Information Disclosure
Monthly
Information disclosure in perwendel Spark (SparkJava) up to version 2.9.4 via symlink following in the staticFiles.externalLocation method allows remote attackers with low privileges to read arbitrary files from the server. Publicly available exploit code exists, but no active exploitation or CISA KEV listing has been confirmed. The project maintainer has not yet responded to the issue report.
Information disclosure in mf-yang openclaw-cn up to version 0.2.1 allows remote authenticated attackers with low privileges to leak sensitive data by supplying a crafted URL to the scheme handler. Public exploit code is available, though no active exploitation has been confirmed by CISA KEV.
Memory exhaustion in ImageMagick's magick CLI tool allows a local attacker to cause denial of service by repeatedly supplying malformed command-line arguments. Affects versions before 7.1.2-27. Vendor patch is available; no public exploit or active exploitation reported.
In the Linux kernel, the following vulnerability has been resolved: tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Sashiko identified a deadlock when the console flow is engaged [1]. When console flow control is enabled (UPF_CONS_FLOW), s3c24xx_serial_stop_tx() calls s3c24xx_serial_rx_enable() and s3c24xx_serial_start_tx() calls s3c24xx_serial_rx_disable(). The serial core framework invokes the .stop_tx() and .start_tx() callbacks with the port->lock spinlock already held. Furthermore, all internal driver paths that invoke stop_tx (such as the DMA TX completion handler s3c24xx_serial_tx_dma_complete() or the PIO TX IRQ handler s3c24xx_serial_tx_irq()) also acquire port->lock prior to calling it. (Note that s3c24xx_serial_start_tx() is only invoked by the serial core). However, s3c24xx_serial_rx_enable() and s3c24xx_serial_rx_disable() unconditionally attempt to acquire port->lock again using uart_port_lock_irqsave(). Since spinlocks are not recursive, this causes a deadlock on the same CPU when console flow control is engaged. Remove the redundant lock acquisition from both rx helper functions.
In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hyperv_receive_sub() reads msg->vid_hdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv->recv_buf. The completion path then runs memcpy(hv->init_buf, msg, VMBUS_MAX_PACKET_SIZE), so the consumer that wakes on wait_for_completion_timeout() can read up to 16 KiB of residue from a prior message as if it were the response payload. Pass bytes_recvd into hyperv_receive_sub() and reject any packet that does not cover the pipe + synthvid header. A single switch on msg->vid_hdr.type then computes the type-specific payload size: the three completion-driving types (SYNTHVID_VERSION_RESPONSE, SYNTHVID_RESOLUTION_RESPONSE, SYNTHVID_VRAM_LOCATION_ACK) fall through to a shared exit that requires that size before memcpy/complete, while SYNTHVID_FEATURE_CHANGE validates its own payload and returns before reading is_dirt_needed. Unknown types are dropped. SYNTHVID_RESOLUTION_RESPONSE is variable length: the host fills resolution_count entries, not the full SYNTHVID_MAX_RESOLUTION_COUNT array. Validate the fixed prefix first so resolution_count can be read, bound it against the array, then require only the count-sized array, so the shorter responses the host actually sends are accepted. Only run the sub-handler when vmbus_recvpacket() returned success. The memcpy length is bytes_recvd, which is bounded by VMBUS_MAX_PACKET_SIZE only on a successful receive; on -ENOBUFS vmbus_recvpacket() instead reports the required length, which can exceed hv->recv_buf, so copying bytes_recvd would read and write past the 16 KiB buffers. Gating on the success return keeps the copy bounded. The nonzero-return path is itself a malformed-message case and is now logged rather than silently skipped; channel recovery is not attempted. Rejected packets are reported via drm_err_ratelimited() rather than silently dropped, matching the CoCo-hardened pattern in hv_kvp_onchannelcallback().
In the Linux kernel, the following vulnerability has been resolved: ethtool: tsconfig: fix missing ethnl_ops_complete() tsconfig_prepare_data() calls ethnl_ops_begin(), we need to call ethnl_ops_complete() before returning the error.
In the Linux kernel, the following vulnerability has been resolved: xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit The struct pernet_operations docstring in include/net/net_namespace.h explicitly warns against blocking RCU primitives in .exit handlers: Exit methods using blocking RCU primitives, such as synchronize_rcu(), should be implemented via exit_batch. [...] Please, avoid synchronize_rcu() at all, where it's possible. Note that a combination of pre_exit() and exit() can be used, since a synchronize_rcu() is guaranteed between the calls. xfrm_policy_fini() violates this: it calls synchronize_rcu() before freeing the policy_bydst hash tables (so no RCU reader is mid- traversal at free time), but runs from xfrm_net_ops.exit -- once per namespace -- so a cleanup_net() of N namespaces pays N full RCU grace periods serially. Use the documented pre_exit/exit split. Move the policy flush (and the workqueue drains it depends on) into a new .pre_exit handler; xfrm_policy_fini() then runs in .exit and frees the hash tables after the synchronize_rcu_expedited() that cleanup_net() guarantees between the two phases. Providing O(1) RCU grace periods per batch instead of O(N). Observed on Linux 6.18 with a workload doing unshare(CLONE_NEWNET) at ~13/sec sustained: cleanup_net() and the netns_wq rescuer kthread both stuck in xfrm_policy_fini()'s synchronize_rcu(), >300k struct net accumulated in the cleanup queue, Percpu in /proc/meminfo climbed to 130+ GB on 256-CPU hosts, and memcg OOMs followed. setup_net and __put_net counts were balanced, ruling out a refcount leak.
In the Linux kernel, the following vulnerability has been resolved: pinctrl: meson: amlogic-a4: fix deadlock issue Accessing the pinconf-pins sysfs node may deadlock. pinconf_pins_show() holds pctldev->mutex, and the platform driver calls pinctrl_find_gpio_range_from_pin(), which tries to acquire the same mutex again, leading to a deadlock. Use pinctrl_find_gpio_range_from_pin_nolock() to fix this issue.
In the Linux kernel, the following vulnerability has been resolved: drm/xe/gsc: Fix double-free of managed BO in error path The error path in xe_gsc_init_post_hwconfig() explicitly frees a BO allocated with xe_managed_bo_create_pin_map() via xe_bo_unpin_map_no_vm(). Since the managed BO already has a devm cleanup action registered, this causes a double-free when devm unwinds during probe failure. Remove the explicit free and let devm handle it, consistent with all other xe_managed_bo_create_pin_map() callers. (cherry picked from commit 71d61e3e299a17139e47f980a4d6f425b2c59bf7)
In the Linux kernel, the following vulnerability has been resolved: userfaultfd: gate must_wait writability check on pte_present() userfaultfd_must_wait() and userfaultfd_huge_must_wait() read the PTE without taking the page table lock and then apply pte_write() / huge_pte_write() to it. Those accessors decode bits from the present encoding only; on a swap or migration entry they read the offset bits that happen to share the same position and return an undefined result. The intent of the check is "is this fault still WP-blocked?". A non-marker swap entry means the page is in transit -- the userfault context the original fault delivered against is no longer the same, and the swap-in or migration completion path will re-deliver a fresh fault if userspace still needs to handle it. Worst case under the current code the garbage write bit says "wait", and the thread stays asleep until a UFFDIO_WAKE that may never arrive. Gate the writability check on pte_present() so the lockless re-check only inspects present-PTE bits when the entry is actually present. The non-present, non-marker case returns "don't wait" and lets the fault path retry.
In the Linux kernel, the following vulnerability has been resolved: rust: block: fix GenDisk cleanup paths GenDiskBuilder::build() still has fallible work after __blk_mq_alloc_disk(), but its error path only recovers the foreign queue data. That leaks the temporary gendisk and request_queue until later teardown. If the caller moved the last Arc<TagSet<T>> into build(), the leaked queue can retain blk-mq state after the tag set is dropped. Fix the pre-registration failure path by dropping the temporary gendisk reference with put_disk() before recovering queue_data, so disk_release() can tear down the owned queue. Also pair GenDisk::drop() with put_disk() after del_gendisk(). Once a Rust GenDisk has been added with device_add_disk(), del_gendisk() only unregisters it; the final gendisk reference still has to be dropped to complete the release path.
In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is written into space that a previous program occupied, an indirect jump into the new program can reuse a branch prediction left behind by the old one. Flush the indirect branch predictors before reusing JIT memory so that indirect jumps into a newly written program don't reuse predictions from an old program that occupied the same space. Introduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush static call for flushing the branch predictors on JIT memory reuse. Architectures that need a flush, can update it to a predictor flush function. By default, its a NOP and does not emit any CALL. Allocations larger than a pack are not covered by this flush. That is safe because cBPF programs (the unprivileged attack surface) are bounded well below a pack size. Issue a warning if this assumption is ever violated while the flush is active.
In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Enable IBPB flush on BPF JIT allocation Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip enabling the IBPB flush if the BPF dispatcher is already using a retpoline sequence. This hardening applies only when BPF-JIT is in use. Guard the enabling under CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n.
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: correct drop logic for malformed AMPDU frames The previous commit aims to fix issue caused by malformed AMPDU frames. But the drop logic fails to deal with the first AMPDU packet paired with certain range of sequence number, and leads to unexpected packet drop. It is more likely to encounter this failure when there are busy traffic during rekey process and could lead to disconnection from the AP. Fix this by adding a initial state judgement and only reset status during pairwise rekey.
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check for header Add a length check for the rndis header in rndis_rm_hdr, to ensure that MessageType, MessageLength, DataOffset, and DataLength fields are present before they are accessed.
In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error kxsd9_write_raw() takes a runtime PM reference with pm_runtime_get_sync() but returns -EINVAL directly when a scale with a non-zero integer part is requested, skipping the matching pm_runtime_put_autosuspend(). This leaks a runtime PM usage-counter reference on every such write, after which the device can no longer autosuspend. Set the error code and fall through to the existing put instead of returning early.
In the Linux kernel, the following vulnerability has been resolved: iio: adc: lpc32xx: Initialize completion before requesting IRQ In the report from Jaeyoung Chung: "lpc32xx_adc_probe() in drivers/iio/adc/lpc32xx_adc.c registers its interrupt handler with devm_request_irq() before it initializes st->completion with init_completion(). If an interrupt arrives after devm_request_irq() and before init_completion(), the handler calls complete() on an uninitialized completion, causing a kernel panic. The probe path, in lpc32xx_adc_probe(): iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */ ... retval = devm_request_irq(&pdev->dev, irq, lpc32xx_adc_isr, 0, LPC32XXAD_NAME, st); /* register handler */ ... init_completion(&st->completion); /* initialize completion */ lpc32xx_adc_isr() calls complete(): complete(&st->completion); If the device raises an interrupt before init_completion() runs, complete() acquires the uninitialized wait.lock and walks the zeroed task_list in swake_up_locked(). The zeroed task_list makes list_empty() return false, so swake_up_locked() dereferences a NULL list entry, triggering a KASAN wild-memory-access." Fix the chance of a spurious IRQ causing an uninitialized pointer dereference by moving init_completion() above devm_request_irq().
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1119: fix PM reference leak in buffer preenable ads1119_triggered_buffer_preenable() resumes the device with pm_runtime_resume_and_get() before starting a conversion. If i2c_smbus_write_byte() fails, the function returns the error directly and leaves the runtime PM usage counter elevated. The matching postdisable callback is not called when preenable fails, so the reference is leaked and the device may remain runtime-active indefinitely. Store the I2C transfer result in ret and drop the runtime PM reference on failure before returning the error.
In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: free scan_mask on buffer release The scan_mask lifetime changed in commit 9a2e1233d38c ("iio: buffer: hw-consumer: remove redundant scan_mask flexible array"). Before that change, the scan mask storage was embedded in struct hw_consumer_buffer, so iio_hw_buf_release() could free the whole allocation with a single kfree(hw_buf). That commit moved the scan mask to a separate bitmap_zalloc() allocation stored in buffer.scan_mask, but left iio_hw_buf_release() unchanged. Free the scan mask in iio_hw_buf_release() before freeing the buffer wrapper.
In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Include linux/bitfield.h for FIELD_GET(). Create new macros for bit manipulation in combination with manual bit manipulation being replaced with FIELD_GET(). The current variable declaration and initializations are barely readable and use comma separations across multiple lines. Refactor the initializations so that mantissa and exp have separate declarations and sign gets initialized later. In addition (and due to the nature of the cleanup), fix a sign-extension bug where, float32 would get bitwise anded with ~BIT(31) (which is 0xFFFFFFFF7FFFFFFF) which corrupted the exponent.
In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: fix runtime PM leak on read error gp2ap002_read_raw() calls pm_runtime_get_sync() before reading the lux value, but if gp2ap002_get_lux() fails, it returns directly. This skips the pm_runtime_put_autosuspend() call at the "out" label, permanently leaking a runtime PM reference and preventing the device from autosuspending. Replace the direct return with a "goto out" to ensure the reference is properly dropped on the error path.
