Vulnerabilities

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited denial-of-service attacks in DSM.

A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: mac80211: validate individual TWT params before driver setup<br /> <br /> ieee80211_process_rx_twt_action() only partially validates a received<br /> S1G TWT setup frame before queueing it.<br /> <br /> An individual agreement can therefore reach ieee80211_s1g_rx_twt_setup()<br /> with twt-&gt;length too short for the full struct ieee80211_twt_params.<br /> <br /> The individual path passes twt to drv_add_twt_setup(). Both the tracepoint<br /> and the driver callback consume the complete parameters block, not merely<br /> req_type. Do not pass a short individual agreement to the driver.<br /> Broadcast agreements remain unchanged because they are rejected locally<br /> after accessing only req_type.<br /> <br /> [edit commit message to not overclaim lack of validation nor<br /> understate driver impact]

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> of: reserved_mem: prevent OOB when too many dynamic regions are defined<br /> <br /> On boot, fdt_scan_reserved_mem() saves each dynamically-placed<br /> /reserved-memory subnode into a local array of size<br /> MAX_RESERVED_REGIONS.<br /> <br /> If the device tree defines more than MAX_RESERVED_REGIONS<br /> dynamically-placed regions, fdt_scan_reserved_mem() writes past the<br /> end of the local array.<br /> <br /> Add a bounds check that logs an error and skips the excess regions,<br /> restoring the original behavior.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ptp: vmclock: prevent read-only mappings from becoming writable<br /> <br /> vmclock_miscdev_mmap() rejects writable mappings of the shared vmclock<br /> ABI page with -EROFS, but leaves VM_MAYWRITE set. Userspace can map the<br /> page read-only and then upgrade it to writable with mprotect(), after<br /> which the guest can corrupt the host-written timekeeping data (sequence<br /> counter, UTC time, TSC offset) that the vmclock ABI defines as read-only.<br /> <br /> Clear VM_MAYWRITE on the read-only path so the mapping cannot be<br /> upgraded, as i915 does for its read-only objects and as fixed in drm/vc4<br /> (CVE-2026-68445) and drm/panthor (CVE-2024-53071).

