Linux kernel vulnerabilities

In the NVMe over Fabrics subsystem (nvmet) of the Linux kernel, a bug was found causing a crash when disabling a namespace. The percpu counter protecting pending I/O was not properly handled, leading to a crash when trying to disable a namespace with active I/O.

In the Linux kernel, the RDMA/rxe driver triggers a warning during resource cleanup when too many rdma resources are allocated. The current timeout is too short to release all resources correctly, causing a warning.

In the Linux kernel's RDMA/rtrs driver, the deinit() function is missing during disconnection, so the IB event handler registration is not undone. This leads to list corruption when repeatedly connecting and disconnecting.

In the Linux kernel NFSD subsystem, a use-after-free vulnerability occurs when fetching acl_default fails. Both acl_access and acl_default are released, but acl_access retains a pointer to the freed posix_acl, triggering a kernel warning and panic.

In the Linux kernel, a vulnerability was found in the ndisc_send_skb() function, which can be called without RTNL or RCU lock. The lack of proper RCU protection allows a use-after-free (UAF) when accessing the device's network namespace.

In the Linux kernel, a vulnerability exists in igmp6_send() in the IPv6 multicast code, which can be called without holding RTNL or RCU. Lack of proper RCU protection can lead to a use-after-free (UAF) when fetching the net pointer. The fix extends RCU protection and changes skb allocation to avoid sleeping issues.

In the Linux kernel, the mld_newpack() function lacked RCU protection, potentially causing data races. The fix replaces sock_alloc_send_skb() with alloc_skb() and charges the socket under RCU protection.

In the Linux kernel's ksmbd module, an integer overflow vulnerability was found on 32-bit systems. Addition operations in ipc_msg_alloc() can overflow, leading to potential memory corruption.

In the Linux kernel, the PCI dwc ep driver has a vulnerability due to lack of protection against changing BAR size/flags in pci_epc_set_bar(). This allows setting a new BAR size that is smaller than the size determined by the host, potentially allowing reads past the new BAR size.

In the Linux kernel's MPTCP implementation, a vulnerability was found due to improper management of suboption status. Zeroing the bitmask before parsing is insufficient to ensure state consistency, leading to uninitialized bitfields and a KMSAN bug.

In the Linux kernel, a vulnerability in the netfilter conntrack module has been fixed, where after insertion of a conntrack entry, a clash can occur, leading to freeing skb->_nfct and setting it to an already-confirmed entry. This was not found before because the conntrack entry and extension space were freed after an RCU grace period, and the race requires events enabled to trigger.

In the Linux kernel, the NFSv4 subsystem has a bug causing free of an uninitialized nfs4_label during referral lookup. The fix sends the already-allocated fattr along with nfs4_fs_locations and drops the memcpy of fattr, fixing a crash during 'ls' operations.

In the Linux kernel, a vulnerability in the DLM module causes an invalid memory read during file unlock (plock) operations. The bug occurs when a 'plock_op' structure is cast to 'plock_xop' and fields not present in the original structure are accessed, leading to a slab-out-of-bounds read. The fix moves the 'callback' field to 'struct plock_op' to indicate when such casting is allowed.

In the Linux kernel, in the nfsd_file_put() function in NFSD, a potential use-after-free was fixed. Since nfsd_file_put_noref() can free @nf, it should not be dereferenced after return.

In the Linux kernel, in the svc_rdma_build_writes() function in SUNRPC, an overflow issue with RDMA segments was fixed by preventing walking off the end of the segment array.

In the Linux kernel, in the nfssvc_decode_writeargs() function in NFSD, an underflow issue with 'args->len' was fixed by changing the type to unsigned.

In the Linux kernel, in the hisilicon/sec crypto driver, a bug with the aead software fallback was fixed. Misuse of the subreq pointer caused occasional OS panics when setting the 64K page.

