Broken access control in the Deposits and Partial Payments for WooCommerce plugin (MagePeople Team) versions up to and including 3.1.0 allows unauthenticated network attackers to perform unauthorized integrity-impacting actions on deposit and partial payment functionality. The root cause is CWE-862 (Missing Authorization), meaning certain plugin endpoints or AJAX actions execute restricted operations without validating whether the caller has permission to do so. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated IDOR in Quiz And Survey Master WordPress plugin (versions ≤ 11.2.5) allows remote attackers to access quiz or survey objects they are not authorized to view by manipulating user-controlled resource identifiers. The flaw carries a CVSS 5.3 (C:L/I:N/A:N), meaning impact is limited to confidentiality - no data modification or denial of service is possible. No public exploit code or CISA KEV listing is identified at time of analysis, but the unauthenticated network vector lowers the bar for opportunistic discovery.
Stored cross-site scripting in Chamilo LMS allows unauthenticated remote attackers to inject persistent malicious scripts into survey reporting views by exploiting deterministic invitation codes to bypass the survey submission authorization check. Affected versions are Chamilo LMS before 1.11.42 (1.x branch) and before 3.0.0 (3.x branch). When a teacher or administrator subsequently views the survey reporting interface, the stored payload executes in their browser session, enabling session hijacking and - per the description - automated creation of backdoor administrative accounts. No public exploit identified at time of analysis, but VulnCheck has published a dedicated advisory.
Payment authority reuse in the Persian Elementor WordPress plugin (versions 2.7.10 through before 2.8.2) lets unauthenticated attackers complete pending orders without making a real payment. The ZarinPal payment callback handler accepts any valid authority token without verifying it was issued for the specific transaction being fulfilled, so an attacker who obtains an authority token from any ZarinPal transaction can submit it to a different pending order's callback and have the plugin mark that order as paid. No public exploit code has been identified at time of analysis, but the low attack complexity makes abuse straightforward on affected sites running active ZarinPal integrations.
Insecure Direct Object Reference in the Nexi XPay Build WordPress payment plugin (versions 7.6.1-7.6.2) exposes stored card token references and valid authorization signatures belonging to arbitrary customers to unauthenticated network attackers. The plugin's token retrieval endpoint performs no ownership verification, allowing any external actor to enumerate and retrieve payment credentials associated with other users' accounts. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the unauthenticated, zero-complexity vector makes automated harvesting trivial.
Reflected XSS in WWBN AVideo's Gallery plugin allows unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers by supplying a malicious payload in the `getBackURL` GET parameter targeting `plugin/Gallery/view/Category.php`. The injected value is echoed directly into an href attribute without HTML encoding, enabling `javascript:` URI injection that fires when a visitor interacts with the Back navigation control while the SubCategorys feature is active. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 base score of 5.3 appropriately reflects the mandatory user-interaction step that constrains mass exploitation.
Reflected XSS in WWBN AVideo's confirmLivePassword.php allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL. The vulnerability arises because the PHP script copies REQUEST_URI verbatim into an HTML form action attribute - a quote character in the URL path breaks attribute context and enables injection of arbitrary event handlers executing within the site's origin. No public exploit code or active exploitation has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms low-complexity unauthenticated exploitation gated only on passive victim interaction.
Reflected XSS in WWBN AVideo's Live plugin (plugin/Live/confirmLivePassword.php) allows remote unauthenticated attackers to execute arbitrary JavaScript in the browser of any user - including administrators - who follows a crafted link. The GET parameter `u` bypasses the application's `$securityFilter` and is interpolated without encoding directly into an HTML `<img src="...">` attribute, enabling attribute breakout and injected event-handler execution. No patched version was available at time of disclosure; no public exploit code or active exploitation (CISA KEV) has been identified.
Reflected XSS in WWBN AVideo's showAlertMessage() function allows unauthenticated attackers to inject arbitrary JavaScript into the site's execution context by abusing how the raw HTTP Referer header is embedded inside a JavaScript block comment without output encoding. Exploitation requires luring a victim to navigate to AVideo from an attacker-controlled page so the browser automatically includes the crafted Referer header. The injected script executes under the AVideo site origin, enabling session theft, credential harvesting, or UI redressing against authenticated users.
