Information Disclosure
Monthly
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct trace_event_call', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member is 'refcnt', which acts as an active reference counter. When a dynamic event (such as kprobe, uprobe, fprobe, eprobe, or wprobe) has a non-zero reference count (e.g. due to active event triggers or perf attachments), its 'call->module' evaluates to a small non-zero integer instead of NULL. When filtering or setting events for a specific module (e.g., writing ':mod:<module>' to 'set_event'), the code in '__ftrace_set_clr_event_nolock()' and 'update_event_fields()' reads 'call->module' directly without checking whether the event is dynamic. This causes the kernel to treat the small integer (refcnt) as a 'struct module' pointer, leading to a NULL/invalid pointer dereference (Oops) when dereferencing the module name. Fix this by ensuring that the 'TRACE_EVENT_FL_DYNAMIC' flag is checked before treating 'call->module' as a valid pointer in these code paths.
In the Linux kernel, the following vulnerability has been resolved: arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates When seccomp support was originally added to arm64 in a1ae65b21941 ("arm64: add seccomp support"), seccomp was erroneously called _before_ the ptrace syscall-enter-stop and therefore the tracer could trivially manipulate the syscall register state after the seccomp check had passed. This was subsequently fixed in a5cd110cb836 ("arm64/ptrace: run seccomp after ptrace") by moving the seccomp check after the tracer has run. Unfortunately, a decade later, that fix has been reported to be incomplete. On arm64, both the first argument to a syscall and its eventual return value are allocated to register x0. In order to facilitate syscall restarting and querying of syscall arguments on the syscall exit path, the original value of x0 is stashed in 'struct pt_regs::orig_x0' early during the syscall entry path and is returned for the first argument by syscall_get_arguments(). Unlike 32-bit Arm, this stashed value is not directly exposed via ptrace() and so changes to register x0 made by the tracer on a syscall-enter-stop are not reflected in 'orig_x0'. This means that seccomp, syscall tracepoints and audit can observe a stale value for the register compared to the argument that will be observed by the actual syscall. Re-sync 'orig_x0' from x0 on the syscall entry path following a potential ptrace stop (i.e. PTRACE_EVENTMSG_SYSCALL_ENTRY or SECCOMP_RET_TRACE). This behaviour is limited to native tasks (because compat tasks expose 'orig_r0' to ptrace) where the syscall is not being skipped (because x0 is updated to hold the return value of -ENOSYS in that case).
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: userspace: fix use-after-free in get_local_id In mptcp_pm_userspace_get_local_id(), the address entry is looked up under spinlock, but its id is read after dropping the lock. A concurrent deletion can free the entry between the unlock and the read, leading to UAF. The race window is narrow. It was reproduced only with a locally constructed stress test that repeatedly overlaps an MP_JOIN SYN with a MPTCP_PM_CMD_SUBFLOW_DESTROY request. However, the KASAN report below confirms that the race is reachable: [ 666.319376] BUG: KASAN: slab-use-after-free in mptcp_userspace_pm_get_local_id+0x1dc/0x1f0 [ 666.319386] Read of size 1 at addr ffff888124845610 by task swapper/0/0 ... [ 666.319401] Call Trace: [ 666.319405] <IRQ> [ 666.319408] dump_stack_lvl+0x53/0x70 [ 666.319412] print_address_description.constprop.0+0x2c/0x3b0 [ 666.319418] print_report+0xbe/0x2b0 [ 666.319421] ? mptcp_userspace_pm_get_local_id+0x1dc/0x1f0 [ 666.319423] kasan_report+0xce/0x100 [ 666.319426] ? mptcp_userspace_pm_get_local_id+0x1dc/0x1f0 [ 666.319429] mptcp_userspace_pm_get_local_id+0x1dc/0x1f0 [ 666.319433] mptcp_pm_get_local_id+0x371/0x440 ... [ 666.319821] Allocated by task 45539: [ 666.319844] kasan_save_stack+0x33/0x60 [ 666.319855] kasan_save_track+0x14/0x30 [ 666.319858] __kasan_kmalloc+0x8f/0xa0 [ 666.319863] __kmalloc_noprof+0x1e7/0x520 [ 666.319867] sock_kmalloc+0xdf/0x130 [ 666.319885] sock_kmemdup+0x1b/0x40 [ 666.319888] mptcp_userspace_pm_append_new_local_addr+0x261/0x500 [ 666.319910] mptcp_pm_nl_announce_doit+0x16a/0x610 ... [ 666.319967] Freed by task 45560: [ 666.319988] kasan_save_stack+0x33/0x60 [ 666.319991] kasan_save_track+0x14/0x30 [ 666.319994] kasan_save_free_info+0x3b/0x60 [ 666.319998] __kasan_slab_free+0x43/0x70 [ 666.320000] kfree+0x166/0x440 [ 666.320003] sock_kfree_s+0x1d/0x50 [ 666.320007] mptcp_userspace_pm_delete_local_addr.isra.0+0x157/0x200 [ 666.320011] mptcp_pm_nl_subflow_destroy_doit+0x51d/0xea0 Fix by copying the id into a local variable while still holding the lock, and use -1 as a "not found" sentinel.
In the Linux kernel, the following vulnerability has been resolved: afs: Fix afs_edit_dir_remove() to get, not find, block 0 Fix afs_edit_dir_remove() to use afs_dir_get_block() to get block 0 rather than afs_dir_find_block() as the latter caches the found block in the afs_dir_iter and may[*] switch out the page it's on if another afs_dir_find_block() is done. This parallels what afs_edit_dir_add() does. [*] There's more than one block per page.
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not try compression for data reloc inodes [BUG] There is a syzbot report that the check inside get_new_location() triggered: BTRFS info (device loop0): found 31 extents, stage: move data extents BTRFS info (device loop0): leaf 8908800 gen 16 total ptrs 28 free space 1676 owner 18446744073709551607 item 0 key (256 INODE_ITEM 0) itemoff 3835 itemsize 160 inode generation 5 transid 0 size 0 nbytes 0 block group 0 mode 40755 links 1 uid 0 gid 0 rdev 0 sequence 0 flags 0x0 atime 1669132761.0 ctime 1669132761.0 mtime 1669132761.0 otime 0.0 item 1 key (256 INODE_REF 256) itemoff 3823 itemsize 12 index 0 name_len 2 item 2 key (258 INODE_ITEM 0) itemoff 3663 itemsize 160 inode generation 1 transid 16 size 733184 nbytes 106496 block group 0 mode 100600 links 0 uid 0 gid 0 rdev 0 sequence 24 flags 0x18 item 3 key (258 EXTENT_DATA 0) itemoff 3595 itemsize 68 generation 16 type 0 inline extent data size 47 ram_bytes 4096 compression 1 [...] item 27 key (18446744073709551611 ORPHAN_ITEM 258) itemoff 2376 itemsize 0 BTRFS error (device loop0): unexpected non-zero offset in file extent item for data reloc inode 258 key offset 0 offset 9277520992061368337 ------------[ cut here ]------------ btrfs_abort_should_print_stack(__error) [CAUSE] The above dump tree shows the first file extent item is inlined, which should make no sense for data reloc inodes, as such inodes just represent where the data extents are in the relocation destination chunk. However the relocation path preallocates space for each block, then dirties them, cluster by cluster. It's possible to have a single block at the beginning of the block group, and no other block in the same cluster. So relocation will preallocate a file extent for that block and dirty the first block. Then memory pressure forces the data reloc inode to be written back, before any other blocks are dirtied/allocated. Finally commit 3eaf5f082c4c ("btrfs: extract inlined creation into a dedicated delalloc helper") changed the sequence of delalloc. Before that commit we always tried NOCOW first, so that dirtied block would be written back into the preallocated space, and appear as a regular extent. But with that commit, we always try inline first, and since compression is forced, we try compressing the first block, and then inline the compressed data, resulting in the above inlined file extent in the data reloc tree. Then the check in get_new_location() will check the file offset, without checking if the file extent is inlined or not, resulting in the above failure. [FIX] Do not allow compression for data reloc inodes. Since data reloc inode sizes are always block aligned, as long as we do not compress, @data_len will always be at least one block, and that will cause can_cow_file_range_inline() to return false, thus no inlined extent will be created.
In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: validate ranges in damon_set_regions() DAMON core logic assumes zero length regions don't exist. However, a few DAMON API callers including DAMON_SYSFS, DAMON_RECLAIM and DAMON_LRU_SORT allow users to set empty monitoring target regions. This could result in WARN_ONCE() on CONFIG_DAMON_DEBUG_SANITY enabled kernel, and divide-by-zero from damon_merge_two_regions(). For example, the WANR_ONCE() can be triggered like below. # grep DAMON_DEBUG_SANITY /boot/config-$(uname -r) # CONFIG_DAMON_DEBUG_SANITY=y # damo start # cd /sys/kernel/mm/damon/admin/kdamonds/0 # echo 0 > contexts/0/targets/0/regions/0/start # echo 0 > contexts/0/targets/0/regions/0/end # echo commit > state # dmesg [....] [ 73.705780] ------------[ cut here ]------------ [ 73.707552] start 0 >= end 0 [ 73.708452] WARNING: mm/damon/core.c:359 at damon_new_region+0x6e/0x80, CPU#1: kdamond.0/758 [...] All DAMON API callers eventually use damon_set_regions() to setup the regions. Add the validation logic in the function.
In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow overlapping input ranges for damon_set_regions() damon_set_regions() assumes the input ranges are sorted by the address and don't overlap each other. Hence the assumption was initially to be explicitly validated. But commit 97d482f4592f ("mm/damon/sysfs: reuse damon_set_regions() for regions setting") has mistakenly removed the validation. This can make DAMON behave in unexpected ways. At the best, the monitoring results snapshot will just look weird since there will be overlapping regions. DAMOS will also work weirdly, applying the same action multiple times for overlapping regions, and make DAMOS quota weird. More seriously, depending on the setup and regions updates sequence, negative size regions can be made. It will trigger WARN_ONCE() if the kernel is built with CONFIG_DAMON_DEBUG_SANITY=y. Depending on the monitoring results, the negative size region can further trigger division by zero in damon_merge_two_regions(). Note that some of the consequences including the WARN_ONCE() and the divide by zero depend on commits that were introduced after the root cause commit 97d482f4592f ("mm/damon/sysfs: reuse damon_set_regions() for regions setting"). Fix the problems by checking the assumption and returning an error if the input ranges don't meet the assumption. The issue was discovered [1] by Sashiko.
In the Linux kernel, the following vulnerability has been resolved: binfmt_elf_fdpic: only honour the first PT_INTERP The program header scan handles PT_INTERP from a switch nested in the scan loop, so its break leaves the switch and not the loop. A binary carrying more than one PT_INTERP runs the case again and overwrites both interpreter_name and interpreter. The previous name allocation leaks and so does the previous interpreter reference, along with the write denial open_exec() took on it. The denial is never released, so the file stays unwritable for as long as the system runs. An unprivileged caller reaches this with a crafted binary and repeats it at will. binfmt_elf stops at the first PT_INTERP. Do the same here. The flaw dates back to the driver's introduction in the pre-git history tree introduced in v2.6.11 by 91808d6ebe39 ("[PATCH] FRV: Add FDPIC ELF binary format driver").
In the Linux kernel, the following vulnerability has been resolved: fs/super: fix emergency thaw double-unlock of s_umount do_thaw_all() iterates over all superblocks via __iterate_supers() with SUPER_ITER_EXCL, which acquires s_umount exclusively before calling the callback and releases it afterwards. However, the callback do_thaw_all_callback() calls thaw_super_locked() which unconditionally releases s_umount on every code path. This results in a second unlock attempt in __iterate_supers() that corrupts the rwsem state, triggering a DEBUG_RWSEMS warning: [ 182.601148] sysrq: Emergency Thaw of all frozen filesystems [ 182.601865] ------------[ cut here ]------------ [ 182.602375] DEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && !rwsem_test_oflags(sem, RWSEM_NONSPINNABLE)): count = 0x0, magic = 0xffff99b1011e5870, owner = 0x0, curr 0xffff99b101b06c80, list not empty [ 182.603817] WARNING: kernel/locking/rwsem.c:1412 at up_write+0xa3/0x170, CPU#2: kworker/2:1/53 [ 182.604578] Modules linked in: [ 182.604864] CPU: 2 UID: 0 PID: 53 Comm: kworker/2:1 Not tainted 7.2.0-rc4-00001-gbd3bd93ea98a-dirty #4 PREEMPT(lazy) [ 182.605711] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1kylin1 04/01/2014 [ 182.606417] Workqueue: events do_thaw_all [ 182.606750] RIP: 0010:up_write+0xaf/0x170 [ 182.607076] Code: 19 3a 92 48 0f 44 c2 48 8b 55 08 48 8b 55 00 4c 8b 45 08 48 8b 55 00 48 8d 3d ad 91 e0 01 48 8b 4d 20 50 48 c7 c6 f0 8c 26 92 <67> 48 0f b9 3a e8 d7 93 4e 00 58 eb 81 48 83 7f 18 00 48 c7 c2 8d [ 182.608563] RSP: 0018:ffffb670001d7e08 EFLAGS: 00010246 [ 182.609007] RAX: ffffffff92349e8d RBX: 0000000000000000 RCX: ffff99b1011e5870 [ 182.609595] RDX: 0000000000000000 RSI: ffffffff92268cf0 RDI: ffffffff92914d10 [ 182.610283] RBP: ffff99b1011e5870 R08: 0000000000000000 R09: ffff99b101b06c80 [ 182.610847] R10: ffff99b10139a808 R11: fefefefefefefeff R12: 0000000000000000 [ 182.611414] R13: ffffffff90cf74d0 R14: 0000000000000000 R15: ffff99b1011e5800 [ 182.612009] FS: 0000000000000000(0000) GS:ffff99b1eaaee000(0000) knlGS:0000000000000000 [ 182.612670] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 182.613146] CR2: 00000000005c631c CR3: 00000000013ee000 CR4: 00000000000006f0 [ 182.613722] Call Trace: [ 182.613946] <TASK> [ 182.614130] __iterate_supers+0x128/0x150 [ 182.614463] do_thaw_all+0x1b/0x30 [ 182.614759] process_scheduled_works+0xbb/0x3f0 [ 182.615150] ? __pfx_worker_thread+0x10/0x10 [ 182.615499] worker_thread+0x129/0x270 [ 182.615816] ? __pfx_worker_thread+0x10/0x10 [ 182.616201] kthread+0xe2/0x120 [ 182.616469] ? __pfx_kthread+0x10/0x10 [ 182.616792] ret_from_fork+0x15b/0x240 [ 182.617115] ? __pfx_kthread+0x10/0x10 [ 182.617426] ret_from_fork_asm+0x1a/0x30 [ 182.617761] </TASK> [ 182.617968] ---[ end trace 0000000000000000 ]--- [ 182.618412] Emergency Thaw complete Fix this by switching to SUPER_ITER_UNLOCKED and acquiring s_umount in the callback via super_lock_excl() before calling thaw_super_locked(). This matches the locking pattern expected by thaw_super_locked() and eliminates the double unlock. While at it, remove the dead 'return;' at the end of do_thaw_all_callback().
In the Linux kernel, the following vulnerability has been resolved: ftrace: Add global mutex to serialize trace_parser access In ftrace, the trace_parser structure is allocated and initialized when a trace file is opened, and is subsequently used across write and release handlers to parse user input. The affected handler paths and their specific functions are: - Open paths: ftrace_regex_open(), ftrace_graph_open() - Write paths: ftrace_regex_write(), ftrace_graph_write() - Release paths: ftrace_regex_release(), ftrace_graph_release() If userspace opens a trace file descriptor and shares it across multiple threads, concurrent write calls will race on the parser's internal state, specifically the 'idx', 'cont', and 'buffer' fields, leading to corrupted input or undefined behavior. Fix this by adding a global mutex, parser_lock, to serialize all access to trace_parser across write and release paths, preventing concurrent corruption of parser state.
