CVE Vulnerability Catalog

A race condition exists in the Linux kernel's nfsd_net structure, where the boolean field grace_ended is read and written without synchronization from multiple threads. Two concurrent calls to nfsd4_end_grace() can both proceed to nfsd4_record_grace_done(), leading to a double-free and corruption of the reclaim_str_hashtbl list. The vulnerability is fixed by replacing boolean fields with a flags word and using the atomic test_and_set_bit() operation.

In the Linux kernel's sched_ext scheduler, kick_sync_wait_bal_cb() assumes it runs on the rq's CPU, but due to changes in rq lock dropping it can run on a foreign CPU. This leads to comparisons against unrelated snapshots and potential deadlock.

In the Linux kernel, the timer-sun4i clock driver advertises TIMER_SYNC_TICKS as the minimum delta, allowing the clockevents core to call set_next_event() with a value that programs a zero-tick interval. This can leave the next event stuck and cause a boot hang on Allwinner D1.

In the Linux kernel's mm/huge_memory, madvise_free_huge_pmd() can encounter a device-private PMD and enter the !pmd_present() branch, leading to pmd_folio() being called on an unexpected PMD. This can occur when an HMM-based GPU driver races with madvise(MADV_FREE).

In the Linux kernel's mm/madvise, madvise_cold_or_pageout_pte_range() can encounter a device-private PMD and enter the !pmd_present() branch, triggering a VM_BUG_ON(). This can occur when an HMM-based GPU driver races with madvise(MADV_COLD)/MADV_PAGEOUT).

In the Linux kernel's mm/page_owner, print_page_owner_memcg() re-reads page->memcg_data locklessly in two places, creating a TOCTOU condition. If the page is concurrently freed and reallocated as a THP tail page or slab page, VM_BUG_ON assertions can crash the kernel.

In the Linux kernel, cdx_create_res_attr() frees res_attr when sysfs_create_bin_file() fails but does not set cdx_dev->res_attr[num] to NULL, leaving a dangling pointer. A later call to cdx_destroy_res_attr() frees the already-freed memory, causing a double free.

In the Linux kernel's USB gadget f_tcm, usbg_make_tpg() holds dep_lock while calling configfs_depend_item_unlocked(), creating a circular lock dependency with configfs_rmdir(). This can lead to a deadlock.

In the Linux kernel, a vulnerability was found involving an out-of-bounds read in the of_alias_scan() function. The stem parser checks isdigit before validating boundaries, causing a read one byte before the property name when the name is empty or all digits. This could lead to unexpected behavior or information leakage.

A vulnerability in the Linux kernel's NFS server (nfsd) involves a NULL pointer dereference in nfsd_file_net_dispose(). During network teardown, the nn->nfsd_serv pointer may be cleared while the function still attempts to use it, leading to a crash. The fix safely checks the pointer before use.

In the Linux kernel's NFS server (nfsd), the vulnerability concerns the order of DRC hash table initialization before registering the shrinker. On weakly-ordered architectures (arm64, ppc), the shrinker may observe an uninitialized hash table, causing a NULL pointer dereference in the callback. The fix moves the initialization before registration.

In the Linux kernel's SMB client, the vulnerability involves hardening the DFS cache against invalid target hints. Functions get_tgt_name() and dfs_cache_noreq_update_tgthint() do not handle missing hints (NULL) properly, potentially leading to NULL pointer dereferences. The fix hardens the callers and adds NULL checks.

In the Linux kernel Bluetooth subsystem, hci_send_cmd_sync() cloned the sent command into hdev->req_skb using skb_clone(). Under memory pressure this clone could fail, leaving req_skb NULL, so hci_req_cmd_complete() never invoked hci_cmd_sync_complete() and the waiter timed out with -ETIMEDOUT after 10 seconds. The fix replaces skb_clone() with skb_get(), which only increments the reference count and cannot fail.

A race condition in the Linux kernel between KASAN quarantine cache shrink and CPU hotplug was found. When a CPU goes offline, objects remain on its per-CPU shrink_qlist and are not returned to the slab allocator, causing incomplete cache destruction and kernel warnings. Affects kernels with CONFIG_KASAN_GENERIC enabled.

A vulnerability in the Linux kernel's SUNRPC module involves not zeroing the rpc_gss_wire_cred structure at the entry of svcauth_gss_decode_credbody(). Since the structure is reused across requests, early decode failures leave partially stale data, potentially leading to dangling pointers or incorrect lengths. The fix zeroes the structure at entry.

In the Linux kernel, the procfs interface for reading PCI config space (proc_bus_pci_read) checked CAP_SYS_ADMIN based on the credentials of the task calling read(), not the process that opened the file. A privileged process could open the file and pass the file descriptor to an unprivileged process, which could then read the entire config space. The fix uses file_ns_capable() to check the credentials recorded in file->f_cred at open time, aligning with sysfs behavior.

In the Linux kernel's iommu/arm-smmu-v3 driver, the vulnerability involves teardown management. Manual freeing of resources in arm_smmu_device_remove() runs in the wrong order relative to devm-managed resources, potentially causing use-after-free, e.g., the IOPF queue freed before the IRQ that uses it. The fix moves all management to devm.

Araxis Merge for Windows versions 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry without sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials stored by the target user.

In the ZBar library, the decode6() function for Code 128 barcodes contains an undefined-behavior vulnerability. When decode_e() returns -1 for an invalid edge pattern, decode6() left-shifts this negative signed value, which is undefined behavior. This can cause a crash (SIGILL) in UBSan builds, leading to denial of service.

libconfini 1.16.4 contains a heap out-of-bounds write condition involving the bundled load_ini_buffer.h utility and strip_ini_cache(). The bundled utility allocates exactly ini_length bytes, while strip_ini_cache() unconditionally writes a NUL terminator at ini_source[ini_length], requiring an additional writable byte.