In the Linux kernel, the following vulnerability has been resolved: iio: pressure: mpl115: fix runtime PM leak on read error mpl115_read_raw() takes a runtime PM reference with pm_runtime_get_sync() before reading the processed pressure or raw temperature, but on the read error path it returns without calling pm_runtime_put_autosuspend(). Each failed read therefore leaks a runtime PM reference and prevents the device from autosuspending. Drop the reference before checking the return value so both the success and error paths are balanced.
In the Linux kernel, the following vulnerability has been resolved: iio: temperature: tmp006: use devm_iio_trigger_register tmp006_probe() allocates the DRDY trigger with devm_iio_trigger_alloc() but registers it with plain iio_trigger_register(). The driver has no .remove() callback, so on module unload the trigger stays in the global trigger list while its memory is freed by devm, leaving a dangling entry. Switch to devm_iio_trigger_register() so the registration is undone in the same devm scope as the allocation.
In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: us144mkii: fix work UAF on disconnect tascam_disconnect() cancels capture_work and midi_in_work before usb_kill_anchored_urbs() kills the capture/MIDI-in URBs. Those URBs self-resubmit, and their completion handlers reschedule the work. A URB that completes in the small window between cancel_work_sync() and usb_kill_anchored_urbs() therefore re-arms the work after its only cancel. Nothing cancels it again before snd_card_free() frees the card-private tascam structure, so the work handler then runs on freed memory. Kill the anchored URBs before cancelling the work; once the work is cancelled no remaining URB can complete to re-arm it.
In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire: isight: bound the sample count to the packet payload isight_packet() takes the frame count from the device iso packet and checks it only against the device claimed iso length. count = be32_to_cpu(payload->sample_count); if (likely(count <= (length - 16) / 4)) isight_samples(isight, payload->samples, count); length is the iso header data_length. It can be up to 0xffff. So the gate allows a count up to about 16379. isight_samples() then copies count frames out of payload->samples into the PCM DMA buffer. payload->samples holds only 2 * MAX_FRAMES_PER_PACKET values. The device multiplexes two samples per frame. A count past MAX_FRAMES_PER_PACKET reads past the payload. A count past the buffer size writes past runtime->dma_area. The smallest PCM buffer is larger than MAX_FRAMES_PER_PACKET. Bounding the count to MAX_FRAMES_PER_PACKET keeps both the read and the write in range. A malicious or faulty Apple iSight on the FireWire bus reaches this during a normal capture. Add the MAX_FRAMES_PER_PACKET bound to the gate.
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() snd_seq_event_dup() copies an incoming event into a pool cell and, in the UMP-enabled build, clears the trailing cell->ump.raw.extra word that the memcpy() did not cover. The guard deciding whether to clear it compares the copied size against sizeof(cell->event): memcpy(&cell->ump, event, size); if (size < sizeof(cell->event)) cell->ump.raw.extra = 0; For a legacy (non-UMP) event, size == sizeof(struct snd_seq_event) == sizeof(cell->event), so the condition is false and the extra word keeps stale data. The cell pool is allocated with kvmalloc() (not zeroed) and cells are reused via a free list, so that word holds uninitialised heap or leftover event data. When such a cell is delivered to a UMP client (client->midi_version > 0) that set SNDRV_SEQ_FILTER_NO_CONVERT -- so the legacy event reaches it unconverted -- snd_seq_read() reads it out as the larger struct snd_seq_ump_event and copies the stale word to user space, a 4-byte kernel heap infoleak to an unprivileged /dev/snd/seq client. Compare against sizeof(cell->ump) instead, so the trailing word is zeroed for every event shorter than the UMP cell.
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: avoid kobject path lookup in DualSense match The DualSense jack-detection input handler verifies that a matching input device belongs to the same physical controller by building kobject path strings for both the input device and the USB audio device, then comparing the path prefix. This was observed when a weak physical connection caused the controller to rapidly disconnect and reconnect. During that repeated hotplug, snd_dualsense_ih_match() can run while the controller's USB device is being disconnected. kobject_get_path() walks ancestor kobjects and dereferences their names; if the USB device kobject name is no longer valid, this can fault in strlen(): RIP: 0010:strlen+0x10/0x30 Call Trace: kobject_get_path+0x34/0x150 snd_dualsense_ih_match+0x49/0xd0 [snd_usb_audio] input_register_device+0x566/0x6a0 ps_probe+0xb89/0x1590 [hid_playstation] The same ownership check can be done without building kobject path strings. The input device is parented below the HID device, USB interface and USB device, so walking the input device parent chain and comparing against the mixer USB device preserves the check without dereferencing kobject names during disconnect.
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Latch disable_idle_d3 per device When disable_idle_d3 was introduced in vfio-pci, it directly manipulated the device power state with pci_set_power_state(). There were no refcounts to maintain or balanced operations, we could unconditionally bring the device to D0 and conditionally move it to D3hot. Therefore the module parameter was made writable. Later, in commit c61302aa48f7 ("vfio/pci: Move module parameters to vfio_pci.c"), as part of the vfio-pci-core split, the writable aspect of the module parameter was nullified. The parameter value could still be changed through sysfs, but the vfio-pci driver latched the values into vfio-pci-core globals at module init. Loading the vfio-pci module, or unloading and reloading, with non-default or different values could change the globals relative to existing devices bound to vfio-pci variant drivers. Runtime PM was introduced in commit 7ab5e10eda02 ("vfio/pci: Move the unused device into low power state with runtime PM"), which marks the point where power states became refcounted. PM get and put operations need to be balanced, but the same module operations noted above can change the global variables relative to those devices already bound to vfio-pci variant drivers. This introduces a window where PM operations can now become unbalanced. To resolve this with a narrow footprint for stable backports, the disable_idle_d3 flag is latched into the vfio_pci_core_device at the time of initialization, such that the device always operates with a consistent value. NB. vfio_pci_dev_set_try_reset() now unconditionally raises the runtime PM usage count around bus reset to account for disable_idle_d3 becoming a per-device rather than global flag. When this flag is set, the additional get/put pair is harmless and allows continued use of the shared vfio_pci_dev_set_pm_runtime_get() helper.
In the Linux kernel, the following vulnerability has been resolved: vfio: Remove device debugfs before releasing devres VFIO device debugfs files created with debugfs_create_devm_seqfile() store a devres allocated debugfs_devm_entry as inode private data. vfio_unregister_group_dev() currently calls vfio_device_del() before vfio_device_debugfs_exit(), but device_del() releases devres. This can leave debugfs entries visible with stale inode private data while unregister waits for userspace references to drain. Remove the per-device debugfs tree before vfio_device_del(). The debugfs view is diagnostic only, so losing it at the start of unregister is preferable to preserving entries whose backing storage may already have been released. Complete the teardown by clearing the per-device debugfs root after removal. This matches the global debugfs root cleanup and prevents future users from mistaking a removed dentry for a live debugfs tree during the remainder of unregister.
In the Linux kernel, the following vulnerability has been resolved: vfio/mlx5: Fix racy bitfields and tighten struct layout Bitfield operations are not atomic, they use a read-modify-write pattern, therefore we should be careful not to pack bitfields that can be concurrently updated into the same storage unit. This split takes a binary approach: flags that are only modified pre/post open/close remain bitfields, flags modified from user action, including actions that reach across to another device (ex. reset) use dedicated storage units. Note mlx5_vhca_page_tracker.status is relocated to fill the alignment hole this split exposes. Bitfield justifications: migrate_cap: written only in mlx5vf_cmd_set_migratable() at probe chunk_mode: written only in mlx5vf_cmd_set_migratable() at probe mig_state_cap: written only in mlx5vf_cmd_set_migratable() at probe Dedicated storage units: mdev_detach: written in the VF attach/detach event notifier mlx5fv_vf_event() at runtime log_active: written in mlx5vf_start_page_tracker()/ mlx5vf_stop_page_tracker() during runtime dirty tracking deferred_reset: written in mlx5vf_state_mutex_unlock()/ mlx5vf_pci_aer_reset_done() during runtime reset handling is_err: set by tracker error handling and dirty-log polling at runtime object_changed: set by tracker event handling and cleared by dirty-log polling at runtime
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free on registration failure Make sure to release the sibling interfaces in case controller registration fails to avoid use-after-free and double-free when they are eventually disconnected. This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free on marvell probe failure Make sure to stop any TX URBs submitted during Marvell OOB wakeup configuration on later probe failures to avoid use-after-free in the completion callback. This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths.
In the Linux kernel, the following vulnerability has been resolved: rust_binder: clear freeze listener on node removal Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. Currently, in this scenario the freeze listener remains in the freeze_listeners rbtree and in the remote node's freeze listener list, even though the ref for which the listener is registered is gone. This could potentially lead to a memory leak due to a refcount cycle. Thus, remove the freeze listener in this scenario.
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix sleep in atomic context in xhci_free_streams() When a USB device with active stream endpoints is disconnected, xhci_free_streams() is called from the hub_event workqueue to free the stream resources. It calls xhci_free_stream_info() while holding xhci->lock with irqs disabled. xhci_free_stream_info() invokes xhci_free_stream_ctx(), which calls dma_free_coherent() for large stream context arrays. dma_free_coherent() can sleep (e.g. via vunmap), triggering a BUG when called from atomic context. Call trace: dma_free_attrs+0x174/0x220 xhci_free_stream_info+0xd0/0x11c xhci_free_streams+0x278/0x37c usb_free_streams+0x98/0xc0 usb_unbind_interface+0x1b8/0x2f8 device_release_driver_internal+0x1d4/0x2cc device_release_driver+0x18/0x28 bus_remove_device+0x160/0x1a4 device_del+0x1ec/0x350 usb_disable_device+0x98/0x214 usb_disconnect+0xf0/0x35c hub_event+0xab4/0x19ec process_one_work+0x278/0x63c Fix this by saving the stream_info pointers and clearing the ep references under the lock, then calling xhci_free_stream_info() outside the lock where sleeping is allowed.
In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: fix ring sg table pages leak xhci_ring_to_sgtable() allocates a temporary pages array and uses it to build the returned sg_table with sg_alloc_table_from_pages(). The error paths free the pages array, but the success path returns the sg_table without freeing it. This leaks the temporary array every time a sideband client gets an endpoint or event ring buffer. Free the pages array after sg_alloc_table_from_pages() succeeds. The returned sg_table has its own scatterlist entries and does not depend on the temporary array after construction.
In the Linux kernel, the following vulnerability has been resolved: PCI: altera: Fix resource leaks on probe failure The chained IRQ handler is set during probe, but is only removed during the driver remove(). If pci_host_probe() fails, the handler and INTx IRQ domain remain set even though the devm-managed host bridge storage containing struct altera_pcie will be released, leaving the handler with a stale data pointer. Interrupts are also enabled before pci_host_probe() is called. If probe fails after that point, the controller interrupt source should be disabled before the chained handler and INTx domain are removed. So set the chained handler only after the INTx domain has been created. Disable controller interrupts during IRQ teardown, and tear the IRQ setup down if pci_host_probe() fails. [mani: commit log]
In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek: Fix IRQ domain leak when port fails to enable When mtk_pcie_enable_port() fails, mtk_pcie_port_free() removes the port from pcie->ports and frees the port structure. However, the IRQ domains set up earlier by mtk_pcie_init_irq_domain() are never freed. Fix this by refactoring mtk_pcie_irq_teardown() into a per-port helper, mtk_pcie_irq_teardown_port(), and calling it from mtk_pcie_setup() when mtk_pcie_enable_port() fails. Since the IRQ teardown must only happen in the probe error path (during resume, child devices may have active MSI mappings and the NOIRQ context prohibits sleeping locks), mtk_pcie_enable_port() is changed to return an error code so callers can distinguish the two paths and act accordingly. This issue was reported by Sashiko while reviewing the EcoNet EN7528 SoC support series.
In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: handle extreme intervals in damon_hot_score() Fix three issues in damon_hot_score() that comes from wrong handling of extreme (zero or too high) monitoring intervals user setup. When the user sets sampling interval zero, damon_max_nr_accesses(), which is called from damon_hot_score(), causes a divide-by-zero. Needless to say, it is a problem. When the user sets the aggregation interval zero, the function returns zero. It is wrong, since the real maximum nr_acceses in the setup should be one. Worse yet, it can cause another divide-by-zero from its caller, damon_hot_score(), since it uses damon_max_nr_accesses() return value as a denominator. When the user sets the aggregation interval very high, damon_hot_score() could return a value out of [0, DAMOS_MAX_SCORE] range. Since the return value is used as an index to the regions_score_histogram array, which is DAMOS_MAX_SCORE+1 size, it causes out of bounds array access. The issues can be relatively easily reproduced like below. The sysfs write permission is required, though. # ./damo start --damos_action lru_prio --damos_quota_space 100M \ --damos_quota_interval 1s # cd /sys/kernel/mm/damon/admin/kdamonds/0 # echo 0 > contexts/0/monitoring_attrs/intervals/sample_us # echo 0 > contexts/0/monitoring_attrs/intervals/aggr_us # echo commit > state # dmesg [...] [ 131.329762] Oops: divide error: 0000 [#1] SMP NOPTI [...] [ 131.336089] RIP: 0010:damon_hot_score+0x27/0xd0 [...] Fix the divide-by-zero intervals problems by explicitly handling the zero intervals in damon_max_nr_accesses(). Fix the out-of-bound array access by applying [0, DAMOS_MAX_SCORE] bounds before returning from damon_hot_score(). The issue was discovered [1] by Sashiko.
