Vulnerabilities

Improper input validation in the PAM AD discovery endpoints in <br /> Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated<br /> user with the UserGroupsView permission to coerce server-side <br /> authentication to an attacker-controlled host, exposing PAM provider <br /> credentials as a NTLMv2 challenge-response, via a crafted DomainName <br /> parameter.

Unauthenticated Broken Access Control in MainWP Child

When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass.<br /> This vulnerability is similar to https://www.cve.org/CVERecord?id=CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the `shiro-guice` module instead of the `shiro-spring` module.<br /> <br /> This issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1 only when using `shiro-guice` module in a web servlet context.<br /> <br /> Upgrade to version 3.0.0 or later, which fixes the issue.

"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed.<br /> This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled.<br /> <br /> <br /> Upgrade to version 3.0.0 or later, which fixes the issue.

A vulnerability in Apache Kvrocks.<br /> <br /> This issue affects Apache Kvrocks: from 2.6.0 through 2.15.0.<br /> <br /> Users are recommended to upgrade to version 2.16.0, which fixes the issue.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation<br /> <br /> walk_s1() and kvm_walk_nested_s2() expect to be called while holding<br /> kvm-&gt;srcu to guard against memslot changes. While this is generally<br /> the case, __kvm_at_s12() and __kvm_find_s1_desc_level() call into the<br /> respective walkers without taking kvm-&gt;srcu.<br /> <br /> Fix by acquiring kvm-&gt;srcu prior to the table walk in both instances.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer<br /> <br /> In iso_sock_rebind_bc(), the bis pointer is cached, then the socket lock is<br /> dropped:<br /> bis = iso_pi(sk)-&gt;conn-&gt;hcon;<br /> /* Release the socket before lookups since that requires hci_dev_lock<br /> * which shall not be acquired while holding sock_lock for proper<br /> * ordering.<br /> */<br /> release_sock(sk);<br /> hci_dev_lock(bis-&gt;hdev);<br /> <br /> During the unlocked window, could a concurrent close() destroy the connection<br /> and free the bis structure, causing hci_dev_lock(bis-&gt;hdev) to access memory<br /> after it is freed, fix this by using the hdev reference which was safely<br /> acquired via iso_conn_get_hdev().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ipv6: mcast: Fix use-after-free when processing MLD queries<br /> <br /> When processing an MLD query, a pointer to the multicast group address<br /> is retrieved when initially parsing the packet. This pointer is later<br /> dereferenced without being reloaded despite the fact that the skb header<br /> might have been reallocated following the pskb_may_pull() calls, leading<br /> to a use-after-free [1].<br /> <br /> Fix by copying the multicast group address when the packet is initially<br /> parsed.<br /> <br /> [1]<br /> BUG: KASAN: slab-use-after-free in __mld_query_work (net/ipv6/mcast.c:1512)<br /> Read of size 8 at addr ffff8881154b8e90 by task kworker/4:1/118<br /> <br /> Workqueue: mld mld_query_work<br /> Call Trace:<br /> <br /> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)<br /> print_address_description.constprop.0 (mm/kasan/report.c:378)<br /> print_report (mm/kasan/report.c:482)<br /> kasan_report (mm/kasan/report.c:595)<br /> __mld_query_work (net/ipv6/mcast.c:1512)<br /> mld_query_work (net/ipv6/mcast.c:1563)<br /> process_one_work (kernel/workqueue.c:3314)<br /> worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)<br /> kthread (kernel/kthread.c:436)<br /> ret_from_fork (arch/x86/kernel/process.c:158)<br /> ret_from_fork_asm (arch/x86/entry/entry_64.S:245)<br /> <br /> <br /> [...]<br /> <br /> Freed by task 118:<br /> kasan_save_stack (mm/kasan/common.c:57)<br /> kasan_save_track (mm/kasan/common.c:78)<br /> kasan_save_free_info (mm/kasan/generic.c:584)<br /> __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)<br /> kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566)<br /> pskb_expand_head (net/core/skbuff.c:2335)<br /> __pskb_pull_tail (net/core/skbuff.c:2878 (discriminator 4))<br /> __mld_query_work (net/ipv6/mcast.c:1495 (discriminator 1))<br /> mld_query_work (net/ipv6/mcast.c:1563)<br /> process_one_work (kernel/workqueue.c:3314)<br /> worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)<br /> kthread (kernel/kthread.c:436)<br /> ret_from_fork (arch/x86/kernel/process.c:158)<br /> ret_from_fork_asm (arch/x86/entry/entry_64.S:245)

