Linux kernel vulnerabilities

In the Linux kernel, the RDMA/siw driver has an out-of-bounds (OOB) write vulnerability caused by improper length limiting of fragmented header copies. The fix uses the number of already received header bytes to calculate the next copy length.

In the Linux kernel, in the RDMA/srpt driver, the function srpt_alloc_rw_ctxs() on partial failure does not reset the n_rw_ctx and n_rdma counters and does not clear the rw_ctxs pointer, leading to incorrect send queue credit accounting. The fix resets the counters and clears the pointer before returning an error.

In the Linux kernel, in the RDMA rtrs-srv subsystem, process_read and process_write did not validate that usr_len is less than or equal to off, which could lead to an integer underflow. A malicious RDMA client could send usr_len greater than off, causing data_len to wrap to a huge size_t value and leading to out-of-bounds memory access. Validation of usr_len <= off was added before calling rtrs_srv_get_ops_ids().

A vulnerability was found in the Linux kernel's svcrdma module (NFS/RDMA server). A remote peer can send a Write or Reply chunk with a segcount field of zero, which passes validation in xdr_check_write_chunk() and causes a degenerate chunk (ch_segcount == 0) to be linked onto the rc_write_pcl or rc_reply_pcl lists. An earlier patch made pcl_for_each_segment() safe for segcount 0, but the issue remains relevant as defense in depth.

A vulnerability in the Linux kernel's SUNRPC module involves not zeroing the rpc_gss_wire_cred structure at the entry of svcauth_gss_decode_credbody(). Since the structure is reused across requests, early decode failures leave partially stale data, potentially leading to dangling pointers or incorrect lengths. The fix zeroes the structure at entry.

In the Linux kernel, xfrm_dev_direct_output() frees the skb when local_out() returns a value other than 1, even though the skb has already been consumed or its ownership transferred. This causes a double-free when netfilter drops the packet.

A vulnerability in the Linux kernel's IB/isert (iSER) module allows an unauthenticated initiator to declare more data in a login PDU than was actually sent. This leads to an out-of-bounds read before authentication, potentially causing information disclosure or a system crash.

In the Linux kernel's sunrpc subsystem, xprtsock functions use plain stores and loads for shared callback pointers sk_data_ready and sk_write_space. This can lead to another CPU using a stale pointer after the original callbacks are restored. The fix adds READ_ONCE/WRITE_ONCE for these operations.

In the Linux kernel nvmet subsystem, nvmet_auth_negotiate() performs a heap out-of-bounds read because it does not validate the host-supplied transfer length (tl) or the halen/dhlen values. A malicious or non-conformant host can supply a too-small tl or too-large halen/dhlen (up to 255), causing reads past the allocated buffer. The fix passes tl into the function and rejects invalid values.

In the Linux kernel's smb (smbdirect) module, completion queues created by ib_alloc_cq_any() were torn down with ib_destroy_cq(), which did not cancel the previously queued ib_cq_poll_work(). A late completion (e.g. an RNR error from Soft-RoCE/rxe) re-queued the poll work on the already-freed CQ, causing a use-after-free.

A vulnerability exists in the Linux kernel's inetpeer rate limiting system, which stores peer entries in a Red-Black tree keyed deterministically on the remote IP address. An off-path adversary can predict the tree topology and force eviction of targeted nodes, resetting their rate-limiting token buckets, which allows bypassing IP-keyed ICMP rate limits and inferring open UDP ports. The fix randomizes the RB-tree node comparison using SipHash with a secret key.

In the Linux kernel, the NFSv4.1 implementation fails to zero referring call lists before decoding. decode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), leaving each referring_call_list uninitialized, and decode_rc_list() assigns rcl_refcalls only when rcl_nrefcalls is nonzero. A valid list with zero referring calls leaves the pointer uninitialized, and nfs4_callback_sequence() later passes stale slab contents to kfree().

In the Linux kernel, a vulnerability in skb_zerocopy() was fixed: it incorrectly called skb_tx_error() on the source skb when copying frags. This completed the zerocopy uarg and cleared the SKBFL_SHARED_FRAG flag on an skb still in use by the network stack. Specifically on the OVS_ACTION_ATTR_USERSPACE path, the skb was not freed on error, which could lead to ESP data being decrypted in place where the skb did not privately own frags, potentially causing data corruption or other issues.

A vulnerability was found in the Linux kernel's Ceph filesystem where ceph_fname_to_usr() passed vmalloc() buffers to the fscrypt crypto API, which requires linear memory. This can cause kernel oopses, especially on non-x86 platforms. The fix adds support for vmalloc() buffers using a bounce buffer.

In the Linux kernel, nfsd4_revoke_export_states() drops nn->client_lock but the held stateid reference does not pin the client. A concurrent client teardown can free the client while revoke_one_stid() still dereferences it, causing a use-after-free.

In the Linux kernel, an nfs4_openowner left on nn->close_lru holds only a raw pointer to its nfs4_client. When the laundromat reaps entries, drops client_lock and calls nfs4_put_stid(), a concurrent force_expire_client() can free the client, causing a use-after-free.

