CVE Vulnerability Catalog

In the Linux kernel, a race condition was found in the has_locked_children() function called by may_decode_fh() without holding locks. This can cause a system crash (oops). The fix renames the function to __has_locked_children() and adds a safe wrapper with locking.

W jądrze systemu Linux zidentyfikowano podatność, która mogła prowadzić do awarii podczas tworzenia danych reklamowych Bluetooth. Problem dotyczy funkcji eir_create_adv_data, która nie sprawdza, czy dodawane EIR_FLAGS i EIR_TX_POWER mieszczą się w dostępnej przestrzeni.

In the Linux kernel's ath11k driver, a vulnerability causes node corruption in the ar->arvifs list during WLAN recovery. Improper list reinitialization in ath11k_core_halt() leads to list inconsistency, triggering a kernel panic when an interface is removed concurrently.

In the ath12k WiFi driver in the Linux kernel, there is a use-after-free bug. After freeing skb, the code still accesses rxcb->is_continuation, which can lead to accessing already freed memory.

In the Linux kernel, a vulnerability in the ath12k driver causes WMI commands to be sent to the firmware during a crash, leading to a kernel call trace. The fix sets ATH12K_FLAG_CRASH_FLUSH and ATH12K_FLAG_RECOVERY flags upon crash notification to prevent command transmission during recovery.

In the ath12k WiFi driver in the Linux kernel, a bug was found causing node corruption in the ar->arvifs list during WLAN recovery. The ath12k_core_halt() function only reinitializes the list head, leaving invalid pointers in the next node, leading to a kernel panic when attempting to remove an interface.

W jądrze systemu Linux naprawiono podatność związaną z wywołaniem smp_processor_id() w jądrze z możliwością preempcji. Zastosowano raw_smp_processor_id() w celu poprawienia śladu wywołania, co zapobiega generowaniu błędów w przypadku, gdy preempcja jest włączona.

In the Linux kernel's InfiniBand CM subsystem, cm_free_priv_msg() was reused in a context where the cm_id lock is not needed, causing false lockdep asserts and WARNs when freeing an old message.

In the Linux kernel's hisi_acc_vfio_pci driver, a bug in live migration for VMs without a loaded VF driver leads to NULL pointer access when migrating device data.

In the Linux kernel's octeontx2-pf driver, the TC_HTB_LEAF_DEL_LAST callback for QoS was refactored to fix issues with stopping traffic before queue reassignment and warnings during system reboot.

In the Linux kernel's fs/dax subsystem, a bug in wait_entry_unlocked_exclusive() causes the current entry to be skipped after calling xas_pause(), leading to missed locked entries during scanning. This triggers a warning in truncate_folio_batch_exceptionals() and potential data inconsistency.

In the Linux kernel's TIPC stack, a refcount warning in tipc_aead_encrypt occurs when get_net() is called on a network namespace being destroyed (refcount=0), potentially leading to use-after-free.

In the Linux kernel's netdevsim driver, a bug causes napi_complete() to be called from netpoll context when NAPI is not scheduled, triggering a warning in napi_complete_done().

Clerk, narzędzie wspierające zarządzanie użytkownikami, ma problem z weryfikacją podpisów webhooków. Aplikacje korzystające z funkcji verifyWebhook() mogą akceptować nieprawidłowo podpisane zdarzenia webhooków.

Zimbra Collaboration (ZCS) przed wersją 9.0.0 Patch 46, 10.0.x przed 10.0.15 oraz 10.1.x przed 10.1.9 jest podatna na atak typu denial of service z powodu niewłaściwego przetwarzania nadmiarowych segmentów ścieżki oddzielonych przecinkami w Konsoli Administracyjnej. Nieautoryzowany zdalny atakujący może wysłać specjalnie przygotowane żądania GET, które powodują nadmiarowe przetwarzanie i zwiększone odpowiedzi.

In the uartlite serial driver in the Linux kernel, there is a race condition during UART driver registration. If two devices are probed simultaneously, a null pointer dereference and kernel panic can occur.

In the Linux kernel for RISC-V architecture, a vulnerability was found where the SR_SUM status bit is not saved and restored during thread context switches. This causes sleeping functions called in user-access sections to clear SR_SUM, leading to kernel panics.

In the Linux kernel's s390/pkey module, there is a missing overflow check in size calculation for memdup_user(). The number of APQN target list entries comes from user space and can cause an overflow during multiplication.

In the Linux kernel's HID Wacom driver, wacom_aes_battery_handler() is scheduled as delayed work but not canceled on device removal, leading to hard crashes or 'general protection fault' after device disconnect.

In the Linux CXL RAS driver, cxl_cper_handle_prot_err() incorrectly assumes PCIe endpoint devices are CXL type 3 and bound to the cxl_pci driver. This can cause crashes when handling CPER error records.