CVE Vulnerability Catalog

In the Linux kernel, the phy: rockchip-samsung-dcphy driver has an incorrect max_register value of 0x10000, while the PHY register block is 64KB, so the last accessible register is at offset 0xfffc. Dumping registers through the regmap debugfs interface reads beyond the ioremapped region and oopses on the unmapped page.

In the Linux kernel, ubifs_sb_verify_signature() bounds the on-disk ubifs_sig_node->len field with the wrong sign, adding the header size instead of subtracting it. This accepts a declared length up to 2 * UBIFS_SIG_NODE_SZ larger than the node actually holds, leading to an out-of-bounds read past c->sbuf while processing the PKCS7 signature.

In the Linux kernel, zram's read_block_state() calculates nr_pages before taking dev_lock. If the device is reset and reinitialized with a smaller disksize before lock acquisition, nr_pages still describes the old table, and the subsequent loop can call slot_lock() past the end of the newly allocated table.

In the Linux kernel, zram's writeback_store() calculates the table scan bounds before taking dev_lock. A reset followed by reconfiguration with a smaller disksize can replace zram->table while writeback_store() is waiting for the lock, so once it acquires the lock it scans the new table using the old upper bound, resulting in an out-of-bounds access.

In the Linux kernel, zram_destroy_comps() resets all compressors and leaves them set to NULL, including the primary one, which is invalid device state. This can lead to a NULL pointer dereference in comp_algorithm_show() via strcmp().

In the Linux kernel, the zram module lacked validation of deflate parameters. A user-supplied winbits value was not checked before being passed to zlib_deflate_workspacesize(), which triggers BUG_ON() for values outside the valid range.

In the Linux kernel, the NFS/localio subsystem has a reference leak when nfs_uuid_add_file() races with nfs_uuid_put() and returns -ENXIO. In that case the error path fails to release the nfsd_file and nfsd_net references, preventing proper teardown of network resources.

A memory leak exists in the Linux kernel NFS subsystem. The nfs4_server_common_setup() function allocates the delegation_hash_table, but the server->destroy pointer responsible for freeing it is only assigned at the end of the function. If any intermediate step fails, the table is not freed, leaking 4 KiB of kernel memory on every failed NFSv4 mount attempt.

In the Linux kernel, nfsd_setattr() checked the NFSD_MAY_TRUNC permission using a file size sampled without the inode lock, while the actual size update was applied later under inode_lock(). This created a TOCTOU window for append-only files where a concurrent append could extend the file before a real truncation was applied without the required check.

In the Linux kernel, nfsd4_ssc_expire_umount() walked nfsd_ssc_mount_list while dropping nfsd_ssc_lock for mntput(), but kept the tmp pointer saved by list_for_each_entry_safe. Another NFSD thread could delete and free the item that was the saved tmp during that window, leading to a use-after-free.

In the Linux kernel, a flawed WARN_ON_ONCE was removed from nfsd_mode_check(). The assumption justifying the warning is invalid for NFS reexport, where the function can encounter a dentry without i_op->lookup. Returning nfserr_notdir must remain to guard the lookup_one_unlocked() path against a NULL method pointer dereference.

In the Linux kernel, the out_forget path in pnfs_layout_process() never drained the free_me list, causing a layout segment leak. Previous fixes added and removed the drain, and this change restores the pnfs_free_lseg_list() call.

In the Linux kernel, the nlmsvc_ops pointer was published and cleared with plain stores while lockd dereferenced it unguarded from dispatch sites in fs/lockd/svcsubs.c. After nfsd module removal, a stale load could result in a NULL dereference or a module-text use-after-free.

A use-after-free vulnerability was fixed in the Linux kernel's nfsd (NFS server) module. After a DESTROY_SESSION, the rpciod thread could still dereference the freed session structure via the cl_cb_session pointer, leading to access of freed memory. The fix converts cl_cb_session to an RCU-protected pointer and changes session freeing from kfree() to kfree_rcu().

In the Linux kernel, nfsd_cross_mnt() jumped to the out label on a follow_down() error without releasing the path references taken by mntget() and dget(). This leaked references on each failed cross-mount, blocking umount and pinning dentries.

In the Linux kernel, the nfsd module failed to reset the write verifier when an async COPY writeback failed. When writeback failed, the server reported NFS_UNSTABLE to the NFS client but did not rotate the verifier, so after COMMIT the client treated the data as durable even though the write had failed.

In the Linux kernel, nfsd_dispatch() did not restore rq_status_counter to an even value on all exit paths (cache-hit, drop, encode-error). The counter left odd caused the lockless reader in nfsd_nl_rpc_status_get_dumpit() to treat rqstp fields as stable and read past the end of the 8-element ops array.

In the Linux kernel, _nfsd_copy_file_range() sampled the writeback error cursor (dst->f_wb_err) after the copy loop instead of before it. Concurrent COMMIT or stable WRITE could advance the cursor, so the writeback error went undetected and NFSD4_COPY_F_COMMITTED was set despite the failed write.

In the Linux kernel, nfsd4_drop_revoked_stid(), which handles FREE_STATEID for admin-revoked delegations, did not set SC_STATUS_FREED before releasing cl_lock. Without this flag the freed delegation was added to cl_revoked, causing a use-after-free when that list is later traversed in __destroy_client().

A vulnerability was fixed in the Linux kernel's nfsd subsystem affecting the nfsd_fh_verify and nfsd_fh_verify_err tracepoints. The server sockaddr slot in the trace buffer was sized by xpt_remotelen but filled with data of length xpt_locallen, so when xpt_locallen exceeded xpt_remotelen, the memcpy wrote past the reserved ring-buffer slot. The issue is reachable for NFSv2/v3 requests over UDP, where xpt_remotelen remains 0 for the transport's lifetime.