CVE Vulnerability Catalog

In the Linux kernel, the NFSv2 attribute decoder (svcxdr_decode_sattr) converts wire useconds to nanoseconds by multiplying by 1000 and storing the result in tv_nsec. On 32-bit (ILP32) architectures, an out-of-range useconds value such as 4294968 overflows and produces an incorrect tv_nsec value (e.g., 704) that passes later range checks. The vulnerability affects NFSv2 SETATTR and CREATE operations and was fixed by rejecting useconds values greater than 1000000 during decoding.

A memory (reference) leak of posix_acl objects exists in the nfsd module of the Linux kernel. When an NFS client sends a malformed OPEN operation carrying POSIX ACL attributes, nfsd4_open() is never invoked, so the allocated posix_acl structures are not released. The issue also affects the v4.0 replay path.

A use-after-free vulnerability was found in the Linux kernel nfsd subsystem related to copy-notify stateids. The _free_cpntf_state_locked() function only unlinked an entry once its refcount reached zero, so revoke paths (parent-stid drain, OFFLOAD_CANCEL, and laundromat expiry) could drop a reference without unlinking, leaving the entry discoverable to a concurrent reader. The fix adds revoke_cpntf_state_locked(), which unhashes the entry from the IDR and sc_cp_list first and defers the final free to any holder.

In the Linux kernel, the libceph module has a vulnerability due to missing validation of OSD extent maps before cursor advance. The osd_sparse_read() function does not verify that each extent is monotonic and within the request range, allowing a malicious OSD to advance the cursor beyond the buffer and trigger BUG_ON. This leads to a Ceph client crash.

A vulnerability was fixed in the Linux kernel in the ceph_parse_deleg_inos() function of the Ceph client. A malicious or compromised MDS server could send a reply with a huge or repeated number of delegated inode numbers, causing unbounded loops and excessive growth of the xarray in the client session. Limits were introduced on the number of delegated inodes per session and on the aggregate interval length accepted from a single reply.

In the Linux kernel, the Ceph subsystem's ceph_cap_reclaim_work() repeatedly re-queued itself whenever ceph_trim_dentries() returned -EAGAIN, creating a CPU-consuming busy loop with no progress. The issue was worsened by touching valid directory leases (TOUCH) instead of leaving them in place (KEEP), preventing the walk from terminating naturally. The fix adjusts lease reclaim logic and the conditions for returning -EAGAIN.

A leaked inode reference in the Linux kernel Ceph filesystem was fixed for the writeback abort path during umount. When ceph_inc_osd_stopping_blocker() fails during umount, the write request is aborted and the wrbuffer claim (i_wrbuffer_ref) is never released, so the inode cannot be evicted and the kernel reports "Busy inodes after unmount of ceph".

In the Linux kernel, cifs_file_set_size() has a use-after-free. When the else branch finds a writable file handle via find_writable_file(), it borrows tcon and server from the handle, attempts the handle-based set_file_size() RPC, then releases the handle with cifsFileInfo_put(). If set_file_size() fails, execution falls through to the path-based fallback, which reuses the borrowed tcon and server even though cifsFileInfo_put() may have freed tcon. The fix sets tcon = NULL after cifsFileInfo_put() to force the safe cifs_sb_tlink() path.

In the Linux kernel CIFS client, cifs_remap_file_range() with len == 0 (clone to EOF) computes the effective length as i_size - off. If off exceeds the file size, the result is a negative loff_t, corrupting the ByteCount in the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range in filemap_write_and_wait_range(). The existing off >= i_size check only fires after the ioctl has already been sent.

In the Linux kernel CIFS client, cifs_do_truncate() invoked from cifs_open() with O_TRUNC cannot use cifs_resize_file_locked() because i_rwsem is not held, so it fails to properly resize the fscache cookie. The fix adds a cifs_invalidate_cache() call after cifs_setsize(), which invalidates the cache without requiring i_rwsem.

In the Linux kernel SMB client (cifs.ko), writing to a file with the setuid/setgid bit set did not clear that bit on the server when mounted with cifsacl, modefromsid, or POSIX/Unix extensions. The VFS requested clearing the bit, but the cifs driver unconditionally skipped the mode change (ATTR_MODE), so the cleared mode was never sent to the server.

In the Linux kernel SMB client, reparse_buf_ptr() reads the ReparseDataLength field before verifying that the received data covers the full fixed header. If a server returns OutputCount < 6, the read at offset 4-5 reaches past the end of the received data.

In the HID sensor custom driver, hid_sensor_custom_add_attributes() did not remove previously created sysfs groups when a subsequent sysfs_create_group() call failed. This left invalid structures and potential access to freed memory.

In the Linux kernel, universal_pidff_probe() starts the device with hid_hw_start() but, if force-feedback initialization fails, returns the error without stopping the device. This leaves the registered hidraw device alive after the driver is cleared, leading to a use-after-free write when /dev/hidrawX is opened.

In the mcp2221 HID driver, mcp_i2c_smbus_read() stored a buffer pointer in mcp->rxbuf but never cleared it after the transfer completed. A delayed or spurious MCP2221_I2C_GET_DATA report could write data into freed memory.

In the Linux kernel, the intel-quickspi HID driver does not validate the report size before copying it into the report_buf heap buffer. The buffer is sized from the device descriptor (max_report_len), but the report length coming from a hidraw ioctl is unbounded, allowing a buffer overflow with attacker-controlled data.

In the Linux kernel, quickspi_get_report() in the intel-quickspi HID driver copies the entire device response into the caller's buffer without checking its length. A response larger than the caller's buffer overflows it with device-controlled content.

In the Linux kernel, the fs/ntfs3 driver does not validate the dirty page table during log replay. A crafted DIR_PAGE_ENTRY with an invalid lcns_follow field lets the v0->v1 conversion and later replay passes run off the entry.

In the Linux kernel, ni_read_frame() in fs/ntfs3 trusts decompress_lznt()'s return value, which may be smaller than the frame size. Unwritten bytes remain in the vmapped pages and are returned to userspace, disclosing uninitialized kernel memory.

In the Linux kernel, the copy_lcns and redo shorten loops in fs/ntfs3 index page_lcns[] based on the log record's lcns_follow, which is not checked against the target entry. A crafted record can overflow page_lcns[] of an otherwise valid entry.