Information Disclosure

CVE-2022-50483 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clean up si_domain in the init_dmars() error path A splat from kmem_cache_destroy() was seen with a kernel prior to commit ee2653bbe89d ("iommu/vt-d: Remove domain and devinfo mempool") when there was a failure in init_dmars(), because the iommu_domain cache still had objects. While the mempool code is now gone, there still is a leak of the si_domain memory if init_dmars() fails. So clean up si_domain in the init_dmars() error path.

CVE-2022-50480 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.

In the Linux kernel, the following vulnerability has been resolved: drm/amd: fix potential memory leak This patch fix potential memory leak (clk_src) when function run into last return NULL. s/free/kfree/ - Alex

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() Patch series "nilfs2: fix UBSAN shift-out-of-bounds warnings on mount time". The first patch fixes a bug reported by syzbot, and the second one fixes the remaining bug of the same kind. Although they are triggered by the same super block data anomaly, I divided it into the above two because the details of the issues and how to fix it are different. Both are required to eliminate the shift-out-of-bounds issues at mount time. This patch (of 2): If the block size exponent information written in an on-disk superblock is corrupted, nilfs_sb2_bad_offset helper function can trigger shift-out-of-bounds warning followed by a kernel panic (if panic_on_warn is set): shift exponent 38983 is too large for 64-bit type 'unsigned long long' Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_shift_out_of_bounds+0x33d/0x3b0 lib/ubsan.c:322 nilfs_sb2_bad_offset fs/nilfs2/the_nilfs.c:449 [inline] nilfs_load_super_block+0xdf5/0xe00 fs/nilfs2/the_nilfs.c:523 init_nilfs+0xb7/0x7d0 fs/nilfs2/the_nilfs.c:577 nilfs_fill_super+0xb1/0x5d0 fs/nilfs2/super.c:1047 nilfs_mount+0x613/0x9b0 fs/nilfs2/super.c:1317 ... In addition, since nilfs_sb2_bad_offset() performs multiplication without considering the upper bound, the computation may overflow if the disk layout parameters are not normal. This fixes these issues by inserting preliminary sanity checks for those parameters and by converting the comparison from one involving multiplication and left bit-shifting to one using division and right bit-shifting.

In the Linux kernel, the following vulnerability has been resolved: rtc: class: Fix potential memleak in devm_rtc_allocate_device() devm_rtc_allocate_device() will alloc a rtc_device first, and then run dev_set_name(). If dev_set_name() failed, the rtc_device will memleak. Move devm_add_action_or_reset() in front of dev_set_name() to prevent memleak. unreferenced object 0xffff888110a53000 (size 2048): comm "python3", pid 470, jiffies 4296078308 (age 58.882s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 08 30 a5 10 81 88 ff ff .........0...... 08 30 a5 10 81 88 ff ff 00 00 00 00 00 00 00 00 .0.............. backtrace: [<000000004aac0364>] kmalloc_trace+0x21/0x110 [<000000000ff02202>] devm_rtc_allocate_device+0xd4/0x400 [<000000001bdf5639>] devm_rtc_device_register+0x1a/0x80 [<00000000351bf81c>] rx4581_probe+0xdd/0x110 [rtc_rx4581] [<00000000f0eba0ae>] spi_probe+0xde/0x130 [<00000000bff89ee8>] really_probe+0x175/0x3f0 [<00000000128e8d84>] __driver_probe_device+0xe6/0x170 [<00000000ee5bf913>] device_driver_attach+0x32/0x80 [<00000000f3f28f92>] bind_store+0x10b/0x1a0 [<000000009ff812d8>] drv_attr_store+0x49/0x70 [<000000008139c323>] sysfs_kf_write+0x8d/0xb0 [<00000000b6146e01>] kernfs_fop_write_iter+0x214/0x2d0 [<00000000ecbe3895>] vfs_write+0x61a/0x7d0 [<00000000aa2196ea>] ksys_write+0xc8/0x190 [<0000000046a600f5>] do_syscall_64+0x37/0x90 [<00000000541a336f>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

In the Linux kernel, the following vulnerability has been resolved: ntb_netdev: Use dev_kfree_skb_any() in interrupt context TX/RX callback handlers (ntb_netdev_tx_handler(), ntb_netdev_rx_handler()) can be called in interrupt context via the DMA framework when the respective DMA operations have completed. As such, any calls by these routines to free skb's, should use the interrupt context safe dev_kfree_skb_any() function. Previously, these callback handlers would call the interrupt unsafe version of dev_kfree_skb(). This has not presented an issue on Intel IOAT DMA engines as that driver utilizes tasklets rather than a hard interrupt handler, like the AMD PTDMA DMA driver. On AMD systems, a kernel WARNING message is encountered, which is being issued from skb_release_head_state() due to in_hardirq() being true. Besides the user visible WARNING from the kernel, the other symptom of this bug was that TCP/IP performance across the ntb_netdev interface was very poor, i.e. approximately an order of magnitude below what was expected. With the repair to use dev_kfree_skb_any(), kernel WARNINGs from skb_release_head_state() ceased and TCP/IP performance, as measured by iperf, was on par with expected results, approximately 20 Gb/s on AMD Milan based server. Note that this performance is comparable with Intel based servers.

