CVE Vulnerability Catalog

In the Linux kernel, the __kick_flushing_caps() function in the ceph module contains a use-after-free vulnerability. The function iterates over the i_cap_flush_list but drops the i_ceph_lock while sending cap messages, allowing handle_cap_flush_ack() to free a cf entry that the original thread later dereferences after reacquiring the lock.

In the Linux kernel, the check_new_map() function in the ceph subsystem contains a use-after-free vulnerability. The function drops mdsc->mutex to perform per-session operations, but three code paths (address changed, reconnect, active transition) fail to take a reference on the session object beforehand. Another thread can free the session during this unlock window, leading to access of freed memory.

In the Linux kernel, the ceph module has a vulnerability due to failure to reject export_targets ranks >= CEPH_MAX_MDS during mdsmap decode. The check_new_map() function uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can cause set_bit() to write past the array.

In the Linux kernel, the ceph module has a vulnerability due to failure to bound the copied dentry name length in NFS export get_name. The ceph_get_name() function copies the MDS-supplied name into a NAME_MAX-sized buffer without checking dname_len, leading to a buffer overflow. __get_snap_name() copies data in the same unchecked way.

In the Linux kernel, handle_session() in the ceph module lacked bounds checks when decoding the match.path and match.fs_name fields of MDSCapAuth records in a CEPH_SESSION_OPEN message. A malicious or compromised MDS can supply an oversized length, causing an out-of-bounds read (up to 4 GiB) and crashing the client. The fix switches both copies to ceph_decode_copy_safe().

In the Linux kernel, ceph_mdsmap_decode() lacked bounds checking for the num_export_targets array in MDS info records with version 2 or 3. A malicious or compromised Ceph monitor can send an MDS map with an oversized num_export_targets value, causing an out-of-bounds read in the CephFS client kernel.

A vulnerability exists in the Linux kernel's __build_xattrs() function in the Ceph subsystem, which decodes xattr attributes supplied by the MDS server. Missing bounds checking on the last attribute's value length allows a malicious or compromised metadata server to set a length larger than the actual buffer size, leading to an out-of-bounds read. The fix adds the required ceph_decode_need() check, returning -EIO instead of storing the invalid length.

A vulnerability was fixed in the Linux kernel in the ceph_parse_deleg_inos() function of the Ceph client. A malicious or compromised MDS server could send a reply with a huge or repeated number of delegated inode numbers, causing unbounded loops and excessive growth of the xarray in the client session. Limits were introduced on the number of delegated inodes per session and on the aggregate interval length accepted from a single reply.

In the Linux kernel, the Ceph subsystem's ceph_cap_reclaim_work() repeatedly re-queued itself whenever ceph_trim_dentries() returned -EAGAIN, creating a CPU-consuming busy loop with no progress. The issue was worsened by touching valid directory leases (TOUCH) instead of leaving them in place (KEEP), preventing the walk from terminating naturally. The fix adjusts lease reclaim logic and the conditions for returning -EAGAIN.

A leaked inode reference in the Linux kernel Ceph filesystem was fixed for the writeback abort path during umount. When ceph_inc_osd_stopping_blocker() fails during umount, the write request is aborted and the wrbuffer claim (i_wrbuffer_ref) is never released, so the inode cannot be evicted and the kernel reports "Busy inodes after unmount of ceph".

In the Linux kernel, btrfs_recover_relocation() leaks reloc_root references on recovery failure. When loading or adding a later root fails, or the first transaction commit fails, the out_unset path does not drop references held by fs_root->reloc_root, leaving them behind. The fix keeps temporary references to fs roots and drops them on failure.

In the Linux kernel, btrfs_dio_iomap_begin() leaks an extent map on direct I/O writes into a NOCOW range. If btrfs_create_dio_extent() fails (e.g., ordered extent allocation fails), the function returns an error without dropping the input extent map. The fix checks the error before replacing the map and drops it on failure.

In the Linux kernel, audit_del_rule() has a use-after-free on fsnotify rule autoremove. The unconditional audit_put_tree() assumes the template case, so for mixed AUDIT_DIR and AUDIT_EXE rules an autoremove event drops the installed rule's live tree reference. Repeating this can free the tree while another rule still references it, leading to dereferencing a freed pathname. The fix moves the temporary tree put to audit_rule_change().

In the Linux kernel, cifs_setsize() omits pagecache_isize_extended() when extending a file. It calls truncate_pagecache() but skips zeroing the tail of the page straddling the old EOF, so dirty bytes in that region can be written back to the server, exposing stale data in the newly extended range. The fix adds pagecache_isize_extended() before truncate_pagecache().

In the Linux kernel, cifs_file_set_size() has a use-after-free. When the else branch finds a writable file handle via find_writable_file(), it borrows tcon and server from the handle, attempts the handle-based set_file_size() RPC, then releases the handle with cifsFileInfo_put(). If set_file_size() fails, execution falls through to the path-based fallback, which reuses the borrowed tcon and server even though cifsFileInfo_put() may have freed tcon. The fix sets tcon = NULL after cifsFileInfo_put() to force the safe cifs_sb_tlink() path.

In the Linux kernel CIFS client, cifs_remap_file_range() with len == 0 (clone to EOF) computes the effective length as i_size - off. If off exceeds the file size, the result is a negative loff_t, corrupting the ByteCount in the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range in filemap_write_and_wait_range(). The existing off >= i_size check only fires after the ioctl has already been sent.

In the Linux kernel CIFS client, cifs_do_truncate() invoked from cifs_open() with O_TRUNC cannot use cifs_resize_file_locked() because i_rwsem is not held, so it fails to properly resize the fscache cookie. The fix adds a cifs_invalidate_cache() call after cifs_setsize(), which invalidates the cache without requiring i_rwsem.

In the Linux kernel SMB client (cifs.ko), writing to a file with the setuid/setgid bit set did not clear that bit on the server when mounted with cifsacl, modefromsid, or POSIX/Unix extensions. The VFS requested clearing the bit, but the cifs driver unconditionally skipped the mode change (ATTR_MODE), so the cleared mode was never sent to the server.

In the Linux kernel SMB client, cifs_check_trans2() returning false for a malformed secondary T2 response (invalid SMB header or PDU rejected by check2ndT2()) causes handle_mid() to overwrite mid->resp_buf with the new buffer, leaking the primary buffer and leaving server->smallbuf/bigbuf dangling. This results in a use-after-free when the demux thread reuses the freed buffer.

In the Linux kernel SMB client, free_tgts() frees all structures in ce->tlist but leaves ce->tgthint pointing to one of the freed cache_dfs_tgt structures. If the pointer is not reset before later use, a use-after-free occurs.