Linux kernel vulnerabilities

In the Linux kernel, the vmxnet3 driver has a vulnerability where after a failed memory allocation for the RX data ring, the desc_size field is not reset, causing the hypervisor to reference invalid memory during packet reception. This leads to a kernel panic (BUG) in skb_panic.

In the Linux kernel, a revert was made to a patch that allowed redirecting to any AF_XDP socket bound to the same umem. The patch introduced a potential kernel crash when multiple NAPI instances redirect to the same socket, corrupting the Rx ring state.

In the Linux kernel's SUNRPC module, gss_free_in_token_pages() has a loop termination condition issue because the in_token->pages[] array is not NULL terminated, leading to wild memory access (KASAN).

In the Linux kernel, the TIPC subsystem has an issue with size validation for received domain records. The tipc_mon_rcv() function does not verify that the number of members in a record does not exceed the MAX_MON_DOMAIN limit, which may lead to stack overflow. Additionally, an extra sanity check was added in tipc_link_proto_rcv() to prevent bit overflow.

In the Linux kernel, a vulnerability was found in the systemport driver due to missing global locking for the descriptor list shared across all transmit queues. Concurrent access from multiple queues can corrupt descriptors, leading to incorrect packet lengths and checksums in UDP and TCP traffic.

A potential use-after-free of glocks in the GFS2 filesystem of the Linux kernel was found during unmount. DLM automatically unlocks locks, but bast callbacks may remain active and access freed objects.

In the Linux kernel, the Open vSwitch (openvswitch) module has a vulnerability where the original conntrack tuple for ICMPv6 packets is overwritten during OVS_PACKET_CMD_EXECUTE processing. Parsing the ICMPv6 header zeroed out Neighbor Discovery (ND) fields even for non-ND packets, corrupting conntrack metadata and leading to incorrect packet matching.

A seg fault in rxe_comp_queue_pkt() in the RDMA rxe subsystem of the Linux kernel was found. An incoming response packet is enqueued and then dereferenced after deciding to run the completer task, which can lead to accessing freed memory.

In the Linux kernel, in the NFSD server, there is a crasher in nfsd4_encode_fattr4(). The issue is that args.acl is not initialized early, but it is used in an unconditional call to kfree() on the way out of the function, leading to a crash.

In the Linux kernel, a vulnerability in the vmbus driver was fixed where in CoCo VMs, a failed set_memory_encrypted() or set_memory_decrypted() call could lead to freeing decrypted (shared) memory pages. The fix leaks the pages in such cases to avoid potential functional or security issues.

In the Linux kernel, a vulnerability in the vmbus driver was fixed where in CoCo VMs, a failed set_memory_encrypted() or set_memory_decrypted() call could lead to freeing decrypted (shared) memory pages. The fix adds a field in struct vmbus_gpadl to track the decryption status of buffers, preventing such pages from being returned to the allocator.

In the Linux kernel, a problem was found in the hv_netvsc driver where decrypted memory could be freed. In CoCo VMs, an untrusted host can cause set_memory_encrypted() or set_memory_decrypted() to fail, leaving memory shared. The netvsc driver could free decrypted/shared pages if set_memory_decrypted() fails. The fix checks the decrypted field in the gpadl to decide whether to free the memory.

In the Linux kernel, a problem was found in the vmbus driver (Drivers: hv) where ring buffers that couldn't be re-encrypted could be freed. In CoCo VMs, an untrusted host can cause set_memory_encrypted() or set_memory_decrypted() to fail, leaving memory shared. The VMBus ring buffer code could free decrypted/shared pages if set_memory_decrypted() fails. The fix checks the decrypted field in the struct vmbus_gpadl for the ring buffers to decide whether to free the memory.

A use-after-free (UAF) vulnerability was found in the Linux kernel in the tipc_buf_append() function in the error path of the TIPC protocol. The bug was reported by Sam Page working with Trend Micro Zero Day Initiative and may lead to memory corruption.

A vulnerability in the Linux kernel's TCP implementation allowed accepting ACK packets acknowledging bytes that were never sent. The issue was in ACK sequence validation per RFC 5961, enabling potential manipulation of data streams. The fix tightens ACK checks, rejecting packets with out-of-range acknowledgment numbers.