Unauthenticated brute-force authentication bypass in the Xootix OTP Login & Register WooCommerce plugin (≤2.7.2) allows remote attackers to hijack any registered WordPress user's session - including administrators - by exhausting a trivially small OTP space. Two compounding flaws make this practical at scale: the rate-limit attempt counter is keyed on the attacker-controlled `xoo_ml_user_ip_data` cookie rather than the true network source address, enabling unlimited counter resets by rotating the cookie, while OTPs are generated with PHP's non-cryptographic `rand()` over only 9,000 possible values. Successful exploitation calls `wp_set_auth_cookie()`, granting a full WordPress authentication session. No public exploit code or CISA KEV listing has been identified at time of analysis.
Missing object-level authorization in Concrete CMS below 9.5.3 allows a signed-in dashboard user with limited Page Type editing rights to modify arbitrary Page Types outside their assigned permission boundary. The Types::submit() controller accepts a user-supplied ptID parameter and persists the targeted Page Type without invoking canEditPageType(), meaning the CSRF token validation - which is action- and user-scoped only - provides no object-level constraint. No public exploit or active exploitation has been identified; the vendor self-reported this as a moderate integrity issue (CVSS 4.0: 5.1) and patched it in version 9.5.3.
Stored cross-site scripting in Concrete CMS below 9.5.3 allows an authenticated user holding file-property edit permissions to inject persistent script payloads via the Document Library block's description and tags fields, executing against any visitor - including unauthenticated users - who loads a page rendering those columns. The block controller returned description and tags values without the h() output-escaping helper already applied to the title column, and the view template wrote these raw values directly into the HTML results table. Successful exploitation can result in session token theft or unauthorized browser-side actions against visitors. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in Concrete CMS before 9.5.3 allows authenticated users with limited Express entry permissions to inject entries into Express objects they are not authorized to modify. The vulnerability stems from a parameter confusion bug where the permission check validates the entity supplied in the POST body, but the dashboard submit route resolves the actual target entity from an attacker-controlled route ID - and the two are never compared. An attacker who legitimately holds add-entry permissions on one Express object can therefore write to entirely different, protected datasets, potentially triggering administrative workflows or polluting content managed by higher-privilege users. No public exploit code or CISA KEV listing has been identified at time of analysis.
Missing authorization in Concrete CMS 9.2.0-9.5.2 allows authenticated editors holding block-add scope to bypass file-manager visibility controls by exploiting the Area API's block-create endpoint, which never invokes the block type controller's validate() method. For file-referencing block types such as hero_image and gallery, this validate() call is the sole enforcement point for file access authorization - its omission means a restricted file reference can be stored and rendered on any page. The unauthorized file's URL and thumbnail preview are then disclosed to both the submitting editor and all page visitors, with the severity of that disclosure dependent on whether public or private file storage is configured. No public exploit has been identified at time of analysis.
Open redirect in the file-upload handler of an ICS inventory management product (covered by ICS-CERT advisory ICSA-26-254-01) allows an authenticated attacker to redirect other authenticated users' browsers to arbitrary external destinations. The handler reflects the Referer header directly into a post-upload Location response without validating it against the application's own origin, enabling phishing and credential-harvesting chains. No public exploit code exists and this CVE is not listed in the CISA KEV catalog; however, its presence in an OT/ICS context and sharing an advisory with at least one other vulnerability in the same product (CVE-2026-90456) indicates a broader security review of this component is warranted.
CSV formula injection in WWBN AVideo (through commit c3edcc274) enables authenticated users to embed spreadsheet formula payloads in comments that execute when administrators or video owners open exported CSV files from the myComments.download.php endpoint. The unsanitized comment text containing =, +, -, or @ prefixes is written directly into the CSV output, which spreadsheet applications interpret as executable expressions. Depending on the victim's application and security settings, this can chain to OS command execution via DDE or similar mechanisms, elevating a low-privilege user's impact to the admin's local session. No public exploit has been identified and it is not listed in CISA KEV.
Open redirect combined with CSRF guard bypass in WWBN AVideo allows a remote unauthenticated attacker to redirect authenticated playlist managers to attacker-controlled phishing sites. The vulnerability resides in `objects/playlistSort.php`, which escapes AVideo's automatic CSRF protection because it lacks the `.json.php` filename suffix that triggers `autoCSRFGuard()`/`forbidIfIsUntrustedRequest()`, while simultaneously forwarding the unvalidated `HTTP_REFERER` header as a `Location` redirect without invoking AVideo's own `isSafeRedirectURL()` sanitizer. No patched version is available at time of analysis, leaving all AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1 exposed to both playlist tampering and browser hijacking.
