Classic buffer overflow in certain Zoom Clients for Windows may allow an authorised user to conduct a denial of service via network access.
Denial of service in GnuTLS can be triggered during cipher suite negotiation when a NULL pointer is dereferenced in the _gnutls_figure_common_ciphersuite() function. Remote attackers can crash TLS services relying on GnuTLS, causing availability disruption. No public exploit code or active exploitation has been identified at this time, and the EPSS score indicates very low exploitation probability.
A security vulnerability in certain Zoom Clients for iOS (CVSS 6.5) that allows an unauthenticated user. Remediation should follow standard vulnerability management procedures.
The Honeywell Experion PKS and OneWireless WDM contains Sensitive Information in Resource vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could result in buffer reuse which may cause incorrect system behavior. Honeywell also recommends updating to the most recent version of Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1. The affected Experion PKS products are C300, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are 520.1 before 520.2 TCU9 HF1 and 530 before 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.
Improper Certificate Validation (CWE-295) in the Controller 7000 OneLink implementation could allow an unprivileged attacker to perform a limited denial of service or perform privileged overrides during the initial configuration of the Controller, there is no risk for Controllers once they are connected. This issue affects Controller 7000: 9.30 prior to vCR9.30.250624a (distributed in 9.30.1871 (MR1)).
CVE-2025-5022 is a security vulnerability (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
Improper Control of Generation of Code ('Code Injection') vulnerability in OpenText™ Directory Services allows Remote Code Inclusion. The vulnerability could allow access to the system via script injection.This issue affects Directory Services: 23.4.
Remote OS command injection in Netgear D6400 firmware 1.0.0.114 allows authenticated attackers to execute arbitrary commands via the diag.cgi host_name parameter. Public exploit code exists, and the vendor confirmed the vulnerability, but no patch will be issued because the product is end-of-life. EPSS score is low (0.79%) indicating limited likelihood of widespread exploitation despite the exploit's availability.
OS command injection in Tenda O3V2 firmware version 1.0.0.12(3880) via the domain parameter in the /goform/setPingInfo endpoint allows authenticated remote attackers to execute arbitrary commands on the device. Exploit code is publicly available, but no active exploitation has been confirmed by CISA KEV. Despite a low CVSS 4.0 base score of 2.1 assigned by the reporter, the vulnerability is rated Critical by the disclosing source.
Command injection in the httpd component of Tenda O3V2 firmware version 1.0.0.12(3880) allows remote authenticated attackers with low privileges to execute arbitrary operating system commands via the dest parameter of /goform/getTraceroute. Public exploit code is available, though no active exploitation has been confirmed (no CISA KEV entry). The vulnerability has a moderate EPSS score (0.65%), indicating a limited but non-negligible probability of exploitation.
The Gwolle Guestbook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘gwolle_gb_content’ parameter in all versions up to, and including, 4.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
We are tasked with producing a comprehensive JSON analysis for CVE-2025-7413. The analysis must synthesize data from multiple intelligence sources. We'll go through each field carefully. First, understand the CVE: It's a critical vulnerability in "code-projects Library System 1.0", specifically in /user/teacher/profile.php where manipulation of the argument "image" leads to unrestricted upload. It is remotely exploitable. The exploit is publicly disclosed. The CVSS Score is 2.1 (sounds very low, but the vector is 4.0: AV:N, AC:L, AT:N, PR:L, UI:N, VC:L, VI:L, VA:L, SC:N, SI:N, SA:N, E:P). That suggests low impact, but the description says "critical". Might be a discrepancy. CWE-284 is "Improper Access Control". Multi-source intelligence: EPSS 0.07% (percentile 21%), so low exploitation probability. POC/Exploit: Publicly available (from the description and tags). KEV status not mentioned, so assume not in KEV. Tags: File Upload, PHP, Authentication Bypass. CPE: code-projects:library_system:1.0. The product is "Library System 1.0" by code-projects (likely a PHP web app). References: - code-projects.org (probably the product site) - https://github.com/rom4j/cve/issues/16 (exploit reference) - vuldb.com links (including one with id.315873) - nvd link for CVE-2025-7413 We need to output fields as plain text strings, no arrays. So each field will be a paragraph. We'll follow the instructions precisely. product_name: "Library System" (but it's "Library System 1.0", so maybe "Library System" or "code-projects Library System"? The rule: "1-3 words ONLY. The specific product or service name affected." So "Library System" is appropriate, but to be specific, "code-projects Library System" might be 3 words. I'll use "Library System" as the vendor is "code-projects" and that is implied. But I'll go with "code-projects Library System" to be specific, but it's 3 words. I'll keep it simple: "Library System". It's better to specify "Library System" as the product, vendor known from CPE. I'll output: "Library System". summary: 2-3 sentence plain-language synthesis. Must not copy description, original. Start with impact and product. Example: "Remote