Use-after-free in the Linux kernel IPv4 networking stack allows potential kernel memory disclosure or corruption when destination (dst) entries are accessed without proper RCU protection during ICMP rate-limiting, IP fragment reassembly, and multicast forwarding. The fix converts icmpv4_xrlim_allow(), ip_defrag(), the ipmr multicast transmit paths, and ipv4_neigh_lookup() to the lockdep-enabled dst_dev_rcu() accessor. No public exploit identified at time of analysis, and EPSS probability is low (0.17%, 7th percentile), consistent with a hard-to-win kernel race rather than a readily weaponized flaw.
Use-after-free vulnerability in Mozilla Firefox 142 and 143 enables compromised renderer processes to trigger memory corruption in the GPU or browser process via malicious WebGPU IPC calls, potentially achieving sandbox escape. Affecting Firefox versions 142.0 through 144.0.1, this CWE-416 flaw carries CVSS 9.8 despite low real-world exploitation probability (EPSS 0.06%, 18th percentile). No public exploit identified at time of analysis. Patched in Firefox 144.0.2 released January 2025.
Unrestricted file upload in Simple Food Ordering System 1.0 (PHP) allows remote attackers to upload arbitrary files through the photo parameter of /addproduct.php, potentially enabling web shell deployment and full server compromise. The affected product is tracked under CPE cpe:2.3:a:fabian:simple_food_ordering_system:1.0, and exploit code is publicly available via GitHub. No active exploitation is confirmed in CISA KEV, and EPSS sits at 0.06% (17th percentile), though the presence of a public proof-of-concept combined with an authentication bypass tag elevates realistic risk above what the low EPSS would suggest.
SQL injection in Campcodes Retro Basketball Shoes Online Store 1.0 exposes the `/admin/admin_football.php` endpoint to database manipulation via the unsanitized `pid` parameter, achievable by remote unauthenticated attackers per the CVSS 4.0 PR:N rating. The flaw enables limited read, write, and availability impact against the backend database. A public proof-of-concept exploit has been disclosed via GitHub, though EPSS remains extremely low at 0.03% (8th percentile), consistent with this product's negligible real-world deployment footprint and no CISA KEV listing.
SQL injection in Campcodes Retro Basketball Shoes Online Store 1.0 exposes the `/admin/admin_product.php` endpoint to remote attackers who can manipulate the `pid` parameter to execute arbitrary SQL queries against the backend database. Publicly available exploit code exists (GitHub CVE issue #16), though the EPSS score of 0.01% at the 1st percentile signals negligible observed exploitation probability - consistent with a niche, low-footprint hobbyist application. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
SQL injection in Campcodes Retro Basketball Shoes Online Store 1.0 exposes the admin panel endpoint /admin/admin_feature.php to database manipulation via the unsanitized `pid` parameter. The provided CVSS 4.0 vector asserts PR:N (no privileges required), though the /admin/ path suggests authentication may be in play - this discrepancy is noted and should be verified against the actual application. A publicly available proof-of-concept exploit exists on GitHub, though the EPSS score of 0.01% (1st percentile) indicates real-world exploitation attempts remain negligible, consistent with the product's obscure deployment footprint. No vendor-released patch has been identified at time of analysis.
SQL injection in Campcodes Retro Basketball Shoes Online Store 1.0 exposes the admin login endpoint to remote, unauthenticated database manipulation via the Username parameter in /admin/admin_index.php. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and minimal skill, and a public proof-of-concept exists on GitHub. Despite this, real-world risk is curtailed by the product's extremely niche deployment footprint, an EPSS of just 0.01% (1st percentile), and absence from CISA KEV - making mass exploitation implausible.
Remote code execution in alexusmai laravel-file-manager (versions 3.3.1 and earlier) lets an authenticated user with file-manager access run arbitrary PHP on the server by uploading a PHP payload disguised with a .png extension, then abusing the rename API to give it a .php extension so it executes when requested via a public URL. The flaw stems from client-side-only upload validation combined with an unrestricted rename operation and web-accessible storage. No CISA KEV listing; EPSS is a modest 0.55% (42nd percentile), but a dedicated GitHub repository referencing this CVE indicates public proof-of-concept material likely exists.
