Linux kernel vulnerabilities

In the Linux kernel, the AVX2 implementation for pipapo sets in netfilter has a bug that returns non-matching entries on expiry. The issue occurs when AVX2 match functions process the last field without consuming the entire input, leading to false element collision reports.

In the Linux kernel, ext4 could exceed the 32-bit block number range when searching for blocks for indirect block mapped files. This occurs when ac->ac_g_ex.fe_group is greater than or equal to ngroups, potentially allocating blocks outside the supported range. A safety clamp was added in ext4_mb_scan_groups().

A vulnerability has been identified in the Linux kernel that involves missing packet data copying from the XDP buffer to the skb structure, leading to kernel memory leakage to user space. Additionally, improper skb recycling marking may corrupt the page pool state.

In the Linux kernel, a vulnerability in ip6_err_gen_icmpv6_unreach() fails to clear the cb[] field in skb2, leading to misinterpretation of control data. An attacker can send a crafted ICMPv4 packet with a CIPSO option, causing an out-of-bounds read in icmp6_send().

A vulnerability was found in the Linux kernel's ip4ip6_err() function in the IPv6-over-IPv4 tunnel. An uninitialized cb[] area in a cloned skb can be misinterpreted as an IPv4 structure, leading to attacker-controlled data reads and a stack buffer overflow.

In the Linux kernel X.25 stack, a double free of a socket buffer (skb) was discovered. When x25_queue_rx_frame fails to allocate memory, it frees the skb and returns an error, but the caller x25_backlog_rcv also attempts to free the same skb, causing a double free.

A vulnerability has been identified in the Linux kernel related to use-after-free in the __ksmbd_close_fd() function. The issue arises when a durable file handle survives session disconnect, leading to improper management of byte-range locks.

In the Linux kernel, a vulnerability was found in the bridge's br_nd_send() function, which parses neighbor discovery (ND) options from ICMPv6 packets. The function assumed these options are in the linear part of the buffer, but in some cases they can be non-linear, leading to out-of-bounds memory access. The fix linearizes the skb before parsing ND options.

A use-after-free vulnerability was found in the Linux kernel's MPTCP implementation, specifically in __inet_lookup_established. The issue arises from incorrect initialization of the TCPv6 protocol for MPTCP subflow child sockets, which are allocated via kmalloc instead of the proper slab cache with SLAB_TYPESAFE_BY_RCU flag. This allows concurrent access to freed memory during ehash table lookups, potentially leading to security breaches.

In the Linux kernel, the seg6 lwtunnel uses a single dst_cache per encap route, shared between seg6_input_core() and seg6_output_core(). These paths can perform the post-encap SID lookup in different routing contexts, and whichever runs first populates the cache that the other reuses blindly. The fix splits the cache into cache_input and cache_output.

In the Linux kernel, batman-adv's batadv_tt_prepare_tvlv_global_data() builds the allocation length for a global TT response in 16-bit temporaries. When a remote originator advertises a large enough global TT, the TT payload length plus the VLAN header offset can exceed 65535 and wrap before kmalloc(). The wrapped allocation is too small, so the function writes past the end of the heap object before the later packet-size check runs.

In the Linux kernel, the stmmac driver has an integer underflow vulnerability in chain mode. The jumbo_frm() function computes len = nopaged_len - bmax, which wraps when the linear portion is small but total packet size is large, causing excessive iterations and mapping arbitrary kernel memory to DMA. This leads to kernel memory disclosure and potential memory corruption.

In the Linux kernel USB/IP driver, a vulnerability exists due to missing validation of the number_of_packets field in the RET_SUBMIT response. A malicious USB/IP server can set this value larger than the original, causing a heap out-of-bounds write when processing ISO packets.

A vulnerability in the Linux kernel has been resolved by directly calling the ->free_folio() function in folio_unmap_invalidate(). The issue was that calling filemap_free_folio() without properly locking the mapping could lead to a use-after-free error.

In the Linux kernel's TLS module, a use-after-free vulnerability was found in the -EBUSY error path of tls_do_encryption. Double cleanup of encrypt_pending and scatterlist entry corrupts data structures, allowing a callback on freed memory.

