CVE Vulnerability Catalog

Podatność związana z użyciem twardo zakodowanych poświadczeń w monitorze systemu fotowoltaicznego Mitsubishi Electric 'EcoGuideTAB' PV-DR004J oraz PV-DR004JA pozwala atakującemu w zasięgu komunikacji Wi-Fi na ujawnienie informacji, manipulację danymi lub wywołanie stanu Denial-of-Service (DoS). Problem wynika z wykorzystania twardo zakodowanego identyfikatora użytkownika i hasła, które można uzyskać poprzez CVE-2025-5022.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's ftrace mechanism. When a kernel module triggers an error that disables ftrace (ftrace_disable) and is then removed, the ftrace module list entry remains but the module memory is already freed. Reading /proc/kallsyms after such event accesses freed memory and causes a system crash.

In the mt76 (mt7996) WiFi driver in the Linux kernel, fragments with multicast or broadcast RA are not dropped. According to IEEE 802.11, fragmentation applies only to unicast frames.

In the Linux kernel's software node, an out-of-bounds (OOB) check bug in software_node_get_reference_args() can cause out-of-bounds read for maliciously crafted properties.

In the fbnic network driver in the Linux kernel, there is a double-free vulnerability when DMA-mapping of a firmware message fails. The fbnic_mbx_map_msg() function does not take ownership of the message on error.

In the Linux kernel for PowerPC, a bug was found in the JIT code size calculation of the BPF trampoline. The arch_bpf_trampoline_size() function may return a smaller size than actually needed because the instruction count depends on the image location. This leads to a warning and potential buffer overflow during JIT compilation.

In the Linux kernel's F2FS filesystem, an inconsistency between the free segment map and free section map was detected. The get_new_segment() function should record the error in the superblock and bail out instead of continuing.

In the Cortina (gemini) network driver in the Linux kernel, the TOE/TSO accelerator is not used for all TCP packets. Without this, the driver becomes unstable and may lock up.

In the Linux kernel's CIFS/SMB client, error logging was added when close_all_cached_dirs() fails due to low memory, which previously caused a "Dentry still in use" error during unmount.

In the ath12k wifi driver in the Linux kernel, a buffer overflow in debugfs was found. Writing more than 32 bytes causes memory corruption. The vulnerability is limited to root users.

In the Linux virtio-pci driver, virtio_pci_admin_dev_parts_get() returns a result size 8 bytes too large because it includes extra status bytes from virtqueue_get_buf(). This causes errors during live migration and potential out-of-bounds reads.

In the Linux kernel, a race condition was found in the has_locked_children() function called by may_decode_fh() without holding locks. This can cause a system crash (oops). The fix renames the function to __has_locked_children() and adds a safe wrapper with locking.

W jądrze systemu Linux zidentyfikowano podatność, która mogła prowadzić do awarii podczas tworzenia danych reklamowych Bluetooth. Problem dotyczy funkcji eir_create_adv_data, która nie sprawdza, czy dodawane EIR_FLAGS i EIR_TX_POWER mieszczą się w dostępnej przestrzeni.

In the Linux kernel's ath11k driver, a vulnerability causes node corruption in the ar->arvifs list during WLAN recovery. Improper list reinitialization in ath11k_core_halt() leads to list inconsistency, triggering a kernel panic when an interface is removed concurrently.

In the ath12k WiFi driver in the Linux kernel, there is a use-after-free bug. After freeing skb, the code still accesses rxcb->is_continuation, which can lead to accessing already freed memory.

In the Linux kernel, a vulnerability in the ath12k driver causes WMI commands to be sent to the firmware during a crash, leading to a kernel call trace. The fix sets ATH12K_FLAG_CRASH_FLUSH and ATH12K_FLAG_RECOVERY flags upon crash notification to prevent command transmission during recovery.

In the ath12k WiFi driver in the Linux kernel, a bug was found causing node corruption in the ar->arvifs list during WLAN recovery. The ath12k_core_halt() function only reinitializes the list head, leaving invalid pointers in the next node, leading to a kernel panic when attempting to remove an interface.

W jądrze systemu Linux naprawiono podatność związaną z wywołaniem smp_processor_id() w jądrze z możliwością preempcji. Zastosowano raw_smp_processor_id() w celu poprawienia śladu wywołania, co zapobiega generowaniu błędów w przypadku, gdy preempcja jest włączona.

In the Linux kernel's InfiniBand CM subsystem, cm_free_priv_msg() was reused in a context where the cm_id lock is not needed, causing false lockdep asserts and WARNs when freeing an old message.

In the Linux kernel's hisi_acc_vfio_pci driver, a bug in live migration for VMs without a loaded VF driver leads to NULL pointer access when migrating device data.