Sensitive information disclosure in WordPress Ultimate Auction plugin up to version 4.3.3 allows unauthenticated remote attackers to retrieve embedded sensitive data from the application's responses. No authentication is required, making exploitation simple with only network access needed. Current threat intelligence indicates a very low risk of exploitation, with no active attacks observed.
Denial of service in WordPress Protect WP Admin plugin <=4.1 allows unauthenticated remote attackers to degrade availability. A missing authorization check enables exploitation of incorrectly configured access control security levels, causing a low-impact loss of availability without affecting confidentiality or integrity. The vulnerability has a low EPSS score (0.05%) and no known public exploit or active exploitation.
Unauthenticated access to a sensitive function in the Stylish Price List WordPress plugin through version 7.2.2 allows remote attackers to degrade service availability. The missing authorization check can be leveraged to perform actions that impact the plugin's availability without requiring login credentials. No active exploitation or public exploit code has been identified.
Unauthenticated modification of plugin data affects Feeds for YouTube plugin for WordPress through version 2.4.0. The vulnerability stems from a missing authorization check, allowing remote attackers to alter settings without authentication. Despite a CVSS base score of 5.3, only low integrity impact is possible, and no active exploitation or public proof-of-concept has been identified at the time of analysis.
Broken access control in Yaad Sarig Payment Gateway for WooCommerce (versions ≤2.2.11) allows unauthenticated remote attackers to bypass authorization checks and gain unauthorized access to payment gateway functions. With CVSS 9.1 (Critical) scoring reflecting network-accessible exploitation requiring no privileges or user interaction, attackers can read or modify sensitive payment data. EPSS score of 0.04% (14th percentile) suggests low observed exploitation probability despite severity. No public exploit identified at time of analysis, though the authentication bypass tag indicates potential for unauthorized transaction manipulation or data exposure in WordPress e-commerce environments.
Unauthenticated remote attackers can bypass access controls in ZEEN101 Leaky Paywall WordPress plugin versions up to 4.22.6, gaining unauthorized access to restricted content through incorrectly configured security levels. The vulnerability requires no user interaction and can be exploited over the network, though it is limited to information disclosure (CVSS 5.3, EPSS 0.04%). No public exploit code or active exploitation has been identified at time of analysis.
Missing authorization in WP Compress for MainWP plugin versions up to 6.50.17 allows unauthenticated remote attackers to modify plugin settings due to incorrectly configured access control, affecting integrity of compressed content and plugin configuration without requiring authentication or user interaction.
Unauthenticated remote attackers can access sensitive sitemap data in Google XML Sitemaps WordPress plugin versions through 4.1.22 due to missing authorization checks on sitemap endpoints. The vulnerability allows unauthorized information disclosure of site structure and indexed pages without requiring authentication or user interaction. While the CVSS score is moderate (5.3), real-world exploitation probability is very low (EPSS 0.04th percentile), suggesting this is primarily an information disclosure risk rather than an active threat.
Authorization bypass in FAPI Member WordPress plugin through version 2.2.29 allows unauthenticated remote attackers to access or modify resources via insecure direct object references (IDOR) exploiting misconfigured access control security levels. The vulnerability requires no authentication, low attack complexity, and results in confidentiality and integrity impact without availability compromise. EPSS score of 0.04% indicates minimal real-world exploitation probability despite the moderate CVSS score.
Missing authorization in g5theme Essential Real Estate WordPress plugin version 5.2.9 and earlier allows authenticated users to access or modify restricted resources by exploiting inadequately configured access controls. An attacker with low-privilege WordPress account credentials can leverage the broken access control to view sensitive information and make unauthorized modifications without requiring administrative approval. No public exploit code is currently identified, though the vulnerability is documented in the Patchstack security database.
Information disclosure in the TI WooCommerce Wishlist WordPress plugin (≤2.10.0) allows unauthenticated attackers to read any user's wishlist data due to missing authorization checks. The vulnerability has a low CVSS base score of 5.3 and an extremely low EPSS exploitation probability (0.02%), indicating minimal real-world risk. No public exploit or active exploitation has been reported.
