337490 matches found
kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups
A flaw was found in the Linux kernel's netfilter component, specifically within the nftlookup functionality. This issue arises from incorrect handling of 'catchall' elements during 'inverted lookups' in the nftlookupeval function. Due to a logic error where the lookup result is not recomputed,...
kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry
A flaw was found in the Linux kernel's Server Message Block over Remote Direct Memory Access SMC-Rv2 protocol implementation. The smcllcrmtdeleterkey and smcllcsaveaddlinkrkeys functions incorrectly handle oversized LLC messages, reading beyond the intended message boundaries. This can lead to th...
kernel: net/sched: act_ct: Only release RCU read lock after ct_ft
A flaw was found in the Linux kernel. A race condition in the actct module, specifically during the flow table lookup, can lead to a Use-After-Free UAF vulnerability. This occurs because a critical lock is released prematurely, allowing a memory object to be freed while still in use. An attacker...
kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key
A flaw was found in the Linux kernel's acttunnelkey module, which manages network traffic tunneling. A race condition, where multiple operations occur in an unpredictable order, can lead to a use-after-free vulnerability. This allows a local attacker to corrupt memory, potentially causing the...
kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
A flaw was found in the Advanced Linux Sound Architecture ALSA Sound Open Firmware SOF ipc3-control component of the Linux kernel. This vulnerability, a heap overflow, occurs due to incorrect bounds checks when handling user data lengths. An unprivileged local user can exploit this to write past...
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping
A flaw was found in the Linux kernel's Network File System Daemon NFSD. A use-after-free vulnerability can occur during the blocked-lock reaping process. This happens when a client's lock owner, without a proper reference to keep the client alive, leads to the client being prematurely freed. This...
kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
A flaw was found in the Linux kernel's Wi-Fi mac80211 component. A connected WiFi 7 Access Point AP can trigger an out-of-bounds write by sending a specially crafted EPCS Enable Response action frame. This vulnerability can lead to a kernel crash, resulting in a Denial of Service DoS for the...
kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect
A flaw was found in the Linux kernel's cfg80211 wireless subsystem. This vulnerability involves a race condition during the process of disconnecting a wireless device, where a work item can be improperly queued after it has been cancelled. This could allow a local attacker to trigger a system...
kernel: net/sched: cls_route: fix fastmap use-after-free on filter
A flaw was found in the Linux kernel's net/sched: clsroute component. A race condition exists in the route4 classifier's fastmap cache, where a reader can re-cache a pointer to a filter that has already been freed by a writer. This can lead to a use-after-free condition, allowing subsequent packe...
kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key
A flaw was found in the Linux kernel's acttunnelkey module, which manages network traffic tunneling. A race condition, where multiple operations occur in an unpredictable order, can lead to a use-after-free vulnerability. This allows a local attacker to corrupt memory, potentially causing the...
kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
A flaw was found in the Advanced Linux Sound Architecture ALSA Sound Open Firmware SOF ipc3-control component of the Linux kernel. This vulnerability, a heap overflow, occurs due to incorrect bounds checks when handling user data lengths. An unprivileged local user can exploit this to write past...
kernel: ALSA: usx2y: bound the hwdep mmap fault offset
A flaw was found in the Advanced Linux Sound Architecture ALSA usx2y driver in the Linux kernel. A local attacker, by opening the hwdep node of an attached US-X2Y device, could exploit an unbounded memory mapping mmap fault offset. This allows read-write access to arbitrary kernel memory,...
kernel: udp: fix potential use-after-free in tunnel segmentation
A flaw was found in the Linux kernel's UDP User Datagram Protocol tunnel segmentation. This vulnerability arises when the system attempts to process network packets, specifically in the skbudptunnelsegment function. An attacker could potentially exploit a use-after-free condition, where the syste...
kernel: svcrdma: Validate Read chunk positions before reconstruction
A flaw was found in the svcrdma component of the Linux kernel. A remote attacker can exploit this vulnerability by supplying a crafted RPC/RDMA Read chunk position field that is not properly validated against the received inline body length. This can lead to an underflow, exposing adjacent slab...
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping
A flaw was found in the Linux kernel's Network File System Daemon NFSD. A use-after-free vulnerability can occur during the blocked-lock reaping process. This happens when a client's lock owner, without a proper reference to keep the client alive, leads to the client being prematurely freed. This...
kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush()
A flaw was found in the Linux kernel. A local attacker can cause a Denial of Service DoS or potentially escalate privileges through a use-after-free vulnerability in the RAID-5 Partial Parity Log PPL component. During flush operations, the system improperly continues to access an input/output I/O...
Important: Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update
An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...
kernel: udp: fix potential use-after-free in tunnel segmentation
A flaw was found in the Linux kernel's UDP User Datagram Protocol tunnel segmentation. This vulnerability arises when the system attempts to process network packets, specifically in the skbudptunnelsegment function. An attacker could potentially exploit a use-after-free condition, where the syste...
kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key
A flaw was found in the Linux kernel's acttunnelkey module, which manages network traffic tunneling. A race condition, where multiple operations occur in an unpredictable order, can lead to a use-after-free vulnerability. This allows a local attacker to corrupt memory, potentially causing the...
kernel: ALSA: usx2y: bound the hwdep mmap fault offset
A flaw was found in the Advanced Linux Sound Architecture ALSA usx2y driver in the Linux kernel. A local attacker, by opening the hwdep node of an attached US-X2Y device, could exploit an unbounded memory mapping mmap fault offset. This allows read-write access to arbitrary kernel memory,...