A use-after-free vulnerability in the Linux kernel SMB client was resolved. The issue involved the DFS superblock pointer being stored in an iterator callback without properly taking an active reference, allowing concurrent DFS automount expiry to free the superblock before use. This could lead to a kernel slab-use-after-free error detected by KASAN. The fix ensures the active reference is taken while a shared lock is held, preventing premature freeing.
A vulnerability in the Linux kernel SMB1 client allows a malicious or compromised SMB1 server to cause out-of-bounds reads in the CIFSSMBRead() function by providing a crafted DataOffset value. This can lead to information disclosure or denial of service. The issue arises because DataOffset is not validated against the response length, allowing memcpy() to read beyond the buffer. SMB1 is not negotiated by default, requiring explicit use of vers=1.0 mount to reach the vulnerable code. The vulnerability has been resolved by adding proper validation to ensure DataOffset and DataLength fit within the response buffer.
A vulnerability in the Linux kernel's SMB client component allowed userspace to create cifs.idmap keys with authority-bearing fields that were treated as kernel-originating inputs. This could lead to unvetted descriptions being consumed in root context. The issue was resolved by restricting acceptance of cifs.idmap descriptions to only when CIFS uses its private root credentials to request the key, mirroring a similar fix for cifs.spnego.
A vulnerability in the Linux kernel's SMB client implementation (CIFSSMBRead) allows a malicious or compromised SMB1 server to send short READ responses that cause out-of-bounds reads. This occurs because CIFSSMBRead() does not verify that the entire READ_RSP response is received before parsing its header fields. Exploitation requires explicit use of SMB1 protocol, which is not negotiated by default.
A vulnerability in the Linux kernel's Multipath TCP (MPTCP) path manager was resolved. The issue involved stale ADD_ADDR announcement entries remaining when removing the ID0 endpoint due to asymmetry in cleanup paths. This could cause kernel warnings during path reselection. The fix ensures symmetric cleanup for ID0 removal by properly removing pending announcements and adjusting signaling counts.
A race condition vulnerability in the Linux kernel's multipath TCP (mptcp) implementation was resolved. The issue involved a race between the disconnect() function and a retransmission timer (rtx), which could lead to inconsistent connection status. The fix prevents this race by using a synchronous timer stop operation.
A vulnerability in the Linux kernel's multipath TCP (mptcp) syncookies implementation was resolved by properly handling the request backup flag. The issue involved using an uninitialized bit in the subflow_ulp_clone() function, which has been corrected by using a single bit from the mptcp_subflow_request_sock structure instead of extending the join_entry structure.
A vulnerability in the Linux kernel's bnxt_en driver could cause the network queue to stop and never restart under specific conditions involving deferred packet completions and small ring sizes. This occurs when a burst of packets defers completions and a subsequent software USO packet cannot be processed due to insufficient buffer descriptors, leading to a stalled queue. The issue affects small ring sizes (<= 457 descriptors) and has been fixed by ensuring the completion bit is cleared appropriately to guarantee queue restart.
A vulnerability in the Linux kernel's bnxt_en driver caused crashes due to out-of-bounds access when handling TPA IDs. The firmware supports up to 1024 concurrent TPAs, but some NICs advertise fewer, leading to invalid indexing and kernel crashes. This issue has been fixed by properly bounding the software TPA IDs and allocating the rx_tpa array accordingly.
A vulnerability in the Linux kernel's bnxt_en driver was resolved involving improper handling of buffer allocation failures in the bnxt_queue_mem_alloc() function. The issue occurs when bnxt_alloc_one_tpa_info_data() returns an error due to allocation failure, but bnxt_queue_mem_alloc() ignores this error and installs a partially initialized ring. This can lead to the hardware selecting an uninitialized slot with a zero DMA address, potentially causing malfunction. The fix involves checking the allocation return value and properly freeing resources on failure.
A vulnerability in the Linux kernel's bnxt_en driver was resolved involving improper error propagation during RX ring initialization. The function bnxt_init_nic() ignored errors from bnxt_init_rx_rings(), potentially enabling TPA over partially zeroed RX ring entries, which could lead to zeroed DMA addresses being used. This issue was fixed by ensuring error propagation out of bnxt_init_nic(), allowing callers to properly handle failures and clean up resources.
A vulnerability in the Linux kernel's bnxt_en driver was resolved that involved improper handling of buffer allocation failures in the bnxt_rx_ring_reset() function. The function failed to properly propagate allocation errors, leading to potential use of uninitialized DMA addresses when re-enabling TPA (TCP Packet Aggregation). This could cause severe impacts including confidentiality, integrity, and availability issues. The vulnerability affects specific linux-hwe-edge versions and has a CVSS score of 8.1.
A vulnerability in the Linux kernel's bnxt_en driver was resolved that involved improper freeing of memory related to the live ring's TPA state on queue restart failure. Specifically, during a queue restart failure, the live ring's memory could be freed while still in use due to shallow copying and incomplete pointer initialization in the clone structure. This could lead to use-after-free conditions. The fix involved initializing the clone's pointers to NULL to prevent inadvertent freeing of live ring state memory.
A vulnerability in the Linux kernel's media subsystem related to the validation of AV1 tile counts in stateless AV1 decoders has been resolved. The issue involves improper bounds checking of tile_cols and tile_rows fields, which are used as loop bounds and indices in various arrays and calculations. This could lead to out-of-bounds access or buffer overflows. The fix enforces validation to reject AV1 frame controls with tile counts exceeding defined maximums, while still accepting zero tile counts as before.
A vulnerability in the Linux kernel's media subsystem related to v4l2 controls for HEVC tile counts has been resolved. The issue involves the stateless HEVC decoders reading tile count values without proper bounds checking, which could lead to out-of-bounds access. The fix enforces validation to reject HEVC PPS controls with tile counts exceeding the allowed array capacity.
A vulnerability in the Linux kernel's media subsystem for Verisilicon Rockchip AV1 decoding allows frames with tile counts exceeding the tile capacity to be processed, leading to out-of-bounds reads. This occurs because the tile group entry array is indexed beyond its submitted size when tile counts are not properly validated. The issue has been resolved by rejecting AV1 frames that exceed the maximum allowed tiles or the submitted entry count.
A vulnerability in the Linux kernel's media subsystem for Verisilicon Rockchip VPU981 AV1 decoding was resolved. The flaw involved a division by zero risk and potential buffer overflow when processing tile information from the bitstream. The issue was fixed by guarding the division operation and limiting writes to the tile_info DMA buffer. This vulnerability affects specific linux-hwe-edge kernel versions and has a CVSS score of 7.8, indicating a high impact on confidentiality, integrity, and availability.
A vulnerability in the Linux kernel's media component for Mediatek video codec (vcodec) involving the AV1 tile-start copy operation has been resolved. The function vdec_av1_slice_setup_tile() copied more entries than the array capacity allowed, potentially causing out-of-bounds memory access. This issue has been fixed by bounding the copy operation to the array capacity.
A vulnerability in the Linux kernel's media rkvdec component related to HEVC tile loops and PPS id handling has been resolved. The issue involved unbounded loops and indexing based on untrusted picture parameter set (PPS) data, which could lead to out-of-bounds writes in hardware tables. The fix bounds the tile loops and validates the PPS id before use to prevent such writes.
A vulnerability in the Linux kernel's media subsystem for Verisilicon Hantro hardware was resolved. The issue involved the G2 HEVC tile loop writing entries beyond the allocated buffer capacity in the tile_sizes DMA buffer. The fix ensures that loops are bounded using helper functions to stay within buffer limits, preventing potential buffer overflows.