Uninitialized-memory disclosure in the Linux kernel's NFC NCI subsystem lets a local actor with access to the NCI interface trigger reads of unallocated skb->data by submitting NCI control packets whose declared header length passes the weak nic_valid_size() check but does not match the actual buffer layout expected per opcode. The flaw, found by Syzbot in nci_init_req, affects Linux kernels built with the NFC/NCI stack; it is tagged Information Disclosure with an EPSS of 0.21% (11th percentile) and no public exploit identified at time of analysis. Upstream fixes add per-handler parameter validation and silently drop malformed packets.
Improper enablement of IOMMU dirty page tracking in the Intel VT-d (iommu/vt-d) driver of the Linux kernel allows a misconfiguration where dirty tracking is offered even when the IOMMU performs incoherent page walks. Because the hardware cannot atomically update A/EA/D bits in non-snooped paging-structure entries, this triggers a non-recoverable fault and can corrupt or silently drop dirty-page state used during operations like VM live migration. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and this is a corrective hardening patch rather than an actively exploited flaw.
Improper accounting in the Linux kernel's io_uring zero-copy receive (zcrx) path allows a zcrx recv request to return more data than the caller requested, caused by desc->count being adjusted for all received buffers and then double-counted during recursive processing of frag-list skbs, leading to counter underflow. Affected are Linux kernels shipping the io_uring zcrx feature, where a local process using this interface can read beyond the intended receive limit. There is no public exploit identified at time of analysis, and EPSS is low (0.19%, 9th percentile), consistent with an internal kernel-hardening fix rather than an actively exploited flaw.
Local privilege-to-data compromise in the Linux kernel NTFS3 driver allows an attacker who can supply a crafted NTFS volume to bypass inode access checks and read or destroy arbitrary on-disk data. The flaw is an unvalidated integer overflow in run_unpack(), which decodes the compressed runlist ($DATA runs) mapping virtual clusters to logical clusters (LCNs); a forged runlist yields out-of-bounds LCNs. Rated CVSS 8.4 (high) with no public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and it is not in CISA KEV.
Information disclosure and memory-safety risk in the Linux kernel's TCP metrics (tcp_metrics) subsystem stems from three call sites using the non-lockdep-safe dst_dev() accessor, now replaced by the RCU-aware dst_dev_net_rcu() helper. Affected are Linux kernel builds prior to the fixing stable commits; a race in device/net dereference during TCP metric handling could expose kernel memory or destabilize the network stack. There is no public exploit identified at time of analysis, EPSS is low (0.18%), and the issue is not listed in CISA KEV.
Improper instruction emulation in the Linux kernel's KVM x86 subsystem allows a local user with access to KVM (typically /dev/kvm) to crash or destabilize the host hypervisor by racing port I/O interception changes against a userspace I/O exit. Because KVM re-checks L1 intercepts after it has already committed to emulating an L2 I/O access, a malicious or buggy VMM/guest can leave vcpu->arch.pio.count non-zero and trigger a kernel WARN in emulator_pio_in_out(); the flaw was discovered via a syzkaller reproducer. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.25%).
Local privilege escalation and denial of service in the Linux kernel's 9p (Plan 9) filesystem transport (net/9p/trans_fd.c) arises from a double request free in p9_fd_cancelled(). A race between p9_read_work() cancelling pending requests and p9_fd_cancelled() cleaning up a flush request causes the same req_list entry to be removed twice via list_del(), corrupting kernel list pointers (the classic 0xdead000000000100 poison), yielding a GPF/KASAN wild-memory-access that a local user can trigger by mounting a malicious 9p share. No public exploit identified at time of analysis; the flaw was found by the Linux Verification Center with Syzkaller, and EPSS is low at 0.22% (12th percentile).
Out-of-bounds/use-after-free read in the Linux kernel UDF (Universal Disk Format) filesystem driver allows a local attacker to crash the kernel or leak adjacent memory by getting a crafted or corrupted UDF image mounted and accessed. The flaw lies in fs/udf handling of the on-disk lengthAllocDescs field, which was not validated against the block size, causing udf_update_tag() to invoke crc_itu_t() on memory past the buffer. It was found by the Linux Verification Center via Syzkaller; there is no public exploit identified at time of analysis, and EPSS is low at 0.21% (12th percentile).
Improper return-value handling in the Linux kernel's vhost vringh host-side virtqueue library allows a local low-privileged actor (including a malicious or misbehaving guest driving a vhost/vDPA backend) to trigger processing of partially-copied descriptor data, potentially disclosing kernel memory. The vringh code checked copy_from_iter/copy_to_iter results for a negative error that these functions cannot return, so short (incomplete) copies were silently treated as success. No public exploit identified at time of analysis; EPSS is low at 0.20% (10th percentile) and the CVE is not in CISA KEV.
