Linux kernel vulnerabilities

In the Linux kernel ppp driver, ppp_fill_forward_path() had two race conditions: the channel list could change without locking, and pch->chan could be NULL, leading to kernel panics.

In the Linux kernel, the CIFS (SMB) subsystem has an uninitialized 'buffer' variable in smb3_init_transform_rq(), potentially causing an oops during folio buffer allocation.

A Use-After-Free (UAF) vulnerability was discovered in the Linux kernel's SMC (Shared Memory Communications) module. The issue occurs when smc_listen_out_connected() is called and newclcsock->sk becomes NULL because the application closes the socket immediately after accept. This leads to a NULL pointer dereference when trying to increment SMC statistics.

In the Linux kernel, a vulnerability in the CIFS module can cause a slab out-of-bounds read when mounting a share to a ksmbd server. The issue is due to a missing check in the parse_server_interfaces() function.

In the Linux kernel, the NFS server (nfsd) function nfsd4_setclientid_confirm() does not check the return value of get_client_locked(). A race with an expiring client can lead to use-after-free (UAF).

In the Linux kernel, the DRBD driver is missing a kref_get call in handle_write_conflicts when two-primaries is enabled. This leads to premature device destruction and use-after-free.

A vulnerability in the Linux kernel related to the handling of decryption requests in synchronous mode has been resolved. The handling of no-async decryption requests has been separated from async, simplifying the process and eliminating reference counting issues.

In the Linux kernel, the Ceph filesystem function parse_longname() uses strrchr() on a string that is not NUL-terminated. This may lead to incorrect behavior or potential security issues.

In the Linux kernel's sunrpc module, a vulnerability was found in server-side TLS alert handling. The tls_alert_recv() function incorrectly assumes it can read data from the msg iterator, causing issues with TLS control message processing.

In the Linux kernel's ksmbd module, a race condition was found regarding Preauh_HashValue. When a client sends multiple session requests, improper freeing of Preauh_HashValue memory can occur.

In the Linux kernel for x86/SEV-SNP, a cache coherency vulnerability requires manual cache line eviction during memory validation after a page state change to private. The mitigation involves touching the first and last byte of each 4K page.

In the Linux kernel, the ksmbd module added validation of command request sizes. Previously, except for SMB2_OPLOCK_BREAK_HE, request sizes of other commands were not checked, which could lead to improper processing.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds read in smb2_sess_setup. ksmbd does not consider the case of that smb2 session setup is in compound request. If this is the second payload of the compound, OOB read issue occurs while processing the first payload in the smb2_sess_setup().

In the Linux kernel, there is a vulnerability in ksmbd that involves missing validation of session ID and tree ID in compound requests. If the first operation in a compound request is SMB2 ECHO, validation is bypassed, which can lead to NULL pointer dereference and system crash.

In the Linux kernel, the ksmbd module now prevents guest users from using multichannel. If a session is bound to a guest, the server returns STATUS_NOT_SUPPORTED.

In the Linux kernel MPTCP stack, races between subflow failure and new subflow creation are fixed by adding a separate flag protected by the fallback lock, preventing additional subflow creation in certain socket states.

In the Linux kernel, the libwx network driver has an uninitialized 'dma' field in wx_rx_buffer, potentially causing DMA errors or use-after-free.

A use-after-free vulnerability in the Linux kernel's SMB client (cifs) was found in cifs_oplock_break() due to a race condition during unmount. The cinode structure is accessed after the superblock is released, leading to memory corruption.

In the Linux kernel, a double free in the libwx driver's page_pool_put_full_page() function causes a kernel panic. The issue occurs when the function is called inappropriately, leading to list corruption and system crash.

A use-after-free vulnerability was found in the crypt_message function of the Linux kernel's SMB client module. The issue occurs when hardware crypto accelerators perform asynchronous operations. After removing async handling in the CVE-2024-50047 fix, the request buffer is freed before the crypto operation completes, leading to kernel crashes.

A use-after-free vulnerability was found in the Linux kernel's rpl_do_srh_inline() function in the RPL module. The function fetches an IPv6 header pointer and accesses it after calling skb_cow_head(), which can lead to accessing freed memory. The fix changes the pointer to a local struct.

A crash in the Linux kernel's nf_conntrack module occurs when removing an uninitialized entry from the hash bucket list due to a race condition. The confirmed bit (IPS_CONFIRMED) is set before the entry is added to the hash table, leading to a null pointer dereference.

In the Linux kernel, a use-after-free bug was found in the TLS subsystem when reading a socket. After TCP changes that compact skbs more aggressively, TLS may try to operate on a freed skb while checking the queue's decryption state.

In the Linux kernel, the bnxt_en driver has a vulnerability where the DMA unmap length is incorrectly set to 0 for XDP_REDIRECT packets. This triggers a warning and potential issues on systems with IOMMU enabled.

In the Linux kernel NFSD, nfsd4_spo_must_allow() does not check if the request is a v4 compound. If not, examining cstate can yield undefined results.

