Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes WPS runtime status to any attacker on the adjacent network. The `getStaticDhcpRules` CGI handler at `/cgi-bin/cstecgi.cgi` fails to enforce access control, allowing a crafted POST request to retrieve WPS operational state without credentials. No public exploit code or active exploitation has been identified at time of analysis; the EPSS score of 0.18% (7th percentile) reflects correspondingly low real-world exploitation interest.
Unauthenticated disclosure of advanced wireless configuration on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 is possible by any attacker with LAN or WiFi adjacency to the device. The getWiFiAdvancedCfg handler in /cgi-bin/cstecgi.cgi performs no access-control check before returning advanced WiFi settings in response to a crafted POST request. No public exploit has been identified and EPSS is very low (0.18%, 7th percentile); exploitation is bounded to adjacent-network attackers and carries no integrity or availability impact.
Unauthenticated access to the RebootSystem function in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any adjacent-network attacker to force an immediate device reboot by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CVSS vector (AV:A) constrains the attack to the same LAN or WiFi segment, limiting exposure to local network adversaries. No public exploit code has been confirmed and EPSS sits at 0.18% (7th percentile), reflecting negligible observed exploitation pressure; researcher coordination documents are publicly available on GitHub.
Unauthenticated information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) exposes schedule and scheduled-reboot configuration to any adjacent-network host. The CGI dispatcher at /cgi-bin/cstecgi.cgi serves the getScheduleCfg function without validating session credentials, allowing any LAN or Wi-Fi neighbor to retrieve timing configuration data via a crafted POST request. No public exploit identified at time of analysis, and the 0.18% EPSS score at the 7th percentile reflects very limited exploitation probability.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes mesh neighbor table data to any attacker on the adjacent network. The getMeshNeighborTable function in the /cgi-bin/cstecgi.cgi CGI interface fails to enforce access control, allowing a crafted POST request to retrieve mesh network topology without credentials. No public exploit or active exploitation is confirmed; EPSS at 0.18% and SSVC exploitation status of 'none' indicate minimal real-world threat at present.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes mesh portal table data to any adjacent network attacker. The getMeshPortalTable function in /cgi-bin/cstecgi.cgi performs no authentication check, allowing a crafted POST request to retrieve mesh network topology details without credentials. No active exploitation is confirmed and EPSS is low (0.18%), but the adjacent-network vector means exploitation is trivially simple for any attacker already on the local network.
Unauthenticated storage configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes the device's storage feature state to any attacker on the adjacent network. The `getStorageCfg` function in the CGI handler at `/cgi-bin/cstecgi.cgi` fails to enforce access control, allowing a crafted POST request to retrieve storage configuration data without credentials. Impact is limited to read-only disclosure of storage feature state - not credentials or encryption keys - and no public exploit or active exploitation has been identified at time of analysis.
Guest Wi-Fi configuration exposure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any adjacent-network attacker without credentials to retrieve the router's guest wireless settings by sending a crafted POST to /cgi-bin/cstecgi.cgi invoking the getWiFiGuestCfg function. The CGI dispatcher performs no session or privilege check before returning guest SSID and passphrase data, a pattern consistent with multiple other access-control deficiencies in the same firmware. No public exploit code or active exploitation has been identified; EPSS stands at 0.18% (7th percentile) and SSVC rates technical impact as partial.
Unauthenticated guest Wi-Fi credential exposure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows adjacent-network attackers to retrieve the guest network SSID and password by posting a crafted request to /cgi-bin/cstecgi.cgi targeting the getWiFiEasyGuestCfg handler, which performs no session or authentication validation before returning configuration data. The vulnerability is part of a broader pattern of access-control omissions across this firmware's CGI dispatcher. No public exploit or CISA KEV listing exists, and the 0.18% EPSS score (7th percentile) reflects minimal automated exploitation interest; the adjacent-network constraint (AV:A) limits the realistic attacker population to physically proximate parties.
Incorrect access control in the getDeviceInfo endpoint of TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes device identification details to unauthenticated adjacent-network attackers via a crafted POST request to /cgi-bin/cstecgi.cgi. The missing authentication check on this CGI function allows any host on the same network segment to enumerate device model, firmware version, and related identification metadata without credentials. No public exploit or active exploitation has been identified; with an EPSS of 0.18% (7th percentile) and adjacent-only reach, real-world risk is low.