Local privilege escalation risk in the Linux kernel's io_uring waitid handling stems from a race condition in io_waitid_wait(), where a successful return failed to prune the task's entry from the wait queue when a cancelation was concurrently in progress, allowing the wait queue callback to be invoked twice against a stale entry. Authenticated local attackers (PR:L per CVSS) could exploit this to corrupt kernel memory with high confidentiality, integrity, and availability impact (CVSS 7.8). This is fixed upstream; there is no public exploit identified at time of analysis and EPSS is low (0.20%).
Memory corruption in the Linux kernel's wcd937x ASoC audio codec driver occurs because the SoundWire port for the HPHL_COMP and HPHR_COMP compander components is set to zero, causing an out-of-bounds access at index -1 of the port_map array during driver operation. Local low-privileged users on devices using this Qualcomm codec can trigger kernel memory corruption (CVSS 7.8). There is no public exploit identified at time of analysis, EPSS risk is low (0.20%, 10th percentile), and the fix has already been merged upstream.
Local privilege escalation potential in the Linux kernel's ARM Statistical Profiling Extension (arm_spe) perf driver stems from an integer overflow in the PERF_IDX2OFF() calculation when an AUX ring buffer of 2 GiB or larger is used. On affected arm64 systems, a local user with permission to open SPE perf events can trigger the overflow because nr_pages was not cast to unsigned long, producing an incorrect buffer offset and out-of-bounds kernel memory access. This is a resolved kernel bug fixed via stable-tree commits; there is no public exploit identified at time of analysis and EPSS probability is low (0.20%, 10th percentile).
Local filesystem corruption / potential memory corruption in the Linux kernel's ntfs3 driver arises when an index allocation is performed against a $BITMAP attribute that is empty while index blocks already exist on disk. An attacker who can get a victim to mount a malformed NTFS image can drive the driver into an inconsistent index state during rename() of long filenames, causing subsequent operations to fail (-ENOENT) and reflecting on-disk corruption that the driver previously failed to reject. There is no public exploit identified at time of analysis, the EPSS probability is low (0.19%, 9th percentile), and it is not listed in CISA KEV.
Local privilege escalation via use-after-free in the Linux kernel's RDMA/rxe (Soft-RoCE) driver allows a low-privileged local user to corrupt kernel memory by winning a race in do_task(). When the task loop exhausts its iteration budget it blindly resets state to TASK_STATE_IDLE, overwriting a concurrent TASK_STATE_DRAINING set during rxe_cleanup_task()/rxe_disable_task() teardown, so a task reschedules against freed structures. No public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with a hard-to-win kernel race rather than a mass-exploited flaw.
Local privilege escalation and memory corruption in the Linux kernel's Android binder IPC driver arises from a double-free in the dynamic bitmap (dbitmap) allocator used for per-process reference tracking. When a process's dmap expansion fails, dbitmap_grow() frees the old bitmap, but the pointer is not cleared, so binder_proc_dec_tmpref() frees it a second time at process teardown, corrupting the kernel heap. This is a memory-safety flaw exploitable by any local user with binder access (default on Android and many Linux systems); there is no public exploit identified at time of analysis and the EPSS score is low (0.19%).
Use-after-free in the Linux kernel's F2FS (Flash-Friendly File System) encryption write path allows a local user to crash the kernel or corrupt memory during concurrent writes to encrypted files. The flaw lives in f2fs_merge_page_bio(), where a bounce/encrypted page can be freed by the write completion path (f2fs_write_end_io) while another thread still dereferences it via fio->encrypted_page in f2fs_is_cp_guaranteed(), producing a NULL/dangling pointer dereference. It is fixed upstream; no public weaponized exploit is identified, though the commit ships a race reproducer, and EPSS risk is low (0.19%).
Kernel panic (denial of service) in the Linux kernel's LoongArch BPF JIT compiler affects systems running on LoongArch (Loongson) 64-bit CPUs when BPF struct_ops programs - such as a BPF-based qdisc - are attached and their pointer return values are consumed by the kernel networking path. The LoongArch JIT epilogue sign-extended 32-bit return values as it does for ordinary BPF programs, but struct_ops functions must follow the LoongArch calling ABI, so a returned pointer (e.g. an skb from bpf_fifo_dequeue) was truncated/sign-extended into an invalid address that the kernel then dereferenced, causing an unhandled paging fault in __qdisc_run(). This is no public exploit identified at time of analysis and is not on CISA KEV; EPSS is low (0.19%, 9th percentile).
