CVE Vulnerability Catalog

A vulnerability was fixed in the Linux kernel's SUNRPC gss_unwrap_resp_priv() function. Improper validation of the RPCSEC_GSS opaque length (opaque_len) allowed u32 arithmetic overflow and lacked a lower bound, enabling out-of-bounds reads in gss_krb5_unwrap_v2().

A race condition exists in the Linux kernel sunrpc module. The /proc/net/rpc/use-gss-proxy entry is published by proc_create_data() before the sn->gssp_lock mutex is initialized via mutex_init(), allowing a writer to lock an uninitialized mutex.

In the Linux kernel, gssx_dec_option_array() in the SUNRPC subsystem does not reject duplicate CREDS_VALUE options. Each CREDS_VALUE entry triggers gssx_dec_linux_creds(), which overwrites creds->cr_group_info without releasing the previous allocation, causing a memory leak. A reply containing two CREDS_VALUE entries is sufficient to leak the first group_info allocation.

A vulnerability was fixed in the Linux kernel's gss_krb5_unwrap_v2() function in the SUNRPC module. A Kerberos v2 token with an 'extra count' (ec) field larger than the plaintext length, even when sent by an authenticated peer with a valid GSS context, left the xdr_buf in an inconsistent state (zero length, mismatched iov lengths). The fix rejects such tokens before calling xdr_buf_trim(), returning a GSS_S_DEFECTIVE_TOKEN error.

The Linux kernel has a vulnerability in the SUNRPC function gss_krb5_verify_mic_v2(), which fails to check the minimum length of a MIC token before reading its contents. A remote attacker (e.g., a malicious NFS server) can supply a short token, causing an out-of-bounds read of the allocated buffer. The issue was fixed by adding a length guard.

In the Linux kernel, xs_tls_handshake_sync() in the SUNRPC subsystem has a use-after-free race during TLS handshake cancellation. When handshake_req_cancel() returns false (because handshake_complete() already marked the request complete), the waiter may drop the lower transport reference before the xs_tls_handshake_done() callback finishes. This can free the transport while it is still in use.

In the Linux kernel, svc_rdma_free() in the svcrdma subsystem has a use-after-free due to operation ordering. rpcrdma_rn_unregister() is called after rdma_destroy_id(), leaving the sc_rn entry in the device's rd_xa after the cm_id is freed. A concurrent ib_unregister_device walk can dispatch svc_rdma_xprt_done() against the freed sc_cm_id. Additionally, the sc_cm_id dereference lacks a NULL check.

In the Linux kernel svcrdma module, when handling an ADDR_CHANGE event the replacement connection ID (cm_id) allocation fails, sc_cm_id still points to the old cm_id that the CM core is about to destroy. Any later dereference of sc_cm_id, such as the rdma_disconnect() call in svc_rdma_detach(), results in a use-after-free.

A bug was fixed in the Linux kernel's svcrdma module in svc_rdma_read_chunk_range(), related to offset arithmetic when building a read range for RDMA chunks. Incorrect use of '>' instead of '>=' and improper min_t() bracketing caused u32 underflow, wrong DMA lengths, and potentially large memory allocations (multi-MiB kmalloc_array_node). The function also rejected valid zero-length requests.

A vulnerability exists in the Linux kernel's svcrdma component related to the pcl_for_each_segment macro. When a parsed chunk list contains a chunk with ch_segcount equal to zero, the inclusive upper bound calculation underflows, causing the loop to walk past the ch_segments flex array and resulting in an out-of-bounds read and a general protection fault. The issue is reachable from the wire via a Write or Reply chunk advertising zero segments when the transport has negotiated Send-With-Invalidate.

In the Linux kernel svcrdma module, handle_connect_req() takes no action when svc_rdma_create_xprt() fails to allocate a new transport. Because the CM core returns 0 for CONNECT_REQUEST events, the new rdma_cm_id is not destroyed, leaking one rdma_cm_id per failed allocation under memory pressure.

A vulnerability exists in the Linux kernel's svcrdma module (RPC-over-RDMA). A client can request a reply without providing a Write list or Reply chunk, causing the linearization function to copy past the end of the sc_xprt_buf buffer and corrupt adjacent slab memory. The oversized length is then stored in sc_sges[0].length and posted, causing the device to read beyond the mapped region.

In the Linux kernel svcrdma module, the RPC/RDMA Read list decoder stores wire-supplied segment lengths without validation. An oversized rs_length reaches svc_rdma_build_read_segment(), which derives nr_bvec from it and can drive a large dynamic bvec allocation before verifying that enough rq_pages remain; if the post-allocation page-overrun guard fires, the freshly acquired rw context is not returned, leaking the resource.

In the Linux kernel svcrdma module, individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending multiple segments whose cumulative length exceeds the rq_pages array budget. When one segment fills the page array exactly, the runtime guard in svc_rdma_build_read_segment() is bypassed because len reaches zero, and a subsequent segment accesses the NULL sentinel slot at rq_pages[rq_maxpages], resulting in a NULL pointer dereference during DMA mapping.

In the Linux kernel svcrdma module, svc_rdma_create() calls kfree(cma_xprt) when svc_rdma_create_listen_id() fails. Because svc_xprt_init() has already acquired a net namespace reference via get_net_track(), kfree bypasses svc_xprt_free() which would release it, leading to unbalanced reference counts.

In the Linux kernel svcrdma module, the RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim. xdr_count_read_segments() checks only 4-byte alignment and never compares the position against the received inline body length, so in the single-chunk path a position past the inline body underflows the tail length and exposes adjacent slab memory, while in the multi-chunk path overlapping chunks cause unsigned underflows and copies past the receive buffer.

In the Linux kernel UDF filesystem, UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings, where s_num_entries stores the number of entries, not the highest valid index. udf_get_pblock_virt15() currently rejects only indexes greater than s_num_entries, so a crafted image can request index s_num_entries, pass the bounds check, and make the kernel read one entry past the allocated VAT table.

In the Linux kernel's ath6kl wifi driver, ath6kl_cfg80211_connect_event() subtracts fixed IE offsets from assoc_req_len and assoc_resp_len (both u8) without a lower bound. When the length is smaller than the offset, the u8 wraps to about 250, and cfg80211_connect_result()/cfg80211_roamed() treat that wrapped value as the IE length and copy that many bytes from the small assoc_info buffer to user space via nl80211, disclosing adjacent slab memory.

In the Linux kernel's mt76 wifi driver (mt7925), the pending mlo_pm_work is not cancelled in reset, suspend, and unregister paths. If the device is reset, suspended, or unregistered within that window, the pending work can still run and access already freed vif/bss data or send MCU commands while the firmware is unavailable.

In the Linux kernel's media staging/ipu7 driver, isys_register_devices() registers the V4L2 async notifier, but the probe error path (isys_probe()) only calls isys_unregister_devices(), which does not unregister or clean up the notifier. As a result, the notifier stays on the global notifier_list while the enclosing struct ipu7_isys is freed by devres, leading to list corruption and a use-after-free the next time the list is walked.