Jeff Layton

The issue concerns a NULL dereference in the `nfsd4 process cb update()` function. Specifically, the `@ses` variable is initialized to NULL. If the ` nfsd4 find backchannel()` function does not find an available backchannel session, the `setup callback client()` function will attempt to dereference `@ses`, resulting in a segmentation fault.

The vulnerability is related to the NFS component of the Linux kernel. It is caused by incorrect locking in the `nfs netfs issue read()` function, which can lead to a deadlock when interrupts are not disabled while iterating through pages in the xarray to submit for NFS read. This issue can be reproduced with a specific test and may cause inconsistent lock state warnings on a lockdep-enabled kernel. The problem can occur when another page in the mapping is processed for writeback inside an interrupt, leading to a potential deadlock.

The issue is related to the calloc function in the glibc package, which does not properly initialize memory areas. This could allow attackers to cause a denial of service, resulting in a hang or crash, via unspecified vectors.

The issue allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging improper access to a certain error field in the ext4 journal stop function.

The issue is related to multiple vulnerabilities in the glibc and libc6 packages, which can lead to a disruption of confidentiality, integrity, and availability of protected information. The vulnerabilities can be exploited remotely or locally, depending on the specific package and version. The `encode name` macro in `misc/mntent r.c` is specifically mentioned as being vulnerable to newline characters in mountpoint names, allowing local users to cause a denial of service or possibly modify mount options and gain privileges.