Threats affecting pkg:npm/@angular/router

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop PMTU walk when nexthop group shrinks Commit 7d3f3b4367f3 ("net: ipv4: Cache pmtu for all packet paths if multipath enabled") made __ip_rt_update_pmtu() update every path. For nexthop objects, fib_info_num_path() and fib_info_nhc() independently load nh->nh_grp. RCU protects each group's lifetime but does not make the loads observe the same group. If replacement shrinks the group after the loop accepts an index, fib_info_nhc() returns NULL and update_or_create_fnhe() dereferences it. A deterministic probe only widened the existing window between the real operations. On v7.2, an RTM_NEWNEXTHOP replacement published a one-member group after the PMTU reader accepted index 1 from a two-member group, producing: KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: update_or_create_fnhe+0x45/0x15b0 Stop when the indexed path is absent. Groups are dense, so no later index exists in that snapshot. The same real-writer window completed 114,423 PMTU iterations without an oops with this check. A reproducer is available on request. Replacement requires CAP_NET_ADMIN in the network namespace. Where unprivileged user namespaces are permitted, a local user can obtain it in a new user and network namespace.

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop exception dump when nexthop group shrinks Commit 4ce5dc9316de ("inet: switch inet_dump_fib() to RCU protection") allowed IPv4 FIB dumps to run concurrently with nexthop replacement. fib_dump_info_fnhe() uses fib_info_num_path() as the loop bound, then fib_info_nhc() independently reloads nh->nh_grp. If RTM_NEWNEXTHOP replaces a group with fewer paths between those loads, fib_info_nhc() returns NULL and the dump dereferences it through nhc_flags. Stop the walk when the indexed path is absent. Nexthop groups are dense, so the current snapshot has no later path.

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c ("net: ipv4: Emit notification when fib hardware flags are changed") added an RCU-only fib_nlmsg_size() call for asynchronous hardware flag notifications. fib_nlmsg_size() checks fib_info_num_path() before each iteration, then fib_info_nhc() independently reloads nh->nh_grp. If RTM_NEWNEXTHOP replaces a group with fewer paths between those loads, fib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences it. Stop sizing when the indexed path is absent. Nexthop groups are dense, so the current snapshot has no later path.

In the Linux kernel, the following vulnerability has been resolved: ipv4: do not warn on route notification size race Commit 680aea08e78c ("net: ipv4: Emit notification when fib hardware flags are changed") added asynchronous route notifications for hardware flag changes. fib_alias_hw_flags_set() sizes the skb with fib_nlmsg_size() and later fills it with fib_dump_info() while holding only RCU. With nexthop compatibility mode enabled, a concurrent replacement can grow the group between these independent snapshots. fib_dump_info() can then legitimately return -EMSGSIZE, so the warning does not prove a sizing bug. Remove the warning. The existing error path still frees the skb and reports the error to listeners.

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later fills it with rt6_fill_node(). With nexthop compatibility mode enabled, a concurrent replacement can grow the group between these independent snapshots. rt6_fill_node() can then legitimately return -EMSGSIZE, so the warning does not prove a sizing bug. Remove the warning. The existing error path still frees the skb and reports the error to listeners.

In the Linux kernel, the following vulnerability has been resolved: Input: ati_remote2 - fix type confusion in device attribute handlers Previously, the channel_mask and mode_mask attributes were registered on the parent usb_device via sysfs_create_group(). When commit b20d6bf8014b ("Input: ati-remote2 - use driver core to instantiate device attributes") converted the driver to let the driver core manage them via dev_groups in struct usb_driver, the attributes moved to the bound usb_interface devices, but the show and store callbacks were not updated accordingly. As a result, the callbacks still invoked to_usb_device() on a device pointer belonging to a struct usb_interface, producing an invalid usb_device pointer. Use to_usb_interface() directly in the attribute handlers to obtain the interface and its driver data.

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d ("ALSA: ctxfi: Simplify dao_clear_{left,right}_input() functions") centralized the DAO input mapper clearing logic in dao_clear_input(), but omitted the kfree() calls. It removes the mapper entries from the list and sets their pointers to NULL without freeing the allocated array. This leaks memory each time dao_clear_input() is called. Store the base pointer of the allocation before clearing the mapper entries and free the array after removing entries from the list.

A reference leak vulnerability was identified and fixed in the Linux kernel's btrfs filesystem scrub functionality. Specifically, the function scrub_print_warning_inode() failed to drop a reference to the root when paths_from_inode() failed, causing a local_root reference leak. This leak occurred each time path resolution failed during scrub warning printing. The issue has been corrected by ensuring the reference is properly dropped on the failure path.

