The CISA KEV Catalogue, Searchable

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

linux kernel 7.0.10, linux kernel 6.18.33, linux kernel 6.12.91, linux kernel 6.6.141, linux kernel 6.1.174 and 7 older

CISA due date

31 Oct 2026

Weakness

CWE-456

NVD Record · Vendor Advisory · Advisory 2 · Advisory 3 · More on Linux kernel

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

juniper junos 13.2, juniper junos 12.1, isc bind 9.10.2, isc bind 9.9.7, hpe vcx 9.8.18

CISA due date

11 Oct 2026

Weakness

CWE-19

NVD Record · Vendor Advisory · Advisory 2

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-imported file page, skb_store_bits() maps the frag page and copies the new MAC address directly into it. Ensure the ARP SHA range is writable before reading the ARP header and before calling skb_store_bits().

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

linux kernel 7.0.13, linux kernel 6.18.36, linux kernel 6.12.94, linux kernel 6.6.143, linux kernel 6.1.176 and 4 older

CISA due date

21 Sep 2026

Weakness

CWE-787

NVD Record · Vendor Advisory · More on Linux kernel

In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

linux kernel 7.1.3, linux kernel 6.18.38, linux kernel 6.12.95, linux kernel 6.6.144, linux kernel 6.1.177

CISA due date

30 Aug 2026

Weakness

CWE-787, CWE-122

NVD Record · Vendor Advisory · More on Linux kernel

An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

linux kernel 5.16.5, linux kernel 5.15.29, linux kernel 5.10.106

CISA due date

29 Aug 2026

Weakness

CWE-787

NVD Record · Vendor Advisory · More on Linux kernel

The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

CISA due date

9 Sep 2026

Weakness

CWE-59

NVD Record · Vendor Advisory

libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

libuser project libuser 0.60-7, libuser project libuser 0.56.13-8

CISA due date

9 Sep 2026

Weakness

CWE-264, CWE-367

NVD Record · Vendor Advisory

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

CISA due date

7 Aug 2026

Weakness

CWE-311

NVD Record · Vendor Advisory · More on Apache Tomcat

A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

linux kernel 5.16.6, linux kernel 5.15.20, linux kernel 5.10.97, linux kernel 5.4.177, linux kernel 4.19.229 and 2 older

CISA due date

5 Jun 2026

Weakness

CWE-287, CWE-862

NVD Record · Vendor Advisory · Advisory 2

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

linux kernel 6.19.12, linux kernel 6.18.22, linux kernel 6.12.85, linux kernel 6.6.137, linux kernel 6.1.170 and 7 older

CISA due date

15 May 2026

Weakness

CWE-669

NVD Record · Vendor Advisory · Advisory 2 · More on Linux kernel

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

roundcube webmail 1.6.11, roundcube webmail 1.5.10

CISA due date

13 Mar 2026

Weakness

CWE-502

NVD Record · Vendor Advisory · Advisory 2 · Advisory 3

An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

paloaltonetworks pan-os 8.1.7, paloaltonetworks pan-os 8.0.16, paloaltonetworks pan-os 7.1.23, f5 big-ip access policy manager 14.1.0.6, f5 big-ip access policy manager 14.0.1.1 and 7 older

CISA due date

16 Feb 2026

Weakness

CWE-190

NVD Record · Vendor Advisory · Advisory 2 · Advisory 3

A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

linux kernel 5.12, linux kernel 5.10.31, linux kernel 5.4.113, linux kernel 4.19.188, linux kernel 4.14.231 and 2 older

CISA due date

27 Oct 2025

Weakness

CWE-787

NVD Record · Vendor Advisory · Advisory 2 · Advisory 3

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

sudo project sudo 1.9.17

CISA due date

20 Oct 2025

Weakness

CWE-829

NVD Record · Vendor Advisory

Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

adminer 4.7.9

CISA due date

20 Oct 2025

Weakness

CWE-918

NVD Record · Vendor Advisory · More on Ubuntu / Debian packages

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

linux kernel 6.15.3, linux kernel 6.12.34, linux kernel 6.6.94, linux kernel 6.1.142, linux kernel 5.15.186 and 2 older

CISA due date

25 Sep 2025

Weakness

CWE-367

NVD Record · Vendor Advisory · Advisory 2 · More on Linux kernel

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

apple xcode 26.0, git-scm git 2.50.1, git-scm git 2.49.1, git-scm git 2.48.2, git-scm git 2.47.3 and 4 older

CISA due date

15 Sep 2025

Weakness

CWE-59, CWE-436

NVD Record · Vendor Advisory · Advisory 2 · Advisory 3 · More on Git

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

google chrome 138.0.7204.157, apple safari 18.6, apple ipados 18.6, apple iphone os 18.6, apple macos 15.6 and 4 older

