CVE Vulnerability Catalog

A vulnerability in the Linux kernel allows integer overflow in the geneve_opt structure. An attacker can use a 128-byte option to fake a zero-length option, leading to a heap out-of-bounds read.

In the Linux kernel for LoongArch architecture, ARCH_DMA_MINALIGN defaults to 1, but some devices (e.g., APBDMA) require 16-byte alignment. Small DMA buffers can cause hardware cacheline write errors.

In the Linux kernel on LoongArch architecture in the BPF subsystem, there is a bug that overrides the return value of a subprogram. During bpf2bpf calls, the return value is incorrectly moved from register a0 to a5, which can cause a kernel panic.

In the Linux kernel in the x86/microcode/AMD subsystem, there is a bug in the __apply_microcode_amd() function. When verify_sha256_digest() fails, the function returns -1 instead of false, which is interpreted as success.

In the Linux kernel on x86, flush_tlb_range() can be used to zap PMD entries (pointers to page tables) along with corresponding PTE entries. The current implementation does not handle this case, potentially leading to incorrect TLB invalidation, especially concerning lazy TLB CPUs.

In the Linux kernel ACPI NFIT driver, acpi_nfit_ctl() incorrectly converts call_pkg->nd_family from u64 to int before range checking. This can bypass validation when the upper 32 bits are non-zero and lower 32 bits are zero, leading to an invalid argument.

In the Linux kernel in the ksmbd (SMB server) subsystem, there is a missing bounds check for the durable handle context.

In the Linux kernel in the ksmbd (SMB server) subsystem, there is a missing bounds check for the create lease context.

W jądrze Linuxa naprawiono podatność związaną z użyciem po zwolnieniu (UAF) w funkcji ksmbd_sessions_deregister(). Problem ten występuje w trybie wielokanałowym, gdy drugi kanał nawiązuje sesję przez połączenie pierwszego kanału, co może prowadzić do ponownego dostępu do zwolnionej sesji.

W jądrze Linuxa naprawiono podatność związaną z użyciem po zwolnieniu sesji w połączeniu wielokanałowym. Występowała warunkowość wyścigu między konfiguracją sesji a deregistracją sesji ksmbd, co mogło prowadzić do zwolnienia sesji przed dodaniem połączenia do listy kanałów sesji.

In the Linux kernel, a vulnerability was found in the ksmbd filesystem related to an overflow in the dacloffset bounds check. The field was typed as int and used in an unchecked addition, which could overflow and bypass existing bounds checks, leading to out-of-bounds memory access and a kernel crash when dereferencing the DACL pointer.

In the Linux kernel, a vulnerability was found in the ksmbd filesystem due to an out-of-bounds read when accessing sub_auth with zero num_subauth. Lack of validation before reading psid->sub_auth[psid->num_subauth - 1] leads to an out-of-bounds read.

In the Linux kernel, in ksmbd, there is a null pointer dereference in alloc_preauth_hash(). The client sends a malformed SMB2 negotiate request, ksmbd returns an error, but the client can then send an SMB2 session setup even though conn->preauth_info is not allocated. The patch adds the KSMBD_SESS_NEED_SETUP connection status to ignore session setup requests if the SMB2 negotiate phase is not complete.

In the exfat filesystem in the Linux kernel, a bug causes random stack corruption. When get_block is called with a stack-allocated buffer (e.g., in do_mpage_readpage), a use-after-free (UAF) of the buffer can occur in a race condition, leading to stack corruption.

A vulnerability in the Linux kernel's device-exclusive entry handling for HugeTLB and THP pages was found. The bug prevents proper migration, swapping, and splitting of pages marked as device-exclusive, causing memory to become pinned and migration failures.

In the Linux kernel's NFS server (nfsd), a memory leak of nfs4_stid objects was discovered. The issue occurs when nfsd4_run_cb fails to queue the dl_recall work to the callback_wq, after the reference count of dl_stid was incremented. On failure, the count is not decremented, leading to a permanent memory leak.

In the Linux kernel, the JFS filesystem has added a read-only check before truncation in the jfs_truncate_nolock function. This is to avoid errors related to writing to a read-only filesystem.

In the Linux kernel PCI/ASPM subsystem, a use-after-free vulnerability occurs during PCIe switch function removal. The ASPM link state is freed either too early (on any function removal) or too late (after last function removal), causing memory corruption.

In the Linux kernel, the ntb_hw_switchtec driver has a vulnerability causing a shift-out-of-bounds. The function ntb_mw_clear_trans() passes 0 for both address and size, leading to a negative xlate_pos.

Podatność CVE-2025-39592 dotyczy niewłaściwej kontroli nazw plików w instrukcjach include/require w programie PHP, co prowadzi do lokalnego włączenia plików w wtyczce WP Shuffle Subscribe to Unlock Lite w wersjach do 1.3.0. Problem ten może umożliwić atakującym dostęp do lokalnych plików na serwerze.