Unauthenticated wireless credential exposure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any device on the adjacent network to retrieve SSIDs and Wi-Fi pre-shared keys by sending a crafted POST request to the router's `/cgi-bin/cstecgi.cgi` CGI endpoint invoking the `getWiFiBasicCfg` function. The handler performs no authentication check before returning sensitive wireless configuration data, meaning no credentials, tokens, or session state are required. No public exploit is identified at time of analysis, and EPSS sits at 0.18% (7th percentile), indicating limited observed exploitation pressure to date.
Unauthenticated DDNS credential disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any attacker on the local network to retrieve the router's configured DDNS domain, username, and password by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The getDdnsCfg function lacks any authentication gate (CWE-284), returning sensitive DDNS account credentials without verifying session state. No public exploit code and no CISA KEV entry exist; EPSS sits at 0.18%, indicating opportunistic rather than systematic exploitation.
Incorrect access control in the TOTOLINK T6 router firmware exposes VPN pass-through and WAN ping filter settings to unauthenticated adjacent-network attackers. Firmware version 4.1.5cu.748_B20211015 fails to enforce authentication on the getVpnPassCfg function reachable via a crafted POST to /cgi-bin/cstecgi.cgi, leaking network configuration data. EPSS sits at 0.18% (7th percentile), no public exploit code has been identified, and this CVE is not listed in the CISA KEV catalog.
Incorrect access control in the TOTOLINK T6 router's `getStaticDhcpRules` CGI handler exposes static DHCP reservation rules to any unauthenticated attacker within adjacent network range, requiring only a crafted POST to `/cgi-bin/cstecgi.cgi`. Affected firmware is version 4.1.5cu.748_B20211015; the attack vector is limited to adjacent network (LAN or Wi-Fi), narrowing the realistic threat surface considerably. No public exploit code or active exploitation has been identified; the EPSS score of 0.18% (7th percentile) confirms very low exploitation probability at time of analysis.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any adjacent-network attacker to retrieve traceroute diagnostic logs by sending a crafted POST request to /cgi-bin/cstecgi.cgi without credentials. The getTracerouteCfg function applies no access control (CWE-284), returning routing diagnostic data including network hop topology and IP addresses to any LAN-resident requester. EPSS is 0.17% (7th percentile), no CISA KEV listing exists, and no public exploit code has been identified, placing this firmly in a low-priority category despite the zero-authentication requirement.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes Telnet service enablement status to any attacker on the adjacent network segment. The getTelnetCfg function in the CGI interface fails to enforce access control, allowing an unauthenticated POST request to /cgi-bin/cstecgi.cgi to reveal whether the Telnet daemon is active - a reconnaissance-grade leak rather than a full compromise. No public exploitation or active KEV listing exists; EPSS at 0.17% (7th percentile) reflects minimal real-world exploitation interest.
Broken access control in WpEvently WordPress plugin versions 5.5.0 and earlier permits authenticated subscribers to invoke functionality or access data restricted to higher-privileged roles. The flaw is rooted in CWE-862 (Missing Authorization), meaning the plugin fails to enforce proper capability checks on one or more actions accessible to low-privilege users. No public exploit has been identified at time of analysis, and the absence of a KEV listing combined with the PR:L requirement limits opportunistic mass exploitation, though sites with open user registration face meaningful risk.
Subscriber-level Insecure Direct Object Reference (IDOR) in WP Job Portal WordPress plugin versions up to and including 2.5.9 allows low-privilege authenticated users to perform unauthorized modifications to job-related objects belonging to other users. The flaw arises from missing server-side authorization checks on user-controlled object identifiers, enabling a subscriber to target and alter records - such as job applications or listings - that they do not own. No confirmed active exploitation or public exploit code has been identified at time of analysis.
Broken access control in ACF Extended (WordPress plugin) through version 0.9.2.6 allows contributor-level authenticated users to perform privileged operations beyond their intended role boundaries. The root cause is CWE-862 (Missing Authorization): the plugin executes certain sensitive actions without verifying the requesting user holds sufficient permissions. No active exploitation or public proof-of-concept has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to exploit for any user holding a contributor account on an affected site.