In the Linux kernel, the bcmgenet driver has an issue with ordering of device register reads/writes. GCC12 optimizes memory operations in a way that breaks the assumed ordering, leading to transmit queue timeouts and NETDEV WATCHDOG warnings. The fix replaces relaxed variants with safer readl/writel functions.

In the Linux kernel's rxrpc module, a race between call timer start and call destruction can lead to a timer being restarted after it was stopped, causing an oops. The fix takes a reference on the rxrpc_call struct before starting the timer.

In the Linux kernel, in the net/tls module, a slab-out-of-bounds bug in decrypt_internal was fixed. The issue was due to incorrect IV size for AES128-CCM, causing an out-of-bounds read.

In the Linux kernel, a vulnerability in the cifs driver was fixed that could lead to a buffer overflow when handling symbolic links. The issue was due to a missing check that link_len does not exceed the size of the link_str buffer. A check was added.

In the Linux kernel, a double free of the hostname field in the TCP_Server_Info structure was found in the CIFS/SMB client. The issue occurs when the cifsd thread, during server shutdown, continues to attempt reconnection to multiple DFS targets before exiting the loop, leading to a race condition and double free.

In the Linux kernel, in the netfilter module (nf_set_pipapo), there is a bug in the initialization of the fill map during set lookup. The initial buffer is initialized to all-ones, but the restriction to the size of the first field is missing, causing bit leakage into subsequent rounds and incorrect matching results for sets where the first field is not the largest.

In the dwmac-tegra driver for MGBE controllers in the Linux kernel, a vulnerability was found where the IOMMU Stream ID (SID) is hardcoded to MGBE0's SID instead of being read from the device tree. This causes incorrect SID to be written to the MGBE_WRAP_AXI_ASID0_CTRL register for other controllers (e.g., MGBE1), leading to softirq timeouts and kernel panics.

In the Linux kernel, in the RDMA/bnxt_re driver, there is an issue with the maximum number of SGEs for work requests. For Gen P7, 13 SGEs are reported, but the WQE software structure can only hold 6, leading to traffic failures and system crashes.

In the Linux kernel, in the gve driver, the XDP XMIT NDO callback lacks a guard to check for the existence of dedicated XDP queues. When no XDP program is installed or the interface is down, a divide-by-zero error or NULL TX pointer access can occur.

A vulnerability in the Linux kernel's MPTCP implementation involves incorrect TCP option length computation, leading to buffer overflow. In certain circumstances, the ADD_ADDR option is not properly excluded from DSS, causing memory corruption (nr_frags) and potentially leading to a kernel panic.

A vulnerability in the Linux kernel's NET/ROM protocol was found, where nr_route_frame does not check the buffer length before accessing data. This can lead to an uninitialized memory read, as reported by Syzkaller.

In the Linux kernel, a NULL pointer dereference in the RDMA/rtrs subsystem was fixed. The declaration of the 'ib_sge list' variable was moved outside the 'always_invalidate' block to ensure accessibility throughout the function, eliminating the 'BUG: kernel NULL pointer dereference' crash.

In the Linux kernel, in the virtio-net driver, there is an overflow bug in virtnet_rq_alloc. When a frag is one page in size and the total size of the buffer plus virtnet_rq_dma exceeds one page, an overflow can occur, leading to system crashes or SCP failures.

In the Linux kernel, in the virt: tdx-guest module, there is a vulnerability where in CoCo VMs an untrusted host can cause set_memory_decrypted() to fail, resulting in shared memory being returned to the page allocator. This could lead to functional or security issues. The fix leaks the decrypted memory on error, without printing an error since set_memory_decrypted() will call WARN_ONCE().

In the Linux kernel's net/smc module, when receiving a proposal message on the server, the fields iparea_offset and ipv6_prefixes_cnt come from the remote client and are not fully trusted. If iparea_offset exceeds the maximum value, it may lead to accessing an incorrect address and system crash. The patch adds validation of these fields before use.

