https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 10:53:44 +0000 https://cve.radiocsirt.org/vuln/cve-2023-53083 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>nfsd: don&#39;t replace page in rq_pages if it&#39;s a continuation of last page</p> <p>The splice read calls nfsd_splice_actor to put the pages containing file data into the svc_rqst-&gt;rq_pages array. It&#39;s possible however to get a splice result that only has a partial page at the end, if (e.g.) the filesystem hands back a short read that doesn&#39;t cover the whole page.</p> <p>nfsd_splice_actor will plop the partial page into its rq_pages array and return. Then later, when nfsd_splice_actor is called again, the remainder of the page may end up being filled out. At this point, nfsd_splice_actor will put the page into the array _again_ corrupting the reply. If this is done enough times, rq_next_page will overrun the array and corrupt the trailing fields -- the rq_respages and rq_next_page pointers themselves.</p> <p>If we&#39;ve already added the page to the array in the last pass, don&#39;t add it to the array a second time when dealing with a splice continuation. This was originally handled properly in nfsd_splice_actor, but commit 91e23b1c3982 (&#34;NFSD: Clean up nfsd_splice_actor()&#34;) removed the check for it.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>nfsd: don&#39;t replace page in rq_pages if it&#39;s a continuation of last page</p> <p>The splice read calls nfsd_splice_actor to put the pages containing file data into the svc_rqst-&gt;rq_pages array. It&#39;s possible however to get a splice result that only has a partial page at the end, if (e.g.) the filesystem hands back a short read that doesn&#39;t cover the whole page.</p> <p>nfsd_splice_actor will plop the partial page into its rq_pages array and return. Then later, when nfsd_splice_actor is called again, the remainder of the page may end up being filled out. At this point, nfsd_splice_actor will put the page into the array _again_ corrupting the reply. If this is done enough times, rq_next_page will overrun the array and corrupt the trailing fields -- the rq_respages and rq_next_page pointers themselves.</p> <p>If we&#39;ve already added the page to the array in the last pass, don&#39;t add it to the array a second time when dealing with a splice continuation. This was originally handled properly in nfsd_splice_actor, but commit 91e23b1c3982 (&#34;NFSD: Clean up nfsd_splice_actor()&#34;) removed the check for it.</p> https://cve.radiocsirt.org/vuln/cve-2023-53083