CVE Vulnerability Catalog

In the Linux kernel, writing a filesystem path to /proc/fs/nfsd/unlock_filesystem runs nfsd4_cancel_copy_by_sb() before nfsd_mutex is held and before confirming nn->nfsd_serv is set. After shutdown, nn->conf_id_hashtbl was freed but the pointer remained, causing a use-after-free read.

In the Linux kernel, the NFSD module has a use-after-free vulnerability during administrative state revocation. The nfsd4_revoke_states() function drops the client_lock, allowing a concurrent teardown to free the client before the state revocation completes. The issue involves a race between state revocation and client destruction.

In the Linux kernel, the NFSD module has a use-after-free vulnerability during delegation revocation. The nfs4_laundromat() function unhashes an expired delegation from cl_delegations, drops deleg_lock, and then revoke_delegation() attempts to use a client that may have already been freed. The lack of client pinning via cl_rpc_users enables a race with client teardown.

In the Linux kernel, the NFSD module has a use-after-free vulnerability during NFSv4.0 revoked-state cleanup. The nfs40_clean_admin_revoked() function drops the client_lock, and then nfsd4_drop_revoked_stid() uses a client that may have been freed by a concurrent teardown. The lack of client pinning enables a race.

In the Linux kernel, the libceph module has a vulnerability due to missing validation of OSD extent maps before cursor advance. The osd_sparse_read() function does not verify that each extent is monotonic and within the request range, allowing a malicious OSD to advance the cursor beyond the buffer and trigger BUG_ON. This leads to a Ceph client crash.

In the Linux kernel, the libceph module has a vulnerability due to failure to reject buckets with mismatched CRUSH ids. The crush_decode() function stores data by array slot, and a malformed map can cause one bucket to reuse another bucket's workspace, leading to an out-of-bounds write. KASAN reports an out-of-bounds write in bucket_perm_choose().

In the Linux kernel, the __kick_flushing_caps() function in the ceph module contains a use-after-free vulnerability. The function iterates over the i_cap_flush_list but drops the i_ceph_lock while sending cap messages, allowing handle_cap_flush_ack() to free a cf entry that the original thread later dereferences after reacquiring the lock.

In the Linux kernel, the check_new_map() function in the ceph subsystem contains a use-after-free vulnerability. The function drops mdsc->mutex to perform per-session operations, but three code paths (address changed, reconnect, active transition) fail to take a reference on the session object beforehand. Another thread can free the session during this unlock window, leading to access of freed memory.

In the Linux kernel, the ceph module has a vulnerability due to failure to reject export_targets ranks >= CEPH_MAX_MDS during mdsmap decode. The check_new_map() function uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can cause set_bit() to write past the array.

In the Linux kernel, the ceph module has a vulnerability due to failure to bound the copied dentry name length in NFS export get_name. The ceph_get_name() function copies the MDS-supplied name into a NAME_MAX-sized buffer without checking dname_len, leading to a buffer overflow. __get_snap_name() copies data in the same unchecked way.

In the Linux kernel, handle_session() in the ceph module lacked bounds checks when decoding the match.path and match.fs_name fields of MDSCapAuth records in a CEPH_SESSION_OPEN message. A malicious or compromised MDS can supply an oversized length, causing an out-of-bounds read (up to 4 GiB) and crashing the client. The fix switches both copies to ceph_decode_copy_safe().

In the Linux kernel, ceph_mdsmap_decode() lacked bounds checking for the num_export_targets array in MDS info records with version 2 or 3. A malicious or compromised Ceph monitor can send an MDS map with an oversized num_export_targets value, causing an out-of-bounds read in the CephFS client kernel.

A vulnerability exists in the Linux kernel's __build_xattrs() function in the Ceph subsystem, which decodes xattr attributes supplied by the MDS server. Missing bounds checking on the last attribute's value length allows a malicious or compromised metadata server to set a length larger than the actual buffer size, leading to an out-of-bounds read. The fix adds the required ceph_decode_need() check, returning -EIO instead of storing the invalid length.

A vulnerability was fixed in the Linux kernel in the ceph_parse_deleg_inos() function of the Ceph client. A malicious or compromised MDS server could send a reply with a huge or repeated number of delegated inode numbers, causing unbounded loops and excessive growth of the xarray in the client session. Limits were introduced on the number of delegated inodes per session and on the aggregate interval length accepted from a single reply.

In the Linux kernel, the Ceph subsystem's ceph_cap_reclaim_work() repeatedly re-queued itself whenever ceph_trim_dentries() returned -EAGAIN, creating a CPU-consuming busy loop with no progress. The issue was worsened by touching valid directory leases (TOUCH) instead of leaving them in place (KEEP), preventing the walk from terminating naturally. The fix adjusts lease reclaim logic and the conditions for returning -EAGAIN.

A leaked inode reference in the Linux kernel Ceph filesystem was fixed for the writeback abort path during umount. When ceph_inc_osd_stopping_blocker() fails during umount, the write request is aborted and the wrbuffer claim (i_wrbuffer_ref) is never released, so the inode cannot be evicted and the kernel reports "Busy inodes after unmount of ceph".

In the Linux kernel, btrfs_recover_relocation() leaks reloc_root references on recovery failure. When loading or adding a later root fails, or the first transaction commit fails, the out_unset path does not drop references held by fs_root->reloc_root, leaving them behind. The fix keeps temporary references to fs roots and drops them on failure.

In the Linux kernel, btrfs_dio_iomap_begin() leaks an extent map on direct I/O writes into a NOCOW range. If btrfs_create_dio_extent() fails (e.g., ordered extent allocation fails), the function returns an error without dropping the input extent map. The fix checks the error before replacing the map and drops it on failure.

In the Linux kernel, audit_del_rule() has a use-after-free on fsnotify rule autoremove. The unconditional audit_put_tree() assumes the template case, so for mixed AUDIT_DIR and AUDIT_EXE rules an autoremove event drops the installed rule's live tree reference. Repeating this can free the tree while another rule still references it, leading to dereferencing a freed pathname. The fix moves the temporary tree put to audit_rule_change().

In the Linux kernel, cifs_setsize() omits pagecache_isize_extended() when extending a file. It calls truncate_pagecache() but skips zeroing the tail of the page straddling the old EOF, so dirty bytes in that region can be written back to the server, exposing stale data in the newly extended range. The fix adds pagecache_isize_extended() before truncate_pagecache().