CVE Vulnerability Catalog

In the Linux kernel, the ksmbd (SMB server) module has a use-after-free vulnerability in the conn->preauth_info structure during concurrent SMB2 NEGOTIATE requests. One thread can free the memory while another thread in the response send path still uses it, leading to a use-after-free read (confirmed by KASAN).

In the Linux kernel IPv4 FIB, when CONFIG_IP_MULTIPLE_TABLES is enabled but no rule is added, fib_lookup() performs route lookup directly on two tables. Since the first lookup does not properly bail out, the result of an error route in the merged local/main table could be overwritten by another route in the default table. The fix corrects this inconsistent behavior so that the error route is respected.

In the Linux kernel netfilter flowtable, the function nf_flow_ip4_tunnel_proto() does not validate the iph->ihl field before using it to compute the header size, which can lead to out-of-bounds access with malformed IP headers. The fix adds a sanity check for the ihl field and uses iph->protocol instead of the hardcoded IPPROTO_IPIP constant when setting ctx->tun.proto, and references ctx->tun.hdr_size when updating ctx->offset.

In the Linux kernel, on s390/mm there is an issue with the _PAGE_UNUSED bit. This bit is not cleared in some pte-setting paths, which may lead to guest memory corruption.

In the Linux kernel, in the geneve subsystem, a vulnerability was fixed where geneve_gro_complete() did not check the gs->gro_hint flag, allowing an attacker to supply a crafted packet with a hint option, leading to an out-of-bounds read (KASAN: slab-out-of-bounds). The fix involves honoring the gs->gro_hint flag in the complete path as well.

In the Linux kernel, in the geneve subsystem, a vulnerability was fixed where geneve_gro_complete() did not validate the inner network offset, which could lead to an out-of-bounds read. The fix adds a check that the computed offset does not exceed the recorded inner network header.

In the Linux kernel's enetc driver, the number of BDs needed for xdp_frame is not checked. The xdp_redirect_arr array has size ENETC_MAX_SKB_FRAGS, but the number of fragments in xdp_frame can be greater or equal, leading to an out-of-bounds array access.

In the Linux kernel's SCTP protocol, when cookie authentication is disabled, the INIT after cookie unpacking is not re-verified. This could allow processing of tampered data. Added INIT verification after unpacking and chunk type check in cookie.

In the Linux kernel's fbnic driver, fbnic_tx_lso() calls skb_cow_head() which may reallocate the skb including shared info. The pointer calculated before the call becomes stale, leading to a use-after-free.

A use-after-free vulnerability was found in the Linux kernel's ksmbd (SMB server) module. The issue is a race between reading fp->owner.name during durable handle owner comparison and freeing it in the reopen path. An attacker could exploit this to gain unauthorized access or cause a system crash.

In the Linux kernel netfs module, netfs_create_write_req() skips caching if the fscache cookie is disabled, but this is problematic because async cache object creation might not have completed. The fix removes the cookie checks and delegates this to fscache_begin_write_operation().

In the Linux kernel, the netfs module has a barriering issue when walking the subrequest list during retry. There is a possibility of seeing a subrequest that was just added by the application thread.

In the Linux kernel, the GUE module has a vulnerability due to missing validation of the REMCSUM private option length. guehdr_priv_flags_len() returns 0 even when GUE_PFLAG_REMCSUM is set, allowing malformed packets to pass and read missing fields from subsequent bytes.

In the Linux kernel, the netfilter ip6tables module mishandles malformed IPv6 extension headers. For ah, hbh, and rt matches, the advertised header length checks are missing or outdated. The fix adds the missing check for ah and updates checks for hbh and rt, also setting hotdrop to true to drop malformed packets.

In the Linux kernel's qede driver, there is an off-by-one error in BD ring consumption when skb building fails. The functions qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a NULL return from qede_build_skb(), leading to excessive BD consumption and desynchronization of the BD ring, which can corrupt DMA page reference counts and cause SLUB freelist corruption.

In the Linux kernel's liquidio driver, there is an issue with caching VF pci_dev pointers without proper reference counting, potentially leading to use-after-free when handling FLR requests.

In the Linux kernel's IPv4 IGMP module, there is a race condition between device teardown and IGMP query processing, which can lead to use-after-free in igmp_gq_start_timer().

In the Linux kernel's IPv6 MLD module, there is a race condition between device teardown and MLD query processing, which can lead to use-after-free in the MLD delayed work.

In the Linux kernel, the netfilter nft_lookup module has a bug in catchall element handling with inverted lookups. The 'found' variable is not recomputed after 'ext' is replaced by the catchall lookup, which can lead to incorrect matching or skipping of the catchall element in negated queries.

In the Linux kernel, the IPVS module has an issue ensuring that inner headers in ICMP errors are in the skb headroom. After stripping outer headers with pskb_pull(), the inner IP headers may not be available for functions like ipv4_update_pmtu(), icmp_send(), and IP_VS_DBG(). Additional length checks for inner headers were added.