In the Linux kernel, ksmbd's smb2_calc_max_out_buf_len() used a hardcoded hdr2_len value instead of the offsetof() value pointing to the ->Buffer field in the response structure. After response buffer management switched to a dynamic iov array, remaining call sites were not updated, leading to incorrect buffer length calculations.

A vulnerability has been identified in the Linux kernel regarding invalid folio access when i_blkbits differs from I/O granularity. This issue affects situations where IO can be submitted for less than the full folio, leading to improper management of the folio context.

In the Linux kernel ext4 filesystem, a vulnerability causes an infinite loop during mkdir/mknod operations. When mapping logical blocks to physical blocks fails after inserting a new extent, the freed physical block is reused by an xattr block, leading to a deadlock and thread blocking for 143 seconds.

A vulnerability has been identified in the Linux kernel within the smb_grant_oplock() function, leading to use-after-free and NULL dereference issues. These problems arise from an improper publication sequence of oplock, potentially resulting in unpredictable system behavior.

In the Linux kernel, the dmaengine idxd driver's llist_abort_desc() completed the 'found' descriptor instead of the traversal cursor 'd' at the end of the loop. This can lead to NULL pointer dereferences, double completion, or descriptor leaks. The fix completes 'd' instead of 'found' in the final list_for_each_entry_safe() loop.

In the Linux kernel netfilter subsystem, a fix was applied for unsafe use of nfct_help() without holding a reference to the master conntrack entry when dumping helper names in ctnetlink and /proc. The patch uses expect->helper instead to avoid potential memory safety issues.

In the Linux kernel dvb-net driver, an out-of-bounds read vulnerability exists in ULE extension header tables. The htype index derived from network data can be 255, causing an out-of-bounds read on a 255-element array, and the read value may be called as a function pointer.

A heap overflow vulnerability was found in the Linux kernel's NFSD module (NFSv4.0) in the LOCK replay cache. The fixed 112-byte buffer cannot accommodate variable-length lock owner fields (up to 1024 bytes), leading to an out-of-bounds write.

In the Linux kernel, the netfilter nf_conntrack_h323 DecodeQ931() function fails to check for zero length before decrementing, causing an integer wrap and out-of-bounds read.

A vulnerability was found in the Linux kernel's smc_tcp_syn_recv_sock() function in the SMC module. A race condition between closing an SMC socket and TCP connection handling in softirq context leads to NULL pointer dereference or use-after-free (UAF). An attacker could exploit this to cause a system panic.

In the Linux kernel, a race condition exists in the TLS implementation (tls_sw_cancel_work_tx). After cancel_delayed_work_sync() is called from tls_sk_proto_close(), tx_work_handler() can still be scheduled from paths such as the Delayed ACK handler or ksoftirqd, potentially dereferencing a freed TLS object. The fix replaces cancel_delayed_work_sync() with disable_delayed_work_sync().

In the Linux kernel's Btrfs filesystem, a vulnerability was found where conflicting inodes are not detected when logging inode references after a rename exchange operation. This can cause the log replay to attempt deleting a directory containing a subvolume, resulting in a mount failure.

In the Linux kernel btrfs filesystem, btrfs_get_or_create_delayed_node() had a memory ordering bug after moving refcount_set inside the critical section, potentially leading to a use-after-free.

In the Linux kernel, the libceph decode_pool() function lacked proper bounds checking when decoding a corrupted OSD map. A maliciously crafted map can lead to out-of-bounds memory reads.

A bug in the Linux kernel's STMMAC driver causes a crash when executing XDP_TX action in zero copy mode. The issue is due to missing memory type check of the XDP buffer before use, leading to invalid mappings and system panic.

In the Linux kernel e1000 driver, an out-of-bounds (OOB) read vulnerability was found in e1000_tbi_should_accept(). The issue occurs when the descriptor-reported frame length is zero or exceeds the RX buffer size, causing a read beyond allocated memory and potentially crashing the system.

