An out of bounds (OOB) memory access flaw was found in the Linux kernel in relayfilereadstartpos in kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel internal information.

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134finidev in drivers/media/pci/saa7134/saa7134-core.c.

An Out-Of-Bounds Read vulnerability in smb2dumpdetail in fs/smb/client/smb2ops.c in the Linux Kernel. This flaw could allow a local attacker to crash the system or leak internal kernel information.

Refer: https://bugzilla.kernel.org/showbug.cgi?id=218219

1] If CONFIGCIFSDEBUG2 is set, then cifsdemultiplexthread calls dumpdetail.

static int cifsdemultiplexthread(void p) { ... for (i = 0; i < nummids; i++) { if (mids[i] != NULL) { mids[i]->respbufsize = server->pdusize;

if (bufs[i] != NULL) { if (server->ops->isnetworknamedeleted && server->ops->isnetworknamedeleted(bufs[i], server)) { cifsserverdbg(FYI, "Share deleted. Reconnect needed"); } }

if (!mids[i]->multiRsp || mids[i]->multiEnd) mids[i]->callback(mids[i]);

releasemid(mids[i]); } else if (server->ops->isoplockbreak && server->ops->isoplockbreak(bufs[i], server)) { smb2addcreditsfromhdr(bufs[i], server); cifsdbg(FYI, "Received oplock break\n"); } else { cifsserverdbg(VFS, "No task to wake, unknown frame received! NumMids %d\n", atomicread(&midcount)); cifsdumpmem("Received Data is: ", bufs[i], HEADERSIZE(server)); smb2addcreditsfromhdr(bufs[i], server); #ifdef CONFIGCIFSDEBUG2 if (server->ops->dumpdetail) server->ops->dumpdetail(bufs[i], server);//[1] cifsdumpmids(server); #endif / CIFSDEBUG2 / } } //[2]In smb2dumpdetail, calcsmbsize is called, which refers to smb2calcsize.

static void smb2dumpdetail(void buf, struct TCPServerInfo server) { #ifdef CONFIGCIFSDEBUG2 struct smb2hdr shdr = (struct smb2hdr )buf;

cifsserverdbg(VFS, "Cmd: %d Err: 0x%x Flags: 0x%x Mid: %llu Pid: %d\n", shdr->Command, shdr->Status, shdr->Flags, shdr->MessageId, shdr->Id.SyncId.ProcessId); cifsserverdbg(VFS, "smb buf %p len %u\n", buf, server->ops->calcsmbsize(buf));//[2] #endif } In hassmb2dataarea, it attempts to retrieve an element at the index le16tocpu(shdr->Command). If a value larger than the length of hassmb2dataarea is input, an OOB (Out-Of-Bounds) Read occurs."

unsigned int smb2calcsize(void buf) { struct smb2pdu pdu = buf; struct smb2hdr shdr = &pdu->hdr; int offset; / the offset from the beginning of SMB to data area / int datalength; / the length of the variable length data area / / Structure Size has already been checked to make sure it is 64 / int len = le16tocpu(shdr->StructureSize);

/ StructureSize2, ie length of fixed parameter area has already been checked to make sure it is the correct length. / len += le16tocpu(pdu->StructureSize2);

if (hassmb2dataarea[le16tocpu(shdr->Command)] == false)//[3] goto calcsizeexit;

A use-after-free vulnerability in the Linux kernel's afunix component can be exploited to achieve local privilege escalation.

The unixstreamsendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there is a race where unixstreamsendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free.

We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c.

A flaw in the Linux Kernel found. A use-after-free vulnerability in the Linux kernel's net/sched: schqfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfqdequeue() due to the incorrect .peek handler of schplug and lack of error checking in aggdequeue().

References: https://github.com/torvalds/linux/commit/8fc134fee27f2263988ae38920bc03da416b03d8

A use-after-free vulnerability was found in drivers/nvme/target/tcp.c in nvmettcpfreecrypto due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. In this flaw, a malicious user can cause a UAF and a double free, which may lead to RCE (may also lead to an LPE in case the attacker already has local privileges).

Reference: https://lore.kernel.org/linux-nvme/20231002105428.226515-1-sagi@grimberg.me/

A use-after-free in drivers/media/dvb-core/dvbdev.c in Linux Kernel could allow a local authenticated attacker to cause an unknown impact.