Zephyr RTOS's WireGuard subsystem incorrectly bypasses Poly1305 authentication for keepalive packets, allowing a network attacker to spoof VPN connection status events on affected embedded devices. The flaw in `wg_process_data_message()` accepted any 16-byte type-4 transport-data message and returned before invoking `wg_decrypt_packet()`, meaning the Poly1305 MAC was never verified - only a cleartext receiver-index lookup and a non-cryptographic expiry check were performed. Exploitation is constrained to integrity spoofing of the `NET_EVENT_VPN_CONNECTED` management signal; no traffic injection, key disclosure, or session takeover is possible, and no public exploit has been identified at time of analysis.
IMAP compression in OX Dovecot Pro and CE enables a CRIME/BREACH-class side-channel attack where shared compression state across session responses leaks information about mailbox contents. An adversary who can both send mail to a target user and observe the byte sizes of that user's IMAP traffic can use response-size variations to confirm whether a small message body matches a guessed candidate text. No public exploits are known and the attack has not been confirmed as actively exploited; arbitrary content recovery was not demonstrated, bounding real-world impact to oracle-style guess confirmation against short messages.
Race condition in multer's file stream handling allows uploaded files exceeding the configured fileSize limit to bypass size-limit rejection when an application uses an asynchronous fileFilter in combination with the fileSize limit. All multer versions before 2.3.0 are affected. Practical impact is constrained because the underlying busboy multipart parser still truncates the stream at the configured limit, making this a logic bypass of the rejection mechanism rather than uncontrolled resource consumption or data exfiltration; the fix is available in multer 2.3.0.
Path traversal in flutter_file_picker's Android implementation (all versions through 10.3.10) allows a malicious Android app on the same device to write arbitrary files into the victim app's internal storage directories. The openFileStream() method in FileUtils.kt constructs file paths using the DISPLAY_NAME value returned by ContentResolver.query() without sanitization, making it trivially exploitable by a crafted ContentProvider that returns filenames containing ../ sequences. No public exploit has been identified at time of analysis; SSVC classifies exploitation as none and the attack is not automatable, keeping real-world risk constrained despite the clear code-level flaw.
Authenticated Sieve script manipulation in OX Dovecot Pro and CE allows low-privileged mail users to bypass configured per-user CPU resource limits and accumulate orphaned compiled script files on disk. By repeatedly switching the active Sieve script, an attacker resets the CPU accounting stored in each compiled artifact, circumventing the server-enforced cap indefinitely; separately, deleted or renamed scripts leave compiled files behind, causing unbounded disk growth. Sustained exploitation degrades mail delivery service across shared infrastructure. No public exploits are known, no CISA KEV listing exists, and the vendor-reported CVSS severity is Low (3.1).
Authentication bypass in OX Dovecot Pro and OX Dovecot CE (both Open-Xchange GmbH email server products) allows a low-privileged authenticated attacker to circumvent access controls and achieve limited integrity impact over the mail service. The vulnerability is classified under CWE-284 (Improper Access Control) and carries a low CVSS base score of 3.1, reflecting high attack complexity and constrained impact - no confidentiality or availability loss is indicated. No public exploit code is known and this CVE is not listed in the CISA KEV catalog.
Timing side-channel in OX Dovecot Pro and CE exposes the length of configured doveadm passwords and API keys to adjacent-network attackers who can send repeated unauthenticated requests and measure response latency with high precision. The secret value itself is never disclosed - only its length - which marginally reduces brute-force search space. No active exploitation is identified and no public exploit exists; the vendor-assigned CVSS score of 3.1 accurately reflects the constrained attack surface and limited practical impact.
Copilot Chat in Microsoft Edge (Chromium-based) exposes a race condition that enables an authorized, low-privileged attacker to disclose information across a component scope boundary over the network. The flaw arises from improper synchronization of concurrent access to a shared resource within the Copilot Chat feature, producing partial confidentiality and, per the official CVSS vector, limited integrity exposure. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Partial Denial of Service in NetApp StorageGRID versions 11.5 and higher arises from unbounded resource allocation (CWE-774) reachable only under a non-standard configuration and specific operational scenario. An authenticated network attacker with some degree of environmental control can exhaust handles or descriptors to degrade availability, though impact is explicitly partial and limited to the vulnerable system. No public exploit code has been identified and no active exploitation is confirmed; the vendor-assigned CVSS 4.0 score of 2.3 accurately reflects the tightly constrained real-world risk.
Race condition in filebrowser's TUS resumable upload handler allows authenticated low-privileged users to bypass declared Upload-Length limits by issuing concurrent PATCH requests to the same offset. Affected versions start at 2.24.0. A successful exploit causes files to be written beyond their declared sizes, and may trigger upload completion hooks for oversized payloads - potentially abusing downstream processing logic. No public exploit code or CISA KEV listing exists at time of analysis.
