CVE Vulnerability Catalog

In authentik before 2026.2.7, 2026.5.7, and 2026.8.2, email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the established address. An attacker who knows the target's password can substitute an attacker-controlled address, receive the one-time code, and finish enrolling the factor as the target. Successful enrollment gives the attacker a session as the target and access to SSO applications.

In the Linux kernel's stmmac network subsystem for XGMAC2, the RBUE (RX Buffer Unavailable) interrupt was enabled by default, causing a MAC interrupt storm under heavy RX load. The fix disables RBUE in the default interrupt mask because it is redundant—the normal RIE interrupt already triggers NAPI and refills descriptors. This prevents the storm while maintaining normal RX handling.

In the Linux kernel virtio-fs, virtio_fs_setup_vqs() frees fs->vqs and fs->mq_map on the error path, then virtio_fs_ktype_release() frees them again, causing a double-free and dangling pointers. The fix sets the pointers to NULL after kfree() so the later release is harmless. This can be triggered when a broken virtio-fs device advertises more request queues than the transport provides.

In the Linux kernel HID hidpp driver, if input_register_device() fails, input_free_device() is called but a stale pointer to the old device remains in hidpp->input, potentially leading to a use-after-free. The fix resets it to NULL before returning from hidpp_connect_event().

In the Linux kernel, the perf subsystem uses event::addr_filter_ranges under RCU but does not free it via RCU. The incorrect object lifetime can lead to memory errors.

In the Linux kernel, the f2fs filesystem's inline dentry conversion copies names out of the inline dentry area before checking that each recorded name length fits in the available filename slots. A corrupted image can therefore cause the conversion path to read past the inline filename storage.

A flaw was found in the Linux kernel's btrfs module in the validation of the INODE_REF name length (namelen). A crafted btrfs image can contain a namelen larger than the 255-byte limit, causing an out-of-bounds write and a kernel panic.

In the Linux kernel, a double fput() occurs in the error handling of cachefiles_create_tmpfile() in the cachefiles subsystem. This leads to incorrect release of a file reference.

In the Linux kernel, the wifi cfg80211 subsystem's cfg80211_rx_assoc_resp() initializes the status and response-IE fields from the management frame before proving the frame is long enough for those offsets. The S1G path only patches resp_ie after the unsafe initializer has already run.

In the Linux kernel, the SMB client's stack-allocated cifs_open_info_data structure may contain random data, which can cause fields to have incorrect values if they are not set later.

In the Linux kernel iwlwifi driver (mvm subsystem), the sta_id in the BA_WINDOW_STATUS_NOTIFICATION_ID notification is not validated before being used as an index into the fw_id_to_mac_id[] array, leading to potential out-of-bounds access.

In the Linux kernel btrfs filesystem, merge_reloc_roots() has an issue with reloc root cleanup: when a root has zero references, the reloc_root pointer is reset without memory barriers, and the BTRFS_ROOT_DEAD_RELOC_TREE flag is cleared incorrectly. The fix uses clear_reloc_root() to ensure proper synchronization.

In the Linux kernel iwlwifi driver (pcie subsystem), after a failed TX init, the RX resources are freed but the pointers are not set to NULL. This can lead to use-after-free during later cleanup or retry.

In the Linux kernel iwlwifi driver (mvm subsystem), TX_CMD response parsing does not validate the response layout correctly. The minimum length check does not follow the runtime layout calculation, potentially leading to out-of-bounds read. For the new TX API, responses with frame_count != 1 are rejected.

In the iwlwifi mvm driver, an incorrect indexing of the tid_data array was found — using the loop counter instead of the actual TID value. Currently it causes no harm, but a bounds check was added to prevent potential out-of-bounds access.

In the Linux kernel CIFS (SMB1) module, cifs_filldir() copies directory entry names from an SMB response using a server-supplied length without checking that the name stays within the response buffer. A malicious SMB1 server returning an oversized FileNameLength causes memchr() to read past the end of the slab buffer.

The ksmbd SMB server could overwrite ACL masks inherited from the parent directory, leading to widened effective permissions during object creation. The fix preserves original masks.

In vhost-scsi, a race condition between command submission and memory table replacement (VHOST_SET_MEM_TABLE) could cause response writes to an unrelated object after completion. The fix flushes the backend after ioctl.

An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.

In the Linux kernel, the netfilter nfnetlink_log module has a synchronization issue: nfnl_log_net_exit() clears the logger pointer without waiting for an RCU grace period, potentially leading to use-after-free by concurrent packets. The fix moves the cleanup to .pre_exit to ensure RCU readers complete before freeing per-net state.