Denial-of-service vulnerability in Strategy11’s Business Directory Plugin for WordPress (≤ 6.4.19) allows authenticated high-privileged attackers to disrupt site availability. The flaw stems from missing authorization checks, permitting an admin-level user to trigger an action with high availability impact. No public exploit is known, and EPSS (0.06%) indicates low exploitation probability despite the network-based attack vector.
WCFM Marketplace plugin through version 3.7.1 fails to properly enforce authorization controls, allowing authenticated users with limited privileges to cause denial of service or access functionality they should not have. The vulnerability affects the WordPress plugin across all installations through the specified version, exploiting incorrectly configured access control security levels via network-accessible endpoints. With an EPSS score of 0.05% and low real-world exploitation probability, this represents a privilege escalation risk primarily for multi-vendor marketplace administrators.
Arbitrary content deletion in WordPress Ultimate Learning Pro plugin versions <= 3.9.3 allows authenticated high-privilege users to delete learning content without proper authorization checks. An attacker with instructor or administrator access can delete arbitrary posts, lessons, or courses, resulting in high integrity impact but no data theft or system disruption. The vulnerability is not known to be actively exploited and has very low exploitation likelihood (EPSS 0.05%).
Open redirect vulnerability in wpWax Directorist WordPress plugin versions up to 8.6.6 allows unauthenticated remote attackers to redirect users to arbitrary external websites via crafted URL parameters, enabling phishing attacks. The vulnerability requires user interaction (clicking a malicious link) but has a network attack vector with low complexity. EPSS exploitation probability is very low at 0.04%, and no active exploitation or public proof-of-concept has been identified.
Low-privileged authenticated users of the e-plugins Directory Pro WordPress plugin (<=2.5.6) can bypass access controls due to a missing authorization flaw, potentially modifying plugin data. The vulnerability has a medium CVSS score (4.3) with low integrity impact, and no active exploitation or public exploit has been reported; EPSS score of 0.05% indicates a low probability of in-the-wild attacks.
We are tasked to synthesize data from multiple intelligence sources about CVE-2025-59001 into a comprehensive analysis, returning a JSON object with specific fields. We need to cross-reference the data, provide original synthesis, and adhere to strict rules. Input data: - CVE ID: CVE-2025-59001 - Description: "Missing Authorization vulnerability in ThemeNectar Salient Core salient-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salient Core: from n/a through <= 3.0.8." - CVSS Score: 4.3 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - CWE: CWE-862 (Missing Authorization) - EPSS Score: 0.05% (percentile 16%) - Reported by: audit@patchstack.com - Tags: Authentication Bypass (Note: tags might be from Patchstack, but we'll incorporate) - References: [nvd] (None) but actually a Patchstack URL: https://patchstack.com/database/Wordpress/Plugin/salient-core/vulnerability/wordpress-salient-core-plugin-3-0-8-broken-access-control-vulnerability?_s_id=cve - Also, there is no KEV status provided, no POC status mentioned. We must not assume KEV. Our exploitation status phrase: no public exploit identified at time of analysis (since no KEV, no POC stated). But wait, Patchstack might have reported, but we have no explicit "POC=YES" in the data. So we'll use that phrase. We need to fill fields: 1. product_name: "1-3 words ONLY. The specific product or service name affected." It's "Salient Core". That's a WordPress plugin by ThemeNectar. So "Salient Core" works. 2. summary: "2-3 sentence plain-language summary for security professionals. CRITICAL: Do NOT copy or paraphrase the Description — write an original synthesis using all available data. Do NOT start with 'A vulnerability', 'A problem', 'A flaw', or 'An issue'. Start with the specific impact verb and product, e.g. 'Remote code execution in Apache Tomcat 9.x allows...' or 'Cortex XDR agent on macOS can be disabled by local admins via...'. Explain WHAT the vulnerability is, WHO is affected (specific product/version), and WHAT an attacker can do. Mention if actively exploited (KEV), if POC exists, and EPSS risk if notable." So, missing authorization in Salient Core plugin <=3.0.8 allows authenticated users to exploit incorrectly configured access control to modify some data (I:L, integrity impact low, no confidentiality or availability). No active exploitation known, and EPSS is low (0.05%). So summary: "Authenticated attackers can exploit a missing authorization check in ThemeNectar Salient Core plugin versions through 3.0.8 to modify data without proper permissions. The vulnerability results from incorrectly configured access control security levels, with low integrity impact and no confidentiality or availability impact. EPSS probability is very low (0.05%), and no public exploit code or active exploitation has been identified at this time." That's original. 