https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 07:09:04 +0000 https://cve.radiocsirt.org/vuln/cve-2021-47544 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>tcp: fix page frag corruption on page fault</p> <p>Steffen reported a TCP stream corruption for HTTP requests served by the apache web-server using a cifs mount-point and memory mapping the relevant file.</p> <p>The root cause is quite similar to the one addressed by commit 20eb4f29b602 (&#34;net: fix sk_page_frag() recursion from memory reclaim&#34;). Here the nested access to the task page frag is caused by a page fault on the (mmapped) user-space memory buffer coming from the cifs file.</p> <p>The page fault handler performs an smb transaction on a different socket, inside the same process context. Since sk-&gt;sk_allaction for such socket does not prevent the usage for the task_frag, the nested allocation modify &#34;under the hood&#34; the page frag in use by the outer sendmsg call, corrupting the stream.</p> <p>The overall relevant stack trace looks like the following:</p> <p>httpd 78268 [001] 3461630.850950: probe:tcp_sendmsg_locked: ffffffff91461d91 tcp_sendmsg_locked+0x1 ffffffff91462b57 tcp_sendmsg+0x27 ffffffff9139814e sock_sendmsg+0x3e ffffffffc06dfe1d smb_send_kvec+0x28 [...] ffffffffc06cfaf8 cifs_readpages+0x213 ffffffff90e83c4b read_pages+0x6b ffffffff90e83f31 __do_page_cache_readahead+0x1c1 ffffffff90e79e98 filemap_fault+0x788 ffffffff90eb0458 __do_fault+0x38 ffffffff90eb5280 do_fault+0x1a0 ffffffff90eb7c84 __handle_mm_fault+0x4d4 f…</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>tcp: fix page frag corruption on page fault</p> <p>Steffen reported a TCP stream corruption for HTTP requests served by the apache web-server using a cifs mount-point and memory mapping the relevant file.</p> <p>The root cause is quite similar to the one addressed by commit 20eb4f29b602 (&#34;net: fix sk_page_frag() recursion from memory reclaim&#34;). Here the nested access to the task page frag is caused by a page fault on the (mmapped) user-space memory buffer coming from the cifs file.</p> <p>The page fault handler performs an smb transaction on a different socket, inside the same process context. Since sk-&gt;sk_allaction for such socket does not prevent the usage for the task_frag, the nested allocation modify &#34;under the hood&#34; the page frag in use by the outer sendmsg call, corrupting the stream.</p> <p>The overall relevant stack trace looks like the following:</p> <p>httpd 78268 [001] 3461630.850950: probe:tcp_sendmsg_locked: ffffffff91461d91 tcp_sendmsg_locked+0x1 ffffffff91462b57 tcp_sendmsg+0x27 ffffffff9139814e sock_sendmsg+0x3e ffffffffc06dfe1d smb_send_kvec+0x28 [...] ffffffffc06cfaf8 cifs_readpages+0x213 ffffffff90e83c4b read_pages+0x6b ffffffff90e83f31 __do_page_cache_readahead+0x1c1 ffffffff90e79e98 filemap_fault+0x788 ffffffff90eb0458 __do_fault+0x38 ffffffff90eb5280 do_fault+0x1a0 ffffffff90eb7c84 __handle_mm_fault+0x4d4 f…</p> https://cve.radiocsirt.org/vuln/cve-2021-47544