NetAlertX is a network, presence scanner, and alert framework. Prior to version 25.6.7, a vulnerability in the authentication logic allows users to bypass password verification using SHA-256 magic hashes, due to loose comparison in PHP. In vulnerable versions of the application, a password comparison is performed using the `==` operator at line 40 in front/index.php. This introduces a security issue where specially crafted "magic hash" values that evaluate to true in a loose comparison can bypass authentication. Because of the use of `==` instead of the strict `===`, different strings that begin with 0e and are followed by only digits can be interpreted as scientific notation (i.e., zero) and treated as equal. This issue falls under the Login Bypass vulnerability class. Users with certain "weird" passwords that produce magic hashes are particularly affected. Services relying on this logic are at risk of unauthorized access. Version 25.6.7 fixes the vulnerability.
Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery.
A security vulnerability in Sharable Password Protected Posts before version 1.1.1 (CVSS 7.5) that allows access. Risk factors: public PoC available.
We need to produce a JSON object with the specified fields, synthesizing the data. Given CVE-2025-49414: Description: Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Gallery allows Using Malicious Files. This issue affects FW Gallery: from n/a through 8.0.0. CVSS Score: 10.0 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CWE: CWE-434 EPSS: 0.07% (22nd percentile) Tags: File Upload References: patchstack.com url (two similar), and NVD URL. No KEV mention, no POC mention, no patch availability mentioned explicitly. The patchstack references likely detail the vulnerability but we don't have patch info in the input. I'll need to infer that the vendor may have a fix, but no exact version is provided in the input data. Key points: - product_name: "FW Gallery" (WordPress plugin) - summary: synthesize. Not copy description. Start with impact: "Arbitrary file upload in FW Gallery WordPress plugin versions <= 8.0.0 allows unauthenticated attackers to upload malicious files, leading to remote code execution and full site compromise." Mention that there is no KEV, no known POC, EPSS low. Note that CVSS 10.0 suggests critical risk but EPSS suggests low exploitation probability. - technical_context: CWE-434 Unrestricted File Upload. The plugin handles file uploads without proper validation. CPE string: likely cpe:2.3:a:fastw3b:fw_gallery, but not provided. We can mention it's a WordPress plugin. Explain that under WordPress, uploaded PHP files can be executed, leading to RCE. - risk_assessment: CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) with scope change, so the vulnerability affects the web server possibly beyond the plugin. EPSS 0.07% (low exploitation probability). No KEV, no POC. So real-world risk: low probability of exploitation despite critical severity. SSVC: maybe not actively exploited, automatable (likely). - affected_products: FW Gallery plugin for WordPress, versions from n/a through 8.0.0. Mention advisory link: https://patchstack.com/database/wordpress/plugin/fw-gallery/vulnerability/wordpress-fw-gallery-8-0-0-arbitrary-file-upload-vulnerability?_s_id=cve - remediation: No patch version provided in input, but patchstack advisory might contain fix. Since the input only says "patch available" per vendor advisory? Actually, in the references, there's no explicit patch status. I need to check: patchstack usually provides a fix version, but the input doesn't give one. So I'll say "Upgrade FW Gallery to the latest patched version once released by the developer or apply temporary mitigation." But the CVE description says through 8.0.0. Could be that version 8.0.0 is the vulnerable, and maybe there's a 8.0.1 or later. But not in input. So I'll state: "No patched version confirmed in available data; contact vendor or apply Web Application Firewall rules to block malicious file uploads." I'll not invent version. Workarounds: "Disable the plugin until a fix is available, or restrict file upload capabilities to authenticated users only if possible." This is a WordPress plugin, so typical mitigation: disable it. - exploit_scenario: Attacker sends a crafted HTTP request to the vulnerable endpoint to upload a PHP webshell, then accesses it to execute arbitrary commands on the web server. No POC known, but AC:L suggests easy. - exploitation_conditions: "No special conditions — remote unauthenticated exploitation against default configurations of FW Gallery plugin version 8.0.0 and earlier." Since CVSS says PR:N/UI:N, unauthenticated. The description says "unrestricted upload of file with dangerous type" so likely the upload endpoint is accessible without authentication. Could be that the plugin's file upload endpoint doesn't require authentication, or the check is bypassed. So no specific configuration required. I'll note that the vulnerability is exploitable in default installations. But I need to be precise: the CVSS indicates no privileges required, no user interaction, so likely. I'll state: "No special conditions — remote unauthenticated exploitation against default installations of FW Gallery plugin up to 8.0.0." - attack_chain: Send crafted multipart request with malicious file → Unrestricted file upload bypass → File saved in accessible directory → Execute uploaded script → Gain web server control. (5 steps). I'll phrase as: "Send crafted HTTP request to upload endpoint → Upload malicious PHP file without validation → Access uploaded file via direct URL → Execute arbitrary code → Achieve full server compromise". Make it 5 steps. - confidence_notes: "CVE description and patchstack advisory confirm unauthenticated file upload. EPSS score indicates low exploitation likelihood. No public POC or active exploitation identified. Patch status not independently confirmed — patchstack advisory