CVE Vulnerability Catalog

In the Linux kernel, a bug was found in the lan966x driver where a mutex was used in an atomic context, causing a warning about sleeping in an invalid context. The fix replaces the mutex with a spinlock.

In the Linux kernel, io_uring/zctx has an issue with chaining notification contexts. Send zc should only link ubuf_info for requests from the same context. There are ambiguous syz reports, so a check is added on notification completion.

In the Linux kernel, the drm/msm driver did not update last_fence in the vm-bind path, causing resources to be freed while in use on context close, leading to faults. Added last_fence update in the vm-bind path.

In the Linux kernel for AMD Zen5 processors, there is an issue with the RDSEED instruction in 16-bit and 32-bit variants returning a value of 0 with an incorrect success signal (CF=1). A fix is added that checks microcode revisions.

A use-after-free (UAF) vulnerability was found in the Linux kernel's Bluetooth stack in the packet RX path. Improper locking when looking up the hci_conn structure allows concurrent modification or deletion, potentially causing a system crash.

A memory corruption bug was found in the Intel PUNIT IPC driver in the Linux kernel. Instead of passing the pointer to the punit_ipcdev structure, the address of the pointer was passed, causing writes to an incorrect memory address.

A potential NULL pointer dereference was found in the sxgbe network driver in the Linux kernel in the sxgbe_rx() function. When skb is NULL, an error is printed but then skb is dereferenced, potentially causing a kernel panic.

In the Linux kernel's io_uring/net subsystem, a bug exists where vectored registered buffer imports use the wrong 'req' object instead of 'sr->notif'. This can lead to lifetime management issues.

In the Linux kernel, the amdgpu driver for AMD displays lacks a NULL pointer check before dereferencing in the dc_stream_get_scanoutpos function. This causes a NULL pointer dereference during the IGT kms_cursor_legacy test, leading to a system crash.

In the libceph library in the Linux kernel, BUG_ON was replaced with bounds checking for map->max_osd. OSD indexes come from untrusted network packets, so validation was added to prevent potential crashes.

Podatność CVE-2025-10450 w RTI Connext Professional (Biblioteki podstawowe) umożliwia nieautoryzowanym osobom dostęp do prywatnych informacji osobistych poprzez podsłuchiwanie ruchu sieciowego. Dotyczy to wersji Connext Professional od 7.4.0 do przed 7.7.0 oraz od 7.2.0 do przed 7.3.1.

A use-after-free vulnerability was discovered in the Linux kernel's NVMe driver. The issue stems from improper lifetime management of the controller's admin request queue, which namespaces may access after controller teardown. The fix moves the controller reference release after all namespace references are freed.

A vulnerability in the Linux kernel ext4 filesystem lacks i_data_sem protection during inline data destruction, causing a race condition between inode modification and block mapping. This can trigger a kernel BUG and system crash.

A data race on the death_list in the Linux kernel's Rust Binder driver was found. An unsafe remove operation can run concurrently with moving items to a local list, corrupting prev/next pointers and causing system crashes.

An out-of-bounds read was found in the rtw_get_ie() IE parser in the staging rtl8723bs driver in the Linux kernel. The IE length was not validated, allowing reads beyond the frame buffer or infinite loops on malicious frames.

In the staging rtl8723bs driver in the Linux kernel, a stack buffer overflow was found during Association Request frame parsing. The Supported Rates IE length from the frame was used directly as the memcpy() length when copying into a fixed-size 16-byte stack buffer, allowing a malicious station to cause a stack overflow by advertising an IE length larger than 16 bytes.

An out-of-bounds read was found in the Extended Supported Rates (ESR) IE parsing in the OnBeacon function in the staging rtl8723bs driver in the Linux kernel. Lack of bounds checking can cause kernel panics on malicious beacon frames.

In the Linux kernel, the blocker tracking mechanism assumed lock pointers are at least 4-byte aligned to use their lower bits for type encoding. On architectures like m68k that only guarantee 2-byte alignment for 32-bit values, this assumption is broken, causing WARN_ON_ONCE warnings. The fix adjusts runtime checks to silently ignore locks that are not 4-byte aligned, disabling the feature in such cases.

In the Linux kernel's ksmbd module, a socket leak occurs when the per-IP connection limit is exceeded. The accepted socket is not closed, enabling a remote DoS attack.

In the NFS client (Linux kernel), a missing check of the cert_serial and privkey_serial fields in nfs_match_client() was found when using the TLS security policy of type RPC_XPRTSEC_TLS_X509. This could lead to incorrect client identification.