In the Linux kernel, the following vulnerability has been resolved: macintosh: fix possible memory leak in macio_add_one_device() Afer commit 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array"), the name of device is allocated dynamically. It needs to be freed when of_device_register() fails. Call put_device() to give up the reference that's taken in device_initialize(), so that it can be freed in kobject_cleanup() when the refcount hits 0. macio device is freed in macio_release_dev(), so the kfree() can be removed.

CVE-2022-50472 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.

CVE-2022-50471 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.

CVE-2025-39953 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.

In the Linux kernel, the following vulnerability has been resolved: um: virtio_uml: Fix use-after-free after put_device in probe When register_virtio_device() fails in virtio_uml_probe(), the code sets vu_dev->registered = 1 even though the device was not successfully registered. This can lead to use-after-free or other issues.

CVE-2025-39949 is a security vulnerability (CVSS 5.5). Risk factors: public PoC available. Vendor patch is available.

In the Linux kernel, the following vulnerability has been resolved: ice: fix Rx page leak on multi-buffer frames The ice_put_rx_mbuf() function handles calling ice_put_rx_buf() for each buffer in the current frame.

In the Linux kernel, the following vulnerability has been resolved: cnic: Fix use-after-free bugs in cnic_delete_task The original code uses cancel_delayed_work() in cnic_cm_stop_bnx2x_hw(), which does not guarantee that the delayed work item 'delete_task' has fully completed if it was already running. Additionally, the delayed work item is cyclic, the flush_workqueue() in cnic_cm_stop_bnx2x_hw() only blocks and waits for work items that were already queued to the workqueue prior to its invocation. Any work items submitted after flush_workqueue() is called are not included in the set of tasks that the flush operation awaits. This means that after the cyclic work items have finished executing, a delayed work item may still exist in the workqueue. This leads to use-after-free scenarios where the cnic_dev is deallocated by cnic_free_dev(), while delete_task remains active and attempt to dereference cnic_dev in cnic_delete_task(). A typical race condition is illustrated below: CPU 0 (cleanup) | CPU 1 (delayed work callback) cnic_netdev_event() | cnic_stop_hw() | cnic_delete_task() cnic_cm_stop_bnx2x_hw() | ... cancel_delayed_work() | /* the queue_delayed_work() flush_workqueue() | executes after flush_workqueue()*/ | queue_delayed_work() cnic_free_dev(dev)//free | cnic_delete_task() //new instance | dev = cp->dev; //use Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the cyclic delayed work item is properly canceled and that any ongoing execution of the work item completes before the cnic_dev is deallocated. Furthermore, since cancel_delayed_work_sync() uses __flush_work(work, true) to synchronously wait for any currently executing instance of the work item to finish, the flush_workqueue() becomes redundant and should be removed. This bug was identified through static analysis. To reproduce the issue and validate the fix, I simulated the cnic PCI device in QEMU and introduced intentional delays - such as inserting calls to ssleep() within the cnic_delete_task() function - to increase the likelihood of triggering the bug.