3. technical_context: "Explain the underlying technology/library/protocol involved. Use CPE data to identify exact affected products. Reference the CWE to explain the root cause class. Be specific and educational." No CPE data provided, so we can mention that CPE is not available, but the product is a WordPress plugin. We can talk about missing authorization (CWE-862) and how access control in WordPress plugins can be misconfigured. Also, the Patchstack link likely provides details. We'll say: "The Salient Core plugin for WordPress is affected by a missing authorization vulnerability (CWE-862). This class of weakness occurs when a web application does not properly restrict access to privileged functionality, allowing low-privileged authenticated users to perform actions that should require higher permissions. The vulnerability is in the plugin's access control mechanisms, which fail to enforce correct security levels. No CPE information is provided, but the vendor's plugin is available on WordPress.org or ThemeNectar's site." 4. risk_assessment: "Assess real-world risk using ALL available signals: CVSS vector (attack vector, complexity, privileges), EPSS exploitation probability, KEV status, POC availability, SSVC decision framework (exploitation status, automatable, technical impact). Compare and contrast these signals. Is this a real priority or just a high-CVSS-but-low-real-risk issue? If any key data is missing or conflicting, STATE IT EXPLICITLY, e.g.: 'CVSS indicates network vector but description implies local access — verify with vendor.' or 'EPSS score is low despite KEV listing, suggesting targeted rather than widespread exploitation.' Do NOT present uncertain information as confirmed fact." So here: CVSS 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. It's network exploitable, low complexity, low privileges required (authenticated, any user), no user interaction, unchanged scope, only integrity low impact. EPSS 0.05% (very low). No KEV, no POC. SSVC: exploitation=none (no public exploit), automatable=maybe (AC:L, but needs authentication, so perhaps not fully automatable without credentials), technical impact=partial (integrity modification). So risk is low. We'll say: "The CVSS score is low (4.3) due to limited impact, but the vector indicates an authenticated remote attack with low complexity. EPSS probability of exploitation is negligible (0.05%, percentile 16%), and there is no evidence of active exploitation or public exploit code. This vulnerability does not appear to be a high-priority threat, as it requires authentication and only allows integrity modification, not compromising confidential data or system availability. The missing authorization likely stems from a configuration specific to the plugin's access control levels, so risk is contextual." A note: no data conflicts; CVSS aligns with description. 5. affected_products: "Write a concise paragraph listing affected products with their versions. Include product name, version range, CPE if available, and link to vendor advisory from references. Do NOT use bullet points, JSON, or key-value formatting." So: "ThemeNectar Salient Core plugin for WordPress, versions from n/a through 3.0.8, are affected. The vendor advisory is available at https://patchstack.com/database/Wordpress/Plugin/salient-core/vulnerability/wordpress-salient-core-plugin-3-0-8-broken-access-control-vulnerability?_s_id=cve." (Use the reference link). No CPE mentioned, so skip that. 6. remediation: "Write a concise paragraph with actionable remediation steps. Start with the primary fix (patch/upgrade with exact version), then mention workarounds if relevant. Include advisory URLs from references. If no patch is available, suggest SPECIFIC compensating controls with their trade-offs — not generic 'apply defense in depth' but actionable: 'Disable X feature', 'Block Y port', 'Restrict access to Z endpoint'. Note side effects of each mitigation. Do NOT use bullet points, JSON, or key-value formatting." The description says "from n/a through <= 3.0.8", implying that version 3.0.8 is the highest affected, and presumably fixed in version above that, but no specific fix version is given. Patchstack advisory may have details. Since we only have the link, we can check if it says "Fixed in version: 3.0.9" or something. But we don't have that info from the input, just the URL. I can't access it, so I'll assume there is a patch. The data says "Missing Authorization vulnerability... This issue affects Salient Core: from n/a through <= 3.0.8." Typically, Patchstack entries include a fixed version. But in this input, no fix version explicitly. I'll phrase: "Upgrade Salient Core to a version newer than 3.0.8. The vendor has not explicitly announced a fixed version in the CVE data, but the advisory at Patchstack likely provides details. As a workaround, administrators can restrict access to the affected plugin's functionality by reviewing and hardening access control settings until an update is applied, though this may require manual configuration review." But we must not invent version numbers. If no patch is known, I will state that. However, given the structure, I'll say "Update to a patched version beyond 3.0.8" – but that is an inference. Better: "The advisory at Patchstack (see reference) indicates the vulnerability affects versions up to 3.0.8; update to the latest version, which should contain the fix. If no patch is yet available, restrict access to authenticated users with necessary roles, or disable the plugin temporarily. Disabling the plugin may affect functionality dependent on Salient Core." I'll incorporate the reference. 