Kernel panic (and potential memory corruption) in the Linux kernel BPF JIT on the RISC-V architecture allows a local privileged actor to crash the system when a BPF struct_ops program (such as a bpf_qdisc scheduler) returns a pointer. The RISC-V JIT epilogue sign-extended struct_ops return values as if they were 32-bit scalars, violating the RISC-V calling convention and corrupting the returned 64-bit pointer, which the network qdisc path then dereferences. No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and this affects only RISC-V builds using the BPF qdisc/struct_ops feature.
Memory/object reference leak in the Linux kernel's drm/msm (Qualcomm Adreno GPU) driver lets a local user with GPU device access leak kernel object references when the VM_BIND ioctl error path fails a handle lookup partway through, dropping already-obtained GEM object references incorrectly. It affects Linux kernels carrying the newer MSM VM_BIND uAPI and is patched upstream via kernel.org stable commits. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not listed in CISA KEV.
Local privilege escalation and memory corruption in the Linux kernel's SMC (Shared Memory Communications) subsystem allows a local user to trigger a use-after-free of a net_device during a connect() call on an SMC socket. The flaw lives in smc_pnet_find_ism_resource() / smc_pnet_find_roce_resource(), which dereference a destination device (dst->dev) that can be freed and swapped for blackhole_netdev before RTNL is acquired in pnet_find_base_ndev(). It was discovered by syzbot fuzzing; there is no public exploit identified at time of analysis, it is not on CISA KEV, and its EPSS probability is very low (0.17%, 7th percentile).
Local denial-of-service in the Linux kernel's F2FS filesystem allows an attacker who can mount a crafted F2FS image to trigger a kernel BUG_ON panic during a fallocate punch-hole operation. The flaw stems from missing validation of the node footer for non-inode direct nodes (dnodes), which lets a corrupted dnode be misparsed as an inode and produce an invalid truncation count. No public exploit has been identified at time of analysis and EPSS is low (0.17%, 7th percentile); reproduction requires a deliberately fuzzed on-disk image (syzbot-discovered).
Denial of service in Prevx 3.0.5.220 lets a local attacker terminate protected processes by sending IOCTL code 0x22E044 to the pxscan.sys kernel driver, which force-kills every process enumerated under the HKLM\System\CurrentControlSet\Services\pxscan\Files registry key. A GitHub repository named for the CVE indicates publicly available exploit code exists, though the vulnerability is not in CISA KEV and carries a low EPSS score of 0.34% (26th percentile). Prevx is a long-retired anti-malware product (absorbed into Webroot circa 2011), so real-world exposure is minimal.
Information disclosure in BESSystem (Baolande) BES Application Server through version 9.5.x lets remote unauthenticated attackers retrieve sensitive data by abusing the "pre-resource" option in the bes-web.xml deployment descriptor. The flaw exposes protected resources or configuration content over the network with no authentication (CVSS 7.5, C:H). No public exploit identified at time of analysis, though a third-party gist referencing the issue is linked in NVD; EPSS is low at 0.34% (26th percentile).
Denial of service in the Linux kernel's uio_hv_generic driver affects Hyper-V guest VMs that expose VMBus channels to userspace UIO drivers, where the kernel driver improperly manipulated the ring-buffer interrupt mask concurrently with user space. This race causes the guest user-mode driver to miss a host interrupt and hang indefinitely inside pread(), stalling the affected service. No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and it is not on the CISA KEV list.
Denial of service in the Linux kernel's D-Link dl2k Gigabit Ethernet driver (net/dlink, as used with hardware such as the D-Link DGE-550T) arises because the receive path did not check the return value of netdev_alloc_skb_ip_align() on the copy_thresh small-packet path; on allocation failure the code dereferenced skb->protocol, causing a NULL pointer dereference and kernel crash. Affected systems are Linux hosts using the dl2k driver for legacy D-Link Gigabit NICs. There is no public exploit identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low (0.21%, 11th percentile), consistent with a memory-pressure-dependent local DoS rather than a readily weaponizable remote flaw.
Host denial-of-service in the Linux kernel's KVM AMD (SVM) subsystem allows a guest VM to crash or hang the hypervisor host when the CPU/host is running with next-RIP support disabled (nrips=false). In that mode the WRMSR, HLT and INVD VM-Exit fastpath handlers attempt to decode and emulate the guest instruction to advance RIP, which reads guest memory and can sleep - but these handlers run with IRQs disabled, triggering a 'sleeping function called from invalid context' BUG and destabilizing the host. There is no public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile); despite the 7.1 CVSS the scope-changed availability impact is gated by a non-default configuration.