In the Linux kernel, the following vulnerability has been resolved: net: hip04: fix RX buffer leak on build_skb failure When build_skb() fails in hip04_rx_poll(), the driver jumps to the refill path without releasing the current RX buffer and its DMA mapping. Installing a replacement buffer then overwrites the slot references and leaks both resources. Keep the current slot intact and return budget so NAPI retries the same buffer. Also free a newly allocated RX fragment when dma_map_single() fails. This issue was found by an in-house static analysis tool.
In the Linux kernel, the following vulnerability has been resolved: ice: fix PTP Call Trace during PTP release If a PF reset occurs when the PTP state is ICE_PTP_UNINIT, then ice_ptp_rebuild() will update the state to ICE_PTP_ERROR. This will result in the following PTP release call trace during driver unload: kernel BUG at lib/list_debug.c:52! ice_ptp_release+0x332/0x3c0 [ice] ice_deinit_features.part.0+0x10e/0x120 [ice] ice_remove+0x100/0x220 [ice] This was observed when passing PF1 through to a VM. ice_ptp_init() fails because ctrl_pf is NULL and sets the state to ICE_PTP_UNINIT. Fix by detecting the ICE_PTP_UNINIT state in ice_ptp_rebuild() and returning without error, preventing the invalid state transition to ICE_PTP_ERROR. The only valid path to ICE_PTP_ERROR is from ICE_PTP_RESETTING after a failed rebuild.
In the Linux kernel, the following vulnerability has been resolved: super: fix emergency thaw deadlock on frozen block devices do_thaw_all_callback() calls bdev_thaw() while holding sb->s_umount exclusively. If the block device was frozen via bdev_freeze() dropping the last block layer freeze reference calls fs_bdev_thaw() which reacquires s_umount: do_thaw_all_callback(sb) super_lock_excl(sb) # holds sb->s_umount bdev_thaw(sb->s_bdev) mutex_lock(&bdev->bd_fsfreeze_mutex) # bd_fsfreeze_count drops 1 -> 0 bd_holder_ops->thaw == fs_bdev_thaw get_bdev_super(bdev) bdev_super_lock(bdev, true) super_lock(sb, true) down_write(&sb->s_umount) # same task: deadlock The emergency thaw worker deadlocks against itself holding both s_umount and bd_fsfreeze_mutex. That fscks any subsequent unmount, freeze, or thaw of that filesystem and block device. [ 81.878470] sysrq: Show Blocked State [ 81.880140] task:kworker/0:1 state:D stack:0 pid:11 tgid:11 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 81.884876] Workqueue: events do_thaw_all [ 81.886656] Call Trace: [ 81.887759] <TASK> [ 81.888763] __schedule+0x579/0x1420 [ 81.890372] schedule+0x3a/0x100 [ 81.891794] schedule_preempt_disabled+0x15/0x30 [ 81.893848] rwsem_down_write_slowpath+0x1ea/0x900 [ 81.895191] ? __pfx_do_thaw_all_callback+0x10/0x10 [ 81.896528] down_write+0xbd/0xc0 [ 81.897505] super_lock+0x91/0x180 [ 81.898457] ? __mutex_lock+0xa99/0x1140 [ 81.900748] ? __mutex_unlock_slowpath+0x1f/0x400 [ 81.902069] bdev_super_lock+0x5b/0x150 [ 81.903132] get_bdev_super+0x10/0x60 [ 81.904042] fs_bdev_thaw+0x23/0xf0 [ 81.904755] bdev_thaw+0x82/0x100 [ 81.905484] do_thaw_all_callback+0x2c/0x50 [ 81.906298] __iterate_supers+0x5d/0x130 [ 81.907067] do_thaw_all+0x20/0x40 [ 81.907739] process_one_work+0x206/0x5e0 [ 81.908545] worker_thread+0x1e2/0x3c0 [ 81.909339] ? __pfx_worker_thread+0x10/0x10 [ 81.910171] kthread+0xf4/0x130 [ 81.910799] ? __pfx_kthread+0x10/0x10 [ 81.911528] ret_from_fork+0x2e2/0x3b0 [ 81.912259] ? __pfx_kthread+0x10/0x10 [ 81.913010] ret_from_fork_asm+0x1a/0x30 [ 81.913806] </TASK> bdev_super_lock() even documents the violated requirement with lockdep_assert_not_held(&sb->s_umount). Acquiring bd_fsfreeze_mutex under s_umount also inverts the bd_fsfreeze_mutex vs. s_umount ordering established by bdev_{freeze,thaw}() and can thus ABBA against a concurrent block-layer freeze even when the recursive path isn't hit. Fix this by not holding s_umount around the bdev_thaw() loop at all. Pin the superblock with an active reference instead as filesystems_freeze_callback() does. The active reference keeps the superblock from being shut down and so ->s_bdev stays valid without holding s_umount. The block-layer-held freeze is dropped by fs_bdev_thaw() with FREEZE_MAY_NEST | FREEZE_HOLDER_USERSPACE exactly as a regular unfreeze would and thaw_super_locked() handles filesystem-level freezes as before. The emergency thaw path has deadlocked like this in one form or another for a long long time but the current exclusively-held shape dates back to commit [1] where thaw_bdev() already ended in thaw_super() with s_umount held by do_thaw_all_callback().
In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer destroy_previous_session() until after NTLM authentication In ntlm_authenticate(), destroy_previous_session() is called using a user pointer resolved from the client-supplied NTLM blob username field before the NTLMv2 response is validated. An authenticated attacker can set the NTLM blob username to match a victim account and set PreviousSessionId to the victim's session ID; destroy_previous_session() destroys the victim's session while ksmbd_decode_ntlmssp_auth_blob() subsequently rejects the request with -EPERM. Move destroy_previous_session() and the prev_id assignment to after ksmbd_decode_ntlmssp_auth_blob() returns success and use sess->user rather than the pre-authentication lookup result. This matches the ordering already used by krb5_authenticate(), where destroy_previous_session() is called only after ksmbd_krb5_authenticate() returns success.
In the Linux kernel, the following vulnerability has been resolved: mac802154: hold an interface reference across the scan worker mac802154_scan_worker() captures the scanning sub-interface under RCU and then keeps dereferencing sdata->dev after rcu_read_unlock() and outside the rtnl -- in the failure traces, in mac802154_transmit_beacon_req() (skb->dev = sdata->dev), and in the end_scan cleanup. Nothing keeps that netdev alive across the worker iteration. A concurrent DEL_INTERFACE or PHY removal can unregister the interface once the worker drops the rtnl between its two drv_set_channel() sections. unregister_netdevice() frees the netdev asynchronously from netdev_run_todo() with the rtnl already dropped, so neither holding the rtnl nor the per-PHY IEEE802154_IS_SCANNING flag prevents a stale worker iteration from dereferencing the freed netdev -- a KASAN slab-use-after-free, reachable by racing TRIGGER_SCAN against DEL_INTERFACE (both CAP_NET_ADMIN). Pin the netdev with netdev_hold() while the RCU read lock is still held, and release it at every worker exit.
In the Linux kernel, the following vulnerability has been resolved: ovpn: fix peer refcount leak in TCP error paths When either the TCP RX or TX error path calls ovpn_peer_hold() followed by schedule_work(&peer->tcp.defer_del_work), and the work item is already pending from the other path, schedule_work() returns false and the work runs only once. Since ovpn_tcp_peer_del_work() calls ovpn_peer_put() exactly once, the extra reference taken by the losing path is never dropped, leaking the peer object. The race window: CPU0 (strparser/RX error): CPU1 (tcp_tx_work/TX error): ovpn_peer_hold() <- refcnt+1 ovpn_peer_hold() <- refcnt+2 schedule_work() <- queued schedule_work() <- NO-OP (work already pending) ovpn_tcp_peer_del_work runs: ovpn_peer_del() ovpn_peer_put() <- refcnt+1 <- peer never freed Fix by checking the return value of schedule_work() in both paths and calling ovpn_peer_put() to drop the extra reference if the work was already pending. ovpn_peer_hold() is kept unconditional in the TX path as it cannot fail at that point.
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix aperture mapping leak amdgpu_pci_remove() calls drm_dev_unplug() before invoking the driver fini routines. This causes drm_dev_enter() in amdgpu_ttm_fini() to always return false, so iounmap(aper_base_kaddr) never runs on normal driver unload, leaving an orphaned entry in the x86 PAT interval tree. On connected_to_cpu hardware, the aperture is mapped write-back (WB) via ioremap_cache(). On reload, IP discovery calls memremap(..., MEMREMAP_WC) over the same range. The WC vs WB conflict causes: ioremap error for 0x..., requested 0x1, got 0x0 amdgpu: discovery failed: -2 Fix by switching to devres-managed mappings so cleanup is guaranteed regardless of drm_dev_enter() state: - connected_to_cpu path: devm_memremap(MEMREMAP_WB). For IORESOURCE_SYSTEM_RAM ranges this takes the try_ram_remap() shortcut, returning __va(offset) from the existing kernel direct map. No new ioremap VA or PAT entry is created, so there is nothing to orphan. - dGPU path: devm_ioremap_wc() registers iounmap() as a devres action, guaranteeing cleanup at device_del() time. Also remove iounmap(aper_base_kaddr) from amdgpu_device_unmap_mmio() since the mapping is now devres-owned. v2: Remove redundant x86_64 guard (Lijo) (cherry picked from commit d871e99879cb5fd1fa798b006b4888887e63a17a)
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx For a short moment during alloc/free the userptr BO is not part of his VM, so bo->vm_bo can be NULL. Keep a reference to the VM root PD as parent of the userptr BO so that we can always use that to wait for all submissions of the VM instead of only the one involving the userptr BO. (cherry picked from commit 631849ff5d603841e74f19f4a5e30fe1f7d7cf30)
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix race between registration and connection abortion This fixes this race: - thread a: io_uring_enter -> register sqe -> fuse_uring_create_ring_ent -> allocate ent but doesn't grab queue_ref yet - thread b: fuse_conn_destroy() -> fuse_chan_abort() -> fuse_uring_abort() is a no-op due to queue ref being 0 - thread a: grabs the queue_ref, queue_ref is now 1, rest of fuse_uring_do_register() logic executes - thread b: fuse_chan_abort() returns, fuse_chan_wait_aborted() now runs and calls "wait_event(ring->stop_waitq, atomic_read(&ring->queue_refs) == 0);" The abort/unmount thread will hang indefinitely in unkillable state as nothing will decrement queue_refs or wake stop_waitq, and the ring, queue, and ent are leaked. Fix this by checking fch->connected under fch->lock after the created ent has grabbed a ref count on the queue. This ensures that in the scenario above, it is guaranteed that we either release the queue ref and wake up stop_waitq (in case fuse_chan_wait_aborted() is already waiting) in fuse_uring_do_register() when we detect !fch->connected, or if the connection is aborted after the check, it is guaranteed that the async teardown worker will be running in the background cleaning up ents and decrementing the ent's ref on the queue, which will unblock the eventual queue and ring teardown.
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug If a vCPU stays scheduled out (or blocked) while the last pCPU it ran on goes through a hotplug cycle (online->offline->online), and the vCPU then resumes execution on the same pCPU, then it is possible for it to run with an ASID that has now been assigned to a different vCPU, resulting in stale TLB translations being used. svm_enable_virtualization_cpu() resets asid_generation to 1 and sets next_asid to max_asid + 1 on every CPU online event, including hotplug cycles. Because next_asid starts beyond the pool boundary, the first call to new_asid() after an online event always wraps the pool, incrementing asid_generation to 2 and assigning ASIDs starting from min_asid. Consider two vCPUs from different VMs, vCPU-A pinned to CPU-X holding asid_generation=2 and ASID=N from before the hotplug event: 1. CPU-X goes offline and back online: asid_generation resets to 1, next_asid = max_asid + 1. 2. One or more vCPUs migrate to CPU-X and call new_asid(), wrapping the pool and consuming ASIDs starting from min_asid. Eventually vCPU-B from a different VM is assigned asid_generation=2, ASID=N - the same ASID that vCPU-A held before the hotplug. 3. vCPU-A enters pre_svm_run() on CPU-X: current_vmcb->cpu is unchanged so the migration branch is skipped. Its saved asid_generation=2 matches sd->asid_generation=2, so the generation check silently passes and vCPU-A continues running with ASID=N - the same ASID just freshly assigned to vCPU-B. Both vCPUs from different VMs now run on CPU-X with the same ASID, causing them to share NPT TLB entries and producing stale translations. The collision manifests as a KVM internal error (Suberror: 1, emulation failure). The NPT page fault reports a faulting GPA far outside the VM's physical memory range - a sign of stale TLB translations being used. KVM falls back to instruction emulation, which fails on FPU/XSave instructions (XRSTOR, STMXCSR) that the emulator does not implement. Fix this by incrementing asid_generation instead of resetting it to 1 in svm_enable_virtualization_cpu(). On module load, asid_generation starts at 0 (memset) and the increment produces 1, identical to the old behaviour. On subsequent hotplug cycles the generation advances beyond any value a vCPU previously observed on this CPU, so the generation check in pre_svm_run() reliably forces new_asid() on every vCPU after every hotplug cycle.
In the Linux kernel, the following vulnerability has been resolved: time/jiffies: Register jiffies clocksource before usage Teddy reported that a XEN HVM has a long boot delay, which was bisected to the recent enhancements to the negative motion detection. It turned out that the jiffies clocksource is used in early boot before it is registered, which leaves the max_delta_raw field at zero. That causes the read out to be clamped to the max delta of 0, which means time is not making progress. Cure it by ensuring that it is initialized before its first usage in timekeeping_init().
In the Linux kernel, the following vulnerability has been resolved: iio: core: fix uninitialized data in debugfs If *ppos is non-zero then simple_write_to_buffer() will not initialize the start of buf[]. Non zero values for *ppos aren't going to work anyway. Test for them at the start of the function and return -EINVAL.
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndis_query_response(), and perform a length check on them. This is identical to how rndis_set_response() handles these parameters.
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush() wacom_wac_queue_flush() is called via the .raw_event callback (wacom_raw_event → wacom_wac_pen_serial_enforce → wacom_wac_queue_flush). For USB HID devices, this callback is invoked from hid_irq_in(), which is a URB completion handler running in atomic context. Using GFP_KERNEL in this path can sleep, leading to a "scheduling while atomic" bug. Use GFP_ATOMIC instead. The existing code already handles allocation failure by skipping the fifo entry and continuing.
In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: write all dirty file folios when collapsing [There is no upstream commit, as this code was removed by upstream commit 044925f9b565 ("mm: fs: remove filemap_nr_thps*() functions and their users")] As-is, khugepaged and writable-file opening exclude each other. A file cannot be open writeable and have THPs (because the filesystem is not aware of them). khugepaged will never collapse file pages for files that are opened writeable. On an open(O_RDWR/O_WRONLY), the page cache for that particular file is dropped. This is fine because nothing could've been dirtied. However, there is an edge-case: collapse_file() might not be able to coexist with concurrent writers, but it can coexist with dirty folios (from previous writers). Therefore, the following can happen: open(file, O_RDWR) write(file) close(file) madvise(file_mapping, MADV_COLLAPSE, some non-dirty range) open(file, O_RDWR) nr_thps > 0 truncate_inode_pages() /* THPs are cleared out, but so are the dirty folios */ When this edge-case happens, there is data loss, as the dirty folios are fully discarded. Fix it by fully writing back the page cache (and waiting) when collapsing file THPs. Doing so provides the guarantee that no dirty folio will be observed while there are active THPs. To fully ensure this is safe, the invalidate_lock needs to be held while doing the writeout, so that do_dentry_open()'s page cache truncation excludes this write-and-wait. As a side effect, move the nr_thps counter bumping outside the i_pages lock. This is correct since the counter itself is an atomic_t and the producer <-> consumer correctness is provided by a full memory barrier: smp_mb() in collapse_file()/memory barrier implied by full ordering in get_write_access() -> atomic_inc_unless_negative().
