CVE Vulnerability Catalog

In the Linux kernel, __svc_create() ignored the return values of percpu_counter_init() when initializing three per-pool RPC statistics counters. When a per-CPU allocation fails (e.g., under memory pressure), the RPC service (nfsd, lockd, or NFS callback service) is started with uninitialized counters whose per-CPU pointer is NULL. This silently corrupts data in the current CPU's per-CPU area and causes /proc/fs/nfsd/pool_stats to return garbage.

In the Linux kernel, a race occurs during backchannel receive when the NFS callback service is being torn down. xprt_enqueue_bc_request() may skip enqueueing or freeing the request if xprt->bc_serv has already been cleared, leading to a leak or use-after-free.

In the Linux kernel, svc_rqst_free() frees rq_argp and rq_resp synchronously while deferring the rqstp struct free via kfree_rcu(). This creates a window where RCU readers can access already freed fields, leading to a use-after-free.

The Linux kernel fixed four coupled defects in the SUNRPC gssx XDR option-array decoder. The bugs caused a NULL dereference in the caller, a refcount leak on the decoded group_info, and a latent use-after-free.

A use-after-free vulnerability exists in the Linux kernel in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir within the sunrpc subsystem. The clnt->pipefs_sb field is not refreshed on mount events nor cleared on unmount, causing comparison against a stale pointer and skipped cleanup. As a result, pipefs dentries may point to a freed rpc_clnt, leading to use-after-free during subsequent rpc_info_open() or rpc_show_info() calls.

A vulnerability was fixed in the Linux kernel's SUNRPC gss_krb5_unwrap_v2() function, which read EC and RRC header fields out of bounds before validating the token length. Unsigned arithmetic underflow could trigger a ~UINT_MAX-byte memmove, and a zero-length buffer could cause a divide-by-zero. Four defense-in-depth guards were added to validate token and buffer lengths.

A vulnerability was fixed in the Linux kernel's SUNRPC gss_unwrap_resp_priv() function. Improper validation of the RPCSEC_GSS opaque length (opaque_len) allowed u32 arithmetic overflow and lacked a lower bound, enabling out-of-bounds reads in gss_krb5_unwrap_v2().

A race condition exists in the Linux kernel sunrpc module. The /proc/net/rpc/use-gss-proxy entry is published by proc_create_data() before the sn->gssp_lock mutex is initialized via mutex_init(), allowing a writer to lock an uninitialized mutex.

In the Linux kernel, gssx_dec_option_array() in the SUNRPC subsystem does not reject duplicate CREDS_VALUE options. Each CREDS_VALUE entry triggers gssx_dec_linux_creds(), which overwrites creds->cr_group_info without releasing the previous allocation, causing a memory leak. A reply containing two CREDS_VALUE entries is sufficient to leak the first group_info allocation.

A vulnerability was fixed in the Linux kernel's gss_krb5_unwrap_v2() function in the SUNRPC module. A Kerberos v2 token with an 'extra count' (ec) field larger than the plaintext length, even when sent by an authenticated peer with a valid GSS context, left the xdr_buf in an inconsistent state (zero length, mismatched iov lengths). The fix rejects such tokens before calling xdr_buf_trim(), returning a GSS_S_DEFECTIVE_TOKEN error.

The Linux kernel has a vulnerability in the SUNRPC function gss_krb5_verify_mic_v2(), which fails to check the minimum length of a MIC token before reading its contents. A remote attacker (e.g., a malicious NFS server) can supply a short token, causing an out-of-bounds read of the allocated buffer. The issue was fixed by adding a length guard.

In the Linux kernel, xs_tls_handshake_sync() in the SUNRPC subsystem has a use-after-free race during TLS handshake cancellation. When handshake_req_cancel() returns false (because handshake_complete() already marked the request complete), the waiter may drop the lower transport reference before the xs_tls_handshake_done() callback finishes. This can free the transport while it is still in use.

In the Linux kernel, svc_rdma_free() in the svcrdma subsystem has a use-after-free due to operation ordering. rpcrdma_rn_unregister() is called after rdma_destroy_id(), leaving the sc_rn entry in the device's rd_xa after the cm_id is freed. A concurrent ib_unregister_device walk can dispatch svc_rdma_xprt_done() against the freed sc_cm_id. Additionally, the sc_cm_id dereference lacks a NULL check.

In the Linux kernel svcrdma module, when handling an ADDR_CHANGE event the replacement connection ID (cm_id) allocation fails, sc_cm_id still points to the old cm_id that the CM core is about to destroy. Any later dereference of sc_cm_id, such as the rdma_disconnect() call in svc_rdma_detach(), results in a use-after-free.

A bug was fixed in the Linux kernel's svcrdma module in svc_rdma_read_chunk_range(), related to offset arithmetic when building a read range for RDMA chunks. Incorrect use of '>' instead of '>=' and improper min_t() bracketing caused u32 underflow, wrong DMA lengths, and potentially large memory allocations (multi-MiB kmalloc_array_node). The function also rejected valid zero-length requests.

A vulnerability exists in the Linux kernel's svcrdma component related to the pcl_for_each_segment macro. When a parsed chunk list contains a chunk with ch_segcount equal to zero, the inclusive upper bound calculation underflows, causing the loop to walk past the ch_segments flex array and resulting in an out-of-bounds read and a general protection fault. The issue is reachable from the wire via a Write or Reply chunk advertising zero segments when the transport has negotiated Send-With-Invalidate.

In the Linux kernel svcrdma module, handle_connect_req() takes no action when svc_rdma_create_xprt() fails to allocate a new transport. Because the CM core returns 0 for CONNECT_REQUEST events, the new rdma_cm_id is not destroyed, leaking one rdma_cm_id per failed allocation under memory pressure.

A vulnerability exists in the Linux kernel's svcrdma module (RPC-over-RDMA). A client can request a reply without providing a Write list or Reply chunk, causing the linearization function to copy past the end of the sc_xprt_buf buffer and corrupt adjacent slab memory. The oversized length is then stored in sc_sges[0].length and posted, causing the device to read beyond the mapped region.

In the Linux kernel svcrdma module, the RPC/RDMA Read list decoder stores wire-supplied segment lengths without validation. An oversized rs_length reaches svc_rdma_build_read_segment(), which derives nr_bvec from it and can drive a large dynamic bvec allocation before verifying that enough rq_pages remain; if the post-allocation page-overrun guard fires, the freshly acquired rw context is not returned, leaking the resource.

In the Linux kernel svcrdma module, individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending multiple segments whose cumulative length exceeds the rq_pages array budget. When one segment fills the page array exactly, the runtime guard in svc_rdma_build_read_segment() is bypassed because len reaches zero, and a subsequent segment accesses the NULL sentinel slot at rq_pages[rq_maxpages], resulting in a NULL pointer dereference during DMA mapping.