Linux kernel vulnerabilities

In the Linux kernel ksmbd SMB server, the FSCTL_DUPLICATE_EXTENTS_TO_FILE function lacks write permission checks at the share and handle levels, allowing a client to overwrite destination file data even on a read-only share or with a FILE_WRITE_ATTRIBUTES handle.

In the Linux kernel, the ksmbd filesystem has a concurrency issue with directory queries. Concurrent QUERY_DIRECTORY requests for the same file handle can overwrite a stack pointer, leading to a use-after-free.

In the Linux kernel, the ksmbd filesystem runs SET_INFO operations with the current ksmbd worker credentials instead of the credentials of the user who opened the handle. This can bypass owner-based and LSM access controls.

In the Linux kernel, the ksmbd filesystem runs the delete-on-close operation with the ksmbd worker credentials instead of the credentials of the user who opened the handle. This can bypass filesystem permission checks.

In the Linux kernel, the ksmbd filesystem runs alternate data stream (ADS) I/O operations with the current task credentials instead of the credentials of the user who opened the SMB handle. This can bypass inode permission and LSM checks.

In the Linux kernel, SMB client has a double-free vulnerability in query directory replay. A response-bearing attempt can free its buffer, and if SMB2_query_directory_init() fails before the next send, cleanup frees the same buffer again. The fix resets response bookkeeping before each attempt.

In the Linux kernel, SMB client has a double-free vulnerability in query_info() replay. A response-bearing attempt can free its buffer, and if SMB2_query_info_init() fails before the next send, cleanup frees the same buffer again. The fix resets response bookkeeping before each attempt.

In the Linux kernel, SMB client has a double-free vulnerability in SMB2_ioctl() replay. A response-bearing attempt can free its buffer, and if SMB2_ioctl_init() fails before the next send, cleanup frees the same buffer again. The fix resets response bookkeeping before each attempt.

In the Linux kernel, SMB client has a double-free vulnerability in change notify replay. A response-bearing attempt can free its buffer, and if SMB2_notify_init() fails before the next send, cleanup frees the same buffer again. The fix resets response bookkeeping before each attempt.

In the Linux kernel, SMB client has a double-free vulnerability in SMB2_flush() replay. SMB2_flush() keeps response buffer bookkeeping across replay attempts. If a replayable flush response is received and the retry fails before storing a new response, flush_exit frees the stale pointer again. The fix reinitializes resp_buftype and rsp_iov at the top of the replay loop.

In the Linux kernel, a problem was found in the devmap broadcast redirect for BPF with fragmented XDP frames. Cloning such frames leaves the XDP_FLAGS_HAS_FRAGS flag set without valid fragment metadata, leading to out-of-bounds access during frame release. The fix rejects fragmented frames in dev_map_enqueue_clone and dev_map_redirect_clone.

A vulnerability in the Linux kernel's nvmet_execute_disc_get_log_page() function allows an unauthenticated attacker to perform an out-of-bounds heap read when processing a Discovery Get Log Page request. Missing validation of offset and data length can lead to kernel memory leak or system panic.

In the Linux kernel, the NVMe over Fabrics (nvmet-auth) subsystem has a vulnerability due to missing bounds validation of hl and dhvlen fields in the DHCHAP_REPLY message. An attacker can send a crafted message with a small transfer length but large hl/dhvlen values, leading to out-of-bounds heap read.

In the Linux kernel's fsl-lpspi SPI driver, a bug was fixed where the RX channel was not terminated when DMA preparation for the TX channel failed. This could lead to memory corruption or a use-after-free bug, as DMA continued writing to buffers that had already been unmapped.

In the Linux kernel RDMA/rtrs-srv component, a vulnerability was found where the RDMA-Write length was not bounded to the chunk size. A malicious client can send a crafted READ request with an inflated descriptor length, causing memory read beyond the mapped chunk region.

In the Linux kernel, the RDMA/siw driver lacks validation of Read Response segment lengths against the sink buffer size. A remote peer can send oversized segments, causing an out-of-bounds write in kernel memory.

In the Linux kernel SMB (CIFS) client, a vulnerability exists where responses with overlapping data areas are rejected. The __smb2_calc_size() function clears data_length, which can make an invalid response appear valid.

A vulnerability was found in the Linux kernel's blk_insert_cloned_request() function, which did not recompute the nr_integrity_segments for cloned requests. This can trigger a BUG_ON() during segment mapping when the bottom queue has stricter segmentation settings than the top queue.