Keycloak's Dynamic Client Registration endpoint exposes confidential client secrets in cleartext to users holding the view-clients realm management role, violating the principle of least privilege. Affected deployments include Red Hat Build of Keycloak and Red Hat Single Sign-On 7 across all tracked versions. An attacker granted only read-only view-clients access can harvest any confidential OAuth/OIDC client secret via the registration API and subsequently authenticate as that client, escalating their effective permissions within the realm to whatever the compromised client is authorized to do.
Stored cross-site scripting in Concrete CMS versions below 9.5.3 allows an authenticated user with edit_page_contents permissions to inject malicious script payloads via the Date Format field in the Page Attribute Display block. Any site visitor who subsequently loads a page containing the poisoned block will execute the attacker's script in their browser, enabling session-token theft or malicious redirects. A vendor-released patch is available (9.5.3), no public exploit has been identified, and no CISA KEV listing exists at time of analysis.
Out-of-bounds read (CWE-125) in Citrix Workspace App for Windows exposes local, low-privileged users to limited memory disclosure and partial availability impact across Current Release and both LTSR branches. An attacker with local access and a standard user account can trigger the defect without user interaction, potentially reading a small amount of process memory and causing intermittent instability. No active exploitation or public exploit code has been identified; the vendor-released patch addresses the issue across all three affected release trains.
Email header injection in MetForm WordPress plugin before 4.1.9 allows unauthenticated attackers to inject arbitrary SMTP headers - such as Bcc - into notification emails dispatched by the site, by embedding newline characters in form field submissions that are configured to populate those headers. This enables silent exfiltration of form submission content to attacker-controlled addresses and potential abuse of the site as a spam relay. No public exploit code or CISA KEV listing exists; the CVSS 4.8 with AC:H correctly reflects the configuration prerequisite that limits the exploitable surface.
Out-of-bounds write (CWE-787) in Citrix Workspace app for Windows allows a physically present, low-privileged attacker to corrupt memory, resulting in high integrity and availability impact on the affected endpoint. Affected versions span all supported tracks: Current Release builds before 2603.11, LTSR 2507.x builds before CU3 (2507.1), and LTSR 2607 builds before the base release. No public exploit code has been identified at time of analysis, and the physical access requirement substantially constrains real-world exploitability despite the VI:H/VA:H impact ratings.
Integer overflow in GStreamer's gst-plugins-good isomp4 plugin exposes adjacent heap memory when parsing CEA-608 closed-caption data embedded in specially crafted MP4 or MOV files. The 32-bit unsigned arithmetic wraparound bypasses a bounds check, enabling an out-of-bounds heap read of up to 244 bytes that is forwarded into downstream caption output - leaking process memory to an attacker who controls caption rendering output. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit has been identified at time of analysis, and no active exploitation is confirmed.
Cross-site request forgery in Site Kit by Google WordPress plugin version 1.186.0 and earlier allows an unauthenticated remote attacker to perform unauthorized actions on behalf of authenticated site administrators or editors. The flaw (CWE-352) exists because the plugin fails to properly validate request origin tokens, enabling forged state-changing requests to succeed when an authenticated victim interacts with attacker-controlled content. No public exploit has been identified at time of analysis, and real-world impact is constrained by the UI:R requirement - a legitimate privileged user must be socially engineered into triggering the request.
Contributor-level Insecure Direct Object Reference (IDOR) in the Starter Templates WordPress plugin (≤4.7.5) permits authenticated low-privilege users to manipulate object identifiers in plugin requests, modifying resources outside their authorized scope. Reported by Patchstack with a CVSS 4.3, the flaw is bounded to integrity-only impact - no data disclosure or availability disruption applies. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis.
Slim SEO WordPress plugin versions up to and including 4.10.0 exposes an Insecure Direct Object Reference (IDOR) vulnerability exploitable by authenticated contributors. With only contributor-level access (PR:L), an attacker can access SEO-related data objects - such as post metadata or SEO settings - that belong to other users or posts they are not authorized to view. The vulnerability is limited to confidentiality impact (C:L) with no integrity or availability consequence, and no public exploit has been identified at time of analysis.
