CVE Vulnerability Catalog

A vulnerability has been identified in the Linux kernel that allows for out-of-bounds kernel read in the madvise function. A user can provide an invalid pat_index value, leading to unsafe access to the xe->pat.table array.

A vulnerability has been identified in the Linux kernel related to double destruction of the workqueue in the mana driver during PCI scanning. This issue leads to a use-after-free crash, potentially causing system instability.

A vulnerability related to the RSS context deletion logic in the bnxt_en driver has been fixed in the Linux kernel. The issue was that an incorrect check of the network interface state led to VNIC leaks in firmware, potentially resulting in the loss of active RSS contexts.

A vulnerability has been identified in the Linux kernel related to the ovpn module, concerning the processing of TCP stream data. Issues with header offset overflow and misaligned protocol headers may lead to packet loss and performance degradation.

In the Linux kernel, a vulnerability in the do_procmap_query() function in procfs can cause a double mmput() on the mm_struct. The issue occurs when a user provides an incorrectly sized buffer for the build ID, triggering an -ENAMETOOLONG error after locks are released and mmput() is called, leading to a second mmput() in the error path.

A vulnerability has been identified in the Linux kernel regarding the improper classification of data as interlaced plain extents. This issue occurs when data is not properly aligned to the block size, potentially leading to out-of-bounds read errors.

A vulnerability related to null pointer dereference in the __udp_enqueue_schedule_skb() function has been fixed in the Linux kernel. This issue was reported by syzbot and may lead to failures in the UDP socket initialization functions.

A vulnerability in the Linux kernel related to bind attributes in sysfs for the reset device has been resolved. The issue allowed users to unbind the device, leading to a use-after-free error.

A vulnerability was found in the Linux kernel's KVM implementation for nested SVM (nSVM). The VMLOAD/VMSAVE emulation for L2 guests incorrectly used vmcb02 instead of vmcb01, potentially causing incorrect virtual machine state.

In the Linux kernel, the JFS filesystem has an nlink overflow during rename. When a directory's nlink is at maximum (-1), renaming a subdirectory causes a wrap to 0 and triggers a warning.

In the Linux kernel, in the NTFS3 filesystem, errors returned by attr_set_size() when truncating files are silently ignored, which can leave the inode in an inconsistent state.

In the Linux kernel, the ASoC SOF driver for IPC4 topology has a memory allocation bug for bytes controls. The allocation did not account for the control structure size, leading to insufficient memory.

A race condition in the Linux kernel's rpmsg subsystem in driver_override_show() was found. It reads the driver_override string without holding the device_lock, while the store function frees it under that lock, leading to a use-after-free.

HCL BigFix RunBookAI is affected by a vulnerability related to unvalidated command input, which could allow unauthorized command execution. A flaw in a component's input handling was identified.

Apache Wicket has a vulnerability that exposes sensitive information to unauthorized actors. This affects versions from 8.0.0 to 8.17.0, from 9.0.0 to 9.22.0, and from 10.0.0 to 10.8.0.

A vulnerability has been identified in the Linux kernel within the netfilter module regarding safe access to the master conntrack object. The issue arises because this object can disappear, leading to invalid access.

W jądrze Linuxa zidentyfikowano podatność w module wifi: wl1251, która polega na braku walidacji identyfikatorów pakietów przed indeksowaniem tablicy tx_frames. Funkcja wl1251_tx_packet_cb() używa identyfikatora zakończenia z firmware'u bez weryfikacji, czy mieści się on w tablicy.

In the Linux kernel, in the SMB/CIFS client filesystem, an out-of-bounds read exists in the cifs_sanitize_prepath function. When called with an empty string or a string containing only delimiters, it attempts to check *(cursor2 - 1) before cursor2 advances, leading to an out-of-bounds read.

W jądrze Linuxa zidentyfikowano podatność związaną z funkcją roccat_report_event(), która iteruje po liście device->readers bez odpowiedniego zablokowania. Może to prowadzić do sytuacji use-after-free, gdy inny wątek usunie i zwolni czytnik w trakcie jego używania.

W jądrze Linuxa rozwiązano podatność związaną z walidacją indeksów bsscfg w zdarzeniach IF. Funkcja brcmf_fweh_handle_if_event() sprawdza indeks interfejsu dostarczony przez oprogramowanie układowe, ale nadal używa surowego pola bsscfgidx jako indeksu tablicy bez odpowiedniego sprawdzenia zakresu.