CVE Vulnerability Catalog

In the Linux kernel, nfsd3_proc_setacl() for NFSv3 SETACL has a bug that can lead to unintended ACL removal. When a SETACL request contains only NFS_ACL, the acl_default pointer remains NULL, and set_posix_acl() with NULL removes the directory's default ACL. Similarly, mask=0 removes both ACLs.

In the Linux kernel, nfsd4_copy_notify() published the cpntf state into the IDR and the parent's list before finishing initialization and before recording the owning clientid. A racing OFFLOAD_CANCEL could free the entry, turning the caller's stateid read and cp_p_stateid/cp_p_clid writes into a use-after-free.

In the Linux kernel, __destroy_client() releases open owners, but a lock owner whose only reference is a blocked lock (nbl) stays on cl_ownerstr_hashtbl. During client teardown the laundromat can free the owner as __destroy_client() dereferences it, causing a NULL dereference in remove_blocked_locks().

In the Linux kernel, the NFSD module has a use-after-free vulnerability during administrative state revocation. The nfsd4_revoke_states() function drops the client_lock, allowing a concurrent teardown to free the client before the state revocation completes. The issue involves a race between state revocation and client destruction.

In the Linux kernel, the NFSD module has a use-after-free vulnerability during delegation revocation. The nfs4_laundromat() function unhashes an expired delegation from cl_delegations, drops deleg_lock, and then revoke_delegation() attempts to use a client that may have already been freed. The lack of client pinning via cl_rpc_users enables a race with client teardown.

In the Linux kernel, the NFSD module has a use-after-free vulnerability during NFSv4.0 revoked-state cleanup. The nfs40_clean_admin_revoked() function drops the client_lock, and then nfsd4_drop_revoked_stid() uses a client that may have been freed by a concurrent teardown. The lack of client pinning enables a race.

In the Linux kernel, the libceph module has a vulnerability due to failure to reject buckets with mismatched CRUSH ids. The crush_decode() function stores data by array slot, and a malformed map can cause one bucket to reuse another bucket's workspace, leading to an out-of-bounds write. KASAN reports an out-of-bounds write in bucket_perm_choose().

In the Linux kernel, the __kick_flushing_caps() function in the ceph module contains a use-after-free vulnerability. The function iterates over the i_cap_flush_list but drops the i_ceph_lock while sending cap messages, allowing handle_cap_flush_ack() to free a cf entry that the original thread later dereferences after reacquiring the lock.

In the Linux kernel, the check_new_map() function in the ceph subsystem contains a use-after-free vulnerability. The function drops mdsc->mutex to perform per-session operations, but three code paths (address changed, reconnect, active transition) fail to take a reference on the session object beforehand. Another thread can free the session during this unlock window, leading to access of freed memory.

In the Linux kernel, the ceph module has a vulnerability due to failure to reject export_targets ranks >= CEPH_MAX_MDS during mdsmap decode. The check_new_map() function uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can cause set_bit() to write past the array.

In the Linux kernel, the ceph module has a vulnerability due to failure to bound the copied dentry name length in NFS export get_name. The ceph_get_name() function copies the MDS-supplied name into a NAME_MAX-sized buffer without checking dname_len, leading to a buffer overflow. __get_snap_name() copies data in the same unchecked way.

In the Linux kernel, handle_session() in the ceph module lacked bounds checks when decoding the match.path and match.fs_name fields of MDSCapAuth records in a CEPH_SESSION_OPEN message. A malicious or compromised MDS can supply an oversized length, causing an out-of-bounds read (up to 4 GiB) and crashing the client. The fix switches both copies to ceph_decode_copy_safe().

In the Linux kernel, ceph_mdsmap_decode() lacked bounds checking for the num_export_targets array in MDS info records with version 2 or 3. A malicious or compromised Ceph monitor can send an MDS map with an oversized num_export_targets value, causing an out-of-bounds read in the CephFS client kernel.

A vulnerability exists in the Linux kernel's __build_xattrs() function in the Ceph subsystem, which decodes xattr attributes supplied by the MDS server. Missing bounds checking on the last attribute's value length allows a malicious or compromised metadata server to set a length larger than the actual buffer size, leading to an out-of-bounds read. The fix adds the required ceph_decode_need() check, returning -EIO instead of storing the invalid length.

In the Linux kernel, audit_del_rule() has a use-after-free on fsnotify rule autoremove. The unconditional audit_put_tree() assumes the template case, so for mixed AUDIT_DIR and AUDIT_EXE rules an autoremove event drops the installed rule's live tree reference. Repeating this can free the tree while another rule still references it, leading to dereferencing a freed pathname. The fix moves the temporary tree put to audit_rule_change().

In the Linux kernel SMB client, cifs_check_trans2() returning false for a malformed secondary T2 response (invalid SMB header or PDU rejected by check2ndT2()) causes handle_mid() to overwrite mid->resp_buf with the new buffer, leaking the primary buffer and leaving server->smallbuf/bigbuf dangling. This results in a use-after-free when the demux thread reuses the freed buffer.

In the Linux kernel SMB client, free_tgts() frees all structures in ce->tlist but leaves ce->tgthint pointing to one of the freed cache_dfs_tgt structures. If the pointer is not reset before later use, a use-after-free occurs.

In the Linux kernel, the ksmbd_reopen_durable_fd() function rebinds every detached oplock on an inode to the reconnecting session instead of only the oplock owned by the reopened file. This allows one session to adopt another session's oplock, and when the adopting session is destroyed, a use-after-free occurs. The vulnerability is reachable with the default durable-handle and oplock configuration when two sessions open the same file with distinct AppInstanceIds.

In the Linux kernel SMB client, the ALIGN() macro in symlink_data() can overflow for ErrorDataLength values near UINT32_MAX (e.g. 0xFFFFFFF9), wrapping to 0. This causes the bounds check to pass and the loop to advance by zero bytes, leaving pointer 'p' pointing into stale data.

In the Linux kernel SMB client, coalesce_t2() computes data pointers directly from server-supplied DataOffset fields without validating them against buffer bounds. A small DataOffset can push a pointer below the data area and overwrite header fields, while a large one can push it past the buffer end, causing out-of-bounds heap reads or writes.