CVE Vulnerability Catalog

In the Linux kernel, a memory allocation failure in xrep_newbt_add_blocks (XFS subsystem) leaks blocks previously allocated for a new btree and can kill online repair. The fix uses a NOFAIL allocation for the small (~48-byte) space reservation object.

In the Linux kernel, xfs_qm_flush_one (XFS subsystem) fails to drop the dquot flush lock when it cannot grab the buffer associated with the dquot. Since no one else will release the dqflock, it remains held.

In the Linux kernel, xlog_recover_iunlink_bucket (XFS subsystem) has multiple bugs: it does not null out prev_ip after releasing it (use-after-free risk), leaks @ip on inodegc flush failure, and mis-sets prev_agino and i_prev_unlinked, introducing loops into the unlinked list.

In the Linux kernel, net/sched act_ct stores a raw pointer to the extensions area in the expectations list before the connection is confirmed. Later *_ext_add() calls reallocate that area, leaving an invalid pointer that is accessed when removing the expectation, causing a use-after-free.

A use-after-free vulnerability was found in the Linux kernel's net/sched act_ct module. When an skb with an unconfirmed conntrack entry is cloned, both clones may process the same shared entry, modifying expectation list pointers and causing a UAF on the destruction path. The issue primarily affects NAT without commit.

In the Linux kernel, KVM for arm64 (nv) frees shadow S2 structures in kvm_arch_flush_shadow_all(), which can free a container still referenced elsewhere. The fix delays freeing these structures until VM destruction.

In the Linux kernel, an async request may still be pending when an SMB server connection is closed, preventing the connection from closing. The fix cancels active async requests before waiting for them to finish.

In the Linux kernel, MPTCP's mptcp_write_data_fin requires adding a DSS mapping and computing a checksum when sending DATA_FIN without data, but the csum field is no longer zeroed by default since commit cfcceb7a39fc. This leads to use of an uninitialized value.

In the Linux kernel, the media qcom iris driver's iris_enable_power_domains() does not use pm_runtime_resume_and_get(), leaking a runtime PM usage count on failure. Also, iris_disable_power_domains() does not always call pm_runtime_put_sync() when iris_opp_set_rate() fails.

In the Linux kernel, the accel/amdxdna driver did not disable exporting of device buffers, which were never intended to be exported. The fix explicitly disables export support for these buffers.

In the Linux kernel, the altr_portb_setup() function in the EDAC/altera driver anchored the devres group and devm-managed IRQ requests to the embedded struct device instead of the actual parent device. This caused the devres group and its allocated resources to not be torn down together with the parent device.

In the Linux kernel, the proc_dointvec_ms_jiffies_minmax function was missing a range check that was incorrectly removed by an earlier commit replacing the SYSCTL_INT_CONV_CUSTOM macro with functions. The lack of range validation may allow setting values outside the permitted interval.

In the Linux kernel KVM module for PowerPC (Book3S HV), kvmppc_svm_page_in() failed to release the secure device page when uv_page_in() failed after kvmppc_uvmem_get_page() had succeeded. Each occurrence permanently consumed an entry from the firmware-bounded secure memory pool and left the GFN marked as secure, making it unusable for the lifetime of the VM.

A security vulnerability has been detected in WongKinYiu yolov9 0.1 in the DetectMultiBackend.__init__ function of models/common.py, related to the ONNX Metadata Handler. Manipulation of the names/stride arguments leads to code injection, and the exploit has been publicly disclosed.

A weakness has been identified in kishan0725 Hospital Management System up to 777fda46b77a820977a5ba616283dbfbc40bf7e1. This affects the mysqli_query function of the admin-panel.php file of the Appointment Cancellation Handler component. Manipulation of the ID argument leads to SQL injection. The attack may be launched remotely, and the exploit has been made available to the public.

A security flaw has been discovered in dyad-sh dyad up to 1.16.0 in the OAuth Callback Handler component, enabling cross-site request forgery. The issue is fixed in version 1.17.0-beta.1.

@fastify/jwt versions prior to 10.2.5 have top-level sign and verify methods that replace globally configured defaults with per-call options instead of merging them. This silently drops temporal protections such as token expiration and maximum accepted token age, so tokens never expire.

A vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1 in the read_metadata_from_safetensors function of modules/sd_models.py, related to the Extra-Networks Card Builder component. Manipulation of the __metadata__.sshs_model_hash argument leads to cross site scripting, and the exploit is publicly available.

libstrophe through 0.14.0 contains a stack-based buffer overflow in SCRAM_Hi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes.

lwIP through 2.2.1 contains a stack out-of-bounds write in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6.