In the Linux kernel's netfs subsystem, a use-after-free vulnerability was found in netfs_unlock_abandoned_read_pages(). The function accesses the folio index after clearing the NETFS_RREQ_IN_PROGRESS flag, potentially leading to dereference of freed memory.

In the Linux kernel, the idpf driver has a bug in idpf_ptp_init() where the read_dev_clk_lock spinlock is initialized after the PTP auxiliary worker is scheduled, which can immediately try to acquire the lock, causing a lockdep warning about registering a non-static key.

In the Linux kernel, a vulnerability was found in the netfs mechanism, involving potential tearing when reading and writing the ->remote_i_size and ->zero_point fields. The issue stems from insufficient synchronization, which could lead to data corruption.

In the Linux kernel, a bug was found in the netfilter nft_inner module's error path where local_bh_enable() is called before local_unlock_nested_bh(), potentially causing incorrect lock state and synchronization issues.

In the Linux kernel's ksmbd (SMB3) subsystem, two related vulnerabilities were found: reuse of the fp->node list head causing list corruption and a reference count race leading to use-after-free (UAF) during durable handle cleanup by ksmbd_durable_scavenger().

In the Linux kernel, a missing lock around the tc_count increment in smb2_find_smb_sess_tcon_unlocked() was found. This issue arose after a refactoring of CIFS code that changed locking from cifs_tcp_ses_lock to tc_lock but did not cover this specific location.

A vulnerability was found in the Linux kernel's IOAM implementation for IPv6. The ipv6_hop_ioam() function fails to refresh the hdr pointer after a potential data buffer reallocation by skb_ensure_writable(), leading to a Use-After-Free condition.

In the bcmgenet driver for Broadcom chips, a vulnerability causes RX traffic to stall after EEE activation. Setting RBUF_EEE_EN and RBUF_PM_EN bits in RBUF_ENERGY_CTRL prevents RBUF from forwarding frames to DMA, stopping rx_packets increment and potentially causing a paging fault. Reproduced on Pi 4B and Broadcom 4908-family boards.

In the Linux kernel, a use-after-free vulnerability was found in the mlx5e driver in the mlx5e_tx_reporter_timeout_recover function. The issue occurs when the function accesses sq->netdev after mlx5e_safe_reopen_channels() has torn down and freed the channel (and its SQs). The fix replaces three sq->netdev references with priv->netdev, which is safe because priv outlives channel teardown.

In the Linux kernel's ixgbevf driver, a use-after-free vulnerability was found in ixgbevf_clean_rx_irq(). During VEPA multicast source pruning, after freeing the skb buffer, the pointer is not nullified, leading to a dereference of freed memory in the next loop iteration.

In the Linux kernel's KVM for ARM64, a vulnerability was found in the emulated ITS (Interrupt Translation Service) controller. The function restoring Device Table Entries (DTE) did not validate the number of EventID bits, allowing restoration of an out-of-range value larger than supported by the virtual ITS.

In the Linux kernel, the RDMA/siw (Soft-iWARP) driver lacks validation of the MPA header length in received FPDU frames. A malicious remote peer can send a frame with an mpa_len smaller than the required DDP/RDMAP header, causing a signed integer underflow and leading to a use-after-free memory read.

A TOCTOU (time-of-check time-of-use) vulnerability was found in the Linux kernel's batman-adv implementation. During local TT-based TVLV generation, the VLAN count is checked first, then a buffer is allocated. Despite holding a lock, the number of TT entries per VLAN can increase between check and allocation, causing a buffer overflow.

In the Linux kernel, the batman-adv module has a vulnerability where the last_changeset_len field is declared as signed short (s16) but never intended to hold negative values. Assigning a value greater than 32767 wraps it to a negative signed integer, causing incorrect sign extension when widened to s32 in batadv_send_my_tt_response(). This results in allocating a full-sized buffer but populating only a small portion, leaving the rest uninitialized.

In the Linux kernel, a use-after-free vulnerability was found in the ARM FFA firmware driver's notification handling. Notification handlers look up a callback pointer under a lock but invoke it after dropping the lock, allowing a concurrent unregister to delete and free the memory.