code execution in Apache Tomcat 9.x allows..." But here it's unrestricted file upload, which could lead to code execution, but the CVSS impact is low (L:L:L). Description says "critical" though. The impact is "unrestricted upload leads to ..." Possibly webshell upload, leading to code execution. Since it's a PHP file upload, likely you can upload a PHP script and execute it. But the CVSS says VC:L/VI:L/VA:L, so low impact on confidentiality, integrity, availability. Might be that the uploaded image is only accessible within the teacher profile and can't be executed as code? But typical unrestricted upload in PHP allows code execution if the file is accessible. I'll note that: "Unrestricted file upload in code-projects Library System 1.0 via /user/teacher/profile.php allows authenticated remote attackers to upload arbitrary files, potentially leading to remote code execution. The vulnerability is due to improper access control (CWE-284) on the image upload parameter, and exploit code is publicly available." No active exploitation indicated, EPSS low. So summary: "Unrestricted file upload in code-projects Library System 1.0 allows authenticated attackers to upload arbitrary files via the 'image' parameter in /user/teacher/profile.php. Exploit code is publicly available, but the EPSS exploitation probability is low (0.07%), and no active exploitation has been reported in threat intelligence feeds." Note: CVSS vector gives PR:L, so authenticated as a low-privileged user (teacher). So "authenticated remote attacker" is appropriate. I'll mention the conditions: requires authentication as a teacher (or low privilege) and access to the profile page. Now technical_context: Explain the underlying technology. It's a PHP application, so file upload vulnerability. CWE-284, improper access control, likely missing checks on file type or permissions. CPE indicates "code-projects:library_system:1.0". The code-projects Library System is a PHP-based web application. The affected component is /user/teacher/profile.php, likely handling teacher profile updates including an image upload. The vulnerability arises because the application does not properly restrict what files can be uploaded, allowing an attacker to upload a malicious script (e.g., PHP webshell) that can be executed on the server. This could lead to further compromise. Reference CWE-284: improper access control, so maybe the file upload feature lacks proper authorization or validation, but the description says "unrestricted upload", more like CWE-434 (unrestricted upload of file with dangerous type), but they classified as CWE-284. I'll mention that. Underlying technology: PHP, web server (Apache/Nginx), typical LAMP stack. The upload endpoint likely stores uploaded files in a web-accessible directory, allowing direct execution of uploaded PHP files. So the root cause is insufficient file validation and lack of access control on the upload directory. This is a classic unrestricted file upload leading to remote code execution. risk_assessment: Use CVSS vector and EPSS to assess real risk. CVSS:4.0 vector shows AV:N (network), AC:L, AT:N, PR:L (low privileges required), UI:N, with low impact on all three aspects. The EPSS is low (0.07%), implying low probability of exploitation in the wild. No KEV listing, but POC available. So even though the vulnerability allows file upload, the real-world risk might be moderate because exploitation requires authentication as a teacher (PR:L) and the application is not widely deployed (we'll gauge prevalence). The CVSS score of 2.1 seems inconsistent with the description of "critical", but the numeric score given is likely for the exact impact (low). I'll mention this discrepancy: "CVSS:4.0 base score of 2.1 suggests low overall severity due to limited impact (VC:L/VI:L/VA:L) despite network attack vector and low attack complexity. However, unrestricted file upload in PHP can often lead to full code execution, so the actual impact may be higher depending on server configuration. The EPSS score is very low, indicating that widespread exploitation is unlikely. The availability of a POC does not currently translate into active exploitation." Also note PR:L means an attacker must first obtain teacher-level credentials. So risk is low for most organizations unless the Library System is exposed. Then "If any key data is missing or conflicting, STATE IT EXPLICITLY." Here, the CVSS vector suggests low impact while description says critical, and typical unrestricted upload can lead to code execution. I'll explicitly state: "The assigned CVSS:4.0 vector indicates low impact (VC:L, VI:L, VA:L) which contradicts the typical severity of unrestricted file upload vulnerabilities in PHP. This may be due to a misassessment or the specific deployment default configuration limiting impact. Organizations should verify whether the uploaded files are executed as PHP scripts in the affected version." affected_products: "code-projects Library System version 1.0, as identified by CPE cpe:2.3:a:code-projects:library_system:1.0:*:*:*:*:*:*:*. The vulnerable file is /user/teacher/profile.php. The product source is available from code-projects.org. No vendor advisory has been published; the vulnerability was reported through VulDB and EUVD, and an exploit is available on GitHub (rom4j/cve issues/16)." remediation: "No official vendor patch has been released as of analysis. As a workaround, restrict access to the upload directory by configuring the web server to deny execution of scripts from the upload location (e.g., using .htaccess ‘php_flag engine off’ or equivalent), or disable the teacher profile image upload feature entirely if