In the Linux kernel, the following vulnerability has been resolved: USB: chaoskey: Fix slab-use-after-free in chaoskey_release() The chaoskey driver has a use-after-free bug in its release routine. If the user closes the device file after the USB device has been unplugged, a debugging log statement will try to access the usb_interface structure after it has been deallocated: BUG: KASAN: slab-use-after-free in dev_driver_string (drivers/base/core.c:2406) Read of size 8 at addr ffff888168e8a0b8 by task chaoskey_raw_re/10106 Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:595) dev_driver_string (drivers/base/core.c:2406) __dynamic_dev_dbg (lib/dynamic_debug.c:906) chaoskey_release (drivers/usb/misc/chaoskey.c:323) __fput (fs/file_table.c:510) fput_close_sync (fs/file_table.c:615) __x64_sys_close (fs/open.c:1507 fs/open.c:1492 fs/open.c:1492) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) The driver's last reference to the interface structure is dropped in the chaoskey_free() routine, so the code must not use the interface -- even in a debugging statement -- after that routine returns. (Exception: If we know that another reference is held by someone else, such as the device core while the disconnect routine runs, there's no problem. Thanks to Johan Hovold for pointing this out.) Since the bad access is part of an unimportant debugging statement, we can fix the problem simply by removing the whole statement.
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: run gadget disconnect from sleepable suspend context dwc3_gadget_suspend() takes dwc->lock with IRQs disabled and then calls dwc3_disconnect_gadget(). For async callbacks that helper only uses plain spin_unlock()/spin_lock(), so the gadget ->disconnect() callback still runs with IRQs disabled and any sleepable callback trips Lockdep. This issue was found by our static analysis tool and then manually reviewed against the current tree. The grounded PoC kept the dwc3_gadget_suspend() -> dwc3_disconnect_gadget() -> gadget_driver->disconnect() chain, and Lockdep reported: BUG: sleeping function called from invalid context gadget_disconnect+0x21/0x39 [vuln_msv] dwc3_gadget_suspend.constprop.0+0x2b/0x42 [vuln_msv] Keep the disconnect callback selection in one common helper, but add a sleepable suspend-side wrapper which snapshots the callback under dwc->lock and then runs it after spin_unlock_irqrestore(). The regular event path still uses the existing spin_unlock()/spin_lock() window.
Uninitialized stack memory use in the Linux kernel HFS and HFS+ filesystem drivers allows a local user to crash the kernel by mounting a crafted filesystem image. Two early-exit paths in `hfs_bnode_read()` - an invalid offset check and a corrected-to-zero length - skip the buffer write, while downstream callers such as `hfs_bnode_read_u16()` and `hfs_bnode_read_u8()` consume the uninitialized stack buffer unconditionally, producing KMSAN uninit-value reports and risking kernel panics. Patches are available across multiple stable kernel branches; no public exploit exists and EPSS is very low at 0.22%.
The keyspan_pda USB-serial driver in the Linux kernel transmits kernel memory beyond the tty write buffer to an attached USB device due to an incorrect write() return value introduced with write FIFO support. After commit 034e38e8f687, the driver returns the byte count submitted to the USB device rather than the count accepted from the caller; the TTY line discipline interprets this inflated count as authorization to advance its read pointer past the buffer boundary, exposing adjacent kernel memory. Affected stable trees span Linux 5.15 through 7.1 and the 7.2-rc3 development branch, with patches released across all maintained stable series; no public exploit or active exploitation is confirmed, and EPSS is 0.21% (12th percentile).
Sensitive cryptographic key material handled by the Linux kernel's CAAM (Cryptographic Acceleration and Assurance Module) driver was unconditionally emitted to the kernel ring buffer via unguarded hex-dump calls in *_setkey() and gen_split_key(), exposing raw key bytes to any local user with dmesg access on kernels built with CONFIG_DYNAMIC_DEBUG. The exposure affects NXP CAAM-equipped platforms (i.MX, QorIQ SoC families) running kernel versions from approximately 5.3 through the fix commits across all active stable branches. No public exploit code exists and EPSS probability is 0.22%, but key material disclosure on a crypto-accelerator driver carries genuine confidentiality risk that the vendor-assigned CVSS (C:N/I:N/A:H) incorrectly characterizes - the real primary impact is confidentiality loss, not availability.
Incorrect idmap handling in the Linux kernel memory management subsystem causes `owner_or_capable()` checks inside `mincore()` and `madvise(MADV_PAGEOUT)` to use the identity no-op mount idmap (`nop_mnt_idmap`) rather than the actual mount's idmap, producing incorrect ownership evaluations on idmapped mounts. Local users with low privileges on Linux 5.12+ systems configured with idmapped mounts may trigger incorrect authorization decisions that deny legitimate memory management operations, with the most impactful edge case occurring on 0444 files where neither the idmap check nor the fallback `file_permission(MAY_WRITE)` path succeeds. No public exploit is known and EPSS is 0.21% (11th percentile), reflecting minimal real-world exploitation risk despite the Linux kernel's ubiquitous deployment footprint.
Memory exhaustion in the Linux kernel iommufd subsystem allows a local low-privileged user to crash the system by passing an uncapped veventq_depth value to iommufd_veventq_alloc(), which previously accepted any non-zero integer up to U32_MAX without validation. Exploitation requires local access with low privileges on a system where the iommufd device is accessible, making this primarily a concern for multi-tenant or virtualization hosts. No public exploit has been identified and EPSS at 0.21% (11th percentile) reflects minimal real-world exploitation interest at time of analysis.
Unbounded cache invalidation parameters in the Linux kernel iommufd subsystem allow a local low-privileged user to pin a CPU indefinitely or trigger a soft-lockup watchdog fault, resulting in a kernel denial of service. The iommufd_hwpt_invalidate() ioctl accepts user-supplied entry_len and entry_num values bounded only by U32_MAX, enabling an uninterruptible gigabyte-scale memory scan or a no-reschedule VT-d flush loop. No public exploit has been identified and EPSS stands at 0.21% (11th percentile); the vulnerability is not listed in CISA KEV, indicating low active exploitation pressure.
KVM's SEV-SNP guest initialization path in the Linux kernel can trigger a host kernel panic when processing CPUID data backed by a read-only memory mapping. The flaw affects hypervisors running Linux 7.0.x before 7.1.4 where a local, low-privileged VMM process can cause KVM to write corrected CPUID values into a read-only source page after AMD's trusted firmware rejects the userspace-supplied data. No public exploit has been identified and EPSS sits at 0.20% (10th percentile), consistent with a niche, difficult-to-trigger local denial-of-service condition with no confirmed active exploitation.
KVM arm64 in the Linux kernel leaks a Page Frame Number reference when kvm_translate_vncr() races an MMU notifier, allowing a local low-privileged attacker to gradually exhaust kernel memory and cause a denial of service on affected arm64 hypervisor hosts. The vulnerability is specific to arm64 systems running KVM with VNCR (Virtualization Non-Cached Region) active, and requires precise race-condition timing (AC:H). No public exploit has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) confirms this remains a low-probability exploitation target.
System hang vulnerability in the Linux kernel's NXP i.MX LPI2C driver arises from a race condition during suspend/resume power transitions. Specifically, periodic workqueues in I2C client drivers can fire I2C transfers between the suspend_noirq and resume_noirq phases, when clock and pinctrl resources have already been disabled or are not yet restored. Accessing I2C controller registers in this state causes the system to hang. The fix marks the adapter as suspended during noirq suspend, blocking transfers until hardware resources are fully restored. No public exploit or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Division-by-zero and arithmetic underflow flaws in the Linux kernel's elan_i2c touchpad driver cause kernel panic during device probe on systems equipped with Elan I2C touchpad hardware. When device firmware or device tree supplies zero values for x_traces or y_traces, the driver performs an unguarded integer division by zero, crashing the kernel. A secondary arithmetic underflow causes the input subsystem to report a massively incorrect touch width value to userspace when physical device dimensions fall below a hardcoded threshold. No public exploit exists and EPSS is 0.22% (13th percentile), reflecting the hardware-specific, limited-scope nature of this flaw.
Integer wrap in the FUSE subsystem's prune notification handler crashes 32-bit Linux kernels when a malicious or compromised FUSE daemon sends a crafted FUSE_NOTIFY_PRUNE message. On 32-bit platforms where size_t is 32 bits, multiplying a daemon-controlled count value of 0x20000000 by sizeof(u64) wraps to zero, causing the payload length check to pass with no actual nodeid data present; the subsequent copy loop then triggers a BUG_ON assertion, inducing a kernel panic. No public exploit has been identified at time of analysis and EPSS stands at 0.21% (11th percentile), consistent with the narrow exploitation window of 32-bit-only kernels and requiring FUSE daemon control.
Error-code mishandling in the Linux kernel fuse-uring subsystem causes a failed copy_from_user() in fuse_uring_commit to be silently treated as success, leaving callers processing uninitialized or partial output arguments. Local users with low-privilege access on kernels from 6.14 through pre-patch versions can trigger a kernel panic or crash, yielding a local denial of service. No public exploit has been identified and the EPSS score of 0.21% (11th percentile) indicates no meaningful active exploitation activity at time of analysis.
Resource exhaustion and denial of service in the Linux kernel's fuse-uring subsystem allows a local authenticated user to permanently hang FUSE requests and stall all background filesystem operations for the affected connection. The flaw was introduced with the fuse-uring interface in Linux 6.14 and affects stable series through 6.18.38 and 7.1.3; patched releases 6.18.39, 7.1.4, and mainline 7.2-rc1 are available. No public exploit has been identified at time of analysis (EPSS 0.21%, 11th percentile) and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation.
XFS filesystem quota iteration in the Linux kernel wraps a 32-bit quota ID back to zero when a disk quota entry (dquot) exists at XFS_DQ_ID_MAX, producing an infinite loop and local denial of service. Systems running Linux 6.8 and later with XFS quotas enabled are vulnerable if a dquot is present at the maximum 32-bit ID boundary (0xFFFFFFFF). No active exploitation has been identified; patched releases 6.12.96, 6.18.39, 7.1.4, and 7.2-rc4 are available from the kernel stable tree.
libsoup leaks proxy credentials to destination servers via Proxy-Authorization header attachment after CONNECT tunnel establishment. Affects libsoup when used with HTTP proxies for HTTPS tunneling. No public exploit is known, and exploitation probability is low (EPSS 0.23%).
Heap buffer over-read in libsoup's multipart response parser allows remote, unauthenticated attackers to crash client applications or leak heap memory. The flaw occurs when processing crafted HTTP multipart responses from a malicious server. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability.
Hostname verification missing in Apache Thrift Python TSSLSocket before 0.24.0 enables man-in-the-middle impersonation, allowing interception and manipulation of RPC traffic. This flaw violates TLS certificate hostname matching, effectively letting an attacker with a valid certificate for any domain present as a legitimate server. No active exploitation or public exploit code is known.
Out-of-bounds read vulnerability in the c_glib language bindings of Apache Thrift before 0.24.0 may allow remote attackers to read heap memory contents through crafted Thrift messages. Affected users should upgrade to version 0.24.0. No public exploit or active exploitation has been identified at this time.
Cleartext credential storage in Tycon Systems TPDIN-Monitor-WEB2 web management interface allows authenticated attackers to view system credentials, potentially leading to compromise of other network systems. Affected version is 2.3.9. No active exploitation or public exploit is known, and EPSS indicates a very low probability of exploitation.
Information disclosure in Cloudreve allows any logged-in user to enumerate and harvest email addresses of inactive and banned accounts via the user search API. The `SearchActive` method in v4 and v3 omits the required status filter, exposing basic profile metadata to authenticated attackers. No account credentials are compromised, but the leaked PII enables user enumeration across the platform.
Heap buffer overwrite in ImageMagick's morphology operation when an invalid user-supplied kernel is provided, leading to a denial-of-service condition. This integer overflow flaw (CWE-190) affects ImageMagick versions prior to 7.1.2-27 and the Magick.NET wrapper below 14.15.0. No active exploitation or public proof-of-concept has been identified, and EPSS data is unavailable.
