CVE Vulnerability Catalog

The nl.nl-portal:taak package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the submitTaakV2 GraphQL mutation. An authenticated user who knows or guesses another user's task ID can read its form data, overwrite its submitted data, and mark the task as completed.

ArduinoBLE versions prior to 2.0.2 contain a missing bounds check in the ATT layer write request handler that allows a remote, unauthenticated BLE client to corrupt memory in the ATTClass global object. Devices running ArduinoBLE with one or more characteristics configured with the BLEEncryption property are affected.

In the Linux kernel, a race condition in the ring-buffer during subbuf resize by readers was resolved. trace_buffer subbuf_size is read lockless in ring_buffer_read_page() and ring_buffer_read_start(), while it can simultaneously be resized with ring_buffer_subbuf_order_set(). The fix uses bpage::order instead of trace_buffer::subbuf_size and adds a mutex in ring_buffer_read_start().

In the Linux kernel, an IRQ leak on the cpuhp_setup_state error path in the nxp-pit clocksource driver was resolved. When cpuhp_setup_state fails after pit_clockevent_per_cpu_init successfully called request_irq, the error handling skips freeing the registered IRQ, leaking the IRQ line and leaving a dangling pointer as the interrupt handler's dev_id, potentially leading to a use-after-free.

In the Linux kernel, ovl_create_real() in overlayfs calls end_creating() twice on the casefold-mismatch error path. This causes the parent directory's i_rwsem to be unlocked twice and the dentry reference to be released twice, leading to a deadlock on subsequent creation operations under that parent. The issue is reachable by an unprivileged user.

In the Linux kernel's Rust devres layer, a race condition occurs when two paths concurrently revoke a Devres. devres_release_all() calls Revocable::revoke() via the release callback, while Devres::drop() calls revoke_nosync() on another CPU. The revoker that does not claim the is_available swap returns immediately, but the other may still be executing drop_in_place() on the inner data, causing a use-after-free. The fix adds a Completion that Devres::drop() waits on when it loses the is_available swap.

A use-after-free vulnerability exists in the Linux kernel's trusted keys (KEYS: trusted) module due to incorrect TPM teardown ordering. The trusted_tpm_exit() function drops the TPM chip reference and frees the digest array before unregistering the trusted key type, allowing a concurrent key operation to dereference freed memory.

A use-after-free (UAF) vulnerability in the Linux kernel's AppArmor module, related to begin_current_label_crit_section(), has been fixed. The function could directly replace credential pointers (struct cred) during an LSM hook invocation, causing task->cred and task->real_cred to become inconsistent and leading to freed credential memory still being referenced by other tasks.

A fix has been applied in the Linux kernel for an out-of-bounds write in the AppArmor aa_vec_unique() function. When all label components are distinct, the NULL terminator is written to vec[n], but vec_setup() does not reserve space for this extra entry, causing a write one element past the end of the local array or allocation. The vulnerability can be triggered by an unprivileged task writing to /proc/self/attr/apparmor/current or via lsm_set_self_attr(2), and also through the securityfs .access file which is mode 0666.

In the Linux kernel, a bug in swap memory management causes hibernation slots to be freed even when a folio is present in the swap cache. The function swap_free_hibernation_slot() clears the entry under that folio, making it unreachable from the swap table and allowing the offset to be reused by another process. This can trigger silent memory corruption, process crashes, or data instability across unrelated userspace applications, typically when uswsusp is preparing the hibernation image.

A vulnerability exists in the Linux kernel's queue_folios_pmd() function in mm/mempolicy, which fails to skip non-present PMD entries (e.g., device-private) before calling pmd_folio(). This can lead to VM_BUG_ON() on debug kernels, an oops on a bogus vmemmap dereference, or silently isolating an unrelated live folio from LRU. The issue is triggered when an HMM-based GPU driver migrates an anonymous THP folio to device memory and userspace then calls mbind(), migrate_pages(), or set_mempolicy_home_node().

In the Linux kernel, __migrate_device_pages() reads the folio mapping before calling folio_free_swap(). When folio_free_swap() succeeds, the folio is removed from the swap cache but the saved mapping still points to swap_space, leading to use of a stale mapping and invalid reference accounting, eventually triggering a folio reference count BUG.

A flaw in the Linux kernel's mm/pagewalk mechanism causes walk->action to remain incorrectly set to ACTION_AGAIN after a PMD entry is cleared, leading to duplicate walk callbacks and an out-of-bounds write. This was detected by KASAN in __mincore_unmapped_range.

In the Linux kernel, dup_task_struct() copies user_event_mm from the parent to the child without taking a reference. If user_event_mm_alloc() fails, user_event_mm_dup() leaves the copied pointer unmodified, and when the child exits user_event_mm_remove() decrements a reference the child never owned, leading to a use-after-free (UAF).

In the Linux kernel, simple_ring_buffer_swap_reader_page() starts with retry set to 8 and decrements it only after a failed link replacement. On the final attempt, a successful replacement leaves retry at zero while a failed one leaves it at -1, so the !retry test reverses both outcomes and can corrupt the ring buffer.

In the Linux kernel, writing to buffer_subbuf_size_kb calls ring_buffer_subbuf_order_set(), which frees every sub-buffer of the ring buffer, including the reader page. trace_pipe readers hold pointers into those pages, and ring_buffer_peek() returns the event pointer after dropping the lock, so changing the sub-buffer order in that window leads to a use-after-free.

A use-after-free vulnerability exists in the Linux kernel tracing subsystem when two hist triggers with the same name (name=) are registered on different events. The second trigger reuses the first as named_data, but its entry in the tr->hist_vars list is never removed, leaving a dangling pointer to freed hist_data. A later hist trigger referencing a variable then dereferences the freed memory and panics the kernel.

In the Linux kernel, fwnode_for_each_child_node() can enter an infinite loop when iterating over children of a fwnode that has a secondary fwnode with more than one child. This causes the same nodes to be returned repeatedly instead of terminating the iteration.

In the Linux kernel, nsm_sendrecv_msg_locked() stores the length reported by the NSM device without bounding it to the response buffer size. A malicious or buggy device can report an oversized length, leading to an out-of-bounds read and disclosure of adjacent kernel heap memory.

In the Linux kernel, dma_req_free() in RapidIO mport_cdev drops the mapping reference via kref_put() and then dereferences req->map again to unlock the mutex. If kref_put() drops the last reference, the object is freed and a use-after-free occurs.