7534 matches found
CVE-2025-68781
CVE-2025-68781: In the Linux kernel, the usb: phy: fsl-usb driver has a race condition where a delayed work item (fsl_otg_event) can execute after the fsl_otg_dev object is freed during device removal, causing a use-after-free. The root cause is the delayed work being scheduled in fsl_otg_conf() ...
CVE-2025-68781 usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal
In the Linux kernel, the following vulnerability has been resolved: usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal The delayed work item otgevent is initialized in fslotgconf and scheduled under two conditions: 1. When a host controller binds to the OTG controller. 2...
CVE-2025-68781
In the Linux kernel, the following vulnerability has been resolved: usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal The delayed work item otgevent is initialized in fslotgconf and scheduled under two conditions: 1. When a host controller binds to the OTG controller. 2...
kernel: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths
A use-after-free vulnerability was found in the DWC3 USB controller driver in the Linux kernel. Multiple unsynchronized execution paths can invoke dwc3removerequests concurrently, leading to premature freeing of USB requests. When one path frees requests while another is still processing them, a...
ROS-20260113-7359
A vulnerability in the Linux operating system kernel UFS driver is related to thread locking errors. Exploitation of the vulnerability could allow an attacker to cause a denial of service...
CVE-2025-68656
Espressif ESP-IDF USB Host HID Human Interface Device Driver allows access to HID devices. Prior to 1.1.0, usbclassrequestgetdescriptor frees and reallocates hiddevice-ctrlxfer when an oversized descriptor is requested but continues to use the stale local pointer, leading to an immediate...
EUVD-2025-206281
Espressif ESP-IDF USB Host HID Human Interface Device Driver allows access to HID devices. Prior to 1.1.0, calls to hidhostdeviceclose can free the same usbtransfert twice. The USB event callback and user code share the hidifacet state without locking, so both can tear down a READY interface...
CVE-2025-68657
CVE-2025-68657 affects the ESP-IDF USB Host HID driver. Before version 1.1.0, hid_host_device_close() can free the same usb_transfer_t twice, and the USB event callback shares hid_iface_t state with user code without locking, allowing race conditions that may tear down a READY interface in parall...
CVE-2025-68656 Espressif ESP-IDF USB Host HID (Human Interface Device) Driver Descriptor Use-After-Free Vulnerability
Espressif ESP-IDF USB Host HID Human Interface Device Driver allows access to HID devices. Prior to 1.1.0, usbclassrequestgetdescriptor frees and reallocates hiddevice-ctrlxfer when an oversized descriptor is requested but continues to use the stale local pointer, leading to an immediate...
CVE-2025-68622
The CVE-2025-68622 affects Espressif ESP-IDF USB Host UVC Class Driver (esp-usb UVC host). A vulnerability in the UVC host parsing allows a malicious USB Video Class (UVC) device to cause a stack buffer overflow during configuration-descriptor parsing when UVC printing is enabled. A crafted descr...
EUVD-2025-206283
Espressif ESP-IDF USB Host UVC Class Driver allows video streaming from USB cameras. Prior to 2.4.0, a vulnerability in the esp-usb UVC host implementation allows a malicious USB Video Class UVC device to trigger a stack buffer overflow during configuration-descriptor parsing. When UVC...
CVE-2025-68622 Espressif ESP-IDF USB Host UVC Class Driver has a stack buffer overflow in UVC descriptor printing
Espressif ESP-IDF USB Host UVC Class Driver allows video streaming from USB cameras. Prior to 2.4.0, a vulnerability in the esp-usb UVC host implementation allows a malicious USB Video Class UVC device to trigger a stack buffer overflow during configuration-descriptor parsing. When UVC...
kernel: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths
A use-after-free vulnerability was found in the DWC3 USB controller driver in the Linux kernel. Multiple unsynchronized execution paths can invoke dwc3removerequests concurrently, leading to premature freeing of USB requests. When one path frees requests while another is still processing them, a...
kernel: media: rc: fix races with imon_disconnect()
A use-after-free flaw exists in the Linux kernel’s media/rc subsystem. When the device is disconnected via imondisconnect, the driver may unconditionally release a usbdevice reference via usbputdev even while other operations such as vfdwrite, sendpacket, displayopen, lcdwrite are still in...
PT-2026-2280
Name of the Vulnerable Software and Affected Versions Espressif ESP-IDF versions prior to 2.4.0 Description The ESP-IDF USB Host UVC Class Driver, used for video streaming from USB cameras, contains a flaw in the esp-usb UVC host implementation. A malicious USB Video Class UVC device can trigger ...
PT-2026-2285
Name of the Vulnerable Software and Affected Versions Espressif ESP-IDF versions prior to 1.1.0 Description The USB Host HID Human Interface Device Driver in ESP-IDF allows access to HID devices. Prior to version 1.1.0, the hid host device close function can free the same usb transfer t twice. Th...
CVE-2023-49213
The API endpoints in Ironman PowerShell Universal 3.0.0 through 4.2.0 allow remote attackers to execute arbitrary commands via crafted HTTP requests if a param block is used, due to invalid sanitization of input strings. The fixed versions are 3.10.2, 4.1.10, and 4.2.1...
CVE-2018-10465
Jamf Pro 10.x before 10.3.0 has Incorrect Access Control. Jamf Pro user accounts and groups with access to log in to Jamf Pro had full access to endpoints in the Universal API UAPI, regardless of account privileges or privilege sets. An authenticated Jamf Pro account without required privileges...