CVE Vulnerability Catalog

An integer overflow exists in the Linux kernel's ACPICA function acpi_ex_opcode_3A_1T_1R() (mid_op). Missing overflow check for Index + Length can result in a negative size being passed to memcpy().

In the Linux kernel, ACPICA lacks validation of handler object type in acpi_ev_has_default_handler() and acpi_ev_find_region_handler(). This may allow improper operations on handler objects.

In the Linux kernel, ACPICA lacks validation for node in acpi_ns_build_normalized_path(). This may lead to use-after-free vulnerabilities.

In the Linux kernel, a vulnerability in ACPICA was fixed by enhancing buffer validation in acpi_ut_walk_aml_resources(). Insufficient checks could lead to buffer overflows.

In the Linux kernel, a vulnerability in ACPICA was fixed by adding boundary checks in acpi_ps_get_next_namestring() and acpi_ps_peek_opcode(). Missing checks could lead to out-of-bounds access.

In the Linux kernel, a vulnerability in the ath11k wifi driver was fixed where in certain cases hardware could provide packets with a length greater than the maximum native Wi-Fi header length. This could lead to invalid data access and memory corruption in ath11k_dp_rx_h_undecap_nwifi().

A vulnerability was found in the Linux kernel's fs/ntfs3 module due to missing validation of index entry key bounds. A malformed NTFS directory index entry can advertise a key_size larger than the bytes actually present in its payload, causing an out-of-bounds read in cmp_fnames().

In the Linux kernel, a vulnerability in ntfs3 was fixed involving out-of-bounds read in ntfs_dir_emit() and hdr_find_e(). The bounds check in ntfs_dir_emit() did not account for UTF-16LE encoding (2 bytes per character) or the ATTR_FILE_NAME header size, allowing reads past the entry boundary.

In the Linux kernel, the NVMe driver lacks validation of descriptor sizes while walking the FDP configurations log. A descriptor with dsze == 0 or one past the log end can cause unbounded iteration or reads past the buffer.

In the Linux kernel, the drm/amdkfd driver's wait_on_destroy_queue() drops locks to wait for queue resume, allowing a concurrent destroy to free the queue and cause a use-after-free (UAF).

In the Linux kernel, the drm/amdgpu driver's FRU PIA parsing uses an open-coded TLV walk without read bounds. Replacing it with fru_pia_advance() and fru_pia_copy_field() helpers bounds every read by the actual EEPROM data length.

In the Linux kernel, the ib_umem_find_best_pgsz() function has boundary condition issues, especially on 32-bit architectures. The iova value may be truncated, and lengths greater than 4GB can overflow. The fix uses proper u64 arguments and adds necessary checks.

In the Linux kernel, the netfilter nf_conntrack module has an alignment issue in the tcp_sack() function. The timestamp-only fast path dereferences the option stream as a __be32 value, assuming 4-byte alignment that TCP options do not guarantee. Using get_unaligned_be32() is safer.

In the Linux kernel, the btrfs tree-checker did not validate names in ROOT_REF and ROOT_BACKREF items. A corrupted item could cause readers to use the on-disk name length directly, leading to out-of-bounds reads and copying too many bytes into the UAPI buffer in BTRFS_IOC_GET_SUBVOL_INFO. Validation was added in tree-checker and the copy length was limited to the validated name length.

In the Linux kernel, a bug was fixed in the nvme-fc driver where an NVMe-FC controller in CONNECTING state could abort I/O requests before the I/O tagset was initialized. This led to a lockdep warning about improper lock usage and potential stability issues during error recovery after connectivity loss.

A vulnerability in Anagnorisis (up to 0.3.1/0.4.0) in the Socket.IO Connect Interface component (app.py) causes missing authentication. The attack can be launched remotely, and the exploit is public. The vendor did not respond.

In authentik before 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an installation using SAML in either the identity-provider or SAML source role. The message can stop the worker handling /application/saml/* or /source/saml/*, causing assigned requests to fail. Continued malicious messages can cause a sustained share of legitimate traffic to fail. Other protocols are not affected.

In authentik before 2026.2.7, 2026.5.7, and 2026.8.2, a SAML Source verifies an assertion's signature and validity period but does not ensure that the identity provider issued the assertion for that Source or in response to a login request from that Source. It also does not record already accepted assertions, allowing replay. An unauthenticated actor possessing a valid assertion can use it to authenticate as the user named in the assertion. Only SAML Sources are affected.

In authentik before 2026.2.7, 2026.5.7, and 2026.8.2, API serializers return stored credentials when an account has view permission on an affected configuration, even without authorization to change it or read secrets. Affected configurations include one-time code delivery, outbound provisioning, device trust, identity sources, Kubernetes outpost, and applications using secrets. Deployments are at risk when view permission is granted to accounts not intended to read these credentials.

In authentik before 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status or assign an existing role to a group without holding the required permissions. Group hierarchy checks do not consistently account for inherited superuser status, and role assignment to a group lacks authorization checks.