A vulnerability was found in cgroupreleaseagentwrite in kernel/cgroup/cgroup-v1.c in the Linux kernel. In this flaw, under certain circumstances, the cgroups v1 releaseagent feature can be used to escalate privilege and bypass namespace isolation unexpectedly.

Upstream Commit:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=24f6008564183aa120d07c03d9289519c2fe02af

A use-after-free flaw was found in u32change in net/sched/clsu32.c in the network subcomponent of the Linux kernel. This flaw could allow a local attacker to crash the system and cause a privilege escalation, and a kernel information leak problem.

References and upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3db09e762dc79584a69c10d74a6b98f89a9979f8 https://kernel.dance/#3db09e762dc79584a69c10d74a6b98f89a9979f8

A flaw was found in the Linux kernels sysctl handling code for hugepages management. When multiple root level processes would write to modify the /proc/sys/vm/nrhugepages file it could create a race on internal variables leading to a system crash or memory corruption.

A flaw out of bound memory write in the Linux kernel BPF subsystem was found in the way user writes to BPF ring buffer too fast, so larger buffer than available memory could be allocated. A local user could use this flaw to crash the system or possibly escalate their privileges on the system.

A use-after-free exists in the Linux Kernel in tcnewtfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5

A flaw was found in the Linux kernels eBPF verification code. By default accessing the eBPF verifier is only accessible to privileged users with CAPSYSADMIN. A local user with the ability to insert eBPF instructions can use the eBPF verifier to abuse a spectre like flaw where they can infer all system memory.

In ioaddbuffers of iouring.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

In scalar32minmaxand and related functions of verifier.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-10d2bb2e6b1d.

Last updated 11 April 2025

A use-after-free flaw was found in vcsread in drivers/tty/vt/vcscreen.c in vcscreen in the Linux Kernel. In this flaw an attacker with local user access may ead to a system crash or a leak of internal kernel information.

Reference: https://www.spinics.net/lists/stable-commits/msg285184.html

Last updated 25 August 2025

FFmpeg before 4.2 has a heap-based buffer overflow in vqadecodechunk because of an out-of-array access in vqadecodeinit in libavcodec/vqavideo.c.

cbsjpegsplitfragment in libavcodec/cbsjpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEGMARKERSOS handling because of a missing length check.

In FFmpeg before 4.2, avcodecopen2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer.

FFmpeg 2.8 and 4.2.3 has a use-after-free via a crafted EXTINF duration in an m3u8 file because parseplaylist in libavformat/hls.c frees a pointer, and later that pointer is accessed in avprobeinputformat3 in libavformat/format.c.

Last updated 25 August 2025

In SQLite before 3.32.3 select.c mishandles query-flattener optimization leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.

A flaw use after free found in Linux Kernel mm/mremap memory address space accounting source code. If race condition happens between rmap walk and mremap, this can result in stale TLB entries.

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=97113eb39fa7972722ff490b947d8af023e1f6a2

A flaw was found in the Linux kernel implementation of userspace core dumps. This flaw allows anyone with access to core dumps to see a small amount of private kernel data about the current running kernels internal state which could be used to further allow an attack to more reliably execute. This information could be user processes or kernel state from previous executions.

References: https://github.com/google/kmsan/issues/76 https://twitter.com/grsecurity/status/1252558055629299712 https://github.com/ruscur/linux/commit/a95cdec9fa0c08e6eeb410d461c03af8fd1fef0a

An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to crashes and potential use-after-free conditions.

An issue was discovered in libexif before 0.6.22. Several buffer over-reads in EXIF MakerNote handling could lead to information disclosure and crashes. This is different from CVE-2020-0093.

Accessibility. A privacy issue was addressed with improved private data redaction for log entries.

A vulnerability was found in sgwrite in drivers/scsi/sg.c in SCSI generic (sg) driver subsystem. An attacker with a local access and special user privilege (or root) can cause a denial of service (DoS) if allocated list is not cleaned with invalid (Sgfd sfp) pointer at the time of failure, failing this can even cause a kernel internal information leak problem.

Reference and upstream commit: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=83c6f2390040f188cc25b270b4befeb5628c1aee

A flaw was found in the Linux kernel loose validation of child/parent process identification handling while filtering signal handlers. A local attacker is able to abuse this flaw to bypass checks to send any signal to a privileged process.

gadgetdevdescUDCstore in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an internal '\0' value, which allows attackers to trigger an out-of-bounds read, aka CID-15753588bcd4.

A use-after-free flaw was found in fs/ext4/namei.c:dxinsertblock() and a BUG() in fs/ext4/ext4.h:2057, It is tested on 4.14 and 5.16, it randomly got segmentation faults in either systemd or other libc functions after the bug is triggered twice or more with below traces.

