A vulnerability in the Linux kernel's XFS filesystem code was resolved. The issue involves the function xrep_agfl_fill, where bitmap errors are not properly handled, leading to inconsistent in-memory data. Specifically, the xagb_bitmap_walk call's result is not checked, causing silent error drops. This flaw has been fixed in certain Linux kernel versions.
A vulnerability in the Linux kernel's XFS filesystem code was fixed involving a memory leak in the function xchk_dirtree_create_path. The leak occurs when creating a directory path object fails to append the name, causing the seen inode bitmap not to be destroyed properly. A similar logic error was also corrected in xrep_dirtree_create_adoption_path. This issue was resolved in specific linux-hwe-edge kernel versions.
A vulnerability in the Linux kernel's XFS filesystem code could cause a memory leak when the rhashtable insertion fails during quota accounting. Specifically, the function xqcheck_mod_live_ino_dqtrx does not free a newly allocated dqa object if the insertion into the rhashtable fails, leading to resource leakage. This issue has been resolved in certain Linux kernel versions.
A vulnerability in the Linux kernel's XFS filesystem code could cause a locked buffer to be leaked if an IO error occurs during buffer list write operations. This issue has been resolved in specific linux-hwe-edge kernel versions.
A vulnerability in the Linux kernel's XFS filesystem code could cause the system to spin indefinitely when processing zero-length directory entries during directory salvage operations. This issue has been resolved to prevent infinite spinning on such malformed entries.
A vulnerability in the Linux kernel's XFS filesystem reflink flag handling has been fixed. The issue involves incorrect clearing of the reflink inode flag during exchange of file ranges when the XFS_EXCHMAPS_INO1_WRITTEN flag is set. This can lead to data corruption due to writes bypassing copy-on-write protections. The fix disables reflink flag exchange in this scenario, ensuring both inodes retain the flag until it can be safely cleared later.
A vulnerability in the Linux kernel's XFS filesystem code related to the rtrmap and rtrefcount _maxlevels_ondisk functions was fixed. These functions incorrectly calculated the size of in-memory btree cursors by not accounting for the inode root, potentially leading to out-of-bounds access. The issue affects specific versions of the linux-hwe-edge kernel and has been resolved.
A vulnerability in the Linux kernel's XFS filesystem was fixed that involved under-reservation of blocks when repairing shortform (sf) directories. This issue caused assertion failures and could lead to filesystem shutdowns due to incorrect block reservation calculations during directory repairs. The problem stemmed from incorrect assumptions about directory block sizes and reservation counts in certain repair functions. The fix involved correcting these calculations to properly reserve the required blocks.
A vulnerability in the Linux kernel's XFS filesystem code involved incorrect unit conversions in the per_binval computation. Specifically, the conversion between filesystem blocks and bytes was done backwards, potentially affecting the function xfs_buf_inval_log_space. This issue has been resolved in affected Linux kernel versions.
A vulnerability in the Linux kernel's XFS filesystem code was resolved by properly initializing the args->total field in the xfs_parent_da_args_init() function. The flaw involved args->total being zero-initialized but then used in a way that caused an integer wraparound, bypassing free-space checks and potentially triggering a filesystem shutdown when certain conditions were met.
A vulnerability in the Linux kernel's XFS filesystem code was resolved involving an uninitialized error variable in the function xfs_defer_finish_one(). This flaw causes the function to return an indeterminate value when a certain list is empty, which can lead to a false error during online repair operations. The incorrect error handling may cause a successful barrier operation to be treated as a fatal error, resulting in a SHUTDOWN_CORRUPT_INCORE state during repair.
A vulnerability in the Linux kernel's XFS filesystem component was resolved by adding locking to the health monitor when inserting an unmount event. The issue involved an unlocked insertion of the unmount event into the health monitor's event list, which could lead to inconsistent state or race conditions. This vulnerability affects specific versions of the linux-hwe-edge kernel and has been fixed.
A vulnerability in the Linux kernel SMB client was resolved that involved the use of uninitialized Security Identifiers (SIDs) in the cifs_posix_to_fattr() function. The function ignored the return value of posix_info_parse(), leading to potential use of uninitialized stack memory when parsing malformed POSIX directory entries from untrusted servers. This could cause kernel stack contents to leak to the userspace idmap daemon. The vulnerability affects specific Linux kernel versions and has been fixed by adding a check on the return value to skip SID-to-id mapping when parsing fails.
A heap overflow vulnerability in the Linux kernel's SMB client was fixed. The flaw occurs during rewriting of Discretionary Access Control List (DACL) owner/group SIDs, where the buffer allocation does not account for the maximum possible size of replacement SIDs, leading to an overflow. This issue was detected by Kernel Address Sanitizer (KASAN) and affects specific Linux kernel versions. The vulnerability has a high CVSS score of 8.8, indicating significant confidentiality, integrity, and availability impact.
A vulnerability in the Linux kernel's SMB client was resolved to prevent a reference count leak when the function cifs_sb_tlink() fails in multiuser setups. This leak could cause a crash due to busy inodes during unmount operations of CIFS shares. The issue occurs because cifs_oplock_break() does not properly drop a file reference on failure, leading to resource leakage and potential system instability.
A vulnerability in the Linux kernel's SMB client implementation (cifs_queue_oplock_break) causes a reference count leak when multiple oplock breaks occur while a work item is queued. This leak can lead to kernel bugs and failure of unmount operations on the CIFS filesystem. The issue arises because the reference count is incremented before queueing the work unconditionally, but if the work is not queued successfully, the reference is never decremented. The fix involves incrementing the reference count only after successful queueing of the work item.
A vulnerability in the Linux kernel's SMB client was fixed that involved a reference leak of cifsFileInfo during deferred close operations. The issue occurs when cifs_close() defers closing a file and mishandles reference counting if the deferred work is requeued, causing resource leaks. This flaw was identified by static analysis and affects specific Linux kernel versions.
A vulnerability in the Linux kernel's SMB client affects the handling of Discretionary Access Control Lists (DACLs) when the new DACL exceeds 64K in size. The issue arises due to a 16-bit accumulator wrapping when calculating the size of the DACL, causing corruption of the DACL data sent to the server. This flaw is fixed by changing the internal size accumulator to 32-bit and refusing operations that would overflow the allowed DACL size.
A vulnerability in the Linux kernel's SMB client component caused a one-byte out-of-bounds read in the smb2_parse_native_symlink() function when parsing share-root relative native symlinks. This flaw was fixed to prevent reading beyond the allocated buffer, which triggered Kernel Address Sanitizer (KASAN) errors during SMB symlink access.
A vulnerability in the Linux kernel's SMB client component allowed an untrusted server to override local file ownership despite administrator settings to force specific user and group IDs. This occurred because certain code paths ignored the forceuid and forcegid mount options, permitting server-provided values to overwrite the intended ownership. The issue has been fixed by ensuring these code paths respect the administrator's override settings.