Out-of-bounds slab read in the Linux kernel's HFS+ filesystem driver (fs/hfsplus/unicode.c) allows a local low-privileged attacker to read adjacent kernel heap memory by triggering hfsplus_uni2asc() through the listxattr() path on a crafted/malformed HFS+ image. Because hfsplus_listxattr() passes a struct hfsplus_attr_unistr* whose layout differs from the struct hfsplus_unistr* the earlier fix (commit 94458781aee6) assumed, an oversized ustrlen drives the Unicode buffer pointer past the allocation. There is no public exploit identified at time of analysis, and EPSS is low (0.18%), consistent with a memory-disclosure primitive requiring local filesystem access rather than remote mass exploitation.
Link following vulnerability in AntiDupl.NET.WinForms.exe (versions through 2.3.12) allows local authenticated users to manipulate file operations during duplicate image deletion, potentially achieving unauthorized file access or modification with elevated integrity. Proof-of-concept exploit code exists (CVSS E:P). The vendor (ermig1979) was notified but has not responded, leaving users without an official patch.
Memory corruption in the Linux kernel's crypto compression subsystem (scomp/acomp) arises because struct layout randomization can reorder the alloc_ctx and free_ctx function pointers in scomp_alg independently of the crypto_acomp_streams struct that was built to mirror them, introduced by commit 42d9f6c77479. When the CONFIG_RANDSTRUCT hardening feature reorders these pure ops structures inconsistently, the kernel invokes the wrong context allocation/free callback, leading to high-impact confidentiality, integrity, and availability effects for a local low-privileged actor. No public exploit identified at time of analysis and EPSS probability is low (0.17%), so this is a hardening-regression fix rather than an actively exploited flaw.
MaxSite CMS up to version 109 contains an improper access control vulnerability in the file editor plugin that allows authenticated remote attackers to upload arbitrary files by manipulating the file_path and content parameters in save-file-ajax.php. Publicly available exploit code exists for this vulnerability, and the vendor has not responded to early disclosure attempts, leaving affected installations unpatched.
MaxSite CMS up to version 109 contains an unrestricted file upload vulnerability in the auto_post plugin's upload handler that allows authenticated remote attackers to bypass file upload restrictions by manipulating HTTP headers (X-Requested-FileName and X-Requested-FileUpDir). Public exploit code is available, though EPSS score (0.05%) suggests limited real-world exploitation despite the publicly disclosed proof-of-concept.
Stored cross-site scripting (XSS) in code-projects E-Commerce Website 1.0 allows remote attackers to inject malicious scripts via the supp_name or supp_address parameters in /pages/supplier_update.php. Exploitation requires user interaction (clicking a malicious link) but no authentication. Publicly available exploit code exists; real-world exploitation risk is low (EPSS 0.04%, CVSS 2.1) due to limited scope and required user interaction, but the vulnerability is disclosed and weaponizable.
Stored cross-site scripting (XSS) vulnerability in SourceCodester Student Grades Management System 1.0 allows authenticated administrators with high privileges to inject malicious scripts via the delete_user function in /admin.php, which execute in the context of other users' browsers when they interact with affected content. The vulnerability requires user interaction and administrative privileges to exploit, resulting in low integrity impact with a CVSS score of 1.9. Publicly available exploit code exists, though the very low EPSS score (0.05%, 14th percentile) suggests limited real-world exploitation despite POC availability.
Kernel denial-of-service in the Linux mm/ksm subsystem allows a local low-privileged user to crash or destabilize the kernel by triggering a type-promotion bug in ksm_madvise(). When MADV_UNMERGEABLE is applied to a VMA registered with userfaultfd (UFFD) in MINOR mode, the function incorrectly clears the upper 32 bits of vma->vm_flags due to a C integer promotion defect, producing a UFFD inconsistency that causes a kernel BUG or WARNING at mm/userfaultfd.c:2067 during fd cleanup. No public exploit has been identified and EPSS is 0.33% (26th percentile), but the crash was confirmed via syzkaller fuzzing and patches have been backported across multiple stable kernel branches.
Remote unauthenticated SQL injection in Ghost Hot Spot's login form allows direct database manipulation and potential authentication bypass for versions up to 20251014, confirmed by published POC code. The extremely low EPSS score (0.03%, 7th percentile) contradicts technical exploitability metrics, suggesting limited real-world threat from this niche product. Vendor non-response precludes a timely security patch.
