A vulnerability in the Linux kernel's KVM arm64 implementation related to premature freeing of shadow Stage 2 (S2) structures has been resolved. The issue involved freeing shadow S2 structures too early in the VM lifecycle, which could lead to unsafe references. The fix delays freeing these structures until the virtual machine is fully destroyed, ensuring safe cleanup after all vCPUs are terminated.
A vulnerability in the Linux kernel SMB client related to handling cached directory opens has been resolved. The issue involved improper handling of compound SMB2 requests where a successful CREATE operation followed by an error in a subsequent command could lead to incorrect resource cleanup. The fix ensures proper validation of CREATE responses, correct tracking of file identifiers (FIDs), and appropriate handling of reconnect requests and close operations.
A vulnerability in the Linux kernel SMB client was resolved that involved out-of-bounds reads in the create context parsing function smb2_parse_contexts(). The issue allowed malformed create-context chains to expose bytes beyond the intended context boundaries to handlers. Additionally, lease parsers made incorrect layout assumptions that could yield unrelated data without failing. The fix enforces strict bounds checking on context records, rejects malformed chains, and ensures proper parsing of lease contexts.
A vulnerability in the Linux kernel's SMB client was resolved involving improper handling of compound wait errors during remote file operations. Specifically, if a later wait or synchronization fails, an earlier remote file handle may remain open because it is released without proper cancellation. The fix ensures that earlier operations are marked as cancelled and their responses properly handled to queue necessary close operations, preventing resource leaks.
A vulnerability in the Linux kernel's net/sched act_ct component could lead to use-after-free (UAF) conditions when processing cloned skb packets with unconfirmed connection tracking entries. This occurs due to modification of shared unconfirmed ct entries between clones, potentially causing pointer corruption in the expectation list. The issue has been resolved by resetting the entry to avoid shared modification problems without affecting known use cases.
A vulnerability in the Linux kernel's XFS filesystem was resolved that involved memory allocation failures during online repair operations. Specifically, a failure in allocating memory for new btree blocks could cause block leaks and potentially crash the filesystem repair process. The underlying issue was that the code could not properly undo partial transactions on error, leading to filesystem instability. The fix involved changing the allocation to a no-fail approach for a small reservation object, preventing the failure scenario.
A vulnerability in the Linux kernel's XFS filesystem was fixed that involved improper memory copying when formatting on-disk rtrefcount btree roots. The issue caused memory corruption due to copying too many bytes in inode btree root formatting methods.
A vulnerability in the Linux kernel's XFS filesystem was resolved involving a resource leak when changing ownership (chown) of the orphanage directory inode fails. The issue caused the kernel to leak a grabbed reference to the orphanage directory inode, potentially leading to resource management problems.
A vulnerability in the Linux kernel's Bluetooth subsystem related to CIS (Connected Isochronous Stream) ownership handling has been resolved. The issue involved improper management of connection holds during reuse, which could lead to inconsistent state handling in Bluetooth ISO layer connections.
A vulnerability in the Linux kernel's Bluetooth raw HCI socket security filter allows unprivileged sockets to submit out-of-range OCF values that alias allowlisted commands. This occurs because the filter masks the 10-bit OCF with 127, causing reserved OCF values to be treated as valid commands. The issue has been resolved by rejecting OCF values that cannot be represented by the security filter instead of aliasing them.
A vulnerability in the Linux kernel related to KVM on arm64 architecture has been resolved. The issue involved improper handling of the hyp stack pages in the host stage-2 memory management. The fix ensures that the hyp stack's virtual address range is properly walked and accounted for during host ownership checks.
A race condition vulnerability in the Linux kernel's Bluetooth management subsystem was resolved. The flaw involved the read_unconf_index_list() function, which could cause an out-of-bounds write due to inconsistent counting and filling of unconfigured Bluetooth controllers during asynchronous setup. The fix involves allocating space for every device on the hci_dev_list to prevent size mismatches caused by flag changes during the operation.
A vulnerability in the Linux kernel's Bluetooth L2CAP implementation allows out-of-bounds reads due to insufficient validation of frame length before accessing control and FCS fields. This occurs in the l2cap_data_rcv() function when unpacking control fields without ensuring their presence, and in l2cap_check_fcs() when CRC16 is enabled and frame length checks are inadequate.
A vulnerability in the Linux kernel's RISC-V KVM implementation involving improper serialization of IMSIC attributes during vCPU migration has been resolved. The issue allowed KVM device ioctls to access stale IMSIC VS-file attributes due to concurrent vCPU migration, potentially causing attribute operations to interact with the wrong interrupt file. The fix serializes IMSIC attribute operations with the target vCPU mutex to prevent migration and recycling of the VS-file during access.
A null pointer dereference vulnerability was identified and resolved in the Linux kernel's KVM arm64 nested virtualization code. The issue arises due to a race condition during concurrent teardown of nested stage 2 page tables, which can cause a NULL pointer dereference when invalidating VNCR_EL2. The fix involves adding a check for NULL before dereferencing and abstracting the invalidation logic to prevent the race.
A vulnerability in the Linux kernel's KVM module for arm64 architecture involving incorrect handling of the AArch32 DBGBXVR<n> register has been resolved. The issue was caused by a change in breakpoint and watchpoint register accessors that led to improper handling of Op2 values, causing the virtual machine to hit a fatal error and terminate. The fix restores correct mapping of Op2 1 to the appropriate debug register, preventing VM crashes.
A use-after-free vulnerability in the Linux kernel's RISC-V KVM implementation was resolved. The issue occurs due to a race condition during hrtimer callback teardown, where a vCPU can be freed while a timer callback is still running. This can lead to a use-after-free error detected by KASAN. The vulnerability is timing-sensitive and requires a guest to arm the timer and request shutdown. The fix involves synchronizing hrtimer_cancel() to block until the callback completes before vCPU destruction.
A vulnerability in the Linux kernel Bluetooth ISO subsystem related to reference counting in hci_bind_bis() has been resolved. The issue involves improper balancing of parent connection holds, which could lead to premature disconnection of a parent connection while its socket is still in use. The fix ensures that a hold is taken on the parent connection before linking and properly dropped if linking fails, preventing potential use-after-free or disconnection issues.
A vulnerability in the Linux kernel Bluetooth subsystem was resolved involving improper validation of event lengths before filtering. The function is_filtered_packet() reads event data without confirming the event buffer is sufficiently long, leading to potential out-of-bounds reads. This occurs when opcode filters are configured and malformed events are supplied by a controller or virtual host controller interface (vhci) device. The issue was fixed by rejecting truncated command events that are too short for inspection and correcting event code handling to prevent misclassification.
This content describes an open-source phishing forensics engine named phish-zero that claims 98.32% accuracy and operates with a zero-egress architecture to avoid leaking corporate click data. It uses local neural phishing detection, character n-gram TF-IDF vectorizers, and flags for TLD abuse. The post is a community share on Reddit and includes a link to the GitHub repository. There is no indication of a security vulnerability or active threat associated with this tool itself.