CVE Vulnerability Catalog

A vulnerability was found in the Linux kernel's handshake networking mechanism. During net namespace exit, the list of pending handshake requests is not properly drained due to reversed arguments in list_splice_init(). Additionally, a race condition between the drain process and request cancellation can cause list corruption and memory leaks.

A vulnerability in the Linux kernel's KVM SEV implementation has been fixed, where Port I/O requests with a length of '0' were not properly ignored. This could cause an underflow when configuring the scratch area, potentially leading to incorrect behavior or system crashes.

In the Linux kernel KVM SEV module, a vulnerability was found due to incorrect calculation of the maximum scratch area length in GHCB. This bug can cause a buffer overflow when processing PSC requests if the minimum length is passed instead of the full size.

A vulnerability was found in the Linux kernel's KVM component for AMD SEV. When processing Page State Change (PSC) requests, the PSC buffer indices were not validated against the actual scratch area size, potentially leading to an out-of-bounds read.

In the Linux kernel, a vulnerability was found in IPv6 extension header handling. The ipv6_hop_jumbo() function can alter skb pointers, requiring the nh pointer to be recomputed to prevent errors.

In the Linux kernel, a vulnerability was found in ip6_parse_tlv() for IPv6, where the cached nh pointer may be invalidated by pskb_expand_head() in ipv6_dest_hao(). After handling the HAO option, the pointer is not refreshed, causing parsing of stale header data.

In the Linux kernel's ESP (Encapsulating Security Payload) IPsec subsystem, a vulnerability was found in the fast path packet processing due to incorrect fragment length checking. When the combined aligned length exceeds a page size, the destination buffer may be allocated as a single page while the scatter-gather list expects a larger area, leading to a potential buffer overflow.

Two vulnerabilities were found in the Linux kernel's iscsi-target module: a CRC buffer overread (4 bytes beyond allocated memory) and a double-free in iscsit_handle_text_cmd(). Both bugs have been present since the original LIO integration (commit e48354ce078c).

In the Linux kernel's SCSI target iSCSI subsystem, a heap buffer overflow vulnerability was found. The iscsi_encode_text_output() function fails to check remaining space in the 8 KB rsp_buf, allowing up to 32 KB of "NotUnderstood" responses for unknown keys, causing an approximately 24 KB overrun.

In the Linux kernel's iSCSI target subsystem, a buffer overflow vulnerability exists in chap_server_compute_hash() due to missing input length validation before BASE64 decoding. This allows writing beyond allocated memory, potentially leading to data corruption or code execution.

In the Linux kernel's Airoha network driver, a vulnerability was found where the transmit loop in airoha_dev_xmit() reads uninitialized fragment address and length during its final iteration. This occurs when the loop index equals skb_shinfo(skb)->nr_frags, leading to access of uninitialized memory and potential page fault. The fix avoids reading fragment data on the last iteration and moves the skb pointer to the last descriptor to defer freeing until final descriptor processing.

In the Linux kernel, a vulnerability in the sk_msg mechanism where the sg.copy bit is not properly synchronized during scatterlist transforms. This can expose file page-cache pages as writable by BPF, allowing modification of the original page cache.

In the Linux kernel, a vulnerability in the GCOV mechanism occurs when GCC optimization merges global branch counters with loop induction variables. Concurrent execution on multiple CPUs causes inconsistent counter values and out-of-bounds memory writes, manifesting as a page fault during IPComp processing.

In the Linux kernel, a use-after-free vulnerability was found in the exfat filesystem's exfat_find_dir_entry() function. A buffer_head is released before reading data from it in the TYPE_EXTEND branch, potentially leading to access of freed memory.

A use-after-free vulnerability was found in the Linux kernel's pnfs_update_layout() function in the pNFS implementation. The issue occurs when the NFS_LAYOUT_RETURN branch calls pnfs_put_layout_hdr(lo) before the tracepoint trace_pnfs_update_layout(), which still references the freed 'lo' structure.

In the Linux kernel's 9p filesystem, a vulnerability was found in p9_client_walk() due to improper reference counting. When a non-cloning walk fails, the error path incorrectly drops a reference to oldfid, potentially causing a use-after-free or refcount underflow.

In the Linux kernel's NFSD subsystem, a use-after-free vulnerability exists in layout stateid allocation. When nfsd4_layout_setlease() fails, the stateid is freed without removing it from the IDR registry, leaving a dangling pointer. Subsequent IDR walkers (states_show, client teardown) may dereference freed memory.

A vulnerability was found in the Linux kernel's NFSD server in the SECINFO_NO_NAME decode function. Improper initialization of the sin_exp structure before decoding may lead to using stale data from previous operations, causing an incorrect exp_put() call on an uninitialized pointer.

In the Linux kernel, the 8250_dw driver has a vulnerability where if clk_notifier_register() fails, the 8250 port remains registered while driver data is freed, leading to a use-after-free hazard on subsequent port access before rebind.

A vulnerability in @fastify/http-proxy up to version 11.5.0 causes the request prefix not to be rewritten when the prefix segment is URL-encoded. Fastify URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string replace against the decoded prefix. A request encoding one or more characters of the configured prefix matches the route but skips the rewrite, so the raw encoded path is forwarded to the upstream unchanged, allowing an attacker to reach upstream paths that the proxy was configured to hide via rewritePrefix, including internal or administrative endpoints.