A vulnerability in the Linux kernel's TCP mechanism causes page frag corruption during page fault handling. The issue occurs when an HTTP server process (e.g., Apache) uses a mapped CIFS file, and a page fault triggers nested page frag allocation, leading to stream data corruption.

In the Linux kernel, a vulnerability in the SMC network module was found where smc_lgr_cleanup_early() incorrectly deleted the list head instead of the actual link group. This could lead to memory corruption and a kernel panic.

In the Linux kernel, a use-after-free vulnerability in the NFS server (nfsd) due to a delegation race has been fixed. A delegation break can arrive as soon as vfs_setlease is called, leading to the delegation being added to del_recall_lru and then freed without being removed, manifesting later as use-after-free or list corruption.

In the Linux kernel's net/tls module, a flipped sign in tls_err_abort() calls leads to incorrect error handling and potential memory corruption. The fix ensures consistent negative error codes and centralizes the sign flip.

In the Linux kernel, the isofs module has an out-of-bounds access when reading a corrupted ISO image. The fix adds a sanity check on the directory entry length before using it.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab out of bounds write in smb_inherit_dacl(). slab out-of-bounds write is caused by that offsets is bigger than pntsd allocation size. This patch add the check to validate 3 offsets using allocation size.

In the Linux kernel, a use-after-free vulnerability was found in the CIFS module in the rdata->read_into_pages() function. Under unstable network conditions, reading data from the server can lead to use of freed memory (rdata pointer), causing a system crash or potential code execution.

In the Linux kernel, the ceph module has a vulnerability where the kclient is blocklisted after receiving a corrupted snap trace. The issue can lead to continuing I/O and metadata access, potentially corrupting data.

In the Linux kernel's scsi iscsi module, a use-after-free bug exists in task abort handling. The fix reverts a goto to common cleanup code and moves iscsi_get_conn() after checking task validity.

In the Linux kernel, a use-after-free vulnerability in the iSCSI driver (scsi: iscsi) during resets has been fixed. The issue occurs when iscsi_conn_teardown wakes up the EH thread and frees the connection while those threads are still accessing the connection's ehwait field. The fix moves the TMF fields from the connection to the session.

In the Linux kernel, the CAN J1939 subsystem has a Use-after-Free vulnerability. The issue is that a skb is taken from the session queue without incrementing the ref count, which can lead to use-after-free if the skb is concurrently taken from the queue due to a CTS.

In the Linux kernel, a vulnerability in net/mlx5 was resolved regarding improper linking of new fs rules into the tree. Rules created by create_flow_handle could get a refcount of 2 without being linked into the tree, resulting in NULL parent and root and a crash when the flow group was deleted.

In the Linux kernel, the dma-direct function has a page leak issue when dma_set_decrypted() fails. In TDX environments, an untrusted host can cause set_memory_encrypted() or set_memory_decrypted() to fail, returning shared memory to the page allocator. The fix leaks the pages in such cases instead of freeing them.

A vulnerability in the Linux kernel affects UDP packet handling when GRO (Generic Receive Offload) is applied during forwarding and packets land in a tunnel. With rx-udp-gro-forwarding enabled, packets may be incorrectly GROed at the UDP level, leading to packet corruption or kernel crashes (BUG_ON in skb_segment). This occurs when the tunnel endpoint is in a different network namespace (netns).

In the Linux kernel, a use-after-free vulnerability in the SMB client was fixed, affecting DFS referral handling, mounting, and DFS failover. The fix ensures all children from the parent session are properly refcounted and removes the unnecessary dfs_ses_list.

In the Linux kernel, in the SMB client, there is a potential use-after-free vulnerability in smb2_is_valid_lease_break(). The issue involves sessions that are being torn down (status == SES_EXITING), which can lead to use-after-free. The fix skips such sessions to avoid UAF.

In the Linux kernel, the crypto/safexcel subsystem lacks error handling for dma_map_sg() calls. The dma_map_sg() macro may return 0 on error. The fix adds checks in case of macro failure and ensures unmapping of previously mapped buffers with dma_unmap_sg().

