CVE Vulnerability Catalog

A vulnerability in the Linux kernel related to out-of-bounds access in the vfe_isr_reg_update() function has been resolved. The issue occurs during iteration in the vfe_isr() function, where an incorrect loop bound is used, potentially leading to unauthorized memory access.

When addressparser finds no address by its strict reading, it falls back to pulling one out of the free text with /\s*\b[^@\s]+@[^\s]+\b\s*/. That pattern backtracks quadratically, causing high resource consumption when processing a single header.

A vulnerability has been identified in the Linux kernel that has been resolved. In the error path, the function cx88_alsa_dma_unmap() has been added to release resources acquired by cx88_alsa_dma_map().

A vulnerability in the Linux kernel has been fixed that caused sporadic user-space crashes and heap corruption on Alpha systems during memory compaction.

A vulnerability has been identified in the Linux kernel related to the gfs2_fiemap() function, which can lead to recursive inode lock taking. The issue occurs when the fiemap buffer is memory mapped to the same inode.

A vulnerability has been identified in the Linux kernel related to a reference count leak in the of_get_display_timings() function. This issue occurs during the processing of device nodes, potentially leading to improper memory management.

A vulnerability has been identified in the Linux kernel related to the logic in GHES/CPER, which does not detect if the section length is too large. This may lead to improper processing of CPER records for ARM processors.

A vulnerability in the Linux kernel related to event handler initialization in IPMB has been resolved, which does not use I2C reads but requires a value to be set. Otherwise, an I2C read will return an uninitialized value from the bus driver.

A vulnerability in the Linux kernel has been fixed, which involved a NULL pointer dereference in the process_metadata_update() function. The issue occurred in the wait_event() macro, which improperly handled the 'thread' pointer.

A vulnerability in the Linux kernel related to exception handling in SCSI for UFS has been resolved. The issue was the lack of proper flushing of exception handling work during system suspend when the runtime power management level is set to zero.

A vulnerability related to APEI/GHES has been resolved in the Linux kernel, which could lead to the allocation of overly large records. The logic in the ghes_new() function checks that records do not exceed the maximum size of GHES_ESTATUS_MAX_SIZE, currently set at 64KB.

A vulnerability has been identified in the Linux kernel related to the ocfs2 filesystem, concerning the incorrect handling of the 'last' pointer in the context of preserving xattr entries. This issue has been partially addressed, but bugs still exist in the cleanup process.

Crass's tokenizer did not terminate a bad URL token at a ) that followed an escaped backslash (\\). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked.

The vulnerability affects the ViewComponent component in Ruby and is related to the earlier CVE-2026-54497. The fix involved calling __vc_reset_render_state! in render_in to clear three instance variables (@__vc_controller, @__vc_helpers, @__vc_request) on every render, preventing a reused ViewComponent::Base instance from leaking the previous request's controller/helpers/request.

Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates chaining to this root have compromised private keys and the CA has revoked them. An attacker with one of the compromised keys can issue certificates.