CVE-2023-53680 — NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL

Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL

OPDESC() simply indexes into nfsd4_ops[] by the op's operation number, without range checking that value. It assumes callers are careful to avoid calling it with an out-of-bounds opnum value.

nfsd4_decode_compound() is not so careful, and can invoke OPDESC() with opnum set to OP_ILLEGAL, which is 10044 -- well beyond the end of nfsd4_ops[].

RHSA-2025:23445 — Red Hat Security Advisory: kernel security update

kernel: ALSA: usb-audio: ALSA USB Audio Out-of-Bounds Bug kernel: net: sched: sfb: fix null pointer access issue when sfb_init() fails kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy kernel: Bluetooth: L2CAP: Fix user-after-free kernel: ext4: fix undefined behavior in bit shift for ext4_check_flag_values kernel: iomap: iomap: fix memory corruption when recording errors during writeback kernel: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() kernel: NFSD: Protect against send buffer overflow in NFSv2 READ kernel: mm: fix zswap writeback race condition kernel: wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() kernel: wifi: mwifiex: Fix OOB and integer underflow when rx packets kernel: Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp kernel: Bluetooth: L2CAP: Fix use-after-free kernel: skbuff: skb_segment, Call zero copy functions before using skbuff frags kernel: ip6mr: Fix skb_under_panic in ip6mr_cache_report() kernel: crypto: seqiv - Handle EBUSY correctly kernel: RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device kernel: NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL kernel: ethtool: check device is present when getting link settings kernel: sctp: linearize cloned gso packets in sctp_rcv kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() kernel: ALSA: usb-audio: Validate UAC3 power domain descriptors, too kernel: NFS: Fix a race when updating an existing write kernel: ALSA:…

Most recent entries from all

CVE-2023-53680 — NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL

RHSA-2025:23445 — Red Hat Security Advisory: kernel security update