JVM crash and potential in-process memory exposure in lz4-java 1.11.0 and earlier due to insufficient
Heap-buffer-overflow READ in ONNX's Gemm version converter adapter (gemm_7_6.h:41) allows an attacker who can supply a crafted model file to trigger a 16-byte out-of-bounds read when convert_version() downgrades an opset-7 Gemm node whose input tensor B has fewer than 2 dimensions. The vulnerability affects onnx pip package versions 1.3.0 through 1.21.0 and any pipeline that calls onnx.version_converter.convert_version() on untrusted model files. On Release builds the OOB read is silent and the leaked heap bytes propagate into the converted model's output shape metadata, enabling information disclosure; on instrumented builds ASan confirms the 16-byte overread 0 bytes past a 48-byte allocation. No public exploitation confirmed at time of analysis (EPSS 0.17%), though a functional 186-byte PoC is publicly available in the advisory.
Kernel availability degradation in the Linux kernel ntb_hw_epf driver occurs during module teardown when BAR_PEER_SPAD and BAR_CONFIG share a single PCI BAR, causing ntb_epf_pci_remove() to call pci_iounmap() on an offset address that was never independently registered as a vm_area. Systems running Linux 6.0 through at least 6.18.37 with the ntb_hw_epf module loaded under this BAR-sharing configuration will generate a kernel warning ('Trying to vunmap() nonexistent vm area') upon driver removal. No public exploit exists and EPSS probability is 0.16% (6th percentile), consistent with an availability-only defect requiring specific hardware topology and local privilege to trigger.
Shutdown and reboot operations hang indefinitely on LoongArch-based Linux systems due to a missing RCU notification in stop_this_cpu(), exposing multi-CPU LoongArch hosts running affected kernel stable branches to an unrecoverable hang during system halt or reboot. The vulnerable path is triggered when smp_send_stop() parks secondary CPUs without calling rcutree_report_cpu_dead(), after which any irq_work_sync() call in the shutdown sequence invokes synchronize_rcu() - which then blocks forever waiting for quiescent states from CPUs that are permanently parked with interrupts disabled. No public exploit identified at time of analysis; EPSS is 0.16% at the 6th percentile and the CVE is absent from CISA KEV, consistent with this being a reliability defect rather than a security exploitation path.
MIPS SMP systems running affected Linux kernel versions hang indefinitely during reboot or shutdown due to a missing RCU subsystem notification in the stop_this_cpu() shutdown path. When smp_send_stop() parks secondary CPUs, it correctly removes them from the scheduler's view via set_cpu_online(false) but never calls rcutree_report_cpu_dead(), leaving RCU waiting for quiescent states that can never arrive. The defect became reliably triggered after commit 91840be8f710 was backported to stable branches starting with 6.18.34, causing irq_work_sync() to invoke synchronize_rcu() on MIPS systems that lack an irq_work self-IPI, with no public exploit identified at time of analysis.
Improper ordering of resource assignment in the Linux kernel's memory hotplug subsystem causes a spurious WARN_ON during error recovery in __add_memory_block(). When xa_store() fails under memory pressure, device_unregister() is invoked while mem->altmap is already set, triggering memory_block_release() with a non-NULL altmap pointer and producing a kernel warning that can lead to system instability or crash. Affected systems are those running Linux kernel versions from the introduction commit 1a8c64e110435e44e71bcd50a75663174b575f22 through the respective fix commits across the 6.6, 6.12, 6.18, 7.0, and 7.1 stable series; patches are confirmed available. No public exploit has been identified and EPSS stands at 0.16% (6th percentile), consistent with a stability regression rather than an actively targeted security flaw.
Resource leaks and teardown race conditions in the Linux kernel's gpio-rockchip driver expose Rockchip-based systems to kernel panic and memory exhaustion. Three distinct defects exist in the driver's remove path: an unreleased debounce clock reference, a stale chained IRQ handler left registered after driver removal, and an unfreed IRQ domain with its generic chips. The IRQ handler defect is the most severe - if a stray GPIO interrupt arrives after the driver is unbound, the kernel dereferences a stale function pointer and panics. No public exploit identified at time of analysis; EPSS of 0.16% (5th percentile) reflects the niche, hardware-specific exploitation surface.
Incorrect pointer passing in the Linux kernel's igorplugusb infrared USB receiver driver causes the USB core to misinterpret raw pointer bytes as a USB control setup packet, triggering a BOGUS control direction warning and a kernel-level denial of service. The regression was introduced by commit eac69475b01f, which allocated ir->request as a pointer for DMA coherency but left the usb_fill_control_urb() call referencing &ir->request (the pointer variable's address) rather than ir->request (the allocated struct usb_ctrlrequest). No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.17% (6th percentile), reflecting minimal real-world exploitation probability.
Deadlock vulnerability in the Linux kernel's GPIO shared proxy subsystem allows a local, low-privileged user to cause a system hang by triggering removal of a shared GPIO proxy's parent device. The root cause is an overly-wide mutex critical section introduced in commit 710abda58055, where the gpio_shared_entry mutex was held for too long, creating a locking inversion scenario during parent device teardown. No public exploit code exists and no active exploitation has been identified; the fix narrows the critical section to protect only offset reads.
Division-by-zero kernel panic in the Linux kernel's i2c-davinci driver causes a deterministic system crash on TI DaVinci SoC-based hardware when the 'clock-frequency' device tree property is absent. The root cause is a unit mismatch: DAVINCI_I2C_DEFAULT_BUS_FREQ was defined in kHz (100) but the probe path divided it by 1000, producing dev->bus_freq = 0, which then triggers an unconditional divide-by-zero during clock divider calculation. Availability impact is complete (kernel panic), but exploitation requires specific embedded hardware context; no public exploit exists and EPSS is 0.15%, consistent with a reliability defect rather than an adversarially exploitable flaw.
Use-after-free in the Linux kernel USB UVC gadget driver allows a privileged local user to crash the kernel by racing configfs extension-unit teardown against the bind-time list walks in uvc_function_bind(). The bind path walks opts->extension_units without holding opts->lock, while the configfs write path (uvcg_extension_drop) correctly holds the lock, creating an asymmetric locking pattern that enables a freed struct uvcg_extension to be dereferenced. No public exploit exists and EPSS sits at 0.16% (5th percentile), but patches are confirmed across multiple stable kernel branches including 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1.
Out-of-bounds memory access in the Linux kernel's drm/msm DSI display subsystem causes a kernel panic on systems with Qualcomm MSM DSI 6G hardware. The io_offset adjustment applied to the mapped IO base address is not reflected in the ctrl_size value passed to the snapshot dump routine, so msm_disp_snapshot_add_block reads past the end of the mapped region and crashes the kernel. Only devices with Qualcomm MSM DSI 6G display hardware running an unpatched kernel from 5.14 onward are affected; no public exploit exists and EPSS of 0.17% confirms very low exploitation probability.
Kernel denial-of-service in the Linux kernel's device property firmware node subsystem results from fwnode_init() failing to zero the secondary pointer before use, leaving it with uninitialized stack or heap garbage that may be incorrectly treated as a valid pointer and dereferenced in functions such as dev_to_swnode(). Local users with low privileges on any kernel version between the introducing commit and the respective stable patch releases can trigger a kernel panic, causing system downtime. No public exploit code exists and EPSS is 0.17% (7th percentile), reflecting negligible observed exploitation activity.
Missing mutex lock in the Linux kernel lm90 hwmon driver's alert handler creates a race condition that triggers an interrupt storm on systems with LM90-family temperature sensors. When lm90_alert() fires concurrently with a sysfs write operation - both modifying the shared data->config register cache - the sysfs path's restore of data->config silently overwrites the alert handler's hardware-disable flag, re-enabling the alert line while the alarm remains active. The result is uncontrolled interrupt escalation causing system availability impact. No public exploit exists, EPSS is 0.17% (6th percentile), and no KEV listing is present; patched releases 6.18.34, 7.0.11, and 7.1 are available.
Availability loss in the Linux kernel's Tree SRCU (Sleepable Read-Copy-Update) subsystem causes system hangs by queuing workqueue handlers on CPUs that have never been-and may never be-online. Affected kernels spanning commit 61bbcfb50514 through the fix points can attempt to invoke callbacks for CPUs absent from cpu_possible_mask, a condition that is fatal on s390 (IBM mainframe) architectures not hardened to handle such scheduling anomalies. No public exploit code exists and EPSS places exploitation probability at 0.15% (5th percentile), consistent with a stability defect rather than a security attack surface; patches are available in Linux 7.0.11 and 7.1.
Information disclosure in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local attacker with file system access to read secret variable values stored in cleartext on disk. This occurs when the variables feature is used without selecting a vault for encryption. The vulnerability is not known to be actively exploited, and EPSS indicates a very low exploitation probability (0.08%).
OAuth refresh token disclosure in Devolutions PowerShell Universal 2026.2.2 and earlier allows authenticated users with scoped job or script read permission to extract other users' stored refresh tokens from job read API responses. The automation jobs API fails to strip the token before sending it to the client. No active exploitation is reported; EPSS score is low at 0.22%.
Information disclosure in the Keycloak Admin REST API allows a delegated administrator with view-only permissions to retrieve the resolved client secret from a secure vault instead of the vault placeholder, exposing sensitive credentials. Affected Red Hat builds include Keycloak, Single Sign-On 7, Data Grid 8, and JBoss EAP expansion pack. No active exploitation or public exploit is known; EPSS probability is low (0.21%).
Information disclosure in ABIS Technology's AVESİS software allows unauthenticated remote attackers to bypass ACLs and access restricted functionality via manipulated web parameters. Affected versions prior to build 202606251646. Exploitation likelihood is low (EPSS 0.2%), no active exploitation is known, and a vendor patch is available.
A denial-of-service vulnerability in Apache NimBLE’s Mesh Proxy SAR reassembly can be exploited by remote attackers without authentication, causing memory pressure and unstable application behavior. Affected versions include all releases through 1.9.0; a vendor patch is available in version 1.10.0. No active exploitation or public proof-of-concept has been identified, and EPSS indicates a low likelihood of widespread exploitation.
Apache NimBLE 1.9.0 and earlier mishandles multi-report HCI advertising events, potentially leaking heap memory when used with certain third-party Bluetooth controllers. The vulnerability is not under active exploitation and no public exploit code exists.
Information disclosure in Parse Server GraphQL endpoint allows unauthenticated clients to learn names of required custom fields by triggering validation errors, partially bypassing schema hiding when public introspection is disabled. Affects versions 8.2.2 to 8.6.85 and 9.0.0 to 9.9.x; patched in 8.6.86 and 9.10.0-alpha.5. No active exploitation or public exploit code identified.
Information disclosure in Parse Server GraphQL error messages exposes hidden schema class names to unauthenticated attackers when public schema introspection is disabled. Affects versions 9.0.0 before 9.10.0-alpha.6 and 8.2.2 before 8.6.87. Only class names are disclosed, not object data; no public exploit or active exploitation identified.
Denial of service in dbus-broker allows a local attacker to crash the user session bus broker when file descriptor limits are exhausted. Affected products include Red Hat Enterprise Linux 9/10, Red Hat OpenShift Container Platform 4, and Red Hat Hardened Images where dbus-broker is deployed. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability (0.11%).
Out-of-bounds read in GNU coreutils uniq allows attackers with crafted multibyte input and the -w option to crash the utility and potentially leak adjacent heap memory. Affects versions 9.5 through 9.11. No active exploitation or public exploit code is known, but a patch exists.
Unauthenticated record takeover in the Participants Database WordPress plugin (all versions ≤ 2.7.8.3) allows any remote attacker to overwrite arbitrary participant records by guessing or enumerating numeric IDs, redirect the private-access link to an attacker-controlled email, and achieve full read and edit access to victim PII including names, email addresses, and phone numbers. The attack requires no credentials - a valid nonce is freely obtainable via a plain GET request to any public page rendering the plugin's signup or record form. No CISA KEV listing or public exploit code has been identified at time of analysis, but the zero-authentication, low-complexity attack path is trivially scriptable at scale.
Microsoft Graph exposes sensitive information to authenticated network attackers through an information disclosure flaw classified under CWE-200. Any attacker holding a valid low-privilege credential can query the Microsoft Graph API over the network to retrieve data they should not have access to, without requiring additional user interaction or elevated rights. No active exploitation is confirmed (not in CISA KEV), and Microsoft has released an official fix; however, the high confidentiality impact and low attack complexity make this a meaningful risk for any organization relying on Microsoft 365 services.
Unauthenticated network asset discovery exposure in Pronetiqs IntraVUE (formerly Panduit IntraVUE) versions 3.2.1a14 and prior allows remote unauthenticated attackers to enumerate sensitive system and network asset information via the application interface. In industrial control system (ICS) and OT environments where IntraVUE is typically deployed, the disclosed asset inventory - including device types, IP addresses, and network topology - provides adversaries with reconnaissance data directly applicable to follow-on ICS-targeted attacks. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Arbitrary constructor injection in React Router's SSR hydration deserializer (deserializeErrors()) affects npm/react-router versions 6.4.0 through 7.17.x when used in Framework Mode or Data Mode with manual SSR/hydration. When application code permits attacker-supplied input to overwrite the __type or __subType fields embedded in server-side serialized error objects, the client-side hydration process can be manipulated into instantiating arbitrary constructors available on the global window object, triggering unintended outbound network requests from the victim's browser. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available in version 7.18.0.
