CVE Vulnerability Catalog

In the Linux kernel, the Verisilicon Rockchip AV1 driver does not reject frames exceeding tile capacity. The function rockchip_vpu981_av1_dec_set_tile_info() may read out of bounds and program hardware for more tiles than the buffer holds.

In the Linux kernel, v4l2-ctrls lacks validation of HEVC tile counts. Tile column and row counts are not bounded to array capacity, which can lead to out-of-bounds reads.

In the Linux kernel, std_validate_compound() did not bound the tile_cols and tile_rows fields for V4L2_CTRL_TYPE_AV1_FRAME controls. These values are used as loop bounds, array indices, and a divisor, and their product bounds per-tile descriptor buffers. Validation was added to reject values exceeding V4L2_AV1_MAX_TILE_COLS/_ROWS or whose product exceeds V4L2_AV1_MAX_TILE_COUNT.

In the Linux kernel, bnxt_rx_ring_reset() ignored the result of reallocating RX ring buffers. When bnxt_alloc_one_rx_ring() failed with -ENOMEM, some rxr->rx_tpa[] entries remained zeroed while TPA was re-enabled. The fix falls back to a global reset on allocation failure.

In the Linux kernel, the bnxt_en driver has an out-of-bounds write in bnxt_alloc_agg_idx. When firmware advertises fewer concurrent TPAs (e.g., 32) than the maximum, the TPA ID can exceed the size of the rx_tpa array, leading to invalid memory access and a kernel crash at boot.

In the Linux kernel SMB client, tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super() takes its active reference only after iterate_supers_type() has dropped s_umount and its passive reference. Concurrent DFS automount expiry can therefore free the superblock before cifs_sb_active() uses it, resulting in a use-after-free. The fix takes the active reference in the callback while iterate_supers_type() still holds s_umount shared.

In the Linux kernel's SMB client, there is a reference leak in cifs_queue_oplock_break() — the reference is always taken, but if the work is already queued, it is not released. The fix takes the reference only after successful queueing.

In the Linux kernel's SMB client, there is a heap overflow when rewriting DACL owner/group: the buffer is allocated based on the original DACL size, but SID substitution can enlarge each ACE, causing out-of-bounds write. The fix always allocates worst-case size considering maximum SID expansion.

In the Linux kernel, the _maxlevels_ondisk functions for rtrmap and rtrefcount in XFS fail to account for the inode root when computing the size of in-memory btree cursors. With a sufficiently large btree, this can lead to accessing beyond the end of the cursor.

In the Linux kernel, the scsi qla2xxx driver could trigger a use-after-free during queue teardown: free_irq() did not cancel work already queued on ha->wq, so qla_do_work() could access a freed qpair and response queue. The fix adds cancel_work_sync() after free_irq() and before freeing memory.

In the Linux kernel, the scsi qla2xxx driver could re-register a virtual port that was being deleted (VPORT_DELETE) during report ID acquisition, even though its d_id had already been zeroed. This left an entry in host_map and later caused a use-after-free after scsi_host_put().

In the Linux kernel, the qla_nvme_xmt_ls_rsp() function in the scsi: qla2xxx driver frees the uctx structure with kfree() on the error path without first removing it from the fcport->unsol_ctx_head list. This leaves a freed node on the list, so subsequent list_add_tail() and list_del() operations can corrupt the list or cause a kernel panic.

In the Linux kernel, the fcport->unsol_ctx_head list in the scsi: qla2xxx driver is modified from several contexts without a common lock. Concurrent add and delete operations (or two concurrent deletes) can corrupt the list pointers, since the qpair qp_lock cannot serialize this per-fcport list.

In the Linux kernel, the x86/mm/pat code allocated a page table directly when splitting a large page (__split_large_page()), bypassing the standard page table allocation API. As a result, the page table was never marked as a kernel page table (ptdesc_set_kernel() was not called), so freeing such page tables did not invalidate their IOTLB entries. This can leave stale IOTLB entries for kernel page tables.

In the Linux kernel, the MPTCP receive path can, under unlucky error conditions, recursively call mptcp_data_ready() via a state change and then try to hold the data lock again. The fix breaks this recursion by adding a new flag, exiting early in subflow_state_change(), and flushing the RX queue at reset time.

In the Linux kernel, the MPTCP scheduler may race with subflow socket state changes. Data transmission on the selected socket may fail, and a later release could use mss_now reset to 0 in a divide operation.

The Akia keyless entry cloud service is vulnerable to Insecure Direct Object Reference (IDOR) / missing object-level authorization. The unlock action relies on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could unlock rooms other than their own, resulting in unauthorized physical access to guest rooms at an affected property. As of 19th September 2026 the service is no longer vulnerable to this attack (feedback received by the reporter). The attack is remote but the effect is local to an affected property.

Apache Qpid Broker-J is vulnerable to a pre-authentication attack where type nesting can cause a StackOverflowError. This can potentially lead to denial of service.

A vulnerability in Apache Qpid Broker-J (through 10.1.0) allows a pre-authentication attacker to leverage type size/count handling to cause excessive allocation. This can lead to a potential denial of service.

A vulnerability in Apache Qpid Broker-J (through 10.1.0) allows a pre-authentication attacker to leverage type size/count handling to cause excessive allocation. This can lead to a potential denial of service.