7. exploit_scenario: "Brief realistic attack scenario in 2-3 sentences. If POC exists, note that. Factor in attack vector and complexity from CVSS." No POC exists. Attack scenario: "An authenticated low-privileged user, such as a subscriber on a WordPress site, crafts a request to a Salient Core endpoint that lacks proper authorization checks. Due to missing access control, the user modifies settings or content they should not have permission to alter, leading to unauthorized data modification." This matches AV:N, PR:L, UI:N, I:L. 8. exploitation_conditions: "CRITICAL FIELD — security teams make real decisions based on this. Extract SPECIFIC, CONCRETE prerequisites from the CVE description. Name the EXACT product feature, protocol, configuration setting, or deployment mode required. If the description says 'when configured with...' or 'if the X feature is enabled' — that IS the condition. If genuinely no special conditions (AV:N/AC:L/PR:N/UI:N), state: 'No special conditions — remote unauthenticated exploitation against default configurations of [PRODUCT NAME].' Also state what LIMITS exploitation: required user interaction, authentication level, non-default configuration, specific platform/version. These limiting factors help defenders assess realistic risk beyond raw CVSS score. FORBIDDEN generic phrases: 'Network access required.' / 'Specific configuration needed.' / 'Depends on deployment.'" From the description: "Missing Authorization vulnerability ... allows Exploiting Incorrectly Configured Access Control Security Levels." This implies that the vulnerability is due to incorrectly configured access control security levels. So the condition might be that access control security levels are not correctly configured. However, the CVSS vector has PR:L, so it requires authentication with low privileges. So specific conditions: "Exploitation requires an authenticated user with low privileges (e.g., subscriber) on a WordPress site where the Salient Core plugin is active. The vulnerability manifests when access control security levels are misconfigured, potentially due to the plugin's default settings. No user interaction is required. No other special conditions; the attack vector is network-based, and complexity is low." That's specific enough. The "incorrectly configured" might be inherent to the plugin's code rather than a site-specific misconfiguration, but it's a missing authorization check. So I'll phrase: "Exploitation requires an authenticated low-privilege user account on a WordPress instance running Salient Core 3.0.8 or earlier. The vulnerability exists in the plugin's access control mechanisms, specifically when handling requests to certain endpoints where permissions are not properly enforced. No other prerequisites such as enabled features or non-default settings are needed, but the attacker must have valid credentials." 9. attack_chain: "3-7 short steps separated by ' → ' (arrow), following kill chain phases. Use as many steps as the attack realistically requires. Each step is 3-8 words. Must be grounded in actual CVE data (attack vector, privileges, scope from CVSS). Phase templates by length: 3-step: Access → Exploit → Impact. 4-step: Access → Exploit → Execution → Impact. 5-step: Access → Delivery → Exploit → Execution → Impact. 6-step: Access → Delivery → Exploit → Execution → Persist → Impact. 7-step: Recon → Delivery → Exploit → Install → C2 → Execute → Impact. Example: 'Send crafted HTTP request → Trigger buffer overflow in parser → Execute arbitrary code as root'. No numbering, no prose, just the chain." So: Access: "Authenticate with low-privilege user account" -> Exploit: "Send request to unprotected endpoint" (or "Craft request to bypass authorization") -> Impact: "Modify data without proper authorization". That's 3 steps: "Authenticate as low-privileged user → Send crafted request to missing-auth endpoint → Unauthorized data modification". Alternatively, could be 4 steps: Access -> Delivery (sending the request) -> Exploit (the missing check allows access) -> Impact. But 3 steps suffices: "Access: obtain low-privilege credentials" → "Exploit: invoke
Authenticated low-privileged users can exploit missing authorization in the Accessibility by AudioEye WordPress plugin (≤1.0.49) to modify plugin data, resulting in a limited integrity impact. The vulnerability allows attackers with subscriber roles to bypass access controls on plugin endpoints, though no active exploitation or public exploit code is currently known. The CVSS score of 4.3 reflects its low severity.
