Dohyun Kim

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to the BPF timer functionality in the Linux kernel. When two or more timer callbacks are executed in parallel and attempt to cancel each other, it can lead to a deadlock situation. This happens because the `bpf timer cancel` function waits for the callback to finish executing, causing a lockup. To resolve this, an atomic counter named 'cancelling' is added to the `bpf hrtimer` to track outstanding cancellation requests. If there are any, the operation is failed with an error to prevent the deadlock. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Wyze Cam v3 (affected versions not specified) Description: This issue allows network-adjacent attackers to execute arbitrary code on affected devices without authentication. The vulnerability stems from a stack-based buffer overflow within the TUTK P2P library, resulting from insufficient validation of user-supplied data length before copying it into a fixed-length stack buffer. Successful exploitation allows an attacker to execute code in the context of root. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.