CVE Vulnerability Catalog

In the cifs.idmap mechanism, the payload length was incorrectly handled, potentially truncating it to U16_MAX. Not rejecting oversized payloads led to length inconsistencies and potential memory errors.

In cfg80211, the cfg80211_wext_siwgenie() function lacked validation of the IE buffer, leading to out-of-bounds read and integer underflow during subsequent processing. Validation was added before storing.

In Bluetooth RFCOMM, the rfcomm_recv_frame function lacked frame length validation, allowing out-of-bounds reads on truncated frames and length underflow (UINT_MAX) on zero-length frames. The fix rejects frames smaller than the required size.

In vhost-scsi, a race condition between command submission and memory table replacement (VHOST_SET_MEM_TABLE) could cause response writes to an unrelated object after completion. The fix flushes the backend after ioctl.

A vulnerability in the Linux kernel's SCSI subsystem where scsi_eh_lock_door() can block on tag allocation when all tags are held by requeued commands. This leads to a deadlock in the error handler thread, especially for devices with a single driver tag (e.g., USB storage).

An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.

An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client.

An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.

An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicious servers to crash the X client.

In the Linux kernel, the netfilter nfnetlink_log module has a synchronization issue: nfnl_log_net_exit() clears the logger pointer without waiting for an RCU grace period, potentially leading to use-after-free by concurrent packets. The fix moves the cleanup to .pre_exit to ensure RCU readers complete before freeing per-net state.

A vulnerability was found in the Linux kernel i2c/smbus subsystem due to missing early validation of SMBus block transfer length. A user-controlled oversized data->block[0] value can reach tracepoints and native smbus_xfer driver implementations unchecked, causing out-of-bounds memory access.

In the Linux kernel's appletalk module, aarp_send_ddp() calls atalk_find_dev_addr() without a NULL check, leading to a NULL pointer dereference when the device has no AppleTalk interface configured. The fix adds a NULL check consistent with other callers.

In the Linux kernel's f2fs filesystem, the f2fs_gc_kthread structure is dynamically allocated, leading to a race during teardown: the GC thread may access freed memory. The fix embeds f2fs_gc_kthread in f2fs_sb_info, simplifying lifetime management and preparing for race condition fixes.

In the Linux kernel's DRM pagemap driver, drm_pagemap_migrate_unmap_pages() relies on the pages array for DMA unmapping, but drm_pagemap_migration_unlock_put_pages() clears the array during cleanup, leaving no valid page info. The fix calls the unmap function before unlock_put_pages to keep the array valid.

OpenWA before version 0.23.5 allows a user with a VIEWER key to retrieve a group invite code without the OPERATOR role requirement. The invite code is transferable, so an unauthorized account can join the group, read and post messages, and retain membership after the VIEWER key is revoked.

In OpenWA before 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through wildcard, even though GET /api/sessions/{sessionId}/qr requires the OPERATOR role. When a session is waiting to be paired, the exposed QR lets the key holder link an external device to the WhatsApp account and then read and send messages outside OpenWA and its audit trail. Keys restricted through allowedSessions remain limited to those sessions.

Discourse before certain versions allowed a stored cross-origin iframe to bypass the allowed_iframes prefix policy when the iframe src contained encoded userinfo. An authenticated user with posting privileges could persist the iframe in a post, causing attacker-controlled cross-origin content to be rendered.

Discourse before certain versions allowed authenticated users to supply unescaped SQL LIKE wildcard characters in upload-resolution patterns, causing unrelated upload records to be selected. Access to restricted metadata, including original filenames and secure-upload paths, was possible without modifying the records.

Discourse before certain versions, when wildcard patterns were used in the allowed_iframes setting, could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The origin check was bypassed, and the browser selected a different attacker-controlled origin, allowing an attacker-controlled iframe to be rendered.

In Discourse before 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location not allowed by the administrator.