A vulnerability in the Linux kernel's soc: ti: k3-socinfo driver caused a regmap memory leak on probe failure. The issue was due to the mmio regmap allocated during probe not being freed properly. The fix involves switching to a device-managed allocator to ensure regmap release on probe failures and driver unbind. This vulnerability affects specific Linux kernel versions and has a medium severity rating with a CVSS score of 5.5.
A vulnerability in the Linux kernel's ixgbevf driver for Hyper-V virtual machines caused a NULL pointer dereference due to a missing negotiate_features operation in the Hyper-V ops table. This flaw leads to a kernel crash (NULL pointer dereference) during device probe on affected Hyper-V VMs. The issue was fixed by adding the missing callback that returns an error code handled gracefully by the caller.
Gotenberg versions prior to 8.31.0 contain a server-side request forgery (SSRF) vulnerability. An unauthenticated attacker with network access can supply a crafted URL in the Gotenberg-Webhook-Url header to force the server to make HTTP POST requests to arbitrary internal or external destinations. The default configuration lacks restrictions on outbound URLs, allowing unrestricted SSRF. This blind SSRF can be used to probe internal networks, trigger side effects on internal services, and confirm reachability of cloud metadata endpoints. The issue is fixed in version 8.31.0.
The PyPI package 'runtime-probe' version 0.3.0 contains malicious code that exfiltrates basic host information such as IP address and username during installation or import. The package overrides the install command in setup.py to execute this malicious code. It appears to be a low-harm package resembling typical pentest or research tools but with unauthorized data exfiltration functionality.
CVE-2026-35527 is a blind server-side request forgery (SSRF) vulnerability in Incus prior to version 7.0.0. It allows an authenticated user to cause the Incus daemon to send HEAD requests to arbitrary URLs during the image import preflight stage before validation and policy checks are completed. Although the actual image import is rejected by project restrictions, the premature HEAD request can be used to probe internal or external network endpoints, potentially revealing sensitive environment details.
This vulnerability involves a potential memory leak in the probe function of the ti_fpc202 component in Microsoft software version 3.0. The issue was identified and reported under CVE-2025-71290. No detailed technical information or impact specifics are provided in the available data.
CVE-2026-46184 is a vulnerability in Microsoft software version 3.0 related to the sound component 'ua101' where a division by zero error occurs during the probe phase. This flaw could potentially cause a crash or denial of service. No CVSS score or detailed impact information is provided.
CVE-2026-46048 addresses a vulnerability related to a reference count leak in the ALSA caiaq USB device driver during probe failure. The issue involves the usb_dev reference count not being properly decremented, potentially leading to resource leaks. No CVSS score or detailed impact information is provided. There is no indication of known exploits in the wild or available patches. The vendor advisory content is minimal and does not specify remediation status or mitigation steps.
CVE-2026-46004 is a vulnerability related to the ALSA caiaq component where probe errors are not handled properly. The information provided is minimal and does not include technical details, CVSS score, or exploit data. The affected version is specifically version 3.0 of the Microsoft product referenced. No patch or remediation details are provided.
CVE-2026-31740 is a medium severity vulnerability in the Linux kernel's counter driver for the rz-mtu3 hardware. The issue arises because the dev member of the shared struct rz_mtu3_channel is overwritten by both the counter and PWM sub-drivers for channels 1 and 2, leading to a race condition. This causes the counter sub-driver to potentially perform runtime power management on the wrong device. The flaw is fixed by using the parent pointer assigned during probe instead of the shared dev member.
A vulnerability in the Linux kernel's iio: gyro: mpu3050 driver was fixed by moving the iio_device_register() call to the correct location at the end of the probe function to prevent race conditions. This flaw could lead to serious impacts including confidentiality, integrity, and availability loss. The issue affects specific linux-azure kernel versions. A patch is available as part of a broader Linux kernel security update.
CVE-2026-31687 is a medium severity vulnerability in the Linux kernel's OMAP GPIO driver. The issue arises from registering a driver within a probe() callback, which can cause a deadlock due to device locking rules enforced by the driver core. The vulnerability also involves the omap_mpuio_driver not being unregistered properly upon module unload. The flaw has been resolved by moving driver registration to the module initialization and unregistering it on module exit.