In the Linux kernel, a bare lock owner left on nn->blocked_locks_lru holds only a raw pointer to its nfs4_client. When the laundromat reaps such a lock, the final nfs4_put_stateowner() takes the client's cl_lock, which a concurrent force_expire_client() may have already freed, causing a use-after-free.

In the Linux kernel, __spi_map_msg() mishandles DMA mapping ownership on partial map failure. When RX or TX mapping fails, flags and device pointers are not properly cleared, which can lead to re-unmapping or using a NULL/stale device pointer. This can trigger a kernel oops.

In the Linux kernel, the scsi target iscsi function iscsi_target_check_login_request() does not reserve a NUL terminator byte for the login buffer. With payload_length from 8189 to 8192, the entire 8192-byte buffer is filled and then consumed as a C string, leading to out-of-bounds reads. The vulnerability is reachable by an unauthenticated initiator when CHAP is configured.

In the Linux kernel, ceph_mds_check_access() traverses the s_cap_auths array without holding the mutex. A concurrent MDS session reopen can free this array while it is being inspected, resulting in a use-after-free.

In the Linux kernel, the nvme_alloc_ns() error path removes the namespace from the sibling list using list_del_rcu() but does not wait for SRCU readers before freeing the namespace struct. A concurrent reader in the multipath code may still hold a reference to ns when kfree(ns) runs, leading to a use-after-free.

In the Linux kernel, nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(), which does not wait for an already-started callback. As a result, during transport teardown the queue containing struct nvmet_sq can be freed or reused while nvmet_auth_expired_work() still accesses it.

In the Linux kernel, nvmet_tcp_try_recv_pdu() computes the remaining PDU payload length without bounding it against the size of the queue->pdu buffer. When a header digest is negotiated, a duplicate ICReq packet causes a 4-byte write past the end of the 128-byte buffer, overwriting queue->hdr_digest and queue->data_digest with attacker-controlled data.

In the Linux kernel, KVM nVMX does not service local TLB flushes when a nested VM-Enter fails. This can lead to a missed TLB flush if L1 changes L2's VPID, then does a failed VM-Enter followed by a successful one.

In the Linux kernel, KVM for arm64 has an issue with incorrectly handling the end of the VA space during TLB invalidation. The range comparison does not account for address rollover, which can lead to failed TLB invalidation for the last page/block in the TTBR1 VA space.

In the Linux kernel, a KVM arm64 issue exists in VNCR invalidation. When one vcpu invalidates the VNCR TLB while another vcpu is faulting in the same page, a stale TLB entry can be inserted. The fix extends invalidate_vncr_va() to update the mmu_invalidate_seq counter so the fault is replayed.

In the Linux kernel, the global VNCR mapping counter in KVM arm64 was removed. This counter was used to decide whether a TLB invalidation was needed, but it had flaws: checking it could cause missed TLB invalidations, and an L1 vcpu invalidating its own TLB would not invalidate the VNCR pseudo TLB. Since it failed to provide required guarantees, it was removed entirely.

In the Linux kernel, the decode_range_tlbi() helper used for S1 range-based TLB invalidation in KVM arm64 omitted the required sign extension of the virtual address. This could lead to incorrect invalidation range calculation. The fix adds the missing sign extension and guards against PA bit overflow when used for S2 invalidation.

In the Linux kernel, the scsi qla2xxx driver's qla_nvme_ls_reject_iocb() function lacks qpair locking when allocating and sending NVMe LS reject, potentially leading to concurrent access and corruption of the request ring state, causing duplicated or dropped commands.

In the Linux kernel, the scsi: qla2xxx driver's qla2x00_async_iocb_timeout() could call sp->done() twice when the response ISR completed the same handle before the timeout handler. This led to a write into a freed stack frame (use-after-free).

In the Linux kernel, the scsi: qla2xxx driver's qla2x00_status_entry() did not bound rsp_info_len from the target's FCP response, causing par_sense_len underflow and an out-of-bounds sense-data read when a hostile or buggy target reported a large value. This could leak adjacent heap memory into the sense buffer.

In the Linux kernel, ext4_read_inline_dir() has an out-of-bounds read. Directory iteration uses a larger extra_size than the actual inline_size buffer, allowing a dirent header to be read past the end of the buffer, potentially leading to information disclosure or crash.

In the Linux kernel, xfrm6_input_addr() has an out-of-bounds write due to an off-by-one depth check. When sp->len reaches XFRM_MAX_DEPTH, writing to sp->xvec[sp->len++] goes past the array, potentially causing a system crash.

A vulnerability in the Linux kernel's ISOFS filesystem related to zisofs compression has been found. The zisofs_uncompress_block() function returns an incorrect byte count for empty blocks, ignoring the poffset, leading to an out-of-bounds read of the page array when handling compressed files on ISO9660 images. A crafted Rock Ridge "ZF" record can trigger this bug during a normal file read.