================================================================== [ 99.129641] BUG: KASAN: use-after-free in dxinsertblock+0xf9/0x1e0 [ 99.129678] Read of size 199528 at addr ffff88825d339028 by task tmp32/1078

[ 99.129729] CPU: 3 PID: 1078 Comm: tmp32 Not tainted 5.4.171 #1 [ 99.129730] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 99.129731] Call Trace: [ 99.129734] dumpstack+0x8b/0xb9 [ 99.129736] ? dxinsertblock+0xf9/0x1e0 [ 99.129739] printaddressdescription.constprop.4+0x23/0x400 [ 99.129740] ? dxinsertblock+0xf9/0x1e0 [ 99.129742] kasanreport+0x15c/0x1e0 [ 99.129743] ? dxinsertblock+0xf9/0x1e0 [ 99.129744] kasanreport+0x10/0x20 [ 99.129746] checkmemoryregion+0x149/0x1a0 [ 99.129747] memmove+0x1f/0x50 [ 99.129748] dxinsertblock+0xf9/0x1e0 [ 99.129750] dosplit+0x105b/0x1bf0 [ 99.129754] ? ext4renamedirfinish+0x820/0x820 [ 99.129755] ext4dxaddentry+0x30b/0x2a20 [ 99.129757] ? condresched+0x15/0x30 [ 99.129759] ? getblkgfp+0x35/0x7f0 [ 99.129760] ? adddirenttobuf+0x630/0x630 [ 99.129761] ? memset+0x1f/0x40 [ 99.129763] ? fscryptsetupfilename+0x32/0xce0 [ 99.129765] ? ext4getblk+0x127/0x3d0 [ 99.129766] ? dosyscall64+0x9a/0x390 [ 99.129768] ? entrySYSCALL64afterhwframe+0x44/0xa9 [ 99.129769] ? ext4iomapbegin+0xf10/0xf10 [ 99.129771] ? addtransactioncredits+0x13d/0xaf0 [ 99.129772] ? memset+0x1f/0x40 [ 99.129773] ? ext4fnamesetupfilename+0xd1/0x1f0 [ 99.129775] ? memset+0x1f/0x40 [ 99.129776] ext4addentry+0x6c7/0xcd0 [ 99.129778] ? makeindexeddir+0x1130/0x1130 [ 99.129779] ? jbd2journalgetwriteaccess+0xaf/0x120 [ 99.129781] ? ext4journalgetwriteaccess+0x41/0x70 [ 99.129782] ? jbd2journalstart+0x2d6/0x760 [ 99.129784] ext4rename+0xef9/0x1e00 [ 99.129786] ? avchaspermnoaudit+0x1b3/0x380 [ 99.129787] ? ext4tmpfile+0x3a0/0x3a0 [ 99.129788] ? avchasextendedperms+0xe80/0xe80 [ 99.129790] ? selinuxpathnotify+0x460/0x460 [ 99.129792] vfsrename+0x84f/0x1550 [ 99.129794] ? tomoyocredprepare+0xb1/0x160 [ 99.129795] ? vfsmkdir+0x5a0/0x5a0 [ 99.129796] ? dalloc+0x56/0x210 [ 99.129797] ? dorenameat2+0x78a/0x970 [ 99.129798] dorenameat2+0x78a/0x970 [ 99.129800] ? userpathcreate+0x30/0x30 [ 99.129801] ? lockrefputreturn+0xd7/0x190 [ 99.129803] ? blkpreruntimesuspend+0x280/0x280 [ 99.129804] ? kmemcachealloc+0x177/0x220 [ 99.129805] ? mntgetcount+0x1e0/0x1e0 [ 99.129806] ? dput+0x5a/0x760 [ 99.129808] ? pathsetxattr+0xb9/0x130 [ 99.129809] ? setxattr+0x240/0x240 [ 99.129810] ? fgetlight+0x55/0x1f0 [ 99.129811] ? fgetlight+0x55/0x1f0 [ 99.129813] x64sysrename+0x5a/0x80 [ 99.129814] dosyscall64+0x9a/0x390 [ 99.129815] ? prepareexittousermode+0xec/0x1a0 [ 99.129817] entrySYSCALL64afterhwframe+0x44/0xa9 [ 99.129819] RIP: 0033:0x7f8665863639

A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way when reboot the system. A local user could use this flaw to crash the system or escalate their privileges on the system.

It was discovered that aufs improperly managed inode reference counts in the vfsubdentryopen() method. A local attacker could use this vulnerability to cause a denial of service attack.

A flaw integer overflow in the Linux kernel's virtual terminal keyboard driver was found in the way the user sends some specific keyboard code multiple times. A local user could use this flaw to crash the system or possibly escalate their privileges on the system.