CVE Vulnerability Catalog

In the Linux kernel, a race condition exists in the nfsd module between the shrinker, GC worker, and fsnotify/lease callbacks versus per-net shutdown in the filecache. An nfsd_file can be unhashed and moved to the dispose list before nfsd_file_cache_shutdown_net() processes it, causing a leak of the file and its associated state. The fix widens the nfsd_gc_lock scope across all three callers of nfsd_file_dispose_list_delayed() and adds a spinlock barrier in the per-net shutdown function.

In the Linux kernel's nfsd module, a client could send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD request with an out-of-range nseconds field for atime/mtime (tv_nsec >= NSEC_PER_SEC). The value passed protocol-level validation but was not normalized, leading to on-disk metadata corruption on ext4 and XFS filesystems (incorrect seconds and year). The fix rejects such requests with NFS3ERR_INVAL before any changes are made.

In the Linux kernel, the NFSv2 attribute decoder (svcxdr_decode_sattr) converts wire useconds to nanoseconds by multiplying by 1000 and storing the result in tv_nsec. On 32-bit (ILP32) architectures, an out-of-range useconds value such as 4294968 overflows and produces an incorrect tv_nsec value (e.g., 704) that passes later range checks. The vulnerability affects NFSv2 SETATTR and CREATE operations and was fixed by rejecting useconds values greater than 1000000 during decoding.

A memory (reference) leak of posix_acl objects exists in the nfsd module of the Linux kernel. When an NFS client sends a malformed OPEN operation carrying POSIX ACL attributes, nfsd4_open() is never invoked, so the allocated posix_acl structures are not released. The issue also affects the v4.0 replay path.

A use-after-free vulnerability was found in the Linux kernel nfsd subsystem related to copy-notify stateids. The _free_cpntf_state_locked() function only unlinked an entry once its refcount reached zero, so revoke paths (parent-stid drain, OFFLOAD_CANCEL, and laundromat expiry) could drop a reference without unlinking, leaving the entry discoverable to a concurrent reader. The fix adds revoke_cpntf_state_locked(), which unhashes the entry from the IDR and sc_cp_list first and defers the final free to any holder.

In the Linux kernel, __destroy_client() releases open owners, but a lock owner whose only reference is a blocked lock (nbl) stays on cl_ownerstr_hashtbl. During client teardown the laundromat can free the owner as __destroy_client() dereferences it, causing a NULL dereference in remove_blocked_locks().

In the Linux kernel, writing a filesystem path to /proc/fs/nfsd/unlock_filesystem runs nfsd4_cancel_copy_by_sb() before nfsd_mutex is held and before confirming nn->nfsd_serv is set. After shutdown, nn->conf_id_hashtbl was freed but the pointer remained, causing a use-after-free read.

In the Linux kernel, the NFSD module has a use-after-free vulnerability during administrative state revocation. The nfsd4_revoke_states() function drops the client_lock, allowing a concurrent teardown to free the client before the state revocation completes. The issue involves a race between state revocation and client destruction.

In the Linux kernel, the NFSD module has a use-after-free vulnerability during delegation revocation. The nfs4_laundromat() function unhashes an expired delegation from cl_delegations, drops deleg_lock, and then revoke_delegation() attempts to use a client that may have already been freed. The lack of client pinning via cl_rpc_users enables a race with client teardown.

In the Linux kernel, the NFSD module has a use-after-free vulnerability during NFSv4.0 revoked-state cleanup. The nfs40_clean_admin_revoked() function drops the client_lock, and then nfsd4_drop_revoked_stid() uses a client that may have been freed by a concurrent teardown. The lack of client pinning enables a race.

In the Linux kernel, the libceph module has a vulnerability due to missing validation of OSD extent maps before cursor advance. The osd_sparse_read() function does not verify that each extent is monotonic and within the request range, allowing a malicious OSD to advance the cursor beyond the buffer and trigger BUG_ON. This leads to a Ceph client crash.

In the Linux kernel, the libceph module has a vulnerability due to failure to reject buckets with mismatched CRUSH ids. The crush_decode() function stores data by array slot, and a malformed map can cause one bucket to reuse another bucket's workspace, leading to an out-of-bounds write. KASAN reports an out-of-bounds write in bucket_perm_choose().

In the Linux kernel, the __kick_flushing_caps() function in the ceph module contains a use-after-free vulnerability. The function iterates over the i_cap_flush_list but drops the i_ceph_lock while sending cap messages, allowing handle_cap_flush_ack() to free a cf entry that the original thread later dereferences after reacquiring the lock.

In the Linux kernel, the check_new_map() function in the ceph subsystem contains a use-after-free vulnerability. The function drops mdsc->mutex to perform per-session operations, but three code paths (address changed, reconnect, active transition) fail to take a reference on the session object beforehand. Another thread can free the session during this unlock window, leading to access of freed memory.

In the Linux kernel, the ceph module has a vulnerability due to failure to reject export_targets ranks >= CEPH_MAX_MDS during mdsmap decode. The check_new_map() function uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can cause set_bit() to write past the array.

In the Linux kernel, the ceph module has a vulnerability due to failure to bound the copied dentry name length in NFS export get_name. The ceph_get_name() function copies the MDS-supplied name into a NAME_MAX-sized buffer without checking dname_len, leading to a buffer overflow. __get_snap_name() copies data in the same unchecked way.

In the Linux kernel, handle_session() in the ceph module lacked bounds checks when decoding the match.path and match.fs_name fields of MDSCapAuth records in a CEPH_SESSION_OPEN message. A malicious or compromised MDS can supply an oversized length, causing an out-of-bounds read (up to 4 GiB) and crashing the client. The fix switches both copies to ceph_decode_copy_safe().

In the Linux kernel, ceph_mdsmap_decode() lacked bounds checking for the num_export_targets array in MDS info records with version 2 or 3. A malicious or compromised Ceph monitor can send an MDS map with an oversized num_export_targets value, causing an out-of-bounds read in the CephFS client kernel.

A vulnerability exists in the Linux kernel's __build_xattrs() function in the Ceph subsystem, which decodes xattr attributes supplied by the MDS server. Missing bounds checking on the last attribute's value length allows a malicious or compromised metadata server to set a length larger than the actual buffer size, leading to an out-of-bounds read. The fix adds the required ceph_decode_need() check, returning -EIO instead of storing the invalid length.

A vulnerability was fixed in the Linux kernel in the ceph_parse_deleg_inos() function of the Ceph client. A malicious or compromised MDS server could send a reply with a huge or repeated number of delegated inode numbers, causing unbounded loops and excessive growth of the xarray in the client session. Limits were introduced on the number of delegated inodes per session and on the aggregate interval length accepted from a single reply.