CVE Vulnerability Catalog

In the Linux kernel, the drm/nouveau/dmem driver had a mismatched DMA unmap size for large folios. Device-private THP migration maps buffers with page_size() and records that length, but two teardown sites passed a literal PAGE_SIZE to dma_unmap_page(), leaking part of the IOMMU/IOVA mapping for order > 0 folios. The fix uses the saved size.

In the Linux kernel, the drm/nouveau driver's nouveau_channel_del() tore down the fence context before unsubscribing the channel-kill event. A narrow window allowed nouveau_fence_context_kill() to run on an already freed fence context, causing a use-after-free. The fix unsubscribes before tearing down dependent structures.

In the Linux kernel, the drm/nouveau/uvmm driver had a premature region free on failed OP_UNMAP_SPARSE. Two failure paths left op->reg set, causing cleanup to remove and put a region the job never created, leading to a use-after-free. The fix clears op->reg on both failure paths.

In the Linux kernel, the bpf_get_stackid function requires disabled preemption for the get_perf_callchain call and while accessing its returned trace entries buffer. The bpf_get_stackid_pe function already executes with preemption disabled. Failure to disable preemption in bpf_get_stackid may lead to data consistency issues.

A vulnerability in the Linux kernel PCI subsystem affecting s390 systems using a machine-level hypervisor has been resolved. The shared pci_slot assignment for multifunction devices caused the hotplug driver to reset the wrong function and leak memory. A flag was added to allow per-function PCI slots for hypervisor-managed functions.

The lack of signature verification of firmware update packages in VEO and VEO-XS Wi-Fi monitors prior to version 01.48.001 allows an attacker who controls the delivery of an update to install unauthorized firmware.

Kong API Gateway Enterprise has a JWT signature verification vulnerability in MCP OAuth2 and DataKit components. Improper validation of the signing algorithm allows an unauthenticated attacker to craft a forged JWT that is incorrectly accepted as valid.

In the Linux kernel, ublk_ch_mmap() rejects mmap requests with VM_WRITE set but never clears VM_MAYWRITE on the resulting read-only mapping. This allows a userspace daemon to mmap the per-queue command buffer PROT_READ, then upgrade it to PROT_WRITE via mprotect(). The command buffer holds kernel-written struct ublksrv_io_desc entries, so a writable mapping lets an unprivileged daemon process corrupt fields such as addr, op_flags, nr_sectors, and start_sector.

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via import_string, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments with the Kafka event producer enabled build that client inside the scheduler process, so a user whose only privilege is editing Airflow connections gains arbitrary code execution in the control plane. Deployments using Google Managed Kafka are not affected because that code path overwrites any user-supplied oauth_cb.

Lack of TLS certificate validation when downloading firmware updates in VEO and VEO-XS Wi-Fi monitors (versions prior to 01.48.001) allows an attacker to perform man-in-the-middle attacks on the update channel.

Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be authenticated as the user it names, because the audience claim is never checked. Affects deployments using the FAB auth manager with Authentik OAuth where the same Authentik instance also serves other applications.

Transmission of home Wi-Fi credentials without encryption during the pairing process between the DuoxMe application and VEO and VEO-XS Wi-Fi monitors (versions prior to 4.3.4 of the app and 01.50.001 of the monitor firmware) allows an attacker on the Wi-Fi Direct network to intercept the network password.

In Apache Airflow FAB provider, deactivating a user account does not invalidate previously issued tokens. These tokens remain valid and can be used to gain access even after the account is deactivated by an administrator.

In Apache ZooKeeper, the deleteContainer opcode (0x14/20) is processed without verifying ACL permissions, allowing any authenticated client to delete empty persistent, container, and TTL nodes even without proper permissions. This is an authorization bypass and ACL enforcement bug.

On affected platforms running Arista EOS with OSPFv3 configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly.

On affected platforms running Arista EOS with OSPFv2 configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authentication configured, can cause adjacency flapping and packet loss. The disruption can affect routing across the broader OSPF domain.

In Apache ZooKeeper, in FIPS mode, peer hostname verification in quorum TLS is not enforced. Despite enabling the relevant options, the connection accepts a CA-trusted certificate even if the SAN does not match the connected host, allowing a malicious certificate to join quorum traffic.

In Apache ZooKeeper, there is an information disclosure via SetWatches reconnect replay due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs.

A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assertion and authenticate the user without verifying a valid cryptographic signature.

In the Linux kernel, in the ksmbd module, there is a vulnerability to out-of-bounds reads in share config responses. Lack of validation of IPC data sizes before processing variable-length fields can lead to reading beyond the allowed memory area.