Linux kernel vulnerabilities

In the Linux kernel RDMA/iwcm subsystem, a vulnerability causes workqueue list corruption. The issue stems from the incorrect assumption that queue_work() would not enqueue work if already pending, while each iwcm_work object has a unique work_struct. This allows multiple entries to be processed in a single handler run, freed to the free list, and reused, leading to list corruption.

In the Linux kernel, during skb coalescing in skb_try_coalesce(), the SKBFL_SHARED_FRAG marker is not propagated, breaking an invariant for later in-place writers. This can cause ESP processing errors where data is decrypted in place over page-cache backed frags.

An attacker sending TCP, IL, RUDP, or GRE packets with a length less than the header size can trigger a kernel panic.

In the Linux kernel, a vulnerability exists in handling the IPv6 Source Routing Header (SRH). During decompression and recompression of SRH, if the recompressed header is larger than the received one, an out-of-bounds write can occur in ipv6_rthdr_rcv. The issue arises when headroom is insufficient, leading to memory corruption.

In the Linux kernel, a vulnerability was found in the RxRPC protocol implementation where DATA and RESPONSE packet handlers did not check for shared page fragments (e.g., from splice()). This allowed in-place decryption on shared pages, potentially leading to data integrity issues.

In the Linux kernel, a double free of the fcport structure was found in the qla2xxx SCSI driver. The function qla2x00_els_dcmd_sp_free() frees fcport, and a subsequent kref_put() call triggers a second free, potentially causing memory corruption.

A vulnerability has been identified in the Linux kernel related to improper management of kthread exit paths, leading to a use-after-free issue. The problem was reported during KUnit testing, where crashes occurred due to corrupted RCU callback function pointers.

A vulnerability in the Linux kernel related to MAC comparison in the tcp-md5 protocol has been fixed to prevent timing attacks.

A vulnerability has been identified in the Linux kernel affecting the smb_lazy_parent_lease_break_close() function. The opinfo pointer is accessed after the RCU read unlock, leading to race conditions and potential use-after-free.

A vulnerability has been identified in the Linux kernel that allows for a buffer overflow in the ioam6_fill_trace_data() function. The issue arises from improper storage of the schema length, leading to a bypass of the remaining space check in the trace buffer.

A vulnerability was found in the Linux kernel's ESP (Encapsulating Security Payload) implementation for IPv4/IPv6. The UDP datagram append paths did not mark shared pipe pages with the SKBFL_SHARED_FRAG flag, allowing in-place decryption without making a private copy. An attacker could exploit this to read or modify ESP data in UDP packets originating from shared pages.

A vulnerability has been identified in the Linux kernel that has been resolved. The issue concerns passing flow_id to the set_rps_cpu() function, which may lead to out-of-bounds access and system crashes.

A race condition was found in the Linux kernel's tcp_v6_syn_recv_sock() function. After tcp_v4_syn_recv_sock() returns, the child socket is already visible in the TCP ehash table, but the pinet6 pointer still points to the listener's structures, potentially causing issues.

In the Linux kernel, a vulnerability was found in netconsole where the message passed from the console subsystem is not guaranteed to be null-terminated, leading to out-of-bounds reads. KASAN reported a slab-out-of-bounds error during message processing.

In the Linux kernel, the dlm_search_rsb_tree function lacks validation of the len parameter from network messages. When exceeding DLM_RESNAME_MAXLEN, it can cause an out-of-bounds write.

In the Linux kernel, the AVX2 implementation for pipapo sets in netfilter has a bug that returns non-matching entries on expiry. The issue occurs when AVX2 match functions process the last field without consuming the entire input, leading to false element collision reports.

A vulnerability has been identified in the Linux kernel that involves missing packet data copying from the XDP buffer to the skb structure, leading to kernel memory leakage to user space. Additionally, improper skb recycling marking may corrupt the page pool state.

In the Linux kernel, a vulnerability in ip6_err_gen_icmpv6_unreach() fails to clear the cb[] field in skb2, leading to misinterpretation of control data. An attacker can send a crafted ICMPv4 packet with a CIPSO option, causing an out-of-bounds read in icmp6_send().

A vulnerability was found in the Linux kernel's ip4ip6_err() function in the IPv6-over-IPv4 tunnel. An uninitialized cb[] area in a cloned skb can be misinterpreted as an IPv4 structure, leading to attacker-controlled data reads and a stack buffer overflow.

In the Linux kernel X.25 stack, a double free of a socket buffer (skb) was discovered. When x25_queue_rx_frame fails to allocate memory, it frees the skb and returns an error, but the caller x25_backlog_rcv also attempts to free the same skb, causing a double free.

A vulnerability has been identified in the Linux kernel related to use-after-free in the __ksmbd_close_fd() function. The issue arises when a durable file handle survives session disconnect, leading to improper management of byte-range locks.

In the Linux kernel, a vulnerability was found in the bridge's br_nd_send() function, which parses neighbor discovery (ND) options from ICMPv6 packets. The function assumed these options are in the linear part of the buffer, but in some cases they can be non-linear, leading to out-of-bounds memory access. The fix linearizes the skb before parsing ND options.

A use-after-free vulnerability was found in the Linux kernel's MPTCP implementation, specifically in __inet_lookup_established. The issue arises from incorrect initialization of the TCPv6 protocol for MPTCP subflow child sockets, which are allocated via kmalloc instead of the proper slab cache with SLAB_TYPESAFE_BY_RCU flag. This allows concurrent access to freed memory during ehash table lookups, potentially leading to security breaches.