Server-side template injection (SSTI) in Arma Digital Media Inc.'s Website Template product enables remote unauthenticated attackers to inject template engine expressions that are evaluated server-side, achieving code injection. All versions through build 11092026 are affected, and the vendor did not respond to TR-CERT's responsible disclosure, leaving no vendor-released patch available. No public exploit or CISA KEV listing has been identified at time of analysis.
Stack overflow in glibc's nscd (Name Service Cache Daemon) service, versions 2.3.4 and later, can be triggered by a malicious DNS server returning an oversized DNS response, causing the daemon to crash and degrading DNS resolution performance for the affected host. There is a remote theoretical possibility of nscd cache corruption if an attacker achieves precise heap-pointer control during the overflow, introducing a limited integrity impact on cached DNS data. nscd's isolated execution context (unprivileged user, no shell) constrains any post-crash impact, and no active exploitation has been identified.
live-boot at commit ff8867c silently skips dm-verity root hash signature verification when the .verity file is absent from the live medium, allowing a physically present attacker to boot a tampered or unsigned root filesystem image that bypasses integrity enforcement. The flaw undermines the dm-verity-enforce-roothash-signature kernel protection intended to guarantee boot-time filesystem authenticity on Debian live systems. No public exploit code has been identified at time of analysis; the CVSS 4.0 physical-access vector (AV:P) and attack-requirement condition (AT:P) significantly constrain real-world exploitability.
Restricted API token authorization bypass in Forgejo before 16.0.4 (and before 15.0.8 on the 15.x branch) allows authenticated users holding limited-scope tokens to invoke the 'allow maintainer edit' pull-request feature beyond those tokens' intended permissions. The flaw is CWE-863 Incorrect Authorization: the endpoint responsible for toggling maintainer-edit access on PRs fails to enforce token scope boundaries, permitting a scoped token to reach an operation it should be barred from. No public exploit has been identified at time of analysis, and CVSS AC:H signals that specific token configuration conditions must be met to trigger the bypass.
Two-byte memory disclosure in PCRE2's pcre2_serialize_encode function exposes a small amount of potentially sensitive memory to local adversaries who already have some form of unsafe process access. All PCRE2 releases prior to 10.48 are affected across all supported platforms, per CPE cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:*. No public exploit code or active exploitation has been identified; the vendor advisory explicitly qualifies that exploitation occurs in contexts where the adversary's access is already unsafe, substantially constraining real-world impact beyond the minimal two-byte leak.
Argument injection in Pardus Pen before version 4.2.1 allows a local, low-privileged user to inject unsanitized argument delimiters into an underlying command invocation, yielding limited integrity impact. The flaw (CWE-88) is strictly local in scope-CVSS AV:L/PR:L-and carries no confidentiality or availability consequence per the published vector. No public exploit code and no active exploitation have been identified; vendor-released patch 4.2.1 is available via the TR-CERT advisory.
Stored cross-site scripting in Flextype CMS 0.9.9 through 1.0.0-alpha.3 allows an attacker with write access to the server-side plugins directory to inject arbitrary scripts into administrators' browsers. The vulnerable sink is the dependency error page rendered by getValidPluginsDependencies() in Plugins.php, which reflects plugin directory names without HTML-encoding. Exploitation requires the attacker to first plant a malicious plugin directory name and then wait for an authenticated user to trigger a dependency validation failure; no public exploit or active exploitation has been identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: btrfs: drop recovered reloc root refs on recovery failure During relocation recovery, each fs root gets a reference to its relocation root. If loading or adding a later root fails, or if the first transaction commit fails, btrfs_recover_relocation() jumps to out_unset before merge_reloc_roots() and clean_dirty_subvols(). put_reloc_control() drops the list-owned relocation root references, but it does not clear fs_root->reloc_root or drop the references owned by those pointers. Mount cleanup only drops them when BTRFS_FS_ERROR is set, so an error such as -ENOMEM while processing a later root can leave references behind. Keep temporary references to the fs roots associated during recovery. On failure, clear their reloc_root pointers and drop the corresponding references. Once the first transaction commit succeeds, drop only the temporary fs root references and let the normal merge and cleanup paths handle the relocation roots. Fault injection on a pending-relocation image confirmed the cleanup gap. With an injected first-commit failure, 25 fs roots had reloc_root set with fs_error=0. With this fix, the same failure path drops that count to 0 before mount fails.