Information disclosure in perwendel Spark (SparkJava) up to version 2.9.4 via symlink following in the staticFiles.externalLocation method allows remote attackers with low privileges to read arbitrary files from the server. Publicly available exploit code exists, but no active exploitation or CISA KEV listing has been confirmed. The project maintainer has not yet responded to the issue report.
Information disclosure in mf-yang openclaw-cn up to version 0.2.1 allows remote authenticated attackers with low privileges to leak sensitive data by supplying a crafted URL to the scheme handler. Public exploit code is available, though no active exploitation has been confirmed by CISA KEV.
Memory exhaustion in ImageMagick's magick CLI tool allows a local attacker to cause denial of service by repeatedly supplying malformed command-line arguments. Affects versions before 7.1.2-27. Vendor patch is available; no public exploit or active exploitation reported.
In the Linux kernel, the following vulnerability has been resolved: tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Sashiko identified a deadlock when the console flow is engaged [1]. When console flow control is enabled (UPF_CONS_FLOW), s3c24xx_serial_stop_tx() calls s3c24xx_serial_rx_enable() and s3c24xx_serial_start_tx() calls s3c24xx_serial_rx_disable(). The serial core framework invokes the .stop_tx() and .start_tx() callbacks with the port->lock spinlock already held. Furthermore, all internal driver paths that invoke stop_tx (such as the DMA TX completion handler s3c24xx_serial_tx_dma_complete() or the PIO TX IRQ handler s3c24xx_serial_tx_irq()) also acquire port->lock prior to calling it. (Note that s3c24xx_serial_start_tx() is only invoked by the serial core). However, s3c24xx_serial_rx_enable() and s3c24xx_serial_rx_disable() unconditionally attempt to acquire port->lock again using uart_port_lock_irqsave(). Since spinlocks are not recursive, this causes a deadlock on the same CPU when console flow control is engaged. Remove the redundant lock acquisition from both rx helper functions.
In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hyperv_receive_sub() reads msg->vid_hdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv->recv_buf. The completion path then runs memcpy(hv->init_buf, msg, VMBUS_MAX_PACKET_SIZE), so the consumer that wakes on wait_for_completion_timeout() can read up to 16 KiB of residue from a prior message as if it were the response payload. Pass bytes_recvd into hyperv_receive_sub() and reject any packet that does not cover the pipe + synthvid header. A single switch on msg->vid_hdr.type then computes the type-specific payload size: the three completion-driving types (SYNTHVID_VERSION_RESPONSE, SYNTHVID_RESOLUTION_RESPONSE, SYNTHVID_VRAM_LOCATION_ACK) fall through to a shared exit that requires that size before memcpy/complete, while SYNTHVID_FEATURE_CHANGE validates its own payload and returns before reading is_dirt_needed. Unknown types are dropped. SYNTHVID_RESOLUTION_RESPONSE is variable length: the host fills resolution_count entries, not the full SYNTHVID_MAX_RESOLUTION_COUNT array. Validate the fixed prefix first so resolution_count can be read, bound it against the array, then require only the count-sized array, so the shorter responses the host actually sends are accepted. Only run the sub-handler when vmbus_recvpacket() returned success. The memcpy length is bytes_recvd, which is bounded by VMBUS_MAX_PACKET_SIZE only on a successful receive; on -ENOBUFS vmbus_recvpacket() instead reports the required length, which can exceed hv->recv_buf, so copying bytes_recvd would read and write past the 16 KiB buffers. Gating on the success return keeps the copy bounded. The nonzero-return path is itself a malformed-message case and is now logged rather than silently skipped; channel recovery is not attempted. Rejected packets are reported via drm_err_ratelimited() rather than silently dropped, matching the CoCo-hardened pattern in hv_kvp_onchannelcallback().
In the Linux kernel, the following vulnerability has been resolved: ethtool: tsconfig: fix missing ethnl_ops_complete() tsconfig_prepare_data() calls ethnl_ops_begin(), we need to call ethnl_ops_complete() before returning the error.
In the Linux kernel, the following vulnerability has been resolved: xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit The struct pernet_operations docstring in include/net/net_namespace.h explicitly warns against blocking RCU primitives in .exit handlers: Exit methods using blocking RCU primitives, such as synchronize_rcu(), should be implemented via exit_batch. [...] Please, avoid synchronize_rcu() at all, where it's possible. Note that a combination of pre_exit() and exit() can be used, since a synchronize_rcu() is guaranteed between the calls. xfrm_policy_fini() violates this: it calls synchronize_rcu() before freeing the policy_bydst hash tables (so no RCU reader is mid- traversal at free time), but runs from xfrm_net_ops.exit -- once per namespace -- so a cleanup_net() of N namespaces pays N full RCU grace periods serially. Use the documented pre_exit/exit split. Move the policy flush (and the workqueue drains it depends on) into a new .pre_exit handler; xfrm_policy_fini() then runs in .exit and frees the hash tables after the synchronize_rcu_expedited() that cleanup_net() guarantees between the two phases. Providing O(1) RCU grace periods per batch instead of O(N). Observed on Linux 6.18 with a workload doing unshare(CLONE_NEWNET) at ~13/sec sustained: cleanup_net() and the netns_wq rescuer kthread both stuck in xfrm_policy_fini()'s synchronize_rcu(), >300k struct net accumulated in the cleanup queue, Percpu in /proc/meminfo climbed to 130+ GB on 256-CPU hosts, and memcg OOMs followed. setup_net and __put_net counts were balanced, ruling out a refcount leak.
In the Linux kernel, the following vulnerability has been resolved: pinctrl: meson: amlogic-a4: fix deadlock issue Accessing the pinconf-pins sysfs node may deadlock. pinconf_pins_show() holds pctldev->mutex, and the platform driver calls pinctrl_find_gpio_range_from_pin(), which tries to acquire the same mutex again, leading to a deadlock. Use pinctrl_find_gpio_range_from_pin_nolock() to fix this issue.
In the Linux kernel, the following vulnerability has been resolved: drm/xe/gsc: Fix double-free of managed BO in error path The error path in xe_gsc_init_post_hwconfig() explicitly frees a BO allocated with xe_managed_bo_create_pin_map() via xe_bo_unpin_map_no_vm(). Since the managed BO already has a devm cleanup action registered, this causes a double-free when devm unwinds during probe failure. Remove the explicit free and let devm handle it, consistent with all other xe_managed_bo_create_pin_map() callers. (cherry picked from commit 71d61e3e299a17139e47f980a4d6f425b2c59bf7)
In the Linux kernel, the following vulnerability has been resolved: userfaultfd: gate must_wait writability check on pte_present() userfaultfd_must_wait() and userfaultfd_huge_must_wait() read the PTE without taking the page table lock and then apply pte_write() / huge_pte_write() to it. Those accessors decode bits from the present encoding only; on a swap or migration entry they read the offset bits that happen to share the same position and return an undefined result. The intent of the check is "is this fault still WP-blocked?". A non-marker swap entry means the page is in transit -- the userfault context the original fault delivered against is no longer the same, and the swap-in or migration completion path will re-deliver a fresh fault if userspace still needs to handle it. Worst case under the current code the garbage write bit says "wait", and the thread stays asleep until a UFFDIO_WAKE that may never arrive. Gate the writability check on pte_present() so the lockless re-check only inspects present-PTE bits when the entry is actually present. The non-present, non-marker case returns "don't wait" and lets the fault path retry.
In the Linux kernel, the following vulnerability has been resolved: rust: block: fix GenDisk cleanup paths GenDiskBuilder::build() still has fallible work after __blk_mq_alloc_disk(), but its error path only recovers the foreign queue data. That leaks the temporary gendisk and request_queue until later teardown. If the caller moved the last Arc<TagSet<T>> into build(), the leaked queue can retain blk-mq state after the tag set is dropped. Fix the pre-registration failure path by dropping the temporary gendisk reference with put_disk() before recovering queue_data, so disk_release() can tear down the owned queue. Also pair GenDisk::drop() with put_disk() after del_gendisk(). Once a Rust GenDisk has been added with device_add_disk(), del_gendisk() only unregisters it; the final gendisk reference still has to be dropped to complete the release path.
In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is written into space that a previous program occupied, an indirect jump into the new program can reuse a branch prediction left behind by the old one. Flush the indirect branch predictors before reusing JIT memory so that indirect jumps into a newly written program don't reuse predictions from an old program that occupied the same space. Introduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush static call for flushing the branch predictors on JIT memory reuse. Architectures that need a flush, can update it to a predictor flush function. By default, its a NOP and does not emit any CALL. Allocations larger than a pack are not covered by this flush. That is safe because cBPF programs (the unprivileged attack surface) are bounded well below a pack size. Issue a warning if this assumption is ever violated while the flush is active.
In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Enable IBPB flush on BPF JIT allocation Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip enabling the IBPB flush if the BPF dispatcher is already using a retpoline sequence. This hardening applies only when BPF-JIT is in use. Guard the enabling under CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n.
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: correct drop logic for malformed AMPDU frames The previous commit aims to fix issue caused by malformed AMPDU frames. But the drop logic fails to deal with the first AMPDU packet paired with certain range of sequence number, and leads to unexpected packet drop. It is more likely to encounter this failure when there are busy traffic during rekey process and could lead to disconnection from the AP. Fix this by adding a initial state judgement and only reset status during pairwise rekey.
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check for header Add a length check for the rndis header in rndis_rm_hdr, to ensure that MessageType, MessageLength, DataOffset, and DataLength fields are present before they are accessed.
In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error kxsd9_write_raw() takes a runtime PM reference with pm_runtime_get_sync() but returns -EINVAL directly when a scale with a non-zero integer part is requested, skipping the matching pm_runtime_put_autosuspend(). This leaks a runtime PM usage-counter reference on every such write, after which the device can no longer autosuspend. Set the error code and fall through to the existing put instead of returning early.
In the Linux kernel, the following vulnerability has been resolved: iio: adc: lpc32xx: Initialize completion before requesting IRQ In the report from Jaeyoung Chung: "lpc32xx_adc_probe() in drivers/iio/adc/lpc32xx_adc.c registers its interrupt handler with devm_request_irq() before it initializes st->completion with init_completion(). If an interrupt arrives after devm_request_irq() and before init_completion(), the handler calls complete() on an uninitialized completion, causing a kernel panic. The probe path, in lpc32xx_adc_probe(): iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */ ... retval = devm_request_irq(&pdev->dev, irq, lpc32xx_adc_isr, 0, LPC32XXAD_NAME, st); /* register handler */ ... init_completion(&st->completion); /* initialize completion */ lpc32xx_adc_isr() calls complete(): complete(&st->completion); If the device raises an interrupt before init_completion() runs, complete() acquires the uninitialized wait.lock and walks the zeroed task_list in swake_up_locked(). The zeroed task_list makes list_empty() return false, so swake_up_locked() dereferences a NULL list entry, triggering a KASAN wild-memory-access." Fix the chance of a spurious IRQ causing an uninitialized pointer dereference by moving init_completion() above devm_request_irq().
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1119: fix PM reference leak in buffer preenable ads1119_triggered_buffer_preenable() resumes the device with pm_runtime_resume_and_get() before starting a conversion. If i2c_smbus_write_byte() fails, the function returns the error directly and leaves the runtime PM usage counter elevated. The matching postdisable callback is not called when preenable fails, so the reference is leaked and the device may remain runtime-active indefinitely. Store the I2C transfer result in ret and drop the runtime PM reference on failure before returning the error.
In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: free scan_mask on buffer release The scan_mask lifetime changed in commit 9a2e1233d38c ("iio: buffer: hw-consumer: remove redundant scan_mask flexible array"). Before that change, the scan mask storage was embedded in struct hw_consumer_buffer, so iio_hw_buf_release() could free the whole allocation with a single kfree(hw_buf). That commit moved the scan mask to a separate bitmap_zalloc() allocation stored in buffer.scan_mask, but left iio_hw_buf_release() unchanged. Free the scan mask in iio_hw_buf_release() before freeing the buffer wrapper.
In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Include linux/bitfield.h for FIELD_GET(). Create new macros for bit manipulation in combination with manual bit manipulation being replaced with FIELD_GET(). The current variable declaration and initializations are barely readable and use comma separations across multiple lines. Refactor the initializations so that mantissa and exp have separate declarations and sign gets initialized later. In addition (and due to the nature of the cleanup), fix a sign-extension bug where, float32 would get bitwise anded with ~BIT(31) (which is 0xFFFFFFFF7FFFFFFF) which corrupted the exponent.
In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: fix runtime PM leak on read error gp2ap002_read_raw() calls pm_runtime_get_sync() before reading the lux value, but if gp2ap002_get_lux() fails, it returns directly. This skips the pm_runtime_put_autosuspend() call at the "out" label, permanently leaking a runtime PM reference and preventing the device from autosuspending. Replace the direct return with a "goto out" to ensure the reference is properly dropped on the error path.