Credential hijacking in gitoxide before 0.38.2 allows remote attackers to redirect credential helper lookups to attacker-specified hosts by embedding bare carriage return characters in URLs supplied to gitoxide operations. Because gitoxide fails to sanitize these control characters before constructing credential helper protocol messages, injected fields override the legitimate host value, causing helpers to return stored credentials for a host the attacker controls rather than the intended repository host. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the CVSS 4.0 score of 2.3 reflects the high complexity, attack prerequisites, and user interaction requirements that substantially constrain real-world exploitability.
Stale public share links in filebrowser through 2.63.23 can silently redirect to unrelated files uploaded after a rename operation, unexpectedly exposing new content to anyone holding the original link. The defect (CWE-459, Incomplete Cleanup) arises because share records are keyed by file path rather than a file identifier - deletion triggers cleanup, but rename does not, leaving the share dormant. No public exploit or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score of 2.3 reflects the multi-step preconditions required, but the confidentiality risk is real for deployments where multiple users share create permissions on overlapping directories.
Stale public share links in File Browser 2.63.6-2.63.23 expose subsequently uploaded content to unauthenticated network access after a privileged user deletes another user's shared file without triggering proper link invalidation. Because the surviving share URL continues to resolve to whatever is later placed at the same storage path, an attacker who retains or discovers the original link can retrieve entirely unrelated files without authentication. No public exploit code is identified at time of analysis, and the CVSS 4.0 score of 2.3 reflects the constrained, multi-step preconditions required.
Stack buffer overflow in Ericsson CodeChecker through 6.28.2 results from an off-by-two error introduced during the CVE-2025-40843 remediation: the safe_strcpy() call at ldlogger-tool-gcc.c:129 receives destination pointer fullPath + 2 but the full PATH_MAX (4096) as its size bound, causing a deterministic 2-byte overwrite past the 4094 bytes that actually remain on every invocation of the GCC logger component. The overflow is unconditional and input-independent; a proof-of-concept is noted via the CVSS 4.0 E:P supplemental metric, though no active exploitation (CISA KEV) has been confirmed.
Reflected JSON injection in PrivateBin v2.0.4 and earlier allows remote unauthenticated attackers to inject arbitrary key/value pairs into JSON-LD API responses served at the /?jsonld= endpoint. PHP's FILTER_SANITIZE_URL passes double-quote characters through unmodified into JSON template construction via str_replace(), breaking out of the JSON string context and reflecting attacker-controlled fields. The vulnerable response path additionally omits X-Content-Type-Options: nosniff while setting Access-Control-Allow-Origin: *, enabling any cross-origin structured-data consumer to read the manipulated output. No public exploit or KEV listing exists, though the advisory includes a dynamically verified proof-of-concept on v2.0.4.
In the Linux kernel, the following vulnerability has been resolved: ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() It's pointless to call WARN_ON() in case of an allocation failure in dev_change_net_namespace() and device_rename(), since it only leads to useless splats caused by deliberate fault injections, so avoid it. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix potential NULL pointer dereference dasd_release_space() checks the implementation of the is_ese() discipline function before calling it to determine if a given device is an ESE DASD. The current usage of the logical AND operator will lead to a NULL pointer dereference as the function is called even if the function pointer is NULL. Fix this by using the logical OR operator.
In the Linux kernel, the following vulnerability has been resolved: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE pte_pfn() and pte_dirty() have undefined behaviour when called on a non-present PTE. In migrate_vma_collect_pmd(), these functions may be invoked on non-present entries (e.g., device-private entries), leading to potential crashes from pte_pfn() or incorrect dirty folio accounting from pte_dirty(). Fix both by guarding with pte_present() checks.
In the Linux kernel, the following vulnerability has been resolved: hwmon: (sht3x) Fix unaligned accesses Sashiko reports: In sht3x_update_client(), the 16-bit temperature and humidity values are extracted from a stack-allocated byte array using be16_to_cpup(). The pointers passed to this function are calculated as buf and buf + 3. Since the difference between the two pointers is an odd number of bytes, at least one of them is guaranteed to be at an unaligned offset. This will trigger an alignment fault on strict-alignment architectures such as ARMv5 or SPARC, resulting in a kernel panic. Fix the problem by using get_unaligned_be16() instead of be16_to_cpup(), and put_unaligned_be16() instead of cpu_to_be16().
