CVE Vulnerability Catalog

In the Linux kernel XFS, the capability check uses has_capability_noaudit(), which tests real credentials instead of effective ones. This allows bypassing group quota limits by changing a file's gid to another group the user belongs to, e.g. via an NFS client.

In the Linux kernel, missing packet source validation for connected sockets in vsock/virtio was fixed. virtio_transport_recv_pkt() could select a non-listening socket via destination-only lookup without checking the source, allowing an unrelated source to transition the victim socket to TCP_ESTABLISHED and deliver RW packets.

In the Linux kernel, missing packet source validation for connected sockets in vsock/vmci was fixed. vmci_transport_recv_stream_cb() could select a non-listening socket via destination-only lookup without checking whether the packet came from its stored peer; a RST from another context could reset a TCP_SYN_SENT socket.

In the Linux kernel bridge multicast subsystem, the port group walk during teardown is truncated because hlist_del_init() clears the ->next pointer of a deleted node, terminating the iteration early. This leaves port groups in the bridge mdb with a dangling ->key.port after the port is freed, causing a slab-use-after-free detected by KASAN in __mdb_fill_info.

In the Linux kernel, the net/psp subsystem fixed an issue where the Rx association was inherited on socket clone. Because sk->psp_assoc sits past sk_dontcopy_end, sock_copy() copied it into every accepted socket without taking a reference, leading to a use-after-free in psp_twsk_assoc_free. The fix clears the association on clone.

In the Linux kernel, net/sched: cls_flower has a mask pointer validation flaw after nla_next(). fl_set_enc_opt() iterates the key's nested tunnel-option attributes while advancing a single mask pointer via nla_next() based on the number of key attributes rather than the mask's own attributes; the pointer produced by nla_next() is used in the next iteration without validation, leading to an out-of-bounds read (slab-out-of-bounds) in __nla_validate_parse called from fl_change().

In the Linux kernel SMB client, cifs_set_acl() validates ACL size using the xattr format (4 + count*8), but cifs_do_set_acl() writes the larger CIFS wire format (6 + count*10) into the same buffer, which can overflow the heap. The size is also not checked against USHRT_MAX, so an oversized ACL truncates the on-wire packet length and causes the server to apply a partial ACL.

In the Linux kernel SMB client, CIFSSMBSetEA() copies the caller's extended attribute value into the SMB request buffer without checking that it fits. An unprivileged setxattr(2) on an SMB1 mount with a large attribute causes a slab-out-of-bounds write. The fix applies SendReceive()'s limit before the copy and widens byte counters to prevent overflow.

In the Linux kernel NTFS filesystem, ntfs_new_attr_flags() passes the wrong MFT record pointer to ntfs_attr_record_resize(). When the attribute resides in an extent record, the base record pointer is passed instead of the extent record, causing incorrect size calculations in memmove.

Acronis Cyber Protect 17 (Linux, Windows) before build 42587 contains a vulnerability due to improper token validation, leading to sensitive information disclosure and manipulation.

Acronis Cyber Protect 17 (Linux, Windows) before build 42587 contains a vulnerability due to improper token validation, leading to sensitive information disclosure and manipulation.

Dell PowerProtect Data Domain contains a Stack-based Buffer Overflow vulnerability. A low-privileged attacker with remote access could exploit it to gain unauthorized access.

Dell PowerProtect Data Domain contains an Out-of-bounds Write vulnerability. A low-privileged attacker with remote access could exploit it to cause a denial of service.

A link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, this enables arbitrary file/folder deletion leveraged to gain NT AUTHORITY\SYSTEM privileges.

The NoviGest Desktop App contains an XML External Entity (XXE) injection vulnerability in the SAFT import feature. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker could provide a manipulated XML file to read local files accessible to the application process.

Dell PowerProtect Data Domain contains an OS Command Injection vulnerability due to improper neutralization of special elements used in OS commands. A high privileged attacker with remote access could exploit it to execute commands.

Dell PowerProtect Data Domain Management Center contains a Missing Authorization vulnerability. A low privileged attacker with remote access could exploit it to perform unauthorized operations.

Dell PowerProtect Data Domain contains an Improper Authentication vulnerability. A low privileged attacker with remote access could exploit it to bypass protection mechanisms.

A local privilege escalation exists due to improper authentication. The vulnerability affects Acronis Cyber Protect Cloud Agent (Windows) before build 42569 and Acronis Cyber Protect 17 (Windows) before build 42587.

Dell PowerProtect Data Domain contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could exploit this vulnerability, leading to command execution.