Linux kernel vulnerabilities

A vulnerability in the Linux kernel's CIFS module can cause a system crash (oops) during oplock break handling. The issue stems from a race between deferred close and lease breaks, potentially leading to an invalid pointer dereference during filesystem unmount.

A vulnerability was found in the Linux kernel's SMC (Shared Memory Communications) module. The smc_llc_srv_add_link() function lacked proper protection, which could lead to a race condition and result in a system panic (crash) when the server attempts to create a second link.

In the Linux kernel, a vulnerability in the mlx5e driver for Mellanox network cards causes invalid buffer access in XSK mode for legacy rq. The issue leads to double release of the buffer in the XDP_REDIRECT path, potentially causing a system crash.

In the Linux kernel, in the scsi: target: iscsit module, there is a vulnerability where commands from recovery entries are freed after the session has been closed, leading to use-after-free or NULL pointer dereference. The fix moves cleanup of recovery entries to before session freeing.

In the Linux kernel, the qla2xxx SCSI driver has issues after chip reset: commands sent to firmware are not freed, and handling them causes BUG_ON errors and DMA mapping problems.

In the Linux kernel, the qla2xxx SCSI driver has a bug where it incorrectly frees a purex item using kfree() instead of qla24xx_free_purex_item(), which can cause memory corruption when the item comes from a pre-allocated pool.

A vulnerability in the Linux kernel causes skb corruption during frag list segmentation. The issue occurs when packets processed by rx-gro-list are fed via a bridge to both local input and an egress device (tun), leading to unsafe writes to cloned skbs with shared heads. This results in critical errors such as NULL pointer dereference.

In the Linux kernel, a vulnerability in the ixgbe driver causes a system panic during XDP_TX on machines with more than 64 CPUs. The issue stems from incorrect indexing of XDP TX rings, which does not apply the modulo 64 limit, leading to an out-of-bounds array access and NULL pointer dereference. Additionally, the locking mechanism (ixgbe_xdp_locking_key) is incorrectly decremented during configuration changes, allowing the bug to trigger.

In the Linux kernel, the SMB client (cifs) has a missed session refcounting issue. The new helper cifs_smb_ses_inc_refcount() is used to get active references, preventing use-after-free.

In the Linux kernel, the nvmet-tcp module lacked a bounds check for the Transfer Tag (ttag), which is used as an index into the command array. A bounds check was added to prevent out-of-bounds access.

In the Linux kernel, the aead crypto framework has a reqsize handling issue. Using cra_reqsize instead of crypto_aead_set_reqsize() leads to memory corruption and crashes.

A double-free vulnerability in the Linux kernel's Btrfs filesystem was found in the qgroup record handling. The issue occurs when add_delayed_ref_head() fails after the record was already traced by btrfs_qgroup_trace_extent_nolock(), leading to both caller and callee attempting to free the same memory.

In the Linux kernel, the enc_dec_hypercall() function was changed to accept a size instead of a page count. The previous version forced rounding up, causing pages to be incorrectly marked as decrypted during live migration, leading to consistent data corruption.

In the Linux kernel's ceph module, a potential use-after-free bug exists when trimming caps. After releasing 'session->s_cap_lock', another thread may remove the cap, and using stale memory in callbacks causes a crash. The fix checks cap existence after acquiring 'ci->i_ceph_lock'.

In the Linux kernel, the veth interface has a race condition related to the xdp_no_direct section. After NAPI completion, another CPU may start a new NAPI instance, leading to concurrent access to the BPF context and a potential race.

In the Linux kernel's atlantic driver for Aquantia network cards, a vulnerability exists due to missing fragment count validation in the RX path. Packets with more than 17 fragments cause an out-of-bounds write in skb_add_rx_frag_netmem(), leading to a kernel panic.

In the Linux kernel's libceph, a use-after-free vulnerability was found in have_mon_and_osd_map(). Lack of locking when accessing monmap and osdmap can cause dereference of freed memory, as shown by KASAN errors.

In the Linux kernel's libceph library, the handle_auth_session_key() function lacks validation of the length field from network packets. The len field originates from untrusted packets, potentially leading to out-of-bounds writes when decrypting the connection secret or processing service tickets.

In the Linux kernel, a vulnerability was resolved in the ksmbd: ipc module — a use-after-free in ipc_msg_send_request. The ipc_msg_send_request() function waits for a generic netlink reply using an ipc_msg_table_entry on the stack; the generic netlink handler fills entry->response under ipc_msg_table_lock, but ipc_msg_send_request() validated and freed entry->response without holding the same lock. Under high concurrency this allows a race where handle_response() copies data into entry->response while ipc_msg_send_request() has just freed it, leading to a slab-use-after-free reported by KASAN.

In the Linux kernel's USB network driver qmi_wwan, the qmimux_rx_fixup function does not initialize the MAC header offset for raw IP packets. This leaves skb->mac_header uninitialized, potentially causing a kernel panic on ARM64 when subsystems like xfrm access the offset.

In the mlx5e driver (Linux kernel), a bug was found in XDP buffer handling for striding RQ. XDP programs can change the xdp_buff layout, but the driver assumed it was unchanged, leading to erroneous skb generation or a kernel warning.

In the Linux kernel's nvmet-fc module, a double scheduling of association deletion was found. When forcefully shutting down a port via configfs, both nvmet_port_del_ctrls() and nvmet_disable_port() can schedule the same association for deletion, leading to double resource freeing.

In the Linux kernel, in the RDMA/siw subsystem, a bug was fixed where QP destruction did not wait for all references to be dropped. The destruction completion was delayed until all siw references to the QP are released, preventing a use-after-free.

In the Linux kernel's cifs module, a session state check issue during reconnect can lead to a use-after-free. The fix prevents collecting an exiting session in smb2_reconnect_server() because it will be released soon.

