CVE Vulnerability Catalog

A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When combined with CVE-2026-50053, an attacker with an ordinary Zimbra account can execute JavaScript in another signed-in user's Zimbra browser session.

In the Linux kernel, the ksmbd server has a heap out-of-bounds write in krb5_authenticate(). When SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the out_len calculation omits work->next_smb2_rsp_hdr_off, overstating available buffer space and allowing memcpy() to write the AP-REP blob past response_buf. The fix subtracts this value when computing out_len.

A bug was fixed in the Linux kernel KVM on x86 regarding the per-vCPU MMIO cache. The cache was tagged with a memslot generation, but both the fill and validation paths used kvm_memslots(), which unconditionally selects address space 0 even when the vCPU runs in SMM and uses address space 1. As a result, an SMM memslot update could leave an apparently valid entry from the old SMM address space after the vCPU returns to the normal address space, letting a guest force a KVM_EXIT_MMIO for valid RAM.

In the Linux kernel, the bnxt_en driver has a DMA mapping length bug for padded small packets. bnxt_start_xmit() pads packets smaller than 52 bytes, but the length passed to dma_map_single() is not adjusted, so the NIC DMA engine reads beyond the mapped region, causing IOMMU faults and transmit queue timeouts.

A vulnerability in the Linux kernel's IPv4/UDP handling allowed off-path attackers to conduct a side-channel attack on the FIB nexthop exception (FNHE) cache. Previously, an exception was only created if the UDP packet could be matched to an existing socket, enabling discovery of the ephemeral port used by a connected UDP socket. The fix always creates a FNHE before attempting socket matching.

In the Linux kernel, cipso_v4_skbuff_delattr() removes CIPSO bytes but does not adjust cached offsets for options that follow them (srr, rr, ts, router_alert). Consumers such as ip_forward_options() and __ip_options_echo() then access the wrong bytes, and the latter may interpret packet data as the option length and copy it into fixed-size option storage.

In the Linux kernel, the WireGuard noise subsystem has a race condition when two threads process the same response message, potentially reusing handshake state and creating a new session from stale state. The issue is considered very difficult to trigger in practice and was fixed by comparing the ephemeral private key with the peer's latest handshake state.

In the Linux kernel, strparser did not guarantee that in-flight __strp_recv calls completed before the parser was torn down in strp_done(). A dummy lock_sock/release_sock pair was added to ensure completion of in-flight strp_recv calls, and state bits were switched to u8 to avoid races between strp_stop() and strp_pause/unpause().

In the Linux kernel, tipc_topsrv_stop() closed subscriber connections while the topology server's send and receive workqueues were still running. This caused races leading to refcount errors, a use-after-free in tipc_conn_close(), queue_work() on a destroyed workqueue, and an RCU stall in tipc_topsrv_exit_net(). The fix clears the flag under idr_lock, destroys workqueues before closing connections, and refuses tipc_conn_lookup() after the flag is cleared.

In the Linux kernel TIPC module, tipc_node_find_by_name() returned a node pointer after dropping the RCU read lock without taking a reference. The LINK_SET, LINK_GET and LINK_RESET_STATS handlers could then use a freed node, leading to a use-after-free (reported by KASAN).

In the Linux kernel, __fsverity_get_info() uses rhashtable_lookup_fast() with rcu_read_lock(), which does not directly synchronize with fsverity_remove_info(). For different inodes, concurrent calls can cause a use-after-free because they rely on fsverity_info::rhash_head and fsverity_info::inode after freeing. The fix RCU-delays freeing of struct fsverity_info after removal from the rhashtable.

In the Linux kernel's gpio-mpsse driver, gpio_mpsse_irq_enable() armed the poll worker before adding it to priv->workers. If gpio_mpsse_disconnect() walked the list in that window, it missed the worker, and after mpsse_priv was freed the orphaned gpio_mpsse_poll() kept accessing it, causing a use-after-free. The fix publishes and arms the worker in one irq_spin critical section and adds a priv->dying flag.

In the Linux kernel, the gve driver leaks an XSK buffer on an error descriptor. When the error bit is set in the RX completion descriptor, buf_state and its attached buffer should be freed, but in the AF_XDP ZC case the XSK buffer is not freed.

In the Linux kernel, io_uring/net has a CONNECT filter bypass for 24-byte sockaddr_in6. io_connect_bpf_populate() fills filter fields only when addr_len >= 28 bytes, while IPv6 connect paths accept 24 bytes, so the filter sees zero port and address and can be bypassed.

In the Linux kernel, smc_getname() dereferences smc->clcsock without holding clcsock_release_lock, allowing link-group termination to release the CLC socket concurrently. This results in a use-after-free (or NULL dereference if the pointer is cleared before the load) when getsockname() is called.

In the Linux kernel, skb_copy_and_csum_bits() returns 0 after copying only the linear part when it reaches unreadable frags, leaving the rest of the caller's buffer unchanged. Since buffers (e.g., ICMP errors or driver TX bounce buffers) are not zeroed beforehand, unexpected memory contents may be sent over the wire.

In the Linux kernel on RISC-V, with CONFIG_SHADOW_CALL_STACK enabled, handle_exception() decided whether to reload the shadow call stack pointer (gp) based on the user-writable tp register. By setting tp to the linear-map address of its own task_struct, a user task could make the kernel skip the gp reload, leading to an unprivileged kernel arbitrary-write and control-flow-hijack primitive.

In the Linux kernel, errata_probe_ghostwrite() only marks the CPU vulnerable at the early boot stage, which requires CONFIG_RISCV_ALTERNATIVE_EARLY. That option is currently selected only by ERRATA_THEAD_MAE, so with ERRATA_THEAD_GHOSTWRITE=y and ERRATA_THEAD_MAE=n the vulnerable state is never set and the mitigation does not apply. The fix selects RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE.

In the Linux kernel on RISC-V, futex helpers pass the raw user pointer to atomic operations without untagging, even though access_ok() checks the untagged address. With the tagged address ABI enabled (CONFIG_RISCV_ISA_SUPM), an unprivileged process can make FUTEX_WAKE_OP perform an atomic read-modify-write on an arbitrary kernel address. The fix untags the pointer before the atomic operation, as get_user()/put_user() already do.

In the Linux kernel, hci_le_set_ext_scan_param_sync() during PA sync scan setup suffers from a use-after-free. The address pointer is obtained from hci_sent_cmd_data() without holding a reference to the skb, and the concurrent hci_cmd_work() can free and replace that skb before the address is dereferenced. The fix serializes access to sent_cmd and req_skb using hdev->lock and copies the address before releasing the lock.