CVE Vulnerability Catalog

In the Linux kernel, a vulnerability in the TIPC module was fixed where exceeding the TIPC_MAX_PUBL (65535) limit of local service publications prevented protocol service types (node state, link state) from being inserted into the name table. This caused missing event notifications and a NULL pointer dereference in tipc_named_node_up() when the publication list was empty.

In the Linux kernel, a problem in TIPC where random pad bytes were sent in RESET/ACTIVATE messages was fixed. Previously, strcpy() was used, which could send random data from the skb buffer to the remote system. Now memcpy() is used, which copies zeroed pad bytes.

In the Linux kernel, tpacket_parse_header() in the af_packet subsystem cast the user-provided tpacket_hdr.tp_len (u32) to int. A value larger than INT_MAX became negative, passed the size check, and was returned up to sock_sendmsg_nosec(), triggering BUG().

In the Linux kernel, the fbtft staging driver's dirty_lock was not IRQ-safe. fbtft_mkdirty() can be reached from the fbcon rendering path in hardirq context, while fbtft_deferred_io() takes the same lock in workqueue context with local interrupts enabled, leading to a possible lock inversion and deadlock.

In the Linux kernel, the ASoC amd yc driver's acp6x_pdm_dma_close() does not free the runtime->private_data buffer allocated in acp6x_pdm_dma_open(). The missing kfree causes a memory leak.

In the Linux kernel, in the btrfs filesystem, when creating the first metadata chunk for a sprout filesystem, create_chunk() adds the new device to the transaction dev_update_list. If the subsequent system chunk creation fails, btrfs_init_new_device() aborts the transaction and releases the device while post_commit_list is still linked, causing a warning and leaving the transaction list referencing freed memory.

In the Linux kernel, in the btrfs filesystem, btrfs_init_new_device() switches latest_dev and possibly s_bdev from the seed device to the new sprout device before creating the first writable chunks. If chunk creation or the subsequent sprout setup fails, the error path releases the new device without switching those pointers back, so btrfs_show_devname() can dereference the freed latest_dev and crash.

In the Linux kernel's btrfs filesystem, there is a memory leak of the bioc structure on the bioc_list of an ordered_extent. The bug can occur during RAID extent insertion or when an ordered extent encounters an I/O error, causing the bioc to not be freed.

In the Linux kernel, a bug in the btrfs subsystem forces unnecessary reloc root creation during snapshot creation when qgroups (quota) are enabled. This triggers a kernel warning in lookup_inline_extent_backref and flips the filesystem to read-only mode. The issue is reproducible during balance/relocate operations on a btrfs filesystem with quota enabled.

In the Linux kernel's IPVS, there is a bug with reversed argument order in sequence serialization for version 1 sync. This leaves 24 bytes of the message unwritten, potentially disclosing stale heap data and replacing the live connection sequence state with values read from the buffer.

In the Linux kernel, the signal_generate and signal_deliver tracepoints declare their info argument as a struct kernel_siginfo pointer, so btf_ctx_access() treats it as a trusted pointer for tp_btf programs. However, signal delivery uses SEND_SIG_NOINFO (0) and SEND_SIG_PRIV (1) as special values that are not pointers. A tp_btf program can dereference these values and fault the kernel, and signal_generate can run from timer interrupt context, leading to a kernel panic.

In the Linux kernel, do_wait() passes wo->wo_pid to the sched_process_wait tracepoint, but kernel_wait4() leaves wo_pid NULL for wait4(-1), and kernel_waitid_prepare() does likewise for waitid(P_ALL). btf_ctx_access() types argument 0 as PTR_TO_BTF_ID | PTR_TRUSTED without PTR_MAYBE_NULL, so the verifier accepts an unchecked dereference. Since trusted pointer loads have no fault protection, a wait for any child can cause a NULL pointer dereference in JITed BPF code. The fix marks argument 0 as nullable.

In the Linux kernel, bpf_sys_bpf() and bpf_sys_close() can sleep (e.g., via mutexes, GFP_KERNEL allocations, waiting for an RCU grace period), but they lack .might_sleep on their prototypes. They are limited to BPF_PROG_TYPE_SYSCALL, whose main program is sleepable, but a bpf_timer callback registered by a syscall program is checked in a non-sleepable context. Such a callback can invoke bpf_sys_bpf() from hrtimer softirq context and trigger a scheduling-while-atomic failure. The fix sets .might_sleep on both prototypes.

In the Linux kernel, the ASoC Intel AVS driver's strace_open() invokes try_module_get(), which on success takes a module reference. If any follow-up operation causes strace_open() to fail, the reference count is not released, resulting in an unbalanced state.

In the Linux kernel, the ASoC Intel AVS driver accesses entries in the init_configs array using indexes from the config_ids array, which are bounded by num_config_ids rather than num_init_configs. Using an ID greater than or equal to num_init_configs leads to an out-of-bounds access in avs_path_module_send_init_configs().

In the Linux kernel, the bcmasp network driver's tx_spb_ring_full() initialized next_index from intf->tx_spb_index on every loop iteration, so incr_ring() always produced the same result and only one slot was ever tested. This caused incorrect checking of consecutive descriptor slot availability before transmission.

In the Linux kernel's BPF subsystem, is_cmpxchg_insn() matches only BPF_MODE == BPF_ATOMIC, so an arena cmpxchg misses the required zero extension for a 32-bit operation. This can lead to incorrect values in the destination register on architectures requiring explicit zero extension.

The Regesta Smart HD-PLC device from Teldat (model TLDPH16D2) with vulnerable firmware version 11.02.06.00.02 is vulnerable to Cross-Site Scripting (XSS). An attacker with network access (registration required) can inject a specific payload via the 'cmdcookie' parameter in /upgrade/index.html.

The cisco_firesight_manager_ACL_rule_export module in misp-modules generates a shell script (.sh) that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values (IP address, login, password, domain ID, policy ID) and MISP attribute values (destination IPs, URLs, event info comments) directly into single-quoted shell string assignments without any escaping or sanitization. Because the values are placed inside single-quoted shell strings, any value containing a single-quote character breaks out of the quoting context, allowing an attacker to inject arbitrary shell commands into the exported script. A security analyst who executes the generated .sh file unmodified would run the injected commands with their own privileges, potentially exposing fireSIGHT Manager credentials, modifying ACL rules, or compromising the analyst workstation. Additionally, the module contained a secondary defect where the variable 'config' was only assigned inside a conditional block but referenced unconditionally afterward, causing a NameError (denial of service) when the request payload lacked a 'config' key.

Apache Qpid Broker-J improperly handles compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion, and HTTP management JSON rendering. An authenticated message producer can exhaust memory and disrupt broker availability by processing data without a decompressed-output limit.