CVE Vulnerability Catalog

In the Linux kernel BPF verifier, the pointer type for atomic RMW operations is recorded only when the current destination is PTR_TO_ARENA. A second path can reach the same instruction with an ordinary pointer without comparing it against the saved arena type, leading to incompatible use of the instruction.

In the Linux kernel's ksmbd module, check_lock_range() uses inclusive ranges, so start == end represents a valid single-byte range rather than an empty range. The start == end shortcut skipped mandatory byte-range lock checks for one-byte reads, writes, copychunk operations and one-byte truncate ranges, allowing the operation to proceed despite a conflicting lock.

In the Linux kernel's SMB server (ksmbd), the buffer returned by ksmbd_ipc_login_request_ext() was not freed after ksmbd_alloc_user() calls, causing a memory leak visible in kmemleak. The fix frees this buffer unconditionally.

A slab-out-of-bounds read vulnerability exists in the ksmbd module of the Linux kernel in the ksmbd_alloc_user() function. The function copies resp->hash_sz bytes from the mountd IPC login response, where hash_sz is a __u16 supplied by the response and is not validated against the size of the hash[] buffer (KSMBD_REQ_MAX_HASH_SZ). A malformed or malicious login response can set hash_sz up to 65535, causing the memcpy() to read past the end of the response object.

In the Linux kernel's smb (smbdirect) module, completion queues created by ib_alloc_cq_any() were torn down with ib_destroy_cq(), which did not cancel the previously queued ib_cq_poll_work(). A late completion (e.g. an RNR error from Soft-RoCE/rxe) re-queued the poll work on the already-freed CQ, causing a use-after-free.

In the Linux kernel, the rdma_accept_failed error path of smbdirect_accept_connect_request() destroyed memory pools before destroying the QP. This left an outstanding recv_io object at kmem_cache_destroy() time, triggering a "Slab cache still has objects" warning and later a NULL-pointer dereference in mempool_free_bulk.

A vulnerability in the Linux kernel's SMB Direct (smbdirect) module releases pending child sockets before destroying the listener's cm_id, leading to a use-after-free in _cma_cancel_listens(). This can cause a kernel crash or potential privilege escalation.

In the Linux kernel's ksmbd module, ipc_validate_msg() reads length fields (payload_sz, session_key_len, ngroups) from the response buffer supplied by the userspace ksmbd daemon before verifying the buffer is large enough. A short response causes an out-of-bounds read past the end of the allocation, triggering a KASAN slab-out-of-bounds error.

In the Linux kernel's ksmbd module, preauthentication sessions (preauth_session) were not freed on connection teardown. If a client disconnected before sending the authenticate request, the object allocated during NTLM negotiate was not freed by either the authenticate or error cleanup paths, causing a memory leak.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No further vulnerability information is available.

In the Linux kernel's ksmbd module, close may abort an in-flight oplock break while another breaker already holds an opinfo reference. Without serializing the close transition with bit acquisition, close can become a new break owner through the test_and_set_bit() fast path and overwrite OPLOCK_CLOSING with OPLOCK_ACK_WAIT, continuing a break for a dying opinfo.

In the Linux kernel, the SMB server (ksmbd) has a null pointer dereference vulnerability in ksmbd_ipc_tree_connect_request(). The issue occurs when the share name allocation (share->name) fails and the code does not check for this error before using the name in strlen().

In the Linux kernel, the SMB server (ksmbd) has an invalid pointer dereference vulnerability in ksmbd_stop_durable_scavenger(). When thread creation (kthread_run) fails, dh_task contains an ERR_PTR error, and a later call to kthread_stop() on that pointer leads to an invalid dereference.

In the Linux kernel, the SMB server (ksmbd) function ksmbd_server_init() does not abort initialization when ksmbd_proc_init() fails. ksmbd_proc_init() returns void, so allocation errors are not detected, leading to use of invalid pointers during later calls to ksmbd_proc_reset() and creation of entries in /proc.

In the Linux kernel, the SMB server (ksmbd) during module initialization, when a later initializer fails, ksmbd_proc_cleanup() is not called, leading to resource leaks (proc tree and per-CPU counters).

In the Linux kernel, the SMB server (ksmbd) has a Use-After-Free and double-free vulnerability in smb2_lock(). Granted locks are published to conn->lock_list and fp->lock_list immediately after vfs_lock_file() succeeds, but they also remain on the rollback_list. If a later element in the request array fails, the rollback loop may free an already-freed object, as a concurrent UNLOCK request can remove it.

In the Linux kernel, the EROFS filesystem has an out-of-bounds read vulnerability in the case of invalid interlaced ztailpacking pclusters. Filesystem images can contain invalid clusters, leading to a read from a kmap'd page and copying irrelevant kernel memory into userspace-visible page cache.

In the Linux kernel, the lwt_bpf module has a vulnerability due to incorrect headroom checking after an LWT_XMIT BPF program runs. The check uses hard_header_len, which does not account for alignment required by the neighbour cached-header path (neigh_hh_output), potentially leading to packet drops.

In the Linux kernel, the BPF mechanism has a vulnerability where bpf_setsockopt() and bpf_getsockopt() can be called in cgroup UNIX getname hooks (BPF_CGROUP_UNIX_GETPEERNAME and BPF_CGROUP_UNIX_GETSOCKNAME) without holding the socket lock, leading to a sock_owned_by_me() warning.

In the Linux kernel, the m68k nfcon driver has a deadlock caused by calling console_is_registered() in nfcon_device(), when the .device() method is called while holding the console_list_lock, and console_is_registered() tries to acquire it again.