CVE Vulnerability Catalog

In the Linux kernel, the next hop weight was increased from 8 bits to 16 bits to support larger ECMP weight ratios in CLOS networks. The change repurposed the reserved field resvd1 in the nexthop_grp structure to store high-order weight bits.

The datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability. Attackers controlling input schemas can achieve remote code execution by supplying a malicious customBasePath value with embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated 'from ... import ...' statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.

The Fluent Forms Pro Add On Pack plugin for WordPress up to version 6.2.6 is vulnerable to PHP Object Injection via deserialization of untrusted input. Authenticated attackers with Subscriber-level access or above can inject a PHP Object. The presence of a POP chain allows changing user passwords and potentially taking over administrator accounts. Exploitation is only possible if user update integration is enabled and a user meta field is mapped.

In the Linux kernel, the unused character device and IOCTLs in the QAT driver have been removed, reducing the attack surface. Device management is already handled via sysfs.

In the Linux kernel DRM Hyper-V driver, the resolution_count field in SYNTHVID_RESOLUTION_RESPONSE was not validated, potentially causing an out-of-bounds read of the supported_resolution array. Also, when the WIN10 resolution probe failed, screen_*_max / preferred_* were left unset, causing all userspace framebuffers to be rejected.

In the mlx5e driver in the Linux kernel, during handling of temporary SAs (acquire SA) in IPsec, the eswitch mode block was skipped, but the success label called unblock, causing an underflow of the num_block_mode counter.

In the arm_ffa firmware in the Linux kernel, the register-based PARTITION_INFO_GET_REGS path trusted firmware-provided indices, potentially allowing writes past the allocated array when copying partition descriptors.

In the DRM AMDGPU driver in the Linux kernel, for VCE 1, the VCPU BO size did not account for the offset where the firmware resides, potentially causing an out-of-bounds read. Also, stack and data were not aligned to the 32K TLB size, and firmware was not checked to fit in the reserved space.

In the Linux kernel mac80211 subsystem, the MLE (Multi-Link Element) defragmentation routine was called with a pointer to the defragmented copy but the original elements, potentially causing a heap over-read if the original frame was at a higher address.

In the Linux kernel, a use-after-free vulnerability was found in the ACPI NFIT driver. The error cleanup in acpi_nfit_init() fails to remove the acpi_desc object from the acpi_descs list, leading to a dangling pointer that can be accessed during subsequent Machine Check Exceptions (MCE), causing a use-after-free condition.

In the Linux kernel, the ad_sigma_delta driver for registerless ADC devices (has_registers=false) without rdy_gpiod, the ad_sigma_delta_clear_pending_event() function may read conversion data instead of status, corrupting the data stream. Additionally, when num_resetclks=0, a memset with negative size causes a heap overflow.

In the ad_sigma_delta ADC driver in the Linux kernel, issues were found with CS (chip select) being left asserted and SPI bus lock state leaks. In ad_sigma_delta_single_conversion(), set_mode() and disable_one() are called while keep_cs_asserted is still true, leaving CS active after conversion. Additionally, in the error path of ad_sd_buffer_postenable(), the device may remain in continuous conversion mode with CS asserted, and the bus_locked flag may stay set, allowing concurrent SPI access.

A race condition in the Linux kernel's IIO event FIFO reset allows a concurrent thread to read from the FIFO during reset, causing an out-of-bounds read and kernel memory leak to userspace.

In the ALSA virtio-snd driver, control metadata from the device is not validated, allowing a malicious device to cause out-of-bounds access.

In the ALSA compress driver, snd_compr_task_new() leaks driver resources on error after successful task_create() and may incorrectly report success due to uninitialized retval.

In the Linux kernel's ALSA hda/cs35l41 driver, there is a teardown issue with firmware load work. ALSA controls are not removed on component unbind, and fw_load_work may be cancelled only conditionally. If the component or device is removed before the queued work runs, a use-after-free can occur.

In the Linux kernel's vfio/pci driver, after a reorder in vfio_pci_core_register_device(), the VGA arbiter client registration is not unwound on failure. This can leave a callback with a freed vdev cookie, which becomes unsafe when the callback follows drvdata to the vfio device.

A use-after-free (UAF) vulnerability was found in the Linux kernel's binder_thread_release() function. A race condition between thread exit and concurrent transaction freeing can lead to accessing freed memory.

A use-after-free vulnerability was found in the Linux kernel's binder_free_transaction() function in the Binder driver. The issue occurs because the target process pointer (t->to_proc) is read under a lock, but after the lock is released, the process can be freed, leading to access to freed memory.

In the Linux kernel rust_binder driver, an incorrect stride (usize instead of u64) is used when cleaning up the offsets array. On 32-bit kernels, this causes over-decrement of reference counts and corrupted reference accounting.