CVE Vulnerability Catalog

In the Linux kernel platform/x86 x86-android-tablets module, gpio_secondary_fwnode_init() drops the device reference at the end of each iteration, while devm_add_action_or_reset() saves the pointer without incrementing its reference count. This can lead to a use-after-free during driver teardown.

In the Linux kernel on PowerPC, arch_exit_to_user_mode_prepare() restored user memory access permissions (KUAP) too early, before platform-specific exit routines completed. This caused the kernel to run with user memory access unblocked, triggering a warning in interrupt_exit_user_prepare() when CONFIG_PPC_KUAP_DEBUG was enabled. The issue was fixed by removing the KUAP restore from that hook.

In the Linux kernel on PowerPC, __replay_soft_interrupts() overwrote irq_soft_mask with IRQS_DISABLED (0x1) when replaying a pending interrupt, stripping the IRQS_PMI_DISABLED (0x2) bit. This triggered a WARN_ON in arch/powerpc/kernel/irq_64.c:75, observed early in boot on a POWER10 pseries guest. The fix replaces local_irq_disable() with hard_irq_disable().

In the Linux kernel, recv(0, MSG_PEEK) in blocking mode triggered a busy-wait in unix_stream_read_generic() when the last skb in the queue was a MSG_OOB skb. This affects AF_UNIX sockets. The fix makes the function return 0 immediately, matching TCP behavior.

In the Linux kernel IPv4 handling, a UDP length overflow occurs with PMTU discovery and a very large interface MTU. When IP_MTU_DISCOVER is set to IP_PMTUDISC_PROBE and a packet is sent over a netdev with MTU larger than IP_MAX_MTU + 20, the UDP length can exceed the 16-bit field and trigger a WARN in udp_set_len_short. This affects the IPv4 networking stack in the kernel.

In the Linux kernel Bluetooth driver btintel_pcie, there is an off-by-one bounds check error for tx_handle. Valid indices are 0..txq->count-1, but the guard in btintel_pcie_msix_tx_handle() only checked '> txq->count', allowing an index equal to txq->count. The fix changes the guard to '>= txq->count'.

In the Linux kernel drm/xe driver, a race condition occurs during VM teardown when the runtime PM reference is dropped asynchronously while stale page faults are still queued. The page-fault worker may call guc_ct_send_locked() on an already-suspended device, tripping an assertion and kernel warning. The fix holds a runtime PM reference across the entire pagefault queue worker.

In the Linux kernel x86/amd_node code, a divide-by-zero occurs on virtualized systems. The number of nodes is unrelated to the number of roots, and on Xen PVH dom0 roots_per_node can be 0, causing a crash in a modulo operation. The fix sets roots_per_node to 1 in this case and prints a firmware bug warning for non-virtualized systems.

In the Linux kernel drm/amdgpu driver, during resume from GPU reset, the gfx idle work may invoke switch_power_profile before the reset completes. This causes register access without releasing the GPU reset semaphore, leading to an assertion error and stack trace. The fix skips switch_power_profile during GPU reset.

In the Linux kernel, do_close_on_exec() is called while holding exec_update_lock, which can block waiting for a filesystem reply. This can lead to deadlock if a FUSE filesystem tries to inspect the calling process, or block codepaths using exec_update_lock. The fix moves do_close_on_exec() before taking exec_update_lock, but after copying the FD table if necessary.

In the Linux kernel s390/crypto module (aes_s390), return codes from skcipher_walk_virt() are not properly checked before entering processing loops in ecb_aes_crypt() and ctr_aes_crypt(). If skcipher_walk_virt() fails, the walk structure may be in an undefined state, leading to incorrect behavior or access to uninitialized memory. The fix adds proper return code checking.

In the Linux kernel scsi: qla2xxx driver, __qla2x00_alloc_iocbs() zeroes the QLAFX00 request ring slot with a plain memset(), even though it is ioremapped device I/O memory, not DMA-coherent RAM. On architectures like ARM64, memset() may emit invalid instructions (e.g., DC ZVA) on Device memory, causing a synchronous external abort. The fix uses memset_io() for QLAFX00.

Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. A low privileged attacker with local access could potentially exploit this vulnerability, leading to denial of service.

Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Account Lockout Mechanism vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

Cloud Commander versions 19.20.2 through 19.21.1 contain a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler calls the unguarded root() function instead of the root.resolve() validation wrapper. Attackers can use percent-encoded directory traversal sequences to read arbitrary files outside the configured --root directory, such as /etc/passwd or SSH private keys, which are archived and streamed back as a downloadable tar.gz file.

ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint. Attackers can bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in the default configuration, causing the server to fetch and proxy back arbitrary private-network and cloud metadata content.

SQL Injection (CWE-89) exists in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce. An unauthenticated remote attacker can read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID parameter value containing a single quote and stacked SQL query.

The JetEngine plugin by Crocoblock up to version 3.8.16 contains a DOM-Based Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.

7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp). Attackers can leak heap memory by crafting a malicious archive where the superblock's no_ids field is set so that the final metadata block's expected size is miscomputed and bypasses the size validation check. By listing or extracting the crafted archive, attackers can cause the application to return uninitialized heap memory as the kpidUserId and kpidGroupId properties.

Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) a Path Traversal vulnerability due to improper limitation of a pathname to a restricted directory. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.