In the Linux kernel, the following vulnerability has been resolved: iio: pressure: mpl115: fix runtime PM leak on read error mpl115_read_raw() takes a runtime PM reference with pm_runtime_get_sync() before reading the processed pressure or raw temperature, but on the read error path it returns without calling pm_runtime_put_autosuspend(). Each failed read therefore leaks a runtime PM reference and prevents the device from autosuspending. Drop the reference before checking the return value so both the success and error paths are balanced.
In the Linux kernel, the following vulnerability has been resolved: iio: temperature: tmp006: use devm_iio_trigger_register tmp006_probe() allocates the DRDY trigger with devm_iio_trigger_alloc() but registers it with plain iio_trigger_register(). The driver has no .remove() callback, so on module unload the trigger stays in the global trigger list while its memory is freed by devm, leaving a dangling entry. Switch to devm_iio_trigger_register() so the registration is undone in the same devm scope as the allocation.
In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: us144mkii: fix work UAF on disconnect tascam_disconnect() cancels capture_work and midi_in_work before usb_kill_anchored_urbs() kills the capture/MIDI-in URBs. Those URBs self-resubmit, and their completion handlers reschedule the work. A URB that completes in the small window between cancel_work_sync() and usb_kill_anchored_urbs() therefore re-arms the work after its only cancel. Nothing cancels it again before snd_card_free() frees the card-private tascam structure, so the work handler then runs on freed memory. Kill the anchored URBs before cancelling the work; once the work is cancelled no remaining URB can complete to re-arm it.
In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire: isight: bound the sample count to the packet payload isight_packet() takes the frame count from the device iso packet and checks it only against the device claimed iso length. count = be32_to_cpu(payload->sample_count); if (likely(count <= (length - 16) / 4)) isight_samples(isight, payload->samples, count); length is the iso header data_length. It can be up to 0xffff. So the gate allows a count up to about 16379. isight_samples() then copies count frames out of payload->samples into the PCM DMA buffer. payload->samples holds only 2 * MAX_FRAMES_PER_PACKET values. The device multiplexes two samples per frame. A count past MAX_FRAMES_PER_PACKET reads past the payload. A count past the buffer size writes past runtime->dma_area. The smallest PCM buffer is larger than MAX_FRAMES_PER_PACKET. Bounding the count to MAX_FRAMES_PER_PACKET keeps both the read and the write in range. A malicious or faulty Apple iSight on the FireWire bus reaches this during a normal capture. Add the MAX_FRAMES_PER_PACKET bound to the gate.
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() snd_seq_event_dup() copies an incoming event into a pool cell and, in the UMP-enabled build, clears the trailing cell->ump.raw.extra word that the memcpy() did not cover. The guard deciding whether to clear it compares the copied size against sizeof(cell->event): memcpy(&cell->ump, event, size); if (size < sizeof(cell->event)) cell->ump.raw.extra = 0; For a legacy (non-UMP) event, size == sizeof(struct snd_seq_event) == sizeof(cell->event), so the condition is false and the extra word keeps stale data. The cell pool is allocated with kvmalloc() (not zeroed) and cells are reused via a free list, so that word holds uninitialised heap or leftover event data. When such a cell is delivered to a UMP client (client->midi_version > 0) that set SNDRV_SEQ_FILTER_NO_CONVERT -- so the legacy event reaches it unconverted -- snd_seq_read() reads it out as the larger struct snd_seq_ump_event and copies the stale word to user space, a 4-byte kernel heap infoleak to an unprivileged /dev/snd/seq client. Compare against sizeof(cell->ump) instead, so the trailing word is zeroed for every event shorter than the UMP cell.
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: avoid kobject path lookup in DualSense match The DualSense jack-detection input handler verifies that a matching input device belongs to the same physical controller by building kobject path strings for both the input device and the USB audio device, then comparing the path prefix. This was observed when a weak physical connection caused the controller to rapidly disconnect and reconnect. During that repeated hotplug, snd_dualsense_ih_match() can run while the controller's USB device is being disconnected. kobject_get_path() walks ancestor kobjects and dereferences their names; if the USB device kobject name is no longer valid, this can fault in strlen(): RIP: 0010:strlen+0x10/0x30 Call Trace: kobject_get_path+0x34/0x150 snd_dualsense_ih_match+0x49/0xd0 [snd_usb_audio] input_register_device+0x566/0x6a0 ps_probe+0xb89/0x1590 [hid_playstation] The same ownership check can be done without building kobject path strings. The input device is parented below the HID device, USB interface and USB device, so walking the input device parent chain and comparing against the mixer USB device preserves the check without dereferencing kobject names during disconnect.
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Latch disable_idle_d3 per device When disable_idle_d3 was introduced in vfio-pci, it directly manipulated the device power state with pci_set_power_state(). There were no refcounts to maintain or balanced operations, we could unconditionally bring the device to D0 and conditionally move it to D3hot. Therefore the module parameter was made writable. Later, in commit c61302aa48f7 ("vfio/pci: Move module parameters to vfio_pci.c"), as part of the vfio-pci-core split, the writable aspect of the module parameter was nullified. The parameter value could still be changed through sysfs, but the vfio-pci driver latched the values into vfio-pci-core globals at module init. Loading the vfio-pci module, or unloading and reloading, with non-default or different values could change the globals relative to existing devices bound to vfio-pci variant drivers. Runtime PM was introduced in commit 7ab5e10eda02 ("vfio/pci: Move the unused device into low power state with runtime PM"), which marks the point where power states became refcounted. PM get and put operations need to be balanced, but the same module operations noted above can change the global variables relative to those devices already bound to vfio-pci variant drivers. This introduces a window where PM operations can now become unbalanced. To resolve this with a narrow footprint for stable backports, the disable_idle_d3 flag is latched into the vfio_pci_core_device at the time of initialization, such that the device always operates with a consistent value. NB. vfio_pci_dev_set_try_reset() now unconditionally raises the runtime PM usage count around bus reset to account for disable_idle_d3 becoming a per-device rather than global flag. When this flag is set, the additional get/put pair is harmless and allows continued use of the shared vfio_pci_dev_set_pm_runtime_get() helper.
In the Linux kernel, the following vulnerability has been resolved: vfio: Remove device debugfs before releasing devres VFIO device debugfs files created with debugfs_create_devm_seqfile() store a devres allocated debugfs_devm_entry as inode private data. vfio_unregister_group_dev() currently calls vfio_device_del() before vfio_device_debugfs_exit(), but device_del() releases devres. This can leave debugfs entries visible with stale inode private data while unregister waits for userspace references to drain. Remove the per-device debugfs tree before vfio_device_del(). The debugfs view is diagnostic only, so losing it at the start of unregister is preferable to preserving entries whose backing storage may already have been released. Complete the teardown by clearing the per-device debugfs root after removal. This matches the global debugfs root cleanup and prevents future users from mistaking a removed dentry for a live debugfs tree during the remainder of unregister.
In the Linux kernel, the following vulnerability has been resolved: vfio/mlx5: Fix racy bitfields and tighten struct layout Bitfield operations are not atomic, they use a read-modify-write pattern, therefore we should be careful not to pack bitfields that can be concurrently updated into the same storage unit. This split takes a binary approach: flags that are only modified pre/post open/close remain bitfields, flags modified from user action, including actions that reach across to another device (ex. reset) use dedicated storage units. Note mlx5_vhca_page_tracker.status is relocated to fill the alignment hole this split exposes. Bitfield justifications: migrate_cap: written only in mlx5vf_cmd_set_migratable() at probe chunk_mode: written only in mlx5vf_cmd_set_migratable() at probe mig_state_cap: written only in mlx5vf_cmd_set_migratable() at probe Dedicated storage units: mdev_detach: written in the VF attach/detach event notifier mlx5fv_vf_event() at runtime log_active: written in mlx5vf_start_page_tracker()/ mlx5vf_stop_page_tracker() during runtime dirty tracking deferred_reset: written in mlx5vf_state_mutex_unlock()/ mlx5vf_pci_aer_reset_done() during runtime reset handling is_err: set by tracker error handling and dirty-log polling at runtime object_changed: set by tracker event handling and cleared by dirty-log polling at runtime
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free on registration failure Make sure to release the sibling interfaces in case controller registration fails to avoid use-after-free and double-free when they are eventually disconnected. This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free on marvell probe failure Make sure to stop any TX URBs submitted during Marvell OOB wakeup configuration on later probe failures to avoid use-after-free in the completion callback. This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths.
In the Linux kernel, the following vulnerability has been resolved: rust_binder: clear freeze listener on node removal Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. Currently, in this scenario the freeze listener remains in the freeze_listeners rbtree and in the remote node's freeze listener list, even though the ref for which the listener is registered is gone. This could potentially lead to a memory leak due to a refcount cycle. Thus, remove the freeze listener in this scenario.
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix sleep in atomic context in xhci_free_streams() When a USB device with active stream endpoints is disconnected, xhci_free_streams() is called from the hub_event workqueue to free the stream resources. It calls xhci_free_stream_info() while holding xhci->lock with irqs disabled. xhci_free_stream_info() invokes xhci_free_stream_ctx(), which calls dma_free_coherent() for large stream context arrays. dma_free_coherent() can sleep (e.g. via vunmap), triggering a BUG when called from atomic context. Call trace: dma_free_attrs+0x174/0x220 xhci_free_stream_info+0xd0/0x11c xhci_free_streams+0x278/0x37c usb_free_streams+0x98/0xc0 usb_unbind_interface+0x1b8/0x2f8 device_release_driver_internal+0x1d4/0x2cc device_release_driver+0x18/0x28 bus_remove_device+0x160/0x1a4 device_del+0x1ec/0x350 usb_disable_device+0x98/0x214 usb_disconnect+0xf0/0x35c hub_event+0xab4/0x19ec process_one_work+0x278/0x63c Fix this by saving the stream_info pointers and clearing the ep references under the lock, then calling xhci_free_stream_info() outside the lock where sleeping is allowed.
In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: fix ring sg table pages leak xhci_ring_to_sgtable() allocates a temporary pages array and uses it to build the returned sg_table with sg_alloc_table_from_pages(). The error paths free the pages array, but the success path returns the sg_table without freeing it. This leaks the temporary array every time a sideband client gets an endpoint or event ring buffer. Free the pages array after sg_alloc_table_from_pages() succeeds. The returned sg_table has its own scatterlist entries and does not depend on the temporary array after construction.
In the Linux kernel, the following vulnerability has been resolved: PCI: altera: Fix resource leaks on probe failure The chained IRQ handler is set during probe, but is only removed during the driver remove(). If pci_host_probe() fails, the handler and INTx IRQ domain remain set even though the devm-managed host bridge storage containing struct altera_pcie will be released, leaving the handler with a stale data pointer. Interrupts are also enabled before pci_host_probe() is called. If probe fails after that point, the controller interrupt source should be disabled before the chained handler and INTx domain are removed. So set the chained handler only after the INTx domain has been created. Disable controller interrupts during IRQ teardown, and tear the IRQ setup down if pci_host_probe() fails. [mani: commit log]
In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek: Fix IRQ domain leak when port fails to enable When mtk_pcie_enable_port() fails, mtk_pcie_port_free() removes the port from pcie->ports and frees the port structure. However, the IRQ domains set up earlier by mtk_pcie_init_irq_domain() are never freed. Fix this by refactoring mtk_pcie_irq_teardown() into a per-port helper, mtk_pcie_irq_teardown_port(), and calling it from mtk_pcie_setup() when mtk_pcie_enable_port() fails. Since the IRQ teardown must only happen in the probe error path (during resume, child devices may have active MSI mappings and the NOIRQ context prohibits sleeping locks), mtk_pcie_enable_port() is changed to return an error code so callers can distinguish the two paths and act accordingly. This issue was reported by Sashiko while reviewing the EcoNet EN7528 SoC support series.
In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: handle extreme intervals in damon_hot_score() Fix three issues in damon_hot_score() that comes from wrong handling of extreme (zero or too high) monitoring intervals user setup. When the user sets sampling interval zero, damon_max_nr_accesses(), which is called from damon_hot_score(), causes a divide-by-zero. Needless to say, it is a problem. When the user sets the aggregation interval zero, the function returns zero. It is wrong, since the real maximum nr_acceses in the setup should be one. Worse yet, it can cause another divide-by-zero from its caller, damon_hot_score(), since it uses damon_max_nr_accesses() return value as a denominator. When the user sets the aggregation interval very high, damon_hot_score() could return a value out of [0, DAMOS_MAX_SCORE] range. Since the return value is used as an index to the regions_score_histogram array, which is DAMOS_MAX_SCORE+1 size, it causes out of bounds array access. The issues can be relatively easily reproduced like below. The sysfs write permission is required, though. # ./damo start --damos_action lru_prio --damos_quota_space 100M \ --damos_quota_interval 1s # cd /sys/kernel/mm/damon/admin/kdamonds/0 # echo 0 > contexts/0/monitoring_attrs/intervals/sample_us # echo 0 > contexts/0/monitoring_attrs/intervals/aggr_us # echo commit > state # dmesg [...] [ 131.329762] Oops: divide error: 0000 [#1] SMP NOPTI [...] [ 131.336089] RIP: 0010:damon_hot_score+0x27/0xd0 [...] Fix the divide-by-zero intervals problems by explicitly handling the zero intervals in damon_max_nr_accesses(). Fix the out-of-bound array access by applying [0, DAMOS_MAX_SCORE] bounds before returning from damon_hot_score(). The issue was discovered [1] by Sashiko.
