Linux kernel vulnerabilities

In the Linux kernel, the GUE module has a vulnerability due to missing validation of the REMCSUM private option length. guehdr_priv_flags_len() returns 0 even when GUE_PFLAG_REMCSUM is set, allowing malformed packets to pass and read missing fields from subsequent bytes.

In the Linux kernel, the netfilter ip6tables module mishandles malformed IPv6 extension headers. For ah, hbh, and rt matches, the advertised header length checks are missing or outdated. The fix adds the missing check for ah and updates checks for hbh and rt, also setting hotdrop to true to drop malformed packets.

In the Linux kernel's qede driver, there is an off-by-one error in BD ring consumption when skb building fails. The functions qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a NULL return from qede_build_skb(), leading to excessive BD consumption and desynchronization of the BD ring, which can corrupt DMA page reference counts and cause SLUB freelist corruption.

In the Linux kernel's liquidio driver, there is an issue with caching VF pci_dev pointers without proper reference counting, potentially leading to use-after-free when handling FLR requests.

In the Linux kernel's IPv4 IGMP module, there is a race condition between device teardown and IGMP query processing, which can lead to use-after-free in igmp_gq_start_timer().

In the Linux kernel's IPv6 MLD module, there is a race condition between device teardown and MLD query processing, which can lead to use-after-free in the MLD delayed work.

In the Linux kernel, the netfilter nft_lookup module has a bug in catchall element handling with inverted lookups. The 'found' variable is not recomputed after 'ext' is replaced by the catchall lookup, which can lead to incorrect matching or skipping of the catchall element in negated queries.

In the Linux kernel, the IPVS module has an issue ensuring that inner headers in ICMP errors are in the skb headroom. After stripping outer headers with pskb_pull(), the inner IP headers may not be available for functions like ipv4_update_pmtu(), icmp_send(), and IP_VS_DBG(). Additional length checks for inner headers were added.

In the Linux kernel, the cifs module has a vulnerability due to lack of validation of string offsets in DFS responses. A malicious server can provide offsets pointing outside the response buffer, leading to out-of-bounds memory read during path name processing.

In the Linux kernel SUNRPC subsystem, a use-after-free vulnerability exists in the TLS connect path. Nothing pins the upper rpc_clnt across the delayed connect_worker, which can lead to dereferencing freed memory when a TLS connection fails (e.g., mTLS error).

In the Linux kernel TIPC subsystem, a vulnerability was found where the tracepoint in tipc_sk_enqueue() dumped the sk_receive_queue without proper locking, leading to a use-after-free condition reported by KASAN. The fix restricts the dump to the spinlock-protected backlog queue only.

In the Linux kernel, the ife_decode() function does not guarantee that the inner Ethernet header is accessible in the linear data area, which can lead to a crash with malformed IFE frames.

In the Linux kernel for KVM on s390, try_get_locked_pte() had an unlikely race that could occur if puds or pmds were unmapped between p?dp_get() and p?d_offset(). The fix eliminates this race.

In the Linux kernel for KVM on arm64, vgic_prune_ap_list() had an issue during interrupt migration to another vCPU. After reacquiring locks, it only checked affinity, not whether the interrupt still belonged to this vCPU. The fix adds a check irq->vcpu == vcpu before moving.

In the Linux kernel for KVM on arm64, vgic_prune_ap_list() had a race between interrupt affinity change and LPI disabling, which could lead to use-after-free (UAF). The fix takes a reference on the interrupt before dropping locks and does not attempt to migrate the pending bit.

In the Linux kernel, KVM arm64 (nested mode) mapping of L1 VNCR into host stage-1 did not respect read-only PFNs. The fix caches PFN writability and constrains mapping permissions, also fixing a page leak.

In the Linux kernel, KVM arm64 (nested mode) did not re-translate the VNCR address on a page fault. The fix invalidates the VNCR TLB entry and re-fetches the translation to allow write mapping on the second attempt.

In the Linux kernel, KVM arm64 (nested mode) unconditionally used cacheable memory attributes for L1 VNCR mappings, even if the underlying PFN is not memory. The fix rejects anything that isn't normal memory to avoid SError issues.