In the Linux kernel, the following vulnerability has been resolved: tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions mmio_trace_rw() and mmio_trace_mapping() retrieve mmio_trace_array into tr and pass it to __trace_mmiotrace_rw() and __trace_mmiotrace_map(). If these functions are invoked while mmio_trace_array is NULL (e.g. before initialization or after disabled), accessing tr->array_buffer.buffer will result in a NULL pointer dereference crash. Fix this by adding an explicit NULL check for tr at the beginning of __trace_mmiotrace_rw() and __trace_mmiotrace_map().
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1]
In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Shutdown and free rx mailbox channel A mbox rx channel is requested using mbox_request_channel_byname() in probe. In remove callback, the rx mailbox channel is cleaned up when the rx_chan is NULL due to incorrect condition check. The mailbox channel is not shutdown and it can receive messages even after the device removal. This leads to use after free. Also the channel resources are not freed. Fix this by checking the rx_chan correctly.
In the Linux kernel, the following vulnerability has been resolved: media: atomisp: gc2235: fix UAF and memory leak gc2235_probe() handles its error paths incorrectly. If media_entity_pads_init() fails, gc2235_remove() is called, which tears down the subdev and frees dev, but then still falls through to atomisp_register_i2c_module(). This results in use-after-free. If atomisp_register_i2c_module() fails, the media entity and control handler are left initialized and dev is leaked. gc2235_remove() unconditionally calls media_entity_cleanup() and v4l2_ctrl_handler_free(), but these are not initialized at every error path in gc2235_probe(). Replace gc2235_remove() calls in the probe error paths with explicit unwind labels that free only the resources initialized at each point of failure, in reverse order of initialization.
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: npc: Fix size of entry2cntr_map KASAN prints below splat. This is caused by allocating counter for reserved mcam entry for cpt 2nd pass entry. But mcam->entry2cntr_map is not allocated for reserved entries. BUG: KASAN: slab-out-of-bounds in npc_map_mcam_entry_and_cntr+0xb0/0x1a0 Write of size 2 at addr ffff0001033e7ffe by task kworker/0:1/14 CPU: 0 PID: 14 Comm: kworker/0:1 Not tainted 6.1.67 #1 Hardware name: Marvell CN106XX board (DT) Workqueue: events work_for_cpu_fn Call trace: dump_backtrace.part.0+0xe4/0xf0 show_stack+0x18/0x30 dump_stack_lvl+0x88/0xb4 print_report+0x154/0x458 kasan_report+0xb8/0x194 __asan_store2+0x7c/0xa0 npc_map_mcam_entry_and_cntr+0xb0/0x1a0 rvu_mbox_handler_npc_mcam_write_entry+0x268/0x280 npc_install_flow+0x840/0xfe0 rvu_npc_install_cpt_pass2_entry+0x138/0x190 rvu_nix_init+0x148c/0x2880 rvu_probe+0x1800/0x30b0 local_pci_probe+0x78/0xe0 work_for_cpu_fn+0x30/0x50 process_one_work+0x4cc/0x97c worker_thread+0x360/0x630 kthread+0x1a0/0x1b0 ret_from_fork+0x10/0x20
In the Linux kernel, the following vulnerability has been resolved: ACPI: processor_idle: Mark LPI enter functions as __cpuidle When function tracing or Kprobes is enabled, entering an ACPI Low Power Idle (LPI) state triggers the following RCU splat: RCU not on for: acpi_idle_lpi_enter+0x4/0xd8 WARNING: CPU: 8 PID: 0 at include/linux/trace_recursion.h:162 function_trace_call+0x1e8/0x228 The acpi_idle_lpi_enter() function is invoked within the cpuidle path after RCU has already been disabled for the current local CPU. Consequently, ftrace's function_trace_call() expects RCU to be actively watching before recording trace data, emitting a warning if it is not. Fix this by annotating acpi_idle_lpi_enter(), the generic __weak stub, and the RISC-V implementation of acpi_processor_ffh_lpi_enter() with __cpuidle. This moves these functions into the '.cpuidle.text' section, implicitly disabling ftrace instrumentation (notrace) along this sensitive path and preventing trace-induced RCU warnings during idle entry.
