Search: 18.8.3.2

OW2 ASM 3.0 versions before 9.11 have a denial of service vulnerability where attackers can supply specially crafted class files to exhaust CPU resources. This occurs during processing with ClassWriter.COMPUTE_FRAMES, causing the MethodWriter.computeAllFrames() algorithm to converge very slowly and tie up threads indefinitely.

OW2 ASM versions before 9.11 have a vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() that causes quadratic memory allocation when using COMPUTE_MAXS or COMPUTE_FRAMES. An attacker can craft a class file with thousands of overlapping exception handlers to trigger excessive memory allocation, leading to an OutOfMemoryError and JVM crash.

OW2 ASM versions before 9.11 have an uncontrolled recursion vulnerability in the ClassWriter.replaceAsmInstructions() method. This flaw allows attackers to cause a denial of service by supplying crafted class files with large methods containing many long forward jumps. The vulnerability triggers unbounded recursion in the toByteArray() method, resulting in a StackOverflowError during class transformation.

OW2 ASM versions before 9.11 have a vulnerability in the Label.addSubroutineRetSuccessors() method that allows excessive memory allocation. This occurs because the method does not enforce the single-RET-per-JSR rule, enabling crafted class files with multiple RET instructions per JSR to trigger large memory allocations (~2 GB) that crash the JVM.

CVE-2026-110658 is a heap out-of-bounds read vulnerability in sofia-sip up to version 1.13.18. It occurs in the msg_multipart_parse() function when processing multipart MIME boundaries. An unauthenticated remote attacker can send an INVITE request with a multipart Content-Type header containing a boundary string longer than the message body, causing a memory read beyond the allocated heap buffer and crashing the process. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity).

p7zip versions before 26.03 contain a vulnerability in the SquashFS v4 archive handler that allows attackers to leak uninitialized heap memory. This occurs when a crafted archive manipulates the superblock's no_ids field, causing the final metadata block size to be miscomputed and bypass validation. When such an archive is listed or extracted, uninitialized heap memory is returned as user and group ID properties, potentially exposing sensitive process memory contents.

A use-after-free vulnerability was identified and resolved in the Linux kernel's platform/x86 code for x86 Android tablets. The issue arises from improper reference counting of device pointers during secondary firmware node teardown, which could lead to use-after-free during driver teardown if the device is released prematurely.

This vulnerability in the Linux kernel affects the PowerPC architecture's handling of Kernel User Access Protection (KUAP) during the transition from kernel mode to user mode. The flaw involves restoring the KUAP state too early in the exit sequence, which can lead to warnings and potential improper memory access protections. The issue has been resolved by adjusting when KUAP is restored in the exit process.

CVE-2026-98395 is a vulnerability in the Linux kernel's powerpc architecture interrupt handling code. It involves corruption of the irq_soft_mask variable during replayed interrupt exits, which causes a warning and incorrect interrupt masking state. The issue occurs because local_irq_disable() overwrites irq_soft_mask incorrectly, stripping a needed bit. The fix replaces local_irq_disable() with hard_irq_disable(), which preserves the correct mask bits and resolves the warning. This fix applies to both PPC64 and PPC32 architectures and corrects interrupt replay behavior during early boot on POWER10 pseries guests.

CVE-2026-98431 addresses a deadlock vulnerability in the Linux kernel's RDMA/uverbs subsystem caused by a circular locking dependency between mmap_lock and disassociation_lock. The issue was introduced by a commit that added disassociation_lock to protect mmap registrations but inadvertently created an ABBA deadlock scenario. The fix removes disassociation_lock and relies on the existing hw_destroy_rwsem lock to prevent deadlocks. This resolves the circular dependency and prevents potential kernel lockup conditions.

A vulnerability in the Linux kernel's RDMA/efa driver was addressed to ensure proper management of admin queues during IRQ registration. The issue involved the IRQ handler accessing queues that were not fully constructed or already destroyed, leading to potential use-after-free conditions. The fix involves initializing queues with interrupts masked, requesting IRQs before enabling interrupts, and properly resetting the device and freeing IRQs before destroying queues.

A low-severity vulnerability in the Linux kernel's mac80211_hwsim component was fixed to prevent frames from being handed to mac80211 while the radio is stopping. The issue involved a race condition where the radio could stop after a check but before frame delivery, triggering a warning in mac80211. The fix expands mutex protection to synchronize frame delivery with radio stopping, eliminating the warning and dropping a noisy error print.

A NULL pointer dereference vulnerability was fixed in the Linux kernel's dmaengine ti k3-udma-glue driver. The flaw occurs when memory allocation for rx_chn->flows fails, leading to a NULL dereference in the error handling path during channel release. This issue was identified and resolved to prevent potential kernel crashes.

A vulnerability in the Linux kernel's SELinux component was fixed by ensuring the avc_has_perm_noaudit() function always fills the AVC decision structure. Previously, if the requested permission set was empty, the function returned early without initializing the decision buffer, leading to uninitialized data being used by callers. This could cause inconsistent or undefined behavior in access control decision handling.

A vulnerability in the Linux kernel watchdog driver da9063 causes improper suspend/resume handling when the hardware watchdog is running but userspace never opens the device. This leads to the watchdog continuing to count during system suspend, potentially causing unexpected system resets.

A vulnerability in the Linux kernel s390 boot code could cause an out-of-bounds write when appending IPL parameters to the command line if the command line occupies all but the terminating byte of the buffer. This issue has been resolved by changing how the IPL parameter is converted and appended to the command line buffer.

A NULL pointer dereference vulnerability in the Linux kernel's s390 architecture IPL (Initial Program Load) code was fixed. The issue occurs when kdump attempts to access a re-IPL parameter block that may not be provided by certain IPL types, leading to a NULL dereference. The fix ensures that kdump skips updating os_info when no re-IPL parameter block is available, preventing the NULL dereference and allowing the system to collect a crash dump and reboot properly.

A NULL pointer dereference vulnerability in the Linux kernel's s390 architecture IPL (Initial Program Load) handling was fixed. The issue occurs when the stand-alone dump process attempts to dereference a NULL re-IPL parameter block pointer if no re-IPL parameter block is provided by certain IPL types. This could cause the stand-alone dumper to enter a disabled wait state after completing the dump. The fix explicitly stores zero values for the IPL parameter block address and checksum when no re-IPL parameter block is available, preventing the NULL dereference.

CVE-2026-98398 is a vulnerability in the Linux kernel's lockdep subsystem where stale class_cache entries for zapped lock classes are not properly invalidated. This can cause lockdep to reference invalid or unrelated lock classes, leading to warnings and potential ABA issues during lock acquisition and validation.

A medium severity vulnerability in the Linux kernel's af_unix socket implementation causes a busy-wait condition when recv(0, MSG_PEEK) is called under specific conditions involving out-of-band data. This issue has been resolved by returning immediately when manage_oob() returns NULL for a zero-length buffer.