CVE Vulnerability Catalog

A race condition was found in the Linux kernel's power management runtime (PM runtime). The pm_runtime_work() function may dereference the dev->parent pointer after the parent device has been freed, leading to a use-after-free. The fix adds a flush_work() call in pm_runtime_remove().

In the Linux kernel, the aqc111 driver (net: usb) calls a power management (PM) function in its suspend callback, leading to a task hung in rpm_resume. The issue occurs when aqc111_suspend calls the PM variant of its write_cmd routine, causing a wait for a status change that never happens, blocking another task holding rtnl_lock and the entire networking stack.

In the Linux kernel, in the ACPI processor module, a previous fix for acpi_processor_errata_piix4() introduced a use-after-free issue. Device pointers may be dereferenced after dropping references to the device objects. Additionally, debug messages about enabling errata may be printed when errata flags are unset. The fix moves message printing to the points where errata flags are set.

In the Linux kernel, SRv6 IPv6 paths lack NULL checks for the idev pointer returned by __in6_dev_get(). This can lead to a NULL pointer dereference when a network device has no IPv6 configuration.

In the mlx5e driver in the Linux kernel, a race condition exists when accessing the ASO context for IPsec because the spinlock is released before WQE completion, allowing overwriting of the shared DMA context.

In the Linux kernel, the udp_sock_create6 function returns success (0) without creating a socket when CONFIG_IPV6 is disabled. This leads to a NULL pointer dereference in callers like fou_create, causing a kernel crash.

In the Linux kernel's mvpp2 driver for Marvell PP2/CP11X, a NULL pointer dereference vulnerability exists. The mvpp2_bm_switch_buffers() function unconditionally calls flow control update without checking if the CM3 SRAM resource is available, causing a kernel panic on MTU changes.

In the Linux kernel's network shaper mechanism, there is a race condition between Netlink operations and network device unregistration. This can lead to a shaper hierarchy leak if the hierarchy is created after a flush has already run.

A bug was found in the Linux kernel's PMU (Performance Monitoring Unit) handling for AMD EPYC processors. The issue is that the event pointer setup in x86_pmu_enable() occurs too late, leading to a race condition and a NULL pointer dereference in the NMI (Non-Maskable Interrupt) handler. This results in a kernel crash.

In the Linux kernel arm_mpam driver, a null pointer dereference occurs when restoring memory bandwidth counters. When an MSC is brought offline and online, mpam_restore_mbwu_state() does not set mbwu_arg.val, causing a kernel oops.

In the Amlogic SPI driver (amlogic-spisg) in the Linux kernel, a memory leak occurs in aml_spisg_probe(). After allocating a controller via spi_alloc_target() or spi_alloc_host(), several error paths fail to call spi_controller_put().

In the vmwgfx graphics driver (for VMware) in the Linux kernel, a memory leak occurs due to overwriting the surface dirty tracker in KMS mode.

Juju versions from 2.9 to before 2.9.56 and 3.6 to before 3.6.19 allow any authenticated user, machine, or controller to modify application resources across the entire controller.

Juju from versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19 allows a compromised workload machine to read any log file for any entity in any model at any level.

A vulnerability in FastMCP before version 3.2.0. Server names containing shell metacharacters (e.g., &) can cause command injection on Windows during installation via fastmcp install claude-code or gemini-cli.

Casdoor 2.356.0 has a server-side request forgery (SSRF) vulnerability in the Webhook URL Handler component. The attack can be launched remotely without authentication.

Dokuwiki version 2025-05-14b has a denial of service vulnerability in the media_upload_xhr() function in media.php. A remote attacker can cause a denial of service.

In Biztalk360 through version 11.5, a Directory Traversal vulnerability exists due to mishandling of user-provided input in a path to be read by the server. A Super User attacker can read files on the system and/or coerce an authentication from the service.

Focalboard version 8.0 (unsupported product) fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the file content. The product is no longer maintained and no fix will be issued.

In the logicvc DRM driver in the Linux kernel, a device node reference leak occurs in logicvc_drm_config_parse(). The of_get_child_by_name() function does not release the reference to the found 'layers' node.