Gregkh

An out-of-bounds write occurs when triggering HLINK BUMP processing on file entries that have the `FLAG HLINKED` flag set while the hard-link preservation option is inactive. This happens because the `file struct` layout lacks the `F SUM` field, allowing memory access beyond the allocated structure and resulting in the corruption of adjacent heap or stack data.

A heap out-of-bounds write allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation. This occurs when a crafted files-from entry containing both an interior and trailing backslash is supplied to a read-only rsync daemon module, causing the `add implied include()` function to under-count the trailing backslash during destination buffer sizing.

A null pointer dereference occurs in the daemon child process. A remote attacker can cause the daemon to crash by sending a file list where the first entry is a dot entry not typed as a directory. The daemon processes the first file list entry as a directory structure pointer without verifying the entry type, leading to an invalid or uninitialized pointer dereference that terminates the client connection.

An arbitrary file write issue exists where attackers can write files outside the intended destination tree. This occurs by specifying an absolute path through the `--temp-dir` or `--link-dest` options, which bypasses the rename-confinement logic. This allows attacker-controlled values to write files to any location accessible to the rsync process.

A symlink race condition exists where a local attacker can cause the software to apply arbitrary Access Control Lists (ACLs) or extended attributes to unintended files. This occurs when a symlink is substituted at a predictable destination path between the file write operation and the subsequent `acl set file()` or `lsetxattr()` function calls. By exploiting this timing window, an attacker can redirect the application of ACLs and extended attributes to files outside the intended destination tree, which may lead to elevated permissions and local privilege escalation.

A TLS certificate validation issue allows on-path attackers to intercept encrypted sessions by presenting self-signed or invalid certificates. This occurs because the software fails to validate server TLS certificates against a trusted Certificate Authority (CA) or verify that the certificate hostname matches. Consequently, an attacker can decrypt or tamper with session content without the client detecting the interference.

An out-of-bounds write exists in the `read args()` function. A malicious sender can corrupt adjacent heap memory by providing a crafted argument list. This occurs when the argument count fills the `argv` allocation exactly, causing the trailing NULL terminator to be written beyond the allocation boundary.

An out-of-bounds write exists in the `parse size arg()` function. The issue occurs because the return value of `snprintf()` is used as an index for a .bss-segment array without proper bounds checking. When `snprintf()` truncates a formatted size string, it returns the number of characters that would have been written, which can exceed the array length. This leads to a write operation targeting memory outside the intended bounds, resulting in the corruption of .bss memory (a segment of memory used for uninitialized global and static variables).

An issue exists in the Linux kernel where the `xe vm madvise ioctl()` function fails to validate Page Attribute Table (PAT) indices. Specifically, using the `XE COH NONE` coherency mode with CPU cached buffers allows a GPU to bypass CPU caches and read stale, sensitive data directly from DRAM. This occurs because when the kernel clears pages before reallocation, the clear operation may remain in the CPU cache as dirty data, potentially leaking information from previously freed pages belonging to other processes.

An issue exists in the `memcg reparent list lrus()` function where the xarray entry of a dying memory control group (memcg) is cleared using `xas store(&xas, NULL)` before its per-node lists are reparented. This sequence creates a race condition where a concurrent `list lru del()` operation may fail to find the entry via `xa load()`, proceed to the parent memcg in `lock list lru of memcg()`, and execute `list del init()` on an item still linked to the dying memcg's list. If another thread simultaneously holds the dying memcg's per-node lock—such as during another `list lru del()` or a `list lru walk one()` isolate callback—both threads may modify the `->next` and `->prev` pointers of the same physical list using different locks, leading to the corruption of adjacent items' links.

An issue exists in the `accel/ivpu` component where the `get info ioctl()` function fails to validate the info size returned from the metric stream info query against the allocated buffer size. This lack of validation could lead to a buffer overflow if the firmware returns a size larger than the available buffer.

A heap overflow exists in the `get manuf info()` function. The issue occurs because the function reads a number of bytes specified by the `Size` field from a device I2C EEPROM into a buffer allocated with `kmalloc obj()`, which has a fixed size of 10 bytes. While the `Size` field is validated in `check i2c image()` to ensure it does not exceed 16384 bytes, it is not checked against the actual destination buffer size. A malicious USB device can set the `Size` field to a value up to 16377, leading to a heap overflow of up to 16367 bytes. Additionally, the `valid csum()` function iterates through the buffer based on the `Size` field, further compounding the out-of-bounds access.