may contain fix version." I need to be specific: "Vendor advisory (Patchstack) confirms vulnerability but no exact patch version provided in this dataset; fix version may exist. No KEV listing." Actually, I'll check the reference: "patchstack.com/database/wordpress/plugin/fw-gallery/vulnerability/wordpress-fw-gallery-8-0-0-arbitrary-file-upload-vulnerability" – likely that includes fix info. So I can say "Patchstack advisory likely details a fix, but exact patched version not available in the provided data." - prevalence: WordPress plugin, FW Gallery. Unknown popularity; I'll estimate "medium" (common but not everywhere). Prevalence_basis: "WordPress plugin with some user base, but not extremely widespread." I'll go with "medium" and justification "popular WordPress plugin with a moderate user base". Actually, I can't be sure. Could be low. But since it's a commercial plugin? "FW Gallery" might be a gallery plugin, not in the top list. I'll say "unknown" because I have no installation numbers. The prevalence field says ONE word from set, so I can put "unknown" and prevalence_basis "insufficient data to estimate deployment scale". That's safe. The instruction says if genuinely cannot estimate output 'unknown'. I'll do that. - assessed_cvss_vector: I need my own vector. The provided CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. That sounds reasonable for unauthenticated file upload. I'll keep it but might tweak. Since no specific conditions, I'll use that same vector. But I'll assess: AV:N (network exploitable), AC:L (low complexity), PR:N (no privileges required), UI:N (no user interaction), Scope: Changed (the vulnerable component is the plugin, but the impact is on the web server, so S:C). Impact: High for C, I, A. That matches. So I'll use: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Rationale: "No authentication required, network vector, low complexity; scope change from plugin to server leading to full compromise." - assessed_cvss40_vector: Convert. CVSS 4.0: AV:N (Network) -> AV:N, AC:L -> AC:L, AT:N (no attack requirements), PR:N, UI:N, VC:H, VI:H, VA:H (since vulnerable system is the plugin? Actually scope changed: the vulnerable component is the plugin, but the attack impacts the web server. In CVSS 4.0, we have Vulnerable System confidentiality/integrity/availability (VC, VI, VA) and Subsequent System (SC, SI, SA). For a scope change, we need to assign impact to both. Since the plugin is the vulnerable component, and the attack compromises the server (subsequent system) with full high impact. The vulnerable component itself might also have high impact? Typically, file upload in plugin might allow compromise of the plugin's data, but full server compromise. I'll set VC:H, VI:H, VA:H (since the vulnerability allows modifying plugin files, database, etc.), and SC:H, SI:H, SA:H (server compromise). That's typical for file upload leading to RCE. So: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Also need to note Attack Requirements: none, so AT:N. That's fine. Rationale for CVSS 4.0: "Full compromise of both the plugin and the underlying server due to arbitrary code execution." I'll include the vector. Now, all fields as plain text. I'll craft the JSON. - summary: "Arbitrary file upload in FW Gallery WordPress plugin versions up to 8.0.0 allows unauthenticated attackers to upload malicious PHP files and execute code on the server, leading to complete site takeover. CVSS 10.0 signals critical severity, but EPSS score of 0.07% indicates low likelihood of real-world exploitation; no public exploit code or active exploitation has been identified at time of analysis." - technical_context: "CWE-434: Unrestricted Upload of File with Dangerous Type. The FW Gallery plugin (cpe:2.3:a:fastw3b:fw_gallery) fails to validate file types during upload, allowing PHP scripts or other executable files to be stored in a web-accessible directory. In WordPress, such files can be directly accessed and executed, leading to remote code execution." - risk_assessment: "CVSS 10.0 reflects network-accessible, low-complexity, unauthenticated exploitation with full system compromise. However, EPSS probability of exploitation is only 0.07% (22nd percentile), suggesting that despite high severity, the vulnerability is not being actively targeted. No CISA KEV entry and no public exploit code reduce immediate risk. Risk is high if exploited, but current threat activity is low." - affected_products: "FW Gallery plugin for WordPress, versions from unknown through 8.0.0 inclusive. The vendor advisory is available at Patchstack: https://patchstack.com/database/wordpress/plugin/fw-gallery/vulnerability/wordpress-fw-gallery-8-0-0-arbitrary-file-upload-vulnerability?_s_id=cve." - remediation: "Upgrade FW Gallery to a patched version beyond 8.0.0 when released by Fastw3b; the Patchstack advisory likely provides the exact fix version. If no patch is available, disable the FW Gallery plugin entirely until a fix is deployed. Apply a Web Application Firewall (WAF) rule to block uploads of executable file types (e.g., .php, .phtml) to the plugin's upload endpoint. Note that WAF may be bypassed if filename manipulation is used; plugin deactivation is the most effective interim measure." - exploit_scenario: "An unauthenticated attacker sends a crafted multipart HTTP request to the vulnerable file upload endpoint, uploading a PHP webshell. The attacker then navigates to the uploaded file's URL to execute commands, gaining full control of the WordPress server." - exploitation_conditions: "No special conditions — remote unauthenticated exploitation against default configurations of FW Gallery plugin version 8.0.0 and earlier." - attack_chain: "Send crafted HTTP request to upload endpoint → Upload malicious PHP file due to missing type validation → File stored in web-accessible directory → Access uploaded file via direct URL → Execute arbitrary code → Achieve full server compromise" - confidence_notes: "Vulnerability confirmed by Patchstack advisory; CVSS vector and description confirm unauthenticated access and full scope change. No public POC or KEV listing identified. Exact patch version not specified in provided data; check Patchstack for newer version." - prevalence: "unknown" - prevalence_basis: "insufficient data to estimate deployment scale" - assessed_cvss_vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" - assessed_cvss_rationale: "Unrestricted file upload via network, no authentication or user interaction, and full impact to both plugin and server." - assessed_cvss40_vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" Now, format JSON. Ensure all fields are plain text strings. The attack_chain is a chain with arrows, so no bullet points. I'll make it: "Send crafted HTTP request to upload endpoint → Upload malicious PHP file due to missing type validation → File stored in web-accessible directory → Access uploaded file via direct URL → Execute arbitrary code → Achieve full server compromise
Remote code execution in LogisticsHub WordPress theme allows unauthenticated attackers to upload arbitrary files, including web shells, enabling full server compromise. Affected versions range from n/a through 1.1.6. This vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and has a CVSS base score of 10.0, though the EPSS exploitation probability is low (0.07%); no active exploitation or public proof-of-concept has been confirmed at the time of analysis.
Remote code execution in Easy Stripe WordPress plugin version 1.1 and earlier allows unauthenticated attackers to inject and execute arbitrary code on the underlying server. The vulnerability has a critical CVSS score of 10.0 but EPSS indicates a low exploitation probability (0.07%), and no active exploitation has been reported.
Unauthenticated object injection in the WooCommerce Product Multi-Action WordPress plugin up to version 1.3 allows remote attackers to achieve arbitrary code execution, data theft, and full site compromise via deserialization of untrusted user-supplied data. The vulnerability is exploitable over the network with no user interaction or privileges, carrying a CVSS score of 9.8. At present, no active exploitation or public exploit code is known, and the EPSS (0.11%) suggests low near-term exploitation probability.
Privilege escalation in Service Finder Booking plugin for WordPress allows unauthenticated attackers to gain full administrative control. This vulnerability, affecting all versions up to 6.0, arises from incorrect privilege assignment (CWE-266) and carries a CVSS score of 9.8, though EPSS indicates a low exploitation probability (0.08%) with no public exploit or active exploitation known.
Unprivileged attackers can gain administrative control of WordPress sites running InspiryThemes RealHomes up to version 4.4.0 by exploiting an incorrect privilege assignment vulnerability. No authentication or user interaction is required, leading to full site compromise with a CVSS 9.8 critical rating. While no active exploitation is known and EPSS probability is low, the flaw is reachable over the network if user registration is enabled.
Whale browser for iOS before 3.9.1.4206 allow an attacker to execute malicious scripts in the browser via a crafted javascript scheme.
User-controlled inputs are improperly escaped in: * VotePage.php (poll option input) * ResultPage::getPagesTab() and getErrorsTab() (user-controllable page names) This allows attackers to inject JavaScript and compromise user sessions under certain conditions. This issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
SQL injection in the Click & Pledge Connect WordPress plugin allows unauthenticated attackers to escalate privileges and potentially compromise affected sites. The vulnerability exists in versions 25.04010101 through WP6.8 and carries a critical CVSS score due to its full technical impact and easy exploitability, though no public exploit or active exploitation has been observed.
Unauthenticated SQL injection in the designthemes LMS WordPress theme through version 9.1 allows remote attackers to extract arbitrary data from the database, potentially exposing sensitive user information or causing limited availability impact via scope change. Exploitation requires no user interaction or privileges, but EPSS score of 0.04% indicates low likelihood of future exploitation, and no active exploitation has been confirmed.
Unauthenticated SQL injection vulnerability in the NGG Smart Image Search WordPress plugin up to version 3.4.1 allows remote attackers to execute arbitrary SQL commands, primarily compromising database confidentiality. While rated Critical (CVSS 9.3) with a network attack vector, the EPSS probability of exploitation is only 0.04%, and no public exploits or active exploitation have been reported.
Unauthenticated SQL injection in the WordPress plugin Video List Manager through version 1.7 allows remote attackers to execute arbitrary SQL commands on the backing database, leading to exposure of sensitive data and potential partial denial of service. No authentication or user interaction is required, and the attack vector is network-accessible, but the EPSS exploitation probability is very low (0.04%), and no active exploitation or public exploit code is known at this time.
Blind SQL injection in bSecure – Your Universal Checkout WordPress plugin allows unauthenticated remote attackers to exfiltrate sensitive database contents, including user credentials and order data, via crafted HTTP requests to the checkout endpoint. The vulnerability affects all plugin versions up to 1.7.9 and requires no user interaction or special privileges. While no active exploitation or public exploit is currently known (EPSS 0.04%, not listed in CISA KEV), the CVSS 9.3 critical score reflects the high ease of exploitation and severe confidentiality impact across a changed scope, making patching a high priority.
