CVE Vulnerability Catalog

absinthe_plug versions 1.2.0 to before 1.5.10 contain a reflected XSS vulnerability in the GraphiQL interface. The js_escape/1 function does not escape backslashes, allowing bypass of escaping and execution of arbitrary JavaScript in the victim's browser.

i18next-locize-backend interpolates lng, ns, projectId, and version directly into URL templates with no path-component validation and no encoding. When an application exposes these values to user-controlled input, a crafted value can change the structure of the outgoing request URL.

Marko is a declarative, HTML-based language for building web apps. Prior to marko version 5.38.36 and prior to @marko/runtime-tags 6.0.164, when dynamic text is interpolated into a <script> or <style> tag the Marko runtime failed to prevent tag breakout when the closing tag used non-lowercase casing. An attacker able to place input inside a <script> or <style> block could break out of the tag with </SCRIPT>, </Style>, etc. and inject arbitrary HTML/JavaScript, resulting in cross-site scripting. This issue has been patched in marko version 5.38.36 and @marko/runtime-tags 6.0.164.

Prior to zebrad 4.4.0, zebra-chain 7.0.0, and zebra-network 6.0.0, several inbound deserialization paths in Zebra allocated buffers sized against generic transport or block-size ceilings before tighter protocol or consensus limits were enforced. An unauthenticated or post-handshake peer could force the node to preallocate and parse orders of magnitude more data than intended, across headers messages, equihash solutions in block headers, Sapling spend vectors in V5/V4 transactions, and coinbase script bytes in blocks.

A bug was fixed in the Linux kernel storvsc (Hyper-V) driver that caused a scheduling-while-atomic error with PREEMPT_RT enabled. This led to a system lock-up during I/O operations on a Hyper-V virtual machine.

A crash occurs in the Linux kernel scsi mpi3mr driver during resource cleanup when the request and reply queues are NULL due to freed memory. This happens when queue creation fails, memory is freed first, and then an attempt is made to set its content. The fix adds NULL checks before accessing the queues.

In the Linux kernel, a bug in unshare_fs() handling was fixed for unshare(2) with CLONE_NEWNS when current->fs was not shared. In that case, copy_mnt_ns() received the current fs instead of a private copy, potentially leaving the process with pwd and root on detached mounts after a failed unshare(2).

In the Linux kernel, the net/mlx5 module has a deadlock between the devlink lock and the esw->wq workqueue. When changing the eswitch mode (eswitch_mode_set), flushing the workqueue can deadlock if the esw_vfs_changed_event_handler is concurrently trying to acquire the devlink lock. The fix avoids flushing the workqueue and uses a generation counter to track work relevance.

The Linux kernel rxrpc and afs code lacks an error pointer check after rxrpc_kernel_lookup_peer(). The function can return error pointers in addition to NULL, so checking only for NULL is insufficient. The fix makes the function return -ENOMEM on allocation failure and updates afs callers to use IS_ERR() and PTR_ERR().

In the Linux kernel netfilter (nfnetlink_queue) subsystem, nfqnl_recv_verdict() removes the queue entry via find_dequeue_entry() and then, for PF_BRIDGE packets, calls nfqa_parse_bridge(). If parsing returns an error, the function returns without freeing the dequeued entry and its sk_buff, causing a memory and reference leak. Repeated triggering exhausts kernel memory.

In the Linux kernel, a race condition exists in nvme_poll_irqdisable() in the nvme-pci driver. If the device is disabled by nvme_reset_work() between disable_irq() and enable_irq(), pdev->msix_enabled is set to 0, causing pci_irq_vector() to return a different IRQ number for each call, which results in an unbalanced enable_irq() and a kernel warning (WARNING: Unbalanced enable for IRQ).

The runtime suspend callback in accel/amdxdna drains the running job workqueue before suspending the device. If a job is still executing and calls pm_runtime_resume_and_get(), it can deadlock with the runtime suspend path. The fix moves pm_runtime_resume_and_get() from the job execution routine to the job submission routine.

In the Linux kernel e1000/e1000e drivers, there is an off-by-one error in DMA error cleanup when mapping TX buffers. Decrementing count before the while loop in dma_error causes exactly one DMA mapping to leak if any mapping succeeded before a failure. The issue may still exist in the igbvf driver.

In the Linux kernel drm/amdkfd driver, the queue update error handling path does not unreserve the buffer object (bo). The fix ensures that if queue update fails, the bo reservation is released before returning the error.

In the Linux kernel, the acp_card_rt5682_init() and acp_card_rt5682s_init() functions did not check the return values of clk_get(). This could lead to a kernel crash when the invalid pointers are later dereferenced by clock core functions.

A race condition between task migration and iteration in the Linux kernel cgroup subsystem has been fixed. When a task is migrated out of a css_set, css_task_iter could be advanced relative to the mg_tasks list instead of the original tasks list, causing remaining tasks to be skipped during iteration (e.g., cgroup.procs may omit some PIDs). The fix calls css_set_skip_task_iters() before unlinking the task from cset->tasks.

In the Linux kernel ALSA usb-audio driver, the Scarlett2 quirk may hit a NULL dereference when a malformed USB descriptor is passed, because scarlett2_find_fc_interface() assumes an endpoint is present in the parsed interface. The fix adds a bNumEndpoints sanity check and skips the invalid interface.

In the Linux kernel USB xhci driver, xhci_disable_slot() error handling only frees the command structure via kfree(), missing the associated completion structure allocated by xhci_alloc_command(). This causes a memory leak. The fix uses xhci_free_command() to free both structures.

In the Linux kernel USB usbtmc driver, user-specified timeout values from an ioctl are used in usb_bulk_msg() calls, which use unkillable waits. A user can specify arbitrarily long timeouts and hang a kernel thread indefinitely. The fix switches to usb_bulk_msg_killable().

In the Linux kernel usbcore, the usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs allow unlimited timeout durations using uninterruptible waits, which can hang a task indefinitely. The fix enforces a maximum limit of 60 seconds for these timeouts and treats negative values as 0 (the maximum allowed timeout).