We are asked to produce a JSON object with specific fields. I need to synthesize data from multiple intelligence sources about CVE-2025-39944. Let's parse the provided data: - CVE ID: CVE-2025-39944 - Description: In the Linux kernel, a vulnerability in octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp(). The original code uses cancel_delayed_work() which doesn't ensure the delayed work is fully completed, leading to use-after-free when otx2_ptp is deallocated while the work is still running. The fix replaces with cancel_delayed_work_sync(). KASAN report confirms. The bug was identified through static analysis and tested in QEMU simulation. - CVSS Score: 7.8, Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CWE: CWE-416 - EPSS Score: 0.01% (percentile 1%) - POC/Exploit: Publicly available (there's a link to a gist) - Patch: Available from vendor - Reported by: (some UUID) - CPE: many Linux kernel versions, including 6.17 up to rc6, and some older versions with ranges like "Linux 2958d17a898416c6193431676f6130b68a2cb9fc <2786879aebf363806a13d41e8d5f99202ddd23d9", etc. So it's Linux kernel, specifically the octeontx2-pf driver. - Tags: Information Disclosure, Linux, Memory Corruption, Use After Free - ENISA EUVD ID, affected versions from EUVD include Linux 6.1 and specific commit ranges. - References: patches from git.kernel.org, NVD advisory, exploit gist, Ubuntu USN, SUSE SU advisories. - KEV status? Not mentioned. So not in KEV. So this is a local vulnerability (AV:L) requiring low privileges (PR:L). No user interaction (UI:N), scope unchanged (S:U). High impact on confidentiality, integrity, availability. CVSS 7.8, meaning high severity but not critical (critical is 9.0+). EPSS very low (0.01%), so exploitation probability is very low. POC exists publicly, but KEV not listed, so no confirmed active exploitation. The product is Linux kernel, but specifically the "octeontx2-pf" driver for Marvell OcteonTX2 network interface cards. So I'll identify product_name as "octeontx2-pf" or "Linux kernel (octeontx2-pf driver)". The instructions say "1-3 words ONLY. The specific product or service name affected." So "Linux Kernel" might be fine, but more specifically it's the octeontx2-pf driver. I'll go with "Linux kernel (octeontx2-pf)" but it says 1-3 words, and that's 4 words. Maybe "octeontx2-pf driver"? Still 2 words. The product is the Linux kernel. I'll pick "Linux Kernel" as the product_name. But the vulnerability is in a specific driver. I'll output "Linux Kernel" as it's part of the kernel. Per instructions "NOT the vulnerability type, NOT the vendor alone, NOT a description." So "Linux Kernel" is okay. Summary: Need an original synthesis. "Use-after-free vulnerability in the Linux kernel's octeontx2-pf driver can be triggered locally by a low-privileged user during device removal, leading to potential memory corruption and system compromise. The vulnerability arises due to improper synchronization of delayed work cancellation, and a public exploit is available. EPSS indicates very low exploitation probability, but it may be exploitable in specific configurations where the OcteonTX2 device is present." Technical context: The octeontx2-pf is a physical function driver for Marvell OcteonTX2 network adapters. It handles Precision Time Protocol (PTP) timestamping via a delayed work item `synctstamp_work`. The vulnerability is a classic use-after-free (CWE-416): the cleanup path `otx2_ptp_destroy()` cancels the work with `cancel_delayed_work()` which does not wait for a currently-running instance of the work to finish. If the work is running concurrently, a race condition can lead to the work dereferencing freed memory, as confirmed by KASAN. The fix uses `cancel_delayed_work_sync()` which waits for the callback to finish. This affects Linux kernel versions containing the commit 2958d17a8984 ("octeontx2-pf: Add PTP support") up to the fixes. Risk assessment: CVSS vector AV:L indicates local access is required, with low privileges. The EPSS score of 0.01% suggests that despite the existence of a public exploit, mass exploitation is unlikely. The attack requires the attacker to be able to trigger device removal (e.g., via sysfs write to remove device, which requires low privileges). Active exploitation is not confirmed (no KEV). SSVC: Exploitation status: public PoC exists but no active exploitation. Automatable: likely partially automatable if attacker has local access and can trigger device unbind. Technical impact: total (system compromise). Given the local requirement and need for a specific hardware (OcteonTX2 NIC), real-world risk is lower than the CVSS score suggests, but if such hardware is present, a user with low privileges could escalate to root. The EPSS reflects the rarity of the hardware. Affected products: Linux kernel versions where the octeontx2-pf driver is present and includes the PTP sync work (likely from commit 2958d17a898416c6... onward). The EUVD lists specific version ranges: Linux 6.1, and commit-based ranges. The CPEs show Linux kernel * (wildcards), including versions from 6.17-rc1 to rc6. Exact affected version strings are provided: "Linux 2958d17a898416c6193431676f6130b68a2cb9fc <2786879aebf363806a13d41e8d5f99202ddd23d9" etc. The fix is in version 6.17, and backported to 6.16.9, 6.12.49, 6.1.154, 6.6.108. So I'll mention those. Vendor advisories from Ubuntu and SUSE are listed. Remediation: Patch available. Update to kernel version that includes the fix: mainline 6.17, or stable releases 6.16.9, 6.12.49, 6.6.108, 