CVE Vulnerability Catalog

In the Linux kernel bonding driver, a NULL pointer dereference vulnerability was found in bond_debug_rlb_hash_show. The function iterates over RLB hash table entries without checking if the slave field is NULL, potentially causing a system crash.

Podatność CVE-2026-5265 dotyczy błędu w obsłudze odpowiedzi ICMP 'Destination Unreachable' lub 'Packet Too Big', gdzie nieprawidłowo kopiowane są dane z oryginalnego pakietu do ciała błędu ICMP. Problem wynika z braku walidacji długości pakietu w stosunku do rzeczywistego rozmiaru bufora pakietu.

A type confusion flaw was found in libxml2 when processing a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker can exploit this by providing a malicious document, causing the application to crash.

SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoose_multipart.c that allows unauthenticated attackers to cause a denial of service by sending a crafted HTTP POST request to /upload with a malformed multipart boundary and controlled TCP stream timing. Attackers can trigger an integer underflow in the mg_http_multipart_continue_wait_for_chunk() function when the buffer length falls within a specific range, causing an out-of-bounds heap read past the allocated receive buffer to a local IPC socket.

Moduł @node-oauth/oauth2-server w Node.js ma lukę, która pozwala na akceptację nieprawidłowych wartości code_verifier zgodnych z RFC7636, w tym jednoczłonowych ciągów, w przepływach S256 PKCE. To umożliwia atakującym przeprowadzanie ataków brute-force na code_verifier po przechwyceniu kodu autoryzacyjnego.

SSRF vulnerability in ntfy before version 2.22.0 due to an unanchored regular expression for web push endpoint URLs. This allows an attacker to send requests to internal network resources.

Multiple uses of uninitialized variables were found in libopensc, potentially leading to information disclosure or application crash. The attack requires a crafted USB device or smart card that presents specially crafted APDU responses.

A vulnerability in Libgcrypt before version 1.12.2 allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext passed to gcry_pk_decrypt.

IBM Guardium Key Lifecycle Manager versions 4.1, 4.1.1, 4.2, 4.2.1, 5.0, and 5.1 enables privilege escalation, allowing unauthorized users to perform administrative operations after being demoted. Attackers could access sensitive data, modify system configurations, or change permissions for other users.

Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page to access the exposed root_path value rendered in the HTML response.

A vulnerability in the Linux kernel's module loader lacks bounds checking for the ELF section index in simplify_symbols(). An out-of-bounds st_shndx value (e.g., 0xffff) can cause a kernel panic due to invalid memory access.

A vulnerability was found in the Linux kernel's ESP over TCP (espintcp) implementation with async crypto. When the transmit queue is full, esp_output_tail_tcp returns an error but does not free the skb buffer, causing a memory leak. With synchronous crypto, the issue does not occur because the xfrm code drops the packet automatically.

In the Linux kernel, the af_key module's pfkey_send_migrate() function fails to validate address families (old/new), causing a skb buffer overflow (skb_over_panic) and system crash. The issue was reported by syzbot.

A vulnerability in the Linux kernel's UDP implementation causes wildcard bind conflict checks to be skipped when the hash bucket count exceeds 10. The issue occurs because the code switches to the hash2 table (keyed by address and port) instead of the hash table (keyed by port only), allowing a wildcard bind to succeed despite existing specific-address binds on the same port.

In the Linux kernel, a vulnerability in the netfilter module allowed displaying connection expectations from other network namespaces via the /proc interface. The fix adds filtering to skip expectations not belonging to the current netns.

In the Linux kernel netfilter subsystem, a vulnerability in ctnetlink allowed accepting invalid values for TCP protocol attributes, potentially causing undefined behavior when used as shift counts. The fix replaces manual range and mask validations with netlink policy annotations, rejecting invalid values early.

In the Linux kernel, a vulnerability was found in softleaf_to_folio() in mm/huge_memory.c. Missing memory barrier (smp_rmb) causes a race condition between folio splitting and zap_nonpresent_ptes(), leading to VM_WARN_ON_ONCE or BUG_ON.

W jądrze Linuxa zidentyfikowano podatność, która pozwala na dereferencję wskaźnika NULL w przypadku, gdy użytkownik z uprawnieniami ustawi nr_contexts na 0 podczas działania DAMON. Problem występuje, gdy nie sprawdzono, czy kdamond->contexts->nr == 1 przed dostępem do contexts_arr[0].

W jądrze Linuxa zidentyfikowano podatność, która została rozwiązana. Funkcja damon_sysfs_repeat_call_fn() wywołuje inne funkcje bez sprawdzenia wartości contexts->nr, co może prowadzić do dereferencji wskaźnika NULL, jeśli nr_contexts jest ustawione na 0.

A vulnerability has been identified in the Linux kernel that occurs during the splitting of a PUD entry in the walk_pud_range() function. It may lead to a kernel bug when a thread attempts to read the numa_maps of a process while VFIO-PCI is setting up DMA.