In the Linux kernel, nfsd_setattr() checked the NFSD_MAY_TRUNC permission using a file size sampled without the inode lock, while the actual size update was applied later under inode_lock(). This created a TOCTOU window for append-only files where a concurrent append could extend the file before a real truncation was applied without the required check.

In the Linux kernel, nfsd4_ssc_expire_umount() walked nfsd_ssc_mount_list while dropping nfsd_ssc_lock for mntput(), but kept the tmp pointer saved by list_for_each_entry_safe. Another NFSD thread could delete and free the item that was the saved tmp during that window, leading to a use-after-free.

A use-after-free vulnerability was fixed in the Linux kernel's nfsd (NFS server) module. After a DESTROY_SESSION, the rpciod thread could still dereference the freed session structure via the cl_cb_session pointer, leading to access of freed memory. The fix converts cl_cb_session to an RCU-protected pointer and changes session freeing from kfree() to kfree_rcu().

A vulnerability was fixed in the Linux kernel's nfsd subsystem affecting the nfsd_fh_verify and nfsd_fh_verify_err tracepoints. The server sockaddr slot in the trace buffer was sized by xpt_remotelen but filled with data of length xpt_locallen, so when xpt_locallen exceeded xpt_remotelen, the memcpy wrote past the reserved ring-buffer slot. The issue is reachable for NFSv2/v3 requests over UDP, where xpt_remotelen remains 0 for the transport's lifetime.

In the Linux kernel, nfsd4_create_file() may call fh_compose() with the wrong dentry. dentry_create() can hypothetically return a different dentry than the one passed in, potentially leading to a use-after-free. The fix moves the fh_compose() call until the final dentry is certain.

In the Linux kernel, nfsd4_copy() for async COPY has an initialization order bug. nfs4_init_copy_state() is called before dup_copy_fields(), so the s2s_cp_stateids IDR entry points to the COMPOUND buffer memory that is reused by the next request. This can lead to use-after-free or memory corruption, causing kernel crashes or potential code execution.

A use-after-free (UAF) vulnerability was fixed in the Linux kernel's NFS asynchronous copy mechanism (nfsd). A race between the copy kthread and teardown callers (OFFLOAD_CANCEL, nfsd4_shutdown_copy, nfsd4_cancel_copy_by_sb) could free or use an already-freed copy structure, double-put nfsd_file, and dereference a freed task_struct.

In the Linux kernel, nfsd4_ff_encode_layoutget() has multiple XDR buffer size calculation errors. These errors can result in an out-of-bounds write or leaking uninitialized kernel memory to the client. The worst case occurs with short strings, where the function writes up to 5 bytes past the reserved XDR buffer.

In the Linux kernel, nfsacld_proc_setacl() for NFSACL v2 SETACL has a bug that can lead to unintended ACL removal. When a SETACL request contains only NFS_ACL, the other pointer (acl_default) remains NULL, and set_posix_acl() with NULL removes the directory's default ACL. Similarly, mask=0 removes both ACLs.

In the Linux kernel, nfsd3_proc_setacl() for NFSv3 SETACL has a bug that can lead to unintended ACL removal. When a SETACL request contains only NFS_ACL, the acl_default pointer remains NULL, and set_posix_acl() with NULL removes the directory's default ACL. Similarly, mask=0 removes both ACLs.

In the Linux kernel, nfsd4_copy_notify() published the cpntf state into the IDR and the parent's list before finishing initialization and before recording the owning clientid. A racing OFFLOAD_CANCEL could free the entry, turning the caller's stateid read and cp_p_stateid/cp_p_clid writes into a use-after-free.

In the Linux kernel, __destroy_client() releases open owners, but a lock owner whose only reference is a blocked lock (nbl) stays on cl_ownerstr_hashtbl. During client teardown the laundromat can free the owner as __destroy_client() dereferences it, causing a NULL dereference in remove_blocked_locks().

In the Linux kernel, the NFSD module has a use-after-free vulnerability during administrative state revocation. The nfsd4_revoke_states() function drops the client_lock, allowing a concurrent teardown to free the client before the state revocation completes. The issue involves a race between state revocation and client destruction.

In the Linux kernel, the NFSD module has a use-after-free vulnerability during delegation revocation. The nfs4_laundromat() function unhashes an expired delegation from cl_delegations, drops deleg_lock, and then revoke_delegation() attempts to use a client that may have already been freed. The lack of client pinning via cl_rpc_users enables a race with client teardown.

In the Linux kernel, the NFSD module has a use-after-free vulnerability during NFSv4.0 revoked-state cleanup. The nfs40_clean_admin_revoked() function drops the client_lock, and then nfsd4_drop_revoked_stid() uses a client that may have been freed by a concurrent teardown. The lack of client pinning enables a race.

In the Linux kernel, the libceph module has a vulnerability due to failure to reject buckets with mismatched CRUSH ids. The crush_decode() function stores data by array slot, and a malformed map can cause one bucket to reuse another bucket's workspace, leading to an out-of-bounds write. KASAN reports an out-of-bounds write in bucket_perm_choose().