Arbitrary file upload vulnerability in the Bulk Featured Image WordPress plugin (versions up to 1.2.1) allows authenticated attackers with high privileges to upload malicious files, such as web shells, leading to remote code execution on the server. The flaw has a CVSS score of 9.1 due to an unrestricted file upload mechanism; however, no active exploitation has been confirmed and the EPSS exploitation probability is very low (0.07%).
PHP object injection in the Red Art WordPress theme allows authenticated attackers to execute arbitrary code. The vulnerability, caused by deserialization of untrusted data (CWE-502), affects all versions up to 3.7. A low-privileged user can supply a malicious serialized payload to trigger object injection, leading to complete site compromise. No active exploitation or public exploit code has been identified, and EPSS indicates low exploitation probability.
The WP Human Resource Management plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the ajax_insert_employee() and update_empoyee() functions in versions 2.0.0 through 2.2.17. The AJAX handler reads the client-supplied $_POST['role'] and, after basic cleaning via hrm_clean(), passes it directly to wp_insert_user() and later to $user->set_role() without verifying that the current user is allowed to assign that role. This makes it possible for authenticated attackers, with Employee-level access and above, to elevate their privileges to administrator.
A security vulnerability in autocomplete endpoint within the RestAPI of Checkmk (CVSS 8.8) that allows an authenticated user. High severity vulnerability requiring prompt remediation.
Cryptographic key derivation failure in libssh versions prior to 0.11.2 (when built against OpenSSL older than 3.0) can cause SSH sessions to proceed with uninitialized key material, allowing remote attackers to undermine session confidentiality and integrity. The flaw stems from inverted return-value semantics between OpenSSL and libssh in ssh_kdf(), so a silent KDF failure is treated as success. No public exploit identified at time of analysis and EPSS risk is low (0.07%), but the issue is widely shipped across Red Hat, Ubuntu, Debian and SUSE distributions and has vendor patches available.
ArchivePage.php, UnarchivePage.php, and VoterEligibilityPage#executeClear() do not validate request methods or CSRF tokens, allowing attackers to trigger sensitive actions if an admin visits a malicious site. This issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
CVE-2025-53366 is a security vulnerability (CVSS 8.7). High severity vulnerability requiring prompt remediation.
The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.10.0, if a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught ClosedResourceError on the server side, causing the server to crash and requiring a restart to restore service. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. Version 1.10.0 contains a patch for the issue.
Authenticated SQL injection in the Simple Link Directory WordPress plugin up to version 14.7.3 allows low-privileged users to exfiltrate sensitive database contents. No public exploit or active exploitation has been confirmed, and the EPSS score of 0.04% indicates a very low likelihood of real-world attacks despite a CVSS 8.5 rating.
SQL injection in the Printcart Web to Print Product Designer for WooCommerce plugin (versions up to 2.4.0) enables authenticated attackers with low privileges to execute arbitrary SQL commands, potentially exposing sensitive database contents. Exploitation requires no user interaction and carries high confidentiality impact, though no active exploitation (CISA KEV) or public exploit code is known at this time. The low attack complexity and network attack vector make this a serious risk for WooCommerce stores using the vulnerable plugin.
SQL injection in the gopiplus Pixelating image slideshow gallery WordPress plugin (versions ≤ 8.0) allows authenticated attackers with low privileges to execute arbitrary SQL queries, enabling unauthorized extraction of sensitive database information and potential disruption via costly queries. No public
Authenticated SQL injection in iFrame Images Gallery plugin up to version 9.0 allows any user with subscriber-level access to extract sensitive information from the WordPress database, including password hashes. No public exploit or active exploitation has been confirmed, and the EPSS score is extremely low (0.04%), indicating minimal real-world exploitation activity at this time.
Blind SQL injection in the Cool fade popup WordPress plugin allows authenticated low-privilege attackers to extract sensitive data from the database. The vulnerability affects all versions up to 10.1. Exploitation requires only subscriber-level access and no user interaction, making it easily exploitable once authenticated, though EPSS score is low (0.04%) and no public exploit or active exploitation is known.
SQL injection in the cybio Gallery Widget plugin for WordPress up to version 1.2.1 allows authenticated attackers with low privileges (e.g., Subscriber) to extract sensitive database information and cause limited availability disruptions. No active exploitation or public exploit is known, and the EPSS exploitation probability is very low (0.04%).
SQL injection in the Contact Us page – Contact people LITE WordPress plugin allows authenticated low-privileged users to extract sensitive data from the WordPress database. Versions through 3.7.4 are affected; an attacker needs a valid subscriber-level (or higher) account to exploit it. EPSS probability is very low, and no active exploitation or public exploit code has been identified.
A vulnerability has been found in IROAD Dashcam Q9 up to 20250624 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component MFA Pairing Request Handler. The manipulation leads to allocation of resources. The attack needs to be done within the local network. The vendor was contacted early about this disclosure but did not respond in any way.
