Maurizio Lombardi

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a kernel panic that occurs when a host sends an invalid H2C PDU length. If the host sends an H2CData command with an invalid DATAL, the kernel may crash in the `nvmet tcp build pdu iovec()` function due to a null pointer dereference. The PDU length should never exceed the `MAXH2CDATA` parameter, which has been communicated to the host in `nvmet tcp handle icreq()`. To fix the bug, a fatal error is raised if DATAL isn't coherent with the packet size. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the `flush all cpu locked()` function in the Linux kernel's memory management subsystem. When this function is called from a task context, it may cause a dependency issue if a workqueue with the `WQ MEM RECLAIM` bit set ends up flushing the global workqueue. This can lead to problems with memory management and potentially affect the confidentiality, integrity, and availability of protected information. The vulnerability can be exploited by creating a workqueue for the flush operation without the `WQ MEM RECLAIM` bit set. **Recommendations** To resolve this issue, create a workqueue for the flush operation with the `WQ MEM RECLAIM` bit set. This will help avoid the dependency issue and ensure proper memory management. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.14.0-39.el9.x86 64 **Description** The vulnerability is related to the `bnx2fc` driver in the Linux kernel. The `bnx2fc destroy()` function removes the interface before calling `destroy work`, resulting in multiple warnings from `sysfs remove group()` as the controller rport device attributes are removed too early. This issue can be reproduced by following specific steps, including enabling `fcoe` and executing `fipvlan` and `fcoeadm` commands. The problem is caused by the removal of the `fcoe port`'s `destroy work` queue, which is not needed. **Recommendations** To resolve this issue, update the Linux kernel to a version that includes the fix for this vulnerability. Specifically, for Linux kernel version 5.14.0-39.el9.x86 64, ensure that the `bnx2fc` driver is updated to flush the `destroy work` queue before calling `bnx2fc interface put()`. As a temporary workaround, consider disabling the `fcoe` interface until a patch is available.