CVE Vulnerability Catalog

In the Linux kernel, a vulnerability in the do_procmap_query() function in procfs can cause a double mmput() on the mm_struct. The issue occurs when a user provides an incorrectly sized buffer for the build ID, triggering an -ENAMETOOLONG error after locks are released and mmput() is called, leading to a second mmput() in the error path.

In the Linux kernel, the rtw89 Wi-Fi PCI driver does not validate release report content before using it for the RTL8922DE chip. When an SKB release report becomes malformed, the lack of prior validation may lead to a crash.

In the Linux kernel, the iwlwifi Wi-Fi driver incorrectly parses SMEM for the 22000 series. If the firmware reports three LMACs (which do not exist in hardware), using fwrt->smem_cfg.lmac[2] causes an array overrun.

A vulnerability has been identified in the Linux kernel regarding the improper classification of data as interlaced plain extents. This issue occurs when data is not properly aligned to the block size, potentially leading to out-of-bounds read errors.

A vulnerability related to null pointer dereference in the __udp_enqueue_schedule_skb() function has been fixed in the Linux kernel. This issue was reported by syzbot and may lead to failures in the UDP socket initialization functions.

A bug in the Linux kernel's XFS filesystem causes incorrect freemap adjustments when adding extended attributes to leaf blocks. Misaligned freemap entries overlap with the entries array, triggering an assertion and forcing the filesystem to shut down.

In the Linux kernel XFS filesystem, xfs_attr_leaf_hasname() has a problematic calling convention: it returns NULL on read failure, a valid buffer on -ENOATTR or -EEXIST, and a pointer to an already released buffer on other errors. The fix open-codes the function in callers so each caller of xfs_attr3_leaf_read handles buffer release.

In the Linux kernel, the perf/arm-cmn driver accepted unknown CMN models and revisions even though the code assumes maximum supported sizes and counts. Newer, larger hardware could lead to array overflows and memory corruption.

In the Linux kernel, xfrm6_get_saddr() does not check the return value of ipv6_dev_get_saddr(). When no suitable source address is found (returns -EADDRNOTAVAIL), saddr->in6 remains uninitialized but the function still returns success, leading to use of an uninitialized address and a KMSAN warning.

A vulnerability in the Linux kernel related to bind attributes in sysfs for the reset device has been resolved. The issue allowed users to unbind the device, leading to a use-after-free error.

A vulnerability in the Linux kernel related to the missing encryption key size check upon receiving L2CAP_LE_CONN_REQ has been resolved.

A vulnerability was found in the Linux kernel's KVM implementation for nested SVM (nSVM). The VMLOAD/VMSAVE emulation for L2 guests incorrectly used vmcb02 instead of vmcb01, potentially causing incorrect virtual machine state.

In the Linux kernel, in ib_umem_dmabuf_get_pinned_with_dma_device(), a failure of ib_umem_dmabuf_map_pages() immediately unpinned the dmabuf while the pinned flag remained set, causing a double dma_buf_unpin() during umem release.

In the Linux kernel, card disconnect checkpoints were added to the ALSA OSS mixer layer. Because kcontrol operations are called individually, pending calls might not always be caught when disconnecting the device, potentially leading to use-after-free scenarios.

In the Linux kernel, the JFS filesystem has an nlink overflow during rename. When a directory's nlink is at maximum (-1), renaming a subdirectory causes a wrap to 0 and triggers a warning.

In the Linux kernel, in the NTFS3 filesystem, errors returned by attr_set_size() when truncating files are silently ignored, which can leave the inode in an inconsistent state.

In the Linux kernel, the ASoC SOF driver for IPC4 topology has a memory allocation bug for bytes controls. The allocation did not account for the control structure size, leading to insufficient memory.

A race condition in the Linux kernel's rpmsg subsystem in driver_override_show() was found. It reads the driver_override string without holding the device_lock, while the store function frees it under that lock, leading to a use-after-free.

HCL BigFix RunBookAI is affected by a vulnerability related to unvalidated command input, which could allow unauthorized command execution. A flaw in a component's input handling was identified.

Apache Wicket has a vulnerability that exposes sensitive information to unauthorized actors. This affects versions from 8.0.0 to 8.17.0, from 9.0.0 to 9.22.0, and from 10.0.0 to 10.8.0.