CVE Vulnerability Catalog

In the Linux kernel ksmbd SMB server, a path traversal bypass exists in __ksmbd_vfs_kern_path() because the -EXDEV error from vfs_path_parent_lookup() is not intercepted, allowing the caseless retry logic to create files or directories outside the shared resource.

In the Linux kernel, the ksmbd filesystem lacks a permission check for the FSCTL_SET_ZERO_DATA operation. An authenticated SMB client can use a handle opened only with FILE_WRITE_ATTRIBUTES to zero file data without FILE_WRITE_DATA rights.

In the Linux kernel, the ksmbd filesystem has a use-after-free vulnerability in the file_lock structure during deferred lock cancellation. When a lock is cancelled and the work is no longer active, freeing the lock before removing it from the async list leads to accessing freed memory.

In the Linux kernel, the ksmbd filesystem lacks a read permission check for the source file during the duplicate extents operation (FSCTL_DUPLICATE_EXTENTS_TO_FILE). A handle opened only with attribute access can be used to copy file contents to an attacker-readable destination.

In the Linux kernel's ksmbd (SMB) filesystem, a missing WRITE_DAC/WRITE_OWNER permission check in the SMB2 SET_INFO SECURITY operation allows a client with a low-privilege handle (e.g., FILE_WRITE_ATTRIBUTES) to rewrite the file's security descriptor and gain unauthorized access.

In the Linux kernel, the ksmbd filesystem has a lock management issue with SMB3 multichannel. A byte-range lock can be removed from the connection list using the wrong spinlock, leading to access to freed objects during concurrent list traversal.

In the Linux kernel, the ksmbd filesystem validates the NTLMv2 response after updating the session key. On authentication failure, the session key can be modified before the error is returned, allowing a client to change the session key of an existing binding session.

In the Linux kernel, SMB3 client with POSIX Extensions ignored chown/chgrp changes unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID were set. The fix checks for posix_extensions in cifs_setattr_nounix() to properly call id_mode_to_cifs_acl() and set ownership/group on the server.

In the Linux kernel, SMB client has a double-free vulnerability in SMB2_open() replay. A response-bearing attempt can free its buffer, and if SMB2_open_init() fails before the next send, cleanup frees the same buffer again. The fix resets response bookkeeping before each attempt.

In the Linux kernel, SMB client function receive_encrypted_standard() allocates next_buffer before checking if the number of compound PDUs reached MAX_COMPOUND. If the limit is exceeded, the function returns immediately and the allocated next_buffer is leaked. The fix moves the MAX_COMPOUND check before allocating next_buffer.

In the Linux kernel, SMB client function posix_info_sid_size() reads sid[1] for subauthority count, but its boundary check still accepts buffers with only one remaining byte. The fix requires two bytes before reading sid[1] so all client paths safely reject truncated POSIX SIDs.

In the Linux kernel, SMB client with modefromsid active, parse_dacl() applies the server-provided sub_auth[2] value from the NFS mode SID to cf_mode without masking to 07777. The fix adds correct masking, same as in the read path.

A race condition between cgroup_writeback_umount() and inode_switch_wbs() in the Linux kernel causes a BUG_ON during filesystem unmount after container exit. This results in busy inodes and potential kernel panic.

In the cpufreq driver for Qualcomm devices, a double free vulnerability was found. The qcom_cpufreq_hw_cpu_exit() function calls kfree() on a pointer to devres-managed memory, which can lead to a double free when the device is detached.

In procfs, a race condition was found in proc_pid_get_link() and proc_pid_readlink(). The ptrace access check and task lookup are performed separately, allowing a race.

A vulnerability was found in the Linux kernel's RT_PUSH_IPI mechanism for the real-time (RT) scheduler. When RT_PUSH_IPI is enabled on a system without PREEMPT_RT, a live lock can occur on a CPU where softirqs run in interrupt context. This causes excessive IPI interrupts that slow down softirq processing, preventing context switching and leading to CPU lockup.

In the pcc cpufreq driver, a use-after-free and double free were found during _OSC evaluation. After the first acpi_evaluate_object() call, the output buffer is freed but pointer and length are not reset, causing a write to freed memory on the second call.

In the Linux kernel's mm/slab subsystem, a bug was found in the memory zeroing mechanism during allocation. When only red zoning (SLAB_RED_ZONE) is enabled without tracking the requested size (SLAB_STORE_USER), kmalloc may zero only the requested size instead of the full object, breaking the __GFP_ZERO guarantees for krealloc.

In the HID driver for Goodix SPI devices (hid-goodix-spi), there is no validation of the report size before copying it into a 128-byte stack buffer. An attacker can send a report larger than ~116 bytes via the SET_REPORT ioctl, causing a stack buffer overflow.

In the Wacom HID driver (wacom_wac), the wacom_wac_queue_insert() function can call kfifo_skip() on an empty kfifo buffer, causing it to read garbage data and corrupt the internal kfifo state. This can lead to an out-of-bounds write beyond the 256-byte buffer, potentially writing up to 3842 bytes past the memory.