CVE Vulnerability Catalog

W jądrze systemu Linux zidentyfikowano podatność, która prowadzi do uszkodzenia stanu licznika nfeeds w przypadku niepowodzenia funkcji start_streaming. W wyniku tego, kolejne wywołania start_feed mogą nieprawidłowo pomijać uruchamianie mux, co prowadzi do wycieków pamięci.

W jądrze systemu Linux zidentyfikowano podatność związana z dereferencją NULL w i_assoc_inode w funkcji nilfs_mdt_save_to_shadow_map. Problem występuje, gdy NILFS_IOCTL_CLEAN_SEGMENTS jest wywoływane przed jakąkolwiek operacją btree na inode DAT, co prowadzi do błędu ochrony ogólnej.

A deadlock vulnerability was found in the Linux kernel's RDMA/irdma driver during netdev reset with active RDMA connections. The netdev reset triggers removal of the irdma auxiliary driver, causing a circular dependency where uverbs_client waits for QP reference count to reach zero while cma_client holds the final reference, leading to an indefinite wait in iWARP mode.

W jądrze Linuxa naprawiono podatność związaną z błędnym logowaniem błędów w module spi-dw-dma. W przypadku wystąpienia błędu, urządzenie może nie mieć aktualnej wiadomości, co może prowadzić do awarii systemu.

In the Linux kernel, a bug in futex_lock_pi() was found where the local pointer to an exiting thread was not cleared on retry. This caused a WARN_ON_ONCE() when a stale pointer was passed to wait_for_owner_exiting().

In the Linux kernel bonding driver, a NULL pointer dereference vulnerability was found in bond_debug_rlb_hash_show. The function iterates over RLB hash table entries without checking if the slave field is NULL, potentially causing a system crash.

Podatność CVE-2026-5265 dotyczy błędu w obsłudze odpowiedzi ICMP 'Destination Unreachable' lub 'Packet Too Big', gdzie nieprawidłowo kopiowane są dane z oryginalnego pakietu do ciała błędu ICMP. Problem wynika z braku walidacji długości pakietu w stosunku do rzeczywistego rozmiaru bufora pakietu.

A type confusion flaw was found in libxml2 when processing a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker can exploit this by providing a malicious document, causing the application to crash.

SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoose_multipart.c that allows unauthenticated attackers to cause a denial of service by sending a crafted HTTP POST request to /upload with a malformed multipart boundary and controlled TCP stream timing. Attackers can trigger an integer underflow in the mg_http_multipart_continue_wait_for_chunk() function when the buffer length falls within a specific range, causing an out-of-bounds heap read past the allocated receive buffer to a local IPC socket.

Moduł @node-oauth/oauth2-server w Node.js ma lukę, która pozwala na akceptację nieprawidłowych wartości code_verifier zgodnych z RFC7636, w tym jednoczłonowych ciągów, w przepływach S256 PKCE. To umożliwia atakującym przeprowadzanie ataków brute-force na code_verifier po przechwyceniu kodu autoryzacyjnego.

SSRF vulnerability in ntfy before version 2.22.0 due to an unanchored regular expression for web push endpoint URLs. This allows an attacker to send requests to internal network resources.

Multiple uses of uninitialized variables were found in libopensc, potentially leading to information disclosure or application crash. The attack requires a crafted USB device or smart card that presents specially crafted APDU responses.

A vulnerability in Libgcrypt before version 1.12.2 allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext passed to gcry_pk_decrypt.

IBM Guardium Key Lifecycle Manager versions 4.1, 4.1.1, 4.2, 4.2.1, 5.0, and 5.1 enables privilege escalation, allowing unauthorized users to perform administrative operations after being demoted. Attackers could access sensitive data, modify system configurations, or change permissions for other users.

Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page to access the exposed root_path value rendered in the HTML response.

A vulnerability in the Linux kernel's module loader lacks bounds checking for the ELF section index in simplify_symbols(). An out-of-bounds st_shndx value (e.g., 0xffff) can cause a kernel panic due to invalid memory access.

A vulnerability was found in the Linux kernel's ESP over TCP (espintcp) implementation with async crypto. When the transmit queue is full, esp_output_tail_tcp returns an error but does not free the skb buffer, causing a memory leak. With synchronous crypto, the issue does not occur because the xfrm code drops the packet automatically.

In the Linux kernel, the af_key module's pfkey_send_migrate() function fails to validate address families (old/new), causing a skb buffer overflow (skb_over_panic) and system crash. The issue was reported by syzbot.

A vulnerability in the Linux kernel's UDP implementation causes wildcard bind conflict checks to be skipped when the hash bucket count exceeds 10. The issue occurs because the code switches to the hash2 table (keyed by address and port) instead of the hash table (keyed by port only), allowing a wildcard bind to succeed despite existing specific-address binds on the same port.

In the Linux kernel, a vulnerability in the netfilter module allowed displaying connection expectations from other network namespaces via the /proc interface. The fix adds filtering to skip expectations not belonging to the current netns.