not required. Additionally, implement strict file type validation on the server side to only allow image file extensions. However, these mitigations may break intended functionality. Monitor for any upcoming patches from the vendor via the VulDB advisory (https://vuldb.com/?id.315873)." Note: I'm not sure if a patch exists, but from the references, no advisory with a fix version. So I'll say "No vendor-released patch identified". I'll avoid saying "no patch exists". Suggest compensating controls. exploit_scenario: "An attacker with low-privileged teacher credentials (e.g., gained through phishing or default credentials) accesses the /user/teacher/profile.php page and uploads a malicious PHP webshell via the image upload field. The uploaded file is stored in a web-accessible directory, and the attacker navigates to it to execute arbitrary commands on the server, potentially taking full control of the web application and underlying host." Note: POC available from GitHub. exploitation_conditions: Must extract specific prerequisites. The description: "manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely." It doesn't mention authentication explicitly, but CVSS vector says PR:L, so low privileges required. The affected file is /user/teacher/profile.php, implying a teacher user must be logged in to access this endpoint. So conditions: "Exploitation requires authentication as a teacher-level user on the Library System application, with access to the profile image upload feature. No additional non-default configuration is needed—the vulnerability exists in the default installation of Library System 1.0. The attack is remotely exploitable over a network, but low privileges are mandatory." So I'll state: "Requires teacher-level authentication (PR:L) and access to the /user/teacher/profile.php upload form. No other special conditions; the default configuration is vulnerable." The instruction forbids generic phrases like "Network access required." So I'll be specific. I'll also note what limits it: authentication. So: "The vulnerability is limited to authenticated teacher users; unauthenticated attackers cannot exploit it directly unless they obtain valid credentials." That's good. attack_chain: A realistic chain: "Obtain teacher credentials → Access teacher profile page → Upload PHP webshell via image parameter → Locate uploaded file in web root → Execute webshell to achieve code execution → Escalate privileges or maintain persistence." But the chain should be concise, 3-7 steps separated by arrows. Starting from access: "Access with teacher credentials" is access. Then "Send malicious file via image upload" → "Web server stores file in public directory" → "Attacker requests uploaded PHP file" → "Server executes script" → "Attacker gains command execution". I'll combine into steps: "Authenticate as teacher → Upload PHP webshell via profile image parameter → Access uploaded file via direct URL → Execute arbitrary code on server". That's 4 steps. But maybe include persistence: "Authenticate → Upload → Access → Execute code → Install backdoor". But I'll keep it simple: "Authenticate as low-privileged teacher → Craft HTTP POST request with malicious PHP file to /user/teacher/profile.php → Server stores file in web-accessible directory → Attacker requests the file URL → PHP code executes, delivering a webshell → Attacker interacts with webshell for full remote control." That's 6 steps. Short steps: "Obtain teacher credentials (phishing/default) → Upload PHP shell via profile image upload → Determine file storage path → Execute webshell via HTTP request → Gain command execution → Maintain access." I'd like to follow kill chain phases. I'll produce: "Authenticate as teacher → Upload malicious PHP via image parameter → Identify file location → Request uploaded file URL → Execute code as web server user → Achieve remote command execution". That's 6 steps. I'll use exactly that as a string with arrows. No numbering. "Authenticate as teacher → Upload malicious PHP via image parameter → Identify file location → Request uploaded file URL → Execute code as web server user → Achieve remote command execution". Good. confidence_notes: "The vulnerability is confirmed by VulDB and EUVD, with a publicly available exploit on GitHub. The CWE classification (CWE-284) and CVSS vector (4.0) are provided by the VulDB submitter; the low impact scores may not reflect the full potential of the flaw if uploaded PHP files are executable. No vendor advisory or patch has been published, and the exact behavior of file execution is not independently verified. EPSS data indicates very low exploitation probability, consistent with the product's niche deployment." prevalence: The product is "Library System", a project from code-projects.org. It's a free, likely small-scale library management system used by small institutions or for learning purposes. Not widely deployed like major enterprise software. So prevalence is "low" or "rare". I'll go with "low". Justification: "free open-source PHP app with limited enterprise footprint". Will output "low". prevalence_basis:
Unrestricted file upload in code-projects Library System 1.0 enables remote attackers to upload arbitrary files via the image parameter of /user/student/profile.php, potentially leading to full server compromise if combined with authentication bypass. Public exploit code is available, though EPSS indicates low exploitation probability (0.07%) and no active exploitation is recorded in CISA KEV. The CVSS 4.0 rating of 2.1 (Low) conflicts with the 'critical' classification in the disclosure, likely due to the authentication bypass tag increasing real-world impact.
A cross-site scripting (XSS) vulnerability in the component /master/login.php of mpgram-web commit 94baadb allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload.
A cross-site scripting (XSS) vulnerability in the Admin Login page of Allworx System Software v9.1.9.12 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the SessionID parameter at query.asp.
pdfme is a TypeScript-based PDF generator and React-based UI. The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vulnerabilities allowing sandbox escape leading to XSS and prototype pollution attacks. This vulnerability is fixed in 5.4.1.
Cross-site scripting (XSS) in SourceCodester Zoo Management System 1.0 allows authenticated remote attackers to inject arbitrary web script via the 'msg' argument of the animal form template. Exploit code is publicly available, but no active exploitation has been confirmed and the EPSS score indicates very low exploitation probability.
liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Multiple secret-dependent branches have been identified in the reference implementation of the HQC key encapsulation mechanism when it is compiled with Clang for optimization levels above -O0 (-O1, -O2, etc). A proof-of-concept local attack exploits this secret-dependent information to recover the entire secret key. This vulnerability is fixed in 0.14.0.
CVE-2025-46406 is a security vulnerability (CVSS 5.6) that allows a privileged operator with high level access. Remediation should follow standard vulnerability management procedures.
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix node corruption in ar->arvifs list In current WLAN recovery code flow, ath12k_core_halt() only reinitializes the "arvifs" list head. This will cause the list node immediately following the list head to become an invalid list node. Because the prev of that node still points to the list head "arvifs", but the next of the list head "arvifs" no longer points to that list node. When a WLAN recovery occurs during the execution of a vif removal, and it happens before the spin_lock_bh(&ar->data_lock) in ath12k_mac_vdev_delete(), list_del() will detect the previously mentioned situation, thereby triggering a kernel panic. The fix is to remove and reinitialize all vif list nodes from the list head "arvifs" during WLAN halt. The reinitialization is to make the list nodes valid, ensuring that the list_del() in ath12k_mac_vdev_delete() can execute normally. Call trace: __list_del_entry_valid_or_report+0xd4/0x100 (P) ath12k_mac_remove_link_interface.isra.0+0xf8/0x2e4 [ath12k] ath12k_scan_vdev_clean_work+0x40/0x164 [ath12k] cfg80211_wiphy_work+0xfc/0x100 process_one_work+0x164/0x2d0 worker_thread+0x254/0x380 kthread+0xfc/0x100 ret_from_fork+0x10/0x20 The change is mostly copied from the ath11k patch: https://lore.kernel.org/all/20250320053145.3445187-1-quic_stonez@quicinc.com/ Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
CVE-2025-38347 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
In the Linux kernel, the following vulnerability has been resolved: jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() Since handle->h_transaction may be a NULL pointer, so we should change it to call is_handle_aborted(handle) first before dereferencing it. And the following data-race was reported in my fuzzer: ================================================================== BUG: KCSAN: data-race in jbd2_journal_dirty_metadata / jbd2_journal_dirty_metadata write to 0xffff888011024104 of 4 bytes by task 10881 on cpu 1: jbd2_journal_dirty_metadata+0x2a5/0x770 fs/jbd2/transaction.c:1556 __ext4_handle_dirty_metadata+0xe7/0x4b0 fs/ext4/ext4_jbd2.c:358 ext4_do_update_inode fs/ext4/inode.c:5220 [inline] ext4_mark_iloc_dirty+0x32c/0xd50 fs/ext4/inode.c:5869 __ext4_mark_inode_dirty+0xe1/0x450 fs/ext4/inode.c:6074 ext4_dirty_inode+0x98/0xc0 fs/ext4/inode.c:6103 .... read to 0xffff888011024104 of 4 bytes by task 10880 on cpu 0: jbd2_journal_dirty_metadata+0xf2/0x770 fs/jbd2/transaction.c:1512 __ext4_handle_dirty_metadata+0xe7/0x4b0 fs/ext4/ext4_jbd2.c:358 ext4_do_update_inode fs/ext4/inode.c:5220 [inline] ext4_mark_iloc_dirty+0x32c/0xd50 fs/ext4/inode.c:5869 __ext4_mark_inode_dirty+0xe1/0x450 fs/ext4/inode.c:6074 ext4_dirty_inode+0x98/0xc0 fs/ext4/inode.c:6103 .... value changed: 0x00000000 -> 0x00000001 ================================================================== This issue is caused by missing data-race annotation for jh->b_modified. Therefore, the missing annotation needs to be added.
