CVE Vulnerability Catalog

A vulnerability related to array access in the hwmon module for the tps53679 chip has been fixed in the Linux kernel. The issue occurred when the i2c_smbus_read_block_data() function returned 0, leading to out-of-bounds read on the stack.

An issue was discovered in the VRML V2.0 parser in Open CASCADE Technology (OCCT) V8_0_0_rc5 that allows attackers to cause a denial of service via a crafted VRML file. The issue occurs because malformed VRML input can trigger dereference of a corrupt or unvalidated pointer during shape construction.

CVE-2026-42477 describes a heap-based out-of-bounds read vulnerability in the RWObj_Reader::read function in the OBJ file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5. This vulnerability can be exploited by user-assisted attackers persuading a victim to open a crafted OBJ file, potentially leading to denial of service or exposure of sensitive information.

Two heap-based out-of-bounds read vulnerabilities exist in the STL ASCII file parser in Open CASCADE Technology (OCCT) V8_0_0_rc5. These issues arise from improper length validation of buffers before data access, potentially leading to denial of service or information disclosure.

A vulnerability in the Linux kernel related to the container_of operation in the intel_pmu_hw_config function has been fixed. The issue could lead to out-of-bounds memory reads when software events are present in a group of events.

A vulnerability has been identified in the Linux kernel that leads to a slab-out-of-bounds read in the io_bundle_nbufs() function. The issue arises from improper storage of length values, resulting in overflow and an infinite loop.

In the Linux kernel, the ti-adc161s626 ADC driver used stack memory for spi_read(), which is not DMA-safe. A dedicated DMA-safe buffer has been added, and conversion functions updated accordingly.

A vulnerability has been identified in the Linux kernel regarding the validation of the doorbell_offset parameter during user queue creation in amdgpu. Lack of proper bounds checking may lead to corruption of the doorbell space in the kernel.

A vulnerability has been identified in the Linux kernel that allows out-of-bounds access to the odr_table array in the st_lsm6dsx_hwfifo_odr_store() function. This issue occurs when a user attempts to set the buffer sampling frequency for sensors other than the accelerometer or gyroscope.

In the Linux kernel, the MPU3050 gyroscope IIO driver called iio_device_register() before completing device initialization, potentially causing race conditions. The fix moves registration to the end of the probe function and adjusts unregistration accordingly.

A vulnerability has been identified in the Linux kernel related to a double free in the reset_add_gpio_aux_device() function on error. The issue occurs when __auxiliary_device_add() fails, leading to improper resource deallocation.

A vulnerability has been identified in the Linux kernel related to incorrect buffer size in DMA allocation and memcpy in zynqmp_nvmem. This flaw may lead to undersized DMA buffer access and potential memory corruption.

A vulnerability has been identified in the Linux kernel that occurs when switching to an alternate screen after resizing. The issue is that the old Unicode buffer is not properly discarded, leading to memory errors when restoring the screen state.

A vulnerability has been identified in the tegra crypto driver in the Linux kernel, which involved the failure to set the CRYPTO_ALG_ASYNC flag for asynchronous algorithms. This led to the crypto API selecting these algorithms for users requesting only synchronous algorithms, potentially causing crashes.

A vulnerability in the Linux kernel related to the unmap function was identified, which can unmap more than requested if the endpoint lands within the middle of a large or contiguous IOPTE. This issue has been resolved with a fix that ensures all unmapped areas are properly flushed.

A vulnerability has been identified in the Linux kernel's krb5enc function that allows bypassing integrity verification during asynchronous decryption. The issue is that upon completion of the skcipher operation, it signals 'done' without performing hash verification.

W jądrze Linuxa zidentyfikowano podatność w ksmbd, która nie weryfikuje, czy użytkownik próbujący ponownie połączyć się z trwałym uchwytem jest tym samym użytkownikiem, który pierwotnie otworzył plik. To umożliwia każdemu uwierzytelnionemu użytkownikowi przejęcie osieroconego trwałego uchwytu poprzez przewidywanie lub łamanie identyfikatora.

W jądrze Linuxa zidentyfikowano podatność polegającą na braku walidacji wartości rec->used podczas sprawdzania rekordów plików w dzienniku. To może prowadzić do niebezpiecznego kopiowania dużych ilości pamięci do bufora o rozmiarze 4 KB.

A use-after-free (UAF) vulnerability has been identified in the Linux kernel within the f2fs_write_end_io() function, which may lead to a NULL pointer dereference. The issue occurs in a concurrent scenario, potentially resulting in system panic.

A vulnerability has been identified in the Linux kernel within the smb_check_perm_dacl() function, allowing for out-of-bounds (OOB) reads due to improper ACE size validation. An attacker can exploit this flaw to access memory, potentially leading to kernel state corruption.