Improper neutralization of input during web page generation (&amp;#39;cross-site scripting&amp;#39;) vulnerability in Tangible Loops &amp; Logic.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ipvs: do not propagate one-packet flag to synced conns<br /> <br /> Synced connections can be created before their destination exists. When<br /> the destination is later added, ip_vs_bind_dest() copies connection flags<br /> from the destination into cp-&gt;flags.<br /> <br /> IP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced<br /> connection inherits IP_VS_CONN_F_ONE_PACKET while it is already hashed,<br /> expiry can treat it as a one-packet connection and skip unlinking the<br /> existing conn_tab node, leaving stale hash nodes pointing at a freed<br /> struct ip_vs_conn.<br /> <br /> Drop IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced<br /> connections.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> igc: remove napi_synchronize() in igc_down()<br /> <br /> When an AF_XDP zero-copy application is killed abruptly, the XSK pool is<br /> torn down but NAPI keeps polling. igc_clean_rx_irq_zc() then returns the<br /> full budget on every poll, so napi_complete_done() never clears<br /> NAPI_STATE_SCHED.<br /> <br /> igc_down() calls napi_synchronize() before napi_disable(), so it spins<br /> forever waiting for that bit and the interface never goes down. Drop the<br /> napi_synchronize() and let napi_disable() do the job -- it sets<br /> NAPI_STATE_DISABLE, which forces the stuck poll to complete. Reorder it<br /> ahead of igc_set_queue_napi() so the NAPI mapping is cleared only after<br /> polling has stopped, matching the recent igb fix b1e067240379.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: pcm: wake linked drain waiters on unlink<br /> <br /> snd_pcm_drain() on a linked stream parks an on-stack wait entry on the<br /> drained peer&amp;#39;s runtime-&gt;sleep, and after schedule_timeout() removes it<br /> only if that peer is still found in the caller&amp;#39;s group. If group<br /> membership changes during the wait and the sleep ends by signal or<br /> timeout (so autoremove_wake_function() does not run), finish_wait() is<br /> skipped and snd_pcm_drain() returns with the entry still queued on that<br /> stream&amp;#39;s sleep list; a later wake_up() then walks a freed stack frame.<br /> This is reachable by unlinking either the drained or the draining stream.<br /> <br /> Unlike the close path (snd_pcm_drop() -&gt; snd_pcm_post_stop()),<br /> snd_pcm_unlink() never wakes the sleep queues. Wake every group member<br /> under the group lock before the membership change, so a linked drainer is<br /> released and drops its entry while the streams are still grouped.<br /> <br /> The window was opened when snd_pcm_link_rwsem stopped being held across<br /> the wait and the removal became conditional on group membership (see<br /> Fixes). The later switch to finish_wait() kept that conditional removal,<br /> so the signal/timeout case remained.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> sctp: validate Adaptation Indication parameter length<br /> <br /> The Adaptation Layer Indication parameter contains a fixed 32-bit<br /> Adaptation Code Point after its parameter header. However,<br /> sctp_verify_param() accepts a header-only parameter because the generic<br /> parameter walker only requires the header to be present.<br /> <br /> sctp_process_param() then reads adaptation_ind beyond the declared<br /> parameter. When the malformed parameter is last in an INIT, the read<br /> starts at the receive skb tail, and the value is copied into the state<br /> cookie returned in the INIT ACK. This may disclose four receive-buffer<br /> tail bytes.<br /> <br /> Require the declared parameter length to match the fixed structure size<br /> and abort the association through the existing invalid parameter length<br /> path otherwise.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()<br /> <br /> In pcpu_create_chunk(), nr_pages is the total contiguous backing<br /> allocation, i.e., nr_units * pcpu_unit_pages, but pcpu_chunk_populated()<br /> uses it to set chunk-&gt;populated, whose size is pcpu_unit_pages, bitmap. <br /> Since bit N in chunk-&gt;populated means page offset N inside every unit is<br /> backed. When nr_units &gt; 1, the function writes beyond chunk-&gt;populated. <br /> Fix it by using chunk-&gt;nr_pages.<br /> <br /> It also fixes the global pcpu_nr_empty_pop_pages accounting, since<br /> pcpu_balance_free() only iterates up to chunk-&gt;nr_pages.<br /> <br /> Commit a63d4ac4ab609 ("percpu: make percpu-km set chunk-&gt;populated bitmap<br /> properly") introduced the bitmap overflow issue. Later, commit<br /> b539b87fed37f ("percpu: implmeent pcpu_nr_empty_pop_pages and<br /> chunk-&gt;nr_populated") added pcpu_nr_empty_pop_pages and caused the<br /> accounting issue.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm: mglru: fix stale batch updates after memcg reparenting<br /> <br /> The mglru page table walker batches per-generation size deltas in<br /> walk-&gt;nr_pages while walking page tables without holding the lruvec lock. <br /> The reset_batch_size() later folds those deltas into walk-&gt;lruvec under<br /> the lruvec lock.<br /> <br /> The page table walker can run concurrently with the memcg reparenting path<br /> as follows:<br /> <br /> CPU0 CPU1<br /> ==== ====<br /> <br /> walk_mm<br /> --&gt; walk_page_range<br /> --&gt; update_batch_size<br /> --&gt; walk-&gt;nr_pages += delta<br /> <br /> mem_cgroup_css_offline<br /> --&gt; memcg_reparent_objcgs<br /> --&gt; lock lruvec<br /> lru_gen_reparent_memcg<br /> --&gt; reparent child folios to parent<br /> unlock lruvec<br /> <br /> lock lruvec<br /> reset_batch_size<br /> --&gt; child lrugen-&gt;nr_pages += delta<br /> <br /> This will trigger the following warning in lru_gen_exit_memcg():<br /> <br /> VM_WARN_ON_ONCE(memchr_inv(lruvec-&gt;lrugen.nr_pages, 0,<br /> sizeof(lruvec-&gt;lrugen.nr_pages)));<br /> <br /> And the user-visible impact of underestimated nr_pages in MGLRU was<br /> premature OOMs because MGLRU does not try to reclaim memory when nr_pages<br /> reaches zero, but there are still more pages.<br /> <br /> To fix it, make reset_batch_size() check CSS_DYING under RCU before<br /> flushing the pending batch. A non-dying memcg keeps the original lruvec<br /> stable against RCU-delayed offlining; a dying memcg redirects the deltas<br /> to the first non-dying ancestor.