CVE Vulnerability Catalog

A stack-based buffer overflow exists in the ims_registrar_pcscf module of Kamailio v6.1.3 and v6.1.4. When processing a crafted application/reginfo+xml NOTIFY message, process_contact() copies an attacker-controlled port value from the alias parameter into a fixed 5-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger stack corruption and terminate the P-CSCF process, resulting in denial of service.

kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. This is due to an unanchored regular expression in the ACR credential helper that accepts hostnames containing .azurecr.io, .azurecr.cn, .azurecr.de, or .azurecr.us.

In the Linux kernel, a race between fallocate and mmap reads in NTFS was fixed. Fallocate only took invalidate_lock for punch hole, collapse range and insert range operations, and during standard allocation new clusters were mapped before being zeroed, allowing concurrent mmap page faults to read uninitialized disk data.

In the Linux kernel, a missing lock in ntfs_filemap_page_mkwrite() was fixed; it called iomap_page_mkwrite() without holding mapping->invalidate_lock. A concurrent truncate or fallocate could be invalidating pagecache and rewriting the runlist while the write fault mapped blocks and dirtied the folio.

In the Linux kernel, the DAMON subsystem (mm/damon/core) has a division-by-zero bug when a DAMOS quota goal has a target_value of zero. The fix moves handling of this corner case to the core layer by adding validation in damos_commit_quota_goal(), which now returns an error for zero target values.

A TOCTOU race in the Linux kernel Bluetooth L2CAP subsystem allowed an l2cap_chan to be linked to an l2cap_conn more than once, violating an invariant assumed during cleanup. The fix adds an invariant check in __l2cap_chan_add and a l2cap_lock_chan guard in l2cap_sock_bind().

A use-after-free in the Linux kernel tracing subsystem: trace_module_record() walks ftrace_trace_arrays from the module notifier without trace_types_lock, while a concurrent rmdir of an instance removes and frees it under that lock. A module load or unload can therefore walk into a freed trace_array.

A double-free/use-after-free in the Linux kernel tracing subsystem: update_last_data_if_empty() is called from tracing_open() with O_TRUNC, tracing_read_pipe() and tracing_buffers_read() without trace_types_lock. Two readers can both pass the LAST_BOOT test and free module_delta twice, and a module notifier can update module_delta while it is being freed.

A Linux kernel tracing vulnerability: incomplete event filter expressions (e.g., ending with a logical operator) left unresolved operator state, causing an out-of-bounds read (prog[-1]) or copying an out-of-bounds word into a branch target. This could be reached via PERF_EVENT_IOC_SET_FILTER on a self-targeted perf tracepoint counting event.

A use-after-free in the Linux kernel tracing/histograms subsystem: create_field_var_hist() saved a pointer to a compatible histogram (hist_data) rather than the one it created. Since find_compatible_hist() matches on keys alone, the user could remove that histogram while the target still pointed at it, leading to a use-after-free in event_hist_trigger_free().

In the Linux kernel tracing subsystem, a failed hist command that creates a field variable histogram leaves a registered trigger without a corresponding entry in field_var_hists[]. As a result, the trigger remains active and keeps counting even though the operation failed with -EINVAL, causing a resource leak and inconsistent state.

A use-after-free in the Linux kernel tracing/histograms subsystem: find_synth_event() compared only the event basename, so registering or removing a histogram on a non-synthetic event whose basename matched a synthetic event erroneously modified the synthetic event's refcount. This could free the synthetic event while an active histogram action still held a pointer to it.

In the Linux kernel, syscall_copy_user_array() was fixed to use copy_from_user() instead of __copy_from_user() when copying the buffer argument of faultable syscalls (write, pwrite64, etc.). Skipping access_ok() allowed a non-user address to be accepted.

In the Linux kernel's io_uring waitid implementation, a use-after-free occurs. io_waitid_wait() clears ->head before taking ownership of the request by incrementing ->refs, allowing another thread to complete and free the request while the wake-up handler still touches it.

In the Linux kernel, io_uring_cmd_del_cancelable() was fixed to not leave LIST_POISON in ->hash_node; it used hlist_del(). Requests are recycled without reinitialisation and not every user of ->hash_node sets it up before use, leading to a write through LIST_POISON2 and a general protection fault.

In the Linux kernel, a spin in io_cqring_wait_schedule() was fixed when IO_CHECK_CQ_OVERFLOW_BIT is set and the overflow list cannot be flushed. The task spins in the kernel and cannot be killed, e.g. with IORING_SETUP_CQE_MIXED or when the application moves the CQ head.

A bug was fixed in the Linux kernel's io_uring/io-wq where the signal ending work could be lost. When a thread exits, its io-wq is torn down and workers are signalled, but a worker that had not yet started the work could lose the signal. This caused the thread to hang in do_exit(), e.g. with IORING_OP_OPENAT of a FIFO without a writer and IOSQE_ASYNC.

In the Linux kernel, the io_uring/waitid mechanism has a reference counter bug where repeated failed cancellation attempts can wrap the 31-bit reference field to zero. A later cancellation can then claim ownership and complete the request a second time.

A use-after-free flaw was fixed in the Linux kernel's find_keyring_by_name() during named keyring lookup. The function read keyring->user->uid under keyring_name_lock, which does not protect the separate key_user object, so a concurrent KEYCTL_CHOWN could free the old key_user between the pointer load and the UID read. The fix uses the inline keyring->uid field instead of dereferencing the owner account.

A vulnerability exists in the Linux kernel's search_process_keyrings_rcu() function, which validates the authorization payload and saved credentials. Due to a race condition between a request-key helper's descendant and the requester, request_key_auth_revoke() can clear the payload pointer, leading to a NULL dereference and kernel oops.