thesmartshadow

C1 — cover letter re-read against the six patches that exist

Rewrote it. Subject is now [PATCH net-next v3 0/6] vxlan: vnifilter: bound a single request and account per-VNI memory. The full merged file is printed above. What changed (diff vs the previous version):

• Deleted the entire macro-flip paragraph — every mention of the tree-wide netdev_alloc_pcpu_stats() change, netdevice.h, qdisc_alloc()/tcf_idr_create(), and alloc_percpu().
• Patch 5 is now described as what it is: charges the per-VNI node and its per-CPU stats block at the vxlan call site.
• Added one-line descriptions of patches 2/3 and patch 6 so every patch is covered.
• Confirmed no ODEBUG / kobject / baseline / splat mention anywhere in the cover (grep returned none — they were only ever in the report, never the cover).
• No prose line exceeds 75 chars (only the two lore URLs, which are refs).

C2 — full test run redone on the 6-patch KASAN kernel (7-patch results discarded)

thesmartshadow

Summary

tar::Builder::append_dir_all() follows symlinks by default (follow = true). That behavior is documented, but the security issue is that dereferenced symlink targets are not checked against the source root passed to append_dir_all().

The function uses src_path as the logical archive boundary when building entry names:

let dest = path.join(src.strip_prefix(src_path).unwrap());

thesmartshadow

LiME disk dumps are created world-readable by default

Summary

LiME creates disk memory dump files with mode 0444. When a privileged operator uses LiME's documented disk acquisition flow and writes a new dump in a traversable directory such as /tmp, the resulting physical memory image is readable by every local user on the system.

Because LiME captures physical memory, the output can contain credentials,

thesmartshadow

CVE-2026-61371

Microsoft AVML symlink following on destination output open (CWE-59)

Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix. If the destination path is a symlink, AVML follows it and truncates or overwrites the symlink target. The destructive open happens through O_TRUNC at open time, and it occurs before the input is fully validated. An invalid input still leaves the target truncated to zero, which is why this is described as truncation before validation.

Affected and fixed

Affected: all versions before 0.17.0, including the 0.16.x line.

thesmartshadow

CVE-2025-59716 — ownCloud Guests pending-user enumeration via registration endpoint

Type: Information Disclosure (User Enumeration)
CWE: CWE-200 (Exposure of Sensitive Information) / CWE-203 (Observable Discrepancy)
Affected component: ownCloud Guests app
Tested on: ownCloud Server 10.11, Guests app v0.12.4, Apache HTTPD
Researcher: Ali Firas (@thesmartshadow)
Date: 2025-11-03

---

thesmartshadow

PoC: Incorrect Access Control in @digitalocean/do-markdownit

Summary

This repository demonstrates an Incorrect Access Control vulnerability in the @digitalocean/do-markdownit library (≤ 1.16.1).

Both the callout and fence_environment plugins expect allowedClasses and allowedEnvironments to be arrays of strings. If mistakenly provided as a string, the library applies .includes directly, resulting in substring matching instead of exact array comparison.