A flaw in the Linux Kernel found. A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation.

The perfgroupdetach function did not check the event's siblings' attachstate before calling addeventtogroups(), but removeonexec made it possible to call listdelevent() on before detaching from their group, making it possible to use a dangling pointer causing a use-after-free vulnerability.

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fd0815f632c24878e325821943edccc7fde947a2

A flaw in the Linux Kernel found. When splice() is called with a ktls socket as destination, the ktls code fails to update the internal "curr"/"copybreak" accounting that tracks which parts of the plaintext scatter-gather buffer (struct skmsgsg) are unused writable memory. This can cause subsequent writes to the socket to overwrite the contents of spliced pages, including pages from files to which the caller is not supposed to have write access.

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c5a595000e267

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the h->nets array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.

A Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcfextsexec()' is called with the destroyed tcfext.

A local attacker user can use this vulnerability to elevate its privileges to root.

This issue affects Linux Kernel: from 4.14 before git commit ee059170b1f7e94e55fa6cadee544e176a6e59c2.

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ee059170b1f7e94e55fa6cadee544e176a6e59c2

A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindexdelete function which does not properly deactivate filters in case of a perfect hashes while deleting the underlying structure which can later lead to double freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to root.

We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/ .

Accounts. A privacy issue was addressed with improved private data redaction for log entries.

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBCTUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBCTUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

A flaw was found in glibc. When the getaddrinfo function is called with the AFUNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.

A flaw in the Linux Kernel found. An out-of-bounds write vulnerability in the Linux kernel's net/sched: schqfq component can be exploited to achieve local privilege escalation. The qfqchangeagg() function in net/sched/schqfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks.

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e337087c3b5805fe0b8a46ba622a962880b5d64

A flaw in the Linux Kernel found in the GFS2 file system. On corrupted gfs2 file systems the evict code can try to reference the journal descriptor structure, jdesc, after it has been freed and set to NULL. It can lead to null pointer dereference when gfs2transbegin being called and then fail ingfs2evictinode().

Reference: https://listman.redhat.com/archives/cluster-devel/2023-April/023914.html

A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height greater than 32 to fbconsetfont, since there are no checks in place, a shift-out-of-bounds occurs leading to undefined behavior and possible denial of service.

A use-after-free flaw was found in r592remove in drivers/memstick/host/r592.c in media access in Linux Kernel. This flaw could allow a local attacker to crash the system at device disconnect. This vulnerability could even lead to a kernel information leak problem.

Refer: https://lore.kernel.org/lkml/CAPDyKFoV9aZObZ5GBm0U-UVeVkBNrAG-kH3BKoP4EXdYM4bw@mail.gmail.com/t/

A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption.

Airport. A permissions issue was addressed with improved redaction of sensitive information.

An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105remove in drivers/media/pci/dm1105/dm1105.c.

In emacprobe, &adpt->workthread is bound with emacworkthread. Then it will be started by timeout handler emactxtimeout or a IRQ handler emacisr. If we remove the driver which will call emacremove to make cleanup, there may be a unfinished work. This could lead to a use-after-free.

Upstream fix: https://github.com/torvalds/linux/commit/6b6bc5b8bd2d

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

A use-after-free in the function drivers/media/dvb-core/dvbcaen50221.c in Linux Kernel could allow a remote authenticated attacker from within the local network to cause an unknown impact.

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusbdec.c has a memory leak because of the lack of a dvbfrontenddetach call.

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbnet.c has a .disconnect versus dvbdeviceopen race condition that leads to a use-after-free.

In libpixman in Pixman before 0.42.2, there is an out-of-bounds write (aka heap-based buffer overflow) in rasterizeedges8 due to an integer overflow in pixmansamplefloory.

Last updated 25 April 2025

A use-after-free vulnerability was found in the Linux kernel's vmwgfx driver in vmwexecbuftiecontext. Systems making use of the vmwgfx driver are potentially affected by this flaw. Exploiting the bug would require an attacker to have access to either /dev/dri/card0 or /dev/dri/rendererD128 and be able to issue an ioctl() on the resulting file descriptor. Under certain circumstances a local unprivileged user could use this flaw to crash the system, causing a denial of service.

Reference: https://bugzilla.openanolis.cn/showbug.cgi?id=2075