CVE Vulnerability Catalog

In the Linux kernel i2c-qcom-cci driver, a NULL pointer dereference occurs during driver removal when the CCI controller has two I2C masters but only one is initialized. Calling cci_halt() on the uninitialized master causes a kernel crash.

In the Linux kernel, the airoha network driver lacks a NULL check for of_reserved_mem_lookup(). If the 'memory-region' node in the device tree (DTS) is misconfigured or removed, the function returns NULL and its result is directly dereferenced, causing a NULL pointer dereference and kernel panic.

In the Linux kernel bonding driver, a NULL pointer dereference vulnerability exists in bond_do_ioctl(). The slave_dbg() call before the NULL check for slave_dev causes a kernel panic when a non-existent slave interface is used via ioctl.

A vulnerability in the Linux kernel's nvmem driver for ONIE-TLV layouts causes an infinite loop hang when encountering an unknown entry type (e.g., 0x41). The fix ensures offset incrementation for unknown types to break the loop.

In the Linux kernel, the DAMON_LRU_SORT module has a vulnerability due to missing error handling for damon_ctx allocation. The damon_lru_sort_enabled_store() function assumes allocation always succeeds, leading to a NULL pointer dereference when allocation fails.

In the Linux kernel, a vulnerability in DAMON_RECLAIM causes a NULL pointer dereference when damon_ctx allocation fails, as damon_reclaim_enabled_store() assumes the allocation always succeeds. This can lead to system crashes.

In the Linux kernel, mincore_swap() incorrectly checked the !CONFIG_SWAP guard before handling non-swap entries (migration, hwpoison, shmem errors). This caused spurious WARN messages and incorrect reporting of pages as non-resident on !CONFIG_SWAP builds with CONFIG_MIGRATION or CONFIG_MEMORY_FAILURE enabled.

In the Linux kernel's slimbus qcom-ngd-ctrl driver, callbacks are registered before the NGD structure is fully initialized. When remoteproc starts in parallel with NGD driver probing, these callbacks may operate on uninitialized data, causing system crashes.

In the Qualcomm slimbus driver (qcom-ngd-ctrl), a potential deadlock was found due to an ABBA locking order between tx_lock and ctrl->lock. During SSR/PDR down notification, tx_lock is acquired before ctrl->lock, while other code paths take them in reverse order, leading to a possible system hang.

In the Linux kernel, an out-of-bounds read vulnerability was found in the AMD/Display driver in the dp_get_eq_aux_rd_interval() function. The aux_rd_interval array in struct dc_lttpr_caps has 7 elements, but the offset parameter can be 8 when a sink reports 8 LTTPR repeaters, causing a read beyond allocated memory.

In the Linux kernel, the AMD/Display driver has a vulnerability in the dal_vector_reserve() function where uint32_t arithmetic can overflow, causing a small buffer allocation and subsequent heap overflow. The fix replaces krealloc() with krealloc_array() which includes overflow detection.

A WARN warning was triggered in the Linux kernel's scx_cgroup_move_task() function during task migration by the sched_ext scheduler. The issue occurs when systemd modifies subtree_control and cgrp_moving_from is NULL, which is a legitimate scenario, not a bug. The patch removes this warning while preserving the correct pairing of ops.cgroup_prep_move() and ops.cgroup_move() calls.

In the Linux kernel, a vulnerability was found in the debugobjects mechanism. The fill_pool() function on RT-enabled kernels calls rtlock_lock(), which asserts if current::pi_blocked_on is set, because a task can only block on one lock to avoid corrupting the priority inheritance chain.

A vulnerability in the Linux kernel's debugobjects mechanism triggers a lockdep inconsistency warning during early boot on PREEMPT_RT systems. The issue occurs when hardware interrupts fire before the scheduler is enabled, and attempting to fill the object pool in hardirq context can lead to a deadlock.

The pretix-oppwa plugin insecurely concatenated the resourcePath parameter with the API URL, allowing an attacker to redirect requests to their own server and steal the Oppwa access token. The vulnerability is fixed by strictly validating API URLs.

A vulnerability in allegroai/clearml versions up to 1.16.5 allows relative path traversal when extracting .zip archives using ZipFile.extractall() in StorageManager._extract_to_cache(). Lack of path validation enables arbitrary file writes.

A Race Condition vulnerability in BIOVIA Workbook from Release 2021 through Release 2026 could allow a user to access unauthorized data from another user.

The vulnerability in MCO is due to missing server-side validation of uploaded file types. Validation relies solely on client-side checks, which can be bypassed. An authenticated, low-privileged attacker can upload files of arbitrary types to the server.

MCO is vulnerable to User Enumeration through authentication-related functionalities. The application returns distinguishable responses for valid and invalid users during username reminder and password reset operations, allowing an attacker to enumerate valid usernames and email addresses.

Stored Cross‑Site Scripting (XSS) vulnerability in MCO allows an attacker to upload a malicious SVG file as the application logo. The JavaScript code executes when the logo is rendered or opened.