6.1.154. If immediate patching not possible, disable the octeontx2-pf driver if the hardware is not essential (blacklist it), but this removes network functionality. Alternatively, restrict access to device unbind operations (e.g., via `remove` sysfs file) to root only, though low privilege users might still be able to trigger it through other means like hot-unplug. Workaround: limit local access to trusted users. The vendor advisory links are provided. Exploit scenario: A local attacker with low privileges on a system with an OcteonTX2 NIC triggers a device unbind (e.g., by writing to `/sys/bus/pci/drivers/octeontx2-pf/unbind`) while the delayed work is running, causing the use-after-free and potential code execution with kernel privileges. Exploitation conditions: The system must have an OcteonTX2 network interface card with the octeontx2-pf driver loaded and the PTP functionality active (enabled by default). The attacker needs local access and the ability to trigger device removal (e.g., via sysfs writes that may be restricted to root on some distributions; but the CVSS says PR:L, so low-privileged user can do this). Specifically, the race condition requires the cancellation to occur while the delayed work `synctstamp_work` is executing. This is probabilistic but deemed "nonnegligible". Attack chain: - Step 1: Obtain local low-privilege access to the target system with OcteonTX2 NIC. - Step 2: Trigger device removal via sysfs unbind or PCI hot-unplug. - Step 3: Concurrently, the delayed work `otx2_sync_tstamp` is executing, causing a race where the ptp structure is freed while the work still holds a reference. - Step 4: The work dereferences freed memory (use-after-free). - Step 5: Exploit the memory corruption to achieve code execution in kernel context, leading to privilege escalation, data corruption, or system crash. I'll condense to 3-7 steps. Confidence notes: The vulnerability is confirmed by a KASAN report and a specific fix has been merged. Affected versions are identified via commits, and vendor advisories confirm. Public exploit code exists but no active exploitation in the wild. Patch availability is confirmed by kernel commits and vendor updates. The EPSS is very low, consistent with niche hardware. Prevalence: The octeontx2-pf driver is for Marvell OcteonTX2 NICs, which are high-performance network adapters used in some data centers and telecom, but not ubiquitously. It's a specific hardware driver. So I'd say "low" because it's a niche hardware. Not all Linux systems have this NIC. So "low". Prevalence basis: "specific to Marvell OcteonTX2 NICs, uncommon in general desktop or server deployments". But the question says "product", so I'm estimating the footprint of Linux kernel systems with that hardware. The ubuntu and SUSE advisories indicate it's packaged in their kernels, but that's just the kernel itself, the driver may be built as a module loaded only when hardware is present. So overall prevalence among Linux systems: low. Assessed CVSS vector: The original CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. I need to do my own assessment. It's essentially the same: local, low complexity, low privileges, no user interaction, unchanged scope, high CIA. So I'll output that vector. But I need to justify. I'll use the same. The rationale: "Local access, low privileges (trigger device unbind), no user interaction, total compromise possible." That's consistent. So I'll use that. However, the original vector had PR:L, which is correct because the attacker needs low privileges to write to sysfs unbind file, which may be root-only on many systems, but CVSS says PR:L. That might be a point: the attack might require root to unbind? Actually, the `remove_store` in the KASAN trace shows it was triggered via sysfs write by task 136 (bash). That likely requires root. But CVSS says PR:L. This is an input data conflict. I'll note in assessed_cvss_rationale: "Requires local user to trigger device removal; some systems may restrict unbind to root, but CVSS assumes low privileges." I'll keep PR:L as per CVSS. I'll output the same vector. CVSS 4.0 base vector: I need to map to 4.0. AV:L to AV:L, AC:L to AC:L, AT:N (no attack requirement beyond those), PR:L, UI:N, impact: VC:H, VI:H, VA:H, SC:N, SI:N, SA:N. So CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Now, output JSON. Ensure all fields are plain strings. I'll carefully construct each field. - product_name: "Linux Kernel" - summary: "Use-after-free vulnerability in the Linux kernel's octeontx2-pf driver allows a local low-privileged user to trigger memory corruption and potentially escalate privileges or cause a denial of service on systems with OcteonTX2 network adapters. The issue occurs during device removal when the delayed work cancellation mechanism race condition causes freed memory to be accessed. Public exploit code exists, but no active exploitation has been confirmed, and EPSS estimates very low likelihood of widespread exploitation." - technical_context: "The vulnerability is in the octeontx2-pf driver, which handles Precision Time Protocol (PTP) timestamp synchronization for Marvell OcteonTX2 physical function network interfaces. The driver uses a delayed work item `synctstamp_work` to periodically update timestamps. In the cleanup routine `otx2_ptp_destroy()`, `cancel_delayed_work()` is called, but this does not wait for a currently executing instance of the work to finish, leading to a race condition (CWE-416) where the `ptp` structure is freed while the work callback `otx2

