CVE Vulnerability Catalog

In the Linux kernel, the mt76 wifi driver (mt7615) acquires the mt76 mutex in mt7615_suspend() and then calls cancel_delayed_work_sync() on mac_work. Since mt7615_mac_work() also acquires the same mutex, if mac_work is already running and blocked on the mutex, the suspend path deadlocks.

In the Linux kernel, the mt76 wifi driver (mt7915) copies a fixed EFUSE block into dev->mt76.eeprom.data at the offset reported by the MCU (res->addr) in mt7915_mcu_get_eeprom() without checking it against the buffer size. A malicious or malfunctioning device can report an arbitrary address and drive a 16-byte out-of-bounds write past eeprom.data.

In the Linux kernel, the mt76 wifi driver (mt7925) queues mlo_pm_work with a 5 second delay during multi-link power-save setup and never cancels it on the stop path. If the device is torn down within that window, the work outlives the teardown and its timer fires afterwards, trying to queue onto a workqueue that is already gone.

In the Linux kernel, mt7996_mcu_get_eeprom() in the mt76 wifi driver (mt7996 chipset) derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response (event->addr) and clamps only the copy length, never the destination offset into dev->mt76.eeprom.data. A malicious or malfunctioning device can report an arbitrary address and drive an out-of-bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes past eeprom.data.

In the Linux kernel, mt7996/mt7992 hand the firmware a HW MAC-TXP for AddBA req action frames but are otherwise FW-TXP devices. On tx free, mt76_connac_txp_skb_unmap() decodes the per-frame txp as a struct mt76_connac_fw_txp, so the unmap loop runs zero times and the skb DMA mapping in buf[1] is never unmapped. Each AddBA req leaks one TX DMA mapping, exhausting the WED swiotlb pool after ~1-2 days under continuous client reconnect churn.

In the Linux kernel, the default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during variant validation or the fallback copy.

In the Linux kernel, virtio_vsock_remove() stops the virtqueues and flushes each work item before freeing the enclosing virtio_vsock, but the order does not account for dependencies: tx_work may queue send_pkt_work, and send_pkt_work may queue rx_work. In particular, send_pkt_work can set restart_rx and release tx_lock, and the remove path can flush rx_work before send_pkt_work queues it, leading to a use-after-free race with kfree(vsock).

In the Linux kernel, w1_f19_i2c_master_transfer(), the master_xfer for the DS28E17 1-Wire to I2C bridge, takes the length from the device on an I2C_M_RECV_LEN read. The driver reads that many bytes into buf[1], but the caller buffer is I2C_SMBUS_BLOCK_MAX + 2 (34 bytes), so a length above 32 makes the read run past it, up to about 222 bytes out of bounds. The SMBus core check runs after master_xfer returns, by which time the write is already done.

In the Linux kernel, i2c_nuvoton_wait_for_stat() in the tpm_i2c_nuvoton driver enables the IRQ before waiting for the interrupt handler to report a status change. If the wait times out or is interrupted before the handler runs, the function returns without balancing the enable_irq() call.

In the Linux kernel, the "cad_pid" sysctl entry is global and kill_cad_pid() is only used in the root namespace. However, due to pid_table_root_permissions(), a non-root user can unshare pid/user namespaces and modify it from the child namespace, which is wrong.

In the Linux kernel, smack_file_send_sigiotask() was accessing both tsk->cred and __task_cred(tsk). Accessing ->cred on a non-current task is forbidden because a task can change its own ->cred pointer without synchronization, leading to a use-after-free of struct cred.

In the Linux kernel, __do_adjtimex() did not check the return value of tk_get_aux_ts64. If the auxiliary clock is disabled during tk_get_aux_ts64() but enabled before tks->clock_valid is checked, uninitialized stack data is used in calculations and indirectly leaked to userspace.

A use-after-free vulnerability was fixed in the Linux kernel's ksmbd oplock break notification mechanism. The smb2_oplock_break_noti() function read the opinfo->conn pointer without locking and dereferenced it after sleeping allocations, allowing a race with durable handle teardown to access a freed connection. The flaw is reachable by any authenticated client holding a durable batch oplock.

A reflected cross-site scripting (XSS) vulnerability in the p.rfihub.com component of Zeta Marketing Platform (ZMP) v1.0 allows attackers to execute arbitrary JavaScript in the victim's browser by injecting a crafted URL into the ca parameter.

Out-of-bounds write vulnerability in Citrix Workspace app for Windows. This issue affects versions before 2603.11 Current Release (CR), before 2507.1 LTSR CU3, and before LTSR 2607.

Out-of-bounds read vulnerability in Citrix Workspace app for Windows. This issue affects versions before 2603.11 Current Release (CR), before 2507.1 LTSR CU3, and before LTSR 2607.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller (concrete/controllers/dialog/event/duplicate.php) submit() action, which duplicated a calendar event after checking only canAccess() and the per-resource canAddCalendarEvent() permission. A crafted cross-site request could cause an authenticated user with add-event permission to create duplicate CalendarEvents and CalendarEventVersions records.

AirSane versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation that allows a remote unauthenticated attacker to cause a Denial of Service (DoS) via memory exhaustion. The HttpServer::Request::content function reads the Content-Length header and passes it directly to std::string::resize() without upper-bound validation, causing allocation of gigabytes of memory and process crash. Additionally, non-numeric characters in the Content-Length header lead to undefined behavior.

GetSimple CMS (v3.4.0a and below) and GetSimple CMS CE (v3.3.22 and below) contain a logic flaw allowing unauthenticated attackers to create a new administrator account. The automated control that deletes admin/setup.php after installation is neutralized by a self-exclusion bug, leaving the setup script accessible. As of publication, no patched versions are available.