In the Linux kernel svcrdma component, svc_rdma_copy_inline_range did not verify that the rc_curpage index stays within the allocated page array, potentially causing out-of-bounds read/write.

In the Linux kernel, the ksmbd module has a use-after-free vulnerability during concurrent tree-connection disconnection. The tcon object is freed on one path while another path still holds a reference.

In the Linux kernel svcrdma, svc_rdma_copy_inline_range uses rc_curpage (page index) instead of rc_pageoff (byte offset) for memcpy, causing copies to land outside the current page.

In the Linux kernel, a data race on the m_flags field in the ksmbd vfs_cache structure was found. Some functions read and modify this field without proper locking, potentially causing loss of delete-on-close state or inconsistency.

In the Linux kernel iomap, iomap_adjust_read_range() assumes block-aligned positions and lengths, which is not always true (e.g., in erofs). This causes skipping too many bytes for uptodate blocks, leading to incorrect read position and length.

In the Linux kernel net/handshake, duplicate handshake cancellations cause a socket leak. When a second cancellation arrives, remove_pending() returns false, but the socket reference count is still decremented, leading to underflow.

In the Linux kernel, the RDMA/irdma module has a data race on the cqp_request->request_done field. The field is read without locking in irdma_handle_cqp_op while being updated in irdma_cqp_ce_handler. The issue was fixed by using READ_ONCE/WRITE_ONCE macros to prevent compiler optimizations and KCSAN warnings.

In the Linux kernel, there is a race condition in the CIFS filesystem when connecting to an IPC tree. Access to the hostname field in TCP_Server_Info is not properly protected, which can lead to it being freed in the cifsd thread and cause a use-after-free in __tree_connect_dfs_target().

In the Linux kernel, there is a double free of the xprt_ctxt pointer in the SUNRPC service. When an RPC request is deferred, the pointer is moved to svc_deferred_req, but on a second deferral it is not cleared, leading to double free or adding to a free list, which can cause an oops.

A vulnerability in the Linux kernel's CIFS module can cause a system crash (oops) during oplock break handling. The issue stems from a race between deferred close and lease breaks, potentially leading to an invalid pointer dereference during filesystem unmount.

A vulnerability was found in the Linux kernel's SMC (Shared Memory Communications) module. The smc_llc_srv_add_link() function lacked proper protection, which could lead to a race condition and result in a system panic (crash) when the server attempts to create a second link.

In the Linux kernel, a vulnerability in the mlx5e driver for Mellanox network cards causes invalid buffer access in XSK mode for legacy rq. The issue leads to double release of the buffer in the XDP_REDIRECT path, potentially causing a system crash.

In the Linux kernel, in the scsi: target: iscsit module, there is a vulnerability where commands from recovery entries are freed after the session has been closed, leading to use-after-free or NULL pointer dereference. The fix moves cleanup of recovery entries to before session freeing.

In the Linux kernel, the qla2xxx SCSI driver has issues after chip reset: commands sent to firmware are not freed, and handling them causes BUG_ON errors and DMA mapping problems.

In the Linux kernel, the qla2xxx SCSI driver has a bug where it incorrectly frees a purex item using kfree() instead of qla24xx_free_purex_item(), which can cause memory corruption when the item comes from a pre-allocated pool.

A vulnerability in the Linux kernel causes skb corruption during frag list segmentation. The issue occurs when packets processed by rx-gro-list are fed via a bridge to both local input and an egress device (tun), leading to unsafe writes to cloned skbs with shared heads. This results in critical errors such as NULL pointer dereference.

In the Linux kernel, a vulnerability in the ixgbe driver causes a system panic during XDP_TX on machines with more than 64 CPUs. The issue stems from incorrect indexing of XDP TX rings, which does not apply the modulo 64 limit, leading to an out-of-bounds array access and NULL pointer dereference. Additionally, the locking mechanism (ixgbe_xdp_locking_key) is incorrectly decremented during configuration changes, allowing the bug to trigger.

In the Linux kernel, the SMB client (cifs) has a missed session refcounting issue. The new helper cifs_smb_ses_inc_refcount() is used to get active references, preventing use-after-free.