In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: fix location monitor leak in tsi148 bridge tsi148_probe() allocates a location monitor resource and links it into tsi148_bridge->lm_resources. The probe error path frees this list, but tsi148_remove() only frees the dma, slave and master resource lists, so the location monitor resource is leaked on device unbind or module unload. Free the lm_resources list in tsi148_remove() as well, before tsi148_bridge is freed.
User enumeration via observable response discrepancy in Checkmate through version 2.1.0 exposes whether any given email address is registered on the platform. The password recovery endpoint POST /api/v1/auth/recovery/request returns HTTP 200 for known accounts and a distinct status code for unknown ones, allowing unauthenticated remote attackers to silently map valid user accounts. No public exploit or CISA KEV listing exists at time of analysis, but exploitation requires no authentication and is trivially automatable.
Uninitialized heap memory exposure in GNU Emacs for Android's sfnt font parser allows a remote, unauthenticated attacker to trigger information disclosure, process crashes, or arbitrary memory access on 32-bit targets by delivering a crafted font file. The flaw in sfnt_read_table_directory() (src/sfnt.c) stems from an incorrect comparison variable in the read-length check, causing the parser to trust an attacker-controlled table-entry count without proper bounds validation. No public exploit or CISA KEV listing exists at time of analysis; exploitation requires user interaction with attacker-delivered content such as an email, EWW-rendered webpage, or a document referencing a malicious font face.
JWT tokens written to Apache Ranger logs in versions 2.8.0 and earlier remain replayable, allowing any party with read access to those logs to authenticate as legitimate users without knowing their credentials. The flaw (CWE-532) is particularly severe because Ranger controls data security policies across Hadoop ecosystems - impersonating a Ranger user can yield control over access policies for HDFS, Hive, HBase, and related services. No public exploit or CISA KEV listing exists at time of analysis; Apache has confirmed a fix in version 2.9.0.
Remote unauthenticated control of Ecovacs Robotics DEEBOT PRO M1 and K1VAC robot vacuums is possible due to an incorrectly implemented authentication algorithm in their WebSocket communications interface. Any network-reachable attacker can connect to and issue operational commands to affected robots without valid credentials (AV:N, PR:N per CVSS vector). No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Man-in-the-middle interception of ECOVACS PRO app traffic is possible due to improper TLS server certificate validation (CWE-295) in both the Android and iOS versions of the application, published by ECOVACS Robotics and coordinated by JPCERT under JVNVU92804348. An attacker with a network-positioned MITM capability can present a rogue certificate that the app accepts without proper validation, enabling retrieval and alteration of all app-server communications, which may include device control commands, account credentials, and home telemetry. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Weak Wi-Fi hotspot credentials on Ecovacs DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums allow a physically proximate attacker to recover the access point password through analysis, then connect to the robot's local network interface. Reported by JPCERT/CC via JVN advisory JVNVU92804348, this affects all firmware versions of both models per CPE data. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the low exploitation complexity combined with zero required privileges makes unauthorized Wi-Fi access straightforward for any attacker within radio range.
Weak preconfigured root credentials on Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robotic vacuum cleaners expose the root account to compromise via physical access. An attacker who obtains physical access to an affected device can recover the root password, gaining privileged control over the embedded Linux system. Reported by JPCERT and disclosed via JVN advisory JVNVU92804348, no public exploit code exists and no active exploitation has been confirmed at time of analysis.
Improper certificate validation in DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums exposes MQTT communications to man-in-the-middle interception, allowing unauthenticated network-positioned attackers to retrieve operation logs and activity logs stored on the devices. Both models from Ecovacs Robotics fail to verify server certificates during MQTT sessions, meaning a rogue server can impersonate the legitimate cloud backend without detection. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but a vendor advisory with remediation guidance was published on 2026-03-31 as referenced by JPCERT.
Samsung Smart Switch prior to version 3.7.72.6 exposes sensitive user data to adjacent network attackers through improper input validation during device transfer sessions. The attack requires both adjacent network positioning and user interaction, constraining real-world exploitability relative to the high confidentiality impact (VC:H) reflected in the CVSS 4.0 score of 6.8. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
SamsungPassAutofill prior to version 5.2.10.x on Samsung Android devices improperly exports application components, enabling a locally-installed malicious app to access sensitive autofill credential data with user interaction. The CVSS 4.0 vector (AV:L/PR:L/UI:A/VC:H) confirms the attack is constrained to on-device, low-privilege access requiring user-triggered activity, yielding a moderate score of 5.1 despite high confidentiality impact. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Cleartext storage of sensitive information in Samsung Smart Switch prior to version 3.7.72.6 exposes device migration data to adjacent network attackers. The flaw enables an attacker on the same local network segment to intercept or read sensitive data that the application fails to encrypt at rest or in transit. No public exploit or active exploitation has been confirmed, but the high confidentiality impact and low attack complexity make this a meaningful risk in shared or semi-trusted network environments.
Device identity spoofing in Samsung Smart Switch's trouble scanning mode allows adjacent network attackers to impersonate trusted devices, potentially enabling interception or manipulation of data during device transfer sessions. All Smart Switch versions prior to 3.7.72.6 are affected, as reported by Samsung Mobile. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Improper authorization in the custom URL scheme handler of Samsung's My Galaxy app (all versions prior to 6.3) exposes sensitive information to remote attackers. The flaw exists because the handler processes inbound custom URL scheme invocations without enforcing adequate authorization checks, enabling an attacker-controlled web page or application to silently extract user data when a victim interacts with a crafted link. No public exploit code has been identified at time of analysis, and CISA KEV does not list this as actively exploited, but the zero-privilege requirement from the attacker's side and the broad Samsung device install base make timely patching advisable.
Improper input validation in the Galaxy Themes application on Samsung Mobile Devices allows a physical attacker to launch arbitrary Android activities, with a high confidentiality impact on the vulnerable system. Affected devices are those running Galaxy Themes prior to the SMR Aug-2026 Release 1 security update. The vulnerability is tagged as an information disclosure issue, and while it requires physical device access and active user interaction, exploitation could allow access to sensitive device data or protected application screens that would otherwise be restricted. No public exploit has been identified at time of analysis, and no KEV listing exists.
Samsung Message on Android devices prior to SMR Aug-2026 Release 1 exposes sensitive user information to physical attackers through improper input validation. An attacker with physical access to an unlocked or accessible device can interact with the Samsung Message application to trigger the flaw and read confidential message content or related data. No public exploit code has been identified, and exploitation requires hands-on device access, limiting widespread automated abuse.
Samsung Dialer on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes SIM-related functions to remote attackers through improper input validation, requiring user interaction to trigger. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P/VC:H) classifies this as a network-reachable, high-confidentiality-impact flaw, though high attack complexity and specific prerequisites substantially reduce the realistic threat surface. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Samsung Contacts on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes contact data across Android user profiles to an attacker with physical device access, due to improper input validation that fails to enforce inter-profile data isolation. The CVSS 4.0 vector confirms both the physical access prerequisite (AV:P) and the scope extension to a secondary user's data (SC:H), consistent with a profile boundary bypass in a multi-user Android environment. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized file deletion via improperly exported Android components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows any locally-installed malicious application to invoke the exported component and delete files under Samsung Contacts' privilege without requiring any elevated permissions of its own. The vulnerability stems from an Android component export misconfiguration, granting third-party apps unintended access to privileged file operations. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of privilege requirements make this straightforward to exploit on affected devices.
Improper input validation in Samsung Contacts on Samsung Mobile devices prior to SMR Aug-2026 Release 1 enables local attackers to delete files under Samsung Contacts' process privilege, bypassing the Android sandbox boundary between applications. The CVSS 4.0 score of 6.9 with VI:H reflects high integrity impact on the vulnerable system, though the local attack vector constrains opportunistic exploitation. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis; Samsung has released a fix in the August 2026 Security Maintenance Release.
Sensitive information exposure in the Advanced Classifieds & Directory Pro WordPress plugin (versions through 3.4.2) allows unauthenticated remote attackers to retrieve custom field listing data via the publicly accessible AJAX action `acadp_public_custom_fields_listings`, bypassing WordPress authentication entirely. A publicly available proof-of-concept has been published by WPScan, though EPSS places exploitation probability at the 1st percentile, suggesting limited observed exploitation to date. No CISA KEV listing exists, and a vendor-released patch is available in version 3.4.3.
Infinite-loop denial-of-service in libexpat before 2.8.3 allows attackers supplying crafted UTF-16 XML to hang the parsing process indefinitely via a low Unicode surrogate handled as a high surrogate in the *_toUtf16 functions. The flaw is gated by a compile-time prerequisite - only builds configured with XML_UNICODE and XML_UNICODE_WCHAR_T are vulnerable - which specifically includes Firefox and Windows-native builds of applications embedding libexpat. A concrete attack payload is publicly available in the upstream patch PR test suite; no active exploitation has been confirmed via CISA KEV at time of analysis.
Memory leak exploitation in Almico Speedfan 4.52 is constrained to local, high-privilege access and produces limited availability degradation via the speedfan.sys kernel driver's MSR Index Handler. The vulnerability resides in the KiSystemCall64 handler path within speedfan.sys, where kernel pool memory is allocated but never released during MSR index processing, enabling gradual resource exhaustion on affected Windows hosts. A publicly available proof-of-concept exists, no vendor patch has been issued, and the vendor has not responded to coordinated disclosure.
Local availability degradation in Mullvad's wireguard.sys kernel driver 0.10.1 stems from improper reference count management (CWE-911) within the AdapterState function of the IOCTL handler. An attacker with high local privileges can trigger this defect to cause driver instability or crash the WireGuard adapter, impacting VPN connectivity. A public proof-of-concept exploit exists; however, this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog and carries a CVSS 4.0 score of 4.6, reflecting its constrained impact and access prerequisites.
Unauthenticated remote exploitation of Badaso 3.0.0-alpha's File API allows attackers to bypass permission controls in ApiRequest::class (src/Routes/api.php), resulting in unauthorized read, write, and access operations on file resources. The vulnerability stems from improper permission assignment (CWE-275) in the PHP-based File API route handler. A public exploit has been disclosed via a GitHub issue; the vendor has not responded to the coordinated disclosure.
Query injection and oracle enumeration in Ash Framework (ash-project/ash) versions 1.52.0-rc.11 through pre-3.31.1 allow an attacker to forge a belongs_to relationship to a record whose identifier they cannot directly name, and to systematically recover secret lookup values via a comparison oracle. The root cause is a two-part failure in the managed_relationship on_lookup: :relate code path: client-supplied values reach Ash.Query.filter/2 without type-casting, so a nested map is interpreted as a filter predicate rather than a literal scalar, and the missing Ash.Query.limit(1) call lets Ash.read_one/2 distinguish zero, one, and multiple matches - converting boolean filter predicates into an oracle. No public exploit has been identified at time of analysis; a vendor patch is available at version 3.31.1.
Improper privilege management in wongcyrus ExcelLexBot through version 0.0.3 allows remote high-privileged attackers to perform unauthorized actions via the ExcelLexBotS3TriggerFunction Lambda handler, resulting in limited confidentiality, integrity, and availability impact. The affected product is end-of-life and will receive no vendor patch, as the maintainer is no longer supporting it. No public exploit code or active exploitation has been identified at time of analysis, though the remote attack vector and absence of a patch increase residual risk for any remaining deployments.
Weak password recovery in macrozheng mall (commit 0504e86) exposes the /sso/getAuthCode endpoint of the mall-portal module to remote manipulation, enabling account takeover via a broken authentication flow. The flaw maps to CWE-640 and requires no authentication, though exploitation is rated high complexity. A publicly available exploit has been published; the vendor deleted the corresponding GitHub issue without explanation and has not responded to private disclosure.
Unauthenticated information disclosure in MingSoft MCMS up to version 3.0.6 allows remote attackers to extract sensitive data via the /mdiy/form/get endpoint of the ms-mdiy component. The vulnerability requires no credentials or user interaction and is exploitable over the network, making it trivially accessible to any attacker with HTTP reach to the application. A public exploit has been released (CVSS 4.0 E:P), though the vulnerability is not currently listed in the CISA KEV catalog; the vendor did not respond to pre-disclosure notification, leaving no official patch available at time of analysis.
Information disclosure in MingSoft MCMS through version 3.0.6 exposes sensitive data via the `/mdiy/form/data/list` endpoint in the ms-mdiy component, exploitable by unauthenticated remote attackers with no configuration prerequisites. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial network reachability, and a public exploit has been released (E:P). The vendor did not respond to responsible disclosure, leaving no official patch available at time of analysis.
File inclusion in DedeCMS up to 5.7.118 UTF8SP2 allows a remote attacker with low privileges and high-complexity conditions to include arbitrary files via the _4_Setup function within the Installation Wizard (install/index.php). Exploitation results in limited confidentiality, integrity, and availability impact. A proof-of-concept has been publicly disclosed via GitHub, though no active exploitation has been confirmed by CISA KEV. The CVSS 4.0 score of 1.3 reflects the constrained real-world impact and significant attack complexity required.
Unauthenticated file deletion in WP Photo Album Plus WordPress plugin (all versions before 9.2.07.002) exposes a public REST endpoint that performs no capability or nonce verification, permitting any remote actor to delete generated album export ZIP archives stored by the plugin. The CVSS 3.1 score is 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N reflecting zero authentication and trivial access requirements, though impact is scoped only to those regenerable archive files. No public exploit or CISA KEV listing exists; EPSS at 0.14% (4th percentile) confirms negligible current exploitation activity.
Nexter Blocks WordPress plugin before 5.0.2 exposes a REST endpoint for saving global CSS that any Contributor-level user can invoke without proper authorization, causing injected styles to render site-wide for all visitors. The attack surface is limited to sites with untrusted Contributor accounts, and impact is constrained to front-end defacement, content suppression, and UI redressing - not code execution or data exfiltration. No public exploit code or active exploitation has been identified; EPSS of 0.10% at the 1st percentile confirms negligible exploitation probability at this time.
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state Put all vmcs12 pages if KVM synthesizes a nested VM-Exit due to invalid guest while emulating VMLAUNCH or VMRESUME. The invalid guest state path doesn't use nested_vmx_vmexit() as that API is intended to be used if and only if L2 is active, and the open coded equivalent neglects to put the vmcs12 pages. Failure to put the vmcs12 pages leaks any pinned pages (and/or mappings) if L1 retries VMLAUNCH/VMRESUME. Note, the !from_vmenter scenario doesn't suffer the same problem, as vmx_get_nested_state_pages() only gets/pins/maps the vmcs12 pages if L2 is active, i.e. if a "full" VM-Exit is guaranteed before KVM will retry getting vmcs12 pages.
WP Directory Kit WordPress plugin before version 1.5.5 exposes sensitive site data to any authenticated user due to missing authorization and nonce validation on an AJAX endpoint. Any subscriber-level account holder can trigger the vulnerable action to enumerate the full WordPress user list and access unpublished directory listings belonging to other users - data that should be restricted to privileged roles. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.14% (4th percentile), suggesting exploitation has not yet become widespread despite the low barrier to abuse.