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS<br /> <br /> A logic flaw in __smc_setsockopt() allows a local unprivileged user to<br /> cause a Denial of Service (DoS) by holding the socket lock indefinitely.<br /> <br /> The function __smc_setsockopt() calls copy_from_sockptr() while holding<br /> lock_sock(sk). By passing a userfaultfd-monitored memory page (or<br /> FUSE-backed memory on systems where unprivileged userfaultfd is disabled)<br /> as the optval, an attacker can halt execution during the copy operation,<br /> keeping the lock held.<br /> <br /> Combined with asynchronous tear-down operations like shutdown(), this<br /> exhausts the kernel wq (kworkers) and triggers the hung task watchdog.<br /> <br /> [ 240.123456] INFO: task kworker/u8:2 blocked for more than 120 seconds.<br /> [ 240.123489] Call Trace:<br /> [ 240.123501] smc_shutdown+...<br /> [ 240.123512] lock_sock_nested+...<br /> <br /> This patch moves the user-space copy outside the lock_sock() critical<br /> section to prevent the issue.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tee: optee: prevent use-after-free when the client exits before the supplicant<br /> <br /> Commit 70b0d6b0a199 ("tee: optee: Fix supplicant wait loop") made the<br /> client wait as killable so it can be interrupted during shutdown or<br /> after a supplicant crash. This changes the original lifetime expectations:<br /> the client task can now terminate while the supplicant is still processing<br /> its request.<br /> <br /> If the client exits first it removes the request from its queue and<br /> kfree()s it, while the request ID remains in supp-&gt;idr. A subsequent<br /> lookup on the supplicant path then dereferences freed memory, leading to<br /> a use-after-free.<br /> <br /> Serialise access to the request with supp-&gt;mutex:<br /> <br /> * Hold supp-&gt;mutex in optee_supp_recv() and optee_supp_send() while<br /> looking up and touching the request.<br /> * Let optee_supp_thrd_req() notice that the client has terminated and<br /> signal optee_supp_send() accordingly.<br /> <br /> With these changes the request cannot be freed while the supplicant still<br /> has a reference, eliminating the race.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> erofs: fix use-after-free on sbi-&gt;sync_decompress<br /> <br /> z_erofs_decompress_kickoff() can race with filesystem unmount, causing<br /> a use-after-free on sbi-&gt;sync_decompress.<br /> <br /> When I/O completes, z_erofs_endio() calls z_erofs_decompress_kickoff()<br /> to queue z_erofs_decompressqueue_work() asynchronously. Then, after all<br /> folios are unlocked, unmount workflow can proceed and sbi will be freed<br /> before accessing to sbi-&gt;sync_decompress.<br /> <br /> Thread (unmount) I/O completion kworker<br /> queue_work<br /> z_erofs_decompressqueue_work<br /> (all folios are unlocked)<br /> cleanup_mnt<br /> ..<br /> erofs_kill_sb<br /> erofs_sb_free<br /> kfree(sbi)<br /> access sbi-&gt;sync_decompress // UAF!!

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: fix NULL-deref of opinfo-&gt;conn in oplock/lease break notifiers<br /> <br /> smb2_oplock_break_noti() and smb2_lease_break_noti() read opinfo-&gt;conn<br /> into a local with neither READ_ONCE() nor a NULL check. Both run from<br /> oplock_break() after opinfo_get_list() has dropped ci-&gt;m_lock, so a<br /> concurrent SMB2 LOGOFF (session_fd_check()) can set op-&gt;conn = NULL<br /> under ci-&gt;m_lock within that window. ksmbd_conn_r_count_inc(conn) then<br /> writes through NULL at offset 0xc4 -- a remotely triggerable oops.<br /> <br /> Guard both reads the way compare_guid_key() already does: read<br /> opinfo-&gt;conn with READ_ONCE() and return early if it is NULL, before<br /> allocating the work struct so nothing leaks. A NULL conn means the<br /> client is gone and the break is moot, so return 0; oplock_break() treats<br /> that as success and runs the normal teardown.