In the Linux kernel, the following vulnerability has been resolved: net: tipc: fix refcount warning in tipc_aead_encrypt syzbot reported a refcount warning [1] caused by calling get_net() on a network namespace that is being destroyed (refcount=0). This happens when a TIPC discovery timer fires during network namespace cleanup. The recently added get_net() call in commit e279024617134 ("net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done") attempts to hold a reference to the network namespace. However, if the namespace is already being destroyed, its refcount might be zero, leading to the use-after-free warning. Replace get_net() with maybe_get_net(), which safely checks if the refcount is non-zero before incrementing it. If the namespace is being destroyed, return -ENODEV early, after releasing the bearer reference. [1]: https://lore.kernel.org/all/68342b55.a70a0220.253bc2.0091.GAE@google.com/T/#m12019cf9ae77e1954f666914640efa36d52704a2
CVE-2025-38293 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
The Lana Downloads Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the endpoint parameters in versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with administrator-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix WARN() in get_bpf_raw_tp_regs syzkaller reported an issue: WARNING: CPU: 3 PID: 5971 at kernel/trace/bpf_trace.c:1861 get_bpf_raw_tp_regs+0xa4/0x100 kernel/trace/bpf_trace.c:1861 Modules linked in: CPU: 3 UID: 0 PID: 5971 Comm: syz-executor205 Not tainted 6.15.0-rc5-syzkaller-00038-g707df3375124 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:get_bpf_raw_tp_regs+0xa4/0x100 kernel/trace/bpf_trace.c:1861 RSP: 0018:ffffc90003636fa8 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000003 RCX: ffffffff81c6bc4c RDX: ffff888032efc880 RSI: ffffffff81c6bc83 RDI: 0000000000000005 RBP: ffff88806a730860 R08: 0000000000000005 R09: 0000000000000003 R10: 0000000000000004 R11: 0000000000000000 R12: 0000000000000004 R13: 0000000000000001 R14: ffffc90003637008 R15: 0000000000000900 FS: 0000000000000000(0000) GS:ffff8880d6cdf000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7baee09130 CR3: 0000000029f5a000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1934 [inline] bpf_get_stack_raw_tp+0x24/0x160 kernel/trace/bpf_trace.c:1931 bpf_prog_ec3b2eefa702d8d3+0x43/0x47 bpf_dispatcher_nop_func include/linux/bpf.h:1316 [inline] __bpf_prog_run include/linux/filter.h:718 [inline] bpf_prog_run include/linux/filter.h:725 [inline] __bpf_trace_run kernel/trace/bpf_trace.c:2363 [inline] bpf_trace_run3+0x23f/0x5a0 kernel/trace/bpf_trace.c:2405 __bpf_trace_mmap_lock_acquire_returned+0xfc/0x140 include/trace/events/mmap_lock.h:47 __traceiter_mmap_lock_acquire_returned+0x79/0xc0 include/trace/events/mmap_lock.h:47 __do_trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:47 [inline] trace_mmap_lock_acquire_returned include/trace/events/mmap_lock.h:47 [inline] __mmap_lock_do_trace_acquire_returned+0x138/0x1f0 mm/mmap_lock.c:35 __mmap_lock_trace_acquire_returned include/linux/mmap_lock.h:36 [inline] mmap_read_trylock include/linux/mmap_lock.h:204 [inline] stack_map_get_build_id_offset+0x535/0x6f0 kernel/bpf/stackmap.c:157 __bpf_get_stack+0x307/0xa10 kernel/bpf/stackmap.c:483 ____bpf_get_stack kernel/bpf/stackmap.c:499 [inline] bpf_get_stack+0x32/0x40 kernel/bpf/stackmap.c:496 ____bpf_get_stack_raw_tp kernel/trace/bpf_trace.c:1941 [inline] bpf_get_stack_raw_tp+0x124/0x160 kernel/trace/bpf_trace.c:1931 bpf_prog_ec3b2eefa702d8d3+0x43/0x47 Tracepoint like trace_mmap_lock_acquire_returned may cause nested call as the corner case show above, which will be resolved with more general method in the future. As a result, WARN_ON_ONCE will be triggered. As Alexei suggested, remove the WARN_ON_ONCE first.