Unauthorized data exposure in the WP Directory Kit WordPress plugin (all versions before 1.5.5) allows any authenticated user - including low-privilege Subscribers - to retrieve stored contact messages and associated personal data belonging to other users by invoking an unprotected AJAX endpoint. The root cause is the complete absence of WordPress authorization checks and nonce verification on an authenticated AJAX action, meaning the plugin performs no ownership or permission validation before returning sensitive inter-user data. A publicly available proof-of-concept has been published by WPScan; however, EPSS sits at just 0.14% (4th percentile) and no CISA KEV listing exists, indicating low observed exploitation activity at time of analysis despite the public PoC.
Visitor analytics data exposure in WP Statistics WordPress plugin versions before 14.16.10 allows any authenticated WordPress user - including those with only Subscriber-level access - to invoke dashboard analytics AJAX handlers and retrieve the site's full visitor metrics without authorization. The plugin's AJAX handlers validate a WordPress nonce but omit the required capability check, and because WordPress issues valid nonces to all authenticated users regardless of role, this effectively grants analytics read access to anyone with a site account. Publicly available exploit code exists per WPScan reporting, though no active exploitation is confirmed in the CISA KEV catalog and EPSS remains at 0.14% (4th percentile), indicating limited observed mass exploitation to date.
Out-of-bounds memory read and write in the Zephyr RTOS SF32LB MPI QSPI NOR flash driver allows a low-privileged thread, when explicitly granted flash device access in a CONFIG_USERSPACE build, to disclose arbitrary CPU-addressable memory or corrupt flash and invalidate cache beyond the mapped flash window. The root cause is a signed/unsigned type confusion in the offset bounds check: a crafted negative off_t value converts to a large unsigned integer and the subsequent addition wraps to a small result that passes the check, allowing memcpy to read from or program flash at attacker-controlled addresses. No public exploit code has been identified at time of analysis; exploitation is nonetheless mechanically straightforward for any attacker familiar with signed/unsigned integer confusion vulnerabilities.
Login-shell environment variable leakage in HKUDS nanobot up to 0.2.1 exposes sensitive environment variables to local low-privilege users during agent-driven shell command execution. The `ExecTool._prepare_command` function in `shell.py` defaulted to invoking bash/zsh with the `-l` (login shell) flag, causing system and user profile startup scripts to be sourced and potentially re-exporting credentials, API keys, or tokens into the execution environment where they could be read by the invoking user. A publicly available proof-of-concept exploit exists; no active exploitation has been confirmed (not listed in CISA KEV). The vendor-released fix in v0.3.0 changes the default from login-shell to non-login-shell execution.
Out-of-bounds kernel memory read in SonicWall Global VPN Client's SWIPsec.sys driver allows a local, low-privileged attacker to crash the host system. Affected versions are 4.10.8.1108 and earlier, running on Windows where the IPsec kernel driver is loaded by the VPN client. No public exploit identified at time of analysis, and EPSS probability stands at a very low 0.16% (5th percentile), indicating no signs of active or widespread exploitation interest.
Symlink following in File::Rotate::Simple before v0.4.0 allows a local low-privileged attacker to create arbitrary files with the permissions of the log-rotating process. When the non-default `touch` option is enabled and the log file path is a dangling symlink, the rotate method skips rotation (because the symlink target does not exist) but still invokes touch, which resolves the symlink and materializes the target at an attacker-controlled path. No public exploit code exists and EPSS is 0.17% (7th percentile), indicating negligible current exploitation interest.
Repeated denial-of-service resets in Aviation VHF Link Control X.25 protocol implementations can be triggered remotely over radio frequency by transmitting malformed or out-of-sequence frames. The resulting reset loop degrades communication availability and increases workload for pilots or air traffic controllers, with potential for reduced situational awareness during critical flight operations. No public exploit has been identified at time of analysis, but the radio-frequency attack vector means any actor with appropriate VHF transmitting equipment and protocol knowledge within range could attempt exploitation without authenticating to the target system.
Resource exhaustion in pypdf before 6.15.0 enables denial of service via crafted PDF files containing CID font width entries with maliciously large range values. Any application that processes untrusted PDFs using pypdf's text extraction or font parsing routines is affected, as the library iterates over attacker-controlled CID width ranges without bounds enforcement, consuming excessive CPU and memory. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Hono's `proxy()` function in the `hono/proxy` Proxy Helper leaks connection-scoped response headers to downstream clients by failing to strip headers named in the origin's `Connection` response field, violating RFC 9110 Section 7.6.1. Versions 4.7.0 through 4.12.33 of the npm `hono` package are affected; the function correctly removed well-known hop-by-hop headers but neglected to parse and remove the additional headers the origin declared as connection-scoped via `Connection`. No public exploit has been identified at time of analysis and exploitation is conditional on non-default origin behavior, limiting real-world priority despite the network-reachable attack vector.
Kirby CMS's REST API error handler exposes full server filesystem paths to unauthenticated remote users via unsanitized PHP exception messages. Affected are all Kirby installations on versions prior to 4.9.5 (4.x branch) and 5.0.0 through 5.5.1 (5.x branch) where the REST API has not been explicitly disabled. An attacker triggering a PHP-level error receives the raw exception message - including absolute paths such as '/var/www/kirby-site/content/' - enabling server directory enumeration that lowers the bar for chained attacks. No public exploit or CISA KEV listing has been identified at time of analysis.
Datadog Android app versions prior to 5.9.2 structurally associate authenticated users' Datadog UUIDs with Google Firebase Installation IDs on every successful login, transmitting this stable cross-session identifier - alongside crash stack traces that may include in-flight application data, internal class names, package names, and breadcrumbs - to Google's Firebase Crashlytics backend without an identifiable user consent gate or opt-out mechanism. The exposure is not triggered by an external attacker but occurs automatically during normal authenticated app usage for all affected users. No active exploitation has been identified (SSVC Exploitation: none; no CISA KEV listing), and no public exploit code exists; the primary risk is regulatory and privacy-related rather than direct technical compromise.
Plaintext SQLite database storage in the Datadog Android application exposes operationally sensitive monitoring metadata to anyone with physical access to the device or the ability to perform forensic acquisition. Two Room-managed databases - LocalNotificationDatabase and SearchRecentDatabase - store incident notification recipients, deeplinks, service names, and free-text search queries without at-rest encryption; no SQLCipher or equivalent openHelperFactory configuration was found in the codebase. Protection relies entirely on the Android application sandbox, which is insufficient for this class of data in high-risk deployment environments such as on-call engineering teams managing production infrastructure. No public exploit code exists and CISA has not added this to the KEV catalog.
Notification dismissal in the Datadog Android application (versions prior to 5.9.2) can be triggered by any zero-permission co-installed application through the improperly exported BubbleChatActivity component (CWE-926), allowing silent cancellation of the hard-coded Bits AI chat notification (ID 9201) with no identity validation of the caller or their supplied conversation_id. The impact is limited to nuisance-level denial of that specific notification and potential facilitation of in-app phishing workflows, with chat content remaining server-authentication gated and inaccessible to the attacker. SSVC assessment confirms no known active exploitation, and no public exploit code has been identified at time of analysis.
Six exported Android App Widget configuration activities in the Datadog Android application (versions prior to 5.9.2) allow a co-installed zero-permission malicious app to brute-force sequential App Widget IDs and trigger automatic Datadog session login for the victim, exposing live operational data - dashboards, SLOs, on-call schedules, incident details - as a visual side-channel. Exploitation is constrained by three simultaneous preconditions and data exfiltration is limited to screen-visible disclosure only, with no programmatic return path. No public exploit has been identified at time of analysis; SSVC rates exploitation as none with partial technical impact.
Forged on-call acknowledgment and confused-deputy execution in the Datadog Android application (versions prior to 5.9.2) allows any co-installed malicious app to silently dismiss real production incident alerts on behalf of the victim by exploiting an unguarded exported Activity with no permission check. An attacker-controlled app can supply crafted Intent extras to forge a backend Acknowledge API call using the victim's authenticated session, redirect the Datadog process into non-exported internal components, and surface a spoofed alert over the device lock screen. No public exploit has been identified at time of analysis; exploitation requires a malicious co-installed app plus a single user tap.
File and directory information exposure in SourceCodester Online Clothing Store allows unauthenticated remote attackers to retrieve Dreamweaver metadata files from the publicly accessible /_notes/ directory. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or special preconditions are required. A publicly disclosed proof-of-concept exists (E:P), documented via a Medium article detailing directory listing and Dreamweaver metadata exposure; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Behavioral workflow enforcement bypass in WonderTrader up to version 0.9.9 allows remote low-privileged attackers to manipulate the getUndoneQty argument within the _undone_qty function of the Pending Order Handler component (src/WtCore/TraderAdapter.h), resulting in unauthorized integrity modification of pending order state. The CVSS 4.0 vector confirms network-accessible exploitation with low privilege requirements and no user interaction. A publicly available proof-of-concept exploit exists (E:P), though no CISA KEV listing is recorded. The vendor was notified prior to disclosure and did not respond, meaning no official patch or advisory has been released.
Netty's RedisArrayAggregator codec fails to release retained partial aggregate state when the maxElements limit is exceeded, unlike the symmetric maxNestedArrayDepth branch which correctly calls releaseAndClearDepths() before throwing. In applications that keep the channel alive after a codec exception - a common resilience pattern - an unauthenticated peer can exploit this inconsistency to keep attacker-controlled ByteBuf references pinned in Netty's pooled buffer allocator and cause subsequent messages to be consumed into the stale pre-error aggregate. A public proof-of-concept test is included in the GHSA advisory; fixed in Netty 4.1.136.Final and 4.2.16.Final with no KEV listing at time of analysis.
Use of an uninitialized variable in WonderTrader up to version 0.9.9 allows a remote low-privileged attacker to cause limited availability disruption by manipulating the m_offsetType argument within the TraderATP Cash Trade Conversion component. The flaw resides in src/Includes/WTSTradeDef.hpp and is exploitable remotely, with a public proof-of-concept available via a Feishu document. No patch has been released and the vendor has not responded to disclosure - exploitation conditions are low complexity once authentication is satisfied, making this a persistent unmitigated risk for deployments using the ATP cash trading interface.
Scheduled task configuration overwrite in Sonatype Nexus Repository 3 enables a low-privileged authenticated user - holding permission to create at least one scheduled task type - to corrupt the configuration of an unrelated existing task via mass assignment against the administrative UI. By injecting internal configuration keys into user-supplied task property values, the attacker causes the system to redirect its write operation onto a pre-existing task rather than creating a new one, disrupting or manipulating that task's behavior. No public exploit or active exploitation has been identified; vendor-released patch 3.95.0 resolves the issue.
Unverified password change in Sonatype Nexus Repository 3 allows any account holding the nexus:* permission to overwrite the administrator password by invoking an onboarding-phase endpoint that remains accessible after initial setup is complete. The endpoint enforces access using only the presence of a local onboarding artifact rather than a proper lifecycle state check, enabling a privileged-but-non-admin account to hijack the administrator credential without invalidating existing administrator sessions. No public exploit has been identified at time of analysis and Sonatype has released a fix in version 3.95.0.
Improper behavioral workflow enforcement in WonderTrader up to version 0.9.9 allows remote attackers to manipulate the FID_JYLB argument in the TraderDD::queryTrades function, causing the application to execute trading query operations in an unintended sequence. Per the CVSS 4.0 vector (AV:N/AC:H/PR:N/UI:N), exploitation is network-reachable without authentication but requires high attack complexity, limiting opportunistic abuse. A proof-of-concept exploit is publicly available (E:P), and the vendor did not respond to responsible disclosure, leaving no patch available at time of analysis.
UNC path injection in Tobit TeamDavid's Webbox link-storing endpoint (`//ServerClient_celink.htm`) forces the server to initiate outbound SMB connections to attacker-controlled hosts, leaking NTLM authentication credentials and enabling SMB relay attacks against internal systems. The unvalidated `pathname` parameter accepts arbitrary UNC paths (e.g., `\\attacker\share`), triggering Windows credential-passing behavior that exposes the server's NTLM hash. No public exploit code identified at time of analysis, though the underlying NTLM coercion technique is well-understood and documented as part of a broader audit of 22 CVEs in the David platform published by InfoGuard.
UNC path injection in TeamDavid Webbox's !ArcEntryMove archive function causes the server to initiate outbound SMB connections to attacker-controlled infrastructure, exposing the server's NTLM authentication material (Net-NTLMv2 hashes). All TeamDavid deployments through Rollout 524 are affected, with the confidentiality impact occurring on subsequent systems - the attacker's SMB listener - rather than the Webbox host itself. No public exploit has been identified at time of analysis, but the attack technique is fully commoditized via tools such as Responder and Impacket; exploitation feasibility is further complicated by a contradictory authentication requirement in the source data that warrants vendor clarification.
UNC path injection in Tobit Laboratories AG TeamDavid's Webbox messaging component allows attackers to coerce the server into initiating outbound SMB connections to attacker-controlled hosts, exposing NTLM authentication credentials. The server processes @@INCLUDE directives containing Windows UNC paths (e.g., \\Server\Share) without validation across email, fax, and SMS composition features. Captured NTLM hashes can be cracked offline or relayed to authenticate against other internal services; the CVE description explicitly states the pathname parameter vector is exploitable without authentication, conflicting with the PR:L designation in the CVSS 4.0 vector. No public exploit or CISA KEV listing has been identified at time of analysis, but this attack class (NTLM coercion via UNC injection) is well-understood and widely tooled.
Hardcoded cryptographic credentials embedded in unencrypted ZTE ZXHN F680 router firmware allow a low-privilege authenticated network attacker to extract integrity verification keys and subsequently bypass application integrity checks on the device. Seven specific firmware versions across the V9.0.10 P1, P4, and P6 branches are confirmed affected per the ZTE advisory. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
CAPTCHA bypass in the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 allows unauthenticated network attackers to defeat anti-abuse protections on Forminator-integrated forms by exploiting a flawed validation cache keying mechanism. After solving a single legitimate Turnstile challenge, an attacker can replay token-less form submissions during the validation cache window because the cache is bound to an attacker-controlled, reusable request value rather than the one-time challenge token. A publicly available proof-of-concept exists (WPScan); this vulnerability is not currently listed in CISA KEV, and no EPSS score was provided in source data.
Payment integrity bypass in the Subscriptions for WooCommerce plugin (versions before 2.0.1) enables financial fraud by allowing substitution of an arbitrary approved PayPal order token during the WooCommerce order-received flow. The plugin captures a client-supplied token and marks any order paid solely based on a COMPLETED capture status, without verifying that the captured amount matches the order total or that the token belongs to the specific order. Unauthenticated attackers - where guest checkout is enabled - can exploit this to obtain goods or subscription access without paying the actual order price. A publicly available proof-of-concept exists; no CISA KEV listing at time of analysis.
WP Events Manager for WordPress (all versions before 2.2.5) exposes a payment notification endpoint that accepts fraudulent booking-paid confirmations from unauthenticated attackers. The plugin neither validates that an incoming payment callback originates from the configured merchant nor that the notified amount matches the booking total, enabling any remote actor to mark arbitrary bookings - including other users' bookings - as fully paid without money reaching the merchant. A publicly available exploit exists; the vulnerability is not currently listed in CISA KEV, but the AV:N/AC:L/PR:N/UI:N attack profile means exploitation requires zero privileges and trivial effort.
SELinux label manipulation via TOCTOU race condition in the policycoreutils fixfiles script allows a local low-privileged attacker to corrupt SELinux mandatory access control labels on arbitrary system files, including security-critical targets such as /etc/shadow. The flaw affects fixfiles when run in relabel or restore mode across all supported Red Hat Enterprise Linux releases (6 through 10), Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is constrained by both a required race condition win and the need for an administrator to actively invoke fixfiles.
