CVE Vulnerability Catalog

In the Linux kernel, wacom_wac_pen_serial_enforce() in the HID wacom driver may compute an invalid offset passed to hid_field_extract(), causing a read past the end of the report. The value is stored in wacom_wac->serial[0] and can reach userspace as an MSC_SERIAL event.

In the Linux kernel, mlx5e_ipsec_policy_mask() in the net/mlx5e driver builds masks for IPv6 XFRM policies, but setup_fte_addr6() installs each mask in the opposite address field. When source and destination prefix lengths differ, the hardware rule can miss traffic covered by the policy and match traffic outside it.

In the Linux kernel, the openvswitch conntrack module can modify a shared unconfirmed ct entry. When a cloned skb with an unconfirmed ct entry is committed, differing extension sets cause a use-after-free on the destruction path.

In the Linux kernel, the bridge mdb module has a use-after-free due to a stale cursor after port group deletion. br_mdb_flush_pgs() can point to freed memory, exposed by a subsequent RTM_GETMDB.

In the Linux kernel, the netfilter ip6t_rt module has an out-of-bounds read in non-strict zero-address matching. When a rule has rtinfo->addrnr == 0, a crafted IPv6 packet can cause the index to go past struct ip6t_rt.

In the Linux kernel, the Data-In branch of iscsi_tcp_hdr_dissect() in libiscsi_tcp copies the PDU's data segment into the command's scatterlist without checking whether the command was a read. A malicious iSCSI target can answer a WRITE command's ITT with a Data-In frame and overwrite pages the initiator was about to send.

In the Linux kernel, KVM SEV did not manually perform cache maintenance on the source VM during intra-host migration. After the source VM was destroyed, stale data could remain in CPU caches because KVM's memory reclaim flows would not trigger cache maintenance.

In the Linux kernel, KVM for arm64 had the consolidation of breakpoint and watchpoint register accessors switch DBGBXVR<n> from trap_bvr() to trap_dbg_wb_reg(). Because DBGBXVR<n> uses Op2 value 1, an AArch32 guest access hit KVM_BUG_ON() and marked the VM dead.

In the Linux kernel, KVM for arm64 had fix_host_ownership() walk only the linear-map alias of each memblock region. The per-CPU hypervisor stack, mapped in the private VA range for its guard page, had no such alias and was not covered by that walk.

In the Linux kernel, RISC-V KVM does not serialize IMSIC attribute operations against vCPU migration. kvm_riscv_aia_imsic_rw_attr() can snapshot stale physical CPU and HGEI data before a concurrent vCPU migration, so a GET or SET attribute may access the new owner's interrupt file.

In the Linux kernel Bluetooth mgmt, read_unconf_index_list() counts unconfigured controllers before allocating its response, then rechecks device flags while filling it. During asynchronous controller setup, the worker can set HCI_UNCONFIGURED and clear HCI_SETUP between the two passes, so a controller omitted from the count becomes eligible for the fill pass, causing an out-of-bounds write to rp->index[].

In the Linux kernel SMB client, smb2_parse_contexts() validates the complete create-context area but does not limit each record to its Next field before dispatching it to a handler. A malformed chain can expose bytes beyond the current context, and the lease parsers read fields at canonical offsets rather than at DataOffset.

In the Linux kernel SMB client, an O_CREAT open can find an existing symlink or another non-regular inode. cifs_atomic_open() calls finish_open() on it and attaches a cifsFileInfo, but symlink inodes have no CIFS release operation, so the dentry reference held by cifsFileInfo is leaked, and FMODE_OPENED prevents the VFS from following the symlink.

In the Linux kernel, xlog_recover_iunlink_bucket (XFS subsystem) has multiple bugs: it does not null out prev_ip after releasing it (use-after-free risk), leaks @ip on inodegc flush failure, and mis-sets prev_agino and i_prev_unlinked, introducing loops into the unlinked list.

In the Linux kernel, net/sched act_ct stores a raw pointer to the extensions area in the expectations list before the connection is confirmed. Later *_ext_add() calls reallocate that area, leaving an invalid pointer that is accessed when removing the expectation, causing a use-after-free.

A use-after-free vulnerability was found in the Linux kernel's net/sched act_ct module. When an skb with an unconfirmed conntrack entry is cloned, both clones may process the same shared entry, modifying expectation list pointers and causing a UAF on the destruction path. The issue primarily affects NAT without commit.

In the Linux kernel, KVM for arm64 (nv) frees shadow S2 structures in kvm_arch_flush_shadow_all(), which can free a container still referenced elsewhere. The fix delays freeing these structures until VM destruction.

In the Linux kernel, the accel/amdxdna driver did not disable exporting of device buffers, which were never intended to be exported. The fix explicitly disables export support for these buffers.

A weakness has been identified in kishan0725 Hospital Management System up to 777fda46b77a820977a5ba616283dbfbc40bf7e1. This affects the mysqli_query function of the admin-panel.php file of the Appointment Cancellation Handler component. Manipulation of the ID argument leads to SQL injection. The attack may be launched remotely, and the exploit has been made available to the public.

JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. A (?{ ... }) code block in the pattern passed to test(), match(), or the match and =~ conditions of select() runs without requiring use re 'eval', allowing arbitrary Perl code execution.