CVE Vulnerability Catalog

A use-after-free (UAF) vulnerability was fixed in the Linux kernel's NFS asynchronous copy mechanism (nfsd). A race between the copy kthread and teardown callers (OFFLOAD_CANCEL, nfsd4_shutdown_copy, nfsd4_cancel_copy_by_sb) could free or use an already-freed copy structure, double-put nfsd_file, and dereference a freed task_struct.

In the Linux kernel, nfsd4_ff_encode_layoutget() has multiple XDR buffer size calculation errors. These errors can result in an out-of-bounds write or leaking uninitialized kernel memory to the client. The worst case occurs with short strings, where the function writes up to 5 bytes past the reserved XDR buffer.

In the Linux kernel, nfsd4_ff_encode_getdeviceinfo() has an XDR padding calculation error. The da_addr_body reservation does not match the actual bytes written by xdr_encode_opaque(), causing stale reply-page content to leak to the client and misaligning the subsequent version list decode. This occurs on every flexfile GETDEVICEINFO reply.

In the Linux kernel, nfsacld_proc_setacl() for NFSACL v2 SETACL has a bug that can lead to unintended ACL removal. When a SETACL request contains only NFS_ACL, the other pointer (acl_default) remains NULL, and set_posix_acl() with NULL removes the directory's default ACL. Similarly, mask=0 removes both ACLs.

In the Linux kernel, nfsd3_proc_setacl() for NFSv3 SETACL has a bug that can lead to unintended ACL removal. When a SETACL request contains only NFS_ACL, the acl_default pointer remains NULL, and set_posix_acl() with NULL removes the directory's default ACL. Similarly, mask=0 removes both ACLs.

A vulnerability was fixed in the Linux kernel's nfsd module where nfsd_open_local_fh() dereferenced an nfsd_file pointer without holding an RCU read lock. The object could be freed and reallocated by another thread, leading to a use-after-free condition. The fix wraps the cmpxchg and reference acquisition in an rcu_read_lock() section.

In the Linux kernel, nfsd4_copy_notify() published the cpntf state into the IDR and the parent's list before finishing initialization and before recording the owning clientid. A racing OFFLOAD_CANCEL could free the entry, turning the caller's stateid read and cp_p_stateid/cp_p_clid writes into a use-after-free.

In the Linux kernel, init_nfsd() calls nfsd_debugfs_init() before nfsd4_init_slabs(). If slab allocation fails, the early return bypasses nfsd_debugfs_exit(), leaving orphan debugfs files with stale fops pointers into freed module text.

In the Linux kernel, a race condition exists in the nfsd module between the shrinker, GC worker, and fsnotify/lease callbacks versus per-net shutdown in the filecache. An nfsd_file can be unhashed and moved to the dispose list before nfsd_file_cache_shutdown_net() processes it, causing a leak of the file and its associated state. The fix widens the nfsd_gc_lock scope across all three callers of nfsd_file_dispose_list_delayed() and adds a spinlock barrier in the per-net shutdown function.

In the Linux kernel's nfsd module, a client could send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD request with an out-of-range nseconds field for atime/mtime (tv_nsec >= NSEC_PER_SEC). The value passed protocol-level validation but was not normalized, leading to on-disk metadata corruption on ext4 and XFS filesystems (incorrect seconds and year). The fix rejects such requests with NFS3ERR_INVAL before any changes are made.

In the Linux kernel, the NFSv2 attribute decoder (svcxdr_decode_sattr) converts wire useconds to nanoseconds by multiplying by 1000 and storing the result in tv_nsec. On 32-bit (ILP32) architectures, an out-of-range useconds value such as 4294968 overflows and produces an incorrect tv_nsec value (e.g., 704) that passes later range checks. The vulnerability affects NFSv2 SETATTR and CREATE operations and was fixed by rejecting useconds values greater than 1000000 during decoding.

A memory (reference) leak of posix_acl objects exists in the nfsd module of the Linux kernel. When an NFS client sends a malformed OPEN operation carrying POSIX ACL attributes, nfsd4_open() is never invoked, so the allocated posix_acl structures are not released. The issue also affects the v4.0 replay path.

A use-after-free vulnerability was found in the Linux kernel nfsd subsystem related to copy-notify stateids. The _free_cpntf_state_locked() function only unlinked an entry once its refcount reached zero, so revoke paths (parent-stid drain, OFFLOAD_CANCEL, and laundromat expiry) could drop a reference without unlinking, leaving the entry discoverable to a concurrent reader. The fix adds revoke_cpntf_state_locked(), which unhashes the entry from the IDR and sc_cp_list first and defers the final free to any holder.

In the Linux kernel, __destroy_client() releases open owners, but a lock owner whose only reference is a blocked lock (nbl) stays on cl_ownerstr_hashtbl. During client teardown the laundromat can free the owner as __destroy_client() dereferences it, causing a NULL dereference in remove_blocked_locks().

In the Linux kernel, writing a filesystem path to /proc/fs/nfsd/unlock_filesystem runs nfsd4_cancel_copy_by_sb() before nfsd_mutex is held and before confirming nn->nfsd_serv is set. After shutdown, nn->conf_id_hashtbl was freed but the pointer remained, causing a use-after-free read.

In the Linux kernel, the NFSD module has a use-after-free vulnerability during administrative state revocation. The nfsd4_revoke_states() function drops the client_lock, allowing a concurrent teardown to free the client before the state revocation completes. The issue involves a race between state revocation and client destruction.

In the Linux kernel, the NFSD module has a use-after-free vulnerability during delegation revocation. The nfs4_laundromat() function unhashes an expired delegation from cl_delegations, drops deleg_lock, and then revoke_delegation() attempts to use a client that may have already been freed. The lack of client pinning via cl_rpc_users enables a race with client teardown.

In the Linux kernel, the NFSD module has a use-after-free vulnerability during NFSv4.0 revoked-state cleanup. The nfs40_clean_admin_revoked() function drops the client_lock, and then nfsd4_drop_revoked_stid() uses a client that may have been freed by a concurrent teardown. The lack of client pinning enables a race.

In the Linux kernel, the libceph module has a vulnerability due to missing validation of OSD extent maps before cursor advance. The osd_sparse_read() function does not verify that each extent is monotonic and within the request range, allowing a malicious OSD to advance the cursor beyond the buffer and trigger BUG_ON. This leads to a Ceph client crash.

In the Linux kernel, the libceph module has a vulnerability due to failure to reject buckets with mismatched CRUSH ids. The crush_decode() function stores data by array slot, and a malformed map can cause one bucket to reuse another bucket's workspace, leading to an out-of-bounds write. KASAN reports an out-of-bounds write in bucket_perm_choose().