In the Linux kernel, the sev-guest module now double-buffers messages. Previously, encryption algorithms read and wrote directly to shared unencrypted memory, potentially leaking information and allowing the host to tamper with message integrity.

In the Linux kernel, cifs has a potential use-after-free in TCP_Server_Info::hostname. Protecting access outside the reconnect path prevents potential use-after-free bugs.

In the SMB client (cifs) in the Linux kernel, a potential use-after-free vulnerability was found in smb2_query_info_compound. During retries, a previously allocated cfid could be freed, and the lack of pointer reset led to use-after-free.

In the Linux kernel, the NVMe over Fabrics (nvme-fc) driver has a vulnerability due to incorrect call ordering during controller deletion. The `nvme_fc_delete_association()` function can queue `->ioerr_work` after `cancel_work_sync()` has already been called, leading to list corruption and kernel panic.

In the Linux kernel, a refcount leak in nfsd_set_fh_dentry() occurs when an NFSv3 (or v2) client uses a pseudo-root filehandle. The export is stored in svc_fh but the reference is dropped, leading to a double free and potential use-after-free.

In the Linux kernel TLS subsystem, if tls_strp_msg_hold fails for async decryption, it can lead to use-after-free (UAF) of the skb or writing to userspace memory after recv() returns.

In the Linux kernel, the CIFS module's parse_dfs_referrals function lacks input validation for SMB server replies. A malicious server can send a reply smaller than expected or with an invalid number of referrals, causing an out-of-bounds memory read.

In the IPv4 stack of the Linux kernel, functions icmpv4_xrlim_allow() and ip_defrag() were changed to prevent a potential use-after-free vulnerability. Also, dst_dev_rcu() with lockdep support was added to several other functions.

In the Linux kernel, the SMB client's smb2_compound_op() function uses incorrect indices when processing compound command responses. This can lead to improper handling of results and, if the index exceeds MAX_COMPOUND, to out-of-bounds memory accesses.

A vulnerability in the Linux kernel's 'ice' network driver causes a memory page leak when handling multi-buffer frames. The issue occurs when hardware posts a descriptor with size 0, skipping buffer release and leaving a stale page in the RX ring.

In the Linux kernel, a vulnerability was found in the ksmbd module (SMB server) in SMBDirect data transfer handling. Invalid data_offset and data_length fields in the smb_direct_data_transfer structure can lead to out-of-bounds memory access.

In the Linux kernel SMB client, the recv_done function did not properly verify the data_offset, data_length, and remaining_data_length fields, potentially leading to incorrect handling of server responses.

In the Linux kernel's SMB client (cifs) driver, a vulnerability was found due to missing synchronization during RDMA connection destruction. The smbd_destroy() function does not wait for post_send_credits_work to complete, potentially causing use-after-free and triggering errors in the RDMA stack (rxe).

In the Linux kernel TIPC module, during link MTU negotiation, a malicious peer can send an Activate message with a very small MTU (e.g., 4). Without checking the minimum MTU, this value is set as the link MTU, leading to an integer overflow when calculating message size and potentially causing a system crash.

In the Linux kernel, an invalid access bug was found in the libceph library to the ceph_connection_v1_info union. Generic code in messenger.c reads and writes to the v1 union member without checking if it is active (i.e., msgr1 is in use). This can lead to reading invalid values or writing to overlapping fields.

In the lpfc SCSI driver (Linux kernel), a use-after-free window was found in the deferred receive path. The bug was due to incorrect order of freeing the RQ buffer and clearing the context pointer, which could lead to double-free or UAF.

In the Linux kernel, NFSD has a send buffer overflow vulnerability in NFSv2 READ. A client can send an excessively large RPC record, shrinking the reply buffer and preventing full payload construction, potentially leading to overflow.

A vulnerability in the Linux kernel's SMC (Shared Memory Communications) module was found. When trying to use SMCRv2 and then falling back to SMCRv1, resources assigned to the connection are not reset, leading to a NULL pointer dereference and system crash.

In the Linux kernel, NFSv4.2 has a double-free of scratch buffer in READ_PLUS. The fix moves scratch handling to pageio code, preventing double-free and oops during decoding hole segments.

In the Linux kernel, the lwt (lightweight tunnels) subsystem has an issue with return values of BPF xmit ops. Functions skb_do_redirect and bpf_lwt_xmit_reroute can return various positive values that are incorrectly treated as LWTUNNEL_XMIT_CONTINUE, leading to use-after-free and kernel crashes. The fix discards skb_do_redirect return values and converts bpf_lwt_xmit_reroute return values.

A race condition between login_work and the login thread in the Linux kernel's iSCSI target subsystem was found. A malicious initiator can send data after a login PDU, causing login_work to never stop and, after connection drop, a freed socket structure is dereferenced, leading to a kernel crash.

In the Linux kernel, NFSD has a send buffer overflow vulnerability in NFSv2 READDIR. The previous limit on the @count argument was restored to prevent buffer overflow attacks.

In the Linux kernel, the RDMA/siw driver's siw_tcp_sendpages function incorrectly set the byte count in iov_iter and tcp_sendmsg_locked call, causing oversized iterations. This led to out-of-bounds reads and crashes after recent slab allocator changes.

The s390/ism driver in the Linux kernel lacks synchronization for request-response sequences, allowing concurrent commands to the same ISM function. This can cause command corruption, DMA errors, and the function entering an error state (PEC 2/3A), breaking existing connections and preventing new ones.

A vulnerability in the Linux kernel's HSR (High-availability Seamless Redundancy) layer causes a kernel panic (BUG) when processing HSR frames with an incomplete tag. The lack of proper frame length validation before adding the HSR tag leads to an skb underflow (skb_under_panic).