CVE Vulnerability Catalog

A vulnerability in the Linux kernel related to parameter validation for packet data in communication with nci NFC chips has been resolved. The introduced fix has caused issues with communication with these chips.

A vulnerability in the Linux kernel related to the dma_free_coherent() function has been fixed, which was using an incorrect DMA handle in the error path. This could lead to improper unmapping of the buffer.

A vulnerability has been identified in the Linux kernel in the ceph_zero_partial_object function, which was missing proper snapshot context for OSD write operations. This could lead to data inconsistencies in snapshots.

A vulnerability related to the TSV110 processor has been resolved in the Linux kernel, which is susceptible to the Spectre-BHB attack. This attack can be exploited to leak information through branch prediction side channels.

A vulnerability has been identified in the Linux kernel regarding missing syscalls in the audit read class. The missing 'at' variants of getxattr() and listxattr() may allow bypassing audit rules when reading file extended attributes.

A vulnerability in the Linux kernel related to 'not page aligned sg buffer' errors in the ChipIdea UDC driver has been resolved. This issue occurs when a USB device is reconnected after being disconnected during an active transfer.

When addressparser finds no address by its strict reading, it falls back to pulling one out of the free text with /\s*\b[^@\s]+@[^\s]+\b\s*/. That pattern backtracks quadratically, causing high resource consumption when processing a single header.

The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability, leading to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation.