Dmitry Safonov

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.6.74 **Description** A vulnerability has been resolved in the Linux kernel related to the overlayfs file system. The issue arises when the `ovl encode fh()` function fails to encode a file handle from a non-aliased inode, leading to a failure to report an fid with FAN DELETE SELF fanotify events. The `WARN ON()` assertion in `inotify show fdinfo()` was removed because it is possible for encoding file handle to fail for other reasons. The impact of failing to encode an overlayfs file handle goes beyond this assertion. The `ovl encode fh()` function seldom uses the alias and in the case of non-decodable file handles, it never needs to use the alias to encode a file handle. Defer finding an alias until it is actually needed so `ovl encode fh()` will not fail in the common case of FAN DELETE SELF fanotify events. **Recommendations** To resolve the issue, update to Linux kernel version 6.6.74 or later. As a temporary workaround, consider disabling the `ovl encode fh()` function until a patch is available. Restrict access to the vulnerable `inotify show fdinfo()` function to minimize the risk of exploitation. Avoid using the `inotify show fdinfo()` function for overlayfs watched inodes with discarded dentry aliases until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to v6.6 **Description** The issue is related to the encoding of file handles in the Linux kernel. The `encode fh()` method may fail for various reasons, and some users of `exportfs encode {fh,fid}()` have a `WARN ON()` assertion when this failure occurs. However, this assertion is incorrect and has been relaxed. The legacy users of `exportfs encode fh()`, such as `nfsd` and the `name to handle at(2)` syscall, are prepared to handle the possibility of failure to encode a file handle. **Recommendations** For Linux kernel versions prior to v6.6, apply the patch that relaxes the assertions on failure to encode file handles. As a temporary workaround, consider disabling the `exportfs encode {fh,fid}()` functions until the patch is applied. Restrict access to the vulnerable `encode fh()` method to minimize the risk of exploitation. Avoid using the `encode fh()` method in sensitive operations until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a potential Spectre v1 gadget in the `xfrm xlate32 attr()` function. This could allow an attacker to leak kernel memory content to malicious users. The vulnerability is caused by the use of the `type` variable as an array index, which can be exploited to bypass security measures. The `array index nospec()` function can be used to prevent this type of attack. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.