CVE Vulnerability Catalog

In the Linux kernel, the NFSv4.2 implementation has a LAYOUTSTATS send buffer exhaustion issue. The encode_layoutstats_maxsz macro budgets 256 bytes, but the flexfiles record can exceed that because the server controls the filehandle and address lengths. This can drive the encoder past the end of the send buffer and leave a mutex permanently held when xdr_reserve_space() returns NULL.

In the Linux kernel, the NFSv4/pnfs implementation keys the data server cache on the multipath address set alone, without including the NFS version. When two deviceids on the same address have different versions, they share a single nfs4_pnfs_ds, and whichever mirror connects first pins ds_clp to its own version. The other mirror is handed that client and selects rpc_call_ops for a version the connection does not speak, leading to a NULL dereference.

In the Linux kernel, a fix was made for safely accessing the chan->conn field in getsockopt/setsockopt functions for Bluetooth L2CAP. After a previous change, chan->conn retains a reference and remains non-NULL even after the associated hci_conn is deleted, but accessing its fields (e.g., hdev) is invalid and leads to a KASAN crash. The fix adds a check to verify that hci_conn is still alive, and holds l2cap_chan_lock() to avoid data races.

In the Linux kernel, a fix was made for the Bluetooth L2CAP issue where a new socket could be added to the parent accept queue after l2cap_sock_cleanup_listen() had run and the state was set to BT_CLOSED, leading to a use-after-free (UAF). The fix adds a check for sk_state == BT_LISTEN after acquiring the sk lock in l2cap_sock_new_connection_cb(), and further prevents data races.

A race condition exists in the Linux kernel Bluetooth L2CAP subsystem between l2cap_sock_cleanup_listen() and l2cap_sock_put_chan(). An unsynchronized read of the l2cap_pi(sk)->chan pointer may return NULL, leading to a null-ptr-deref and kernel crash. The issue is fixed by taking lock_sock() in l2cap_sock_kill().

In the Linux kernel, the btnxpuart Bluetooth driver's nxp_process_fw_dump() reads seq_num and buf_len from a firmware dump header struct at skb->data without verifying the ACL payload is long enough. A short frame with connection handle 0xfff reads both fields beyond the received data, and a buf_len of zero can end a dump early and reset the controller.

In the Linux kernel, the net/sched: sch_teql module has a vulnerability where teql_master_xmit() sets skb->dev to the slave device before calling ndo_start_xmit(), but does not restore it when transmission fails. This causes the packet with a stale skb->dev to be queued on the ARP queue, and after the slave device is deleted, a use-after-free (UAF) occurs.

In the Linux kernel, ACOMP_REQUEST_ON_STACK() reserves only enough storage for the synchronous fallback. When an async implementation is selected, acomp_request_clone() copies only the stack-sized object, so the clone has no storage for the async provider request context. Providers such as QAT write past the allocation through acomp_request_ctx(), reported by KASAN as a slab OOB write.

In the Linux kernel, the libceph module (Ceph messenger v2 protocol) did not validate the payload_len field in the banner prefix. A client could send a banner with payload_len of 0, causing a 0-length socket read and violating a state machine invariant, triggering a warning in populate_in_iter(). Per the msgr2 specification, payload_len must be at least 16 bytes.

In the Linux kernel, in netfilter nf_tables the hardware offload step is performed before building the chain blob. Allocating the chain blob before the ruleset offload reduces the chance of entering an inconsistent state where the offloaded ruleset in the NIC and the software ruleset differ.

In the Linux kernel, the stmmac network driver's RX path was converted to zero-copy, but NET_IP_ALIGN was not carried over into stmmac_rx_offset(). As a result, the IP header lands at a misaligned address, causing an alignment fault and kernel panic on architectures such as ARM32 when receiving e.g. an ICMP echo request.

In the Linux kernel's slip driver, there is a use-after-free vulnerability in slip_receive_buf() when racing against a TTY hangup. slip_hangup() only calls slip_close(), causing concurrent access to freed memory.

In the Linux kernel's TCP implementation, devmem TX without zero-copy is not enforced. When NETIF_F_SG is absent, the copy path may attempt invalid iovec access, causing errors or breaking invariants.

MidnightBSD Package Manager (mport) prior to 2.7.8 did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could cause downloaded package data to be written outside the intended cache location or to an unsafe destination name.

The mport_fetch_bootstrap_index() function in libmport/fetch.c prior to 2.7.8 could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or compromised mirror could therefore cause mport to proceed with an unverified or tampered bootstrap package index.

In mport prior to 2.7.8, mport_decompress_zstd() in libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal, and libmport/fetch.c did not consistently propagate those failures to index-fetch callers. A malicious or faulty mirror could supply compressed package index data that caused partial index output to remain available, resulting in package-index integrity loss or denial of service.

SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key.

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resources and other users' documents throughout the installation.

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application uses escapeshellcmd instead of escapeshellarg and fails to quote the parameter, allowing TAB characters to survive sanitization and be interpreted as argument separators, enabling injection of arbitrary GNU tar arguments such as --checkpoint-action=exec to achieve remote code execution as the builds worker process user.

In pgAdmin 4's Backup tool, the client-supplied database name was passed to pg_dump as a bare trailing positional argument without validation. Because pg_dump parses options with getopt_long, which permutes arguments, a value beginning with a dash (e.g. --file=/path) was treated as an option, overriding the previously set --file and allowing files to be written outside the File Manager storage directory. The same field also allowed connection-string injection, redirecting pg_dump to an attacker-controlled server along with the database password from the PGPASSWORD environment variable.