A vulnerability in the Linux kernel's CAN network subsystem caused by missing initialization of socket buffer (skb) headers in the init_can_skb() function can lead to a kernel panic. This occurs because RX skbs carry an invalid mac_header value, which triggers an overflow in packet_rcv_spkt(), resulting in a kernel BUG and full machine panic. The issue was introduced by a commit that removed skb header resets and has been fixed in later kernel versions.

A race condition vulnerability in the Linux kernel cpuset subsystem was identified and fixed. The issue occurs during CPU offline operations where a race between updating cpu_active_mask and cpuset hotplug handling can lead to a NULL pointer dereference in guarantee_active_cpus(). This happens because the top cpuset may temporarily have no active CPU during the race window. The fix reintroduces a NULL check to prevent this condition.

CVE-2026-99064 is a high-severity vulnerability in the Linux kernel's CIPSO implementation. The flaw occurs because cipso_v4_skbuff_delattr() removes CIPSO bytes without adjusting cached offsets for subsequent options. This causes consumers like ip_forward_options() and __ip_options_echo() to access incorrect bytes, potentially leading to improper interpretation and copying of packet data. The issue is fixed by adjusting cached option offsets after CIPSO removal to maintain correct parsing.

A vulnerability in the Linux kernel's device mapper ioctl interface allows an out-of-bounds read due to improper handling of buffer size calculations. Specifically, the data_start pointer can run past the allocated buffer by seven bytes when userspace requests the minimum buffer size. This flaw can cause a kernel slab-out-of-bounds read, but it requires root privileges to trigger and is not considered a security bug. The issue has been fixed in specific Linux kernel commits.

A vulnerability in the Linux kernel's vsock/virtio subsystem caused incorrect accounting of unread bytes in the read_skb() function. This led to underflow of the rx_bytes counter after partial stream receives, causing socket state inconsistencies such as negative byte counts reported by SIOCINQ, empty reads returning ELOOP, and poll indicating readability on empty sockets. The issue was fixed by adjusting the accounting to subtract only the unread portion of the packet from rx_bytes, ensuring accurate tracking of queued data.

A race condition vulnerability in the Linux kernel's brcmfmac WiFi driver causes a kernel crash when the P2P device interface is removed twice during driver removal while the user space process (e.g., wpa_supplicant) is still exiting. This occurs due to concurrent removal paths leading to a double free and subsequent kernel paging fault.

CVE-2026-99060 is a vulnerability in the Linux kernel's mt76 wireless driver for the mt7603 device. It involves the improper initialization of a global station WCID used for frames without a station or vif, including those injected via a monitor interface. This flaw could cause a NULL pointer dereference leading to kernel crashes. The issue has been fixed by initializing the WCID before publishing it. The fix was tested successfully on MT7603 PCIe hardware without causing resets or crashes.

CVE-2026-99059 is a high-severity vulnerability in the Linux kernel's WireGuard implementation related to the Noise protocol handshake. It involves a race condition where two threads process the same response message concurrently, potentially causing inconsistent handshake state and session derivation. The issue has been fixed in specific Linux kernel commits.

A vulnerability in the Linux kernel workqueue subsystem involving a NULL pointer dereference in the chained work check has been fixed. The issue occurs because current_wq_worker() indicates a kworker but does not guarantee that the worker is executing a work item, leading to a possible NULL dereference of worker->current_pwq. This flaw can cause a fault when is_chained_work() is called during queueing on a draining or destroying workqueue. The fix adds a guard to ensure worker->current_pwq is valid before the chained-work test proceeds.

A vulnerability in the Linux kernel's xen/netfront driver causes a memory leak when the function xennet_fill_frags() fails due to response chains exceeding the skb's fragment capacity. The skb buffer is not freed properly, leading to resource leakage. This issue affects multiple Linux kernel versions and has been fixed in later releases.

CVE-2026-99056 is a high-severity vulnerability in the Linux kernel's strparser component, specifically affecting version 5.6. It involves a race condition where the __strp_recv function may still be running when the parser is torn down, potentially leading to use-after-free (UAF) conditions. The issue primarily affects the espintcp user of strp_recv. A patch has been applied to add locking mechanisms to ensure that any in-flight __strp_recv calls complete before teardown, preventing crashes and exploitation. A reproducer and exploit have been published, highlighting the practical risk of this flaw.

A vulnerability in the Linux kernel TCP zerocopy receive path was fixed by rejecting net_iov fragments before page mapping. The flaw caused a null pointer dereference in can_map_frag() when processing unreadable net_iov fragments, leading to kernel panic under certain conditions. The issue affects Linux kernel version 6.12 and was resolved by adding a guard to reject net_iov fragments early.