In the Linux kernel, the following vulnerability has been resolved: USB: chaoskey: Fix slab-use-after-free in chaoskey_release() The chaoskey driver has a use-after-free bug in its release routine. If the user closes the device file after the USB device has been unplugged, a debugging log statement will try to access the usb_interface structure after it has been deallocated: BUG: KASAN: slab-use-after-free in dev_driver_string (drivers/base/core.c:2406) Read of size 8 at addr ffff888168e8a0b8 by task chaoskey_raw_re/10106 Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:595) dev_driver_string (drivers/base/core.c:2406) __dynamic_dev_dbg (lib/dynamic_debug.c:906) chaoskey_release (drivers/usb/misc/chaoskey.c:323) __fput (fs/file_table.c:510) fput_close_sync (fs/file_table.c:615) __x64_sys_close (fs/open.c:1507 fs/open.c:1492 fs/open.c:1492) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) The driver's last reference to the interface structure is dropped in the chaoskey_free() routine, so the code must not use the interface -- even in a debugging statement -- after that routine returns. (Exception: If we know that another reference is held by someone else, such as the device core while the disconnect routine runs, there's no problem. Thanks to Johan Hovold for pointing this out.) Since the bad access is part of an unimportant debugging statement, we can fix the problem simply by removing the whole statement.
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: run gadget disconnect from sleepable suspend context dwc3_gadget_suspend() takes dwc->lock with IRQs disabled and then calls dwc3_disconnect_gadget(). For async callbacks that helper only uses plain spin_unlock()/spin_lock(), so the gadget ->disconnect() callback still runs with IRQs disabled and any sleepable callback trips Lockdep. This issue was found by our static analysis tool and then manually reviewed against the current tree. The grounded PoC kept the dwc3_gadget_suspend() -> dwc3_disconnect_gadget() -> gadget_driver->disconnect() chain, and Lockdep reported: BUG: sleeping function called from invalid context gadget_disconnect+0x21/0x39 [vuln_msv] dwc3_gadget_suspend.constprop.0+0x2b/0x42 [vuln_msv] Keep the disconnect callback selection in one common helper, but add a sleepable suspend-side wrapper which snapshots the callback under dwc->lock and then runs it after spin_unlock_irqrestore(). The regular event path still uses the existing spin_unlock()/spin_lock() window.
Uninitialized stack memory use in the Linux kernel HFS and HFS+ filesystem drivers allows a local user to crash the kernel by mounting a crafted filesystem image. Two early-exit paths in `hfs_bnode_read()` - an invalid offset check and a corrected-to-zero length - skip the buffer write, while downstream callers such as `hfs_bnode_read_u16()` and `hfs_bnode_read_u8()` consume the uninitialized stack buffer unconditionally, producing KMSAN uninit-value reports and risking kernel panics. Patches are available across multiple stable kernel branches; no public exploit exists and EPSS is very low at 0.22%.
The keyspan_pda USB-serial driver in the Linux kernel transmits kernel memory beyond the tty write buffer to an attached USB device due to an incorrect write() return value introduced with write FIFO support. After commit 034e38e8f687, the driver returns the byte count submitted to the USB device rather than the count accepted from the caller; the TTY line discipline interprets this inflated count as authorization to advance its read pointer past the buffer boundary, exposing adjacent kernel memory. Affected stable trees span Linux 5.15 through 7.1 and the 7.2-rc3 development branch, with patches released across all maintained stable series; no public exploit or active exploitation is confirmed, and EPSS is 0.21% (12th percentile).
Sensitive cryptographic key material handled by the Linux kernel's CAAM (Cryptographic Acceleration and Assurance Module) driver was unconditionally emitted to the kernel ring buffer via unguarded hex-dump calls in *_setkey() and gen_split_key(), exposing raw key bytes to any local user with dmesg access on kernels built with CONFIG_DYNAMIC_DEBUG. The exposure affects NXP CAAM-equipped platforms (i.MX, QorIQ SoC families) running kernel versions from approximately 5.3 through the fix commits across all active stable branches. No public exploit code exists and EPSS probability is 0.22%, but key material disclosure on a crypto-accelerator driver carries genuine confidentiality risk that the vendor-assigned CVSS (C:N/I:N/A:H) incorrectly characterizes - the real primary impact is confidentiality loss, not availability.
Incorrect idmap handling in the Linux kernel memory management subsystem causes `owner_or_capable()` checks inside `mincore()` and `madvise(MADV_PAGEOUT)` to use the identity no-op mount idmap (`nop_mnt_idmap`) rather than the actual mount's idmap, producing incorrect ownership evaluations on idmapped mounts. Local users with low privileges on Linux 5.12+ systems configured with idmapped mounts may trigger incorrect authorization decisions that deny legitimate memory management operations, with the most impactful edge case occurring on 0444 files where neither the idmap check nor the fallback `file_permission(MAY_WRITE)` path succeeds. No public exploit is known and EPSS is 0.21% (11th percentile), reflecting minimal real-world exploitation risk despite the Linux kernel's ubiquitous deployment footprint.
Memory exhaustion in the Linux kernel iommufd subsystem allows a local low-privileged user to crash the system by passing an uncapped veventq_depth value to iommufd_veventq_alloc(), which previously accepted any non-zero integer up to U32_MAX without validation. Exploitation requires local access with low privileges on a system where the iommufd device is accessible, making this primarily a concern for multi-tenant or virtualization hosts. No public exploit has been identified and EPSS at 0.21% (11th percentile) reflects minimal real-world exploitation interest at time of analysis.
Unbounded cache invalidation parameters in the Linux kernel iommufd subsystem allow a local low-privileged user to pin a CPU indefinitely or trigger a soft-lockup watchdog fault, resulting in a kernel denial of service. The iommufd_hwpt_invalidate() ioctl accepts user-supplied entry_len and entry_num values bounded only by U32_MAX, enabling an uninterruptible gigabyte-scale memory scan or a no-reschedule VT-d flush loop. No public exploit has been identified and EPSS stands at 0.21% (11th percentile); the vulnerability is not listed in CISA KEV, indicating low active exploitation pressure.
KVM's SEV-SNP guest initialization path in the Linux kernel can trigger a host kernel panic when processing CPUID data backed by a read-only memory mapping. The flaw affects hypervisors running Linux 7.0.x before 7.1.4 where a local, low-privileged VMM process can cause KVM to write corrected CPUID values into a read-only source page after AMD's trusted firmware rejects the userspace-supplied data. No public exploit has been identified and EPSS sits at 0.20% (10th percentile), consistent with a niche, difficult-to-trigger local denial-of-service condition with no confirmed active exploitation.
KVM arm64 in the Linux kernel leaks a Page Frame Number reference when kvm_translate_vncr() races an MMU notifier, allowing a local low-privileged attacker to gradually exhaust kernel memory and cause a denial of service on affected arm64 hypervisor hosts. The vulnerability is specific to arm64 systems running KVM with VNCR (Virtualization Non-Cached Region) active, and requires precise race-condition timing (AC:H). No public exploit has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) confirms this remains a low-probability exploitation target.
System hang vulnerability in the Linux kernel's NXP i.MX LPI2C driver arises from a race condition during suspend/resume power transitions. Specifically, periodic workqueues in I2C client drivers can fire I2C transfers between the suspend_noirq and resume_noirq phases, when clock and pinctrl resources have already been disabled or are not yet restored. Accessing I2C controller registers in this state causes the system to hang. The fix marks the adapter as suspended during noirq suspend, blocking transfers until hardware resources are fully restored. No public exploit or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Division-by-zero and arithmetic underflow flaws in the Linux kernel's elan_i2c touchpad driver cause kernel panic during device probe on systems equipped with Elan I2C touchpad hardware. When device firmware or device tree supplies zero values for x_traces or y_traces, the driver performs an unguarded integer division by zero, crashing the kernel. A secondary arithmetic underflow causes the input subsystem to report a massively incorrect touch width value to userspace when physical device dimensions fall below a hardcoded threshold. No public exploit exists and EPSS is 0.22% (13th percentile), reflecting the hardware-specific, limited-scope nature of this flaw.
Integer wrap in the FUSE subsystem's prune notification handler crashes 32-bit Linux kernels when a malicious or compromised FUSE daemon sends a crafted FUSE_NOTIFY_PRUNE message. On 32-bit platforms where size_t is 32 bits, multiplying a daemon-controlled count value of 0x20000000 by sizeof(u64) wraps to zero, causing the payload length check to pass with no actual nodeid data present; the subsequent copy loop then triggers a BUG_ON assertion, inducing a kernel panic. No public exploit has been identified at time of analysis and EPSS stands at 0.21% (11th percentile), consistent with the narrow exploitation window of 32-bit-only kernels and requiring FUSE daemon control.
Error-code mishandling in the Linux kernel fuse-uring subsystem causes a failed copy_from_user() in fuse_uring_commit to be silently treated as success, leaving callers processing uninitialized or partial output arguments. Local users with low-privilege access on kernels from 6.14 through pre-patch versions can trigger a kernel panic or crash, yielding a local denial of service. No public exploit has been identified and the EPSS score of 0.21% (11th percentile) indicates no meaningful active exploitation activity at time of analysis.
Resource exhaustion and denial of service in the Linux kernel's fuse-uring subsystem allows a local authenticated user to permanently hang FUSE requests and stall all background filesystem operations for the affected connection. The flaw was introduced with the fuse-uring interface in Linux 6.14 and affects stable series through 6.18.38 and 7.1.3; patched releases 6.18.39, 7.1.4, and mainline 7.2-rc1 are available. No public exploit has been identified at time of analysis (EPSS 0.21%, 11th percentile) and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation.
XFS filesystem quota iteration in the Linux kernel wraps a 32-bit quota ID back to zero when a disk quota entry (dquot) exists at XFS_DQ_ID_MAX, producing an infinite loop and local denial of service. Systems running Linux 6.8 and later with XFS quotas enabled are vulnerable if a dquot is present at the maximum 32-bit ID boundary (0xFFFFFFFF). No active exploitation has been identified; patched releases 6.12.96, 6.18.39, 7.1.4, and 7.2-rc4 are available from the kernel stable tree.
libsoup leaks proxy credentials to destination servers via Proxy-Authorization header attachment after CONNECT tunnel establishment. Affects libsoup when used with HTTP proxies for HTTPS tunneling. No public exploit is known, and exploitation probability is low (EPSS 0.23%).
Heap buffer over-read in libsoup's multipart response parser allows remote, unauthenticated attackers to crash client applications or leak heap memory. The flaw occurs when processing crafted HTTP multipart responses from a malicious server. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability.
Hostname verification missing in Apache Thrift Python TSSLSocket before 0.24.0 enables man-in-the-middle impersonation, allowing interception and manipulation of RPC traffic. This flaw violates TLS certificate hostname matching, effectively letting an attacker with a valid certificate for any domain present as a legitimate server. No active exploitation or public exploit code is known.
Out-of-bounds read vulnerability in the c_glib language bindings of Apache Thrift before 0.24.0 may allow remote attackers to read heap memory contents through crafted Thrift messages. Affected users should upgrade to version 0.24.0. No public exploit or active exploitation has been identified at this time.
Cleartext credential storage in Tycon Systems TPDIN-Monitor-WEB2 web management interface allows authenticated attackers to view system credentials, potentially leading to compromise of other network systems. Affected version is 2.3.9. No active exploitation or public exploit is known, and EPSS indicates a very low probability of exploitation.
Information disclosure in Cloudreve allows any logged-in user to enumerate and harvest email addresses of inactive and banned accounts via the user search API. The `SearchActive` method in v4 and v3 omits the required status filter, exposing basic profile metadata to authenticated attackers. No account credentials are compromised, but the leaked PII enables user enumeration across the platform.
Heap buffer overwrite in ImageMagick's morphology operation when an invalid user-supplied kernel is provided, leading to a denial-of-service condition. This integer overflow flaw (CWE-190) affects ImageMagick versions prior to 7.1.2-27 and the Magick.NET wrapper below 14.15.0. No active exploitation or public proof-of-concept has been identified, and EPSS data is unavailable.
JVM crash and potential in-process memory exposure in lz4-java 1.11.0 and earlier due to insufficient
Heap-buffer-overflow READ in ONNX's Gemm version converter adapter (gemm_7_6.h:41) allows an attacker who can supply a crafted model file to trigger a 16-byte out-of-bounds read when convert_version() downgrades an opset-7 Gemm node whose input tensor B has fewer than 2 dimensions. The vulnerability affects onnx pip package versions 1.3.0 through 1.21.0 and any pipeline that calls onnx.version_converter.convert_version() on untrusted model files. On Release builds the OOB read is silent and the leaked heap bytes propagate into the converted model's output shape metadata, enabling information disclosure; on instrumented builds ASan confirms the 16-byte overread 0 bytes past a 48-byte allocation. No public exploitation confirmed at time of analysis (EPSS 0.17%), though a functional 186-byte PoC is publicly available in the advisory.
