CVE Vulnerability Catalog

In the Linux kernel, in the RDMA rtrs-srv subsystem, process_read and process_write did not validate that usr_len is less than or equal to off, which could lead to an integer underflow. A malicious RDMA client could send usr_len greater than off, causing data_len to wrap to a huge size_t value and leading to out-of-bounds memory access. Validation of usr_len <= off was added before calling rtrs_srv_get_ops_ids().

In the Linux kernel, in the pds_core driver, pdsc_teardown() freed DMA buffers without disabling bus mastering, which could lead to use-after-free if the device wrote to freed memory. pci_clear_master() was added before freeing resources, and pci_set_master() was added in pdsc_setup() for the firmware recovery path.

In the Linux kernel, in the IBM EMAC MAL network driver, mal_remove() called napi_disable() unconditionally, which could lead to a system hang if NAPI was not enabled or was already disabled. The fix is to call napi_disable() only when the commac list is not empty.

In the Linux kernel, in netconsole, drop_netconsole_target() unlinked the target while only holding target_list_lock, while another thread (cleanup worker) could be iterating target_cleanup_list under target_cleanup_list_lock. This could lead to list corruption. The fix is to acquire target_cleanup_list_lock around list_del() to serialize the operations.

In the Linux kernel, a bug was fixed in the nvme-fc driver where an NVMe-FC controller in CONNECTING state could abort I/O requests before the I/O tagset was initialized. This led to a lockdep warning about improper lock usage and potential stability issues during error recovery after connectivity loss.

In the Linux kernel, in Bluetooth L2CAP, l2cap_recv_frame() read the two-byte PSM from connectionless frames without checking if the frame contained enough data. A malformed frame with zero or one byte payload could cause an out-of-bounds read. Frames that cannot contain the PSM are now rejected.

In the Linux kernel, in the ASoC rockchip_pdm driver, rockchip_pdm_set_fmt() ignored the return value of pm_runtime_get_sync(), which could lead to register access without power if resume fails. It was replaced with pm_runtime_resume_and_get() and an early return on failure was added.

A vulnerability in Anagnorisis (up to 0.3.1/0.4.0) in the Socket.IO Connect Interface component (app.py) causes missing authentication. The attack can be launched remotely, and the exploit is public. The vendor did not respond.

In authentik before 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an installation using SAML in either the identity-provider or SAML source role. The message can stop the worker handling /application/saml/* or /source/saml/*, causing assigned requests to fail. Continued malicious messages can cause a sustained share of legitimate traffic to fail. Other protocols are not affected.

In authentik before 2026.2.7, 2026.5.7, and 2026.8.2, a SAML Source verifies an assertion's signature and validity period but does not ensure that the identity provider issued the assertion for that Source or in response to a login request from that Source. It also does not record already accepted assertions, allowing replay. An unauthenticated actor possessing a valid assertion can use it to authenticate as the user named in the assertion. Only SAML Sources are affected.

In authentik before 2026.2.7, 2026.5.7, and 2026.8.2, API serializers return stored credentials when an account has view permission on an affected configuration, even without authorization to change it or read secrets. Affected configurations include one-time code delivery, outbound provisioning, device trust, identity sources, Kubernetes outpost, and applications using secrets. Deployments are at risk when view permission is granted to accounts not intended to read these credentials.

In authentik before 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status or assign an existing role to a group without holding the required permissions. Group hierarchy checks do not consistently account for inherited superuser status, and role assignment to a group lacks authorization checks.

In authentik before 2026.2.7, 2026.5.7, and 2026.8.2, email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the established address. An attacker who knows the target's password can substitute an attacker-controlled address, receive the one-time code, and finish enrolling the factor as the target. Successful enrollment gives the attacker a session as the target and access to SSO applications.

This CVE has been rejected because it is a duplicate of another CVE. It contains no vulnerability information.

An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.

In the Linux kernel's stmmac network subsystem for XGMAC2, the RBUE (RX Buffer Unavailable) interrupt was enabled by default, causing a MAC interrupt storm under heavy RX load. The fix disables RBUE in the default interrupt mask because it is redundant—the normal RIE interrupt already triggers NAPI and refills descriptors. This prevents the storm while maintaining normal RX handling.

In the Linux kernel SMB client, the cifsd thread can access the tcp_ses structure before the parent thread finishes populating it, causing a race condition. Additionally, the kthread_run macro may start the thread before returning the thread pointer, so if the kernel is preempted the thread sleeps waiting for SIGKILL. The fix moves thread creation after all tcp_ses fields are populated and splits kthread_create from wake_up_process.

In the Linux kernel exfat filesystem, when the upcase table size is zero in the dentry (e.g. due to corrupted media), an integer overflow causes the module to loop indefinitely. The fix avoids loading the table when size is zero, falls back to the default upcase table, and marks the volume read-only if no table is found.

In the Linux kernel virtio-fs, virtio_fs_setup_vqs() frees fs->vqs and fs->mq_map on the error path, then virtio_fs_ktype_release() frees them again, causing a double-free and dangling pointers. The fix sets the pointers to NULL after kfree() so the later release is harmless. This can be triggered when a broken virtio-fs device advertises more request queues than the transport provides.

In the Linux kernel HID hidpp driver, if input_register_device() fails, input_free_device() is called but a stale pointer to the old device remains in hidpp->input, potentially leading to a use-after-free. The fix resets it to NULL before returning from hidpp_connect_event().