We are asked to produce a JSON object with comprehensive analysis. Let's parse the input data. CVE: CVE-2025-39943 Description: "In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer. If data_offset and data_length of smb_direct_data_transfer struct are invalid, out of bounds issue could happen. This patch validate data_offset and data_length field in recv_done." CVSS: 7.1, vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CWE: CWE-125 (Out-of-bounds Read) EPSS: 0.01% (1st percentile) Patch: Available from vendor Tags: Buffer Overflow, Information Disclosure, Linux KEV? Not mentioned, so assume not in KEV. POC? Not mentioned, so no POC identified. CPE: many Linux kernel versions. The affected products from EUVD: Linux kernel, various branches: 6.1.154, 6.16.9, 6.6.108, 6.12.49, 6.17, 5.15.194, etc. The description mentions ksmbd (kernel SMB server) and smbdirect. So this is a vulnerability in the Linux kernel's ksmbd module, specifically in the handling of SMB Direct data transfer packets over RDMA. The vulnerability is an out-of-bounds read (CWE-125) due to not validating data_offset and data_length fields in the smb_direct_data_transfer struct. This could lead to information disclosure or potentially crash/denial of service (C:H and A:H, I:N). From CVSS: AV:L (local attack vector), AC:L, PR:L (low privileges required), UI:N (no user interaction), S:U (unchanged), C:H, I:N, A:H. So an attacker with low privileges on the local system can read high confidentiality data and cause high availability impact, but no integrity impact. However, the vulnerability exists in ksmbd, which is a kernel SMB server that typically runs with kernel privileges. Possibly an authenticated SMB user (with low privileges) can trigger the out-of-bounds read. The attack vector is local (AV:L) which usually means local to the system where the vulnerable code runs, but could also be from a remote SMB client connecting to the SMB server on the local machine? CVSS vector says AV:L, which indicates that the attacker needs local access to the system (e.g., a user on the system, or a process running locally). However, ksmbd serves remote clients over the network. The AV:L might be because the vulnerable function is triggered by receiving a specially crafted SMB Direct message, but the attacker might be remote? But the vector clearly states AV:L (local). This might be inaccurate or it might require a local attacker to send a crafted packet to the local ksmbd server? Actually, if the SMB server is on the same machine, a local attacker could connect to localhost and send a crafted SMB Direct packet. Or, if the ksmbd module is enabled, a local user with low privileges can craft a message to the kernel module, leading to out-of-bounds read. So AV:L is plausible: requires low-privileged local user. We need to synthesize multiple sources. The data includes patch references (kernel commits), affected versions (EUVD list), CPE strings. The EPSS score is extremely low (0.01%), indicating low exploitation probability. No KEV, no mention of active exploitation. The patch is available. We need to produce a comprehensive analysis. The output JSON fields: product_name: "Linux Kernel" (specifically ksmbd module? But product_name says 1-3 words, specifically product or service name. Could be "Linux Kernel" or "ksmbd". Since ksmbd is a subsystem, I'll use "Linux Kernel" as it's the primary product, but I'll note it's in ksmbd. "ksmbd" alone might not be recognized as a product. I'll use "Linux Kernel". The description says "ksmbd: smbdirect", so product is Linux kernel's ksmbd module. "Linux Kernel" is fine. summary: 2-3 sentence plain-language synthesis. Must not copy description, must start with specific impact verb and product. E.g. "An out-of-bounds read vulnerability in the Linux kernel's ksmbd RDMA subsystem allows a local attacker with low privileges to read sensitive kernel memory and cause system crashes. The flaw exists in the validation of data_offset and data_length fields in SMB Direct data transfer packets. No active exploitation has been observed, and patches are available." Check: EPSS low, no KEV, no POC => "no public exploit identified at time of analysis". The summary should not say "out-of-bounds read vulnerability" starting with "A vulnerability", but we can rephrase: "Local privilege escalation via out-of-bounds read in Linux kernel's ksmbd RDMA could expose kernel memory and crash the system." That starts with impact? "Local privilege escalation via out-of-bounds read" is good. But CVSS: C:H, A:H, so information disclosure and denial of service. No privilege escalation unless reading secrets leads to that. So I'll phrase: "Out-of-bounds read in Linux kernel's ksmbd SMB Direct implementation allows a local attacker to read sensitive kernel memory and cause a system crash." That starts with "Out-of-bounds read", which is okay. I'll do: "An out-of-bounds read in the Linux kernel's ksmbd RDMA implementation could leak kernel memory and crash the system. Affecting kernels with ksmbd and RDMA (SMB Direct) enabled, the vulnerability arises from insufficient validation of offset and length fields in received data transfer packets. Patched kernels are available, and no known exploits exist." technical_context: Explain the underlying technology: ksmbd is an in-kernel SMB server enabling SMB Direct over RDMA for high-performance file sharing. The smb_direct_data_transfer struct handles data payloads over RDMA connections. The data_offset and data_length fields specify where the data resides relative to the packet boundary. Malformed values can cause out-of-bounds memory access when the code copies or processes the data. CWE-125 