CVE Vulnerability Catalog

A vulnerability in the Linux kernel netfilter ctnetlink module fails to validate the helper for new expectations, allowing an attacker to supply an arbitrary helper from userspace, leading to a slab-out-of-bounds read and potential kernel memory leak.

A use-after-free vulnerability exists in the Linux kernel's sco_sock_connect() function (Bluetooth SCO). Missing socket lock during sk_state and sk_type checks allows two concurrent connect() calls on the same socket to both pass validation, leading to double sock_put() and use-after-free.

In the Linux kernel Bluetooth MGMT, loading Long Term Keys stores the user-provided enc_size and later uses it to size fixed-size stack operations when replying to LE LTK requests. An enc_size larger than the 16-byte key buffer can overflow the reply stack buffer. The fix rejects oversized enc_size values during management LTK record validation.

A vulnerability has been identified and resolved in the Linux kernel. It concerns a potential use-after-free (UAF) in the set_cig_params_sync function related to Bluetooth connections.

In the Linux kernel Bluetooth subsystem, hci_le_remote_conn_param_req_evt() looks up and accesses the hci_conn structure without hdev lock protection, which can lead to a use-after-free. The fix extends the hci_dev_lock critical section to cover all connection usage.

A use-after-free vulnerability exists in the Linux kernel's sk_psock_verdict_data_ready() function within the BPF sockmap subsystem. When unix_stream_sendmsg() invokes the peer socket's data_ready callback, the peer's sk->sk_socket may be freed after an RCU grace period before being accessed, resulting in a read of freed memory.

In the Linux kernel, a vulnerability was found in the BPF verifier related to incorrect path pruning due to precision tracking for atomic fetch operations (BPF_ATOMIC with BPF_FETCH). The backtracking logic did not account for the source register also being the destination, leading to missing precision marks on stack slots. This could cause the verifier to incorrectly consider two states equivalent and prune one branch, potentially allowing unsafe BPF programs.

A vulnerability has been identified in the Linux kernel that allows the import of a zero-length buffer, leading to out-of-bounds memory reads. This issue occurs in the validate_fixed_range() function, where the lack of proper buffer length checking results in incorrect offset calculations.

A vulnerability related to array access in the hwmon module for the tps53679 chip has been fixed in the Linux kernel. The issue occurred when the i2c_smbus_read_block_data() function returned 0, leading to out-of-bounds read on the stack.

An issue was discovered in the VRML V2.0 parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 that allows attackers to cause a denial of service via a crafted VRML file. The issue occurs because malformed VRML input can trigger dereference of a corrupt or unvalidated pointer during shape construction.

CVE-2026-42477 describes a heap-based out-of-bounds read vulnerability in the RWObj_Reader::read function in the OBJ file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5. This vulnerability can be exploited by user-assisted attackers persuading a victim to open a crafted OBJ file, potentially leading to denial of service or exposure of sensitive information.

Two heap-based out-of-bounds read vulnerabilities exist in the STL ASCII file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5. These issues arise from improper length validation of buffers before data access, potentially leading to denial of service or information disclosure.

A vulnerability in the Linux kernel related to the container_of operation in the intel_pmu_hw_config function has been fixed. The issue could lead to out-of-bounds memory reads when software events are present in a group of events.

In the Linux kernel wifi iwlwifi (mvm) driver, iwl_mvm_nd_match_info_handler() uses memcpy assuming the dynamic array notif->matches is at least as large as the number of bytes to copy. Insufficient packet length validation can cause an out-of-bounds read and place unwanted data into results->matches.

In the Linux kernel ALSA caiaq driver, init_card has an off-by-one error when creating a whitespace-stripped copy of the card shortname. The check len < sizeof(card->id) allows writing 16 characters without a null terminator, so a later snd_card_set_id() reads past the stack buffer. This triggers a KASAN stack-out-of-bounds on a USB device whose product name contains many multibyte characters.

In the Linux kernel ALSA ctxfi driver, daio_device_index() does not properly handle the SPDIF1 DAIO type for hw20k2 and returns -EINVAL, resulting in an out-of-bounds array access. The fix follows the hw20k1 pattern and returns the proper index for this type.

In the Linux kernel, io_bundle_nbufs() in io_uring/net suffers from a slab-out-of-bounds read. The __u32 value sqe->len is stored into the int field sr->len, so values exceeding INT_MAX (e.g. 0xFFFFFFFF) overflow to a negative value, causing an infinite loop and reads past the allocated iov[] array. The fix rejects negative sr->len values early in io_sendmsg_prep() and io_recvmsg_prep().

In the Linux kernel, the legacy responder path in smp_random() labeled the stored STK as authenticated whenever pending_sec_level was BT_SECURITY_HIGH, regardless of the actual pairing outcome. For Just Works/Confirm legacy pairing the STK should remain unauthenticated, so the fix uses the established MITM state when storing the responder key.

In the Linux kernel, hci_le_big_create_sync() uses DEFINE_FLEX to allocate room for 17 BIS entries, while conn->num_bis can hold up to 31 (HCI_MAX_ISO_BIS). When num_bis is between 18 and 31, the memcpy writes up to 14 bytes past the stack buffer, causing a stack overflow.

In the Linux kernel, a vulnerability exists in the Bluetooth hci_event module where hci_store_wake_reason() is called before the per-event minimum payload length check from hci_ev_table is enforced. A short HCI event frame can reach bacpy() before any bounds check runs. The fix moves wake-address storage into individual event handlers after their existing event-length validation has succeeded.