In the Linux kernel, the following vulnerability has been resolved: EDAC/igen6: Fix call trace due to missing release() When unloading the igen6_edac driver, there is a call trace: Device '(null)' does not have a release() function, it is broken and must be fixed. See Documentation/core-api/kobject.rst. WARNING: drivers/base/core.c:2567 at device_release+0x84/0x90, CPU#5: rmmod/127209 ... RIP: 0010:device_release+0x84/0x90 Call Trace: <TASK> kobject_put+0x8c/0x220 put_device+0x17/0x30 igen6_unregister_mcis+0xa2/0xe0 [igen6_edac] igen6_remove+0x82/0xb0 [igen6_edac] ... Fix the call trace by providing empty release() functions for the memory controller devices.
In the Linux kernel, the following vulnerability has been resolved: coresight: ete: Always save state on power down System register ETMs and ETE are unlikely to be preserved on CPU power down. The ETE DT binding also never documented "arm,coresight-loses-context-with-cpu" so nobody would have legitimately been able to use that binding to fix it and ACPI has no such binding at all. Fix it by hard coding the setting for sysreg ETMs (ETE is always sysreg) or ACPI boots. Use a local variable when setting up save_state so that it's immune to concurrent probing when devices have different configurations which is an issue with modifying the global. This fixes the following error when using Coresight with ACPI on the FVP which supports CPU PM: coresight ete0: External agent took claim tag WARNING: drivers/hwtracing/coresight/coresight-core.c:248 at coresight_disclaim_device_unlocked+0xe0/0xe8, CPU#0: perf/117
In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg Sashiko found that user can cause this WARN_ON_ONCE() easily with adding a kprobe event based on a raw address with BTF parameter. Since this is not an unexpected condition, remove the WARN_ON_ONCE().
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() The helper function _ip_cprb_helper() uses internal buffer memory for building and processing CPRBs. After use this buffer was never scrubbed which could lead to leaving for example clear key material in memory which could be exposed via tricky reuse of this same memory. Extend the _ip_cprb_helper() function with another parameter 'scrub' used to steer scrubbing of this buffer. So now the caller has the opportunity to decide if scrubbing is needed or not. Extend the clear key to secure key token import process in function cca_clr2cipherkey() to tell the helper function from above to scrub the cprb buffer when the clear key value is part of the request data. Add explicit scrubbing on return from function cca_clr2cipherkey() for the random EXOR buffer and the cprb buffer. Overall this cleans the internal used buffer in case of clear key import to prevent sensitive data to get exposed.
In the Linux kernel, the following vulnerability has been resolved: igc: remove napi_synchronize() in igc_down() When an AF_XDP zero-copy application is killed abruptly, the XSK pool is torn down but NAPI keeps polling. igc_clean_rx_irq_zc() then returns the full budget on every poll, so napi_complete_done() never clears NAPI_STATE_SCHED. igc_down() calls napi_synchronize() before napi_disable(), so it spins forever waiting for that bit and the interface never goes down. Drop the napi_synchronize() and let napi_disable() do the job -- it sets NAPI_STATE_DISABLE, which forces the stuck poll to complete. Reorder it ahead of igc_set_queue_napi() so the NAPI mapping is cleared only after polling has stopped, matching the recent igb fix b1e067240379.
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, get_ss_info_from_atombios() uses calc_pll_cs->ctx->logger for logging. But calc_pll_cs->ctx is initialized only later in calc_pll_max_vco_construct(). Therefore, any output using DC_LOG_SYNC() leads to a NULL pointer deference in get_ss_info_from_atombios(). According to Sashiko, the very same problem exists in dce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers() too. To avoid accessing the NULL context, use clk_src->base.ctx->logger everywhere. That context in base is initialized earlier in dce110_clk_src_construct() and dce112_clk_src_construct(). Before get_ss_info_from_atombios() or Sashiko's get_pix_clk_dividers functions above are actually called. This is done by redefining DC_LOGGER to CTX->logger. Before: dce110_clk_src_construct() did: -> sets clk_src->base.ctx = ctx; -> ss_info_from_atombios_create() -> get_ss_info_from_atombios() <- uses calc_pll_cs->ctx # BOOM -> calc_pll_max_vco_construct() <- sets calc_pll_cs->ctx After: dce110_clk_src_construct() does: -> sets clk_src->base.ctx = ctx; -> ss_info_from_atombios_create() -> get_ss_info_from_atombios() <- uses clk_src->base.ctx (cherry picked from commit 6f16fcbb0c46a87e3d9685407e906573d60104b0)