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct trace_event_call', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member is 'refcnt', which acts as an active reference counter. When a dynamic event (such as kprobe, uprobe, fprobe, eprobe, or wprobe) has a non-zero reference count (e.g. due to active event triggers or perf attachments), its 'call->module' evaluates to a small non-zero integer instead of NULL. When filtering or setting events for a specific module (e.g., writing ':mod:<module>' to 'set_event'), the code in '__ftrace_set_clr_event_nolock()' and 'update_event_fields()' reads 'call->module' directly without checking whether the event is dynamic. This causes the kernel to treat the small integer (refcnt) as a 'struct module' pointer, leading to a NULL/invalid pointer dereference (Oops) when dereferencing the module name. Fix this by ensuring that the 'TRACE_EVENT_FL_DYNAMIC' flag is checked before treating 'call->module' as a valid pointer in these code paths.
In the Linux kernel, the following vulnerability has been resolved: arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates When seccomp support was originally added to arm64 in a1ae65b21941 ("arm64: add seccomp support"), seccomp was erroneously called _before_ the ptrace syscall-enter-stop and therefore the tracer could trivially manipulate the syscall register state after the seccomp check had passed. This was subsequently fixed in a5cd110cb836 ("arm64/ptrace: run seccomp after ptrace") by moving the seccomp check after the tracer has run. Unfortunately, a decade later, that fix has been reported to be incomplete. On arm64, both the first argument to a syscall and its eventual return value are allocated to register x0. In order to facilitate syscall restarting and querying of syscall arguments on the syscall exit path, the original value of x0 is stashed in 'struct pt_regs::orig_x0' early during the syscall entry path and is returned for the first argument by syscall_get_arguments(). Unlike 32-bit Arm, this stashed value is not directly exposed via ptrace() and so changes to register x0 made by the tracer on a syscall-enter-stop are not reflected in 'orig_x0'. This means that seccomp, syscall tracepoints and audit can observe a stale value for the register compared to the argument that will be observed by the actual syscall. Re-sync 'orig_x0' from x0 on the syscall entry path following a potential ptrace stop (i.e. PTRACE_EVENTMSG_SYSCALL_ENTRY or SECCOMP_RET_TRACE). This behaviour is limited to native tasks (because compat tasks expose 'orig_r0' to ptrace) where the syscall is not being skipped (because x0 is updated to hold the return value of -ENOSYS in that case).
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: userspace: fix use-after-free in get_local_id In mptcp_pm_userspace_get_local_id(), the address entry is looked up under spinlock, but its id is read after dropping the lock. A concurrent deletion can free the entry between the unlock and the read, leading to UAF. The race window is narrow. It was reproduced only with a locally constructed stress test that repeatedly overlaps an MP_JOIN SYN with a MPTCP_PM_CMD_SUBFLOW_DESTROY request. However, the KASAN report below confirms that the race is reachable: [ 666.319376] BUG: KASAN: slab-use-after-free in mptcp_userspace_pm_get_local_id+0x1dc/0x1f0 [ 666.319386] Read of size 1 at addr ffff888124845610 by task swapper/0/0 ... [ 666.319401] Call Trace: [ 666.319405] <IRQ> [ 666.319408] dump_stack_lvl+0x53/0x70 [ 666.319412] print_address_description.constprop.0+0x2c/0x3b0 [ 666.319418] print_report+0xbe/0x2b0 [ 666.319421] ? mptcp_userspace_pm_get_local_id+0x1dc/0x1f0 [ 666.319423] kasan_report+0xce/0x100 [ 666.319426] ? mptcp_userspace_pm_get_local_id+0x1dc/0x1f0 [ 666.319429] mptcp_userspace_pm_get_local_id+0x1dc/0x1f0 [ 666.319433] mptcp_pm_get_local_id+0x371/0x440 ... [ 666.319821] Allocated by task 45539: [ 666.319844] kasan_save_stack+0x33/0x60 [ 666.319855] kasan_save_track+0x14/0x30 [ 666.319858] __kasan_kmalloc+0x8f/0xa0 [ 666.319863] __kmalloc_noprof+0x1e7/0x520 [ 666.319867] sock_kmalloc+0xdf/0x130 [ 666.319885] sock_kmemdup+0x1b/0x40 [ 666.319888] mptcp_userspace_pm_append_new_local_addr+0x261/0x500 [ 666.319910] mptcp_pm_nl_announce_doit+0x16a/0x610 ... [ 666.319967] Freed by task 45560: [ 666.319988] kasan_save_stack+0x33/0x60 [ 666.319991] kasan_save_track+0x14/0x30 [ 666.319994] kasan_save_free_info+0x3b/0x60 [ 666.319998] __kasan_slab_free+0x43/0x70 [ 666.320000] kfree+0x166/0x440 [ 666.320003] sock_kfree_s+0x1d/0x50 [ 666.320007] mptcp_userspace_pm_delete_local_addr.isra.0+0x157/0x200 [ 666.320011] mptcp_pm_nl_subflow_destroy_doit+0x51d/0xea0 Fix by copying the id into a local variable while still holding the lock, and use -1 as a "not found" sentinel.
In the Linux kernel, the following vulnerability has been resolved: afs: Fix afs_edit_dir_remove() to get, not find, block 0 Fix afs_edit_dir_remove() to use afs_dir_get_block() to get block 0 rather than afs_dir_find_block() as the latter caches the found block in the afs_dir_iter and may[*] switch out the page it's on if another afs_dir_find_block() is done. This parallels what afs_edit_dir_add() does. [*] There's more than one block per page.
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not try compression for data reloc inodes [BUG] There is a syzbot report that the check inside get_new_location() triggered: BTRFS info (device loop0): found 31 extents, stage: move data extents BTRFS info (device loop0): leaf 8908800 gen 16 total ptrs 28 free space 1676 owner 18446744073709551607 item 0 key (256 INODE_ITEM 0) itemoff 3835 itemsize 160 inode generation 5 transid 0 size 0 nbytes 0 block group 0 mode 40755 links 1 uid 0 gid 0 rdev 0 sequence 0 flags 0x0 atime 1669132761.0 ctime 1669132761.0 mtime 1669132761.0 otime 0.0 item 1 key (256 INODE_REF 256) itemoff 3823 itemsize 12 index 0 name_len 2 item 2 key (258 INODE_ITEM 0) itemoff 3663 itemsize 160 inode generation 1 transid 16 size 733184 nbytes 106496 block group 0 mode 100600 links 0 uid 0 gid 0 rdev 0 sequence 24 flags 0x18 item 3 key (258 EXTENT_DATA 0) itemoff 3595 itemsize 68 generation 16 type 0 inline extent data size 47 ram_bytes 4096 compression 1 [...] item 27 key (18446744073709551611 ORPHAN_ITEM 258) itemoff 2376 itemsize 0 BTRFS error (device loop0): unexpected non-zero offset in file extent item for data reloc inode 258 key offset 0 offset 9277520992061368337 ------------[ cut here ]------------ btrfs_abort_should_print_stack(__error) [CAUSE] The above dump tree shows the first file extent item is inlined, which should make no sense for data reloc inodes, as such inodes just represent where the data extents are in the relocation destination chunk. However the relocation path preallocates space for each block, then dirties them, cluster by cluster. It's possible to have a single block at the beginning of the block group, and no other block in the same cluster. So relocation will preallocate a file extent for that block and dirty the first block. Then memory pressure forces the data reloc inode to be written back, before any other blocks are dirtied/allocated. Finally commit 3eaf5f082c4c ("btrfs: extract inlined creation into a dedicated delalloc helper") changed the sequence of delalloc. Before that commit we always tried NOCOW first, so that dirtied block would be written back into the preallocated space, and appear as a regular extent. But with that commit, we always try inline first, and since compression is forced, we try compressing the first block, and then inline the compressed data, resulting in the above inlined file extent in the data reloc tree. Then the check in get_new_location() will check the file offset, without checking if the file extent is inlined or not, resulting in the above failure. [FIX] Do not allow compression for data reloc inodes. Since data reloc inode sizes are always block aligned, as long as we do not compress, @data_len will always be at least one block, and that will cause can_cow_file_range_inline() to return false, thus no inlined extent will be created.
In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: validate ranges in damon_set_regions() DAMON core logic assumes zero length regions don't exist. However, a few DAMON API callers including DAMON_SYSFS, DAMON_RECLAIM and DAMON_LRU_SORT allow users to set empty monitoring target regions. This could result in WARN_ONCE() on CONFIG_DAMON_DEBUG_SANITY enabled kernel, and divide-by-zero from damon_merge_two_regions(). For example, the WANR_ONCE() can be triggered like below. # grep DAMON_DEBUG_SANITY /boot/config-$(uname -r) # CONFIG_DAMON_DEBUG_SANITY=y # damo start # cd /sys/kernel/mm/damon/admin/kdamonds/0 # echo 0 > contexts/0/targets/0/regions/0/start # echo 0 > contexts/0/targets/0/regions/0/end # echo commit > state # dmesg [....] [ 73.705780] ------------[ cut here ]------------ [ 73.707552] start 0 >= end 0 [ 73.708452] WARNING: mm/damon/core.c:359 at damon_new_region+0x6e/0x80, CPU#1: kdamond.0/758 [...] All DAMON API callers eventually use damon_set_regions() to setup the regions. Add the validation logic in the function.
In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow overlapping input ranges for damon_set_regions() damon_set_regions() assumes the input ranges are sorted by the address and don't overlap each other. Hence the assumption was initially to be explicitly validated. But commit 97d482f4592f ("mm/damon/sysfs: reuse damon_set_regions() for regions setting") has mistakenly removed the validation. This can make DAMON behave in unexpected ways. At the best, the monitoring results snapshot will just look weird since there will be overlapping regions. DAMOS will also work weirdly, applying the same action multiple times for overlapping regions, and make DAMOS quota weird. More seriously, depending on the setup and regions updates sequence, negative size regions can be made. It will trigger WARN_ONCE() if the kernel is built with CONFIG_DAMON_DEBUG_SANITY=y. Depending on the monitoring results, the negative size region can further trigger division by zero in damon_merge_two_regions(). Note that some of the consequences including the WARN_ONCE() and the divide by zero depend on commits that were introduced after the root cause commit 97d482f4592f ("mm/damon/sysfs: reuse damon_set_regions() for regions setting"). Fix the problems by checking the assumption and returning an error if the input ranges don't meet the assumption. The issue was discovered [1] by Sashiko.
In the Linux kernel, the following vulnerability has been resolved: binfmt_elf_fdpic: only honour the first PT_INTERP The program header scan handles PT_INTERP from a switch nested in the scan loop, so its break leaves the switch and not the loop. A binary carrying more than one PT_INTERP runs the case again and overwrites both interpreter_name and interpreter. The previous name allocation leaks and so does the previous interpreter reference, along with the write denial open_exec() took on it. The denial is never released, so the file stays unwritable for as long as the system runs. An unprivileged caller reaches this with a crafted binary and repeats it at will. binfmt_elf stops at the first PT_INTERP. Do the same here. The flaw dates back to the driver's introduction in the pre-git history tree introduced in v2.6.11 by 91808d6ebe39 ("[PATCH] FRV: Add FDPIC ELF binary format driver").
In the Linux kernel, the following vulnerability has been resolved: fs/super: fix emergency thaw double-unlock of s_umount do_thaw_all() iterates over all superblocks via __iterate_supers() with SUPER_ITER_EXCL, which acquires s_umount exclusively before calling the callback and releases it afterwards. However, the callback do_thaw_all_callback() calls thaw_super_locked() which unconditionally releases s_umount on every code path. This results in a second unlock attempt in __iterate_supers() that corrupts the rwsem state, triggering a DEBUG_RWSEMS warning: [ 182.601148] sysrq: Emergency Thaw of all frozen filesystems [ 182.601865] ------------[ cut here ]------------ [ 182.602375] DEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && !rwsem_test_oflags(sem, RWSEM_NONSPINNABLE)): count = 0x0, magic = 0xffff99b1011e5870, owner = 0x0, curr 0xffff99b101b06c80, list not empty [ 182.603817] WARNING: kernel/locking/rwsem.c:1412 at up_write+0xa3/0x170, CPU#2: kworker/2:1/53 [ 182.604578] Modules linked in: [ 182.604864] CPU: 2 UID: 0 PID: 53 Comm: kworker/2:1 Not tainted 7.2.0-rc4-00001-gbd3bd93ea98a-dirty #4 PREEMPT(lazy) [ 182.605711] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1kylin1 04/01/2014 [ 182.606417] Workqueue: events do_thaw_all [ 182.606750] RIP: 0010:up_write+0xaf/0x170 [ 182.607076] Code: 19 3a 92 48 0f 44 c2 48 8b 55 08 48 8b 55 00 4c 8b 45 08 48 8b 55 00 48 8d 3d ad 91 e0 01 48 8b 4d 20 50 48 c7 c6 f0 8c 26 92 <67> 48 0f b9 3a e8 d7 93 4e 00 58 eb 81 48 83 7f 18 00 48 c7 c2 8d [ 182.608563] RSP: 0018:ffffb670001d7e08 EFLAGS: 00010246 [ 182.609007] RAX: ffffffff92349e8d RBX: 0000000000000000 RCX: ffff99b1011e5870 [ 182.609595] RDX: 0000000000000000 RSI: ffffffff92268cf0 RDI: ffffffff92914d10 [ 182.610283] RBP: ffff99b1011e5870 R08: 0000000000000000 R09: ffff99b101b06c80 [ 182.610847] R10: ffff99b10139a808 R11: fefefefefefefeff R12: 0000000000000000 [ 182.611414] R13: ffffffff90cf74d0 R14: 0000000000000000 R15: ffff99b1011e5800 [ 182.612009] FS: 0000000000000000(0000) GS:ffff99b1eaaee000(0000) knlGS:0000000000000000 [ 182.612670] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 182.613146] CR2: 00000000005c631c CR3: 00000000013ee000 CR4: 00000000000006f0 [ 182.613722] Call Trace: [ 182.613946] <TASK> [ 182.614130] __iterate_supers+0x128/0x150 [ 182.614463] do_thaw_all+0x1b/0x30 [ 182.614759] process_scheduled_works+0xbb/0x3f0 [ 182.615150] ? __pfx_worker_thread+0x10/0x10 [ 182.615499] worker_thread+0x129/0x270 [ 182.615816] ? __pfx_worker_thread+0x10/0x10 [ 182.616201] kthread+0xe2/0x120 [ 182.616469] ? __pfx_kthread+0x10/0x10 [ 182.616792] ret_from_fork+0x15b/0x240 [ 182.617115] ? __pfx_kthread+0x10/0x10 [ 182.617426] ret_from_fork_asm+0x1a/0x30 [ 182.617761] </TASK> [ 182.617968] ---[ end trace 0000000000000000 ]--- [ 182.618412] Emergency Thaw complete Fix this by switching to SUPER_ITER_UNLOCKED and acquiring s_umount in the callback via super_lock_excl() before calling thaw_super_locked(). This matches the locking pattern expected by thaw_super_locked() and eliminates the double unlock. While at it, remove the dead 'return;' at the end of do_thaw_all_callback().
In the Linux kernel, the following vulnerability has been resolved: ftrace: Add global mutex to serialize trace_parser access In ftrace, the trace_parser structure is allocated and initialized when a trace file is opened, and is subsequently used across write and release handlers to parse user input. The affected handler paths and their specific functions are: - Open paths: ftrace_regex_open(), ftrace_graph_open() - Write paths: ftrace_regex_write(), ftrace_graph_write() - Release paths: ftrace_regex_release(), ftrace_graph_release() If userspace opens a trace file descriptor and shares it across multiple threads, concurrent write calls will race on the parser's internal state, specifically the 'idx', 'cont', and 'buffer' fields, leading to corrupted input or undefined behavior. Fix this by adding a global mutex, parser_lock, to serialize all access to trace_parser across write and release paths, preventing concurrent corruption of parser state.
