CVE Vulnerability Catalog

In the Linux kernel, in tcp_check_req() in the SYN-RECEIVED state, a non-exact RST (not matching RCV.NXT) is accepted and removes the request instead of triggering a challenge ACK as per RFC 9293. The fix adds the RFC 5961 reset check before ACK-field validation to enforce challenge ACK for non-exact RSTs.

In the Linux kernel, a vulnerability in the VXLAN module causes corruption of the MDB source list during a failed replace operation. Due to improper error handling, existing source entries are deleted, leading to incorrect behavior of EXCLUDE and INCLUDE filters, causing unauthorized traffic or blocking of legitimate traffic.

In the Linux kernel, the amdgpu driver (VCE) fixed an integer overflow in image size calculation. Malicious VCE command streams with oversized dimensions (e.g., 65536×65536) caused the buffer size to wrap to 0, bypassing validation and allowing out-of-bounds memory access by GPU firmware. The fix uses 64-bit arithmetic and rejects invalid dimensions.

In the Linux kernel, the amdgpu driver (VCN4) avoids rereading the IB parameter length. Instead, it uses the value returned by vcn_v4_0_enc_find_ib_param(), eliminating a potential TOCTOU issue if the IB contents change between reads.

In the Linux kernel, the amdgpu driver fixed a division by zero with invalid UVD dimensions. When width or height is less than 16, width_in_mb or height_in_mb becomes 0, leading to division by zero in H264 and H264 Perf decode paths. Added validation to reject frames with dimensions smaller than 16.

In the Linux kernel, the amdgpu driver fixed a memory management issue: before freeing acp_genpd memory, pm_genpd_remove() is called to unregister from the global list, and the pointer is cleared after free.

In the Linux kernel, the amdgpu driver fixed an issue with doorbell mapping. Previously, xa_store_irq() allowed a newly created queue to overwrite an existing doorbell mapping, potentially causing misrouting of fence IRQ processing or erasing another queue's mapping. The fix uses xa_insert_irq(), which rejects mapping a reserved doorbell to a new queue.

In the Linux kernel, the ksmbd (SMB server) module has a vulnerability due to missing validation of the num_subauth field when copying ACE entries in the set_ntacl_dacl function. A malicious authenticated client can send a crafted security descriptor with an invalid num_subauth value, leading to an out-of-bounds heap read of approximately 1 KB.

In the Linux kernel, ksmbd has an issue with bounding the DACL dedup walk to copied ACEs. When copying ACEs stops early due to size overflow, the number of ACEs reflects only copied ones, but set_posix_acl_entries_dacl() still uses the original count, leading to scanning beyond the copied array.

In the Linux kernel, ksmbd has an issue with validating ACE size against SID sub-authorities. set_ntacl_dacl() does not verify that the declared ACE size contains all sub-authorities, leading to copying undersized ACEs and later out-of-bounds reads during deduplication.

A deadlock was found in the Linux kernel audit subsystem when duplicating executable-related rules. The issue occurs during file rename operations when an active audit rule matches the moved file — audit_dupe_exe() attempts to re-acquire the parent directory lock (I_MUTEX_PARENT) already held by the rename operation, causing a recursive locking deadlock. The patch introduces struct audit_watch_ctx to pass the fsnotify event context and avoid redundant path resolution.

Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role.

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution.

Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data. This issue affects WAH7601 through 20072026.

In the Linux kernel, the Wacom HID driver has an issue where after starting HID hardware, but before registering input devices and initializing LEDs, failures can occur. In such cases, driver resources are released without stopping the HID hardware, potentially leading to an incorrect state. The fix routes post-start failures through hid_hw_stop() before releasing resources.

In the Linux kernel, the Bluetooth hci_uart driver did not clear the HCI_UART_SENDING bit when canceling write_work, which blocked future writes after reopening the device. The fix clears this bit and safely cancels the work using disable_work_sync and enable_work.

A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar.

A server-side request forgery (SSRF) vulnerability in Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted image_url value in the PATCH /apis/web/v1/album/{id}/image endpoint.

A missing authentication vulnerability in FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQ_QUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events (DEVICE_BROWSE, HOST_INTERFACES, DEVICE_TAGS_REQUEST, etc.) call isSocketAdminAuthorized to verify the connection token, but the DAQ_QUERY handler in server/runtime/index.js lacks this check entirely.

A time-of-check/time-of-use (TOCTOU) race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes.