Red Hat

CVE-2023-53769 Dec 08, 02:15 CRITICAL PATCH Act Now

In the Linux kernel, the following vulnerability has been resolved: virt/coco/sev-guest: Double-buffer messages The encryption algorithms read and write directly to shared unencrypted memory, which may leak information as well as permit the host to tamper with the message integrity. Instead, copy whole messages in or out as needed before doing any computation on them.

CVE-2023-53768 Dec 08, 02:15 HIGH PATCH This Week

In the Linux kernel, the following vulnerability has been resolved: regmap-irq: Fix out-of-bounds access when allocating config buffers When allocating the 2D array for handling IRQ type registers in regmap_add_irq_chip_fwnode(), the intent is to allocate a matrix with num_config_bases rows and num_config_regs columns. This is currently handled by allocating a buffer to hold a pointer for each row (i.e. num_config_bases). After that, the logic attempts to allocate the memory required to hold the register configuration for each row. However, instead of doing this allocation for each row (i.e. num_config_bases allocations), the logic erroneously does this allocation num_config_regs number of times. This scenario can lead to out-of-bounds accesses when num_config_regs is greater than num_config_bases. Fix this by updating the terminating condition of the loop that allocates the memory for holding the register configuration to allocate memory only for each row in the matrix. Amit Pundir reported a crash that was occurring on his db845c device due to memory corruption (see "Closes" tag for Amit's report). The KASAN report below helped narrow it down to this issue: [ 14.033877][ T1] ================================================================== [ 14.042507][ T1] BUG: KASAN: invalid-access in regmap_add_irq_chip_fwnode+0x594/0x1364 [ 14.050796][ T1] Write of size 8 at addr 06ffff8081021850 by task init/1 [ 14.242004][ T1] The buggy address belongs to the object at ffffff8081021850 [ 14.242004][ T1] which belongs to the cache kmalloc-8 of size 8 [ 14.255669][ T1] The buggy address is located 0 bytes inside of [ 14.255669][ T1] 8-byte region [ffffff8081021850, ffffff8081021858)

CVE-2023-53764 Dec 08, 02:15 HIGH PATCH This Week

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Handle lock during peer_id find ath12k_peer_find_by_id() requires that the caller hold the ab->base_lock. Currently the WBM error path does not hold the lock and calling that function, leads to the following lockdep_assert()in QCN9274: [105162.160893] ------------[ cut here ]------------ [105162.160916] WARNING: CPU: 3 PID: 0 at drivers/net/wireless/ath/ath12k/peer.c:71 ath12k_peer_find_by_id+0x52/0x60 [ath12k] [105162.160933] Modules linked in: ath12k(O) qrtr_mhi qrtr mac80211 cfg80211 mhi qmi_helpers libarc4 nvme nvme_core [last unloaded: ath12k(O)] [105162.160967] CPU: 3 PID: 0 Comm: swapper/3 Tainted: G W O 6.1.0-rc2+ #3 [105162.160972] Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0056.2019.0506.1527 05/06/2019 [105162.160977] RIP: 0010:ath12k_peer_find_by_id+0x52/0x60 [ath12k] [105162.160990] Code: 07 eb 0f 39 68 24 74 0a 48 8b 00 48 39 f8 75 f3 31 c0 5b 5d c3 48 8d bf b0 f2 00 00 be ff ff ff ff e8 22 20 c4 e2 85 c0 75 bf <0f> 0b eb bb 66 2e 0f 1f 84 00 00 00 00 00 41 54 4c 8d a7 98 f2 00 [105162.160996] RSP: 0018:ffffa223001acc60 EFLAGS: 00010246 [105162.161003] RAX: 0000000000000000 RBX: ffff9f0573940000 RCX: 0000000000000000 [105162.161008] RDX: 0000000000000001 RSI: ffffffffa3951c8e RDI: ffffffffa39a96d7 [105162.161013] RBP: 000000000000000a R08: 0000000000000000 R09: 0000000000000000 [105162.161017] R10: ffffa223001acb40 R11: ffffffffa3d57c60 R12: ffff9f057394f2e0 [105162.161022] R13: ffff9f0573940000 R14: ffff9f04ecd659c0 R15: ffff9f04d5a9b040 [105162.161026] FS: 0000000000000000(0000) GS:ffff9f0575600000(0000) knlGS:0000000000000000 [105162.161031] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [105162.161036] CR2: 00001d5c8277a008 CR3: 00000001e6224006 CR4: 00000000003706e0 [105162.161041] Call Trace: [105162.161046] <IRQ> [105162.161051] ath12k_dp_rx_process_wbm_err+0x6da/0xaf0 [ath12k] [105162.161072] ? ath12k_dp_rx_process_err+0x80e/0x15a0 [ath12k] [105162.161084] ? __lock_acquire+0x4ca/0x1a60 [105162.161104] ath12k_dp_service_srng+0x263/0x310 [ath12k] [105162.161120] ath12k_pci_ext_grp_napi_poll+0x1c/0x70 [ath12k] [105162.161133] __napi_poll+0x22/0x260 [105162.161141] net_rx_action+0x2f8/0x380 [105162.161153] __do_softirq+0xd0/0x4c9 [105162.161162] irq_exit_rcu+0x88/0xe0 [105162.161169] common_interrupt+0xa5/0xc0 [105162.161174] </IRQ> [105162.161179] <TASK> [105162.161184] asm_common_interrupt+0x22/0x40 Handle spin lock/unlock in WBM error path to hold the necessary lock expected by ath12k_peer_find_by_id(). Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0-03171-QCAHKSWPL_SILICONZ-1

CVE-2023-53763 Dec 08, 02:15 HIGH PATCH This Week

In the Linux kernel, the following vulnerability has been resolved: Revert "f2fs: fix to do sanity check on extent cache correctly" syzbot reports a f2fs bug as below: UBSAN: array-index-out-of-bounds in fs/f2fs/f2fs.h:3275:19 index 1409 is out of range for type '__le32[923]' (aka 'unsigned int[923]') Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 inline_data_addr fs/f2fs/f2fs.h:3275 [inline] __recover_inline_status fs/f2fs/inode.c:113 [inline] do_read_inode fs/f2fs/inode.c:480 [inline] f2fs_iget+0x4730/0x48b0 fs/f2fs/inode.c:604 f2fs_fill_super+0x640e/0x80c0 fs/f2fs/super.c:4601 mount_bdev+0x276/0x3b0 fs/super.c:1391 legacy_get_tree+0xef/0x190 fs/fs_context.c:611 vfs_get_tree+0x8c/0x270 fs/super.c:1519 do_new_mount+0x28f/0xae0 fs/namespace.c:3335 do_mount fs/namespace.c:3675 [inline] __do_sys_mount fs/namespace.c:3884 [inline] __se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3861 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The issue was bisected to: commit d48a7b3a72f121655d95b5157c32c7d555e44c05 Author: Chao Yu <chao@kernel.org> Date: Mon Jan 9 03:49:20 2023 +0000 f2fs: fix to do sanity check on extent cache correctly The root cause is we applied both v1 and v2 of the patch, v2 is the right fix, so it needs to revert v1 in order to fix reported issue. v1: commit d48a7b3a72f1 ("f2fs: fix to do sanity check on extent cache correctly") https://lore.kernel.org/lkml/20230109034920.492914-1-chao@kernel.org/ v2: commit 269d11948100 ("f2fs: fix to do sanity check on extent cache correctly") https://lore.kernel.org/lkml/20230207134808.1827869-1-chao@kernel.org/

CVE-2023-53762 Dec 08, 02:15 HIGH PATCH This Week

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync Use-after-free can occur in hci_disconnect_all_sync if a connection is deleted by concurrent processing of a controller event. To prevent this the code now tries to iterate over the list backwards to ensure the links are cleanup before its parents, also it no longer relies on a cursor, instead it always uses the last element since hci_abort_conn_sync is guaranteed to call hci_conn_del. UAF crash log: ================================================================== BUG: KASAN: slab-use-after-free in hci_set_powered_sync (net/bluetooth/hci_sync.c:5424) [bluetooth] Read of size 8 at addr ffff888009d9c000 by task kworker/u9:0/124 CPU: 0 PID: 124 Comm: kworker/u9:0 Tainted: G W 6.5.0-rc1+ #10 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 Workqueue: hci0 hci_cmd_sync_work [bluetooth] Call Trace: <TASK> dump_stack_lvl+0x5b/0x90 print_report+0xcf/0x670 ? __virt_addr_valid+0xdd/0x160 ? hci_set_powered_sync+0x2c9/0x4a0 [bluetooth] kasan_report+0xa6/0xe0 ? hci_set_powered_sync+0x2c9/0x4a0 [bluetooth] ? __pfx_set_powered_sync+0x10/0x10 [bluetooth] hci_set_powered_sync+0x2c9/0x4a0 [bluetooth] ? __pfx_hci_set_powered_sync+0x10/0x10 [bluetooth] ? __pfx_lock_release+0x10/0x10 ? __pfx_set_powered_sync+0x10/0x10 [bluetooth] hci_cmd_sync_work+0x137/0x220 [bluetooth] process_one_work+0x526/0x9d0 ? __pfx_process_one_work+0x10/0x10 ? __pfx_do_raw_spin_lock+0x10/0x10 ? mark_held_locks+0x1a/0x90 worker_thread+0x92/0x630 ? __pfx_worker_thread+0x10/0x10 kthread+0x196/0x1e0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 </TASK> Allocated by task 1782: kasan_save_stack+0x33/0x60 kasan_set_track+0x25/0x30 __kasan_kmalloc+0x8f/0xa0 hci_conn_add+0xa5/0xa80 [bluetooth] hci_bind_cis+0x881/0x9b0 [bluetooth] iso_connect_cis+0x121/0x520 [bluetooth] iso_sock_connect+0x3f6/0x790 [bluetooth] __sys_connect+0x109/0x130 __x64_sys_connect+0x40/0x50 do_syscall_64+0x60/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Freed by task 695: kasan_save_stack+0x33/0x60 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2b/0x50 __kasan_slab_free+0x10a/0x180 __kmem_cache_free+0x14d/0x2e0 device_release+0x5d/0xf0 kobject_put+0xdf/0x270 hci_disconn_complete_evt+0x274/0x3a0 [bluetooth] hci_event_packet+0x579/0x7e0 [bluetooth] hci_rx_work+0x287/0xaa0 [bluetooth] process_one_work+0x526/0x9d0 worker_thread+0x92/0x630 kthread+0x196/0x1e0 ret_from_fork+0x2c/0x50 ==================================================================

CVE-2023-53759 Dec 08, 02:15 HIGH PATCH This Week

In the Linux kernel, the following vulnerability has been resolved: HID: hidraw: fix data race on device refcount The hidraw_open() function increments the hidraw device reference counter. The counter has no dedicated synchronization mechanism, resulting in a potential data race when concurrently opening a device. The race is a regression introduced by commit 8590222e4b02 ("HID: hidraw: Replace hidraw device table mutex with a rwsem"). While minors_rwsem is intended to protect the hidraw_table itself, by instead acquiring the lock for writing, the reference counter is also protected. This is symmetrical to hidraw_release().

CVE-2023-53753 Dec 08, 02:15 HIGH PATCH This Week

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix mapping to non-allocated address [Why] There is an issue mapping non-allocated location of memory. It would allocate gpio registers from an array out of bounds. [How] Patch correct numbers of bounds for using.

CVE-2023-53752 Dec 08, 02:15 HIGH PATCH This Week

In the Linux kernel, the following vulnerability has been resolved: net: deal with integer overflows in kmalloc_reserve() Blamed commit changed: ptr = kmalloc(size); if (ptr) size = ksize(ptr); size = kmalloc_size_roundup(size); ptr = kmalloc(size); This allowed various crash as reported by syzbot [1] and Kyle Zeng. Problem is that if @size is bigger than 0x80000001, kmalloc_size_roundup(size) returns 2^32. kmalloc_reserve() uses a 32bit variable (obj_size), so 2^32 is truncated to 0. kmalloc(0) returns ZERO_SIZE_PTR which is not handled by skb allocations. Following trace can be triggered if a netdev->mtu is set close to 0x7fffffff We might in the future limit netdev->mtu to more sensible limit (like KMALLOC_MAX_SIZE). This patch is based on a syzbot report, and also a report and tentative fix from Kyle Zeng. [1] BUG: KASAN: user-memory-access in __build_skb_around net/core/skbuff.c:294 [inline] BUG: KASAN: user-memory-access in __alloc_skb+0x3c4/0x6e8 net/core/skbuff.c:527 Write of size 32 at addr 00000000fffffd10 by task syz-executor.4/22554 CPU: 1 PID: 22554 Comm: syz-executor.4 Not tainted 6.1.39-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023 Call trace: dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:279 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:286 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x120/0x1a0 lib/dump_stack.c:106 print_report+0xe4/0x4b4 mm/kasan/report.c:398 kasan_report+0x150/0x1ac mm/kasan/report.c:495 kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189 memset+0x40/0x70 mm/kasan/shadow.c:44 __build_skb_around net/core/skbuff.c:294 [inline] __alloc_skb+0x3c4/0x6e8 net/core/skbuff.c:527 alloc_skb include/linux/skbuff.h:1316 [inline] igmpv3_newpack+0x104/0x1088 net/ipv4/igmp.c:359 add_grec+0x81c/0x1124 net/ipv4/igmp.c:534 igmpv3_send_cr net/ipv4/igmp.c:667 [inline] igmp_ifc_timer_expire+0x1b0/0x1008 net/ipv4/igmp.c:810 call_timer_fn+0x1c0/0x9f0 kernel/time/timer.c:1474 expire_timers kernel/time/timer.c:1519 [inline] __run_timers+0x54c/0x710 kernel/time/timer.c:1790 run_timer_softirq+0x28/0x4c kernel/time/timer.c:1803 _stext+0x380/0xfbc ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:891 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:84 invoke_softirq kernel/softirq.c:437 [inline] __irq_exit_rcu+0x1c0/0x4cc kernel/softirq.c:683 irq_exit_rcu+0x14/0x78 kernel/softirq.c:695 el0_interrupt+0x7c/0x2e0 arch/arm64/kernel/entry-common.c:717 __el0_irq_handler_common+0x18/0x24 arch/arm64/kernel/entry-common.c:724 el0t_64_irq_handler+0x10/0x1c arch/arm64/kernel/entry-common.c:729 el0t_64_irq+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

CVE-2023-53751 Dec 08, 02:15 CRITICAL PATCH Act Now

In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname TCP_Server_Info::hostname may be updated once or many times during reconnect, so protect its access outside reconnect path as well and then prevent any potential use-after-free bugs.

CVE-2023-53748 Dec 08, 02:15 HIGH PATCH This Week

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup variable *nplanes is provided by user via system call argument. The possible value of q_data->fmt->num_planes is 1-3, while the value of *nplanes can be 1-8. The array access by index i can cause array out-of-bounds. Fix this bug by checking *nplanes against the array size.