In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register The call to mipi_dsi_host_register triggers a callback to mtk_dsi_bind, which uses dev_get_drvdata to retrieve the mtk_dsi struct, so this structure needs to be stored inside the driver data before invoking it. As drvdata is currently uninitialized it leads to a crash when registering the DSI DRM encoder right after acquiring the mode_config.idr_mutex, blocking all subsequent DRM operations. Fixes the following crash during mediatek-drm probe (tested on Xiaomi Smart Clock x04g): Unable to handle kernel NULL pointer dereference at virtual address 0000000000000040 [...] Modules linked in: mediatek_drm(+) drm_display_helper cec drm_client_lib drm_dma_helper drm_kms_helper panel_simple [...] Call trace: drm_mode_object_add+0x58/0x98 (P) __drm_encoder_init+0x48/0x140 drm_encoder_init+0x6c/0xa0 drm_simple_encoder_init+0x20/0x34 [drm_kms_helper] mtk_dsi_bind+0x34/0x13c [mediatek_drm] component_bind_all+0x120/0x280 mtk_drm_bind+0x284/0x67c [mediatek_drm] try_to_bring_up_aggregate_device+0x23c/0x320 __component_add+0xa4/0x198 component_add+0x14/0x20 mtk_dsi_host_attach+0x78/0x100 [mediatek_drm] mipi_dsi_attach+0x2c/0x50 panel_simple_dsi_probe+0x4c/0x9c [panel_simple] mipi_dsi_drv_probe+0x1c/0x28 really_probe+0xc0/0x3dc __driver_probe_device+0x80/0x160 driver_probe_device+0x40/0x120 __device_attach_driver+0xbc/0x17c bus_for_each_drv+0x88/0xf0 __device_attach+0x9c/0x1cc device_initial_probe+0x54/0x60 bus_probe_device+0x34/0xa0 device_add+0x5b0/0x800 mipi_dsi_device_register_full+0xdc/0x16c mipi_dsi_host_register+0xc4/0x17c mtk_dsi_probe+0x10c/0x260 [mediatek_drm] platform_probe+0x5c/0xa4 really_probe+0xc0/0x3dc __driver_probe_device+0x80/0x160 driver_probe_device+0x40/0x120 __driver_attach+0xc8/0x1f8 bus_for_each_dev+0x7c/0xe0 driver_attach+0x24/0x30 bus_add_driver+0x11c/0x240 driver_register+0x68/0x130 __platform_register_drivers+0x64/0x160 mtk_drm_init+0x24/0x1000 [mediatek_drm] do_one_initcall+0x60/0x1d0 do_init_module+0x54/0x240 load_module+0x1838/0x1dc0 init_module_from_file+0xd8/0xf0 __arm64_sys_finit_module+0x1b4/0x428 invoke_syscall.constprop.0+0x48/0xc8 do_el0_svc+0x3c/0xb8 el0_svc+0x34/0xe8 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c Code: 52800022 941004ab 2a0003f3 37f80040 (29005a80)
In the Linux kernel, the following vulnerability has been resolved: i2c: designware: amdisp: Fix resume-probe race condition issue Identified resume-probe race condition in kernel v7.0 with the commit 38fa29b01a6a ("i2c: designware: Combine the init functions"),but this issue existed from the beginning though not detected. The amdisp i2c device requires ISP to be in power-on state for probe to succeed. To meet this requirement, this device is added to genpd to control ISP power using runtime PM. The pm_runtime_get_sync() called before i2c_dw_probe() triggers PM resume, which powers on ISP and also invokes the amdisp i2c runtime resume before the probe completes resulting in this race condition and a NULL dereferencing issue in v7.0 Fix this race condition by using the genpd APIs directly during probe: - Call dev_pm_genpd_resume() to Power ON ISP before probe - Call dev_pm_genpd_suspend() to Power OFF ISP after probe - Set the device to suspended state with pm_runtime_set_suspended() - Enable runtime PM only after the device is fully initialized
In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: fix use-after-free on disconnect The vub300 driver maintains an explicit reference count for the controller and its driver data and the last reference can in theory be dropped after the driver has been unbound. This specifically means that the controller allocation must not be device managed as that can lead to use-after-free. Note that the lifetime is currently also incorrectly tied the parent USB device rather than interface, which can lead to memory leaks if the driver is unbound without its device being physically disconnected (e.g. on probe deferral). Fix both issues by reverting to non-managed allocation of the controller.
A vulnerability in the Linux kernel's cp2615 driver could cause a NULL-pointer dereference during device probe if the USB device serial string is missing. This occurs because the driver uses the serial string as the i2c adapter name without verifying its existence. The issue has been fixed in updated Linux kernel versions.
A use-after-free and double-free vulnerability was identified and fixed in the Linux kernel's hackrf media driver. The flaw arises from a race condition where memory allocated during device probe is freed prematurely after device registration, while open file descriptors to the device remain valid. This can lead to memory corruption when the device's release function also attempts to free the same memory. The issue affects specific linux-aws kernel versions and has been addressed by modifying the driver to defer memory freeing until device release.
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix device leak on probe failure Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. This driver takes a reference to the USB device during probe but does not to release it on all probe errors (e.g. when descriptor parsing fails). Drop the redundant device reference to fix the leak, reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of further memory leaks.