A Use-After-Free (UAF) issue exists in the ALSA loopback driver. The `loopback check format()` function may stop the capture side when playback starts with parameters that do not match a running capture stream. While peer lookup is performed under `cable->lock`, the `snd pcm stop()` function executes after the lock is released. A concurrent close operation can remove the capture entry from `cable->streams[]` and free its runtime while the playback trigger path still holds a stale peer substream pointer.

A use-after-free issue exists in the Linux kernel due to a missing zerocopy reference in the `pskb carve inside header()` and `pskb carve inside nonlinear()` functions. Both functions copy the `skb shared info` header into a new buffer using `memcpy()`, which includes the `destructor arg` pointer (`uarg`) for MSG ZEROCOPY skbs. Because these functions fail to call `net zcopy get()` for the new `shinfo`, the reference count `uarg->refcnt` can be driven to zero prematurely. This leads to the premature freeing of `ubuf info msgzc` while TX skbs still hold active `destructor arg` pointers. This flaw has been verified to allow an unprivileged local user to achieve full root privilege escalation on a default kernel configuration.

An issue exists in the thunderbolt component where the `tb xdp properties request()` function derives the per-packet copy length from the response header without verifying if it fits within the previously allocated data buffer. A malicious peer can manipulate the length field to be larger than the declared `data length`, leading to a memory corruption where `memcpy` writes beyond the `kcalloc` allocation.

A desynchronization issue exists in the `nft inner parse l2l3()` function when processing inner IPv6 packets. While the `ipv6 find hdr()` function correctly calculates the transport header offset by traversing extension headers, this value is incorrectly overwritten by a calculation that only accounts for the IPv6 base header. This results in a mismatch between `inner thoff`, which incorrectly points to the start of the extension header, and `l4proto`, which correctly identifies the protocol (e.g., IPPROTO TCP). This discrepancy allows for transport header forgery and potential firewall bypass.

An integer overflow exists in the `kvm reset dirty gfn()` function within the Kernel-based Virtual Machine (KVM) component. A local attacker with access to `/dev/kvm` can manipulate dirty ring entries to cause a u64 wrap during an unchecked addition. This allows the attacker to bypass a bounds check, leading to an out-of-bounds load of a `kvm rmap head` and a subsequent conditional clear of `PT WRITABLE MASK` in the memory location pointed to by the loaded pointer. This flaw can result in information disclosure or a denial of service.

A race condition exists in the Input/Output Memory Management Unit (IOMMU) subsystem, which manages how devices access system memory. This occurs during device recovery when multiple memory domains are attached concurrently. Specifically, the ` iommu group set domain internal()` function rejects concurrent domain attachments if any device in the group is recovering, which triggers a WARN ON in ` iommu group set domain nofail()`. This can lead to a Use-After-Free (UAF) condition—where the system attempts to use memory that has already been released—potentially allowing a local attacker to execute unauthorized code or cause a system crash (denial of service).

A use-after-free flaw exists in the `ipc idr alloc()` function within the checkpoint/restore path for SysV Inter-Process Communication (IPC) ID allocation. The function forwards requests to `idr alloc()` with an open-ended upper bound. When the valid SysV IPC ID space is full, allocations can exceed `ipc mni`, resulting in IDs that use normal index encoding but target incorrect slots during lookup and removal. This breaks the IDR state and can leave a dangling pointer in the IDR entry. Specifically, for shared memory, the `shm destroy()` function may free an object while leaving a stale entry that, when accessed via `/proc/sysvipc/shm`, leads to a dereference of freed memory. This issue can be exploited by local attackers to achieve local privilege escalation to root. Technical details include: - **Vulnerable Function**: `ipc idr alloc()` - **Vulnerable Variable**: `ids->next id` passed to `idr alloc()` with a zero upper bound.

A use-after-free or type confusion issue exists in the SCTP implementation of the Linux kernel. In the `sctp sendmsg()` function, the `SCTP SENDALL` path iterates through associations using `list for each entry safe()`, which caches the next entry in the `tmp` variable. The function calls `sctp sendmsg to asoc()`, which may drop the socket lock within `sctp wait for sndbuf()`. While the lock is released, another thread can migrate the cached association to a new endpoint via `sctp sock migrate()` or free it due to a network ABORT. Because the `tmp` variable is not revalidated after the lock is re-acquired, the iterator may advance to a stale pointer, leading to a use-after-free if the socket was closed, or type confusion if the association was migrated. The type confusion path can allow a controlled indirect call via the `outqueue.sched->init sid` pointer.