Cacti versions from 1.2.27 up to but not including 1.2.31 contain an authenticated stored second-order SQL injection vulnerability in the automation tree rule item handler. A user with Automation realm privileges can inject arbitrary SQL fragments that are later executed when an administrator applies automation rules, leading to potential data exfiltration via the UI. This vulnerability has been fixed in version 1.2.31.
Cacti versions prior to 1.2.31 have a vulnerability in their input blocklist that fails to filter certain characters such as single-quote, double-quote, redirect operators, and subshell parentheses. This allows an authenticated admin to bypass input validation by saving crafted input strings containing these characters. The issue is fixed in version 1.2.31.
A heap out-of-bounds write vulnerability exists in the Linux kernel's ksmbd component within the krb5_authenticate() function. The flaw occurs when processing SMB2_SESSION_SETUP as a non-first element in a compounded SMB2 request, causing an incorrect calculation of buffer headroom. This miscalculation allows memcpy() to write past the end of the allocated buffer into adjacent kernel heap memory. The issue has been fixed by adjusting the calculation to correctly reflect the remaining buffer space.
A vulnerability in the Linux kernel IPv4 implementation could cause an exception dump when a nexthop group shrinks during concurrent routing table dumps. This occurs due to a race condition where the nexthop group size changes between two related function calls, leading to a NULL pointer dereference. The issue has been resolved by stopping the walk when the indexed path is absent.
CVE-2026-99063 is a Linux kernel vulnerability in the device mapper ioctl interface where a buffer over-read can occur due to improper bounds checking of the data_start pointer relative to the buffer size. This flaw can cause a small out-of-bounds read of up to seven bytes past the allocated buffer. The issue arises because the struct dm_ioctl has trailing padding, and the kernel code does not clamp data_start to the actual buffer size. The vulnerability can only be triggered by root privileges and has been fixed by clamping data_start to the buffer size.
A vulnerability in the Linux kernel's mt7603 wifi driver involves the use of an uninitialized global station WCID for certain frames, including those injected via a monitor interface. This flaw can lead to a NULL pointer dereference causing kernel crashes. The issue has been fixed by initializing the WCID before publishing it, with testing confirming stability and no resets during frame injection and data transfer.
CVE-2026-99053 is a use-after-free vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem. The flaw arises because tipc_node_find_by_name() returns a node pointer after releasing its RCU read lock without taking a reference, allowing concurrent cleanup of the node to free it while still in use. This can lead to accessing freed memory, causing potential kernel crashes or other impacts. The issue affects multiple Linux kernel versions and has been assigned a high severity rating with a CVSS score of 7.8.
A vulnerability in the Linux kernel's ice driver involves improper reference count handling of metadata_dst objects during representor teardown. The flaw occurs because metadata_dst_free() is called directly, freeing memory without checking reference counts, potentially leading to use-after-free conditions when packets still hold references. This has been fixed by replacing metadata_dst_free() with dst_release(), which correctly manages reference counts and frees memory only when all references are dropped.
A use-after-free vulnerability exists in the Linux kernel memstick subsystem where asynchronous requests may write to memory after the associated card structure has been freed. This occurs because wait_for_completion_timeout() is used to wait for request completion, and if it times out, the card structure is freed while the request is still in flight. The issue is fixed by replacing wait_for_completion_timeout() with wait_for_completion() to ensure the card is not freed prematurely.
A vulnerability in the Linux kernel's memstick subsystem (rtsx_usb_ms driver) causes requests to be dropped silently after a card eject event, leading to a hang during device removal. This occurs because requests are not properly completed when the device is ejected, causing blocking in kernel workqueues and preventing proper cleanup.
A vulnerability in the Linux kernel's dm-crypt subsystem involves improper handling of the lmk IV mode when used with AEAD ciphers. Specifically, pairing an AEAD cipher with the lmk IV mode causes a kernel oops due to out-of-bounds memory access. This issue arises because lmk sets a transform count of 64, but only one transform is allocated, leading to memory corruption during key setup. The flaw is not exploitable by unprivileged users as root privileges are required to trigger it.
A race condition in the Linux kernel device mapper (dm) subsystem was fixed where a function could read freed memory during concurrent ioctl calls. This issue occurs because dm_table_get_mode is called without holding locks, allowing a concurrent ioctl to swap the table and cause a use-after-free scenario. The flaw was identified by syzbot and fixed by changing the order of operations to read the mode before swapping the table. This is not considered a security bug since only root can trigger it and common tools do not invoke the vulnerable ioctls concurrently.
A use-after-free vulnerability in the Linux kernel's mmc mtk-sd driver was fixed by ensuring that the request timeout work is properly canceled during device removal. The issue involved a delayed work callback accessing freed resources after the driver unbinds and frees the mmc_host, causing kernel memory safety violations detected by KASAN.
A vulnerability in the Linux kernel's mmc sdhci-sprd driver involves improper handling of runtime power management (PM) during device removal. The driver enables runtime PM on probe but fails to properly clean up runtime PM on removal, potentially leading to clocks being disabled incorrectly if the device is runtime suspended. This issue was identified through manual code inspection and affects specific Linux kernel versions.
CVE-2026-99033 is a vulnerability in the Linux kernel's net/packet subsystem where the function packet_rcv_spkt() improperly handles the link layer header push operation. This can cause a kernel panic when processing CAN (Controller Area Network) packets on certain socket types due to an uninitialized mac_header pointer. The issue arises because packet_rcv_spkt() does not guard the skb_push() operation with a check for the presence of a link layer header, unlike similar functions. This flaw can lead to a fatal kernel panic from softirq context, causing a system crash.
CVE-2026-99032 is a use-after-free and potential NULL dereference vulnerability in the Linux kernel's SMC (Shared Memory Communications) subsystem. The flaw occurs in the smc_getname() function, which accesses the clcsock pointer without proper locking, allowing asynchronous release of the associated CLC socket. This can lead to memory corruption or kernel crashes when getsockname() is called concurrently with link-group termination.
A vulnerability in the Linux kernel's network bridge code could cause recursive multicast port cleanup to consume excessive kernel stack frames, potentially hitting the stack guard page. This issue arises from the function br_multicast_sg_del_exclude_ports() calling br_multicast_del_pg(), which in turn calls back into br_multicast_sg_del_exclude_ports() for certain entries. The fix suppresses the recursive cleanup while the helper is already processing the same entry.
A vulnerability in the Linux kernel's skb_copy_and_csum_bits() function could cause stale bytes to be left in network buffers. This occurs when unreadable fragments cause the function to copy only the linear part of a buffer, leaving the remainder uninitialized. The uninitialized memory may be sent out in network packets such as ICMP errors or driver transmit buffers, potentially leaking sensitive data. The issue is addressed by zeroing the unused portion of the buffer before transmission.
A memory leak vulnerability in the Linux kernel's power sequencing code for pcie-m2 was fixed. The function of_regulator_bulk_get_all() allocates an array that was not properly freed in the pwrseq-pcie-m2.c code, causing a leak. The fix adds an explicit kfree() call to release the allocated consumers array.
A vulnerability in the Linux kernel regulator driver for the LTC3676 chip allows reading from write-only registers HRST and CLIRQ. Reading these registers triggers unintended hardware actions, such as a hard reset or clearing interrupts, causing the board to reboot unexpectedly during register dumps.