CVE Vulnerability Catalog

A vulnerability in the Linux kernel futex subsystem where need_futex_hash_allocate_default() incorrectly required CLONE_THREAD for proper hash allocation. This caused a use-after-free bug when sharing memory (mm) in non-thread ways, such as via child processes.

In the Linux kernel, a use-after-free vulnerability was found in the ena driver's get_timestamp function. The issue is caused by missing synchronization when checking the active flag and reading the DMA memory pointer, potentially leading to NULL pointer dereference.

A vulnerability was found in the Linux kernel's KVM subsystem in the kvm_reset_dirty_gfn() function. Missing overflow check when adding offset and mask allows bypassing range validation via integer wrap. An attacker can exploit this for out-of-bounds memory access.

In the Linux kernel, a vulnerability in the KVM subsystem for s390 architecture causes double-scaling of pointer arithmetic when indexing the GAIT table. Functions kvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and aen_host_forward() manually multiply the index by sizeof(struct zpci_gaite), leading to out-of-bounds access for aisb >= 32.

In the Linux kernel, the SMB/client subsystem has a vulnerability causing an infinite loop and out-of-bounds read in the symlink_data() function. On 32-bit architectures, an invalid ErrorDataLength value can make the next pointer point to the beginning of the structure or beyond it.

A buffer leak was discovered in the __ceph_setxattr() function in the Ceph filesystem within the Linux kernel. During retries, the old_blob variable stores the ci->i_xattrs.prealloc_blob value but is never freed via ceph_buffer_put(), causing a memory leak.

In the Linux kernel, a vulnerability was found in the Ceph filesystem where folios not suitable for writeback were not released properly. The function removing folios from the batch did not call `folio_put`, causing a memory leak.

In the Linux kernel's sev-guest driver, a vulnerability was found where a host-controlled value is used to compute the page order when freeing a buffer. The host may return an expected buffer size, which is then used to calculate the page order, potentially leading to corruption in the page allocator.

In the Linux kernel's libceph library, a null pointer dereference vulnerability was found during decoding of choose_args in the CRUSH map. The issue occurs when a received message contains a bucket_index pointing to a non-existent (NULL) bucket, potentially causing a system crash.

In the Linux kernel's libceph, a potential out-of-bounds access vulnerability was found in __ceph_x_decrypt(). An attacker can send a crafted authentication frame causing a read beyond the allocated buffer, potentially leading to information disclosure or system crash.

In the Linux kernel's libceph, the decode_choose_args() function lacks proper error handling for rbtree insertion. A corrupted CEPH_MSG_OSD_MAP message with duplicate choose_args indices triggers an assertion leading to a kernel BUG.

A vulnerability in the Linux kernel's iommu/vt-d driver causes an Oops when killing a QEMU process. The issue is due to out-of-scope access to the global static blocked domain, which lacks a proper dmar_domain structure.

A vulnerability in the Linux kernel IOMMU subsystem causes a false WARN_ON during device reset due to improper domain attachment blocking for multi-device groups sharing a RID. This can lead to a use-after-free condition.

In the Linux kernel, a vulnerability was found in the DRM driver for Intel Xe GPUs related to DMA-BUF buffer handling. The issue involves race conditions leading to use of an uninitialized buffer object (empty bo) and Use-After-Free (UAF) in the invalidate_mappings hook. An attacker could exploit these races to cause system crashes or potentially escalate privileges.

In the Linux kernel, the DRM xe driver (dma-buf) has a use-after-free vulnerability in a retry loop. After an error, the buffer object is freed, and the retry loop accesses freed memory, potentially leading to security issues.

In the Linux kernel's qrtr module, a vulnerability was found where the socket reference count is decremented before the port is removed from the XArray and before the RCU grace period ends. This creates a race condition where an RCU reader can obtain a pointer to a socket with a zero reference count, leading to refcount saturation and potential Use-After-Free (UAF).

A SOFTIRQ-unsafe lock order deadlock was found in the Linux kernel's send_sigio() and send_sigurg() functions when signaling a process group (PIDTYPE_PGID). The use of read_lock(&tasklist_lock) combined with write_lock in fork()/exit() and softirq interrupts (e.g., TCP URG) causes a deadlock. The fix replaces tasklist_lock with rcu_read_lock().

In the Linux kernel, a commit enabling threaded NAPI by default in the WireGuard driver was reverted because it caused complete decryption stalls for specific peers in Kubernetes environments with Cilium. The issue occurred rarely but led to permanent blocking of E/W traffic between pods and certain nodes.

Missing authentication for a critical function in MailerUp <1.0.1 allows a remote, unauthenticated attacker to self-register an account. The POST /api/auth/register/ endpoint applies AllowAny permissions without email verification, CAPTCHA, or administrator approval.

motionEye (mEye) is an online interface for a software called 'motion', which is a video surveillance program with motion detection. Versions prior to 0.44.0 contain an absolute path traversal vulnerability in multiple media file handlers that allows an attacker to read arbitrary files from the filesystem.