In the Linux kernel, the following vulnerability has been resolved:
power: supply: act8945a: Fix use-after-free in power_supply_changed()
Using the `devm_` variant for requesting IRQ _before_ the `devm_`
variant for allocating/registering the `power_supply` handle, means that
the `power_supply` handle will be deallocated/unregistered _before_ the
interrupt handler (since `devm_` naturally deallocates in reverse
allocation order). This means that during removal, there is a race
condition where an interrupt can fire just _after_ the `power_supply`
handle has been freed, *but* just _before_ the corresponding
unregistration of the IRQ handler has run.
This will lead to the IRQ handler calling `power_supply_changed()` with
a freed `power_supply` handle. Which usually crashes the system or
otherwise silently corrupts the memory...
Note that there is a similar situation which can also happen during
`probe()`; the possibility of an interrupt firing _before_ registering
the `power_supply` handle. This would then lead to the nasty situation
of using the `power_supply` handle *uninitialized* in
`power_supply_changed()`.
Fix this racy use-after-free by making sure the IRQ is requested _after_
the registration of the `power_supply` handle.
A memory leak vulnerability was fixed in the Linux kernel's crypto caam driver related to netdev allocations during the dpaa2_caam_probe process. The issue occurred because dynamically allocated net_device structures were not properly freed on certain error paths, causing memory leaks reported by kmemleak. The fix ensures proper cleanup of allocated netdevs during probe failures, preserving CPU masks to avoid issues with CPU hotplug scenarios.
A vulnerability in the Linux kernel's crypto qat driver was fixed related to improper IRQ cleanup on probe failure. When the adf_dev_up() function partially completes and then fails, IRQ handlers registered during resource allocation are not detached before MSI-X vectors are released, causing warnings and potential resource leaks. The fix involves explicitly calling adf_dev_down() on failure to properly free IRQ handlers before releasing MSI-X vectors. This issue affects specific Linux kernel versions and has a medium severity rating with a CVSS score of 5.5.
A vulnerability in the Linux kernel's spi: ch341 driver caused memory leaks and potential use-after-free conditions on probe failures. The issue was addressed by ensuring proper deregistration of the controller, disabling pins, and killing and freeing the RX URB on probe failures, as well as adding an explicit URB kill on disconnect. This fix prevents resource leaks and potential instability related to USB device handling in affected kernel versions.
A use-after-free vulnerability in the Linux kernel's power supply subsystem (pm8916_bms_vm) was fixed. The issue arises from a race condition during device removal or probe where an interrupt handler may access a freed or uninitialized power_supply handle, potentially causing system crashes or memory corruption. The fix ensures the interrupt request is made after the power_supply handle registration to prevent this race condition.
A use-after-free vulnerability in the Linux kernel's power supply driver for cpcap-battery has been fixed. The issue arises from a race condition during device removal or probe, where an interrupt handler may access a freed or uninitialized power_supply handle, potentially causing system crashes or memory corruption. The flaw is due to improper ordering of resource allocation and IRQ request calls. The fix ensures the IRQ is requested only after the power_supply handle is registered.
A use-after-free vulnerability in the Linux kernel's power supply subsystem (bq256xx driver) has been fixed. The issue arises from a race condition during device removal or probe where an interrupt handler may access a freed or uninitialized power_supply handle, potentially causing system crashes or memory corruption. The fix involves changing the order of resource allocation to ensure the interrupt is requested only after the power_supply handle is registered. This vulnerability affects multiple specific Linux kernel versions and has a CVSS score of 7.8 (high severity). A patch is available and included in recent Linux kernel updates.
A use-after-free vulnerability in the Linux kernel's power supply subsystem (sbs-battery) was fixed. The issue arises from a race condition during device removal or probe where an interrupt handler may access a freed or uninitialized power_supply handle, potentially causing system crashes or memory corruption. The fix involves changing the order of IRQ request and power_supply registration to prevent this race. Multiple specific linux-azure kernel versions are affected. A patch is available and has been released by vendors including Ubuntu.
A vulnerability in the Linux kernel's USB network driver (catc) was resolved by adding endpoint type verification during device probing. The driver previously used hardcoded endpoint pipes without checking if the USB device's endpoint descriptors matched expected transfer types. This could allow a malformed USB device to present mismatched endpoint types. The fix introduces explicit checks for bulk and interrupt endpoints, rejecting devices with mismatched descriptors at probe time.
A use-after-free vulnerability was identified and fixed in the Linux kernel's power supply driver for the ab8500 component. The issue arises from a race condition during device removal or probe, where an interrupt handler may access a freed or uninitialized power_supply handle, potentially causing system crashes or memory corruption. This flaw was introduced during a refactor and has been resolved by reordering resource allocation to ensure the IRQ is requested after the power_supply handle registration.
A vulnerability in the Linux kernel's cdns3 USB driver could cause a NULL pointer dereference during role switching on resume from suspend. This occurs when the driver switches to host mode during resume, but the xhci-hcd device probe is deferred, leading to a crash. The issue has been fixed by skipping the resume operation for the new role if a role switch occurs during resume, allowing the device to be properly probed after the resume sequence completes.
A vulnerability in the Linux kernel's ALSA caiaq driver probe procedure was fixed by properly handling error cases in the setup_card() function. Previously, errors from snd_card_register() led to use-after-free (UAF) conditions due to improper error handling and continued execution. The fix changes setup_card() to return error codes promptly, allowing the caller to handle errors correctly and avoid UAF. Multiple specific Linux kernel versions are affected. A patch is available and has been released by vendors including Ubuntu.