Unauthorized access to attachment management exists in the Import external attachments WordPress plugin, allowing low-privileged users to modify external attachment settings or data without proper authorization checks. Versions up to 1.5.12 are vulnerable, and remote attackers with subscriber-level or similar accounts can exploit this missing authorization (CWE-862). No active exploitation or public proof-of-concept code is reported at the time of analysis, and EPSS indicates a low exploitation probability (0.05%).
Unauthorized modification of Elementor widget restrictions in the Restrict Elementor Widgets plugin for WordPress allows authenticated users with low privileges to bypass access controls. Affecting versions up to and including 1.12, this missing authorization flaw can be exploited to alter widget, column, and section restrictions without proper permissions. No active exploitation is confirmed, and the EPSS score remains low at 0.05%.
Authenticated attackers with low-level privileges can modify plugin data in the WP Coupons and Deals WordPress plugin through version 3.2.4 due to missing authorization checks. This integrity-only impact (CVSS 4.3) requires an already-authorized low-privilege user account, limiting risk. No active exploitation has been reported, and the EPSS probability is 0.05% (14th percentile), indicating very low exploitation likelihood.
Authenticated low-privilege attackers can bypass access controls in the WPS Bidouille WordPress plugin through version 1.33.1, allowing unauthorized modification of plugin data. The vulnerability has a low EPSS score (0.05%) and no public exploit or active exploitation is currently reported.
Missing authorization in the SKT Page Builder WordPress plugin allows authenticated attackers to modify page content. The vulnerability permits low-privilege users (e.g., subscribers) to perform unauthorized actions due to incorrectly configured access control security levels. No public exploit or active exploitation is confirmed, but the low privilege requirement poses a moderate insider threat risk.
Missing authorization in the WordPress Read More & Accordion plugin (expand-maker) versions 3.5.5.1 and earlier allows authenticated users to access restricted functionality through incorrectly configured access controls, potentially revealing sensitive information. The vulnerability requires user authentication and network access but carries a CVSS score of 6.5 due to high confidentiality impact, though real-world exploitation probability remains low at 0.04% EPSS. No public exploit code or active exploitation has been identified at time of analysis.
Inadequately configured access control in Easy Property Listings WordPress plugin versions 3.5.21 and earlier allows authenticated users to access sensitive information they should not be authorized to view. An authenticated attacker with user-level privileges can bypass authorization checks to read property listing data or other restricted content due to missing authorization validation on API endpoints or functionality. EPSS exploitation probability is very low at 0.04%, and no public exploit code has been identified, indicating limited real-world threat despite the authentication-bypass tag.
Authenticated users with limited privileges can access search and replace functionality in CM On Demand Search And Replace WordPress plugin (versions up to 1.5.5) due to missing authorization checks on restricted features. An attacker with basic user credentials can perform privileged actions intended only for administrators, affecting data confidentiality through unauthorized content access. This is confirmed as an authentication bypass vulnerability with low real-world exploitation probability (EPSS 0.04%) despite the missing authorization flaw.
Cross-site request forgery in the RTL Tester WordPress plugin through version 1.2 allows unauthenticated attackers to trick administrative users into toggling the RTL test mode, causing temporary site layout changes. This low-severity issue (CVSS 4.3) has a very low exploitation probability (EPSS 0.03%) and no known active exploitation or public exploit code.
Cross-site request forgery in the Quick Interest Slider WordPress plugin (versions up to 3.1.5) allows unauthenticated attackers to deceive authenticated administrators into executing unauthorized actions, such as modifying plugin settings. No public exploit code or active exploitation has been identified, and EPSS predicts a very low exploitation probability.
Authenticated attackers with Contributor-level access or above can delete or generate featured images on posts they do not own in the Auto Featured Image (Auto Post Thumbnail) WordPress plugin through version 4.2.1, due to a missing capability check in the bulk_action_generate_handler function. The vulnerability requires user authentication and has a CVSS score of 4.3; no public exploit code or active exploitation has been confirmed at the time of analysis.
