CVE Vulnerability Catalog

In the Linux kernel, the staging rtl8723bs driver has a memory leak on error paths in issue_beacon(), issue_probersp(), and issue_asocrsp(). When an error occurs after a successful alloc_mgtxmitframe() but before dump_mgntframe(), the management xmit_frame and xmit_buf are neither freed nor placed on any list. Repeated occurrences progressively exhaust the management-TX pools until the interface can no longer send beacons or probe/assoc responses.

In the Linux kernel, a bug was fixed where the BPF_REFCOUNT field was not marked as unique, although it should be. The fix addresses this oversight.

In the Linux kernel, a bug in the netfilter nf_nat_sip module was fixed where the offset was not rewound when NAT shrinks the packet. If map_addr() changes the packet length, coff may point to an incorrect position, potentially causing subsequent Contact headers to be skipped and leaking internal network details.

A reflected cross-site scripting (XSS) vulnerability exists in the EntryAbstract.save() component of APSL puput v1.2.1 through v2.2.0. An authenticated attacker with Wagtail Editor privileges can execute arbitrary code in the victim's browser via a crafted payload.

Netgate pfSense version 26.03.1-RELEASE is vulnerable to Cross Site Scripting (XSS), allowing an attacker to execute arbitrary code in the victim's browser context through the pfBlockerNG package.

A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. When the show_multiple_locations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted HTTP PATCH request.

In the Linux kernel, the wifi mt76 (mt7921) driver lacks validation of CLC firmware records. The loader trusts the region count and each record length, so a malformed image can make the region table pointer precede the firmware buffer, make the record loop fail to advance, or index phy->clc past its end.

In the Linux kernel, a vulnerability in ppp_async causes the error path to zero the skb headroom, violating the NET_SKB_PAD guarantee. As a result, a subsequent frame can be processed without the required headroom, leading to a kernel panic (skb_under_panic) or an out-of-bounds read when CCP compression is enabled.

In the Linux kernel, the EDAC/device_sysfs poll_msec sysfs store file uses simple_strtoul(), which accepts an unsigned long, while the target field poll_msec is an unsigned int. On 64-bit systems, a value greater than UINT_MAX is silently truncated when stored.

In the Linux kernel, the nvmet-rdma module has a resource leak. When pending disconnecting queues exceed the backlog limit, the connect path only drops the device reference and leaks the newly allocated queue and its IB resources.

In the Linux kernel, the drm/gud driver does not validate that the GUD_ROTATION_0 flag is present in the device's supported rotation bitmask. A device that omits this bit from GUD_PROPERTY_ROTATION triggers the WARN_ON in drm_plane_create_rotation_property().

In the Linux kernel, the printk subsystem incorrectly uses WARN_ON() to catch kthread_run() failure, since __kthread_create_on_node() returns -EINTR upon SIGKILL. This causes spurious kernel warnings under normal conditions.

In the Linux kernel, the accel/amdxdna driver's struct amdxdna_cmd_chain contains a flexible array annotated with __counted_by(command_count). Since the structure is stored in shared AMDXDNA_BO_SHARE memory, userspace can concurrently change command_count to zero, causing the bounds check to fail and triggering a kernel panic.

In the Linux kernel, the accel/amdxdna driver allows a command chain with command_count zero to pass the payload length check, and the fill loop does not run. On firmware without AIE2_NPU_COMMAND the request is rejected, but on firmware with aie2_get_npu_chain_msg_op() it reaches drm_clflush_virt_range(cmd_buf, 0), reading the byte before the buffer and faulting on the vmap guard page.

In the Linux kernel, the accel/amdxdna driver's amdxdna_cmd_set_error() takes a reference to the first BO of a command chain but fails to drop it on the mapping failure path, leaking the reference. The path is reachable when the BO handle is recycled by userspace after submission and a dma-buf without a vmap implementation is imported onto the same id.

In the Linux kernel, the drm/cirrus-qemu driver did not validate the BAR0 size during PCI probe. If a PCI device with BAR0 smaller than 4 MB (CIRRUS_VRAM_SIZE) was bound to the driver, the mapped VRAM was smaller than expected, allowing framebuffers larger than the mapped memory to be created and copied out of bounds, causing a supervisor write page fault.

In the Linux kernel, update_reparse_data() in the ntfs driver ignores the return value of set_reparse_index(). When index insertion fails, the code removes the just-written reparse data as cleanup but still returns 0, so symlink(2) reports success while no reparse data exists on disk.

In the Linux kernel, write_mft_record_nolock() in the ntfs driver maps the MFT record folio with kmap_local_folio(), but the pre_write_mst_fixup() and bio_add_folio() failure paths jump to the error label without unmapping it. Since kmap_local mappings are stack-ordered per task, leaking one corrupts the nesting for any outer mapping.

In the Linux kernel, ntfs_cluster_free_from_rl_nolock() in the ntfs driver adds a run's length to nr_freed whenever the error bookkeeping condition is false, which includes cases where ntfs_bitmap_clear_run() actually failed. Since a failed ntfs_bitmap_clear_run() rolls back its partial modifications, no bits were cleared for that run, yet its length still inflates vol->free_clusters.

In the Linux kernel, ntfs_sync_fs() in the ntfs driver unconditionally clears the dirty bit, whereas ntfs_put_super() and the remount-read-only path only clear it when NVolErrors(vol) is false. As a result, any sync() on a volume that recorded an error marks that volume clean, so no recovery is run.