Linux kernel vulnerabilities

A KMSAN warning about uninitialized value in decode_getfattr_attrs() in the Linux kernel's NFS subsystem was found. The fattr->mdsthreshold field is not initialized, which can lead to incorrect behavior.

In the Linux kernel, the stmmac network driver has a vulnerability related to unbalanced DMA mapping/unmapping for non-paged SKB data in TSO context. Incorrect assignment of the DMA buffer address to the wrong tx_skbuff_dma array entry causes premature unmapping before the DMA engine finishes using it. This can lead to corrupted data transmission or IOMMU faults.

Slab-use-after-free vulnerability in the Linux kernel's ksmbd module in ksmbd_smb2_session_create. There is a race condition between this function and ksmbd_expire_session, requiring the addition of missing session table locking when adding/removing sessions from the global table.

In the Linux kernel, a slab-use-after-free vulnerability in the ksmbd server was fixed in the smb3_preauth_hash_rsp function. The ksmbd_user_session_put call should be made within smb3_preauth_hash_rsp to avoid freeing the session before use.

A vulnerability in the Linux kernel Vertexcom MSE102x driver was fixed, which could lead to a double-free of the TX skb. The issue occurred when the TX skb needed to be expanded — the original skb was freed instead of the temporary one, causing a second free in mse102x_tx_work() and a system crash.

In the Linux kernel, in the net: ethernet: mtk_eth_soc module, there is a vulnerability causing memory corruption during fq dma init. The loop responsible for allocating up to MTK_FQ_DMA_LENGTH buffers touches too many descriptors, corrupting unrelated memory. The fix corrects the loop iteration count.

In the Linux kernel, the SMB client (smb2_set_ea()) has a possible double free vulnerability. The bug occurs when after the first free, the variable 'ea' is not re-initialized before another attempt, leading to a second free of the same memory.

In the Linux kernel, the ksmbd module has a use-after-free (UAF) issue during SMB2 session log off. There is a race between session log off and session setup, leading to UAF. The fix adds session lock when setting SMB2_SESSION_EXPIRED and reference count to session struct to prevent freeing while in use.

A vulnerability in the Linux kernel's NFSv4 implementation can cause a NULL-pointer dereference in nfs42_complete_copies(). It occurs when an NFS client copies files from the NFS server mountpoint to another location on the same server, leading to a kernel crash during state recovery. This can result in system instability and service disruption.

In the Linux kernel, the NFS server (nfsd) has an issue in FREE_STATEID handling. Sending multiple FREE_STATEIDs for the same delegation stateid can lead to use-after-free or counter refcount underflow. The fix addresses the critical section in nfsd4_free_stateid() where the lock is dropped before calling nfs4_put_stid(), allowing the stateid to be found again.

A vulnerability was found in the Linux kernel's slhc_remember() function in the SLIP driver, which improperly validated network packets. Missing checks could lead to reading uninitialized memory, as reported by syzbot.

A vulnerability in the Linux kernel's NVMe subsystem was found, where the nvme_ns_head list is not properly protected by SRCU in nvme_mpath_revalidate_paths(). Lack of synchronization when removing namespaces can lead to use-after-free during concurrent scan work.

In the Linux kernel, the mana network driver has a race condition on the per-CQ variable napi work_done. After calling napi_complete_done(), the NAPIF_STATE_SCHED bit may be cleared, and another CPU can start the napi thread and access the per-CQ variable cq->work_done. If another thread sets it to a value >= budget, this thread will continue to run when it should stop, potentially causing memory corruption and panic. The fix saves the work_done variable in a local variable before napi_complete_done() to avoid corruption.

A vulnerability related to buffer overflow when parsing NFS reparse points has been fixed in the Linux kernel. The issue stemmed from incorrect calculation of the data buffer size, leading to access beyond its bounds.

In the Linux kernel, the nbd module has a race between timeout and normal completion. If timeout is handled by nbd_requeue_cmd(), normal completion must be stopped to avoid use-after-free. The fix clears NBD_CMD_INFLIGHT in nbd_requeue_cmd() and ensures cmd->lock is grabbed before clearing the flag and requeueing.