Missing authorization in WCFM - Frontend Manager for WooCommerce through version 6.7.24 allows authenticated users with limited privileges to bypass access controls via incorrectly configured security levels, enabling read-only disclosure of sensitive information. The vulnerability requires user interaction and has a low EPSS score (0.03%, 10th percentile), indicating minimal real-world exploitation probability despite the authentication requirement.
SQL injection in Xiongwei Smart Catering Cloud Platform 2.1.6446.28761 allows authenticated remote attackers to manipulate the filter parameter in the /dishtrade/dish_trade_detail_get endpoint, resulting in limited confidentiality and integrity impact. Public exploit code exists; however, the CVSS score of 2.1 and EPSS percentile of 16% indicate low real-world exploitation probability despite authenticated network accessibility, suggesting the vulnerability may require specific application knowledge or platform-dependent conditions to achieve meaningful impact.
In the Linux kernel, the following vulnerability has been resolved: afs: Fix delayed allocation of a cell's anonymous key The allocation of a cell's anonymous key is done in a background thread along with other cell setup such as doing a DNS upcall. In the reported bug, this is triggered by afs_parse_source() parsing the device name given to mount() and calling afs_lookup_cell() with the name of the cell. The normal key lookup then tries to use the key description on the anonymous authentication key as the reference for request_key() - but it may not yet be set and so an oops can happen. This has been made more likely to happen by the fix for dynamic lookup failure. Fix this by firstly allocating a reference name and attaching it to the afs_cell record when the record is created. It can share the memory allocation with the cell name (unfortunately it can't just overlap the cell name by prepending it with "afs@" as the cell name already has a '.' prepended for other purposes). This reference name is then passed to request_key(). Secondly, the anon key is now allocated on demand at the point a key is requested in afs_request_key() if it is not already allocated. A mutex is used to prevent multiple allocation for a cell. Thirdly, make afs_request_key_rcu() return NULL if the anonymous key isn't yet allocated (if we need it) and then the caller can return -ECHILD to drop out of RCU-mode and afs_request_key() can be called. Note that the anonymous key is kind of necessary to make the key lookup cache work as that doesn't currently cache a negative lookup, but it's probably worth some investigation to see if NULL can be used instead.
Linux kernel binfmt_misc module fails to restore write access to executable files when error handling closes improperly opened file descriptors, potentially causing subsequent write operations on the same file to fail and creating a denial-of-service condition for legitimate file modifications. The vulnerability affects the bm_register_write() function which uses open_exec() to open executable files with intentionally denied write permissions, but does not call exe_file_allow_write_access() before closing the file on error paths. With an EPSS score of 0.03% (8th percentile), this represents a low exploitation probability; no public exploit has been identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind There is a potential race condition between sock bind and socket write iter. bind may free the same cmd via mgmt_pending before write iter sends the cmd, just as syzbot reported in UAF[1]. Here we use hci_dev_lock to synchronize the two, thereby avoiding the UAF mentioned in [1]. [1] syzbot reported: BUG: KASAN: slab-use-after-free in mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316 Read of size 8 at addr ffff888077164818 by task syz.0.17/5989 Call Trace: mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316 set_link_security+0x5c2/0x710 net/bluetooth/mgmt.c:1918 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 sock_write_iter+0x279/0x360 net/socket.c:1195 Allocated by task 5989: mgmt_pending_add+0x35/0x140 net/bluetooth/mgmt_util.c:296 set_link_security+0x557/0x710 net/bluetooth/mgmt.c:1910 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 sock_write_iter+0x279/0x360 net/socket.c:1195 Freed by task 5991: mgmt_pending_free net/bluetooth/mgmt_util.c:311 [inline] mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257 mgmt_index_removed+0x112/0x2f0 net/bluetooth/mgmt.c:9477 hci_sock_bind+0xbe9/0x1000 net/bluetooth/hci_sock.c:1314
