP cookies. A truncated INIT or oversized address list can cause out-of-bounds reads.

In the Linux kernel, a bug was found in the vti6_tnl_lookup() function causing incorrect tunnel matching for IP6_VTI. During wildcard tunnel fallback search, missing checks allowed hash collisions to match tunnels without actual wildcard addresses.

In the Linux kernel, the mvpp2 driver incorrectly initializes the XDP frame size (frame_sz) to PAGE_SIZE instead of the actual RX buffer size from the BM pool. This allows bpf_xdp_adjust_tail() to grow a packet beyond the allocated buffer, causing memory corruption.

In the Linux kernel, a vulnerability in the mvpp2 driver allows an RX buffer to be returned to the BM pool after being handed to XDP or skb, causing use-after-free. The fix reorders operations to refill the BM pool before handing the buffer to XDP or skb.

In the Linux kernel, the RDMA/SRP driver lacks validation of the sense data length copied from SRP_RSP responses. A malicious or compromised SRP target on InfiniBand/RoCE can set a large resp_data_len, causing an out-of-bounds read beyond the received buffer and potentially a page fault.

In the Linux kernel's IB/isert driver, a missing lower bound check on iSER login PDU length allows a remote initiator to send a packet shorter than ISER_HEADERS_LEN (76 bytes). This causes an underflow in payload length calculation, leading to a buffer overflow during memcpy and a crash of the target node. No authentication is required to exploit this vulnerability.

A use-after-free vulnerability was found in the Linux kernel's IP fragment reassembly mechanism. During network namespace teardown, fqdir_pre_exit() flushes fragment queues but does not reset q->fragments_tail and q->last_run_head pointers, which still point to freed skbs. A fragment that obtained the queue before the flush may later dereference the freed memory, leading to a security breach.

In the Linux kernel's AF_RXRPC subsystem, a vulnerability was found in the ACK parser due to improper access to the SACK buffer in received UDP packets. The rxrpc_input_soft_acks() function modifies the skbuff and may incorrectly read data in case of packet fragmentation, potentially leading to parsing errors.

A vulnerability was found in the Linux kernel's netfilter subsystem where functions like `ip6t_eui64`, `xt_mac`, ipset types (`bitmap:ip,mac`, `hash:ip,mac`, `hash:mac`), and `nf_log_syslog` accessed the Ethernet header (`eth_hdr(skb)`) without first verifying that the skb is associated with an Ethernet device, that the MAC header is set, and that it spans at least a full Ethernet header. Missing these checks could lead to errors or potential security issues.

Vulnerability in the Linux kernel in the bcmgenet driver (Broadcom GENET Ethernet) due to an off-by-one error in bcmgenet_put_txcb. Incorrect pointer rewind may lead to improper cleanup of the transmit buffer.

In the Linux kernel, the bcmgenet driver has a flawed timeout handler: it stops all transmit queues when a single queue times out, causing race conditions with queues that are still functioning. The fix restarts only the timed-out queue.

In the Linux kernel's hisilicon/sec2 driver, a use-after-free vulnerability was found during packet transmission. Under heavy system load, hardware may complete packet processing and free the request memory (req) before the transmission function finishes, causing an error.

In the Linux kernel, the GFS2 filesystem lacked proper log locking in the gfs2_logd() function. Log flushing functions (gfs2_ail1_start(), gfs2_ail1_wait(), gfs2_ail1_empty()) were called without holding the sd_log_flush_lock, potentially causing race conditions with concurrent transactions. A new __gfs2_log_flush() function and proper locking were added to gfs2_logd().

In the Linux kernel, a use-after-free vulnerability was found in the ksmbd module related to the Qualcomm Crypto Engine (QCE). The ksmbd_crypt_message() function does not properly handle the -EINPROGRESS return code from async hardware, leading to premature DMA request freeing and freed memory dereference in the callback.

In the Linux kernel, the memory driver for Tegra124 (tegra124-emc) had a reversed check for DLL enable in the EMRS register. DLL is enabled when bit A0 is low, but the code checked the opposite.

In the Linux kernel's OCFS2 filesystem and its DLM (Distributed Lock Manager) component, a vulnerability was found due to missing validation of the `qr_numregions` field in the `dlm_match_regions()` function. An attacker can send a crafted DLM_QUERY_REGION network message with an inflated `qr_numregions` value, causing an out-of-bounds read beyond the `qr_regions` buffer.

In the Linux kernel, a use-after-free vulnerability was found in the ksmbd module's smb2_open function during durable reconnect. Premature release of the file descriptor reference leads to use of freed memory when accessing file properties upon error or scavenger access.

A vulnerability was found in the Linux kernel's icmpv6_rcv() function for IPv6. Caching source and destination addresses before calling pskb_pull() can lead to a use-after-free (UAF) because pskb_pull() may change the skb->head pointer.

In the Linux kernel netfilter/conntrack subsystem, a stack buffer overflow was found in the mangle_content_len() function. The fix replaces sprintf() with scnprintf() and increases the buffer size.

In the Linux kernel, a vulnerability in the netfilter nfnetlink_osf module causes an out-of-bounds read during TCP option matching. The bug occurs because the shared ctx->optp pointer is not restored after early return in nf_osf_match_one(), leading to garbage data reads and incorrect logging when NF_OSF_LOGLEVEL_ALL is enabled.

In the Linux kernel, a double-free vulnerability in tipc_buf_append() due to tipc_msg_validate() reallocating the buffer. This can lead to memory corruption and potentially privilege escalation.

