Vulnerabilities

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vegagrup Software Vega Master allows Directory Indexing.This issue affects Vega Master: from v.1.12.35 through 20250916. <br /> <br /> NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp<br /> <br /> conn-&gt;chan_lock isn&amp;#39;t acquired before l2cap_get_chan_by_scid,<br /> if l2cap_get_chan_by_scid returns NULL, then &amp;#39;bad unlock balance&amp;#39;<br /> is triggered.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nfc: fix memory leak of se_io context in nfc_genl_se_io<br /> <br /> The callback context for sending/receiving APDUs to/from the selected<br /> secure element is allocated inside nfc_genl_se_io and supposed to be<br /> eventually freed in se_io_cb callback function. However, there are several<br /> error paths where the bwi_timer is not charged to call se_io_cb later, and<br /> the cb_context is leaked.<br /> <br /> The patch proposes to free the cb_context explicitly on those error paths.<br /> <br /> At the moment we can&amp;#39;t simply check &amp;#39;dev-&gt;ops-&gt;se_io()&amp;#39; return value as it<br /> may be negative in both cases: when the timer was charged and was not.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> md/raid10: fix leak of &amp;#39;r10bio-&gt;remaining&amp;#39; for recovery<br /> <br /> raid10_sync_request() will add &amp;#39;r10bio-&gt;remaining&amp;#39; for both rdev and<br /> replacement rdev. However, if the read io fails, recovery_request_write()<br /> returns without issuing the write io, in this case, end_sync_request()<br /> is only called once and &amp;#39;remaining&amp;#39; is leaked, cause an io hang.<br /> <br /> Fix the problem by decreasing &amp;#39;remaining&amp;#39; according to if &amp;#39;bio&amp;#39; and<br /> &amp;#39;repl_bio&amp;#39; is valid.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> media: hi846: Fix memleak in hi846_init_controls()<br /> <br /> hi846_init_controls doesn&amp;#39;t clean the allocated ctrl_hdlr<br /> in case there is a failure, which causes memleak. Add<br /> v4l2_ctrl_handler_free to free the resource properly.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: iwl4965: Add missing check for create_singlethread_workqueue()<br /> <br /> Add the check for the return value of the create_singlethread_workqueue()<br /> in order to avoid NULL pointer dereference.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: microchip: vcap api: Fix possible memory leak for vcap_dup_rule()<br /> <br /> Inject fault When select CONFIG_VCAP_KUNIT_TEST, the below memory leak<br /> occurs. If kzalloc() for duprule succeeds, but the following<br /> kmemdup() fails, the duprule, ckf and caf memory will be leaked. So kfree<br /> them in the error path.<br /> <br /> unreferenced object 0xffff122744c50600 (size 192):<br /> comm "kunit_try_catch", pid 346, jiffies 4294896122 (age 911.812s)<br /> hex dump (first 32 bytes):<br /> 10 27 00 00 04 00 00 00 1e 00 00 00 2c 01 00 00 .&amp;#39;..........,...<br /> 00 00 00 00 00 00 00 00 18 06 c5 44 27 12 ff ff ...........D&amp;#39;...<br /> backtrace:<br /> [] __kmem_cache_alloc_node+0x274/0x2f8<br /> [] kmalloc_trace+0x38/0x88<br /> [] vcap_dup_rule+0x50/0x460<br /> [] vcap_add_rule+0x8cc/0x1038<br /> [] test_vcap_xn_rule_creator.constprop.0.isra.0+0x238/0x494<br /> [] vcap_api_rule_remove_in_front_test+0x1ac/0x698<br /> [] kunit_try_run_case+0xe0/0x20c<br /> [] kunit_generic_run_threadfn_adapter+0x50/0x94<br /> [] kthread+0x2e8/0x374<br /> [] ret_from_fork+0x10/0x20

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> f2fs: fix kernel crash due to null io-&gt;bio<br /> <br /> We should return when io-&gt;bio is null before doing anything. Otherwise, panic.<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000010<br /> RIP: 0010:__submit_merged_write_cond+0x164/0x240 [f2fs]<br /> Call Trace:<br /> <br /> f2fs_submit_merged_write+0x1d/0x30 [f2fs]<br /> commit_checkpoint+0x110/0x1e0 [f2fs]<br /> f2fs_write_checkpoint+0x9f7/0xf00 [f2fs]<br /> ? __pfx_issue_checkpoint_thread+0x10/0x10 [f2fs]<br /> __checkpoint_and_complete_reqs+0x84/0x190 [f2fs]<br /> ? preempt_count_add+0x82/0xc0<br /> ? __pfx_issue_checkpoint_thread+0x10/0x10 [f2fs]<br /> issue_checkpoint_thread+0x4c/0xf0 [f2fs]<br /> ? __pfx_autoremove_wake_function+0x10/0x10<br /> kthread+0xff/0x130<br /> ? __pfx_kthread+0x10/0x10<br /> ret_from_fork+0x2c/0x50<br />

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> media: bdisp: Add missing check for create_workqueue<br /> <br /> Add the check for the return value of the create_workqueue<br /> in order to avoid NULL pointer dereference.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> samples/bpf: Fix fout leak in hbm&amp;#39;s run_bpf_prog<br /> <br /> Fix fout being fopen&amp;#39;ed but then not subsequently fclose&amp;#39;d. In the affected<br /> branch, fout is otherwise going out of scope.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale<br /> <br /> Running the &amp;#39;kfree_rcu_test&amp;#39; test case [1] results in a splat [2].<br /> The root cause is the kfree_scale_thread thread(s) continue running<br /> after unloading the rcuscale module. This commit fixes that isue by<br /> invoking kfree_scale_cleanup() from rcu_scale_cleanup() when removing<br /> the rcuscale module.<br /> <br /> [1] modprobe rcuscale kfree_rcu_test=1<br /> // After some time<br /> rmmod rcuscale<br /> rmmod torture<br /> <br /> [2] BUG: unable to handle page fault for address: ffffffffc0601a87<br /> #PF: supervisor instruction fetch in kernel mode<br /> #PF: error_code(0x0010) - not-present page<br /> PGD 11de4f067 P4D 11de4f067 PUD 11de51067 PMD 112f4d067 PTE 0<br /> Oops: 0010 [#1] PREEMPT SMP NOPTI<br /> CPU: 1 PID: 1798 Comm: kfree_scale_thr Not tainted 6.3.0-rc1-rcu+ #1<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015<br /> RIP: 0010:0xffffffffc0601a87<br /> Code: Unable to access opcode bytes at 0xffffffffc0601a5d.<br /> RSP: 0018:ffffb25bc2e57e18 EFLAGS: 00010297<br /> RAX: 0000000000000000 RBX: ffffffffc061f0b6 RCX: 0000000000000000<br /> RDX: 0000000000000000 RSI: ffffffff962fd0de RDI: ffffffff962fd0de<br /> RBP: ffffb25bc2e57ea8 R08: 0000000000000000 R09: 0000000000000000<br /> R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000<br /> R13: 0000000000000000 R14: 000000000000000a R15: 00000000001c1dbe<br /> FS: 0000000000000000(0000) GS:ffff921fa2200000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: ffffffffc0601a5d CR3: 000000011de4c006 CR4: 0000000000370ee0<br /> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000<br /> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400<br /> Call Trace:<br /> <br /> ? kvfree_call_rcu+0xf0/0x3a0<br /> ? kthread+0xf3/0x120<br /> ? kthread_complete_and_exit+0x20/0x20<br /> ? ret_from_fork+0x1f/0x30<br /> <br /> Modules linked in: rfkill sunrpc ... [last unloaded: torture]<br /> CR2: ffffffffc0601a87<br /> ---[ end trace 0000000000000000 ]---