CVE Vulnerability Catalog

In the Linux kernel, in the ovpn driver, there is a security issue related to running deferred work on global system workqueues. Work may be executed after the module text is freed, leading to use-after-free. The fix adds a module-owned workqueue and flushes it before module destruction.

In the Linux kernel, the psxpad-spi driver has a NULL pointer dereference vulnerability. The psxpad_spi_suspend() function retrieves driver data, but it is not stored during probe, leading to a crash during system suspend.

In the Linux kernel, in the MediaTek pmdomain driver (mtk_mfg), the variable prev_o is uninitialized in mtk_mfg_attach_dev(). On the first loop iteration it is read before assignment, potentially dereferencing a stale or invalid pointer, causing faults or incorrectly skipping the first OPP.

In the Linux kernel's pmdomain subsystem for MediaTek, there is an issue with use of a pointer to a freed device-tree node in error paths. The function scpsys_get_bus_protection_legacy() releases the node before checking the regmap lookup result, then uses it in the error message, potentially leading to dereferencing freed memory.

In the Linux kernel's DRM driver for HDMI connectors, there is an out-of-bounds memory read issue. A helper function copies an audio infoframe into the connector's copy using the destination size (60 bytes) instead of the source size (28 bytes), causing a read beyond the allocated buffer.

In the Linux kernel's MMC driver for Loongson chips, there is an issue with scatterlist iteration in data reorder functions. The for_each_sg() macro already iterates over entries, but the code uses '&sg[i]' and 'sg_dma_len(&sg[i])', leading to access of wrong entries or out-of-bounds reads.

In the Linux kernel's drm/amdkfd driver, the CRAT parser does not validate that the advertised subtype length fits within the image. A malformed CRAT table with an oversized length field causes out-of-bounds reads during parsing.

In the Linux kernel's FP9931 regulator driver, there is an issue with the VPOS/VNEG voltage selector table. The VPOSNEG_table[] does not match the datasheet: it has an extra 7.04V entry (shifting all subsequent) and only 41 entries instead of 64, causing out-of-bounds access for selectors above 0x28.

In the Linux kernel's drm_log_draw_kmsg_record() function, there is an out-of-bounds read when the message length is 0. The function accesses s[len - 1], where len is unsigned int, causing a wrap to UINT_MAX when len=0, leading to an out-of-bounds read.

In the Linux kernel's bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie functions, there is an issue with missing validation of socket state before accessing sk_protocol. These functions may receive a pointer to a mini-socket that lacks full socket fields, potentially leading to dereferencing invalid memory.

In the Linux kernel, in the amba-pl011 serial driver, there is a synchronization issue during DMA teardown. dmaengine_terminate_all() does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port lock. The fix switches to dmaengine_terminate_sync() and deletes the RX timer before freeing the buffers.

In the Linux kernel's Thunderbolt subsystem, there is an issue with indexing the bandwidth reservation array. The function tb_consumed_dp_bandwidth() uses the group ID (from 1 to MAX_GROUPS) as an index into the group_reserved[] array, which has only MAX_GROUPS entries, causing an out-of-bounds read for group MAX_GROUPS and omitting it from the sum.

In the Linux kernel, in the ovpn driver, there is a security issue with dereferencing sk_user_data. Some subsystems, like BPF SOCKMAP, set sk_user_data without setting encap_type. It is necessary to ensure the type is the one ovpn expects before dereferencing to avoid out-of-bounds reads.

In the Linux kernel, a vulnerability in the btrfs filesystem involves improper initialization of mapping flags and minimal folio order for cached inodes. Under specific conditions (e.g., 8K block size with 4K page size), this can lead to assertion failures and kernel panics.

In the Linux kernel, in the ata: pata_sl82c105 driver, there is a use-after-free when reading the bridge revision. pci_get_slot() returns a referenced PCI device, but after the change to direct access to the revision field, the read occurs after pci_dev_put(), which may lead to use of freed memory. The fix moves the revision read before dropping the reference.

A vulnerability was found in the Linux kernel's dev_validate_header() function in the networking stack. For processes with CAP_SYS_RAWIO capability, it zero-padded short link-layer headers by reading dev->hard_header_len directly. If the device was reconfigured and this value increased in the meantime, the zeroing write went beyond the allocated buffer, causing an out-of-bounds write.

The Mendix SAML module in versions before V4.2.4 (for Mendix 10 and 11) and before V3.6.29 (for Mendix 9.24) does not properly validate the SAML response signature. In specific SSO configurations, this could allow unauthenticated remote attackers to hijack an account or session.

Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit used in mapp Services. This issue affects mapp Audit used in mapp Services: before 6.8.0.

Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `editAddress()` redirected non-owners away only when the loaded address row had a **non-empty** `user_id` belonging to someone else. Guest-checkout address rows have an empty `user_id`, so that check never triggered for them — any logged-in account guessing a small, sequential `address_id` got a guest customer's full name, street address, and phone number rendered prefilled into the edit form.

Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `fof.xml` grants the `carts` view's tasks a wildcard `true` ACL, and FOF only enforces CSRF tokens on back-end HTML requests, not on front-end `format=raw` requests. `J2StoreControllerCarts` already scoped `remove()` to the caller's own session, but never overrode the generic FOF `save` task, so it remained reachable to insert new cart rows with an attacker-chosen `user_id`/`session_id`, or overwrite an existing row by id.