indicates a read beyond the valid buffer, potentially leaking kernel memory. The affected CPEs span multiple kernel versions, indicating the vulnerability exists across stable and development branches. risk_assessment: Combine CVSS, EPSS, KEV, POC. CVSS 7.1 with AV:L means local only, so risk is lower than a network-exploitable flaw. EPSS of 0.01% (bottom 1 percentile) suggests almost no chance of exploitation in the wild currently. No KEV, so not actively exploited. No public exploit code mentioned. So real-world risk is low, despite the high CVSS score. However, if ksmbd with SMB Direct is used in high-value server environments, it could be a concern. I'll state: "CVSS score 7.1 suggests high severity, but local attack vector (AV:L) and low EPSS probability (0.01%) indicate low real-world exploitation likelihood. No CISA KEV listing and no public exploit code further reduce urgency. Mitigations like disabling RDMA for SMB or restricting local user access can minimize risk until patching." affected_products: List versions and advisory. From EUVD: Linux kernels from commit 2ea086e35c3d... up to fixing commits. The patch versions: 6.1.154, 6.6.108, 6.12.49, 6.16.9, 6.17, 5.15.194. So affected versions: all kernel releases between the commit that introduced the feature and the fixing patches. I'll mention: "Linux kernel with ksmbd and SMB Direct (RDMA) support enabled, prior to the fixed versions: 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9, 6.17. Vendor advisory from Ubuntu USN-8095-1 and NVD references provide patch commits." remediation: Actionable: "Apply the latest stable kernel updates containing the fix commits (references provided). For Ubuntu users, apply USN-8095-1. As a workaround, if RDMA-based SMB Direct is not required, disable the ksmbd module or set 'rdma_disabled=1' module parameter to prevent exploitation. This workaround has the side effect of disabling all RDMA functionality for SMB, potentially impacting performance for high-throughput workloads." exploit_scenario: A local unprivileged user crafts a malicious SMB Direct data transfer packet with crafted data_offset and data_length values, sending it to the kernel's ksmbd server on the same machine, triggering an out-of-bounds read that leaks kernel memory and crashes the kernel. No POC publicly available. exploitation_conditions: "Requires a system with ksmbd enabled and configured to use SMB Direct over RDMA. A local attacker with low privileges (as indicated by CVSS PR:L) must be able to interact with the ksmbd server, either by connecting via a loopback SMB client or by injecting crafted RDMA packets. This configuration is not default; RDMA for SMB is a specific, high-performance feature not enabled in typical deployments." attack_chain: Since AV:L, we can say: "Local attacker with low-privileged access → craft SMB Direct packet with malicious offset/length → send packet to local ksmbd server → trigger out-of-bounds read in recv_done() → leak kernel memory (C:H) or crash kernel (A:H)". As steps: "Access local system with low privileges → Craft malformed RDMA SMB Direct packet → Send to local ksmbd via loopback → Out-of-bounds read in recv_done() → Leak kernel memory or crash kernel." confidence_notes: "Vulnerability confirmed by kernel maintainers (patch links). Affected versions range inferred from Git commit ranges and fixed kernel releases. No active exploitation or public exploit code reported. CVSS vector from NVD suggests local attack, consistent with description." prevalence: ksmbd is a relatively new in-kernel SMB server, introduced in 5.15, but it's not as widely deployed as Samba or other file servers. Most Linux distributions do not enable ksmbd by default, and SMB Direct is rarely used. So prevalence is likely low. I'll put "low", but I need to be careful: It's a kernel module that might be present in many kernels but not loaded. The product is "Linux Kernel", but the affected feature is ksmbd with RDMA. The presence of the vulnerable code is in the kernel, so any kernel that includes CONFIG_SMB_SERVER=y? Actually, ksmbd is a kernel module that can be compiled in, but many distributions ship it as a module. So the affected product footprint is moderate: potentially many Linux systems with ksmbd compiled, but the actual exposure requires loading the module and using RDMA. I'd estimate "low" because the vulnerable condition (RDMA SMB Direct) is rare. But I need to pick ONE word: low, medium, high. I'll go with "low". Prevalence basis: "ksmbd with RDMA rarely enabled in production". assessed_cvss_vector: I need to assess based on description. The CVSS from NVD is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. That seems appropriate: the vulnerability is in the kernel, triggered by a local user (PR:L). AV:L because the attacker needs to interact with the kernel component from user space. So I'll keep the same vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. The description doesn't suggest any network attack vector, so AV:L is correct. AC:L because no special complexity. PR:L because any local user can trigger it. SC:U. So I'll output that. But the instruction says to output my own independent assessment, not copy. I agree with the given vector, so I'll output it. assessed_cvss_rationale: "Requires low-privileged local access to send crafted packet, so AV:L and PR:L; no integrity impact." assessed_cvss40_vector: Convert to CVSS 4.0: AV:L, AC:L, AT:N (no attack requirement?), PR:L, UI:N, VC:H, VI:N, VA:H, SC:N, SI:N, SA:N. So CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N. That is consistent. Now output JSON. Remember each field is a plain text string. I'll write them conc