A remote code execution vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
In the Linux kernel, the following vulnerability has been resolved: fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() In fb_find_mode_cvt(), iff mode->refresh somehow happens to be 0x80000000, cvt.f_refresh will become 0 when multiplying it by 2 due to overflow. It's then passed to fb_cvt_hperiod(), where it's used as a divider -- division by 0 will result in kernel oops. Add a sanity check for cvt.f_refresh to avoid such overflow... Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool.
CVE-2025-38305 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
In the Linux kernel, the following vulnerability has been resolved: Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT When enabling PREEMPT_RT, the gpio_keys_irq_timer() callback runs in hard irq context, but the input_event() takes a spin_lock, which isn't allowed there as it is converted to a rt_spin_lock(). [ 4054.289999] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 [ 4054.290028] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/0 ... [ 4054.290195] __might_resched+0x13c/0x1f4 [ 4054.290209] rt_spin_lock+0x54/0x11c [ 4054.290219] input_event+0x48/0x80 [ 4054.290230] gpio_keys_irq_timer+0x4c/0x78 [ 4054.290243] __hrtimer_run_queues+0x1a4/0x438 [ 4054.290257] hrtimer_interrupt+0xe4/0x240 [ 4054.290269] arch_timer_handler_phys+0x2c/0x44 [ 4054.290283] handle_percpu_devid_irq+0x8c/0x14c [ 4054.290297] handle_irq_desc+0x40/0x58 [ 4054.290307] generic_handle_domain_irq+0x1c/0x28 [ 4054.290316] gic_handle_irq+0x44/0xcc Considering the gpio_keys_irq_isr() can run in any context, e.g. it can be threaded, it seems there's no point in requesting the timer isr to run in hard irq context. Relax the hrtimer not to use the hard context.
CVE-2025-38278 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
CVE-2025-38339 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
CVE-2025-38327 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: avoid NULL pointer dereference in mt7996_set_monitor() The function mt7996_set_monitor() dereferences phy before the NULL sanity check. Fix this to avoid NULL pointer dereference by moving the dereference after the check.
CVE-2025-38314 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: move xe_svm_init() earlier In xe_vm_close_and_put() we need to be able to call xe_svm_fini(), however during vm creation we can call this on the error path, before having actually initialised the svm state, leading to various splats followed by a fatal NPD. (cherry picked from commit 4f296d77cf49fcb5f90b4674123ad7f3a0676165)
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix possible null-ptr-deref when initing hw Search result of avs_dai_find_path_template() shall be verified before being used. As 'template' is already known when avs_hw_constraints_init() is fired, drop the search entirely.
CVE-2025-38296 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL access in assign channel context handler Currently, when ath12k_mac_assign_vif_to_vdev() fails, the radio handle (ar) gets accessed from the link VIF handle (arvif) for debug logging, This is incorrect. In the fail scenario, radio handle is NULL. Fix the NULL access, avoid radio handle access by moving to the hardware debug logging helper function (ath12k_hw_warn). Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
CVE-2025-38287 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: pci: configure manual DAC mode via PCI config API only To support 36-bit DMA, configure chip proprietary bit via PCI config API or chip DBI interface. However, the PCI device mmap isn't set yet and the DBI is also inaccessible via mmap, so only if the bit can be accessible via PCI config API, chip can support 36-bit DMA. Otherwise, fallback to 32-bit DMA. With NULL mmap address, kernel throws trace: BUG: unable to handle page fault for address: 0000000000001090 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: Oops: 0002 [#1] PREEMPT SMP PTI