CVE Vulnerability Catalog

A memory corruption bug was found in the Intel PUNIT IPC driver in the Linux kernel. Instead of passing the pointer to the punit_ipcdev structure, the address of the pointer was passed, causing writes to an incorrect memory address.

A potential NULL pointer dereference was found in the sxgbe network driver in the Linux kernel in the sxgbe_rx() function. When skb is NULL, an error is printed but then skb is dereferenced, potentially causing a kernel panic.

In the Linux kernel's atlantic driver for Aquantia network cards, a vulnerability exists due to missing fragment count validation in the RX path. Packets with more than 17 fragments cause an out-of-bounds write in skb_add_rx_frag_netmem(), leading to a kernel panic.

In the Linux kernel's AFS filesystem, a vulnerability exists due to delayed allocation of a cell's anonymous key. This can cause an oops when a key lookup uses an uninitialized key description. The issue is exacerbated by a previous fix for dynamic lookup failure.

A vulnerability in the Linux kernel related to a race condition in fbcon setup has been resolved, which could lead to out-of-bounds access in the fbcon_remap_all() function. The change involves protecting the vga_switcheroo_client_fb_set() function with a console lock.

In the Linux kernel's io_uring/net subsystem, a bug exists where vectored registered buffer imports use the wrong 'req' object instead of 'sr->notif'. This can lead to lifetime management issues.

In the Linux kernel, the mptcp_do_fastclose() function for MPTCP failed to initialize rcv_mss before calling tcp_send_active_reset(), causing a divide-by-zero in __tcp_select_window(). The issue was reported by syzbot and is analogous to a previous vulnerability in plain TCP (CVE-2025-68291).

In the Linux kernel, the amdgpu driver for AMD displays lacks a NULL pointer check before dereferencing in the dc_stream_get_scanoutpos function. This causes a NULL pointer dereference during the IGT kms_cursor_legacy test, leading to a system crash.

In the Linux kernel's libceph, a use-after-free vulnerability was found in have_mon_and_osd_map(). Lack of locking when accessing monmap and osdmap can cause dereference of freed memory, as shown by KASAN errors.

In the Linux kernel's libceph library, the handle_auth_session_key() function lacks validation of the length field from network packets. The len field originates from untrusted packets, potentially leading to out-of-bounds writes when decrypting the connection secret or processing service tickets.

In the libceph library in the Linux kernel, BUG_ON was replaced with bounds checking for map->max_osd. OSD indexes come from untrusted network packets, so validation was added to prevent potential crashes.

The Dbit N300 T1 Pro router running firmware V1.0.0 lacks rate limiting on the /api/login endpoint, allowing attackers to brute force passwords.

The vulnerability in Blue Mail 1.140.103 and earlier causes documents to be saved to the file system without a Mark-of-the-Web tag when using the attachment interaction functionality. This allows attackers to bypass the built-in file protection mechanisms of Windows OS and third-party software.

A vulnerability in Canary Mail 5.1.40 and earlier causes documents to be saved without a Mark-of-the-Web tag when using the attachment interaction functionality. This allows attackers to bypass built-in file protection mechanisms of Windows OS and third-party software.

In limited scenarios, sensitive data might be written to the log file if an admin uses Microsoft Teams Admin Center (TAC) to make device configuration changes. The affected log file is visible only to users with admin credentials. This is limited to Microsoft TAC and does not affect configuration changes made using the provisioning server or the device WebUI.

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in RTI Connext Professional (Core Libraries) allows Sniffing Network Traffic. This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.2.0 before 7.3.1.

In the Linux kernel, a vulnerability in the BFS filesystem was found where the S_IFMT bits of inode->i_mode can become corrupted when loading from disk. This is due to uninitialized upper 23 bits of the 'mode' field and lack of validation of the 'attributes' field, potentially leading to incorrect file type detection.

A use-after-free vulnerability was discovered in the Linux kernel's NVMe driver. The issue stems from improper lifetime management of the controller's admin request queue, which namespaces may access after controller teardown. The fix moves the controller reference release after all namespace references are freed.

A race condition was found in the ext4 filesystem in the Linux kernel regarding inline data size. The cached ei->i_inline_size value can become stale during write operations, leading to a system crash (BUG_ON).

A vulnerability in the Linux kernel ext4 filesystem lacks i_data_sem protection during inline data destruction, causing a race condition between inode modification and block mapping. This can trigger a kernel BUG and system crash.