CVE-2025-39942 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.

In the Linux kernel, the following vulnerability has been resolved: zram: fix slot write race condition Parallel concurrent writes to the same zram index result in leaked zsmalloc handles. Schematically we can have something like this: CPU0 CPU1 zram_slot_lock() zs_free(handle) zram_slot_lock() zram_slot_lock() zs_free(handle) zram_slot_lock() compress compress handle = zs_malloc() handle = zs_malloc() zram_slot_lock zram_set_handle(handle) zram_slot_lock zram_slot_lock zram_set_handle(handle) zram_slot_lock Either CPU0 or CPU1 zsmalloc handle will leak because zs_free() is done too early. In fact, we need to reset zram entry right before we set its new handle, all under the same slot lock scope.

CVE-2025-39933 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.

CVE-2025-39932 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path During tests of another unrelated patch I was able to trigger this error: Objects remaining on...

Rejected reason: Not used. No vendor patch available.

Rejected reason: Not used. No vendor patch available.

Rejected reason: Not used. No vendor patch available.

Rejected reason: Not used. No vendor patch available.

Rejected reason: Not used. No vendor patch available.

Rejected reason: Not used. No vendor patch available.

Rejected reason: Not used. No vendor patch available.

Rejected reason: Not used. No vendor patch available.

Rejected reason: Not used. No vendor patch available.

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 via the 'registerGetForm', 'registerGetForms', 'registerGetCampaign' and 'registerGetCampaigns' functions due to a missing capability check. This makes it possible for unauthenticated attackers to extract data from private and draft donation forms, as well as archived campaigns.

The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.9. This is due to missing capability checks and nonce verification on functions hooked to 'init'. This makes it possible for unauthenticated attackers to deactivate the plugin, tamper with OAuth configuration, and trigger test connections that expose sensitive data via direct request to vulnerable endpoints granted they can craft malicious requests with specific parameters.

A security vulnerability in plaintext. This issue is fixed in (CVSS 6.6). Remediation should follow standard vulnerability management procedures.

Anyquery is an SQL query engine built on top of SQLite. Versions 0.4.3 and below allow attackers who have already gained access to localhost, even with low privileges, to use the http server through the port unauthenticated, and access private integration data like emails, without any warning of a foreign login from the provider. This issue is fixed in version 0.4.4.

A security vulnerability in Liferay Portal 7.4.0 (CVSS 6.5) that allows sensitive user data. Remediation should follow standard vulnerability management procedures.

Rejected reason: Further research determined the issue is not an independent vulnerability as it originates from Apache Felix. No vendor patch available.

A security vulnerability in Claude Code (CVSS 6.5). Remediation should follow standard vulnerability management procedures.

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later

A security vulnerability in HCL MyXalytics (CVSS 3.5). Remediation should follow standard vulnerability management procedures.

HCL MyXalytics: 6.6.  is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to application objects without proper validation or access controls, potentially allowing unauthorized modification of sensitive fields.

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later

A SQL injection vulnerability was discovered in the /articles endpoint of MyClub 0.5, affecting the query parameters Content, GroupName, PersonName, lastUpdate, pool, and title. Due to insufficient input sanitisation, an unauthenticated remote attacker could inject arbitrary SQL commands via a crafted GET request, potentially leading to information disclosure or manipulation of the database.

An information disclosure vulnerability has been discovered in SeaCMS 13.1. The vulnerability exists in the admin_safe.php component located in the /btcoan/ directory. This security flaw allows authenticated administrators to scan and download not only the application’s source code but also potentially any file accessible on the server’s root directory.

Auth bypass in RestroPress WordPress ordering plugin 3.0.0-3.1.9.2.

The Schema Plugin For Divi, Gutenberg & Shortcodes plugin for WordPress is vulnerable to Object Instantiation in all versions up to, and including, 4.3.2 via deserialization of untrusted input via the wpt_schema_breadcrumbs shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

LFI in JoomSport WordPress plugin.

The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now reset on 'Host' change.

A arbitrary file access vulnerability in Backup Bolt (CVSS 3.8). Remediation should follow standard vulnerability management procedures.

A security vulnerability in Installer of Panasonic AutoDownloader version 1.2.8 (CVSS 7.8). High severity vulnerability requiring prompt remediation.

Rejected reason: Further research determined the issue is not an open source vulnerability. No vendor patch available.

Cursor is a code editor built for programming with AI. In versions 1.6 and below, Mermaid (a to render diagrams) allows embedding images which then get rendered by Cursor in the chat box. An attacker can use this to exfiltrate sensitive information to a third-party attacker controlled server through an image fetch after successfully performing a prompt injection. A malicious model (or hallucination/backdoor) might also trigger this exploit at will. This issue requires prompt injection from malicious data (web, image upload, source code) in order to exploit. In that case, it can send sensitive information to an attacker-controlled external server. Some additional bypasses not covered in the initial fix to this issue were discovered, see GHSA-43wj-mwcc-x93p. This issue is fixed in version 1.7.

Rejected reason: Not used. No vendor patch available.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vendor patch available.

WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Broken Access Control vulnerability, identified in the get_relatorios_socios.php endpoint. This vulnerability allows unauthenticated attackers to directly access sensitive personal and financial information of members without requiring authentication or authorization. This issue is fixed in version 3.5.0.