Unauthenticated local file inclusion in Kossy WordPress Theme up to version 1.45 allows attackers to include arbitrary local files, potentially leading to remote code execution and full site compromise. The vulnerability has a high CVSS score (8.1) but a low EPSS exploitation probability (0.13%); no active exploitation has been confirmed in the wild. A patch has not been publicly identified.
A security vulnerability in cmsmasters CMSMasters Content Composer allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
A security vulnerability in Missing Authorization vulnerability in pietro MobiLoud (CVSS 8.1). High severity vulnerability requiring prompt remediation.
The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4. This is due to an insecure OAuth implementation, as the 'redirect_uri' parameter is missing validation during the authorization flow. This makes it possible for unauthenticated attackers to intercept the authorization code and obtain an access token by redirecting the user to an attacker-controlled URI. Note: OAuth is disabled, the 'Meow_MWAI_Labs_OAuth' class is not loaded in the plugin in the patched version 2.8.5.
OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. In version 4.5.0, using a specially crafted tee-supplicant binary running in REE userspace, an attacker can trigger a panic in a TA that uses the libutee Secure Storage API. Many functions in libutee, specifically those which make up the Secure Storage API, will panic if a system call returns an unexpected return code. This behavior is mandated by the TEE Internal Core API specification. However, in OP-TEE’s implementation, return codes of secure storage operations are passed through unsanitized from the REE tee-supplicant, through the Linux kernel tee-driver, through the OP-TEE kernel, back to libutee. Thus, an attacker with access to REE userspace, and the ability to stop tee-supplicant and replace it with their own process (generally trivial for a root user, and depending on the way permissions are set up, potentially available even to less privileged users) can run a malicious tee-supplicant process that responds to storage requests with unexpected response codes, triggering a panic in the requesting TA. This is particularly dangerous for TAs built with `TA_FLAG_SINGLE_INSTANCE` (corresponding to `gpd.ta.singleInstance` and `TA_FLAG_INSTANCE_KEEP_ALIVE` (corresponding to `gpd.ta.keepAlive`). The behavior of these TAs may depend on memory that is preserved between sessions, and the ability of an attacker to panic the TA and reload it with a clean memory space can compromise the behavior of those TAs. A critical example of this is the optee_ftpm TA. It uses the kept alive memory to hold PCR values, which crucially must be non-resettable. An attacker who can trigger a panic in the fTPM TA can reset the PCRs, and then extend them PCRs with whatever they choose, falsifying boot measurements, accessing sealed data, and potentially more. The impact of this issue depends significantly on the behavior of affected TAs. For some, it could manifest as a denial of service, while for others, like the fTPM TA, it can result in the disclosure of sensitive data. Anyone running the fTPM TA is affected, but similar attacks may be possible on other TAs that leverage the Secure Storage API. A fix is available in commit 941a58d78c99c4754fbd4ec3079ec9e1d596af8f.
In the Linux kernel, the following vulnerability has been resolved: media: vidtv: Terminating the subsequent process of initialization failure syzbot reported a slab-use-after-free Read in vidtv_mux_init. [1] After PSI initialization fails, the si member is accessed again, resulting in this uaf. After si initialization fails, the subsequent process needs to be exited. [1] BUG: KASAN: slab-use-after-free in vidtv_mux_pid_ctx_init drivers/media/test-drivers/vidtv/vidtv_mux.c:78 [inline] BUG: KASAN: slab-use-after-free in vidtv_mux_init+0xac2/0xbe0 drivers/media/test-drivers/vidtv/vidtv_mux.c:524 Read of size 8 at addr ffff88802fa42acc by task syz.2.37/6059 CPU: 0 UID: 0 PID: 6059 Comm: syz.2.37 Not tainted 6.14.0-rc5-syzkaller #0 Hardware name: Google Compute Engine, BIOS Google 02/12/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xd9/0x110 mm/kasan/report.c:634 vidtv_mux_pid_ctx_init drivers/media/test-drivers/vidtv/vidtv_mux.c:78 vidtv_mux_init+0xac2/0xbe0 drivers/media/test-drivers/vidtv/vidtv_mux.c:524 vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 vidtv_start_feed drivers/media/test-drivers/vidtv/vidtv_bridge.c:239 dmx_section_feed_start_filtering drivers/media/dvb-core/dvb_demux.c:973 dvb_dmxdev_feed_start drivers/media/dvb-core/dmxdev.c:508 [inline] dvb_dmxdev_feed_restart.isra.0 drivers/media/dvb-core/dmxdev.c:537 dvb_dmxdev_filter_stop+0x2b4/0x3a0 drivers/media/dvb-core/dmxdev.c:564 dvb_dmxdev_filter_free drivers/media/dvb-core/dmxdev.c:840 [inline] dvb_demux_release+0x92/0x550 drivers/media/dvb-core/dmxdev.c:1246 __fput+0x3ff/0xb70 fs/file_table.c:464 task_work_run+0x14e/0x250 kernel/task_work.c:227 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xad8/0x2d70 kernel/exit.c:938 do_group_exit+0xd3/0x2a0 kernel/exit.c:1087 __do_sys_exit_group kernel/exit.c:1098 [inline] __se_sys_exit_group kernel/exit.c:1096 [inline] __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1096 x64_sys_call+0x151f/0x1720 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f871d58d169 Code: Unable to access opcode bytes at 0x7f871d58d13f. RSP: 002b:00007fff4b19a788 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f871d58d169 RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007fff4b19a7ec R08: 0000000b4b19a87f R09: 00000000000927c0 R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000003 R13: 00000000000927c0 R14: 000000000001d553 R15: 00007fff4b19a840 </TASK> Allocated by task 6059: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kmalloc_noprof include/linux/slab.h:901 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] vidtv_psi_pat_table_init drivers/media/test-drivers/vidtv/vidtv_psi.c:970 vidtv_channel_si_init drivers/media/test-drivers/vidtv/vidtv_channel.c:423 vidtv_mux_init drivers/media/test-drivers/vidtv/vidtv_mux.c:519 vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 vidtv_start_feed drivers/media/test-drivers/vidtv/vidtv_bridge.c:239 dmx_section_feed_start_filtering drivers/media/dvb-core/dvb_demux.c:973 dvb_dmxdev_feed_start drivers/media/dvb-core/dmxdev.c:508 [inline] dvb_dmxdev_feed_restart.isra.0 drivers/media/dvb-core/dmxdev.c:537 dvb_dmxdev_filter_stop+0x2b4/0x3a0 drivers/media/dvb-core/dmxdev.c:564 dvb_dmxdev_filter_free drivers/media/dvb-core/dmxdev.c:840 [inline] dvb_demux_release+0x92/0x550 drivers/media/dvb-core/dmxdev.c:1246 __fput+0x3ff/0xb70 fs/file_tabl ---truncated---
In the Linux kernel, the following vulnerability has been resolved: media: vivid: Change the siize of the composing syzkaller found a bug: BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2608 [inline] BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x1a9c/0x5af0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705 Write of size 1440 at addr ffffc9000d0ffda0 by task vivid-000-vid-c/5304 CPU: 0 UID: 0 PID: 5304 Comm: vivid-000-vid-c Not tainted 6.14.0-rc2-syzkaller-00039-g09fbf3d50205 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2608 [inline] tpg_fill_plane_buffer+0x1a9c/0x5af0 drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2705 vivid_fillbuff drivers/media/test-drivers/vivid/vivid-kthread-cap.c:470 [inline] vivid_thread_vid_cap_tick+0xf8e/0x60d0 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:629 vivid_thread_vid_cap+0x8aa/0xf30 drivers/media/test-drivers/vivid/vivid-kthread-cap.c:767 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> The composition size cannot be larger than the size of fmt_cap_rect. So execute v4l2_rect_map_inside() even if has_compose_cap == 0.
In the Linux kernel, the following vulnerability has been resolved: ipc: fix to protect IPCS lookups using RCU syzbot reported that it discovered a use-after-free vulnerability, [0] [0]: https://lore.kernel.org/all/67af13f8.050a0220.21dd3.0038.GAE@google.com/ idr_for_each() is protected by rwsem, but this is not enough. If it is not protected by RCU read-critical region, when idr_for_each() calls radix_tree_node_free() through call_rcu() to free the radix_tree_node structure, the node will be freed immediately, and when reading the next node in radix_tree_for_each_slot(), the already freed memory may be read. Therefore, we need to add code to make sure that idr_for_each() is protected within the RCU read-critical region when we call it in shm_destroy_orphaned().
CVE-2025-38233 is a security vulnerability (CVSS 7.8). High severity vulnerability requiring prompt remediation. Vendor patch is available.
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: remove tag set when second admin queue config fails Commit 104d0e2f6222 ("nvme-fabrics: reset admin connection for secure concatenation") modified nvme_tcp_setup_ctrl() to call nvme_tcp_configure_admin_queue() twice. The first call prepares for DH-CHAP negotitation, and the second call is required for secure concatenation. However, this change triggered BUG KASAN slab-use-after- free in blk_mq_queue_tag_busy_iter(). This BUG can be recreated by repeating the blktests test case nvme/063 a few times [1]. When the BUG happens, nvme_tcp_create_ctrl() fails in the call chain below: nvme_tcp_create_ctrl() nvme_tcp_alloc_ctrl() new=true ... Alloc nvme_tcp_ctrl and admin_tag_set nvme_tcp_setup_ctrl() new=true nvme_tcp_configure_admin_queue() new=true ... Succeed nvme_alloc_admin_tag_set() ... Alloc the tag set for admin_tag_set nvme_stop_keep_alive() nvme_tcp_teardown_admin_queue() remove=false nvme_tcp_configure_admin_queue() new=false nvme_tcp_alloc_admin_queue() ... Fail, but do not call nvme_remove_admin_tag_set() nvme_uninit_ctrl() nvme_put_ctrl() ... Free up the nvme_tcp_ctrl and admin_tag_set The first call of nvme_tcp_configure_admin_queue() succeeds with new=true argument. The second call fails with new=false argument. This second call does not call nvme_remove_admin_tag_set() on failure, due to the new=false argument. Then the admin tag set is not removed. However, nvme_tcp_create_ctrl() assumes that nvme_tcp_setup_ctrl() would call nvme_remove_admin_tag_set(). Then it frees up struct nvme_tcp_ctrl which has admin_tag_set field. Later on, the timeout handler accesses the admin_tag_set field and causes the BUG KASAN slab-use-after-free. To not leave the admin tag set, call nvme_remove_admin_tag_set() when the second nvme_tcp_configure_admin_queue() call fails. Do not return from nvme_tcp_setup_ctrl() on failure. Instead, jump to "destroy_admin" go-to label to call nvme_tcp_teardown_admin_queue() which calls nvme_remove_admin_tag_set().