In the Linux kernel, the following vulnerability has been resolved: net: hip04: fix RX buffer leak on build_skb failure When build_skb() fails in hip04_rx_poll(), the driver jumps to the refill path without releasing the current RX buffer and its DMA mapping. Installing a replacement buffer then overwrites the slot references and leaks both resources. Keep the current slot intact and return budget so NAPI retries the same buffer. Also free a newly allocated RX fragment when dma_map_single() fails. This issue was found by an in-house static analysis tool.
In the Linux kernel, the following vulnerability has been resolved: ice: fix PTP Call Trace during PTP release If a PF reset occurs when the PTP state is ICE_PTP_UNINIT, then ice_ptp_rebuild() will update the state to ICE_PTP_ERROR. This will result in the following PTP release call trace during driver unload: kernel BUG at lib/list_debug.c:52! ice_ptp_release+0x332/0x3c0 [ice] ice_deinit_features.part.0+0x10e/0x120 [ice] ice_remove+0x100/0x220 [ice] This was observed when passing PF1 through to a VM. ice_ptp_init() fails because ctrl_pf is NULL and sets the state to ICE_PTP_UNINIT. Fix by detecting the ICE_PTP_UNINIT state in ice_ptp_rebuild() and returning without error, preventing the invalid state transition to ICE_PTP_ERROR. The only valid path to ICE_PTP_ERROR is from ICE_PTP_RESETTING after a failed rebuild.
In the Linux kernel, the following vulnerability has been resolved: super: fix emergency thaw deadlock on frozen block devices do_thaw_all_callback() calls bdev_thaw() while holding sb->s_umount exclusively. If the block device was frozen via bdev_freeze() dropping the last block layer freeze reference calls fs_bdev_thaw() which reacquires s_umount: do_thaw_all_callback(sb) super_lock_excl(sb) # holds sb->s_umount bdev_thaw(sb->s_bdev) mutex_lock(&bdev->bd_fsfreeze_mutex) # bd_fsfreeze_count drops 1 -> 0 bd_holder_ops->thaw == fs_bdev_thaw get_bdev_super(bdev) bdev_super_lock(bdev, true) super_lock(sb, true) down_write(&sb->s_umount) # same task: deadlock The emergency thaw worker deadlocks against itself holding both s_umount and bd_fsfreeze_mutex. That fscks any subsequent unmount, freeze, or thaw of that filesystem and block device. [ 81.878470] sysrq: Show Blocked State [ 81.880140] task:kworker/0:1 state:D stack:0 pid:11 tgid:11 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 81.884876] Workqueue: events do_thaw_all [ 81.886656] Call Trace: [ 81.887759] <TASK> [ 81.888763] __schedule+0x579/0x1420 [ 81.890372] schedule+0x3a/0x100 [ 81.891794] schedule_preempt_disabled+0x15/0x30 [ 81.893848] rwsem_down_write_slowpath+0x1ea/0x900 [ 81.895191] ? __pfx_do_thaw_all_callback+0x10/0x10 [ 81.896528] down_write+0xbd/0xc0 [ 81.897505] super_lock+0x91/0x180 [ 81.898457] ? __mutex_lock+0xa99/0x1140 [ 81.900748] ? __mutex_unlock_slowpath+0x1f/0x400 [ 81.902069] bdev_super_lock+0x5b/0x150 [ 81.903132] get_bdev_super+0x10/0x60 [ 81.904042] fs_bdev_thaw+0x23/0xf0 [ 81.904755] bdev_thaw+0x82/0x100 [ 81.905484] do_thaw_all_callback+0x2c/0x50 [ 81.906298] __iterate_supers+0x5d/0x130 [ 81.907067] do_thaw_all+0x20/0x40 [ 81.907739] process_one_work+0x206/0x5e0 [ 81.908545] worker_thread+0x1e2/0x3c0 [ 81.909339] ? __pfx_worker_thread+0x10/0x10 [ 81.910171] kthread+0xf4/0x130 [ 81.910799] ? __pfx_kthread+0x10/0x10 [ 81.911528] ret_from_fork+0x2e2/0x3b0 [ 81.912259] ? __pfx_kthread+0x10/0x10 [ 81.913010] ret_from_fork_asm+0x1a/0x30 [ 81.913806] </TASK> bdev_super_lock() even documents the violated requirement with lockdep_assert_not_held(&sb->s_umount). Acquiring bd_fsfreeze_mutex under s_umount also inverts the bd_fsfreeze_mutex vs. s_umount ordering established by bdev_{freeze,thaw}() and can thus ABBA against a concurrent block-layer freeze even when the recursive path isn't hit. Fix this by not holding s_umount around the bdev_thaw() loop at all. Pin the superblock with an active reference instead as filesystems_freeze_callback() does. The active reference keeps the superblock from being shut down and so ->s_bdev stays valid without holding s_umount. The block-layer-held freeze is dropped by fs_bdev_thaw() with FREEZE_MAY_NEST | FREEZE_HOLDER_USERSPACE exactly as a regular unfreeze would and thaw_super_locked() handles filesystem-level freezes as before. The emergency thaw path has deadlocked like this in one form or another for a long long time but the current exclusively-held shape dates back to commit [1] where thaw_bdev() already ended in thaw_super() with s_umount held by do_thaw_all_callback().
In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer destroy_previous_session() until after NTLM authentication In ntlm_authenticate(), destroy_previous_session() is called using a user pointer resolved from the client-supplied NTLM blob username field before the NTLMv2 response is validated. An authenticated attacker can set the NTLM blob username to match a victim account and set PreviousSessionId to the victim's session ID; destroy_previous_session() destroys the victim's session while ksmbd_decode_ntlmssp_auth_blob() subsequently rejects the request with -EPERM. Move destroy_previous_session() and the prev_id assignment to after ksmbd_decode_ntlmssp_auth_blob() returns success and use sess->user rather than the pre-authentication lookup result. This matches the ordering already used by krb5_authenticate(), where destroy_previous_session() is called only after ksmbd_krb5_authenticate() returns success.
In the Linux kernel, the following vulnerability has been resolved: mac802154: hold an interface reference across the scan worker mac802154_scan_worker() captures the scanning sub-interface under RCU and then keeps dereferencing sdata->dev after rcu_read_unlock() and outside the rtnl -- in the failure traces, in mac802154_transmit_beacon_req() (skb->dev = sdata->dev), and in the end_scan cleanup. Nothing keeps that netdev alive across the worker iteration. A concurrent DEL_INTERFACE or PHY removal can unregister the interface once the worker drops the rtnl between its two drv_set_channel() sections. unregister_netdevice() frees the netdev asynchronously from netdev_run_todo() with the rtnl already dropped, so neither holding the rtnl nor the per-PHY IEEE802154_IS_SCANNING flag prevents a stale worker iteration from dereferencing the freed netdev -- a KASAN slab-use-after-free, reachable by racing TRIGGER_SCAN against DEL_INTERFACE (both CAP_NET_ADMIN). Pin the netdev with netdev_hold() while the RCU read lock is still held, and release it at every worker exit.
In the Linux kernel, the following vulnerability has been resolved: ovpn: fix peer refcount leak in TCP error paths When either the TCP RX or TX error path calls ovpn_peer_hold() followed by schedule_work(&peer->tcp.defer_del_work), and the work item is already pending from the other path, schedule_work() returns false and the work runs only once. Since ovpn_tcp_peer_del_work() calls ovpn_peer_put() exactly once, the extra reference taken by the losing path is never dropped, leaking the peer object. The race window: CPU0 (strparser/RX error): CPU1 (tcp_tx_work/TX error): ovpn_peer_hold() <- refcnt+1 ovpn_peer_hold() <- refcnt+2 schedule_work() <- queued schedule_work() <- NO-OP (work already pending) ovpn_tcp_peer_del_work runs: ovpn_peer_del() ovpn_peer_put() <- refcnt+1 <- peer never freed Fix by checking the return value of schedule_work() in both paths and calling ovpn_peer_put() to drop the extra reference if the work was already pending. ovpn_peer_hold() is kept unconditional in the TX path as it cannot fail at that point.
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix aperture mapping leak amdgpu_pci_remove() calls drm_dev_unplug() before invoking the driver fini routines. This causes drm_dev_enter() in amdgpu_ttm_fini() to always return false, so iounmap(aper_base_kaddr) never runs on normal driver unload, leaving an orphaned entry in the x86 PAT interval tree. On connected_to_cpu hardware, the aperture is mapped write-back (WB) via ioremap_cache(). On reload, IP discovery calls memremap(..., MEMREMAP_WC) over the same range. The WC vs WB conflict causes: ioremap error for 0x..., requested 0x1, got 0x0 amdgpu: discovery failed: -2 Fix by switching to devres-managed mappings so cleanup is guaranteed regardless of drm_dev_enter() state: - connected_to_cpu path: devm_memremap(MEMREMAP_WB). For IORESOURCE_SYSTEM_RAM ranges this takes the try_ram_remap() shortcut, returning __va(offset) from the existing kernel direct map. No new ioremap VA or PAT entry is created, so there is nothing to orphan. - dGPU path: devm_ioremap_wc() registers iounmap() as a devres action, guaranteeing cleanup at device_del() time. Also remove iounmap(aper_base_kaddr) from amdgpu_device_unmap_mmio() since the mapping is now devres-owned. v2: Remove redundant x86_64 guard (Lijo) (cherry picked from commit d871e99879cb5fd1fa798b006b4888887e63a17a)
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx For a short moment during alloc/free the userptr BO is not part of his VM, so bo->vm_bo can be NULL. Keep a reference to the VM root PD as parent of the userptr BO so that we can always use that to wait for all submissions of the VM instead of only the one involving the userptr BO. (cherry picked from commit 631849ff5d603841e74f19f4a5e30fe1f7d7cf30)
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix race between registration and connection abortion This fixes this race: - thread a: io_uring_enter -> register sqe -> fuse_uring_create_ring_ent -> allocate ent but doesn't grab queue_ref yet - thread b: fuse_conn_destroy() -> fuse_chan_abort() -> fuse_uring_abort() is a no-op due to queue ref being 0 - thread a: grabs the queue_ref, queue_ref is now 1, rest of fuse_uring_do_register() logic executes - thread b: fuse_chan_abort() returns, fuse_chan_wait_aborted() now runs and calls "wait_event(ring->stop_waitq, atomic_read(&ring->queue_refs) == 0);" The abort/unmount thread will hang indefinitely in unkillable state as nothing will decrement queue_refs or wake stop_waitq, and the ring, queue, and ent are leaked. Fix this by checking fch->connected under fch->lock after the created ent has grabbed a ref count on the queue. This ensures that in the scenario above, it is guaranteed that we either release the queue ref and wake up stop_waitq (in case fuse_chan_wait_aborted() is already waiting) in fuse_uring_do_register() when we detect !fch->connected, or if the connection is aborted after the check, it is guaranteed that the async teardown worker will be running in the background cleaning up ents and decrementing the ent's ref on the queue, which will unblock the eventual queue and ring teardown.
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug If a vCPU stays scheduled out (or blocked) while the last pCPU it ran on goes through a hotplug cycle (online->offline->online), and the vCPU then resumes execution on the same pCPU, then it is possible for it to run with an ASID that has now been assigned to a different vCPU, resulting in stale TLB translations being used. svm_enable_virtualization_cpu() resets asid_generation to 1 and sets next_asid to max_asid + 1 on every CPU online event, including hotplug cycles. Because next_asid starts beyond the pool boundary, the first call to new_asid() after an online event always wraps the pool, incrementing asid_generation to 2 and assigning ASIDs starting from min_asid. Consider two vCPUs from different VMs, vCPU-A pinned to CPU-X holding asid_generation=2 and ASID=N from before the hotplug event: 1. CPU-X goes offline and back online: asid_generation resets to 1, next_asid = max_asid + 1. 2. One or more vCPUs migrate to CPU-X and call new_asid(), wrapping the pool and consuming ASIDs starting from min_asid. Eventually vCPU-B from a different VM is assigned asid_generation=2, ASID=N - the same ASID that vCPU-A held before the hotplug. 3. vCPU-A enters pre_svm_run() on CPU-X: current_vmcb->cpu is unchanged so the migration branch is skipped. Its saved asid_generation=2 matches sd->asid_generation=2, so the generation check silently passes and vCPU-A continues running with ASID=N - the same ASID just freshly assigned to vCPU-B. Both vCPUs from different VMs now run on CPU-X with the same ASID, causing them to share NPT TLB entries and producing stale translations. The collision manifests as a KVM internal error (Suberror: 1, emulation failure). The NPT page fault reports a faulting GPA far outside the VM's physical memory range - a sign of stale TLB translations being used. KVM falls back to instruction emulation, which fails on FPU/XSave instructions (XRSTOR, STMXCSR) that the emulator does not implement. Fix this by incrementing asid_generation instead of resetting it to 1 in svm_enable_virtualization_cpu(). On module load, asid_generation starts at 0 (memset) and the increment produces 1, identical to the old behaviour. On subsequent hotplug cycles the generation advances beyond any value a vCPU previously observed on this CPU, so the generation check in pre_svm_run() reliably forces new_asid() on every vCPU after every hotplug cycle.
In the Linux kernel, the following vulnerability has been resolved: time/jiffies: Register jiffies clocksource before usage Teddy reported that a XEN HVM has a long boot delay, which was bisected to the recent enhancements to the negative motion detection. It turned out that the jiffies clocksource is used in early boot before it is registered, which leaves the max_delta_raw field at zero. That causes the read out to be clamped to the max delta of 0, which means time is not making progress. Cure it by ensuring that it is initialized before its first usage in timekeeping_init().
In the Linux kernel, the following vulnerability has been resolved: iio: core: fix uninitialized data in debugfs If *ppos is non-zero then simple_write_to_buffer() will not initialize the start of buf[]. Non zero values for *ppos aren't going to work anyway. Test for them at the start of the function and return -EINVAL.
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndis_query_response(), and perform a length check on them. This is identical to how rndis_set_response() handles these parameters.
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush() wacom_wac_queue_flush() is called via the .raw_event callback (wacom_raw_event → wacom_wac_pen_serial_enforce → wacom_wac_queue_flush). For USB HID devices, this callback is invoked from hid_irq_in(), which is a URB completion handler running in atomic context. Using GFP_KERNEL in this path can sleep, leading to a "scheduling while atomic" bug. Use GFP_ATOMIC instead. The existing code already handles allocation failure by skipping the fifo entry and continuing.
In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: write all dirty file folios when collapsing [There is no upstream commit, as this code was removed by upstream commit 044925f9b565 ("mm: fs: remove filemap_nr_thps*() functions and their users")] As-is, khugepaged and writable-file opening exclude each other. A file cannot be open writeable and have THPs (because the filesystem is not aware of them). khugepaged will never collapse file pages for files that are opened writeable. On an open(O_RDWR/O_WRONLY), the page cache for that particular file is dropped. This is fine because nothing could've been dirtied. However, there is an edge-case: collapse_file() might not be able to coexist with concurrent writers, but it can coexist with dirty folios (from previous writers). Therefore, the following can happen: open(file, O_RDWR) write(file) close(file) madvise(file_mapping, MADV_COLLAPSE, some non-dirty range) open(file, O_RDWR) nr_thps > 0 truncate_inode_pages() /* THPs are cleared out, but so are the dirty folios */ When this edge-case happens, there is data loss, as the dirty folios are fully discarded. Fix it by fully writing back the page cache (and waiting) when collapsing file THPs. Doing so provides the guarantee that no dirty folio will be observed while there are active THPs. To fully ensure this is safe, the invalidate_lock needs to be held while doing the writeout, so that do_dentry_open()'s page cache truncation excludes this write-and-wait. As a side effect, move the nr_thps counter bumping outside the i_pages lock. This is correct since the counter itself is an atomic_t and the producer <-> consumer correctness is provided by a full memory barrier: smp_mb() in collapse_file()/memory barrier implied by full ordering in get_write_access() -> atomic_inc_unless_negative().