In the Linux kernel MHI EP driver, the read pointer (rd_offset) is updated before the buffer is written, potentially causing race conditions where the host sees an updated pointer before the element is fully written, leading to data corruption.

In the Linux kernel, a double put of a request was found in the netfs subsystem. If a netfs request finishes during the pause loop, the IN_PROGRESS flag is cleared, but the subsequent wait loop may release the reference again, leading to incorrect behavior.

In the Linux kernel, a race condition was found between file rename and directory logging in the Btrfs filesystem. This bug can cause the log replay to delete the file being renamed if a crash or power failure occurs before the rename completes.

In the Linux kernel ksmbd (SMB) server, the free_transport function for TCP connections can be called from smbdirect context, causing a kernel oops. A free_transport operation was added to the connection structure with separate implementations for TCP and smbdirect.

In the Linux kernel, a vulnerability in the bnxt_en driver causes improper flushing of XDP redirect lists, leading to list corruption and kernel panic during XDP_REDIRECT processing.

In the Linux kernel's RDMA/iwcm subsystem, a use-after-free vulnerability was found on work objects after cm_id destruction. The issue occurs when the last reference to cm_id is removed in the event handler context, leading to memory corruption and potential code execution.

In the Linux kernel, a vulnerability in the nvme-tcp driver causes a use-after-free bug due to improper tag set management during the second admin queue configuration. The first call succeeds, but the second fails without removing the tag set, leading to access to freed memory.

In the Linux kernel, a vulnerability in the openvswitch module causes an infinite loop when parsing MPLS packets. An unexpected MPLS packet may lack the bottom label stack, and with many labels the counter wraps, leading to a dead loop and CPU soft lockup.

A vulnerability in the Linux kernel's netfs write-retry mechanism incorrectly resets the subrequest iterator, causing a slab-out-of-bounds read detected by KASAN. This can lead to a system oops.

In the Linux kernel t7xx WWAN driver, a NAPI RX poll issue occurs: after network interface disconnection (dellink), the netdev is freed but still used during skb processing in polling, causing a kernel panic (NULL pointer dereference).

In the Linux kernel netfilter nf_set_pipapo_avx2 module, an initial map fill bug: if the first field doesn't cover the entire start map, remaining bits are not zeroed, leaking those bits into the next match round. The fix for the C implementation was incomplete.

In the Linux kernel's sunrpc module, a vulnerability was found allowing remote crashes. A crafted packet can cause SVC_GARBAGE to be returned without setting the rq_accept_statp pointer, leading to NULL dereference and system crash.

In the Linux kernel, a race condition in the SCSI target iSCSI subsystem causes the NOPIN response timer to restart after connection deletion, leading to a NULL pointer dereference and system crash.

A vulnerability was found in the Linux kernel's BPF subsystem where the bpf_redirect_peer function does not scrub redirected packets. This allows information from one network namespace to be misused in another, causing issues such as Cilium dropping IPsec traffic.

In the mtk_eth_soc Ethernet driver (Linux kernel), a bug was found causing a system panic with 4GB+ RAM. The mtk_poll_rx() function incorrectly handled the MTK_RESETTING flag, leading to processing of an incorrect SDP descriptor and a panic.

In the Linux kernel, a use-after-free vulnerability in Kerberos authentication in ksmbd has been resolved. Setting sess->user = NULL was introduced to fix the dangling pointer created by ksmbd_free_user, but another thread could operate on the session and use sess->user after it has been passed to ksmbd_free_user but before sess->user is set to NULL.

A vulnerability in the Linux kernel's socket lookup functions can return a pointer to inet_timewait_sock, which when passed to sock_put() instead of sock_gen_put() causes a memory access violation and system crash.

In the Linux kernel's 9p/net module, a vulnerability was found in handling negative read/write replies. A server can reply with success but a negative byte count, causing comparison errors and potential NULL pointer dereference.

In the Linux kernel, the NVMe target subsystem (nvmet) has a use-after-free (UAF) vulnerability in nvmet_req_complete(). The queue_response() operation implementation may free the request passed as an argument, and then percpu_ref_put() may dereference the freed pointer. The fix saves the sq pointer in a local variable before calling __nvmet_req_complete() to avoid dereferencing the freed pointer.

In the Linux kernel, the ceph module has a double-free vulnerability when decoding snaps fails. This can lead to random use-after-free, BUG_ON, or other issues.

In the Linux kernel, the ksmbd subsystem (SMB server) has a dangling pointer issue in krb_authenticate. The function frees sess->user but does not set the pointer to NULL. It then calls ksmbd_krb5_authenticate, which may not reinitialize sess->user, leading to access of freed memory in smb2_sess_setup.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's SMB client during decryption with multichannel. After code changes, channels started reusing the AEAD TFM from the primary channel, causing concurrent access from multiple threads and a race condition that leads to accessing freed memory.

In the Linux kernel, the netfilter nfnetlink_queue subsystem uses an uninitialized 'ctx' variable in nfqnl_build_packet_message(), potentially causing memory allocation errors.