In the Linux kernel, the following vulnerability has been resolved: mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). syzbot reported divide-by-zero in __tcp_select_window() by MPTCP socket. [0] We had a similar issue for the bare TCP and fixed in commit 499350a5a6e7 ("tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0"). Let's apply the same fix to mptcp_do_fastclose(). [0]: Oops: divide error: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 6068 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:__tcp_select_window+0x824/0x1320 net/ipv4/tcp_output.c:3336 Code: ff ff ff 44 89 f1 d3 e0 89 c1 f7 d1 41 01 cc 41 21 c4 e9 a9 00 00 00 e8 ca 49 01 f8 e9 9c 00 00 00 e8 c0 49 01 f8 44 89 e0 99 <f7> 7c 24 1c 41 29 d4 48 bb 00 00 00 00 00 fc ff df e9 80 00 00 00 RSP: 0018:ffffc90003017640 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88807b469e40 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90003017730 R08: ffff888033268143 R09: 1ffff1100664d028 R10: dffffc0000000000 R11: ffffed100664d029 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 000055557faa0500(0000) GS:ffff888126135000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f64a1912ff8 CR3: 0000000072122000 CR4: 00000000003526f0 Call Trace: <TASK> tcp_select_window net/ipv4/tcp_output.c:281 [inline] __tcp_transmit_skb+0xbc7/0x3aa0 net/ipv4/tcp_output.c:1568 tcp_transmit_skb net/ipv4/tcp_output.c:1649 [inline] tcp_send_active_reset+0x2d1/0x5b0 net/ipv4/tcp_output.c:3836 mptcp_do_fastclose+0x27e/0x380 net/mptcp/protocol.c:2793 mptcp_disconnect+0x238/0x710 net/mptcp/protocol.c:3253 mptcp_sendmsg_fastopen+0x2f8/0x580 net/mptcp/protocol.c:1776 mptcp_sendmsg+0x1774/0x1980 net/mptcp/protocol.c:1855 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0xe5/0x270 net/socket.c:742 __sys_sendto+0x3bd/0x520 net/socket.c:2244 __do_sys_sendto net/socket.c:2251 [inline] __se_sys_sendto net/socket.c:2247 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2247 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f66e998f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffff9acedb8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f66e9be5fa0 RCX: 00007f66e998f749 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007ffff9acee10 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007f66e9be5fa0 R14: 00007f66e9be5fa0 R15: 0000000000000006 </TASK>
In the Linux kernel, the following vulnerability has been resolved: bfs: Reconstruct file type when loading from disk syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted or when the 32bits "attributes" field loaded from disk are corrupted. A documentation says that BFS uses only lower 9 bits of the "mode" field. But I can't find an explicit explanation that the unused upper 23 bits (especially, the S_IFMT bits) are initialized with 0. Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk. Also, verify that the value of the "attributes" field loaded from disk is either BFS_VREG or BFS_VDIR (because BFS supports only regular files and the root directory).
In the Linux kernel, the following vulnerability has been resolved: ext4: refresh inline data size before write operations The cached ei->i_inline_size can become stale between the initial size check and when ext4_update_inline_data()/ext4_create_inline_data() use it. Although ext4_get_max_inline_size() reads the correct value at the time of the check, concurrent xattr operations can modify i_inline_size before ext4_write_lock_xattr() is acquired. This causes ext4_update_inline_data() and ext4_create_inline_data() to work with stale capacity values, leading to a BUG_ON() crash in ext4_write_inline_data(): kernel BUG at fs/ext4/inline.c:1331! BUG_ON(pos + len > EXT4_I(inode)->i_inline_size); The race window: 1. ext4_get_max_inline_size() reads i_inline_size = 60 (correct) 2. Size check passes for 50-byte write 3. [Another thread adds xattr, i_inline_size changes to 40] 4. ext4_write_lock_xattr() acquires lock 5. ext4_update_inline_data() uses stale i_inline_size = 60 6. Attempts to write 50 bytes but only 40 bytes actually available 7. BUG_ON() triggers Fix this by recalculating i_inline_size via ext4_find_inline_data_nolock() immediately after acquiring xattr_sem. This ensures ext4_update_inline_data() and ext4_create_inline_data() work with current values that are protected from concurrent modifications. This is similar to commit a54c4613dac1 ("ext4: fix race writing to an inline_data file while its xattrs are changing") which fixed i_inline_off staleness. This patch addresses the related i_inline_size staleness issue.