CVE Vulnerability Catalog

A memory leak was discovered in the Linux kernel's NFS server (nfsd) during SETACL decode failure handling. The decoder calls nfs_stream_decode_acl() twice for access and default ACLs, but if the second call fails, the first allocated posix_acl is not freed. The fix adds dedicated release functions (nfsaclsvc_release_setacl and nfs3svc_release_setacl) that properly clean both ACL fields.

In the Linux kernel, the nfsd4_create_file() function in the NFSD server has two vulnerabilities: a posix_acl memory leak and ignored errors during NFSv4-to-POSIX ACL conversion. These bugs can cause memory exhaustion and violate RFC 7530/8881.

In the Linux kernel NFSD subsystem, a dead ACL conflict guard in nfsd4_create() checked nulled pointers instead of stolen values, causing memory leak of posix_acl objects when both ACL and POSIX ACL attributes are requested in the same CREATE operation.

In the Linux kernel NFSD module, a memory leak was found related to pre-allocated openowner structures. The issue occurs in find_or_alloc_open_stateowner() during a race condition with unconfirmed open owners in NFSv4.0.

In the Linux kernel, the NFSv4/flexfiles driver lacks validation for a zero filehandle version count. An attacker can supply a malformed flexfiles layout, causing a NULL pointer dereference and kernel panic.

A vulnerability in the Linux kernel's nfs4_decode_mp_ds_addr() function in NFSv4/pNFS fails to properly handle zero-length r_addr fields in GETDEVICEINFO responses, leading to a NULL pointer dereference and kernel panic. An attacker can exploit this via a malicious or compromised metadata server.

In the Linux kernel's ksmbd filesystem, an out-of-bounds read vulnerability was found in smb_check_perm_dacl(). Missing ACE size validation before reading SID sub-authorities allows an authenticated client on a share using ACL xattrs to trigger a heap out-of-bounds read past the allocated buffer.

A use-after-free vulnerability was found in the Linux kernel's TCP-AO implementation. In the del_async path of key deletion, the current_key and rnext_key pointers are not cleared, causing a reference to freed memory after the RCU grace period.

In the Linux kernel FUSE subsystem, a vulnerability was found due to missing re-locking of the request after successful fuse_try_move_folio(). This can lead to a use-after-free issue when accessing the fuse_io_args structure.

In the Linux kernel VEML6075 light sensor driver, a missing bounds check on the `veml6075_it_ms` array index could cause an out-of-bounds access. The index from the configuration register can be 0-7 but the array has only 5 elements. A validation was added returning -EINVAL for invalid values.

In the Linux kernel, the ti-ads1298 ADC driver lacked bounds checking for the pga_settings array index. The ADS1298_MASK_CH_PGA mask can yield values 0-7, but the array has only 7 elements (indices 0-6). Value 7 causes an out-of-bounds read. A bounds check was added, returning -EINVAL for invalid indices.

In the Linux kernel, ksmbd module fails to validate session state in compound requests. An invalid IN_PROGRESS session can be used to trigger a remote NULL pointer dereference, causing a kernel Oops and crashing the SMB server.

A use-after-free (UAF) vulnerability was found in the Linux kernel's virtiofs when unmounting submounts. The issue occurs when iput() called from fuse_release_end() accesses a superblock that has already been destroyed.

In the Linux kernel, the rzv2h-ivc driver had a race condition where `list_del()` was called without holding the spinlock, allowing concurrent modification of the buffer list. This could lead to undefined behavior.

In the Linux kernel, in the DRM driver for AMD GPUs (amdgpu) within the VCE component, a vulnerability was found due to incomplete address patching. When only one part (low or high) of the address is valid, patching may result in writing a bad address to the firmware.

In the Linux kernel, the amdgpu driver has a vulnerability where the GART table is not zero-initialized upon allocation. After writing a single PTE entry, the TLB may speculatively load uninitialized, potentially valid-looking data from the same cache line, which can lead to the GPU using stale PTE entries.

In the Linux kernel, a vulnerability was found in the mmap_prepare mechanism where attempting to unmap a VMA during error handling in the mmap() function can cause warnings and an invalid state. The issue occurs when mmap_prepare is invoked from the mmap() hook of 'stacked' drivers (e.g., overlayfs, shm) because the VMA is not fully established in the maple tree.

A SQL Injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /edit_schoolyr.php. Manipulating the ID argument allows remote SQL injection. The exploit is publicly available.

SourceCodester Class and Exam Timetabling System 1.0 is vulnerable to SQL Injection in the file /edit_subject.php via manipulation of the ID argument. The attack can be performed remotely.

In the Linux kernel, a vulnerability in the UDF filesystem allows udf_read_tagged() to skip CRC verification when the CRC length exceeds the block size. A crafted UDF image can set an oversized CRC length to bypass validation entirely, accepting the descriptor based solely on a weak 8-bit tag checksum.