In the Linux kernel, the nf_nat_sip netfilter module has a vulnerability due to a stale data pointer after buffer reallocation. This can lead to packet header corruption.

In the Linux kernel, the netfilter flowtable module has a vulnerability due to using the route from the opposite direction when pushing the IPIP header. This can lead to incorrect headroom calculation and field settings.

In the Linux kernel, the netfilter flowtable module has a vulnerability that causes a crash during IPIP tunnel transmission with direct xmit. The lack of dst_entry leads to invalid dst usage and can trigger a crash.

In the Linux kernel x86/virt/sev subsystem, a previous fix regarding WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN was reverted. The call to wbinvd_on_all_cpus() before SNP_INIT_EX was restored to meet SNP specification requirements for clean cache lines.

In the Linux kernel's batman-adv module, after pskb_may_pull() is called by batadv_get_vid(), the skb buffer may be reallocated. The unicast_packet pointer was not reassigned after this reallocation, potentially leading to a use-after-free.

In the Linux kernel's batman-adv module, the number of VLANs in a TT unicast TVLV is of type u16 and is multiplied by the size of struct batadv_tvlv_tt_vlan_data (8 bytes). This can overflow the u16, invalidating all additional safety checks and potentially leading to an out-of-bounds read.

In the Linux kernel's SUNRPC subsystem, a use-after-free vulnerability exists in the asynchronous TLS handshake handling. The svc_xprt pointer is stored without taking a reference, leading to a race where the callback can write to freed memory. The issue affects NFS servers with TLS enabled when connection close overlaps with the tlshd downcall delivery window.

In the Linux kernel, a race condition in the sunrpc module during TLS handshake cancellation was fixed. When wait_for_completion_interruptible_timeout() returns timeout or signal and cancellation loses the race, the handshake callback may not have committed its side effects, leading to double invocation of the handshake or connection teardown despite successful handshake. The fix waits for the callback to commit before checking flags.

In the Linux kernel's sunrpc subsystem, svc_release_rqst() executes the callback in rqstp->rq_procinfo->pc_release. If a worker thread hits an early error path before a valid rq_procinfo is installed, a stale release hook can be re-triggered against reused state from the previous RPC, leading to double-free or use-after-free. The fix hardens the rq_procinfo lifecycle by clearing it after pc_release, at request entry in svc_process(), and in svc_process_bc().

In the Linux kernel's SUNRPC module, xdr_buf_to_bvec() writes to the caller's array before checking if the slot is in range, potentially causing an out-of-bounds write. The rq_bvec array passed by nfsd_vfs_write() is allocated without slack, so the OOB store can corrupt adjacent memory.

In the Linux kernel's ntfs module, there is an ordering issue when growing the index root value. The larger header is published before resizing the resident value, which can lead to a transient state considered corrupt if the resize fails.

In the Linux kernel's ntfs module, there is an off-by-one error in bounds checks during mapping pairs decompression. Strict greater-than comparisons allow a one-byte out-of-bounds read when data ends exactly at the boundary.

A vulnerability in the Linux kernel's NTFS filesystem was found where ntfs_attr_find() and ntfs_external_attr_find() do not properly validate length fields in variable-length resident attributes. A crafted disk image can trigger an out-of-bounds read (slab-out-of-bounds) during filename lookup operations.

In the Linux kernel, a bounds check was added before accessing EA entries in the NTFS filesystem. In ntfs_ea_lookup and ntfs_listxattr, it verifies that there is enough space in the EA entry before accessing the next_entry_offset field.

In the Linux kernel, the NTFS filesystem no longer converts zero-length $DATA attributes to non-resident. Previously, when a resident attribute could not be grown in place, other resident attributes were converted to non-resident, but now zero-length $DATA attributes are skipped because fsck treats such non-resident attributes as corruption.

In the Linux kernel, the NTFS filesystem now performs stricter validation of the index block header. The ntfs_index_block_inconsisent() function was modified to validate INDEX_HEADER geometry in INDX blocks more thoroughly, and ntfs_lookup_inode_by_name() uses this function to validate INDX blocks.

In the Linux kernel, the NTFS filesystem now validates index entries on reading. Index entries are validated immediately after reading an index root or index block from disk, eliminating repeated checks in lookup and readdir and reducing the risk of missing checks in those paths.

