CVE Vulnerability Catalog

A vulnerability in the Linux kernel's ALSA SEQ OSS subsystem involves a race condition in the read queue reset path. The snd_seq_oss_readq_clear() function modifies queue state without holding q->lock, which can race with concurrent read/free operations, leading to stale records, dropped events, or incorrect readiness reporting.

In the Linux kernel, in the tlclk driver, there is a use-after-free vulnerability in the tlclk_cleanup() function. The issue involves freeing memory before device operations are complete, which can lead to crashes or incorrect behavior.

In the Linux kernel's AppArmor module, the function aa_replace_profiles accessed udata->size after calling aa_put_loaddata(udata), potentially causing a use-after-free (UAF). The fix saves the size to a local variable before dropping the reference.

In the Linux kernel's tun_dst_unclone function, there is a false-positive memcpy overflow warning. The compiler with clang and source fortification estimates that options cannot fit into the structure, even though memory is actually allocated, causing a warning.

In the Linux kernel's emac driver, there is a NULL pointer dereference in emac_probe. The function devm_request_irq() is called before devm_platform_ioremap_resource(), which can cause an interrupt to hit emac_irq() before dev->emacp is mapped, leading to a crash.

In the Linux kernel's veth driver, there is a NAPI leak in the XDP enable error path. The rollback loop skips calling netif_napi_del() for the failed index, leaving a dangling napi_struct in the device's NAPI list, leading to use-after-free (UAF) during device destruction.

In the Linux kernel, the accel/amdxdna driver had a race condition regarding the iommu domain lifetime during device removal. In force_iova mode, accessing xdna->domain after device removal could lead to use-after-free. The fix moves domain freeing to a managed release action, ensuring its validity until all resources are released.

In the Linux kernel, a vulnerability was found in the DRM driver for Intel GPUs (xe). With CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y enabled, xe_pt_svm_userptr_pre_commit() calls vma_check_userptr() with notifier_lock held in read mode, while the test path requires write mode. This triggers an assertion and a WARNING in drm_gpusvm_unmap_pages(), potentially destabilizing the system.

In the Linux kernel, the hid_get_report function in HID core had an out-of-bounds read issue for numbered reports when the data size was 0. The fix moves the minimum size validation before calling hid_get_report, preventing out-of-bounds pointer dereference.

In the Linux kernel, the batman-adv gw module does not reassign the ethernet header pointer after pskb_may_pull() reallocates the buffer. This can lead to a use-after-free condition.

In the Linux kernel, the batman-adv batadv_dat_get_vid() function does not verify that the proto field of the ethernet header is accessible before reading it. This could lead to an out-of-bounds read.

In the Linux kernel, the NTFS3 filesystem's decompress_lznt() function does not validate array index bounds before accessing the decompression table. A corrupted NTFS3 image with invalid compressed data can trigger an out-of-bounds read.

In the Linux kernel, the ims-pcu driver exposes sysfs attributes on all interfaces, but only supports them on the control interface. Accessing these attributes on data interfaces can lead to unexpected behavior or crashes.

In the Linux kernel, the hwmon asus_atk0110 driver's atk_ec_present() function does not check that the sub-package is non-empty before reading its first element. This can lead to an out-of-bounds read.

In the Linux kernel, a vulnerability was found in the f2fs filesystem's f2fs_listxattr() function. Lack of validation of xattr entries before reading their fields may result in returning a partial result instead of an error when an entry is outside the valid storage area.

A vulnerability in the Linux kernel's IP fragmentation stack allows an attacker to send IP fragments with GSO metadata (e.g., via tun/tap), causing a kernel panic (BUG_ON in skb_segment) after reassembly. It affects IPv4, IPv6, nf_conntrack, and 6lowpan reassembly paths.

The User Registration & Membership WordPress plugin before version 5.2.6 does not perform a capability check when saving its login settings. Authenticated users with plugin management capability but without full administrator access can change arbitrary site options and escalate their privileges to administrator.

The Amelia plugin for WordPress up to version 2.2 is vulnerable to Stored Cross-Site Scripting via customer name fields. An authentication bypass allows unauthenticated users to submit booking data, and in the admin calendar view, customer names are interpolated into JavaScript template literals and rendered via innerHTML without proper HTML entity encoding. An attacker can inject malicious scripts that execute when an administrator hovers over the appointment.

The wpForo Forum plugin for WordPress up to version 2.4.17 is vulnerable to SQL Injection via the 'referer' parameter. Insufficient escaping and lack of preparation on the SQL query allow unauthenticated attackers to append additional SQL queries, which can be used to extract sensitive information from the database.

The Ultimate Member WordPress plugin before version 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own allow-list. This allows unauthenticated users who register through the plugin's own form to grant themselves arbitrary capabilities and reach administrator-equivalent access.