Missing password field masking vulnerability in Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view, Hitachi Ops Center Analyzer probe modules), Hitachi Ops Center Analyzer viewpoint, Hitachi Infrastructure Analytics Advisor (Data Center Analytics, Analytics probe modules).
This issue affects Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.8-00; Hitachi Ops Center Analyzer viewpoint: from 10.8.1-00 before 11.0.8-00; Hitachi Infrastructure Analytics Advisor: from 3.2.0-00 before 11.0.8-00.
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags when moving frags from source to destination. __pskb_copy_fclone() defers the rest of the shinfo metadata to skb_copy_header() after copying frag descriptors, but that helper only carries over gso_{size,segs, type} and never touches skb_shinfo()->flags; skb_shift() moves frag descriptors directly and leaves flags untouched. As a result, the destination skb keeps a reference to the same externally-owned or page-cache-backed pages while reporting skb_has_shared_frag() as false. The mismatch is harmful in any in-place writer that uses skb_has_shared_frag() to decide whether shared pages must be detoured through skb_cow_data(). ESP input is one such writer (esp4.c, esp6.c), and a single nft 'dup to <local>' rule -- or any other nf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()'d skb in esp_input() with the marker stripped, letting an unprivileged user write into the page cache of a root-owned read-only file via authencesn-ESN stray writes. Set SKBFL_SHARED_FRAG on the destination whenever frag descriptors were actually moved from the source. skb_copy() and skb_copy_expand() share skb_copy_header() too but linearize all paged data into freshly allocated head storage and emerge with nr_frags == 0, so skb_has_shared_frag() returns false on its own; they need no change. The same omission exists in skb_gro_receive() and skb_gro_receive_list(). The former moves the incoming skb's frag descriptors into the accumulator's last sub-skb via two paths (a direct frag-move loop and the head_frag + memcpy path); the latter chains the incoming skb whole onto p's frag_list. Downstream skb_segment() reads only skb_shinfo(p)->flags, and skb_segment_list() reuses each sub-skb's shinfo as the nskb -- both p and lp must carry the marker. The same omission also exists in tcp_clone_payload(), which builds an MTU probe skb by moving frag descriptors from skbs on sk_write_queue into a freshly allocated nskb. The helper falls into the same family and warrants the same fix for consistency; no TCP TX-side in-place writer is currently known to reach a user page through this gap, but a future consumer depending on the marker would regress silently. The same omission exists in skb_segment(): the per-iteration flag merge takes only head_skb's flag, and the inner switch that rebinds frag_skb to list_skb on head_skb-frags exhaustion does not fold the new frag_skb's flag into nskb. Fold frag_skb's flag at both sites so segments drawing frags from frag_list members carry the marker.
TypeBot is a chatbot builder tool. Versions 3.15.2 and prior contain an SSRF via Open Redirect Bypass as the HTTP Request block and Code block validate the initial request URL via validateHttpReqUrl() to block private IPs and cloud metadata hostnames. However, the HTTP clients (ky and fetch) follow 302 redirects without re-validating the redirect destination. An authenticated user can point a bot block to an attacker-controlled server that responds with a redirect to an internal IP, causing the Typebot server to reach internal services. An authenticated Typebot user can reach AWS metadata (169.254.169.254), private subnets, and container-internal services. Exploitable to extract cloud IAM credentials or probe internal APIs inaccessible from the internet. This issue has been fixed in version 3.16.0.
CVE-2026-5434 is a vulnerability in Honeywell International Inc.'s Control Network Module (CNM) that involves the insertion of sensitive information into an unintended directory. This could allow an attacker to probe system files and potentially gain unintended access to protected data. The affected CNM versions include 100.1, 101.1, 110.1, and 110.2. Honeywell recommends updating to the most recent version 200.1 to address this issue. The vulnerability has a medium severity score of 5.9 and does not have any known exploits in the wild.
Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.13.0, Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by apm install <bundle> on supported Python 3.10 and 3.11 runtimes. When apm install is given a local .tar.gz that is not recognized as a plugin-format bundle, APM probes whether it is a legacy --format apm bundle. On Python versions earlier than 3.12, that probe extracts untrusted tar members with raw tar.extractall() without rejecting Windows absolute member names such as D:/.... This vulnerability is fixed in 0.13.0.
Nextcloud News is an RSS/Atom feed reader. Prior to 28.3.0-beta.1, Nextcloud News allows authenticated users to add feeds by providing a feed URL (via the web interface or the API). In affected versions, an authenticated attacker could provide a URL pointing to internal/private IP ranges or localhost, causing the Nextcloud server to perform server-side HTTP requests to attacker-controlled destinations, but not relaying the result. This enables blind SSRF, which can be used to scan or probe internal network services that are reachable from the Nextcloud server. This vulnerability is fixed in 28.3.0-beta.1.
The KRVTZ-NET IDS alerts for 2026-05-13 report network reconnaissance activity primarily involving scanning by Exabot webcrawler user agents. Some IP addresses are associated with attempts to probe known vulnerabilities, including CVE-2023-27997 targeting Fortigate VPN's /remote/logincheck endpoint and CVE-2025-55182 related to unsafe property access in React Server Components (React2Shell). There is no evidence of confirmed exploitation or active attacks in this data. The activity is informational and categorized as low severity.
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /api/filesystem/pathexists endpoint uses String.startsWith() to validate that a resolved file path is within a library folder. This check fails for sibling directories whose names share a common prefix (e.g., /audiobooks vs /audiobooks-private), allowing authenticated users with upload permission to probe file existence outside their authorized library folder boundaries. This vulnerability is fixed in 2.32.2.