An out-of-bounds access in the RDMA rtrs-clt subsystem of the Linux kernel was found in init_conns(). In the cleanup loop after an error, the cid variable is set to con_num, leading to out-of-bounds access.

In the Linux kernel, nf_reject_ip6_tcphdr_put() could send uninitialized data in the four reserved TCP header bits (th->res1) when generating IPv6 reset packets via netfilter. The issue, reported by KMSAN, was fixed by using skb_put_zero() to zero the entire TCP header.

In the Linux kernel, the order of rate limiting for ICMP messages has been changed. Previously, the host-wide limit was checked first, then the per-destination limit; now the per-destination limit is checked first, and the host-wide limit is checked and consumed later. This change aims to prevent side-channel attacks.

In the Linux kernel, a vulnerability in the Smack module causes incorrect labeling of TCP/IPv4 return packets for incoming connections. The sender's label was mirrored instead of the receiver's label, leading to unauthorized write access.

A vulnerability related to the initialization of grc in the fou module has been fixed in the Linux kernel. If fou is NULL, there can be a condition where grc is used uninitialized.

In the SMB client in the Linux kernel, there is a double put of @cfile in smb2_rename_path(). If smb2_set_path_attr() is called with a valid @cfile and returns -EINVAL, the reference of @cfile was already dropped by a previous smb2_compound_op() call, leading to a double put.

In the Linux kernel, the mlx5e driver for SHAMPO has an incorrect page release issue. Under specific conditions (no skb, header_size == 0, last fragment of a header page), a SHAMPO header page is released incorrectly, leading to multiple releases of the same pages.

In the Linux kernel, in the nfsd module, there is a vulnerability where if nfsd4_encode_fattr4 does a "goto out" before checking for the security label, the args.context field remains uninitialized on the stack and is later freed. The fix initializes it early.

In the Linux kernel, the NFS server (nfsd) has a use-after-free (UAF) vulnerability in nfsd4_cb_getattr_release. After dropping the delegation reference, accessing its embedded fields is unsafe. The fix moves the release to the end.

In the Linux kernel, the inode_setsecctx hook for SELinux and Smack has a permission bypass. Root user on an NFS client can change security labels on files on an NFS filesystem exported with root squashing. The fix replaces __vfs_setxattr_noperm() with __vfs_setxattr_locked(), enforcing proper permission checks.

In the Linux kernel, in the nfsd module, there is a vulnerability in nfsd4_deleg_getattr_conflict that unsafely dereferences flc_owner without confirming that fl_lmops is the expected manager. The fix restores the behavior for the "!= &nfsd_lease_mng_ops" case as before the change, without any reference to a delegation.

In the Linux kernel's igb driver (Intel Gigabit Ethernet), there is an issue with large MAX_SKB_FRAGS values, causing payload corruption during transmission. The root cause is improper handling of shared info size when selecting ring layout, leading to attempts to fit two packets in one 4K page. The fix checks if 2K buffers are insufficient.

In the Linux kernel, there is a use-after-free vulnerability in the NVMe driver. The issue is that stopping the keep-alive mechanism was not moved into nvme_uninit_ctrl(), which can lead to keep-alive work being started and left pending after a controller start failure, and then to use-after-free when the host driver is unloaded.

A use-after-free in the ATM idt77252 driver of the Linux kernel was found in dequeue_rx(). After calling vcc->push(), the skb cannot be dereferenced because it has been freed.

A possible use-after-free in ip6_xmit() in the Linux kernel was found. If skb_expand_head() returns NULL, the skb and associated dst/idev may be freed, and further access can lead to a crash.

In the Linux kernel's net/mlx5e (SHAMPO), there is an issue with invalid WQ linked list unlink. When all strides in a WQE are consumed, the WQE is unlinked, but CQEs with 0 consumed strides for the same WQE can still arrive, causing a double unlink and list corruption. The fix accepts 0-sized consumed strides without unlinking again.