In the Linux kernel, the NTFS filesystem detects mapping-pairs LCN accumulator overflow. The parser accumulates relative LCN deltas in a signed integer, and a corrupted attribute can drive the addition past the representable range. An overflow check is added before storing the next run.

In the Linux kernel, the NTFS filesystem now validates resident $INDEX_ROOT values on lookup. Resident $INDEX_ROOT values carry index header fields that callers consume after lookup. Validation of the header fields is added before returning the attribute, requiring 8-byte alignment, a sane entries_offset, index_length within allocated_size, allocated_size within the resident value, and enough entry space for at least an index entry header.

In the Linux kernel's NTFS3 filesystem, the indx_find_buffer function had no recursion depth limit, potentially leading to kernel stack overflow. The fix adds a depth parameter and a check against the limit.

In the Linux kernel's NTFS3 filesystem, a vulnerability allows an out-of-bounds write when promoting a full resident $INDEX_ROOT to $INDEX_ALLOCATION. A crafted NTFS image can cause memcpy of attacker-controlled data past the allocated buffer, leading to heap corruption.

In the Linux kernel's NTFS3 filesystem, a vulnerability allows out-of-bounds write due to missing validation of the split-point offset in indx_insert_into_buffer. A crafted NTFS image causes an integer underflow and a near-4GiB memmove, corrupting memory and panicking the kernel.

In the Linux kernel's NTFS filesystem, ntfs_lookup_inode_by_name() returns MFT references read from directory index entries on disk, which are untrusted. The function can return an error-marked MFT reference without validation, causing callers to misinterpret the result. The fix normalizes all such references to ERR_MREF(-EIO) across all four return paths.

In the Linux kernel's NTFS filesystem, system files such as $Bitmap can be written from userspace, leading to volume corruption and writeback deadlock. The fix marks base metadata files as immutable during inode read so the VFS rejects write, mmap, truncate, and unlink with -EPERM.

In the Linux kernel's NTFS filesystem, ntfs_map_runlist_nolock() can encounter a resident attribute where a non-resident one is expected, previously triggering only a WARN_ON and leading to reading the wrong union member. The fix replaces the WARN_ON with an -EIO error return, causing crafted images to be rejected during mount.

A vulnerability was found in the Linux kernel's tcp_connect() function related to TCP and MD5 authentication. In one code branch, the tcp_md5sig_info structure and tcp_md5sig_key entries are freed without respecting the RCU grace period, causing a race condition with softirq readers. This leads to a use-after-free of MD5 key memory.

In the Linux kernel, the xfrm module has a double-free issue in nat_keepalive_send(). When the IPv4 or IPv6 helper reports an error, the keepalive packet is freed, but if the packet has already been handed to the network stack, it may be freed again, leading to unsafe operation.

In the Linux kernel, the nvmet-auth module has a heap out-of-bounds write vulnerability in nvmet_execute_auth_receive(). The function trusts the AUTH_RECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In SUCCESS1 and FAILURE1 states, a short buffer can lead to writing past the allocated memory.

In the Linux kernel, the nvmet-rdma module has an issue with handling inline data with a nonzero offset. The function nvmet_rdma_use_inline_sg() maps the host-controlled offset but assumes the data begins in the first inline page. For offsets larger than the page size, a length underflow can occur, leading to out-of-bounds reads.

In the Linux kernel, the dm-verity module has a buffer overflow in FEC calculation. The bug allows writing beyond the bounds of the lambda array in the RS decoder, which can corrupt the syndrome buffer. The fix addresses this overflow.

In the Linux kernel scsi: xen: scsiback driver, on error paths before command submission, there is a double-put of se_cmd with refcount 0, leading to refcount underflow and tag leak. The fix adds a helper that just returns the tag and sends the error response.

A vulnerability in the Linux kernel SCSI target subsystem affects parsing of PERSISTENT RESERVE OUT buffers. The TransportID parser was not given the buffer length, allowing out-of-bounds reads via a malformed iSCSI identifier. It is reachable through any fabric delivering PR OUT to an iSCSI TPG, including vhost-scsi.