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() The RPC container is released after being passed to r535_gsp_rpc_send(). When sending the initial fragment of a large RPC and passing the caller's RPC container, the container will be freed prematurely. Subsequent attempts to send remaining fragments will therefore result in a use-after-free. Allocate a temporary RPC container for holding the initial fragment of a large RPC when sending. Free the caller's container when all fragments are successfully sent. [ Rebase onto Blackwell changes. - Danilo ]
CVE-2025-38206 is a security vulnerability (CVSS 7.8). High severity vulnerability requiring prompt remediation. Vendor patch is available.
In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() Before calling lan743x_ptp_io_event_clock_get(), the 'channel' value is checked against the maximum value of PCI11X1X_PTP_IO_MAX_CHANNELS(8). This seems correct and aligns with the PTP interrupt status register (PTP_INT_STS) specifications. However, lan743x_ptp_io_event_clock_get() writes to ptp->extts[] with only LAN743X_PTP_N_EXTTS(4) elements, using channel as an index: lan743x_ptp_io_event_clock_get(..., u8 channel,...) { ... /* Update Local timestamp */ extts = &ptp->extts[channel]; extts->ts.tv_sec = sec; ... } To avoid an out-of-bounds write and utilize all the supported GPIO inputs, set LAN743X_PTP_N_EXTTS to 8. Detected using the static analysis tool - Svace.
CVE-2025-38182 is a security vulnerability (CVSS 7.8). High severity vulnerability requiring prompt remediation. Vendor patch is available.
In the Linux kernel, the following vulnerability has been resolved: jfs: validate AG parameters in dbMount() to prevent crashes Validate db_agheight, db_agwidth, and db_agstart in dbMount to catch corrupted metadata early and avoid undefined behavior in dbAllocAG. Limits are derived from L2LPERCTL, LPERCTL/MAXAG, and CTLTREESIZE: - agheight: 0 to L2LPERCTL/2 (0 to 5) ensures shift (L2LPERCTL - 2*agheight) >= 0. - agwidth: 1 to min(LPERCTL/MAXAG, 2^(L2LPERCTL - 2*agheight)) ensures agperlev >= 1. - Ranges: 1-8 (agheight 0-3), 1-4 (agheight 4), 1 (agheight 5). - LPERCTL/MAXAG = 1024/128 = 8 limits leaves per AG; 2^(10 - 2*agheight) prevents division to 0. - agstart: 0 to CTLTREESIZE-1 - agwidth*(MAXAG-1) keeps ti within stree (size 1365). - Ranges: 0-1237 (agwidth 1), 0-348 (agwidth 8). UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:1400:9 shift exponent -335544310 is negative CPU: 0 UID: 0 PID: 5822 Comm: syz-executor130 Not tainted 6.14.0-rc5-syzkaller #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:231 [inline] __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468 dbAllocAG+0x1087/0x10b0 fs/jfs/jfs_dmap.c:1400 dbDiscardAG+0x352/0xa20 fs/jfs/jfs_dmap.c:1613 jfs_ioc_trim+0x45a/0x6b0 fs/jfs/jfs_discard.c:105 jfs_ioctl+0x2cd/0x3e0 fs/jfs/ioctl.c:131 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction The commit 59c68ac31e15 ("iw_cm: free cm_id resources on the last deref") simplified cm_id resource management by freeing cm_id once all references to the cm_id were removed. The references are removed either upon completion of iw_cm event handlers or when the application destroys the cm_id. This commit introduced the use-after-free condition where cm_id_private object could still be in use by event handler works during the destruction of cm_id. The commit aee2424246f9 ("RDMA/iwcm: Fix a use-after-free related to destroying CM IDs") addressed this use-after- free by flushing all pending works at the cm_id destruction. However, still another use-after-free possibility remained. It happens with the work objects allocated for each cm_id_priv within alloc_work_entries() during cm_id creation, and subsequently freed in dealloc_work_entries() once all references to the cm_id are removed. If the cm_id's last reference is decremented in the event handler work, the work object for the work itself gets