CPU: 1 UID: 0 PID: 71 Comm: irq/26-pciehp Tainted: G OE 6.14.2-061402-generic #202504101348 Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE RIP: 0010:rtw89_pci_ops_write16+0x12/0x30 [rtw89_pci] RSP: 0018:ffffb0ffc0acf9d8 EFLAGS: 00010206 RAX: ffffffffc158f9c0 RBX: ffff94865e702020 RCX: 0000000000000000 RDX: 0000000000000718 RSI: 0000000000001090 RDI: ffff94865e702020 RBP: ffffb0ffc0acf9d8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000015 R13: 0000000000000719 R14: ffffb0ffc0acfa1f R15: ffffffffc1813060 FS: 0000000000000000(0000) GS:ffff9486f3480000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000001090 CR3: 0000000090440001 CR4: 00000000000626f0 Call Trace: <TASK> rtw89_pci_read_config_byte+0x6d/0x120 [rtw89_pci] rtw89_pci_cfg_dac+0x5b/0xb0 [rtw89_pci] rtw89_pci_probe+0xa96/0xbd0 [rtw89_pci] ? __pfx___device_attach_driver+0x10/0x10 ? __pfx___device_attach_driver+0x10/0x10 local_pci_probe+0x47/0xa0 pci_call_probe+0x5d/0x190 pci_device_probe+0xa7/0x160 really_probe+0xf9/0x370 ? pm_runtime_barrier+0x55/0xa0 __driver_probe_device+0x8c/0x140 driver_probe_device+0x24/0xd0 __device_attach_driver+0xcd/0x170 bus_for_each_drv+0x99/0x100 __device_attach+0xb4/0x1d0 device_attach+0x10/0x20 pci_bus_add_device+0x59/0x90 pci_bus_add_devices+0x31/0x80 pciehp_configure_device+0xaa/0x170 pciehp_enable_slot+0xd6/0x240 pciehp_handle_presence_or_link_change+0xf1/0x180 pciehp_ist+0x162/0x1c0 irq_thread_fn+0x24/0x70 irq_thread+0xef/0x1c0 ? __pfx_irq_thread_fn+0x10/0x10 ? __pfx_irq_thread_dtor+0x10/0x10 ? __pfx_irq_thread+0x10/0x10 kthread+0xfc/0x230 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x47/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Add NULL check in mt7996_thermal_init devm_kasprintf() can return a NULL pointer on failure,but this returned value in mt7996_thermal_init() is not checked. Add NULL check in mt7996_thermal_init(), to handle kernel NULL pointer dereference error.
In the Linux kernel, the following vulnerability has been resolved: net: prevent a NULL deref in rtnl_create_link() At the time rtnl_create_link() is running, dev->netdev_ops is NULL, we must not use netdev_lock_ops() or risk a NULL deref if CONFIG_NET_SHAPER is defined. Use netif_set_group() instead of dev_set_group(). RIP: 0010:netdev_need_ops_lock include/net/netdev_lock.h:33 [inline] RIP: 0010:netdev_lock_ops include/net/netdev_lock.h:41 [inline] RIP: 0010:dev_set_group+0xc0/0x230 net/core/dev_api.c:82 Call Trace: <TASK> rtnl_create_link+0x748/0xd10 net/core/rtnetlink.c:3674 rtnl_newlink_create+0x25c/0xb00 net/core/rtnetlink.c:3813 __rtnl_newlink net/core/rtnetlink.c:3940 [inline] rtnl_newlink+0x16d6/0x1c70 net/core/rtnetlink.c:4055 rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6944 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2534 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] netlink_unicast+0x75b/0x8d0 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:712 [inline]
In the Linux kernel, the following vulnerability has been resolved: pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms Commit 3ef9f710efcb ("pinctrl: mediatek: Add EINT support for multiple addresses") introduced an access to the 'soc' field of struct mtk_pinctrl in mtk_eint_do_init() and for that an include of pinctrl-mtk-common-v2.h. However, pinctrl drivers relying on the v1 common driver include pinctrl-mtk-common.h instead, which provides another definition of struct mtk_pinctrl that does not contain an 'soc' field. Since mtk_eint_do_init() can be called both by v1 and v2 drivers, it will now try to dereference an invalid pointer when called on v1 platforms. This has been observed on Genio 350 EVK (MT8365), which crashes very early in boot (the kernel trace can only be seen with earlycon). In order to fix this, since 'struct mtk_pinctrl' was only needed to get a 'struct mtk_eint_pin', make 'struct mtk_eint_pin' a parameter of mtk_eint_do_init() so that callers need to supply it, removing mtk_eint_do_init()'s dependency on any particular 'struct mtk_pinctrl'.