A vulnerability was found in the Linux kernel's netfs filesystem, related to cancellation of DIO and single read requests. The bug occurs when preparation of a new read subrequest fails and the subrequest has already been added to the list, leading to improper reference management and potential race conditions.

In the Linux kernel, missing locking was found when adding new subrequests in retry functions for read and write operations in the netfs filesystem. This vulnerability could lead to data races and system instability.

In the Linux kernel's netfs subsystem, missing memory barriers were found when accessing the stream->subrequests list without locks. Reader functions may see incomplete data because the NETFS_SREQ_IN_PROGRESS flag might not be visible yet. The fix adds proper release/acquire barriers to list operations.

A vulnerability was found in the Linux kernel's netfs_read_to_pagecache() function, which fails to pause the generation of new subrequests after a subrequest failure. The fix adds a pause in subrequest generation upon error.

A use-after-free vulnerability was found in the Linux kernel's netfs subsystem in netfs_read_gaps(), where a sink folio was released prematurely. This can lead to memory corruption and potential exploitation.

In the Linux kernel, a vulnerability was found in the cortina (Gemini Ethernet) network driver. A static local SKB buffer used for reassembling packets from fragments in gmac_rx() is shared between two Ethernet ports, potentially causing race conditions when both ports are used simultaneously.

In the Linux kernel, a vulnerability was found in the Cortina Ethernet driver where the fragment counter (frag_nr) is reset during packet reception in the gmac_rx() function. When the ring buffer is completely emptied during a poll cycle, the fragment counter is reset even though the packet is not yet fully assembled in the SKB, potentially causing incorrect packet reassembly.

In the Linux kernel, a vulnerability was found in the TLS implementation due to an off-by-one error when chaining wrapped sk_msg rings using sg_chain(). The chain pointer is placed at MAX_SKB_FRAGS instead of the last entry, potentially causing incorrect cryptographic operations.

A vulnerability in the Linux kernel's TLS implementation creates an invalid scatterlist chain when end=0 (start!=0), resulting in a chain-after-chain scenario. This passes illegal input to the crypto layer, potentially causing errors or security breaches.

In the Linux kernel's iwlwifi (MLD) driver, disabling AMSDU aggregation for a TID sets max_tid_amsdu_len to 1. The TSO segmentation path lacks a check for this sentinel value, resulting in zero gso_size, which generates over 32000 tiny frames from a single GSO skb. This floods the TX ring, causes massive TX completion events, memory corruption, and a use-after-free in TCP's retransmit queue.

In the Linux kernel, a vulnerability in the igc driver was found where the tx buffer type for SMD (Sashiko Mode Data) frames is not set. The igc_fpe_init_smd_frame() function initializes igc_tx_buffer fields but does not set the buffer type, which can cause TX completion to use the wrong cleanup path when buffers are reused, potentially affecting XDP or XSK transmissions.

In the Linux kernel's MANA driver, a TOCTOU (time-of-check time-of-use) vulnerability was found due to a double-fetch of the hwc_msg_id field from a DMA buffer. The first read is used for bounds checking, and the second for further processing, allowing a malicious device to alter the value between reads and bypass the validation.

In the Linux kernel RDMA/rtrs component, a use-after-free vulnerability was found in the error handling path of rtrs_srv_create_path_files(). Calling kobject_put() before destroying sysfs root folders can free memory that is later accessed, leading to a use-after-free condition.

In the Linux kernel, a vulnerability in the BPF skmsg mechanism was found where sk_psock_verdict_data_ready() does not check for a TLS RX context, causing a race condition with ktls reception. This can lead to a use-after-free condition during data processing.

A vulnerability in the Linux kernel's TCP implementation allows ISN (Initial Sequence Number) prediction for TIME_WAIT connections. The issue stems from storing the ISN in a per-CPU variable that is not cleared when a packet is dropped on various paths (e.g., min_ttl check, xfrm policy, MD5/AO mismatch, eBPF filter). The next SYN processed on the same CPU may receive a predictable ISN.

In the Linux kernel's MANA network driver, the rx_req_idx is not validated before being used to index the reqs[] array. In confidential VMs (SEV-SNP/TDX), DMA memory can be modified by hardware, allowing out-of-bounds array access.

In the Linux kernel's ksmbd filesystem, a vulnerability was found in the error path of durable reconnect handling. After a successful reconnect, a cleanup function may free the file object without removing it from the session ID table, leading to a use-after-free condition.