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() In iwl_op_mode_dvm_start(), jumping to out_free_eeprom currently bypasses the out_free_eeprom_blob label. Consequently, error paths triggered after successfully parsing the EEPROM free priv->nvm_data but leak priv->eeprom_blob. Fix this memory leak by reordering the error handling labels so that out_free_eeprom falls through to out_free_eeprom_blob. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc6. An x86_64 allyesconfig build showed no new warnings. As we do not have supported Intel DVM wireless hardware and firmware to test with, no runtime testing was able to be performed.
In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcd_debug_eeprom_read() trusts resp->raw_data[2] -- a length byte supplied by the device in its REPORT_EE_DATA reply -- clamped only to the caller's read() count: ret = resp->raw_data[2]; if (ret > s) ret = s; if (copy_to_user(u, resp->raw_data+3, ret)) It never checks resp->raw_size, the number of bytes picolcd_raw_event() actually copied into the 64-byte raw_data[] of the kmalloc'd struct picolcd_pending. A device (or a spoofed picoLCD) returning a length byte of 0xff, read with a count >= 255, makes copy_to_user() read past raw_data[] into adjacent slab memory and return it to userspace through the debugfs "eeprom" file: BUG: KASAN: slab-out-of-bounds in _copy_to_user Read of size 255 ... picolcd_debug_eeprom_read+0x214/0x2f0 [hid_picolcd] The debug-dump path in the same file already validates the device length byte against the received size before trusting it; this read does not. The file is created S_IRUSR (root-only) and a crafted device is needed, so it is neither unprivileged- nor remotely-triggerable. Clamp the copy length to resp->raw_size - 3 (the payload actually received, minus the 3-byte header), floored at 0 for short replies.
In the Linux kernel, the following vulnerability has been resolved: HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind For GHL (Guitar Hero Live) dongles, sony_probe() arms a periodic timer: ghl_magic_poke() (the timer callback) submits sc->ghl_urb, and the URB completion ghl_magic_poke_cb() re-arms the timer with mod_timer(). sony_remove() drained the timer with timer_delete_sync() and then freed the URB with usb_free_urb(): timer_delete_sync(&sc->ghl_poke_timer); usb_free_urb(sc->ghl_urb); timer_delete_sync() does not block re-arming, and while the URB is in flight the timer is not pending, so the sync delete is a no-op. A URB completion that runs after the delete re-arms the timer, and usb_free_urb() only drops a reference -- it does not kill an in-flight URB. sc is allocated with devm_kzalloc() and freed once sony_remove() returns, so the re-armed ghl_poke_timer (embedded in sc) then fires on freed memory, a use-after-free from timer softirq. This is a disconnect/rmmod race. Poison the URB first, then shut the timer down, before freeing the URB. usb_poison_urb() kills any in-flight URB and permanently rejects further submissions, so a poke timer that is still pending cannot re-submit the URB from ghl_magic_poke() in the window before timer_shutdown_sync() runs. usb_kill_urb() would not suffice: it only cancels the in-flight URB and leaves it submittable once it returns, so the pending timer could re-submit it and put a fresh URB in flight over the freed sc. timer_shutdown_sync() then drains any last callback and blocks re-arming. The probe error path is unaffected: it is only reached before the timer is armed. Reproduced under KASAN on next-20260710 via dummy_hcd + raw-gadget emulation of the GHL PS4 dongle (VID 0x1430 / PID 0x07bb): hid-sony binds and arms the poke timer, the poke URB is held in flight, the driver is unbound (freeing sc), then the URB is released. The completion re-arms the timer on the freed sc, and the re-armed timer fires ~8 s later: BUG: KASAN: slab-use-after-free in ghl_magic_poke+0x98/0xb0 Read of size 8 at addr ffff88810b02fd50 by task swapper/0/0 ghl_magic_poke+0x98/0xb0 call_timer_fn+0x35/0x2b0 __run_timers+0x69c/0x9a0 run_timer_softirq+0x173/0x2a0 Allocated by task 169: sony_probe Freed by task 338: devres_release_group <- hid_device_remove (sony_remove) Found by 0sec (https://0sec.ai) using automated source analysis.