CISA due date

12 Aug 2025

Weakness

CWE-20

NVD Record · Vendor Advisory · More on Ubuntu / Debian packages

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

rubyonrails rails 5.2.2.1, rubyonrails rails 5.1.6.2, rubyonrails rails 5.0.7.2, rubyonrails rails 4.2.11.1

CISA due date

28 Jul 2025

Weakness

CWE-22

NVD Record · Vendor Advisory · More on Ubuntu / Debian packages

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

linux kernel 6.1.9, linux kernel 5.15.91

CISA due date

8 Jul 2025

Weakness

CWE-282

NVD Record · Vendor Advisory · Advisory 2 · Advisory 3 · More on Ubuntu / Debian packages

An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

CISA due date

27 May 2025

Weakness

CWE-787

NVD Record · Vendor Advisory · More on Ubuntu / Debian packages

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configuration for allocating dev->config. This can lead to out-of-bounds accesses later, e.g. in usb_destroy_configuration.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

linux kernel 6.12.2, linux kernel 6.11.11, linux kernel 6.6.64, linux kernel 6.1.120, linux kernel 5.15.174 and 3 older

CISA due date

30 Apr 2025

Weakness

CWE-787

NVD Record · Vendor Advisory · Advisory 2 · More on Linux kernel

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.

What to do

Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.

Fixed in (NVD)

linux kernel 6.12.2, linux kernel 6.11.11, linux kernel 6.6.64, linux kernel 6.1.120, linux kernel 5.15.174 and 2 older

CISA due date

30 Apr 2025

Weakness

CWE-125

NVD Record · Vendor Advisory · Advisory 2 · More on Linux kernel

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Fixed in (NVD)

linux kernel 6.12.1, linux kernel 6.11.8, linux kernel 6.6.61, linux kernel 6.1.117, linux kernel 5.15.172 and 3 older

CISA due date

26 Feb 2025

Weakness

CWE-787

NVD Record · Vendor Advisory · More on Linux kernel

The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Fixed in (NVD)

apple safari 18.1.1, apple ipados 18.1.1, apple iphone os 18.1.1, apple ipados 17.7.2, apple iphone os 17.7.2 and 2 older

CISA due date

12 Dec 2024

NVD Record · Vendor Advisory · More on Ubuntu / Debian packages

Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.

What to do

The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Fixed in (NVD)

adobe flash player 12.0.0.70, adobe flash player 11.7.700.269, adobe flash player 11.2.202.341, adobe air sdk 4.0.0.1628, adobe air 4.0.0.1628

CISA due date

8 Oct 2024

Weakness

CWE-399

NVD Record · Vendor Advisory

Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.

What to do

The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Fixed in (NVD)

adobe flash player 11.6.602.171, adobe flash player 11.2.202.273, adobe flash player 10.3.183.67

CISA due date

8 Oct 2024

NVD Record · Vendor Advisory

The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.

What to do

The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Fixed in (NVD)

adobe flash player 11.6.602.171, adobe flash player 11.2.202.273, adobe flash player 10.3.183.67

CISA due date

8 Oct 2024

Weakness

CWE-264

NVD Record · Vendor Advisory

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Fixed in (NVD)

linux kernel 4.0.2, linux kernel 3.19.7, linux kernel 3.18.14, linux kernel 3.16.35, linux kernel 3.14.41 and 4 older

CISA due date

30 Sep 2024

Weakness

CWE-119

NVD Record · More on Linux kernel

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date

30 Sep 2024

Weakness

CWE-20

NVD Record

A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.

What to do

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

Fixed in (NVD)

linux kernel 5.16.2, linux kernel 5.15.16, linux kernel 5.10.93, linux kernel 5.4.173

CISA due date

11 Sep 2024

Weakness

CWE-190

NVD Record · More on Linux kernel

In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Fixed in (NVD)

linux kernel 6.9.4, linux kernel 6.6.34, linux kernel 6.1.94, linux kernel 5.15.161, linux kernel 5.10.219 and 2 older

CISA due date

28 Aug 2024

Weakness

CWE-416

NVD Record · Vendor Advisory · More on Linux kernel

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.

What to do

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

Fixed in (NVD)

siemens simatic s7-1500 tm mfp firmware 1.1, linux kernel 5.19.2, linux kernel 5.18.18, linux kernel 5.15.61, linux kernel 5.10.137 and 4 older

CISA due date

17 Jul 2024

Weakness

CWE-416

NVD Record · More on Linux kernel

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Fixed in (NVD)

linux kernel 6.7.3, linux kernel 6.6.15, linux kernel 6.1.76, linux kernel 5.15.149

CISA due date

20 Jun 2024

Weakness

CWE-416

NVD Record

Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Fixed in (NVD)

google chrome 116.0.5845.179, microsoft edge chromium 116.0.1938.76

CISA due date

27 Feb 2024

Weakness

CWE-843

NVD Record · More on Ubuntu / Debian packages

Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date

23 Jan 2024

Weakness

CWE-95

NVD Record · More on Ubuntu / Debian packages