The KRVTZ-NET IDS alerts for 2026-05-13 report network reconnaissance activity primarily involving scanning by Exabot webcrawler user agents. Some IP addresses are associated with attempts to probe known vulnerabilities, including CVE-2023-27997 targeting Fortigate VPN's /remote/logincheck endpoint and CVE-2025-55182 related to unsafe property access in React Server Components (React2Shell). There is no evidence of confirmed exploitation or active attacks in this data. The activity is informational and categorized as low severity.
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /api/filesystem/pathexists endpoint uses String.startsWith() to validate that a resolved file path is within a library folder. This check fails for sibling directories whose names share a common prefix (e.g., /audiobooks vs /audiobooks-private), allowing authenticated users with upload permission to probe file existence outside their authorized library folder boundaries. This vulnerability is fixed in 2.32.2.
A vulnerability in the Linux kernel's MCTP driver caused a device reference leak on probe failure. The driver incorrectly retained a reference to the USB device during probe without releasing it if the probe failed, leading to a memory leak. This issue has been fixed by dropping the redundant device reference to prevent leaks and improve code clarity.
A double-free vulnerability in the Linux kernel's rockchip-sfc SPI driver has been fixed. The issue arises because the driver uses devm_spi_register_controller() which automatically unregisters the controller on device removal, but also manually calls spi_unregister_controller() in the remove() callback, causing a double-free. The fix involves switching to spi_register_controller() in probe() to ensure proper unregistration order before DMA buffer unmapping.
A race condition vulnerability in the Linux kernel's usb: yurex driver probe function was fixed. The issue involved improper initialization of the bbu member in the descriptor before submitting a URB whose completion handler sets bbu, creating a window where probing could overwrite retrieved data. This flaw could lead to a denial of service (system instability or crash). The vulnerability affects specific Linux kernel versions and has a medium severity rating with a CVSS score of 4.7. A patch is available to address this issue.
A vulnerability in the Linux kernel's spi-cadence-quadspi driver was resolved. The issue involved duplicate clock disables triggered by runtime power management (PM) when device tree (DT) descriptions for attached flashes were missing or broken. This could cause warnings and potential instability during device probe. The fix involved moving flash parsing to an earlier stage to avoid redundant setup and clock disable conflicts.
A vulnerability in the Linux kernel's chips-media wave5 driver caused a runtime PM usage count underflow due to improper handling of power management reference counts during device removal. This underflow triggers a warning on module unload but does not impact confidentiality or integrity, only availability. The issue has been resolved by replacing pm_runtime_put_sync() with pm_runtime_dont_use_autosuspend() in the remove path to correctly pair with pm_runtime_use_autosuspend() from probe, ensuring proper reference count cleanup.
CVE-2026-43242 is a medium severity vulnerability in the Linux kernel's soc: ti: k3-socinfo driver. It involves a resource leak where the mmio regmap allocated during the driver's probe is not freed on probe failure, such as probe deferral. This issue has been fixed by switching to a device-managed allocator that ensures the regmap is released properly on probe failures and driver unbind.
CVE-2026-43227 is a medium-severity vulnerability in the Linux kernel's sh_tmu clocksource/clockevent driver. The issue arises because the driver attempts to manage power and clock states while holding raw spinlocks, which conflicts with runtime power management calls that use regular spinlocks. This leads to lockdep warnings and invalid wait context bugs, particularly in PREEMPT_RT builds where normal spinlocks can sleep. The vulnerability does not affect non-PREEMPT_RT builds significantly. The fix involves always leaving the device powered and clocked on after probe to avoid these locking conflicts.
CVE-2026-43207 is a high-severity vulnerability in the Linux kernel's media subsystem, specifically in the mtk-mdp driver. The issue involves improper error handling in the probe function, which could lead to resource leaks and null pointer dereferences. The fix involves adding proper unregister and reference count management to prevent these issues.
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix potential kernel oops when probe fails When probe of the sdio brcmfmac device fails for some reasons (i.e. missing firmware), the sdiodev->bus is set to error instead of NULL, thus the cleanup later in brcmf_sdio_remove() tries to free resources via invalid bus pointer. This happens because sdiodev->bus is set 2 times: first in brcmf_sdio_probe() and second time in brcmf_sdiod_probe(). Fix this by chaning the brcmf_sdio_probe() function to return the error code and set sdio->bus only there.
In the Linux kernel, the following vulnerability has been resolved: mux: mmio: fix regmap leak on probe failure The mmio regmap that may be allocated during probe is never freed. Switch to using the device managed allocator so that the regmap is released on probe failures (e.g. probe deferral) and on driver unbind.
In the Linux kernel, the following vulnerability has been resolved: mfd: macsmc: Initialize mutex Initialize struct apple_smc's mutex in apple_smc_probe(). Using the mutex uninitialized surprisingly resulted only in occasional NULL pointer dereferences in apple_smc_read() calls from the probe() functions of sub devices.
In the Linux kernel, the following vulnerability has been resolved: media: ipu6: Fix RPM reference leak in probe error paths Several error paths in ipu6_pci_probe() were jumping directly to out_ipu6_bus_del_devices without releasing the runtime PM reference. Add pm_runtime_put_sync() before cleaning up other resources.
A vulnerability in the Linux kernel's MediaTek SMI driver (mtk-smi) was fixed to address a device reference leak during larb probe failures and driver unbind. This flaw could cause resource leaks affecting system stability. The issue was resolved in specific linux-azure kernel versions. The vulnerability has a medium severity score and does not impact confidentiality or integrity but can affect availability. A patch is available as part of a broader Linux kernel security update.
A medium severity vulnerability (CVE-2025-71288) in the Linux kernel's MediaTek SMI driver caused device reference leaks during common probe failures such as probe deferral or driver unbind. This flaw could lead to resource leaks affecting system stability. The vulnerability is resolved in Linux kernel versions 6.8.0 and later. Multiple other Linux kernel security issues affecting various architectures and subsystems were also fixed in the same update. A patch is available and should be applied via standard system updates, which require a reboot and recompilation of third-party kernel modules due to ABI changes.
A potential memory leak vulnerability in the Linux kernel's ti_fpc202 driver probe function has been resolved by using for_each_child_of_node_scoped() to simplify code and ensure automatic release of device node references. This issue could lead to resource exhaustion affecting system availability.
A vulnerability in the Linux kernel's HID subsystem (hid-pl driver) was resolved. The issue involved improper handling of probe errors during initialization, which could lead to a NULL pointer dereference when force feedback (FF) is used. This flaw could cause a denial of service by crashing the system. Multiple Linux kernel versions are affected, and a patch is available to correct this and other security issues.