CVE Vulnerability Catalog

A use-after-free (UAF) vulnerability was found in the Linux kernel's may_decode_fh() function in the fhandle mechanism. The issue arises from reading the mount::mnt_ns field without proper locking, allowing a race condition during unmount and namespace deallocation. The fix adds rcu_read_lock() around the mnt_ns access.

In the i2c-imx driver in the Linux kernel, there is an inconsistency between clock and pinctrl state in runtime PM. During suspend, the clock is disabled before switching pinctrl state, and a pinctrl failure leaves the clock disabled, causing a crash on subsequent hardware access.

In the i2c-qcom-cci driver in the Linux kernel, there is a NULL pointer dereference in cci_remove(). When only one of two I2C masters is initialized, calling cci_halt() for the uninitialized master causes a kernel crash during device unbinding or driver removal.

In the Linux kernel, the airoha network driver lacks a NULL check for the result of of_reserved_mem_lookup(). This can lead to a NULL pointer dereference and system crash when a device tree entry is misconfigured.

In the Linux kernel bonding driver, a NULL pointer dereference occurs in bond_do_ioctl() because slave_dbg() is called before the NULL check for slave_dev. This can cause a system crash when a non-existent interface is specified.

In the Linux kernel NVMEM onie-tlv driver, an infinite loop occurs when encountering an unknown entry type (e.g., 0x41), causing a system hang.

In the Linux kernel, the mm/damon/lru_sort module has a vulnerability due to missing error handling for context allocation. The damon_lru_sort_enabled_store() function assumes allocation always succeeds, leading to a NULL pointer dereference on failure.

In the Linux kernel, the DAMON_RECLAIM module has a NULL pointer dereference bug. The damon_reclaim_enabled_store() function assumes that the damon_ctx allocation will always succeed, which can lead to using an uninitialized pointer.

In the Linux kernel mincore_swap() function, there is an ordering issue in entry checks. On builds without CONFIG_SWAP but with CONFIG_MIGRATION or CONFIG_MEMORY_FAILURE, migration/poison entries are incorrectly treated as swap, causing false warnings and incorrect results.

In the Linux kernel's slimbus qcom-ngd-ctrl driver, callbacks are registered before the NGD (Next Generation Device) is created. When remoteproc starts in parallel with driver probing, callbacks operate on uninitialized data, causing system crashes.

In the Qualcomm slimbus driver (qcom-ngd-ctrl), a potential deadlock was detected due to an ABBA locking order between tx_lock and ctrl->lock. During SSR/PDR down notification, tx_lock is acquired before ctrl->lock, while other code paths take them in reverse order, leading to a possible system hang.

In the Linux kernel's drm/amd/display driver, an out-of-bounds read was found in the dp_get_eq_aux_rd_interval() function. The aux_rd_interval array in struct dc_lttpr_caps has size MAX_REPEATER_CNT - 1 (7 elements), but the offset parameter can be up to MAX_REPEATER_CNT (8) when a sink reports 8 LTTPR repeaters. This leads to an out-of-bounds array read.

In the Linux kernel's AMD Display driver (drm/amd/display), dal_vector_reserve() uses uint32_t arithmetic for allocation size, which can wrap and allocate a smaller buffer than expected, leading to heap overflows.

A WARN warning was triggered in the Linux kernel's scx_cgroup_move_task() function during task migration by the sched_ext scheduler. The issue occurs when systemd modifies subtree_control and cgrp_moving_from is NULL, which is a legitimate CSS-based migration, not an error. The fix removes the warning while keeping ops.cgroup_prep_move() and ops.cgroup_move() paired.

In the Linux kernel, the debugobjects module has an issue on RT-enabled systems. The fill_pool() function calls rtlock_lock(), which asserts if current->pi_blocked_on is set, potentially causing a kernel panic.

A fix in the Linux kernel for debugobjects where calling fill_pool() in hardirq context during early boot could cause a deadlock.

The pretix-oppwa plugin insecurely concatenated the resourcePath parameter with the API URL, allowing an attacker to redirect requests to their own server and steal the Oppwa access token. The vulnerability is fixed by strictly validating API URLs.

A vulnerability in allegroai/clearml versions up to 1.16.5 allows relative path traversal when extracting .zip archives using ZipFile.extractall() in StorageManager._extract_to_cache(). Lack of path validation enables arbitrary file writes.

A Race Condition vulnerability in BIOVIA Workbook from Release 2021 through Release 2026 could allow a user to access unauthorized data from another user.

The vulnerability in MCO is due to missing server-side validation of uploaded file types. Validation relies solely on client-side checks, which can be bypassed. An authenticated, low-privileged attacker can upload files of arbitrary types to the server.