removed, and causes the use- after-free BUG below: BUG: KASAN: slab-use-after-free in __pwq_activate_work+0x1ff/0x250 Read of size 8 at addr ffff88811f9cf800 by task kworker/u16:1/147091 CPU: 2 UID: 0 PID: 147091 Comm: kworker/u16:1 Not tainted 6.15.0-rc2+ #27 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 Workqueue: 0x0 (iw_cm_wq) Call Trace: <TASK> dump_stack_lvl+0x6a/0x90 print_report+0x174/0x554 ? __virt_addr_valid+0x208/0x430 ? __pwq_activate_work+0x1ff/0x250 kasan_report+0xae/0x170 ? __pwq_activate_work+0x1ff/0x250 __pwq_activate_work+0x1ff/0x250 pwq_dec_nr_in_flight+0x8c5/0xfb0 process_one_work+0xc11/0x1460 ? __pfx_process_one_work+0x10/0x10 ? assign_work+0x16c/0x240 worker_thread+0x5ef/0xfd0 ? __pfx_worker_thread+0x10/0x10 kthread+0x3b0/0x770 ? __pfx_kthread+0x10/0x10 ? rcu_is_watching+0x11/0xb0 ? _raw_spin_unlock_irq+0x24/0x50 ? rcu_is_watching+0x11/0xb0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x30/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 147416: kasan_save_stack+0x2c/0x50 kasan_save_track+0x10/0x30 __kasan_kmalloc+0xa6/0xb0 alloc_work_entries+0xa9/0x260 [iw_cm] iw_cm_connect+0x23/0x4a0 [iw_cm] rdma_connect_locked+0xbfd/0x1920 [rdma_cm] nvme_rdma_cm_handler+0x8e5/0x1b60 [nvme_rdma] cma_cm_event_handler+0xae/0x320 [rdma_cm] cma_work_handler+0x106/0x1b0 [rdma_cm] process_one_work+0x84f/0x1460 worker_thread+0x5ef/0xfd0 kthread+0x3b0/0x770 ret_from_fork+0x30/0x70 ret_from_fork_asm+0x1a/0x30 Freed by task 147091: kasan_save_stack+0x2c/0x50 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x60 __kasan_slab_free+0x4b/0x70 kfree+0x13a/0x4b0 dealloc_work_entries+0x125/0x1f0 [iw_cm] iwcm_deref_id+0x6f/0xa0 [iw_cm] cm_work_handler+0x136/0x1ba0 [iw_cm] process_one_work+0x84f/0x1460 worker_thread+0x5ef/0xfd0 kthread+0x3b0/0x770 ret_from_fork+0x30/0x70 ret_from_fork_asm+0x1a/0x30 Last potentially related work creation: kasan_save_stack+0x2c/0x50 kasan_record_aux_stack+0xa3/0xb0 __queue_work+0x2ff/0x1390 queue_work_on+0x67/0xc0 cm_event_handler+0x46a/0x820 [iw_cm] siw_cm_upcall+0x330/0x650 [siw] siw_cm_work_handler+0x6b9/0x2b20 [siw] process_one_work+0x84f/0x1460 worker_thread+0x5ef/0xfd0 kthread+0x3b0/0x770 ret_from_fork+0x30/0x70 ret_from_fork_asm+0x1a/0x30 This BUG is reproducible by repeating the blktests test case nvme/061 for the rdma transport and the siw driver. To avoid the use-after-free of cm_id_private work objects, ensure that the last reference to the cm_id is decremented not in the event handler works, but in the cm_id destruction context. For that purpose, mo ---truncated---
In the Linux kernel, the following vulnerability has been resolved: net: atm: fix /proc/net/atm/lec handling /proc/net/atm/lec must ensure safety against dev_lec[] changes. It appears it had dev_put() calls without prior dev_hold(), leading to imbalance and UAF.
In the Linux kernel, the following vulnerability has been resolved: fbcon: Make sure modelist not set on unregistered console It looks like attempting to write to the "store_modes" sysfs node will run afoul of unregistered consoles: UBSAN: array-index-out-of-bounds in drivers/video/fbdev/core/fbcon.c:122:28 index -1 is out of range for type 'fb_info *[32]' ... fbcon_info_from_console+0x192/0x1a0 drivers/video/fbdev/core/fbcon.c:122 fbcon_new_modelist+0xbf/0x2d0 drivers/video/fbdev/core/fbcon.c:3048 fb_new_modelist+0x328/0x440 drivers/video/fbdev/core/fbmem.c:673 store_modes+0x1c9/0x3e0 drivers/video/fbdev/core/fbsysfs.c:113 dev_attr_store+0x55/0x80 drivers/base/core.c:2439 static struct fb_info *fbcon_registered_fb[FB_MAX]; ... static signed char con2fb_map[MAX_NR_CONSOLES]; ... static struct fb_info *fbcon_info_from_console(int console) ... return fbcon_registered_fb[con2fb_map[console]]; If con2fb_map contains a -1 things go wrong here. Instead, return NULL, as callers of fbcon_info_from_console() are trying to compare against existing "info" pointers, so error handling should kick in correctly.