CVE Vulnerability Catalog

In the igbvf driver, there is a memory leak in TX DMA error cleanup. Due to an off-by-one error, if some mappings succeed and then an error occurs, one DMA mapping (the head) is not unmapped, causing a leak.

A use-after-free vulnerability was found in the Linux kernel's SMC network module during link group termination. The issue arises from insufficient socket protection against concurrent close, potentially leading to memory corruption.

In the Linux kernel, the bridge module has a bug in br_multicast_leave_group() that can lead to a use-after-free after deleting a port group during fast-leave multicast handling.

In the Linux kernel, the UML vector driver has a use-after-free bug in vector_mmsg_rx() when a packet with an invalid header is discarded. The freed skb remains in the buffer, leading to double-free and potential exploitation.

In the Linux kernel, the veth interface has a vulnerability in handling frag_list skbs before running XDP. Frag_list skbs can have data_len set but empty frags[], leading to bogus XDP fragment metadata and a crash in AF_XDP copy mode.

In the Linux kernel, the vxlan module's route_shortcircuit() function reads the neighbour hardware address n->ha without holding the seqlock, which can lead to torn reads or partially updated MAC addresses.

In the Linux kernel, the vxlan module's vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get() functions use pskb_may_pull() instead of pskb_network_may_pull(), which does not account for the MAC header offset and can leave part of the network header in non-linear frags.

In the Linux kernel, the vxlan module's route_shortcircuit() function uses pskb_may_pull() instead of pskb_network_may_pull(), which does not account for the MAC header offset and can lead to reading beyond the pulled linear buffer when accessing IP header fields.

In DBI for Perl before version 1.652, a heap out-of-bounds write occurs via an unvalidated numeric placeholder that sets the binder counter in preparse. A crafted statement can cause a write beyond the allocated buffer.

In DBI for Perl before version 1.652, a heap out-of-bounds write occurs on 32-bit Perl due to integer wraparound in the output buffer size computed by preparse. A very long statement can cause a write beyond the allocated buffer.

The TrueBooker plugin for WordPress up to version 1.2.6 is vulnerable to account takeover. The add_front_user_update() AJAX handler is registered for unauthenticated users and accepts an arbitrary truebooker_wp_user_id value, which is passed directly to wp_update_user() without verifying authentication or ownership. This allows unauthenticated attackers to change any user's email address, including an administrator's, and then use the native password reset flow to take over the account.

The User Profile Builder plugin for WordPress up to version 3.16.4 is vulnerable to authentication bypass via type confusion. The wppb_log_in_user() function calls absint() on the return value of wp_insert_user() before performing an is_wp_error() check. When a registration is submitted with a 61–70 character username, WordPress rejects it with a WP_Error object, but absint() coerces that object to the integer 1, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This allows unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover.

In the Linux kernel's iommu/vt-d subsystem, the Present bit is not cleared before tearing down a scalable-mode context entry, creating a window where hardware can fetch a torn entry, leading to unpredictable behavior or spurious faults. The issue affects device_pasid_table_teardown(), which was not aligned with a previous fix.

In the Linux kernel's rxrpc subsystem, lack of synchronization between rxrpc_kernel_charge_accept and socket teardown can lead to use-after-free. A concurrent rxrpc_discard_prealloc can free the rxrpc_backlog structure while a preallocation worker still uses it.

In the Linux kernel's rxrpc subsystem, when reading an OOB message with MSG_PEEK, the message is moved to the pending_oobq queue even though it should not be removed from the queue. This leads to double-free and use-after-free, potentially causing memory corruption.

In the Linux kernel's rxrpc subsystem, rxgk_issue_challenge() frees the page containing the challenge content after invoking the tracepoint, but the whdr pointer passed to the tracepoint points into the just-freed page, leading to use-after-free.

In the Linux kernel, the rxrpc subsystem fixed a double unlock in rxrpc_recvmsg() when handling OOB messages.

In the Linux kernel, the AFS subsystem fixed a netns teardown issue to cancel the preallocation charger. afs_charge_preallocation() skips charging when net->live is false, and afs_rx_new_call() avoids requeuing the charger.

In the Linux kernel, vxlan_gro_prepare_receive() has a potential null pointer dereference when sk_user_data is set to NULL during execution. This could lead to a system crash.

In the Linux kernel, the DLM module has an issue with the ordering of message handles in the send_queue, which can lead to refcounting issues and use-after-free. An attacker could exploit this to crash the system.