CVE Vulnerability Catalog

In the Linux kernel SMB client, coalesce_t2() computes data pointers directly from server-supplied DataOffset fields without validating them against buffer bounds. A small DataOffset can push a pointer below the data area and overwrite header fields, while a large one can push it past the buffer end, causing out-of-bounds heap reads or writes.

In the Linux kernel SMB client, CIFSTCon() bounds its strnlen() by the server's ByteCount minus two, which for ByteCount 0 or 1 becomes negative as an int and converts to a huge size_t. The later subtraction wraps __u16 bytes_left, allowing cifs_strndup_from_utf16() to read up to 65535 bytes from a ~16 KB object, leaking data through /proc/fs/cifs/DebugData.

In the Linux kernel SMB client, the is_valid_oplock_break() function no longer effectively validates the DataOffset field. Due to an earlier change in RFC1002 header handling, the expression used for validation always evaluates to zero, so the check never rejects invalid values.

In the Linux kernel, the ntfs driver bounds its free-cluster bitmap scan by the size of $Bitmap rather than the volume's cluster count. An image whose $Bitmap covers more clusters than the volume allows indexing past the lcn_empty_bits_per_page array.

In the Linux kernel, the ntfs driver does not reject attributes with empty mapping pairs if they have inconsistent highest VCN and size. The lack of validation can lead to incorrect processing.

In the Linux kernel, parse_ntfs_boot_sector() decodes the NTFS boot sector's 64-bit LCNs into an s64. A crafted high-bit value becomes negative and passes the upper-bound check, leading to an out-of-bounds access to lcn_empty_bits_per_page.

In the Linux kernel, ntfs_attr_update_meta() does not validate the attribute name offset when converting between non-sparse and sparse attributes. A malicious MFT record can set name_offset so the name extends beyond the attribute boundary or overlaps with mapping pairs.

In the Linux kernel, the NTFS mapping pairs decoder validated the starting LCN but did not check whether the run extends beyond the volume boundary. A malformed NTFS image with a crafted mapping pairs array could cause the kernel to access memory beyond the volume boundary, potentially leading to memory corruption and privilege escalation.

In the Linux kernel, the still_degraded variable in raid10_sync_request() was inverted (set to false instead of true) during conversion from int to bool. This causes the bitmap to be incorrectly cleared when recovering a device while another mirror is still missing, leading to silent data corruption after the missing device is re-added.

In the Linux kernel, mpls_select_multipath() caches the hdr pointer to the MPLS header and then calls pskb_may_pull(), which may replace the skb head and free the old one, leaving hdr pointing to freed memory. This leads to a use-after-free when reading the inner IP header.

In the Linux kernel, xdr_buf_trim() does not clamp the subtraction from buf->len, so when buf->len is smaller than the sum of iov_lens, an underflow occurs and wraps to near UINT_MAX. This state is reachable via gss_krb5_unwrap_v2(), and the wrapped value propagates as the authoritative stream bound into all downstream XDR decoders.

In the Linux kernel, svcauth_gss_unwrap_priv() only validated an upper bound on the wire-supplied opaque length before passing the buffer to gss_unwrap(), with no minimum length check. A token of 16 bytes or less (the RFC 4121 header size) reached gss_krb5_unwrap_v2(), where header reads ran past the token and rotate_left() could divide by zero. The fix adds a minimum-length check before the token reaches the krb5 unwrap core.

In the Linux kernel, a race occurs during backchannel receive when the NFS callback service is being torn down. xprt_enqueue_bc_request() may skip enqueueing or freeing the request if xprt->bc_serv has already been cleared, leading to a leak or use-after-free.

A vulnerability was fixed in the Linux kernel's SUNRPC gss_krb5_unwrap_v2() function, which read EC and RRC header fields out of bounds before validating the token length. Unsigned arithmetic underflow could trigger a ~UINT_MAX-byte memmove, and a zero-length buffer could cause a divide-by-zero. Four defense-in-depth guards were added to validate token and buffer lengths.

A vulnerability was fixed in the Linux kernel's SUNRPC gss_unwrap_resp_priv() function. Improper validation of the RPCSEC_GSS opaque length (opaque_len) allowed u32 arithmetic overflow and lacked a lower bound, enabling out-of-bounds reads in gss_krb5_unwrap_v2().

A vulnerability was fixed in the Linux kernel's gss_krb5_unwrap_v2() function in the SUNRPC module. A Kerberos v2 token with an 'extra count' (ec) field larger than the plaintext length, even when sent by an authenticated peer with a valid GSS context, left the xdr_buf in an inconsistent state (zero length, mismatched iov lengths). The fix rejects such tokens before calling xdr_buf_trim(), returning a GSS_S_DEFECTIVE_TOKEN error.

The Linux kernel has a vulnerability in the SUNRPC function gss_krb5_verify_mic_v2(), which fails to check the minimum length of a MIC token before reading its contents. A remote attacker (e.g., a malicious NFS server) can supply a short token, causing an out-of-bounds read of the allocated buffer. The issue was fixed by adding a length guard.

In the Linux kernel, xs_tls_handshake_sync() in the SUNRPC subsystem has a use-after-free race during TLS handshake cancellation. When handshake_req_cancel() returns false (because handshake_complete() already marked the request complete), the waiter may drop the lower transport reference before the xs_tls_handshake_done() callback finishes. This can free the transport while it is still in use.

A bug was fixed in the Linux kernel's svcrdma module in svc_rdma_read_chunk_range(), related to offset arithmetic when building a read range for RDMA chunks. Incorrect use of '>' instead of '>=' and improper min_t() bracketing caused u32 underflow, wrong DMA lengths, and potentially large memory allocations (multi-MiB kmalloc_array_node). The function also rejected valid zero-length requests.

A vulnerability exists in the Linux kernel's svcrdma component related to the pcl_for_each_segment macro. When a parsed chunk list contains a chunk with ch_segcount equal to zero, the inclusive upper bound calculation underflows, causing the loop to walk past the ch_segments flex array and resulting in an out-of-bounds read and a general protection fault. The issue is reachable from the wire via a Write or Reply chunk advertising zero segments when the transport has negotiated Send-With-Invalidate.