CVE Vulnerability Catalog

In the Linux kernel, a vulnerability in the NXP i.MX8 ISI (Image Sensor Interface) M2M driver causes improper streaming cleanup. Imbalanced streamon/streamoff calls (e.g., when exiting an application with Ctrl+C) prevent the usage_count from reaching zero, leaving the ISI channel unfreed. Additionally, an input line width over 2K triggers a WARN_ON().

In the XSK (AF_XDP) subsystem of the Linux kernel, the xdp_desc validation functions do not reject certain invalid values, such as desc->len close to U32_MAX with non-zero tx_metadata_len, which can lead to integer overflows and transmission of invalid frames.

In the Linux kernel, the IPv6 stack's ip6_output() function did not use RCU, allowing a use-after-free (UAF) when accessing the device via dst_dev_rcu(). The fix adds RCU and removes unnecessary rcu_read_lock/unlock pairs from ip6_finish_output2().

In the Linux kernel iommu/vt-d driver in legacy mode, the page table dump logic incorrectly accesses an uninitialized SSPTPTR register when the Translation Type (TT) is not 00b or 01b, causing a general protection fault and kernel oops.

In the Linux kernel for LoongArch architecture, a vulnerability was found in the BPF implementation that does not support struct arguments in trampoline programs. Running the 'tracing_struct' bpf selftest causes an Oops error and potential system hang.

In the Linux kernel, a vulnerability was found in the TLS mechanism where get_netdev_for_sock() called during setsockopt() was not under RCU, potentially causing a use-after-free (UAF) via sk_dst_get(sk)->dev. The fix replaces calls with __sk_dst_get() and dst_dev_rcu() to ensure safe access to the destination structure.

W jądrze Linuxa naprawiono podatność związaną z Bluetooth, która mogła prowadzić do użycia po zwolnieniu (UAF) w funkcji iso_conn_free. Problem występował, gdy wskaźnik conn->sk nie był ustawiony na NULL.

In the Linux kernel, the rtl8150 USB driver's rtl8150_set_multicast function calls netif_stop_queue and netif_wake_queue, disrupting TX queue synchronization. This can lead to double URB submission and a warning in rtl8150_start_xmit.

In the SMC subsystem of the Linux kernel, the function smc_clc_prfx_set() uses sk_dst_get(sk)->dev without RCU or RTNL protection, which can lead to a use-after-free (UAF) during connect() calls.

In the Linux kernel, the ip6_xmit() function lacked RCU protection, leading to a potential use-after-free (UAF) vulnerability. The fix introduces RCU to safely access the network device structure.

In the Linux kernel's MPTCP subsystem, the mptcp_active_enable() function may use sk_dst_get(sk)->dev without RCU protection, leading to a use-after-free (UAF) vulnerability.

In the Linux kernel, a null pointer dereference (NPD) was found in xdr_stream_decode_opaque_auth() (sunrpc module) when the checksum length is zero. When checksum.len is 0, checksum.data is set to NULL, triggering an NPD when accessing checksum.data in gss_krb5_verify_mic_v2(). The fix ensures checksum.len is not less than XDR_UNIT.

In the Linux kernel for SPARC architecture on UltraSPARC III, a bug was found in copy_from_user and copy_to_user functions. Exception handling incorrectly calculated remaining bytes to copy, potentially returning impossibly large values and causing BUG_ON in filesystems like ext4.

A vulnerability was found in the Linux kernel's BPF subsystem where bpf_prog_test_run_xdp() can cause a NULL pointer dereference. The issue arises from missing enforcement of expected_attach_type during tailcalls, allowing BPF programs to access unauthorized data.

In the Linux kernel's pm80xx SCSI driver, an out-of-bounds array access was found during module removal (rmmod). For devices behind an expander, the attached_phy ID can exceed the number of local phys, causing indexing beyond the phy array.

In the pci_endpoint_test driver of the Linux kernel, adding NO_BAR (-1) to the pci_barno enum changed it from unsigned to signed int, allowing a user to pass a negative value in ioctl, leading to an array underflow in pci_endpoint_test_bar().

In the Linux kernel for SPARC architecture on Niagara processors, a bug was found in copy_from_user and copy_to_user functions. Exception handling had incorrect calculations and a broken epilogue, potentially leading to wrong return values and crashes.

Wtyczka Easy Email Subscription dla WordPressa jest podatna na przechowywane ataki Cross-Site Scripting (XSS) poprzez parametr 'name' we wszystkich wersjach do 1.3 włącznie, z powodu niewystarczającej sanitizacji danych wejściowych i ucieczki danych wyjściowych. Umożliwia to nieautoryzowanym atakującym wstrzykiwanie dowolnych skryptów webowych na stronach, które będą wykonywane przy każdym dostępie użytkownika do zainfekowanej strony.

Podatność CVE-2025-11962 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w systemie Digital Corporate Warehouse firmy DivvyDrive Information Technologies Inc., co pozwala na wystąpienie ataków typu Stored XSS. Problem ten dotyczy wersji przed 4.8.2.22.

Wtyczka Payment Plugins Braintree dla WooCommerce w WordPressie jest podatna na obejście autoryzacji z powodu braku sprawdzenia uprawnień na końcówce API wc-braintree/v1/3ds/vaulted_nonce we wszystkich wersjach do 3.2.78 włącznie. Problem wynika z tego, że końcówka została zarejestrowana z permission_callback ustawionym na __return_true, co pozwala na przetwarzanie tokenów ID dostarczonych przez użytkowników bez weryfikacji własności lub autoryzacji.