In the Linux kernel, the following vulnerability has been resolved:

smb: client: validate DFS referral PathConsumed

parse_dfs_referrals() validates that the response contains the fixed referral entry array and, on for-next, the per-referral string offsets. However, the response also contains a PathConsumed value that is later used for DFS path parsing.

If a malformed response provides a PathConsumed value larger than the search name, later DFS parsing can advance beyond the end of the path.

Validate PathConsumed against the search name length before storing it in the parsed referral.

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Important

A flaw was found in the Linux kernel's drm/amdkfd component. An unprivileged local user can exploit an out-of-bounds write vulnerability in the kfd_event_page_set() function. This occurs because the function writes data without properly validating the buffer size, allowing a small buffer to trigger a write beyond its allocated memory. Successful exploitation of this flaw could lead to potential privilege escalation.

CWE-787 - Out-of-bounds Write

A flaw was found in the Linux kernel's `nf_conntrack_h323` helper. A remote attacker could exploit this by sending a specially crafted Q.931 SETUP message to port 1720 through a firewall with the `nf_conntrack_h323` helper active. This memory corruption vulnerability leads to an out-of-bounds read, which can result in a heap-buffer-overflow.

CWE-131 - Incorrect Calculation of Buffer Size

A flaw was found in the Linux kernel's AMD GPU (amdgpu) driver. Incorrect management of graphics memory (dma_fence) references within the `amdgpu_gem_va_ioctl` function can lead to a reference count underflow and a use-after-after-free condition. A local attacker could exploit this vulnerability to trigger a kernel panic, causing the system to crash and resulting in a denial of service.

CWE-911 - Improper Update of Reference Count