In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: fix location monitor leak in tsi148 bridge tsi148_probe() allocates a location monitor resource and links it into tsi148_bridge->lm_resources. The probe error path frees this list, but tsi148_remove() only frees the dma, slave and master resource lists, so the location monitor resource is leaked on device unbind or module unload. Free the lm_resources list in tsi148_remove() as well, before tsi148_bridge is freed.
User enumeration via observable response discrepancy in Checkmate through version 2.1.0 exposes whether any given email address is registered on the platform. The password recovery endpoint POST /api/v1/auth/recovery/request returns HTTP 200 for known accounts and a distinct status code for unknown ones, allowing unauthenticated remote attackers to silently map valid user accounts. No public exploit or CISA KEV listing exists at time of analysis, but exploitation requires no authentication and is trivially automatable.
Uninitialized heap memory exposure in GNU Emacs for Android's sfnt font parser allows a remote, unauthenticated attacker to trigger information disclosure, process crashes, or arbitrary memory access on 32-bit targets by delivering a crafted font file. The flaw in sfnt_read_table_directory() (src/sfnt.c) stems from an incorrect comparison variable in the read-length check, causing the parser to trust an attacker-controlled table-entry count without proper bounds validation. No public exploit or CISA KEV listing exists at time of analysis; exploitation requires user interaction with attacker-delivered content such as an email, EWW-rendered webpage, or a document referencing a malicious font face.
JWT tokens written to Apache Ranger logs in versions 2.8.0 and earlier remain replayable, allowing any party with read access to those logs to authenticate as legitimate users without knowing their credentials. The flaw (CWE-532) is particularly severe because Ranger controls data security policies across Hadoop ecosystems - impersonating a Ranger user can yield control over access policies for HDFS, Hive, HBase, and related services. No public exploit or CISA KEV listing exists at time of analysis; Apache has confirmed a fix in version 2.9.0.
Remote unauthenticated control of Ecovacs Robotics DEEBOT PRO M1 and K1VAC robot vacuums is possible due to an incorrectly implemented authentication algorithm in their WebSocket communications interface. Any network-reachable attacker can connect to and issue operational commands to affected robots without valid credentials (AV:N, PR:N per CVSS vector). No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Man-in-the-middle interception of ECOVACS PRO app traffic is possible due to improper TLS server certificate validation (CWE-295) in both the Android and iOS versions of the application, published by ECOVACS Robotics and coordinated by JPCERT under JVNVU92804348. An attacker with a network-positioned MITM capability can present a rogue certificate that the app accepts without proper validation, enabling retrieval and alteration of all app-server communications, which may include device control commands, account credentials, and home telemetry. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Weak Wi-Fi hotspot credentials on Ecovacs DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums allow a physically proximate attacker to recover the access point password through analysis, then connect to the robot's local network interface. Reported by JPCERT/CC via JVN advisory JVNVU92804348, this affects all firmware versions of both models per CPE data. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the low exploitation complexity combined with zero required privileges makes unauthorized Wi-Fi access straightforward for any attacker within radio range.
Weak preconfigured root credentials on Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robotic vacuum cleaners expose the root account to compromise via physical access. An attacker who obtains physical access to an affected device can recover the root password, gaining privileged control over the embedded Linux system. Reported by JPCERT and disclosed via JVN advisory JVNVU92804348, no public exploit code exists and no active exploitation has been confirmed at time of analysis.
Improper certificate validation in DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums exposes MQTT communications to man-in-the-middle interception, allowing unauthenticated network-positioned attackers to retrieve operation logs and activity logs stored on the devices. Both models from Ecovacs Robotics fail to verify server certificates during MQTT sessions, meaning a rogue server can impersonate the legitimate cloud backend without detection. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but a vendor advisory with remediation guidance was published on 2026-03-31 as referenced by JPCERT.
Samsung Smart Switch prior to version 3.7.72.6 exposes sensitive user data to adjacent network attackers through improper input validation during device transfer sessions. The attack requires both adjacent network positioning and user interaction, constraining real-world exploitability relative to the high confidentiality impact (VC:H) reflected in the CVSS 4.0 score of 6.8. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
SamsungPassAutofill prior to version 5.2.10.x on Samsung Android devices improperly exports application components, enabling a locally-installed malicious app to access sensitive autofill credential data with user interaction. The CVSS 4.0 vector (AV:L/PR:L/UI:A/VC:H) confirms the attack is constrained to on-device, low-privilege access requiring user-triggered activity, yielding a moderate score of 5.1 despite high confidentiality impact. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Cleartext storage of sensitive information in Samsung Smart Switch prior to version 3.7.72.6 exposes device migration data to adjacent network attackers. The flaw enables an attacker on the same local network segment to intercept or read sensitive data that the application fails to encrypt at rest or in transit. No public exploit or active exploitation has been confirmed, but the high confidentiality impact and low attack complexity make this a meaningful risk in shared or semi-trusted network environments.
Device identity spoofing in Samsung Smart Switch's trouble scanning mode allows adjacent network attackers to impersonate trusted devices, potentially enabling interception or manipulation of data during device transfer sessions. All Smart Switch versions prior to 3.7.72.6 are affected, as reported by Samsung Mobile. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Improper authorization in the custom URL scheme handler of Samsung's My Galaxy app (all versions prior to 6.3) exposes sensitive information to remote attackers. The flaw exists because the handler processes inbound custom URL scheme invocations without enforcing adequate authorization checks, enabling an attacker-controlled web page or application to silently extract user data when a victim interacts with a crafted link. No public exploit code has been identified at time of analysis, and CISA KEV does not list this as actively exploited, but the zero-privilege requirement from the attacker's side and the broad Samsung device install base make timely patching advisable.
Improper input validation in the Galaxy Themes application on Samsung Mobile Devices allows a physical attacker to launch arbitrary Android activities, with a high confidentiality impact on the vulnerable system. Affected devices are those running Galaxy Themes prior to the SMR Aug-2026 Release 1 security update. The vulnerability is tagged as an information disclosure issue, and while it requires physical device access and active user interaction, exploitation could allow access to sensitive device data or protected application screens that would otherwise be restricted. No public exploit has been identified at time of analysis, and no KEV listing exists.
Samsung Message on Android devices prior to SMR Aug-2026 Release 1 exposes sensitive user information to physical attackers through improper input validation. An attacker with physical access to an unlocked or accessible device can interact with the Samsung Message application to trigger the flaw and read confidential message content or related data. No public exploit code has been identified, and exploitation requires hands-on device access, limiting widespread automated abuse.
Samsung Dialer on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes SIM-related functions to remote attackers through improper input validation, requiring user interaction to trigger. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P/VC:H) classifies this as a network-reachable, high-confidentiality-impact flaw, though high attack complexity and specific prerequisites substantially reduce the realistic threat surface. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Samsung Contacts on Samsung Mobile Devices prior to SMR Aug-2026 Release 1 exposes contact data across Android user profiles to an attacker with physical device access, due to improper input validation that fails to enforce inter-profile data isolation. The CVSS 4.0 vector confirms both the physical access prerequisite (AV:P) and the scope extension to a secondary user's data (SC:H), consistent with a profile boundary bypass in a multi-user Android environment. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized file deletion via improperly exported Android components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows any locally-installed malicious application to invoke the exported component and delete files under Samsung Contacts' privilege without requiring any elevated permissions of its own. The vulnerability stems from an Android component export misconfiguration, granting third-party apps unintended access to privileged file operations. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of privilege requirements make this straightforward to exploit on affected devices.
Improper input validation in Samsung Contacts on Samsung Mobile devices prior to SMR Aug-2026 Release 1 enables local attackers to delete files under Samsung Contacts' process privilege, bypassing the Android sandbox boundary between applications. The CVSS 4.0 score of 6.9 with VI:H reflects high integrity impact on the vulnerable system, though the local attack vector constrains opportunistic exploitation. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis; Samsung has released a fix in the August 2026 Security Maintenance Release.
Sensitive information exposure in the Advanced Classifieds & Directory Pro WordPress plugin (versions through 3.4.2) allows unauthenticated remote attackers to retrieve custom field listing data via the publicly accessible AJAX action `acadp_public_custom_fields_listings`, bypassing WordPress authentication entirely. A publicly available proof-of-concept has been published by WPScan, though EPSS places exploitation probability at the 1st percentile, suggesting limited observed exploitation to date. No CISA KEV listing exists, and a vendor-released patch is available in version 3.4.3.
Infinite-loop denial-of-service in libexpat before 2.8.3 allows attackers supplying crafted UTF-16 XML to hang the parsing process indefinitely via a low Unicode surrogate handled as a high surrogate in the *_toUtf16 functions. The flaw is gated by a compile-time prerequisite - only builds configured with XML_UNICODE and XML_UNICODE_WCHAR_T are vulnerable - which specifically includes Firefox and Windows-native builds of applications embedding libexpat. A concrete attack payload is publicly available in the upstream patch PR test suite; no active exploitation has been confirmed via CISA KEV at time of analysis.
Memory leak exploitation in Almico Speedfan 4.52 is constrained to local, high-privilege access and produces limited availability degradation via the speedfan.sys kernel driver's MSR Index Handler. The vulnerability resides in the KiSystemCall64 handler path within speedfan.sys, where kernel pool memory is allocated but never released during MSR index processing, enabling gradual resource exhaustion on affected Windows hosts. A publicly available proof-of-concept exists, no vendor patch has been issued, and the vendor has not responded to coordinated disclosure.
Local availability degradation in Mullvad's wireguard.sys kernel driver 0.10.1 stems from improper reference count management (CWE-911) within the AdapterState function of the IOCTL handler. An attacker with high local privileges can trigger this defect to cause driver instability or crash the WireGuard adapter, impacting VPN connectivity. A public proof-of-concept exploit exists; however, this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog and carries a CVSS 4.0 score of 4.6, reflecting its constrained impact and access prerequisites.
Unauthenticated remote exploitation of Badaso 3.0.0-alpha's File API allows attackers to bypass permission controls in ApiRequest::class (src/Routes/api.php), resulting in unauthorized read, write, and access operations on file resources. The vulnerability stems from improper permission assignment (CWE-275) in the PHP-based File API route handler. A public exploit has been disclosed via a GitHub issue; the vendor has not responded to the coordinated disclosure.
Query injection and oracle enumeration in Ash Framework (ash-project/ash) versions 1.52.0-rc.11 through pre-3.31.1 allow an attacker to forge a belongs_to relationship to a record whose identifier they cannot directly name, and to systematically recover secret lookup values via a comparison oracle. The root cause is a two-part failure in the managed_relationship on_lookup: :relate code path: client-supplied values reach Ash.Query.filter/2 without type-casting, so a nested map is interpreted as a filter predicate rather than a literal scalar, and the missing Ash.Query.limit(1) call lets Ash.read_one/2 distinguish zero, one, and multiple matches - converting boolean filter predicates into an oracle. No public exploit has been identified at time of analysis; a vendor patch is available at version 3.31.1.
Improper privilege management in wongcyrus ExcelLexBot through version 0.0.3 allows remote high-privileged attackers to perform unauthorized actions via the ExcelLexBotS3TriggerFunction Lambda handler, resulting in limited confidentiality, integrity, and availability impact. The affected product is end-of-life and will receive no vendor patch, as the maintainer is no longer supporting it. No public exploit code or active exploitation has been identified at time of analysis, though the remote attack vector and absence of a patch increase residual risk for any remaining deployments.
Weak password recovery in macrozheng mall (commit 0504e86) exposes the /sso/getAuthCode endpoint of the mall-portal module to remote manipulation, enabling account takeover via a broken authentication flow. The flaw maps to CWE-640 and requires no authentication, though exploitation is rated high complexity. A publicly available exploit has been published; the vendor deleted the corresponding GitHub issue without explanation and has not responded to private disclosure.
Unauthenticated information disclosure in MingSoft MCMS up to version 3.0.6 allows remote attackers to extract sensitive data via the /mdiy/form/get endpoint of the ms-mdiy component. The vulnerability requires no credentials or user interaction and is exploitable over the network, making it trivially accessible to any attacker with HTTP reach to the application. A public exploit has been released (CVSS 4.0 E:P), though the vulnerability is not currently listed in the CISA KEV catalog; the vendor did not respond to pre-disclosure notification, leaving no official patch available at time of analysis.
Information disclosure in MingSoft MCMS through version 3.0.6 exposes sensitive data via the `/mdiy/form/data/list` endpoint in the ms-mdiy component, exploitable by unauthenticated remote attackers with no configuration prerequisites. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial network reachability, and a public exploit has been released (E:P). The vendor did not respond to responsible disclosure, leaving no official patch available at time of analysis.
File inclusion in DedeCMS up to 5.7.118 UTF8SP2 allows a remote attacker with low privileges and high-complexity conditions to include arbitrary files via the _4_Setup function within the Installation Wizard (install/index.php). Exploitation results in limited confidentiality, integrity, and availability impact. A proof-of-concept has been publicly disclosed via GitHub, though no active exploitation has been confirmed by CISA KEV. The CVSS 4.0 score of 1.3 reflects the constrained real-world impact and significant attack complexity required.
Unauthenticated file deletion in WP Photo Album Plus WordPress plugin (all versions before 9.2.07.002) exposes a public REST endpoint that performs no capability or nonce verification, permitting any remote actor to delete generated album export ZIP archives stored by the plugin. The CVSS 3.1 score is 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N reflecting zero authentication and trivial access requirements, though impact is scoped only to those regenerable archive files. No public exploit or CISA KEV listing exists; EPSS at 0.14% (4th percentile) confirms negligible current exploitation activity.
Nexter Blocks WordPress plugin before 5.0.2 exposes a REST endpoint for saving global CSS that any Contributor-level user can invoke without proper authorization, causing injected styles to render site-wide for all visitors. The attack surface is limited to sites with untrusted Contributor accounts, and impact is constrained to front-end defacement, content suppression, and UI redressing - not code execution or data exfiltration. No public exploit code or active exploitation has been identified; EPSS of 0.10% at the 1st percentile confirms negligible exploitation probability at this time.
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state Put all vmcs12 pages if KVM synthesizes a nested VM-Exit due to invalid guest while emulating VMLAUNCH or VMRESUME. The invalid guest state path doesn't use nested_vmx_vmexit() as that API is intended to be used if and only if L2 is active, and the open coded equivalent neglects to put the vmcs12 pages. Failure to put the vmcs12 pages leaks any pinned pages (and/or mappings) if L1 retries VMLAUNCH/VMRESUME. Note, the !from_vmenter scenario doesn't suffer the same problem, as vmx_get_nested_state_pages() only gets/pins/maps the vmcs12 pages if L2 is active, i.e. if a "full" VM-Exit is guaranteed before KVM will retry getting vmcs12 pages.
WP Directory Kit WordPress plugin before version 1.5.5 exposes sensitive site data to any authenticated user due to missing authorization and nonce validation on an AJAX endpoint. Any subscriber-level account holder can trigger the vulnerable action to enumerate the full WordPress user list and access unpublished directory listings belonging to other users - data that should be restricted to privileged roles. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.14% (4th percentile), suggesting exploitation has not yet become widespread despite the low barrier to abuse.
