CVE Vulnerability Catalog

In the Linux kernel, a race condition in the sunrpc module during TLS handshake cancellation was fixed. When wait_for_completion_interruptible_timeout() returns timeout or signal and cancellation loses the race, the handshake callback may not have committed its side effects, leading to double invocation of the handshake or connection teardown despite successful handshake. The fix waits for the callback to commit before checking flags.

In the Linux kernel's sunrpc subsystem, svc_release_rqst() executes the callback in rqstp->rq_procinfo->pc_release. If a worker thread hits an early error path before a valid rq_procinfo is installed, a stale release hook can be re-triggered against reused state from the previous RPC, leading to double-free or use-after-free. The fix hardens the rq_procinfo lifecycle by clearing it after pc_release, at request entry in svc_process(), and in svc_process_bc().

In the Linux kernel's SUNRPC module, xdr_buf_to_bvec() writes to the caller's array before checking if the slot is in range, potentially causing an out-of-bounds write. The rq_bvec array passed by nfsd_vfs_write() is allocated without slack, so the OOB store can corrupt adjacent memory.

In the Linux kernel's ntfs module, there is an ordering issue when growing the index root value. The larger header is published before resizing the resident value, which can lead to a transient state considered corrupt if the resize fails.

In the Linux kernel's ntfs module, there is an off-by-one error in bounds checks during mapping pairs decompression. Strict greater-than comparisons allow a one-byte out-of-bounds read when data ends exactly at the boundary.

A vulnerability in the Linux kernel's NTFS filesystem was found where ntfs_attr_find() and ntfs_external_attr_find() do not properly validate length fields in variable-length resident attributes. A crafted disk image can trigger an out-of-bounds read (slab-out-of-bounds) during filename lookup operations.

In the Linux kernel, a bounds check was added before accessing EA entries in the NTFS filesystem. In ntfs_ea_lookup and ntfs_listxattr, it verifies that there is enough space in the EA entry before accessing the next_entry_offset field.

In the Linux kernel, the NTFS filesystem no longer converts zero-length $DATA attributes to non-resident. Previously, when a resident attribute could not be grown in place, other resident attributes were converted to non-resident, but now zero-length $DATA attributes are skipped because fsck treats such non-resident attributes as corruption.

In the Linux kernel, the NTFS filesystem now performs stricter validation of the index block header. The ntfs_index_block_inconsisent() function was modified to validate INDEX_HEADER geometry in INDX blocks more thoroughly, and ntfs_lookup_inode_by_name() uses this function to validate INDX blocks.

In the Linux kernel, the NTFS filesystem now validates index entries on reading. Index entries are validated immediately after reading an index root or index block from disk, eliminating repeated checks in lookup and readdir and reducing the risk of missing checks in those paths.

In the Linux kernel, the NTFS filesystem detects mapping-pairs LCN accumulator overflow. The parser accumulates relative LCN deltas in a signed integer, and a corrupted attribute can drive the addition past the representable range. An overflow check is added before storing the next run.

In the Linux kernel, the NTFS filesystem now validates resident $INDEX_ROOT values on lookup. Resident $INDEX_ROOT values carry index header fields that callers consume after lookup. Validation of the header fields is added before returning the attribute, requiring 8-byte alignment, a sane entries_offset, index_length within allocated_size, allocated_size within the resident value, and enough entry space for at least an index entry header.

In the Linux kernel's NTFS3 filesystem, the indx_find_buffer function had no recursion depth limit, potentially leading to kernel stack overflow. The fix adds a depth parameter and a check against the limit.

In the Linux kernel's NTFS3 filesystem, a vulnerability allows an out-of-bounds write when promoting a full resident $INDEX_ROOT to $INDEX_ALLOCATION. A crafted NTFS image can cause memcpy of attacker-controlled data past the allocated buffer, leading to heap corruption.

In the Linux kernel's NTFS3 filesystem, a vulnerability allows out-of-bounds write due to missing validation of the split-point offset in indx_insert_into_buffer. A crafted NTFS image causes an integer underflow and a near-4GiB memmove, corrupting memory and panicking the kernel.

In the Linux kernel's NTFS filesystem, ntfs_lookup_inode_by_name() returns MFT references read from directory index entries on disk, which are untrusted. The function can return an error-marked MFT reference without validation, causing callers to misinterpret the result. The fix normalizes all such references to ERR_MREF(-EIO) across all four return paths.

In the Linux kernel's NTFS filesystem, system files such as $Bitmap can be written from userspace, leading to volume corruption and writeback deadlock. The fix marks base metadata files as immutable during inode read so the VFS rejects write, mmap, truncate, and unlink with -EPERM.

In the Linux kernel's NTFS filesystem, ntfs_map_runlist_nolock() can encounter a resident attribute where a non-resident one is expected, previously triggering only a WARN_ON and leading to reading the wrong union member. The fix replaces the WARN_ON with an -EIO error return, causing crafted images to be rejected during mount.

A vulnerability was found in the Linux kernel's tcp_connect() function related to TCP and MD5 authentication. In one code branch, the tcp_md5sig_info structure and tcp_md5sig_key entries are freed without respecting the RCU grace period, causing a race condition with softirq readers. This leads to a use-after-free of MD5 key memory.

In the Linux kernel, the xfrm module has a double-free issue in nat_keepalive_send(). When the IPv4 or IPv6 helper reports an error, the keepalive packet is freed, but if the packet has already been handed to the network stack, it may be freed again, leading to unsafe operation.