In the Linux kernel, the USB vhci-hcd driver has a reference handling issue. At several places the driver carries stale pointers to references that can still be used. The fix ensures new references are gained before dropping old ones, closing ZDI-CAN-22273.

In the Linux kernel, in the mlx5e driver, updating a CT entry can leak the modify header context. If allocation of a new modify header fails, the pointer to the old one is lost, and freeing an error pointer can cause a kernel panic.

In the Linux kernel, in the RDMA/iwcm subsystem, there is a use-after-free vulnerability related to destroying CM IDs. iw_conn_req_handler() associates a new rdma_id_private with an existing iw_cm_id, and rdma_destroy_id() frees both. The fix ensures that cm_work_handler() does not trigger use-after-free by waiting for all pending work to finish before freeing rdma_id_private.

In the Linux kernel's TIPC module, tipc_udp_addr2str() does not return a non-zero value on invalid UDP address, which can lead to buffer overflow in tipc_media_addr_printf(). The fix returns 1 on invalid address.

In the Linux kernel, a race condition was found in libceph between delayed_work() and ceph_monc_stop(). The handling of delayed work in ceph_monc_stop() is prone to races with mon_fault() and finish_hunting(), which can requeue the delayed work after it was canceled, potentially leading to use-after-free on the monc structure and associated objects.

In the Linux kernel, a use-after-free was found in the rswitch network driver in rswitch_poll(). The bug is that the skb pointer is freed before its len field is used to update interface statistics. The fix moves the instructions to use skb->len before freeing.

In the Linux kernel's ILA module, ila_output() does not block bottom halves (BH), which can lead to a race condition and corruption of dst_cache structures. The fix uses local_bh_disable().

A double free of special payload in the NVMe subsystem of the Linux kernel was found. If a discard request needs retry and the retry fails before a new payload is added, a double free occurs.

A use-after-free vulnerability was found in the Linux kernel's net/sched module related to resolving conntrack clashes. After a clash is resolved, the ct object may be freed but still passed to tcf_ct_flow_table_process_conn, leading to a read-after-free.

In the Linux kernel, the staging subsystem (gdm724x) has a use-after-free (UAF) vulnerability in gdm_lte_rx(). The netif_rx_ni() function frees the skb, and then the code tries to read skb->len, leading to access of freed memory.

In the Linux kernel, in NFSD, the handling of large file sizes in NFSv3 SETATTR/CREATE procedures was fixed by removing the min_t() check to avoid unexpected truncation.

In the Linux kernel, in NFSD, an underflow issue with ia_size was fixed. Since ia_size is a signed loff_t and NFS file size is unsigned, large values could cause underflow. A check was added in nfsd_setattr().

In the Linux kernel, a use-after-free vulnerability in the nvme driver during controller reset during load has been fixed. The issue occurs when the driver does not check controller readiness for AER submission, leading to a use-after-free condition observed with nvme-tcp.

In the Linux kernel, in the nvme-tcp driver, a possible use-after-free in transport error recovery work was fixed. The error recovery work must flush async_event_work before destroying the admin queue to prevent a race.

In the Linux kernel, a vulnerability in the nvme-rdma driver was fixed that could lead to a use-after-free in the transport error recovery work. The issue involved a race between checking the controller state and preparing the AER command, potentially causing incorrect behavior.

In the Linux kernel, in the ena network driver, validation for completion descriptors consistency has been added. It checks that the 'first' flag is set only for the first descriptor in multi-buffer packets. In case of an invalid descriptor, a reset will occur, and a new reset reason for RX data corruption has been added.

In the Linux kernel, the TIPC module fixed an issue where a destination refcount was not forced before decryption. This could lead to a system crash in case of asynchronous cryptographic requests.

In the gve driver of the Linux kernel, a bug was found where napi->skb is left referencing a freed skb after dev_kfree_skb_any(). This can lead to a dangling pointer on subsequent napi_get_frags calls.