CVE Vulnerability Catalog

In the Linux kernel, an inode reference leak occurs in fsnotify_recalc_mask() because the return value of __fsnotify_recalc_mask() (an inode pointer) is discarded, preventing iput() and fsnotify_put_sb_watched_objects() from being called. This leads to a hung task during filesystem unmount.

In the Linux kernel, a vulnerability in the netdevsim module was found where the nsim_dev_trap_skb_build function does not zero-initialize the IP header structure in a dummy sk_buff. This can lead to uninitialized data leaks detected by KMSAN.

In the Linux kernel's net/sched: netem subsystem, a vulnerability was found where the queue limit check only counted packets in the internal tfifo, ignoring packets placed in sch->q by the reorder path (__qdisc_enqueue_head). This allowed the total queue occupancy to exceed sch->limit during reordering.

A vulnerability in the Linux kernel's CFS scheduler causes a newly forked task to inherit an incorrect rel_deadline flag. This leads to a deadline miscalculation, vruntime overflow, and a subsequent NULL pointer dereference when sched_yield() is called.

In the Linux kernel's PSP (Packet Security Protocol) module, a vulnerability was found due to missing check for device unregistration when creating an association. The psp_assoc_device_get_locked() function may obtain a reference to a device that has been unregistered in the meantime, leading to a use-after-free condition.

In the Linux kernel, a vulnerability was found in the PSP (Platform Security Processor) module where dev-set and key-rotate operations modify shared device state (PSP version configuration and cryptographic key material) without requiring CAP_NET_ADMIN privileges. The only access control is psp_dev_check_access(), which only checks network namespace membership.

A vulnerability in the Linux kernel's futex subsystem can cause a live lock during requeue-PI operations. The race condition occurs when a task leaves the queue due to a signal or timeout while a higher-priority task holds the lock, leading to an infinite loop.

In the Linux kernel, the af_alg crypto subsystem now caps the AEAD associated data length to 0x80000000 to prevent arithmetic overflows when checking the TX buffer size.

In the Linux kernel netfilter subsystem, a reference leak of an expectation object was found in nft_ct_expect_obj_eval(). The function allocates an expectation but never releases the local reference before returning.

A logical error was found in the Linux kernel's DRM subsystem within the change handle logic. Incorrect replacement of the IDR pointer with a new object caused a warning and potential resource leak during file close.

In the Linux kernel DRM TTM subsystem, a bug causes an infinite LRU walk when swapout fails. After ttm_tt_swapout() failure, restoring the resource's LRU position leads to the same resource being found again, resulting in an infinite loop.

In the Linux kernel, a vulnerability was found in the USB MIDI 2.0 parser that does not properly validate descriptor lengths when scanning endpoint extra data. This could allow out-of-bounds reads by a malicious USB device.

In the Linux kernel, the ALSA USB-audio driver has a vulnerability where the MIDI endpoint descriptor scan is not properly bounded. The snd_usbmidi_get_ms_info() function fails to check if the endpoint descriptor size exceeds the remaining bytes in the endpoint-extra scan, potentially leading to out-of-bounds reads.

A kernel BUG_ON crash in __ceph_build_xattrs_blob() was discovered in the Linux kernel's Ceph filesystem. The issue is a race condition introduced by commit d93231a6bc8a, which moved blob size calculation before __build_xattrs(), allowing handle_cap_grant() to modify the blob concurrently.

In the Linux kernel, a vulnerability in the TTM (Translation Table Manager) driver causes an infinite loop during LRU list traversal in the ttm_bo_shrink() function when backup fails. The fix moves the bulk_move deletion to occur only after successful backup completion.

In the Linux kernel, the i2c-dev driver's I2C_TIMEOUT ioctl improperly validates the timeout argument, allowing integer overflow when multiplied by 10. This results in a negative timeout value, corrupting the SMBus state machine and causing a local denial of service.

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the frappe.ui.Tree component.

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Number Card component.

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to unsafe evaluation of user-controlled data in the Number Card component.

A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Notifications > Events panel.