In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Prevent attempts to reclaim poisoned pages TL;DR: SGX page reclaim touches the page to copy its contents to secondary storage. SGX instructions do not gracefully handle machine checks. Despite this, the existing SGX code will try to reclaim pages that it _knows_ are poisoned. Avoid even trying to reclaim poisoned pages. The longer story: Pages used by an enclave only get epc_page->poison set in arch_memory_failure() but they currently stay on sgx_active_page_list until sgx_encl_release(), with the SGX_EPC_PAGE_RECLAIMER_TRACKED flag untouched. epc_page->poison is not checked in the reclaimer logic meaning that, if other conditions are met, an attempt will be made to reclaim an EPC page that was poisoned. This is bad because 1. we don't want that page to end up added to another enclave and 2. it is likely to cause one core to shut down and the kernel to panic. Specifically, reclaiming uses microcode operations including "EWB" which accesses the EPC page contents to encrypt and write them out to non-SGX memory. Those operations cannot handle MCEs in their accesses other than by putting the executing core into a special shutdown state (affecting both threads with HT.) The kernel will subsequently panic on the remaining cores seeing the core didn't enter MCE handler(s) in time. Call sgx_unmark_page_reclaimable() to remove the affected EPC page from sgx_active_page_list on memory error to stop it being considered for reclaiming. Testing epc_page->poison in sgx_reclaim_pages() would also work but I assume it's better to add code in the less likely paths. The affected EPC page is not added to &node->sgx_poison_page_list until later in sgx_encl_release()->sgx_free_epc_page() when it is EREMOVEd. Membership on other lists doesn't change to avoid changing any of the lists' semantics except for sgx_active_page_list. There's a "TBD" comment in arch_memory_failure() about pre-emptive actions, the goal here is not to address everything that it may imply. This also doesn't completely close the time window when a memory error notification will be fatal (for a not previously poisoned EPC page) -- the MCE can happen after sgx_reclaim_pages() has selected its candidates or even *inside* a microcode operation (actually easy to trigger due to the amount of time spent in them.) The spinlock in sgx_unmark_page_reclaimable() is safe because memory_failure() runs in process context and no spinlocks are held, explicitly noted in a mm/memory-failure.c comment.
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Use TOE/TSO on all TCP It is desireable to push the hardware accelerator to also process non-segmented TCP frames: we pass the skb->len to the "TOE/TSO" offloader and it will handle them. Without this quirk the driver becomes unstable and lock up and and crash. I do not know exactly why, but it is probably due to the TOE (TCP offload engine) feature that is coupled with the segmentation feature - it is not possible to turn one part off and not the other, either both TOE and TSO are active, or neither of them. Not having the TOE part active seems detrimental, as if that hardware feature is not really supposed to be turned off. The datasheet says: "Based on packet parsing and TCP connection/NAT table lookup results, the NetEngine puts the packets belonging to the same TCP connection to the same queue for the software to process. The NetEngine puts incoming packets to the buffer or series of buffers for a jumbo packet. With this hardware acceleration, IP/TCP header parsing, checksum validation and connection lookup are offloaded from the software processing." After numerous tests with the hardware locking up after something between minutes and hours depending on load using iperf3 I have concluded this is necessary to stabilize the hardware.
In the Linux kernel, the following vulnerability has been resolved: drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table The function atomctrl_initialize_mc_reg_table() and atomctrl_initialize_mc_reg_table_v2_2() does not check the return value of smu_atom_get_data_table(). If smu_atom_get_data_table() fails to retrieve vram_info, it returns NULL which is later dereferenced.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix NULL pointer deference on eir_get_service_data The len parameter is considered optional so it can be NULL so it cannot be used for skipping to next entry of EIR_SERVICE_DATA.
In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() Fix two DMA cleanup issues on the error path in sun8i_ce_cipher_prepare(): 1] If dma_map_sg() fails for areq->dst, the device driver would try to free DMA memory it has not allocated in the first place. To fix this, on the "theend_sgs" error path, call dma unmap only if the corresponding dma map was successful. 2] If the dma_map_single() call for the IV fails, the device driver would try to free an invalid DMA memory address on the "theend_iv" path: ------------[ cut here ]------------ DMA-API: sun8i-ce 1904000.crypto: device driver tries to free an invalid DMA memory address WARNING: CPU: 2 PID: 69 at kernel/dma/debug.c:968 check_unmap+0x123c/0x1b90 Modules linked in: skcipher_example(O+) CPU: 2 UID: 0 PID: 69 Comm: 1904000.crypto- Tainted: G O 6.15.0-rc3+ #24 PREEMPT Tainted: [O]=OOT_MODULE Hardware name: OrangePi Zero2 (DT) pc : check_unmap+0x123c/0x1b90 lr : check_unmap+0x123c/0x1b90 ... Call trace: check_unmap+0x123c/0x1b90 (P) debug_dma_unmap_page+0xac/0xc0 dma_unmap_page_attrs+0x1f4/0x5fc sun8i_ce_cipher_do_one+0x1bd4/0x1f40 crypto_pump_work+0x334/0x6e0 kthread_worker_fn+0x21c/0x438 kthread+0x374/0x664 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- To fix this, check for !dma_mapping_error() before calling dma_unmap_single() on the "theend_iv" path.
CVE-2025-38282 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.