In the Linux kernel, the following vulnerability has been resolved: serial: imx: serialize imx_uart_ports[] lifetime imx_uart_probe() publishes its devm-allocated port in imx_uart_ports[] before uart_add_one_port() because console setup uses the table. The entry is not cleared when adding the port fails or after removal, leaving a dangling pointer. A sibling probe can register the shared console through that stale entry. This was reproduced under KASAN on QEMU mcimx6ul-evk by unbinding a sibling UART, unbinding the console UART and rebinding the sibling. Keep the entry valid through uart_remove_one_port(), then clear it. Protect port addition and removal together with their table updates so sibling operations cannot interleave. Reject an occupied slot rather than clobbering an active port during a duplicate-line probe.
In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOAD_CANCEL path (clp != NULL), manage_cpntf_state() freed the target cpntf state without checking ownership. The lookup key st->si_opaque.so_id is allocated cyclically (guessable) and the embedded clientid is the fixed per-net nn->s2s_cp_cl_id, so any authenticated NFSv4.2 client could cancel and free another client's copy-notify stateid. Compare the creating clientid recorded in state->cp_p_clid against the requesting client's cl_clientid and return nfserr_bad_stateid on a mismatch instead of freeing the entry.
In the Linux kernel, the following vulnerability has been resolved: HID: roccat: free buffered reports when destroying device roccat_report_event() duplicates each report with kmemdup() and stores the allocation in a circular-buffer slot. The allocation is released only when that slot is reused. The device destruction paths free struct roccat_device without releasing reports still stored in cbuf[]. This makes those allocations unreachable and leaks up to ROCCAT_CBUF_SIZE report buffers per device. Add a small destructor that frees every buffered report before freeing the device, and use it in both paths that can destroy a registered device.
In the Linux kernel, the following vulnerability has been resolved: efivarfs: Rate limit statfs() handler Ravi reports that statfs() may be called by unprivileged users on the efivarfs mount point, which may result in a flood of calls to the QueryVariableInfo() runtime service. These calls are disproportionately costly on x86 systems where the variable store is backed by SMM, as each SMM entry requires a rendez-vous of all the CPUs. So rate limit the calls to QueryVariableInfo() at twice per second, and return the most recently obtained value for calls that are elided.
In the Linux kernel, the following vulnerability has been resolved: jbd2: bound shrinker scans by examined checkpoint buffers The jbd2 shrinker currently accounts only checkpoint buffers that it successfully releases against nr_to_scan. Busy buffers therefore do not consume the scan budget. If a checkpoint transaction contains mostly busy buffers, the shrinker can scan its entire checkpoint list while holding journal->j_list_lock. Large checkpoint lists can result in excessive lock hold times and leave other CPUs spinning on j_list_lock, causing soft lockups or RCU stalls. Pass nr_to_scan into journal_shrink_one_cp_list() and decrement it for every buffer examined, including busy buffers. Pass NULL from checkpoint cleanup paths so their existing full-list behavior is preserved. This restores the scan-budget semantics that existed before journal_shrink_one_cp_list() was changed to always scan a complete checkpoint list.
In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix power_supply reference leak bq25890_fw_probe() acquires a reference to a secondary charger using power_supply_get_by_name(), but the reference is not released on later probe failures or on driver detach. In particular, failures after bq25890_fw_probe() returns successfully, such as a failure in bq25890_hw_init(), also leak the reference. Register a device-managed cleanup action immediately after acquiring the secondary charger. This releases the reference on all subsequent probe failures and on driver detach. Found by code review.
In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: synchronize work cancellation on suspend max17040_work() requeues itself after every poll. cancel_delayed_work() only cancels a pending instance and does not wait for a callback that is already running. If system suspend races with the polling callback, the callback can continue accessing the fuel gauge and requeue itself after the suspend callback returns. Use cancel_delayed_work_sync() to ensure polling is quiesced before suspend completes.
