CVE Vulnerability Catalog

In the Linux kernel, the in-kernel MPTCP path manager left a stale ADD_ADDR announcement when removing the id 0 endpoint, because that path did not tear down pending announcements. Later reselecting id 0 hit the stale anno_list entry and triggered WARN_ON_ONCE in mptcp_pm_announced_alloc(). The fix makes the id 0 removal path symmetric.

In the Linux kernel SMB client, CIFSSMBRead() reads READ_RSP header fields without first verifying that a complete READ_RSP was received. A malicious or compromised SMB1 server can return a response shorter than the READ_RSP header, causing an out-of-bounds read past the receive buffer. This only affects mounts explicitly configured with vers=1.0, as SMB1 is not negotiated by default.

In the Linux kernel SMB client, the cifs.idmap key type lacks a vet_description hook, unlike its sibling cifs.spnego. This allows userspace to create keys of this type via request_key(2)/add_key(2) and supply authority-bearing fields (owner/group SIDs, uid/gid) without CIFS origin. A request_key(2) call with a non-NULL callout then triggers a root usermodehelper upcall that consumes the unvetted description in root context.

In the Linux kernel, the CIFSSMBRead() function (SMB1 client) did not validate the DataOffset field in the server response. A malicious or compromised SMB1 server can return a large DataOffset with a valid DataLength, causing an out-of-bounds read past the response buffer — leaking kernel heap memory (information disclosure) or triggering an oops (denial of service). The vulnerability only affects mounts explicitly using vers=1.0, as SMB1 is not negotiated by default.

In the Linux kernel SMB client, tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super() takes its active reference only after iterate_supers_type() has dropped s_umount and its passive reference. Concurrent DFS automount expiry can therefore free the superblock before cifs_sb_active() uses it, resulting in a use-after-free. The fix takes the active reference in the callback while iterate_supers_type() still holds s_umount shared.

In the Linux kernel SMB client, several code paths unconditionally called sid_to_id(), overwriting cf_uid/cf_gid with server-provided values despite mounts using forceuid/forcegid options. This affected smb311_posix_info_to_fattr(), cifs_posix_to_fattr(), and parse_sec_desc(). It allowed an untrusted server to dictate local file ownership against the administrator's explicit configuration.

In the Linux kernel SMB client, smb2_parse_native_symlink() copies smb_target+1 (skipping the leading separator) when parsing a share-root relative native symlink, but uses strlen(smb_target)+1 as the length, reading one byte past the allocated buffer. This results in an out-of-bounds read, as confirmed by a KASAN report. The issue occurs when accessing an SMB symlink with a target such as '\a\b'.

In the Linux kernel's SMB client, a problem was found in DACL rewrite: the size accumulator using u16 can wrap, leading to corruption of the DACL sent to the server. The fix changes the type to u32 and returns -EOVERFLOW on overflow.

In the Linux kernel's SMB client, there is a cifsFileInfo reference leak in the deferred close mechanism due to a race condition between flags. The fix checks the return value of queue_delayed_work() and hands off the reference only if the work was actually queued.

In the Linux kernel's SMB client, there is a reference leak in cifs_queue_oplock_break() — the reference is always taken, but if the work is already queued, it is not released. The fix takes the reference only after successful queueing.

In the Linux kernel's SMB client, there is a reference leak in cifs_oplock_break() when cifs_sb_tlink() fails in multiuser mode. The fix releases the reference on that error path as well.

In the Linux kernel's SMB client, there is a heap overflow when rewriting DACL owner/group: the buffer is allocated based on the original DACL size, but SID substitution can enlarge each ACE, causing out-of-bounds write. The fix always allocates worst-case size considering maximum SID expansion.

In the Linux kernel's SMB client, cifs_posix_to_fattr() ignores the return value of posix_info_parse(), which can lead to using uninitialized SIDs and potentially leaking kernel stack data to the ID mapping process. The fix checks the return value and skips SID mapping on parsing failure.

In the XFS filesystem, a lock is missing when inserting the unmount event into the health monitor. The fix adds proper locking.

In the XFS filesystem, xfs_defer_finish_one() may return an uninitialized error value when the list is empty, which can lead to a false shutdown of the filesystem. The fix initializes the error variable to 0.

In the XFS filesystem, an incorrect args->total value during parent pointer updates can lead to improper free space checking and ENOSPC errors that escalate to a filesystem shutdown. The fix sets args->total in add and replace paths, similar to log recovery.

In the XFS filesystem, the unit conversion in the per_binval computation is backwards, leading to incorrect space calculation. The fix changes the conversion direction from FSB to bytes.

A vulnerability in the Linux kernel's XFS filesystem causes under-reservation of blocks when repairing shortform directories. Incorrectly setting args->total to 1 instead of the actual directory block count (fsbcount) triggers an assertion failure and can lead to a filesystem shutdown.

In the Linux kernel, the _maxlevels_ondisk functions for rtrmap and rtrefcount in XFS fail to account for the inode root when computing the size of in-memory btree cursors. With a sufficiently large btree, this can lead to accessing beyond the end of the cursor.

In the Linux kernel, XFS's xmi_can_exchange_reflink_flags() can move the reflink flag between files during range exchange, but when XFS_EXCHMAPS_INO1_WRITTEN is set, some mappings may be skipped. This can clear the reflink flag from an inode that still owns shared written extents, leading to data corruption.