In the Linux kernel, the nvmet module has a use-after-free vulnerability that can be triggered by blktests nvme/004. The issue leads to reading freed memory during request completion, potentially causing a system crash.

In the Linux kernel, the nvme-tcp module has a use-after-free vulnerability when detecting digest errors. The fix requires breaking out of the io_work loop after setting rd_enabled to true, to avoid reading data from an out-of-sync or corrupted TCP stream.

In the Linux kernel, the SUNRPC module fixed memory leaks in gssx_dec_option_array. Previously, error-handling paths did not free memory allocated for credentials and option array data.

A flaw in the Linux kernel's handling of pages from page_pool during skb reorganization in esp_output (when not using inline mode) causes a page_pool leak when put_page is called on such pages, potentially leading to a kernel crash. The issue is fixed by introducing a new wrapper skb_page_unref that properly handles page refcounting for page_pool pages.

A use-after-free vulnerability was found in the Linux kernel's SCSI core subsystem. The issue occurs when .exit_cmd_priv implementations are called after resources associated with the SCSI host have been freed, leading to access to freed memory. The fix ensures scsi_remove_host() waits for the tag set to be freed before invoking these functions.

In the Linux kernel, the Xilinx cryptographic driver (zynqmp) has an issue where crypto_finalize_request is called without disabling bottom halves (BH), leading to a WARNING and potential system instability.

In the Linux kernel's cifs module, an underflow in parse_server_interfaces() occurs due to comparing ssize_t with size_t, causing the loop to continue with negative bytes_left. The fix addresses the type conversion issue.

In the Linux kernel, the mlx5e driver (for Mellanox network cards) has a bug in the TLS RX resync flow, causing a crash. The list of TLS contexts is vulnerable to corruption due to lack of protection of entries against movements from resync_handle_seq_match() until their resync handling in napi is fully completed.

In the Linux kernel's ksmbd module, there is a lack of validation of IPC response payload size, which can lead to memory overrun or slab-out-of-bounds. The fix adds validation for three IPC responses with payload.

Use-after-free vulnerability in the Linux kernel's TLS implementation during failed backlog decryption. When the crypto operation returns -EBUSY, tls_do_decryption waits for all async decryptions to complete, and if one fails, pages are released but have already been passed to the async callback.

In the Linux kernel, in the SCSI target subsystem (pscsi), there is a bug in handling the error case when freeing a bio object. A bio allocated by bio_kmalloc() must be freed by bio_uninit() and kfree(), but this is not done correctly in this case, leading to a WARN and NULL pointer dereference in bio_free().

In the Linux kernel, in tunnel functions (e.g., VXLAN), there is an out-of-bounds read when building IPv6 PMTU errors. The issue occurs when the ICMPv6 error is built from a non-linear skb, leading to memory corruption (KASAN: slab-out-of-bounds).

In the Linux kernel, the filelayout_decode_layout() function in NFS used an incorrect structure size, potentially leading to memory corruption. The fix changes the size to NFS_MAXFHSIZE, which matches the buffer size.

In the Linux kernel TIPC module, a vulnerability was found where improperly appending fragments to a skb's frag_list can lead to use-after-free. The issue occurs when the skb was cloned or modified by pskb_copy() or pskb_may_pull(), and the new fragment is shared by multiple skbs despite only one skb_get() call.

In the Linux kernel, the lantiq network driver has a vulnerability leading to memory corruption in the RX ring. When memory allocation or DMA mapping fails, an invalid address is programmed into the descriptor, which can lead to memory corruption. The fix makes DMA reuse the previous skb and mapping and drop the packet, incrementing the rx drop counter.

A vulnerability related to buffer overflow in the READDIR function has been identified in the Linux kernel. The issue occurs when a client sends a count argument that is too small, leading to incorrect buffer size calculations and allowing writes beyond its boundaries.

The vulnerability in the Linux kernel concerns incorrect management of the sk_rx_dst field in TCP socket structures, which did not follow standard RCU rules. This can lead to use-after-free in early demux functions, as reported by syzbot.