In the Linux kernel's NVMe-over-TCP driver, a vulnerability was found where nvmet_tcp_build_pdu_iovec() fails to propagate errors (e.g., out-of-bounds PDU length) to its callers. Consequently, callers like nvmet_tcp_handle_h2c_data_pdu() proceed with an uninitialized message iterator, potentially reading network data into an invalid buffer.

In the Linux kernel, unsafe use of simple_strtoul in nf_conntrack_sip was replaced with a new port validation function. The fix prevents out-of-bounds memory access and rejects malformed or overly long port numbers.

A use-after-free vulnerability was discovered in the Linux kernel's rtl8150 driver for USB Ethernet devices. The issue occurs when rtl8150_start_xmit() reads skb->len after usb_submit_urb() is called, while the skb buffer has already been freed by the USB completion handler. This can lead to memory corruption and potential privilege escalation.

In the Linux kernel, a potential out-of-bounds access vulnerability was found in the osdmap_decode() function of the libceph library. The ceph_decode_need() check did not account for the correct number of elements, which could lead to reading beyond the allocated buffer when processing a crafted OSD map message.

In the Linux kernel, the crush_decode() function in libceph is vulnerable to an out-of-bounds access when two fields specifying the bucket algorithm in a CRUSH map differ. This can lead to memory corruption and potential exploitation.

In the Linux kernel, the batman-adv tp_meter module has a vulnerability where uninitialized sender-specific variables are used in batadv_tp_recv_ack() and batadv_tp_stop() when called on a receiver role. A malicious ACK packet can trigger undefined behavior.

A use-after-free vulnerability was found in the Linux kernel's SCTP implementation. When handling a Stale Cookie error (transition from COOKIE_ECHOED to COOKIE_WAIT), the outqueue is not purged, leaving stale scheduler pointers. An attacker can trigger a kernel crash by sending a crafted SCTP packet.

In the Linux kernel, the batman-adv module has a vulnerability due to incorrect payload length accounting during fragment reassembly. This flaw allows malformed fragment chains to bypass validation, potentially causing a local denial of service.

In the Linux kernel, the RDMA/rxe driver has a vulnerability due to incorrect iova-to-va conversion for memory regions (MR) with page sizes different from PAGE_SIZE. This bug causes wrong pointer calculations during memory access, potentially leading to a kernel panic.

In the Linux kernel, KVM/arm64 vgic-its has a bug in vgic_its_invalidate_cache() that can drop the same reference multiple times during concurrent cache invalidation, leading to use-after-free.

In the Linux kernel, a bug in the extract_kvec_to_sg function within the scatterlist library causes incorrect length calculations when extracting data from a kvec to a scatterlist. This can result in an sglist entry exceeding the page size, which is unintended. The vulnerability was introduced in kernel v6.3 and affects v6.5+.

In the Linux kernel, a vulnerability in RAW sockets using IPPROTO_RAW allows malicious ICMP packets to set the protocol field to 255 and match such a socket, leading to FNHE cache changes.

In the Linux kernel netfilter nft_inner module, there is a desynchronization between the transport offset and layer 4 protocol for inner IPv6 packets. The bug overwrites the correct offset calculated by ipv6_find_hdr() with a constant 40 bytes, enabling transport header forgery and potential firewall bypass. This affects stable kernel versions from 6.2.

In the Linux kernel's CIFS/SMB subsystem, a vulnerability was found due to missing validation of the DACL offset (dacloffset) before constructing DACL pointers. A malicious server can supply a dacloffset near U32_MAX, causing pointer wrapping on 32-bit builds and bypassing bounds checks, potentially leading to out-of-bounds memory access.

A vulnerability has been identified in the Linux kernel affecting the symlink_data() function. The issue arises from a lack of length validation for the symlink error response, which may lead to out-of-bounds reads.

A vulnerability has been identified in the Linux kernel that allows for out-of-bounds read in the smb2_compound_op() function. The issue occurs when a server sends a truncated response with a large OutputBufferLength, potentially leading to kernel memory leakage.

A vulnerability in the Linux kernel related to mptcp has been resolved, concerning the mptcp_pm_add_timer() function executed as a timer callback in softirq context. To avoid data races, the socket lock needs to be held with bh_lock_sock().

A race condition was found in the Linux kernel's NVMe/TCP driver (nvmet-tcp) between ICReq handling and queue teardown. Lack of synchronization allows overwriting the queue state, leading to a double kref_put and potential memory corruption.

A vulnerability in the Linux kernel related to out-of-bounds memory access in authentication message processing has been fixed. The issue occurred when a CEPH_MSG_AUTH_REPLY message contained a positive value in its result field, leading to improper processing and sending data beyond the allocated buffer.

A vulnerability has been identified in the Linux kernel within the biovec_phys_mergeable() function, which does not check if bvec segments belong to different dev_pagemaps. This can lead to memory management errors when segments are physically contiguous.

A vulnerability has been identified in the Linux kernel within the rxe_rcv function, which improperly validates the packet length before calculating the payload size. An attacker could exploit this to trigger an underflow error, potentially leading to security issues.

In the Linux kernel, a potential integer overflow in the rxgk_extract_token() function when checking the length of the ticket has been fixed. Instead of rounding up the value to be tested, the size of the available data is rounded down.

A vulnerability related to the re-decryption of RESPONSE packets has been fixed in the Linux kernel. If a RESPONSE packet encounters a temporary failure during processing, it may end up in a partially decrypted state and be requeued for retry.

A vulnerability was found in the Linux kernel's smb2_open_file() function in the SMB client. Failure to zero out @err_iov and @err_buftype pointers before retrying SMB2_open() can lead to a use-after-free (UAF) or double free when @data is not NULL.