CVE Vulnerability Catalog

The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and then add themselves as a member.

The PrivateContent WordPress plugin contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions from n/a through 9.9.2.

In the Linux kernel's drm/i915/gem driver, a bug was found in the pread/pwrite functions for physical buffer objects (phys BO). The sg_page() function returns a struct page pointer, not void*, causing incorrect offset scaling during read/write. As a result, with a non-zero offset, wrong parts of the buffer are accessed.

Vulnerability in the Linux kernel in the RDS IB driver. During failed connection setup (rds_ib_setup_qp), the i_sends pointer is not cleared after memory free, potentially leading to use-after-free on subsequent shutdown.

In the Linux kernel for ARM64, a mitigation was added for errata affecting TLBI instructions on certain Arm CPUs. The bug causes a TLBI;DSB sequence to complete before global observation of writes translated by an invalidated TLB entry. Although TLB invalidation is correct, memory access after invalidation may be incomplete.

In the Linux kernel, the WARN_ONCE() in hsr_addr_is_self() has been removed because it triggered a false positive when an HSR interface was being deleted. The self_node pointer is cleared before the network device is fully unregistered, causing an unnecessary warning.

A race condition in the Linux kernel's zap_other_threads() function fails to clear JOBCTL_PENDING_MASK for the calling thread during execve(). This causes a stale stop signal after execve completes, triggering a kernel warning and potential system instability.

A fix in the Linux kernel resolves a warning during core dump on RISC-V. The issue was using the wrong register note type for REGSET_CFI.

In the Linux kernel, a NULL pointer dereference occurs in the wm_adsp driver when removing firmware controls. The wm_adsp_control_remove() function attempts to clean up private data without checking if the priv pointer is NULL.

In the Linux kernel, a vulnerability in netfilter nf_conntrack causes nf_ct_helper_expectfn_unregister() to not remove pending expectations from the table, leaving a dangling pointer to freed module code. When the expected connection arrives, invoking this pointer results in a kernel crash.

A NULL pointer dereference vulnerability was found in the Linux kernel's ASoC SDCA driver during function unregistration. When a function registration fails partially or device cleanup races with probe deferral, func_dev entries may be NULL, causing a kernel oops with BUG message.

In the Linux kernel, the virtio-gpu driver has an issue during driver removal when KMS is disabled. DRM atomic and modesetting are not initialized, leading to access of uninitialized data and kernel crash.

In the Linux kernel for ARM64 in Rust code, a bug was found related to the LLVM uwtable module flag. Due to a rustc bug, the -Cforce-unwind-tables=y flag does not emit the uwtable annotation for the module, causing compiler-generated functions (e.g., asan.module_ctor) to lack the annotation. When CONFIG_UNWIND_PATCH_PAC_INTO_SCS is enabled, this leads to boot failures due to incorrect patching of paciasp/autiasp instructions.

In the Linux kernel, a false positive WARN was removed when marking a page as dirty while the VM is dying. The issue affected SEV-ES guests where KVM kept a writable mapping of a guest page after an exit to userspace and tried to unmap it during vCPU destruction, triggering a warning about missing active vCPU.

A fix in the Linux kernel for the pinctrl mcp23s08 driver. Initialization of mcp->dev and mcp->addr was too late, causing a NULL pointer dereference during regmap init.

In the Linux kernel for ARM architecture, there is an issue in __switch_to() related to KASAN VMAP stack shadow. The ldr instruction was used to read the stack shadow, which is byte-granular and may not be word-aligned, causing an alignment fault on ARMv5.

In the Linux kernel on ARM64, the pagetable_dtor() call was missing when freeing hot-removed page table pages, causing bad page states, PTL allocation leaks, and incorrect NR_PAGETABLE stats. The fix adds the missing call in free_hotplug_pgtable_page().

A use-after-free (UAF) vulnerability was found in the Linux kernel's may_decode_fh() function in the fhandle mechanism. The issue arises from reading the mount::mnt_ns field without proper locking, allowing a race condition during unmount and namespace deallocation. The fix adds rcu_read_lock() around the mnt_ns access.

In the i2c-imx driver in the Linux kernel, there is an inconsistency between clock and pinctrl state in runtime PM. During suspend, the clock is disabled before switching pinctrl state, and a pinctrl failure leaves the clock disabled, causing a crash on subsequent hardware access.

In the i2c-qcom-cci driver in the Linux kernel, there is a NULL pointer dereference in cci_remove(). When only one of two I2C masters is initialized, calling cci_halt() for the uninitialized master causes a kernel crash during device unbinding or driver removal.