A vulnerability in the Linux kernel's wifi libipw component allows malformed association responses that are too short to cause a buffer over-read. The libipw_handle_assoc_resp() function incorrectly calculates the length of information elements due to unsigned integer wraparound, leading to reading beyond the receive buffer. This issue affects specific Linux kernel versions and has been verified via testing under emulation.
A vulnerability in the Linux kernel's wifi libipw driver allows processing of too-short beacon and probe response frames. The libipw_process_probe_response() and libipw_network_init() functions assume a full 36-byte frame prefix, but some receive paths only verify a 24-byte header, causing length miscalculations that lead to out-of-bounds reads. This flaw was identified through AI-assisted code review and verified via testing under Generic KASAN on arm64 in QEMU.
A use-after-free vulnerability in the Linux kernel's IB/isert subsystem was resolved by ensuring deferred control PDU completions are fully processed before releasing connection resources. The flaw allowed queued work items to access freed memory due to improper synchronization between completion handling and connection teardown. This could lead to kernel memory corruption and system instability.
A vulnerability in the Linux kernel's RDMA core component related to unregistering network devices has been resolved. The issue involves the function ib_get_eth_speed using a net_device after it has started unregistering, potentially causing use of an unregistered device. The fix ensures that the device's registration state is checked under RTNL lock before use, preventing unsafe access during unregistering.
A use-after-free vulnerability in the Linux kernel's RDMA rxe driver was resolved by changing the timing of multicast group insertion into the mcg_tree. The flaw allowed a local userspace RDMA client to trigger a condition where a freed multicast group structure could be dereferenced, causing memory corruption. The fix ensures the multicast group is only published after successful programming of the backing Ethernet multicast address, preventing concurrent access to a group being torn down.
A vulnerability in the Linux kernel's RDMA/rxe component allowed unprivileged users to overwrite read-only page cache memory via On-Demand Paging (ODP) write operations. This occurred because a recent commit removed an access permission check, enabling RDMA traffic to modify pages mapped read-only, potentially affecting sensitive files like /etc/passwd or setuid binaries. The issue was resolved by restoring the HMM_PFN_WRITE check in the fault handling path to prevent unauthorized writes.
A use-after-free vulnerability in the Linux kernel's xfrm subsystem was resolved. The issue occurs because the code reads a network device pointer without holding a proper reference, leading to a potential use-after-free when the device is concurrently replaced. This can cause memory corruption and impact confidentiality, integrity, and availability. The vulnerability has a CVSS score of 7.8, indicating a high severity level. Multiple specific Linux kernel versions are affected. The fix involves changing how the device reference is accessed and held during bundle creation.
A vulnerability in the Linux kernel's RDMA rxe driver allowed an integer overflow in the mr_check_range() function, leading to out-of-bounds memory access. This flaw could be triggered by a remote unauthenticated peer crafting specific RDMA-Write/Read requests, causing a kernel crash (oops). The issue has been fixed by rewriting the range check to prevent integer overflow and out-of-bounds access.
A vulnerability in the Linux kernel's RDMA/rxe subsystem allows improper validation of access flags before reassigning the memory region's protection domain (PD). This can lead to use-after-free conditions where memory windows reference freed PD objects, causing potential kernel memory corruption. The issue arises because the access flags are validated only after the PD reassignment, and error handling does not revert the reassignment, leading to inconsistent reference counts and use-after-free bugs.
A use-after-free vulnerability in the Linux kernel's RDMA/siw subsystem was resolved by ensuring proper locking and clearing of association references when siw_qp_modify fails during siw_accept. Without this fix, a race condition could occur leading to a use-after-free of the connection endpoint (cep) object.
A vulnerability in the Linux kernel's ESP implementation involves improper handling of zerocopy managed fragments in the skb frag array. The issue arises when ESP mutates the frag array without downgrading the skb, leading to use-after-free conditions and memory leaks. This affects specific Linux kernel versions and has been resolved by ensuring proper reference management before modifying the frag array.
A vulnerability in the Linux kernel's xfrm subsystem related to improper RCU locking and reference counting was resolved. The issue involved missing rcu_read_lock(), skb_dst_force(), and dev_hold() calls in the xfrm_trans_reinject() function, which caused suspicious RCU usage warnings. This was due to a change converting xfrm_trans_reinject from a tasklet to a workqueue, altering the execution context and causing RCU lockdep warnings and potential use of non-refcounted network device references. The fix involved adding proper RCU read locks and ensuring reference counting of network device structures during packet reinjection.
A vulnerability in the Linux kernel's drm/ttm subsystem causes a use-after-free condition due to swapped-out resources not being properly removed from their bulk_move range. This can lead to crashes or memory corruption minutes to hours after hibernation or at process exit/reboot following hibernation. The issue was identified in certain Linux kernel versions and has been resolved by restoring the correct removal of swapped-out resources.
A vulnerability in the Linux kernel's SMB client (smb3_enum_snapshots) allows a potential out-of-bounds read when processing server replies shorter than expected. This can cause adjacent kernel memory to be leaked to userspace. The issue arises because the function sets a data length without verifying the actual reply length, leading to reading beyond the allocated buffer. The flaw has been fixed by rejecting replies shorter than the expected struct size.
A use-after-free (UAF) vulnerability in the Linux kernel's SMB client was fixed, addressing issues in handling compound encrypted frames. The flaw involved stale pointers and incorrect bounds checking in the receive_encrypted_standard() function, which could lead to memory corruption. The vulnerability affects specific Linux kernel versions and has a high CVSS score of 8.8.
A use-after-free vulnerability in the Linux kernel's SMB client implementation was fixed. The flaw occurs in the cifs_try_adding_channels() function when iterating over interface lists without proper reference counting, leading to dereferencing freed memory. This can cause memory corruption with potential impact on confidentiality, integrity, and availability. The issue affects specific Linux kernel versions and has a CVSS score of 7.5 (medium severity).
A vulnerability in the Linux kernel SMB client involving a race condition and missing initialization in the TCP_Server_Info.rlist linked list has been resolved. The issue arises because rlist is allocated with kzalloc, which zeros pointers instead of initializing them to point to itself, causing list operations to malfunction and potentially corrupt the list. Concurrent calls to cifs_signal_cifsd_for_reconnect() can add the same server's rlist node multiple times, further corrupting the list.
A use-after-free vulnerability in the Linux kernel's SMB client was resolved by ensuring that reconnect work is properly canceled before freeing server resources. The flaw occurred because clean_demultiplex_info() canceled only the echo delayed work but not the reconnect delayed work, leading to potential use-after-free when the demultiplex thread exited while reconnect work was still queued. This vulnerability affects specific linux-aws kernel versions and has a CVSS score of 7.5.
A vulnerability in SSSD allows a local user to cause a denial of service (DoS) by disrupting system authentication services. The flaw is due to improper handling of GSSAPI authentication in the PAM responder, where cached connection state is freed without clearing the reference pointer, potentially causing the service to access invalid memory and terminate unexpectedly. This issue affects multiple specific versions of SSSD. The CVSS score is 4.7, indicating a medium severity level.
CVE-2026-104040 is a medium severity vulnerability in SSSD when configured with the Entra ID identity provider on Red Hat Enterprise Linux 10. It involves improper escaping of single quotes in input lookup names before inclusion in Microsoft Graph OData queries. This flaw allows a low-privileged local user to craft search requests that can alter query filters, potentially leading to information disclosure and denial of service due to excessive processing and cache population.