In the Linux kernel, the following vulnerability has been resolved: net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO rtl83xx_reset_assert() and rtl83xx_reset_deassert() are only called from the probe path, which may sleep and is not timing-critical. When the reset GPIO is provided by a sleeping controller such as an I2C I/O expander, gpiod_set_value() warns: WARNING: drivers/gpio/gpiolib.c:4030 at gpiod_set_value+0x44/0x80, CPU#1: kworker/u16:4/61 Hardware name: B&O MAP CA33 Rev f (UNKNOWN) (DT) Workqueue: events_unbound deferred_probe_work_func pc : gpiod_set_value+0x44/0x80 lr : rtl83xx_probe+0x1d8/0x3a0 Call trace: gpiod_set_value+0x44/0x80 (P) rtl83xx_probe+0x1d8/0x3a0 realtek_mdio_probe+0x24/0xa0 mdio_probe+0x38/0x78 really_probe+0xc4/0x3e0 __driver_probe_device+0x15c/0x1b8 driver_probe_device+0xb4/0x120 __device_attach_driver+0xb8/0x1a0 bus_for_each_drv+0x88/0xf0 __device_attach+0xa0/0x1d8 device_initial_probe+0x54/0x68 bus_probe_device+0x38/0xa0 deferred_probe_work_func+0xb8/0x120 process_one_work+0x184/0x4e8 worker_thread+0x188/0x308 kthread+0x130/0x150 ret_from_fork+0x10/0x20 Switch both helpers to gpiod_set_value_cansleep() so such a reset GPIO can be used without triggering the warning. The reset GPIO has been driven with the non-sleeping gpiod_set_value() since the driver was added in v4.19. The call has since been refactored across several files - from realtek-smi.c / realtek-mdio.c into the common rtl83xx.c module and then into the rtl83xx_reset_assert() and rtl83xx_reset_deassert() helpers (both in v6.9). This patch therefore applies as-is only to kernels that carry those helpers (v6.9+); older stable kernels need the same gpiod_set_value_cansleep() conversion at the corresponding open-coded call sites.
In the Linux kernel, the following vulnerability has been resolved: fs: fix user path of nested backing files backing_file_open() derives the path to be stored in the new backing file from user_file->f_path. This is incorrect when user_file itself is a backing file, which is the case for nested stacking filesystems, e.g. overlayfs mounts where the lowerdir of one overlayfs is the merged directory of another. Since commit def3ae83da02 ("fs: store real path instead of fake path in backing file f_path") the f_path of a backing file holds the real path of the intermediate layer, not the path that the user opened. Commit 924577e4f6ca ("ovl: Fix nested backing file paths") fixed this for such configurations by passing file_user_path() from ovl_open_realfile(). However, commit 6af36aeb147a ("lsm: add backing_file LSM hooks") changed the first argument of backing_file_open() from the user path back to the user file and derived the path from user_file->f_path again, silently re-introducing the problem. As a result, files mapped through a nested overlayfs show the wrong path in /proc/<pid>/maps and in perf/ftrace mmap records. For example, with two nested overlayfs mounts: mkdir -p /ovl/{lower,upper,work,merged} /ovl/nested echo hello > /ovl/lower/foo mount -t overlay overlay \ -o lowerdir=/ovl/lower,upperdir=/ovl/upper,workdir=/ovl/work \ /ovl/merged # at least two lowerdirs are needed when upperdir is nonexistent mount -t overlay overlay \ -o lowerdir=/ovl/merged:/ovl/lower /ovl/nested mapping /ovl/nested/foo shows a disconnected path instead of the user path: # readlink /proc/self/fd/3 /ovl/nested/foo # grep foo /proc/self/maps 7f6e2c100000-7f6e2c101000 r--s 00000000 00:24 15813027 /foo The bogus path is derived from the f_path of the intermediate backing file, whose mount is a private clone that d_path() cannot resolve. Fix this by using file_user_path(), which returns the outermost user-visible path for backing files and falls back to &user_file->f_path for regular files. This restores the behavior of commit 924577e4f6ca ("ovl: Fix nested backing file paths") for overlayfs and also fixes the same problem for the other backing_file_open() callers, fuse passthrough and erofs ishare, when their user file is itself a backing file. backing_tmpfile_open() has the same pattern but is not affected: it is only called by ovl_create_tmpfile() for the upper layer, and another overlayfs is rejected as upperdir by the DCACHE_OP_REAL check in ovl_mount_dir_check(), so its user_file can never be a backing file.
