CVE Vulnerability Catalog

In the Linux kernel, the qla2xxx SCSI driver has a memory leak in the error path where the sp object is not freed. This leaves objects in the 'qla2xxx_srbs' slab cache and causes a system crash during module unload (rmmod).

In the Linux kernel, the rtw88 wifi driver's rtw_core_enable_beacon() function reads 4 bytes from an address that is not 4-byte aligned, causing an alignment fault and kernel crash (Oops) on some systems. The fix replaces the 4-byte read/write with 1-byte operations.

In the Linux kernel, a vulnerability was resolved in riscv: trace, causing a snapshot deadlock due to sbi ecall calls. If functions in sbi_ecall.c are traceable, a ringbuffer snapshot triggers an IPI interrupt, which calls __sbi_ecall again and another snapshot, creating an endless loop. This is easily triggered on RISC-V systems without the SSTC extension due to periodic sbi ecalls from timer-riscv.c.

In the Linux kernel, a bug in the btrfs filesystem allows a new transaction to be started on a filesystem mounted with rescue options, even though it is fully read-only. During unmount, inode eviction can trigger a new transaction, causing warnings and transaction abort on heavily corrupted filesystems. The fix rejects new transactions if the filesystem has rescue mount options.

In the Linux kernel, the drm/amd/pm driver has an issue during SMU Mode 1 reset when the ASIC becomes temporarily inaccessible over PCIe. Accessing MMIO registers during this window can cause uncompleted PCIe transactions, leading to NMI panics or system hangs. The fix sets the no_hw_access flag immediately after triggering the reset and adds an smp_mb() memory barrier.

In the Linux kernel bonding module, data races exist around slave->last_rx and slave->target_last_arp_rx fields, which are read and written without locks. The fix adds READ_ONCE() and WRITE_ONCE() annotations for safe access.

In the Linux kernel's wifi: mac80211 subsystem, a WARN is triggered when attempting to connect on an invalid channel. This can occur, for example, when regulatory changes disable a channel between scanning and connecting. The fix replaces the warning with a more informative error message.

In the Linux kernel md subsystem, an issue occurs when updating raid_disks via sysfs in raid1_reshape(). freeze_array() may unblock before r1bios queued due to I/O errors are released, leading to mismatched sizes and potential out-of-bounds access in free_r1bio(). The fix suspends the array while updating raid_disks via sysfs.

Podatność CVE-2025-8308 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w systemie INFOREX - General Information Management System, co pozwala na ataki typu XSS poprzez nagłówki HTTP. Problem ten dotyczy wersji systemu od 2025 roku i wcześniejszych do 18 lutego 2026 roku.

W Wispotter, produkcie firmy Doruk Communication and Automation Industry and Trade Inc., występuje podatność związana z niewłaściwym ograniczeniem nadmiernych prób uwierzytelnienia, co umożliwia ataki typu brute force na hasła. Problem dotyczy wersji od 1.0 do przed v2025.10.08.1.

W podatności CVE-2025-7706 w oprogramowaniu Liderahenk występuje brak uwierzytelnienia dla krytycznej funkcji, co umożliwia zdalne włączenie kodu. Problem dotyczy wersji Liderahenk od 3.0.0 do 3.3.1 przed 3.5.0.

Podatność CVE-2025-8303 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w skrypcie nieruchomości EKA Software. Umożliwia to ataki typu Cross-Site Scripting (XSS).

Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, and 11.2.x <= 11.2.1 fail to properly validate team membership when processing channel mentions. This allows authenticated users to determine the existence of teams and their URL names by posting channel shortlinks and observing the channel_mentions property in the API response. Advisory ID: MMSA-2025-00563.

Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, and 11.2.x <= 11.2.1 fail to sanitize sensitive data in WebSocket messages. This allows authenticated users to exfiltrate password hashes and MFA secrets via profile nickname updates or email verification events. Advisory ID: MMSA-2025-00560.

Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, and 11.2.x <= 11.2.1 fail to properly validate login method restrictions. An authenticated user can bypass SSO-only login requirements via userID-based authentication.

In the Linux kernel, the ice driver (Intel E800 NIC) has a race condition during VSI rebuild. PTP periodic work is queued before the VSI rebuild completes, causing a NULL pointer dereference on vsi->rx_rings and a kernel oops.

In the Linux kernel, the spi: tegra210-quad driver has a race in the curr_xfer check in the IRQ handler. The ISR thread checks curr_xfer outside the lock, while the timeout path can set it to NULL, leading to a NULL dereference. The fix synchronizes all curr_xfer accesses and adds a NULL check inside handlers after acquiring the lock.

In the Linux kernel, the dpaa2-switch driver was fixed to prevent ZERO_SIZE_PTR dereference when num_ifs is zero. When the device reports zero interfaces, kcalloc(0, ...) returns ZERO_SIZE_PTR (0x10) instead of NULL, and dpaa2_switch_probe() unconditionally accesses ethsw->ports[0]->netdev, causing a kernel panic. The fix adds a check that num_ifs is greater than zero.

In the Linux kernel's spi: tegra210-quad driver, the curr_xfer field is read by the IRQ handler without holding the lock, creating a race condition that can lead to NULL pointer dereference or use-after-free. The fix protects curr_xfer clearing with the spinlock in tegra_qspi_combined_seq_xfer().

In the Linux kernel, in the Ceph filesystem, there is a bug causing an oops (kernel crash) when reading snapshot directories (.snap). The variable str is guarded by __free(kfree), but it is advanced by one to skip the initial '_' in snapshot names, causing kfree() to be called with an invalid pointer.