CVE Vulnerability Catalog

In the Linux kernel, nfsd4_copy() leaks an nfsd_file reference when inter-server COPY setup fails. The function returns an error directly, bypassing the out: label that would release the file reference. Each failed operation leaks one nfsd_file, pinning the file, inode, dentry, and vfsmount.

In the Linux kernel, nfsd4_setattr() has a NULL pointer dereference when a SETATTR request includes delegation time attributes (FATTR4_WORD2_TIME_DELEG_ACCESS or FATTR4_WORD2_TIME_DELEG_MODIFY) and the client supplies the special stateid (all 0xFF bytes). The local variable st remains NULL and is then dereferenced, causing a kernel oops. This is remotely triggerable by any NFSv4 client without authentication.

In the Linux kernel, nfsd_direct_write() has a partial-write detection bug. After vfs_iocb_iter_write(), iter.count holds the residual byte count, not the original length, so the break condition is incorrect. Short writes completing between 50% and 99% of the segment are not detected, causing the next segment to be written at the wrong offset and over-reporting the byte count to the NFS client.

A vulnerability was fixed in the Linux kernel's nfsd module where nfsd_open_local_fh() dereferenced an nfsd_file pointer without holding an RCU read lock. The object could be freed and reallocated by another thread, leading to a use-after-free condition. The fix wraps the cmpxchg and reference acquisition in an rcu_read_lock() section.

In the Linux kernel, init_nfsd() calls nfsd_debugfs_init() before nfsd4_init_slabs(). If slab allocation fails, the early return bypasses nfsd_debugfs_exit(), leaving orphan debugfs files with stale fops pointers into freed module text.

In the Linux kernel, a race condition exists in the nfsd module between the shrinker, GC worker, and fsnotify/lease callbacks versus per-net shutdown in the filecache. An nfsd_file can be unhashed and moved to the dispose list before nfsd_file_cache_shutdown_net() processes it, causing a leak of the file and its associated state. The fix widens the nfsd_gc_lock scope across all three callers of nfsd_file_dispose_list_delayed() and adds a spinlock barrier in the per-net shutdown function.

In the Linux kernel, the NFSv2 attribute decoder (svcxdr_decode_sattr) converts wire useconds to nanoseconds by multiplying by 1000 and storing the result in tv_nsec. On 32-bit (ILP32) architectures, an out-of-range useconds value such as 4294968 overflows and produces an incorrect tv_nsec value (e.g., 704) that passes later range checks. The vulnerability affects NFSv2 SETATTR and CREATE operations and was fixed by rejecting useconds values greater than 1000000 during decoding.

A memory (reference) leak of posix_acl objects exists in the nfsd module of the Linux kernel. When an NFS client sends a malformed OPEN operation carrying POSIX ACL attributes, nfsd4_open() is never invoked, so the allocated posix_acl structures are not released. The issue also affects the v4.0 replay path.

A use-after-free vulnerability was found in the Linux kernel nfsd subsystem related to copy-notify stateids. The _free_cpntf_state_locked() function only unlinked an entry once its refcount reached zero, so revoke paths (parent-stid drain, OFFLOAD_CANCEL, and laundromat expiry) could drop a reference without unlinking, leaving the entry discoverable to a concurrent reader. The fix adds revoke_cpntf_state_locked(), which unhashes the entry from the IDR and sc_cp_list first and defers the final free to any holder.

In the Linux kernel, the libceph module has a vulnerability due to missing validation of OSD extent maps before cursor advance. The osd_sparse_read() function does not verify that each extent is monotonic and within the request range, allowing a malicious OSD to advance the cursor beyond the buffer and trigger BUG_ON. This leads to a Ceph client crash.

A vulnerability was fixed in the Linux kernel in the ceph_parse_deleg_inos() function of the Ceph client. A malicious or compromised MDS server could send a reply with a huge or repeated number of delegated inode numbers, causing unbounded loops and excessive growth of the xarray in the client session. Limits were introduced on the number of delegated inodes per session and on the aggregate interval length accepted from a single reply.

In the Linux kernel, the Ceph subsystem's ceph_cap_reclaim_work() repeatedly re-queued itself whenever ceph_trim_dentries() returned -EAGAIN, creating a CPU-consuming busy loop with no progress. The issue was worsened by touching valid directory leases (TOUCH) instead of leaving them in place (KEEP), preventing the walk from terminating naturally. The fix adjusts lease reclaim logic and the conditions for returning -EAGAIN.

A leaked inode reference in the Linux kernel Ceph filesystem was fixed for the writeback abort path during umount. When ceph_inc_osd_stopping_blocker() fails during umount, the write request is aborted and the wrbuffer claim (i_wrbuffer_ref) is never released, so the inode cannot be evicted and the kernel reports "Busy inodes after unmount of ceph".

In the Linux kernel, cifs_file_set_size() has a use-after-free. When the else branch finds a writable file handle via find_writable_file(), it borrows tcon and server from the handle, attempts the handle-based set_file_size() RPC, then releases the handle with cifsFileInfo_put(). If set_file_size() fails, execution falls through to the path-based fallback, which reuses the borrowed tcon and server even though cifsFileInfo_put() may have freed tcon. The fix sets tcon = NULL after cifsFileInfo_put() to force the safe cifs_sb_tlink() path.

In the Linux kernel CIFS client, cifs_remap_file_range() with len == 0 (clone to EOF) computes the effective length as i_size - off. If off exceeds the file size, the result is a negative loff_t, corrupting the ByteCount in the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range in filemap_write_and_wait_range(). The existing off >= i_size check only fires after the ioctl has already been sent.

In the Linux kernel CIFS client, cifs_do_truncate() invoked from cifs_open() with O_TRUNC cannot use cifs_resize_file_locked() because i_rwsem is not held, so it fails to properly resize the fscache cookie. The fix adds a cifs_invalidate_cache() call after cifs_setsize(), which invalidates the cache without requiring i_rwsem.

In the Linux kernel SMB client (cifs.ko), writing to a file with the setuid/setgid bit set did not clear that bit on the server when mounted with cifsacl, modefromsid, or POSIX/Unix extensions. The VFS requested clearing the bit, but the cifs driver unconditionally skipped the mode change (ATTR_MODE), so the cleared mode was never sent to the server.

In the Linux kernel SMB client, reparse_buf_ptr() reads the ReparseDataLength field before verifying that the received data covers the full fixed header. If a server returns OutputCount < 6, the read at offset 4-5 reaches past the end of the received data.

In the HID sensor custom driver, hid_sensor_custom_add_attributes() did not remove previously created sysfs groups when a subsequent sysfs_create_group() call failed. This left invalid structures and potential access to freed memory.

In the Linux kernel, universal_pidff_probe() starts the device with hid_hw_start() but, if force-feedback initialization fails, returns the error without stopping the device. This leaves the registered hidraw device alive after the driver is cleared, leading to a use-after-free write when /dev/hidrawX is opened.