In the Linux kernel, the net/smc module when receiving proposal messages on the server, the fields v2_ext_offset, eid_cnt, and ism_gid_cnt come from the remote client and are not fully trusted. Invalid values can lead to accessing wrong addresses and crashes. The fix adds checks for these fields before use.

In the Linux kernel's net/smc module, when receiving a proposal message on the server, the field smcd_v2_ext_offset comes from the remote client and is not fully trusted. If the value of smcd_v2_ext_offset exceeds the maximum value, it may lead to accessing an incorrect address and system crash. The patch adds validation of smcd_v2_ext_offset before use.

A vulnerability in the Linux kernel's NFS server (nfsd) causes a memory leak during concurrent file open operations (nfsd4_open). The issue stems from improper handling of nfs4_openowner objects when two parallel open requests for the same file are processed by different nfsd threads. In extreme cases, this can lead to a kernel panic when shutting down the NFS server.

In the Linux kernel, a bug in the stmmac driver's DMA handling for TSO causes an oops. The issue stems from a delayed assignment of the DMA cookie in stmmac_tso_xmit(), violating DMA API requirements. This leads to DMA mapping failures and messages about freeing unallocated DMA memory.

In the Linux kernel, in the CAN subsystem (J1939), there is a reference counting bug in the j1939_session_new() function. The j1939_session_skb_queue() function performs an extra skb_get() for each new skb, but it does not do so for the initial one, leading to a refcount underflow.

In the Linux kernel, the bnxt_en driver has a vulnerability related to incorrect receive ring space parameters when changing MTU with XDP active. Changing MTU after attaching an XDP multi-buffer can lead to inconsistent aggregation ring configuration, resulting in random memory corruption and crashes.

In the Linux kernel, in the TCP stack, there is a use-after-free vulnerability in the reqsk_timer_handler() function. A previous fix replaced inet_csk_reqsk_queue_drop_and_put() with __inet_csk_reqsk_queue_drop() and reqsk_put(), but it passes the wrong pointer (req instead of oreq) to reqsk_put(), which can lead to use-after-free.

In the Linux kernel, in the ksmbd module, there is a vulnerability due to a race condition between SMB request handling in ksmbd_conn_handler_loop() and the freeing of ksmbd_conn in the workqueue handler handle_ksmbd_work(). This leads to a use-after-free (UAF). The fix addresses this issue.

A use-after-free of the signing key in the SMB client of the Linux kernel was found. A race between mount operations and packet sending can lead to accessing freed memory during signature calculation.

In the Linux kernel, the SMB (CIFS) subsystem contains a use-after-free vulnerability in open_cached_dir(). An error while parsing a lease from the server can race with a lease break, causing open_cached_dir() to free the cfid while queued work is still pending. The fix changes reference counting and clears has_lease immediately under lock.

In the Linux kernel, a vulnerability in the CIFS/SMB filesystem causes a kernel BUG during unmount. A race between unmount and cached directory operations prevents dentries from being dropped, triggering a kernel panic. The fix moves dentry dropping to a workqueue and adds proper synchronization.

In the Linux kernel, a potential integer overflow was found in the NFSD module. If the tag length is >= U32_MAX - 3, the "length + 4" addition can overflow. The fix splits the decoding into several steps to avoid arithmetic on the unsafe length value.

In the Linux kernel, the mlx5e driver for kTLS has an incorrect page refcounting issue. Mixing get_page() and page_ref_inc() APIs for incrementing references and using only put_page() on release leads to over-dereferencing the folio page, potentially causing memory errors.

A use-after-free vulnerability exists in the Linux kernel's SMB/CIFS client due to incorrect reference counting of network namespaces. When CIFS mounts a share in a non-root network namespace and reconnects to the server, it may access freed netns memory, causing a kernel oops. The issue primarily occurs in Kubernetes environments when pods are terminating.

In the Linux kernel, the RDMA/siw driver lacks a sendpage_ok() check, leading to the use of a slab page in sendpage and triggering a warning in skb_splice_from_iter(). The issue occurs during ISER over SIW operation.