CVE-2025-10653 is a security vulnerability (CVSS 8.6) that allows access. High severity vulnerability requiring prompt remediation.

LangBot is a global IM bot platform designed for LLMs. In versions 4.1.0 up to but not including 4.3.5, authorized attackers can exploit the /api/v1/files/documents interface to perform arbitrary file uploads. Since this interface does not strictly restrict the storage directory of files on the server, it is possible to upload dangerous files to specific system directories. This is fixed in version 4.3.5.

CVE-2025-54315 is a security vulnerability (CVSS 7.1). High severity vulnerability requiring prompt remediation.

CVE-2025-49090 is a security vulnerability (CVSS 7.1). High severity vulnerability requiring prompt remediation.

A security vulnerability in SSH Tectia Server before 6.6.6 sometimes (CVSS 7.2) that allows attackers. High severity vulnerability requiring prompt remediation.

Flock Safety Falcon and Sparrow License Plate Readers OPM1.171019.026 ship with development Wi-Fi credentials (test_flck) stored in cleartext in production firmware.

Hardcoded cryptographic key in Flock Safety DetectionProcessing app for ANPR. PoC available.

The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) has a cleartext Auth0 client secret in its codebase. Because application binaries can be trivially decompiled or inspected, attackers can recover this OAuth secret without special privileges. This secret is intended to remain confidential and should never be embedded directly in client-side software.

The Flock Safety Peripheral com.flocksafety.android.peripheral application 7.38.3 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) contains a cleartext DataDog API key within in its codebase. Because application binaries can be trivially decompiled or inspected, attackers can recover the OAuth secret without special privileges. This secret is intended to remain confidential and should never be embedded directly in client-side software.

Missing authentication in Flock Safety Collins Android app for ANPR cameras. EPSS 2.7%. PoC available.

CVE-2025-34210 is a security vulnerability (CVSS 5.5). Risk factors: public PoC available.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) store user passwords using unsalted SHA-512 hashes with a fall-back to unsalted SHA-1. The hashing is performed via PHP's `hash()` function in multiple files (server_write_requests_users.php, update_database.php, legacy/Login.php, tests/Unit/Api/IdpControllerTest.php). No per-user salt is used and the fast hash algorithms are unsuitable for password storage. An attacker who obtains the password database can recover cleartext passwords via offline dictionary or rainbow table attacks. The vulnerable code also contains logic that migrates legacy SHA-1 hashes to SHA-512 on login, further exposing users still on the old hash. This vulnerability was partially resolved, but still present within the legacy authentication platform.

YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module. The Comment model eagerly loads the related User model without field filtering; because User.php defines no $hidden or $visible attributes, sensitive fields (bcrypt password hash, mobile number, pay_money, expend_money.) are exposed in JSON responses. Route names vary per deployment (e.g. /api/goods.pinglun/list), but all call the same vulnerable model logic.

Vulnerability in the cryptographic algorithm of AndSoft's e-TMS v25.03, which uses MD5 to encrypt passwords. MD5 is a cryptographically vulnerable hash algorithm and is no longer considered secure for storing or transmitting passwords. It is vulnerable to collision attacks and can be easily cracked with modern hardware, exposing user credentials to potential risks.

A remote code execution vulnerability (CVSS 5.1) that allows browsers. Remediation should follow standard vulnerability management procedures.

A vulnerability has been identified within Rancher Manager whereby the SAML authentication from the Rancher CLI tool is vulnerable to phishing attacks. The custom authentication protocol for SAML-based providers can be abused to steal Rancher’s authentication tokens.

Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well protected. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. Users are recommended to upgrade to version 5.0.3, which fixes the issue.

A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for example `amazonaws.com`, via the `/meta/proxy` Rancher endpoint. These headers may contain identifiable and/or sensitive information e.g. email addresses.

Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.

Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.

Exposure of sensitive information in Viday. This vulnerability could allow an unauthenticated attacker to obtain sensitive information about customers by sending an HTTP GET request to “/api/reserva/web/clients” using the “phone” parameter.

VT STUDIO versions 8.53 and prior contain an out-of-bounds read vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product.

Rejected reason: Not used. No vendor patch available.

Rejected reason: Not used. No vendor patch available.

Rejected reason: Not used. No vendor patch available.

Rejected reason: Not used. No vendor patch available.

Rejected reason: Not used. No vendor patch available.

Rejected reason: Not used. No vendor patch available.

Rejected reason: Not used. No vendor patch available.

Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).

Rejected reason: This is a fork and is not in the Rust registry. No vendor patch available.

CVE-2023-49883 is a security vulnerability (CVSS 5.9). Remediation should follow standard vulnerability management procedures.

IBM Transformation Extender Advanced 10.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.