Incorrect privilege assignment in the TrustyAI component of Red Hat OpenShift AI exposes pod, PersistentVolumeClaim, and LMEvalJob metadata cluster-wide to every authenticated user or service account. The TrustyAI operator automatically provisions a ClusterRoleBinding that binds the role `trustyai-service-operator-lmeval-user-role` to `system:authenticated`, the built-in Kubernetes group encompassing all authenticated identities - meaning any user or workload with valid cluster credentials inherits get/list/watch permissions on pods in every namespace. No special conditions are required beyond holding any valid credential on the cluster. No public exploit has been identified at time of analysis, and the EPSS score of 0.03% reflects low opportunistic exploitation probability, though the misconfiguration is trivially leveraged by any cluster tenant.
Race conditions in the ksmbd in-kernel SMB server's RPC handle list (sess->rpc_handle_list XArray) expose systems to use-after-free and kernel availability loss. ksmbd_session_rpc_open() incorrectly acquired only a read lock before performing mutating XArray operations, and ksmbd_session_rpc_method() performed xa_load() with no lock at all - creating a window where concurrent session operations can corrupt or dereference freed memory. No public exploit exists and EPSS is 0.13% (3rd percentile), placing real-world exploitation risk very low, though the use-after-free primitive carries latent potential beyond the scored availability impact.
Path normalization bypass in Keycloak allows unauthenticated network attackers to circumvent reverse proxy access controls protecting the /admin interface by submitting HTTP requests with non-normalized paths (containing `..` or `//`). Proxies such as HAProxy perform literal string matching on the raw request URI and do not block these crafted paths, while Keycloak internally normalizes them to resolve to /admin — effectively defeating the proxy-layer security control. This vulnerability is not in CISA KEV and carries a low EPSS score (0.38%), but is directly relevant to any proxy-protected Keycloak deployment following the vendor's own recommended hardening guidance.
Yonyou U8 Cloud versions up to 5.1sp allow authenticated remote attackers to bypass file upload restrictions via manipulation of the ts and sign parameters in the /service/NCloudGatewayServlet endpoint, enabling unrestricted file uploads. The vulnerability affects the Request Header Handler component and has been publicly disclosed with exploit code available, though the vendor has not responded to early notification.
In the Linux kernel, the following vulnerability has been resolved: nbd: restrict sockets to TCP and UDP Recently, syzbot started to abuse NBD with all kinds of sockets. Commit cf1b2326b734 ("nbd: verify socket is supported during setup") made sure the socket supported a shutdown() method. Explicitely accept TCP and UNIX stream sockets.
In the Linux kernel, the following vulnerability has been resolved: bpf: Explicitly check accesses to bpf_sock_addr Syzkaller found a kernel warning on the following sock_addr program: 0: r0 = 0 1: r2 = *(u32 *)(r1 +60) 2: exit which triggers: verifier bug: error during ctx access conversion (0) This is happening because offset 60 in bpf_sock_addr corresponds to an implicit padding of 4 bytes, right after msg_src_ip4. Access to this padding isn't rejected in sock_addr_is_valid_access and it thus later fails to convert the access. This patch fixes it by explicitly checking the various fields of bpf_sock_addr in sock_addr_is_valid_access. I checked the other ctx structures and is_valid_access functions and didn't find any other similar cases. Other cases of (properly handled) padding are covered in new tests in a subsequent patch.
In the Linux kernel, the following vulnerability has been resolved: pps: fix warning in pps_register_cdev when register device fail Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error handling in __video_register_device()"), the release hook should be set before device_register(). Otherwise, when device_register() return error and put_device() try to callback the release function, the below warning may happen. ------------[ cut here ]------------ WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567 Modules linked in: CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567 Call Trace: <TASK> kobject_cleanup+0x136/0x410 lib/kobject.c:689 kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0xe9/0x130 lib/kobject.c:737 put_device+0x24/0x30 drivers/base/core.c:3797 pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402 pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108 pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57 tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432 tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563 tiocsetd drivers/tty/tty_io.c:2429 [inline] tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl fs/ioctl.c:584 [inline] __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> Before commit c79a39dc8d06 ("pps: Fix a use-after-free"), pps_register_cdev() call device_create() to create pps->dev, which will init dev->release to device_create_release(). Now the comment is outdated, just remove it. Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed in pps_register_source() to avoid a double free in the failure case.