Kernel availability degradation in the Linux kernel ntb_hw_epf driver occurs during module teardown when BAR_PEER_SPAD and BAR_CONFIG share a single PCI BAR, causing ntb_epf_pci_remove() to call pci_iounmap() on an offset address that was never independently registered as a vm_area. Systems running Linux 6.0 through at least 6.18.37 with the ntb_hw_epf module loaded under this BAR-sharing configuration will generate a kernel warning ('Trying to vunmap() nonexistent vm area') upon driver removal. No public exploit exists and EPSS probability is 0.16% (6th percentile), consistent with an availability-only defect requiring specific hardware topology and local privilege to trigger.
Shutdown and reboot operations hang indefinitely on LoongArch-based Linux systems due to a missing RCU notification in stop_this_cpu(), exposing multi-CPU LoongArch hosts running affected kernel stable branches to an unrecoverable hang during system halt or reboot. The vulnerable path is triggered when smp_send_stop() parks secondary CPUs without calling rcutree_report_cpu_dead(), after which any irq_work_sync() call in the shutdown sequence invokes synchronize_rcu() - which then blocks forever waiting for quiescent states from CPUs that are permanently parked with interrupts disabled. No public exploit identified at time of analysis; EPSS is 0.16% at the 6th percentile and the CVE is absent from CISA KEV, consistent with this being a reliability defect rather than a security exploitation path.
MIPS SMP systems running affected Linux kernel versions hang indefinitely during reboot or shutdown due to a missing RCU subsystem notification in the stop_this_cpu() shutdown path. When smp_send_stop() parks secondary CPUs, it correctly removes them from the scheduler's view via set_cpu_online(false) but never calls rcutree_report_cpu_dead(), leaving RCU waiting for quiescent states that can never arrive. The defect became reliably triggered after commit 91840be8f710 was backported to stable branches starting with 6.18.34, causing irq_work_sync() to invoke synchronize_rcu() on MIPS systems that lack an irq_work self-IPI, with no public exploit identified at time of analysis.
Improper ordering of resource assignment in the Linux kernel's memory hotplug subsystem causes a spurious WARN_ON during error recovery in __add_memory_block(). When xa_store() fails under memory pressure, device_unregister() is invoked while mem->altmap is already set, triggering memory_block_release() with a non-NULL altmap pointer and producing a kernel warning that can lead to system instability or crash. Affected systems are those running Linux kernel versions from the introduction commit 1a8c64e110435e44e71bcd50a75663174b575f22 through the respective fix commits across the 6.6, 6.12, 6.18, 7.0, and 7.1 stable series; patches are confirmed available. No public exploit has been identified and EPSS stands at 0.16% (6th percentile), consistent with a stability regression rather than an actively targeted security flaw.
Resource leaks and teardown race conditions in the Linux kernel's gpio-rockchip driver expose Rockchip-based systems to kernel panic and memory exhaustion. Three distinct defects exist in the driver's remove path: an unreleased debounce clock reference, a stale chained IRQ handler left registered after driver removal, and an unfreed IRQ domain with its generic chips. The IRQ handler defect is the most severe - if a stray GPIO interrupt arrives after the driver is unbound, the kernel dereferences a stale function pointer and panics. No public exploit identified at time of analysis; EPSS of 0.16% (5th percentile) reflects the niche, hardware-specific exploitation surface.
Incorrect pointer passing in the Linux kernel's igorplugusb infrared USB receiver driver causes the USB core to misinterpret raw pointer bytes as a USB control setup packet, triggering a BOGUS control direction warning and a kernel-level denial of service. The regression was introduced by commit eac69475b01f, which allocated ir->request as a pointer for DMA coherency but left the usb_fill_control_urb() call referencing &ir->request (the pointer variable's address) rather than ir->request (the allocated struct usb_ctrlrequest). No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.17% (6th percentile), reflecting minimal real-world exploitation probability.
Deadlock vulnerability in the Linux kernel's GPIO shared proxy subsystem allows a local, low-privileged user to cause a system hang by triggering removal of a shared GPIO proxy's parent device. The root cause is an overly-wide mutex critical section introduced in commit 710abda58055, where the gpio_shared_entry mutex was held for too long, creating a locking inversion scenario during parent device teardown. No public exploit code exists and no active exploitation has been identified; the fix narrows the critical section to protect only offset reads.
Division-by-zero kernel panic in the Linux kernel's i2c-davinci driver causes a deterministic system crash on TI DaVinci SoC-based hardware when the 'clock-frequency' device tree property is absent. The root cause is a unit mismatch: DAVINCI_I2C_DEFAULT_BUS_FREQ was defined in kHz (100) but the probe path divided it by 1000, producing dev->bus_freq = 0, which then triggers an unconditional divide-by-zero during clock divider calculation. Availability impact is complete (kernel panic), but exploitation requires specific embedded hardware context; no public exploit exists and EPSS is 0.15%, consistent with a reliability defect rather than an adversarially exploitable flaw.
Use-after-free in the Linux kernel USB UVC gadget driver allows a privileged local user to crash the kernel by racing configfs extension-unit teardown against the bind-time list walks in uvc_function_bind(). The bind path walks opts->extension_units without holding opts->lock, while the configfs write path (uvcg_extension_drop) correctly holds the lock, creating an asymmetric locking pattern that enables a freed struct uvcg_extension to be dereferenced. No public exploit exists and EPSS sits at 0.16% (5th percentile), but patches are confirmed across multiple stable kernel branches including 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1.
Out-of-bounds memory access in the Linux kernel's drm/msm DSI display subsystem causes a kernel panic on systems with Qualcomm MSM DSI 6G hardware. The io_offset adjustment applied to the mapped IO base address is not reflected in the ctrl_size value passed to the snapshot dump routine, so msm_disp_snapshot_add_block reads past the end of the mapped region and crashes the kernel. Only devices with Qualcomm MSM DSI 6G display hardware running an unpatched kernel from 5.14 onward are affected; no public exploit exists and EPSS of 0.17% confirms very low exploitation probability.
Kernel denial-of-service in the Linux kernel's device property firmware node subsystem results from fwnode_init() failing to zero the secondary pointer before use, leaving it with uninitialized stack or heap garbage that may be incorrectly treated as a valid pointer and dereferenced in functions such as dev_to_swnode(). Local users with low privileges on any kernel version between the introducing commit and the respective stable patch releases can trigger a kernel panic, causing system downtime. No public exploit code exists and EPSS is 0.17% (7th percentile), reflecting negligible observed exploitation activity.
Missing mutex lock in the Linux kernel lm90 hwmon driver's alert handler creates a race condition that triggers an interrupt storm on systems with LM90-family temperature sensors. When lm90_alert() fires concurrently with a sysfs write operation - both modifying the shared data->config register cache - the sysfs path's restore of data->config silently overwrites the alert handler's hardware-disable flag, re-enabling the alert line while the alarm remains active. The result is uncontrolled interrupt escalation causing system availability impact. No public exploit exists, EPSS is 0.17% (6th percentile), and no KEV listing is present; patched releases 6.18.34, 7.0.11, and 7.1 are available.
Availability loss in the Linux kernel's Tree SRCU (Sleepable Read-Copy-Update) subsystem causes system hangs by queuing workqueue handlers on CPUs that have never been-and may never be-online. Affected kernels spanning commit 61bbcfb50514 through the fix points can attempt to invoke callbacks for CPUs absent from cpu_possible_mask, a condition that is fatal on s390 (IBM mainframe) architectures not hardened to handle such scheduling anomalies. No public exploit code exists and EPSS places exploitation probability at 0.15% (5th percentile), consistent with a stability defect rather than a security attack surface; patches are available in Linux 7.0.11 and 7.1.
Information disclosure in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local attacker with file system access to read secret variable values stored in cleartext on disk. This occurs when the variables feature is used without selecting a vault for encryption. The vulnerability is not known to be actively exploited, and EPSS indicates a very low exploitation probability (0.08%).
OAuth refresh token disclosure in Devolutions PowerShell Universal 2026.2.2 and earlier allows authenticated users with scoped job or script read permission to extract other users' stored refresh tokens from job read API responses. The automation jobs API fails to strip the token before sending it to the client. No active exploitation is reported; EPSS score is low at 0.22%.
Information disclosure in the Keycloak Admin REST API allows a delegated administrator with view-only permissions to retrieve the resolved client secret from a secure vault instead of the vault placeholder, exposing sensitive credentials. Affected Red Hat builds include Keycloak, Single Sign-On 7, Data Grid 8, and JBoss EAP expansion pack. No active exploitation or public exploit is known; EPSS probability is low (0.21%).
Information disclosure in ABIS Technology's AVESİS software allows unauthenticated remote attackers to bypass ACLs and access restricted functionality via manipulated web parameters. Affected versions prior to build 202606251646. Exploitation likelihood is low (EPSS 0.2%), no active exploitation is known, and a vendor patch is available.
A denial-of-service vulnerability in Apache NimBLE’s Mesh Proxy SAR reassembly can be exploited by remote attackers without authentication, causing memory pressure and unstable application behavior. Affected versions include all releases through 1.9.0; a vendor patch is available in version 1.10.0. No active exploitation or public proof-of-concept has been identified, and EPSS indicates a low likelihood of widespread exploitation.
Apache NimBLE 1.9.0 and earlier mishandles multi-report HCI advertising events, potentially leaking heap memory when used with certain third-party Bluetooth controllers. The vulnerability is not under active exploitation and no public exploit code exists.
Information disclosure in Parse Server GraphQL endpoint allows unauthenticated clients to learn names of required custom fields by triggering validation errors, partially bypassing schema hiding when public introspection is disabled. Affects versions 8.2.2 to 8.6.85 and 9.0.0 to 9.9.x; patched in 8.6.86 and 9.10.0-alpha.5. No active exploitation or public exploit code identified.
Information disclosure in Parse Server GraphQL error messages exposes hidden schema class names to unauthenticated attackers when public schema introspection is disabled. Affects versions 9.0.0 before 9.10.0-alpha.6 and 8.2.2 before 8.6.87. Only class names are disclosed, not object data; no public exploit or active exploitation identified.
Denial of service in dbus-broker allows a local attacker to crash the user session bus broker when file descriptor limits are exhausted. Affected products include Red Hat Enterprise Linux 9/10, Red Hat OpenShift Container Platform 4, and Red Hat Hardened Images where dbus-broker is deployed. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability (0.11%).
Out-of-bounds read in GNU coreutils uniq allows attackers with crafted multibyte input and the -w option to crash the utility and potentially leak adjacent heap memory. Affects versions 9.5 through 9.11. No active exploitation or public exploit code is known, but a patch exists.
Unauthenticated record takeover in the Participants Database WordPress plugin (all versions ≤ 2.7.8.3) allows any remote attacker to overwrite arbitrary participant records by guessing or enumerating numeric IDs, redirect the private-access link to an attacker-controlled email, and achieve full read and edit access to victim PII including names, email addresses, and phone numbers. The attack requires no credentials - a valid nonce is freely obtainable via a plain GET request to any public page rendering the plugin's signup or record form. No CISA KEV listing or public exploit code has been identified at time of analysis, but the zero-authentication, low-complexity attack path is trivially scriptable at scale.
Microsoft Graph exposes sensitive information to authenticated network attackers through an information disclosure flaw classified under CWE-200. Any attacker holding a valid low-privilege credential can query the Microsoft Graph API over the network to retrieve data they should not have access to, without requiring additional user interaction or elevated rights. No active exploitation is confirmed (not in CISA KEV), and Microsoft has released an official fix; however, the high confidentiality impact and low attack complexity make this a meaningful risk for any organization relying on Microsoft 365 services.
Unauthenticated network asset discovery exposure in Pronetiqs IntraVUE (formerly Panduit IntraVUE) versions 3.2.1a14 and prior allows remote unauthenticated attackers to enumerate sensitive system and network asset information via the application interface. In industrial control system (ICS) and OT environments where IntraVUE is typically deployed, the disclosed asset inventory - including device types, IP addresses, and network topology - provides adversaries with reconnaissance data directly applicable to follow-on ICS-targeted attacks. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Arbitrary constructor injection in React Router's SSR hydration deserializer (deserializeErrors()) affects npm/react-router versions 6.4.0 through 7.17.x when used in Framework Mode or Data Mode with manual SSR/hydration. When application code permits attacker-supplied input to overwrite the __type or __subType fields embedded in server-side serialized error objects, the client-side hydration process can be manipulated into instantiating arbitrary constructors available on the global window object, triggering unintended outbound network requests from the victim's browser. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available in version 7.18.0.