Unauthorized data exposure in the WP Directory Kit WordPress plugin (all versions before 1.5.5) allows any authenticated user - including low-privilege Subscribers - to retrieve stored contact messages and associated personal data belonging to other users by invoking an unprotected AJAX endpoint. The root cause is the complete absence of WordPress authorization checks and nonce verification on an authenticated AJAX action, meaning the plugin performs no ownership or permission validation before returning sensitive inter-user data. A publicly available proof-of-concept has been published by WPScan; however, EPSS sits at just 0.14% (4th percentile) and no CISA KEV listing exists, indicating low observed exploitation activity at time of analysis despite the public PoC.
Visitor analytics data exposure in WP Statistics WordPress plugin versions before 14.16.10 allows any authenticated WordPress user - including those with only Subscriber-level access - to invoke dashboard analytics AJAX handlers and retrieve the site's full visitor metrics without authorization. The plugin's AJAX handlers validate a WordPress nonce but omit the required capability check, and because WordPress issues valid nonces to all authenticated users regardless of role, this effectively grants analytics read access to anyone with a site account. Publicly available exploit code exists per WPScan reporting, though no active exploitation is confirmed in the CISA KEV catalog and EPSS remains at 0.14% (4th percentile), indicating limited observed mass exploitation to date.
Out-of-bounds memory read and write in the Zephyr RTOS SF32LB MPI QSPI NOR flash driver allows a low-privileged thread, when explicitly granted flash device access in a CONFIG_USERSPACE build, to disclose arbitrary CPU-addressable memory or corrupt flash and invalidate cache beyond the mapped flash window. The root cause is a signed/unsigned type confusion in the offset bounds check: a crafted negative off_t value converts to a large unsigned integer and the subsequent addition wraps to a small result that passes the check, allowing memcpy to read from or program flash at attacker-controlled addresses. No public exploit code has been identified at time of analysis; exploitation is nonetheless mechanically straightforward for any attacker familiar with signed/unsigned integer confusion vulnerabilities.
Login-shell environment variable leakage in HKUDS nanobot up to 0.2.1 exposes sensitive environment variables to local low-privilege users during agent-driven shell command execution. The `ExecTool._prepare_command` function in `shell.py` defaulted to invoking bash/zsh with the `-l` (login shell) flag, causing system and user profile startup scripts to be sourced and potentially re-exporting credentials, API keys, or tokens into the execution environment where they could be read by the invoking user. A publicly available proof-of-concept exploit exists; no active exploitation has been confirmed (not listed in CISA KEV). The vendor-released fix in v0.3.0 changes the default from login-shell to non-login-shell execution.
Out-of-bounds kernel memory read in SonicWall Global VPN Client's SWIPsec.sys driver allows a local, low-privileged attacker to crash the host system. Affected versions are 4.10.8.1108 and earlier, running on Windows where the IPsec kernel driver is loaded by the VPN client. No public exploit identified at time of analysis, and EPSS probability stands at a very low 0.16% (5th percentile), indicating no signs of active or widespread exploitation interest.
Symlink following in File::Rotate::Simple before v0.4.0 allows a local low-privileged attacker to create arbitrary files with the permissions of the log-rotating process. When the non-default `touch` option is enabled and the log file path is a dangling symlink, the rotate method skips rotation (because the symlink target does not exist) but still invokes touch, which resolves the symlink and materializes the target at an attacker-controlled path. No public exploit code exists and EPSS is 0.17% (7th percentile), indicating negligible current exploitation interest.
Repeated denial-of-service resets in Aviation VHF Link Control X.25 protocol implementations can be triggered remotely over radio frequency by transmitting malformed or out-of-sequence frames. The resulting reset loop degrades communication availability and increases workload for pilots or air traffic controllers, with potential for reduced situational awareness during critical flight operations. No public exploit has been identified at time of analysis, but the radio-frequency attack vector means any actor with appropriate VHF transmitting equipment and protocol knowledge within range could attempt exploitation without authenticating to the target system.
Resource exhaustion in pypdf before 6.15.0 enables denial of service via crafted PDF files containing CID font width entries with maliciously large range values. Any application that processes untrusted PDFs using pypdf's text extraction or font parsing routines is affected, as the library iterates over attacker-controlled CID width ranges without bounds enforcement, consuming excessive CPU and memory. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Hono's `proxy()` function in the `hono/proxy` Proxy Helper leaks connection-scoped response headers to downstream clients by failing to strip headers named in the origin's `Connection` response field, violating RFC 9110 Section 7.6.1. Versions 4.7.0 through 4.12.33 of the npm `hono` package are affected; the function correctly removed well-known hop-by-hop headers but neglected to parse and remove the additional headers the origin declared as connection-scoped via `Connection`. No public exploit has been identified at time of analysis and exploitation is conditional on non-default origin behavior, limiting real-world priority despite the network-reachable attack vector.
Kirby CMS's REST API error handler exposes full server filesystem paths to unauthenticated remote users via unsanitized PHP exception messages. Affected are all Kirby installations on versions prior to 4.9.5 (4.x branch) and 5.0.0 through 5.5.1 (5.x branch) where the REST API has not been explicitly disabled. An attacker triggering a PHP-level error receives the raw exception message - including absolute paths such as '/var/www/kirby-site/content/' - enabling server directory enumeration that lowers the bar for chained attacks. No public exploit or CISA KEV listing has been identified at time of analysis.
Datadog Android app versions prior to 5.9.2 structurally associate authenticated users' Datadog UUIDs with Google Firebase Installation IDs on every successful login, transmitting this stable cross-session identifier - alongside crash stack traces that may include in-flight application data, internal class names, package names, and breadcrumbs - to Google's Firebase Crashlytics backend without an identifiable user consent gate or opt-out mechanism. The exposure is not triggered by an external attacker but occurs automatically during normal authenticated app usage for all affected users. No active exploitation has been identified (SSVC Exploitation: none; no CISA KEV listing), and no public exploit code exists; the primary risk is regulatory and privacy-related rather than direct technical compromise.
Plaintext SQLite database storage in the Datadog Android application exposes operationally sensitive monitoring metadata to anyone with physical access to the device or the ability to perform forensic acquisition. Two Room-managed databases - LocalNotificationDatabase and SearchRecentDatabase - store incident notification recipients, deeplinks, service names, and free-text search queries without at-rest encryption; no SQLCipher or equivalent openHelperFactory configuration was found in the codebase. Protection relies entirely on the Android application sandbox, which is insufficient for this class of data in high-risk deployment environments such as on-call engineering teams managing production infrastructure. No public exploit code exists and CISA has not added this to the KEV catalog.
Notification dismissal in the Datadog Android application (versions prior to 5.9.2) can be triggered by any zero-permission co-installed application through the improperly exported BubbleChatActivity component (CWE-926), allowing silent cancellation of the hard-coded Bits AI chat notification (ID 9201) with no identity validation of the caller or their supplied conversation_id. The impact is limited to nuisance-level denial of that specific notification and potential facilitation of in-app phishing workflows, with chat content remaining server-authentication gated and inaccessible to the attacker. SSVC assessment confirms no known active exploitation, and no public exploit code has been identified at time of analysis.
Six exported Android App Widget configuration activities in the Datadog Android application (versions prior to 5.9.2) allow a co-installed zero-permission malicious app to brute-force sequential App Widget IDs and trigger automatic Datadog session login for the victim, exposing live operational data - dashboards, SLOs, on-call schedules, incident details - as a visual side-channel. Exploitation is constrained by three simultaneous preconditions and data exfiltration is limited to screen-visible disclosure only, with no programmatic return path. No public exploit has been identified at time of analysis; SSVC rates exploitation as none with partial technical impact.
Forged on-call acknowledgment and confused-deputy execution in the Datadog Android application (versions prior to 5.9.2) allows any co-installed malicious app to silently dismiss real production incident alerts on behalf of the victim by exploiting an unguarded exported Activity with no permission check. An attacker-controlled app can supply crafted Intent extras to forge a backend Acknowledge API call using the victim's authenticated session, redirect the Datadog process into non-exported internal components, and surface a spoofed alert over the device lock screen. No public exploit has been identified at time of analysis; exploitation requires a malicious co-installed app plus a single user tap.
File and directory information exposure in SourceCodester Online Clothing Store allows unauthenticated remote attackers to retrieve Dreamweaver metadata files from the publicly accessible /_notes/ directory. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or special preconditions are required. A publicly disclosed proof-of-concept exists (E:P), documented via a Medium article detailing directory listing and Dreamweaver metadata exposure; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Behavioral workflow enforcement bypass in WonderTrader up to version 0.9.9 allows remote low-privileged attackers to manipulate the getUndoneQty argument within the _undone_qty function of the Pending Order Handler component (src/WtCore/TraderAdapter.h), resulting in unauthorized integrity modification of pending order state. The CVSS 4.0 vector confirms network-accessible exploitation with low privilege requirements and no user interaction. A publicly available proof-of-concept exploit exists (E:P), though no CISA KEV listing is recorded. The vendor was notified prior to disclosure and did not respond, meaning no official patch or advisory has been released.
Netty's RedisArrayAggregator codec fails to release retained partial aggregate state when the maxElements limit is exceeded, unlike the symmetric maxNestedArrayDepth branch which correctly calls releaseAndClearDepths() before throwing. In applications that keep the channel alive after a codec exception - a common resilience pattern - an unauthenticated peer can exploit this inconsistency to keep attacker-controlled ByteBuf references pinned in Netty's pooled buffer allocator and cause subsequent messages to be consumed into the stale pre-error aggregate. A public proof-of-concept test is included in the GHSA advisory; fixed in Netty 4.1.136.Final and 4.2.16.Final with no KEV listing at time of analysis.
Use of an uninitialized variable in WonderTrader up to version 0.9.9 allows a remote low-privileged attacker to cause limited availability disruption by manipulating the m_offsetType argument within the TraderATP Cash Trade Conversion component. The flaw resides in src/Includes/WTSTradeDef.hpp and is exploitable remotely, with a public proof-of-concept available via a Feishu document. No patch has been released and the vendor has not responded to disclosure - exploitation conditions are low complexity once authentication is satisfied, making this a persistent unmitigated risk for deployments using the ATP cash trading interface.
Scheduled task configuration overwrite in Sonatype Nexus Repository 3 enables a low-privileged authenticated user - holding permission to create at least one scheduled task type - to corrupt the configuration of an unrelated existing task via mass assignment against the administrative UI. By injecting internal configuration keys into user-supplied task property values, the attacker causes the system to redirect its write operation onto a pre-existing task rather than creating a new one, disrupting or manipulating that task's behavior. No public exploit or active exploitation has been identified; vendor-released patch 3.95.0 resolves the issue.
Unverified password change in Sonatype Nexus Repository 3 allows any account holding the nexus:* permission to overwrite the administrator password by invoking an onboarding-phase endpoint that remains accessible after initial setup is complete. The endpoint enforces access using only the presence of a local onboarding artifact rather than a proper lifecycle state check, enabling a privileged-but-non-admin account to hijack the administrator credential without invalidating existing administrator sessions. No public exploit has been identified at time of analysis and Sonatype has released a fix in version 3.95.0.
Improper behavioral workflow enforcement in WonderTrader up to version 0.9.9 allows remote attackers to manipulate the FID_JYLB argument in the TraderDD::queryTrades function, causing the application to execute trading query operations in an unintended sequence. Per the CVSS 4.0 vector (AV:N/AC:H/PR:N/UI:N), exploitation is network-reachable without authentication but requires high attack complexity, limiting opportunistic abuse. A proof-of-concept exploit is publicly available (E:P), and the vendor did not respond to responsible disclosure, leaving no patch available at time of analysis.
UNC path injection in Tobit TeamDavid's Webbox link-storing endpoint (`//ServerClient_celink.htm`) forces the server to initiate outbound SMB connections to attacker-controlled hosts, leaking NTLM authentication credentials and enabling SMB relay attacks against internal systems. The unvalidated `pathname` parameter accepts arbitrary UNC paths (e.g., `\\attacker\share`), triggering Windows credential-passing behavior that exposes the server's NTLM hash. No public exploit code identified at time of analysis, though the underlying NTLM coercion technique is well-understood and documented as part of a broader audit of 22 CVEs in the David platform published by InfoGuard.
UNC path injection in TeamDavid Webbox's !ArcEntryMove archive function causes the server to initiate outbound SMB connections to attacker-controlled infrastructure, exposing the server's NTLM authentication material (Net-NTLMv2 hashes). All TeamDavid deployments through Rollout 524 are affected, with the confidentiality impact occurring on subsequent systems - the attacker's SMB listener - rather than the Webbox host itself. No public exploit has been identified at time of analysis, but the attack technique is fully commoditized via tools such as Responder and Impacket; exploitation feasibility is further complicated by a contradictory authentication requirement in the source data that warrants vendor clarification.
UNC path injection in Tobit Laboratories AG TeamDavid's Webbox messaging component allows attackers to coerce the server into initiating outbound SMB connections to attacker-controlled hosts, exposing NTLM authentication credentials. The server processes @@INCLUDE directives containing Windows UNC paths (e.g., \\Server\Share) without validation across email, fax, and SMS composition features. Captured NTLM hashes can be cracked offline or relayed to authenticate against other internal services; the CVE description explicitly states the pathname parameter vector is exploitable without authentication, conflicting with the PR:L designation in the CVSS 4.0 vector. No public exploit or CISA KEV listing has been identified at time of analysis, but this attack class (NTLM coercion via UNC injection) is well-understood and widely tooled.
Hardcoded cryptographic credentials embedded in unencrypted ZTE ZXHN F680 router firmware allow a low-privilege authenticated network attacker to extract integrity verification keys and subsequently bypass application integrity checks on the device. Seven specific firmware versions across the V9.0.10 P1, P4, and P6 branches are confirmed affected per the ZTE advisory. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
CAPTCHA bypass in the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 allows unauthenticated network attackers to defeat anti-abuse protections on Forminator-integrated forms by exploiting a flawed validation cache keying mechanism. After solving a single legitimate Turnstile challenge, an attacker can replay token-less form submissions during the validation cache window because the cache is bound to an attacker-controlled, reusable request value rather than the one-time challenge token. A publicly available proof-of-concept exists (WPScan); this vulnerability is not currently listed in CISA KEV, and no EPSS score was provided in source data.
Payment integrity bypass in the Subscriptions for WooCommerce plugin (versions before 2.0.1) enables financial fraud by allowing substitution of an arbitrary approved PayPal order token during the WooCommerce order-received flow. The plugin captures a client-supplied token and marks any order paid solely based on a COMPLETED capture status, without verifying that the captured amount matches the order total or that the token belongs to the specific order. Unauthenticated attackers - where guest checkout is enabled - can exploit this to obtain goods or subscription access without paying the actual order price. A publicly available proof-of-concept exists; no CISA KEV listing at time of analysis.
WP Events Manager for WordPress (all versions before 2.2.5) exposes a payment notification endpoint that accepts fraudulent booking-paid confirmations from unauthenticated attackers. The plugin neither validates that an incoming payment callback originates from the configured merchant nor that the notified amount matches the booking total, enabling any remote actor to mark arbitrary bookings - including other users' bookings - as fully paid without money reaching the merchant. A publicly available exploit exists; the vulnerability is not currently listed in CISA KEV, but the AV:N/AC:L/PR:N/UI:N attack profile means exploitation requires zero privileges and trivial effort.
SELinux label manipulation via TOCTOU race condition in the policycoreutils fixfiles script allows a local low-privileged attacker to corrupt SELinux mandatory access control labels on arbitrary system files, including security-critical targets such as /etc/shadow. The flaw affects fixfiles when run in relabel or restore mode across all supported Red Hat Enterprise Linux releases (6 through 10), Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is constrained by both a required race condition win and the need for an administrator to actively invoke fixfiles.