CWE-833
CVEs classified under CWE-833, newest first.
13 CVEsRSS
CVE-2026-46352High· 7.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, Suricata's IP defragmentation code could deadlock when processing…
CVE-2026-80938Medium· 5.5kernel: wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (CVE-2026-80938)
A flaw was found in the Linux kernel, specifically within the `mt7615` Wi-Fi driver. A deadlock can occur during system suspend operations when the suspend process attempts to acquire a mutex (a locking mechanism) while simultaneously wait…
CVE-2026-89732Medium· 4.1kernel: Kernel: USB FunctionFS deadlock via ep0 read loop (CVE-2026-89732)
A flaw was found in the Linux kernel's USB FunctionFS (f_fs) module. A local attacker could exploit a deadlock vulnerability in the ffs_ep0_read() function. This occurs when a userspace daemon polls ep0 and the USB gadget is simultaneously…
CVE-2026-89518Medium· 5.5kernel: sched_ext: Fix this_rq() assumptions in dispatch kfuncs (CVE-2026-89518)
A flaw was found in the Linux kernel's `sched_ext` component. Under core scheduling, incorrect assumptions in dispatch kfuncs regarding `this_rq()` can lead to a deadlock. This occurs when an `rq` lock is acquired on a CPU different from t…
CVE-2026-89589Medium· 4.4In the Linux kernel, the following vulnerability has been resolved: acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks The CXL CPER work registration and unregistration helpers acquire cxl_cper_work_lock and cxl_cper_prot_err_w…
In the Linux kernel, the following vulnerability has been resolved: acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks The CXL CPER work registration and unregistration helpers acquire cxl_cper_work_lock and cxl_cper_prot_err_w…
CVE-2026-80919Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format When dumping IB contents from a hung job, amdgpu_devcoredump_format() acquired the VM root PD's…
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format When dumping IB contents from a hung job, amdgpu_devcoredump_format() acquired the VM root PD's…
CVE-2026-56855Medium· 5.3golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages (CVE-2026-56855)
A flaw was found in golang.org/x/crypto/ssh. After a channel has been established, a remote malicious peer could send specially crafted messages. This could lead to a deadlock of the entire connection, resulting in a Denial of Service (DoS…
CVE-2026-78662Medium· 5.3golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via channel request flooding (CVE-2026-78662)
A flaw was found in golang.org/x/crypto/ssh. A malicious remote attacker could flood a channel's incoming requests before it is established, leading to a deadlock of the entire connection. This could result in a denial of service (DoS) for…
CVE-2026-10647Medium· 5.3The USB CDC-NCM device class (subsys/usb/device_next/class/usbd_cdc_ncm.c) ignores the return value of usbd_ep_enqueue() in its ethernet transmit callback cdc_ncm_send()
The USB CDC-NCM device class (subsys/usb/device_next/class/usbd_cdc_ncm.c) ignores the return value of usbd_ep_enqueue() in its ethernet transmit callback cdc_ncm_send(). When the enqueue fails, the function still calls k_sem_take(&data-…
CVE-2026-39830Critical· 9.1A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connec…
CVE-2026-44579High· 7.5PoCNext.js is a React framework for building full-stack web applications
Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 16.2.5, applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through cr…
CVE-2024-8447Medium· 5.9A security issue was discovered in the LRA Coordinator component of Narayana
A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the applicatio…
CVE-2024-0639Medium· 5.5A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem
A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially cr…