In the Linux kernel, the following vulnerability has been resolved: mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() migrate_pages_batch() unmaps each folio before moving it, and every unmap runs the mmu_notifier invalidate callbacks. On KVM hosts try_to_migrate() ends up in kvm_mmu_notifier_invalidate_range_start() -> tdp_mmu_zap_leafs(), which is expensive, so unmapping a large batch keeps the CPU busy for a long time. The loop already calls cond_resched(), but on PREEMPTION kernels that is a no-op, and involuntary preemption is not a Tasks-RCU quiescent state. A long batch therefore never reports a quiescent state, and the migrating task (e.g. kcompactd) becomes a Tasks-RCU holdout, stalling the Tasks-RCU grace period for minutes, which is common at Meta fleet: INFO: rcu_tasks detected stalls on tasks: 0000000055349ecc: .. nvcsw: 1157401/1157401 holdout: 1 idle_cpu: -1/56 task:kcompactd0 state:R running task Call Trace: tdp_mmu_zap_leafs tdp_mmu_next_root gfn_to_pfn_cache_invalidate_start kvm_mmu_notifier_invalidate_range_start __mmu_notifier_invalidate_range_start try_to_migrate_one try_to_migrate migrate_pages_batch migrate_pages compact_zone compact_node kcompactd kthread Use cond_resched_tasks_rcu_qs() so a quiescent state is reported even when cond_resched() does nothing. This has also been discussed at [1]
In the Linux kernel, the following vulnerability has been resolved: mm/mglru: fix and remove redundant unevictable folio handling sort_folio() has a shortcut for moving folios that are no longer evictable but are still sitting on a generation list. However, this shortcut is buggy. It does not follow the PG_lru usage convention, and it has a more serious issue. Unevictable folios are not threaded on lists[LRU_UNEVICTABLE], so that folio->lru can be reused to hold folio->mlock_count (see the comment in lruvec_init()). Hence lruvec_add_folio() skips the list_add() for them, and every other place that turns a folio unevictable initialises mlock_count explicitly: lru_add() sets it to 0, __mlock_folio() and __mlock_new_folio() set it to !!folio_test_mlocked(folio). sort_folio() sets nothing, and the lru_gen_del_folio() right above it may have already poisoned folio->lru via list_del(), so mlock_count ends up aliasing LIST_POISON2, which reads as 0x122, i.e. 290. The result is user visible. On munlock, __munlock_folio() decrements that bogus count, finds it still non-zero and bails out before clearing PG_mlocked, so the folio remains unevictable and the Mlocked accounting stays inflated until the folio is freed. The shortcut also touches the LRU flags in the wrong order. It calls lru_gen_del_folio() while PG_lru is still set, so a concurrent folio_test_clear_lru() (e.g. compaction, folio_isolate_lru()) can succeed on a folio that has already been taken off the generation list, which may lead to unexpected behavior. So fix it by isolating them as common folios and letting the generic shrink path cull them. This matches the classical LRU behavior, and there should be no visible effect on the generic eviction or isolation behavior. There is no performance concern either, such a folio goes through this once, and then it is off the generation lists for good.
In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() I am seeing some rcu_tasks stalls in the Meta fleet during reclaim. INFO: rcu_tasks detected stalls on tasks: 0000000088620d09: .. nvcsw: 6735/6735 holdout: 1 idle_cpu: -1/8 task:GlobalCPUThread state:R running task pid:2552016 tgid:2524552 Call Trace: shrink_lruvec mem_cgroup_iter shrink_node do_try_to_free_pages try_to_free_pages __alloc_frozen_pages_noprof alloc_pages_noprof pte_alloc_one __pte_alloc handle_mm_fault Nothing promises direct reclaim returns in bounded time, and the scan loop in shrink_lruvec() only calls cond_resched(), which is a no-op on PREEMPTION kernels. Involuntary preemption is not a Tasks-RCU quiescent state, so the reclaiming task never reports one and becomes a holdout. Upgrade it to cond_resched_tasks_rcu_qs(), which reports a quiescent state even when cond_resched() does nothing. PS: This has been discussed in [1]
In the Linux kernel, the following vulnerability has been resolved: lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Patch series "lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()", v2. This series fixes an off-by-one out-of-bounds read in ucs2_strnlen(). The first patch is the real fix, the second patch comes as a bonus and fixes the code indentation. This patch (of 2): ucs2_strnlen() checks the current character before checking whether the caller-provided maximum length has been reached. If the input is not NUL-terminated within that bound, the loop can read one ucs2_char_t past the limit. Test the length before dereferencing to prevent an off-by-one out-of-bounds read.