In the Linux kernel, the stmmac driver has an integer underflow vulnerability in chain mode. The jumbo_frm() function computes len = nopaged_len - bmax, which wraps when the linear portion is small but total packet size is large, causing excessive iterations and mapping arbitrary kernel memory to DMA. This leads to kernel memory disclosure and potential memory corruption.

In the Linux kernel USB/IP driver, a vulnerability exists due to missing validation of the number_of_packets field in the RET_SUBMIT response. A malicious USB/IP server can set this value larger than the original, causing a heap out-of-bounds write when processing ISO packets.

A vulnerability in the Linux kernel has been resolved by directly calling the ->free_folio() function in folio_unmap_invalidate(). The issue was that calling filemap_free_folio() without properly locking the mapping could lead to a use-after-free error.

In the Linux kernel's TLS module, a use-after-free vulnerability was found in the -EBUSY error path of tls_do_encryption. Double cleanup of encrypt_pending and scatterlist entry corrupts data structures, allowing a callback on freed memory.

A vulnerability has been identified in the Linux kernel regarding invalid folio access when i_blkbits differs from I/O granularity. This issue affects situations where IO can be submitted for less than the full folio, leading to improper management of the folio context.

In the Linux kernel ext4 filesystem, a vulnerability causes an infinite loop during mkdir/mknod operations. When mapping logical blocks to physical blocks fails after inserting a new extent, the freed physical block is reused by an xattr block, leading to a deadlock and thread blocking for 143 seconds.

A vulnerability has been identified in the Linux kernel within the smb_grant_oplock() function, leading to use-after-free and NULL dereference issues. These problems arise from an improper publication sequence of oplock, potentially resulting in unpredictable system behavior.

In the Linux kernel netfilter subsystem, a fix was applied for unsafe use of nfct_help() without holding a reference to the master conntrack entry when dumping helper names in ctnetlink and /proc. The patch uses expect->helper instead to avoid potential memory safety issues.

In the Linux kernel dvb-net driver, an out-of-bounds read vulnerability exists in ULE extension header tables. The htype index derived from network data can be 255, causing an out-of-bounds read on a 255-element array, and the read value may be called as a function pointer.

A heap overflow vulnerability was found in the Linux kernel's NFSD module (NFSv4.0) in the LOCK replay cache. The fixed 112-byte buffer cannot accommodate variable-length lock owner fields (up to 1024 bytes), leading to an out-of-bounds write.

In the Linux kernel, the netfilter nf_conntrack_h323 DecodeQ931() function fails to check for zero length before decrementing, causing an integer wrap and out-of-bounds read.

A vulnerability was found in the Linux kernel's smc_tcp_syn_recv_sock() function in the SMC module. A race condition between closing an SMC socket and TCP connection handling in softirq context leads to NULL pointer dereference or use-after-free (UAF). An attacker could exploit this to cause a system panic.

In the Linux kernel's Btrfs filesystem, a vulnerability was found where conflicting inodes are not detected when logging inode references after a rename exchange operation. This can cause the log replay to attempt deleting a directory containing a subvolume, resulting in a mount failure.

In the Linux kernel btrfs filesystem, btrfs_get_or_create_delayed_node() had a memory ordering bug after moving refcount_set inside the critical section, potentially leading to a use-after-free.

In the Linux kernel, the libceph decode_pool() function lacked proper bounds checking when decoding a corrupted OSD map. A maliciously crafted map can lead to out-of-bounds memory reads.

A bug in the Linux kernel's STMMAC driver causes a crash when executing XDP_TX action in zero copy mode. The issue is due to missing memory type check of the XDP buffer before use, leading to invalid mappings and system panic.

In the Linux kernel e1000 driver, an out-of-bounds (OOB) read vulnerability was found in e1000_tbi_should_accept(). The issue occurs when the descriptor-reported frame length is zero or exceeds the RX buffer size, causing a read beyond allocated memory and potentially crashing the system.

In the Linux kernel svcrdma component, svc_rdma_copy_inline_range did not verify that the rc_curpage index stays within the allocated page array, potentially causing out-of-bounds read/write.

In the Linux kernel, the ksmbd module has a use-after-free vulnerability during concurrent tree-connection disconnection. The tcon object is freed on one path while another path still holds a reference.

In the Linux kernel svcrdma, svc_rdma_copy_inline_range uses rc_curpage (page index) instead of rc_pageoff (byte offset) for memcpy, causing copies to land outside the current page.

In the Linux kernel, a data race on the m_flags field in the ksmbd vfs_cache structure was found. Some functions read and modify this field without proper locking, potentially causing loss of delete-on-close state or inconsistency.

In the Linux kernel iomap, iomap_adjust_read_range() assumes block-aligned positions and lengths, which is not always true (e.g., in erofs). This causes skipping too many bytes for uptodate blocks, leading to incorrect read position and length.

In the Linux kernel net/handshake, duplicate handshake cancellations cause a socket leak. When a second cancellation arrives, remove_pending() returns false, but the socket reference count is still decremented, leading to underflow.

In the Linux kernel, the RDMA/irdma module has a data race on the cqp_request->request_done field. The field is read without locking in irdma_handle_cqp_op while being updated in irdma_cqp_ce_handler. The issue was fixed by using READ_ONCE/WRITE_ONCE macros to prevent compiler optimizations and KCSAN warnings.

In the Linux kernel, there is a race condition in the CIFS filesystem when connecting to an IPC tree. Access to the hostname field in TCP_Server_Info is not properly protected, which can lead to it being freed in the cifsd thread and cause a use-after-free in __tree_connect_dfs_target().

In the Linux kernel, there is a double free of the xprt_ctxt pointer in the SUNRPC service. When an RPC request is deferred, the pointer is moved to svc_deferred_req, but on a second deferral it is not cleared, leading to double free or adding to a free list, which can cause an oops.