CVE-2023-53747 Dec 08, 02:15 HIGH PATCH This Week

In the Linux kernel, the following vulnerability has been resolved: vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF After a call to console_unlock() in vcs_write() the vc_data struct can be freed by vc_port_destruct(). Because of that, the struct vc_data pointer must be reloaded in the while loop in vcs_write() after console_lock() to avoid a UAF when vcs_size() is called. Syzkaller reported a UAF in vcs_size(). BUG: KASAN: slab-use-after-free in vcs_size (drivers/tty/vt/vc_screen.c:215) Read of size 4 at addr ffff8880beab89a8 by task repro_vcs_size/4119 Call Trace: <TASK> __asan_report_load4_noabort (mm/kasan/report_generic.c:380) vcs_size (drivers/tty/vt/vc_screen.c:215) vcs_write (drivers/tty/vt/vc_screen.c:664) vfs_write (fs/read_write.c:582 fs/read_write.c:564) ... <TASK> Allocated by task 1213: kmalloc_trace (mm/slab_common.c:1064) vc_allocate (./include/linux/slab.h:559 ./include/linux/slab.h:680 drivers/tty/vt/vt.c:1078 drivers/tty/vt/vt.c:1058) con_install (drivers/tty/vt/vt.c:3334) tty_init_dev (drivers/tty/tty_io.c:1303 drivers/tty/tty_io.c:1415 drivers/tty/tty_io.c:1392) tty_open (drivers/tty/tty_io.c:2082 drivers/tty/tty_io.c:2128) chrdev_open (fs/char_dev.c:415) do_dentry_open (fs/open.c:921) vfs_open (fs/open.c:1052) ... Freed by task 4116: kfree (mm/slab_common.c:1016) vc_port_destruct (drivers/tty/vt/vt.c:1044) tty_port_destructor (drivers/tty/tty_port.c:296) tty_port_put (drivers/tty/tty_port.c:312) vt_disallocate_all (drivers/tty/vt/vt_ioctl.c:662 (discriminator 2)) vt_ioctl (drivers/tty/vt/vt_ioctl.c:903) tty_ioctl (drivers/tty/tty_io.c:2778) ... The buggy address belongs to the object at ffff8880beab8800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 424 bytes inside of freed 1024-byte region [ffff8880beab8800, ffff8880beab8c00) The buggy address belongs to the physical page: page:00000000afc77580 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xbeab8 head:00000000afc77580 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) page_type: 0xffffffff() raw: 000fffffc0010200 ffff888100042dc0 ffffea000426de00 dead000000000002 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880beab8880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880beab8900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880beab8980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880beab8a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880beab8a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Disabling lock debugging due to kernel taint

CVE-2022-50630 Dec 08, 02:15 HIGH PATCH This Week

In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: fix UAF in hugetlb_handle_userfault The vma_lock and hugetlb_fault_mutex are dropped before handling userfault and reacquire them again after handle_userfault(), but reacquire the vma_lock could lead to UAF[1,2] due to the following race, hugetlb_fault hugetlb_no_page /*unlock vma_lock */ hugetlb_handle_userfault handle_userfault /* unlock mm->mmap_lock*/ vm_mmap_pgoff do_mmap mmap_region munmap_vma_range /* clean old vma */ /* lock vma_lock again <--- UAF */ /* unlock vma_lock */ Since the vma_lock will unlock immediately after hugetlb_handle_userfault(), let's drop the unneeded lock and unlock in hugetlb_handle_userfault() to fix the issue. [1] https://lore.kernel.org/linux-mm/000000000000d5e00a05e834962e@google.com/ [2] https://lore.kernel.org/linux-mm/20220921014457.1668-1-liuzixian4@huawei.com/

CVE-2022-50623 Dec 08, 02:15 HIGH PATCH This Week

In the Linux kernel, the following vulnerability has been resolved: fpga: prevent integer overflow in dfl_feature_ioctl_set_irq() The "hdr.count * sizeof(s32)" multiplication can overflow on 32 bit systems leading to memory corruption. Use array_size() to fix that.

CVE-2025-40326 Dec 08, 01:16 HIGH PATCH This Week

Denial of service in the Linux kernel's NFSD (in-kernel NFSv4 server) allows remote clients to crash the server by sending a GETATTR request that queries the newly-defined time_deleg FATTR4 delegation attributes, for which NFSD previously had no defined handler. The fix makes NFSD return nfserr_inval for such spec-invalid queries (RFC 9754 Section 5) instead of crashing. EPSS is very low (0.03%) and there is no public exploit identified at time of analysis, so this is a defensive robustness fix rather than an actively exploited issue.

CVE-2025-40324 Dec 08, 01:16 HIGH PATCH This Week

Denial of service in the Linux kernel NFS server (nfsd) allows a crash in nfsd4_read_release() to be triggered while the trace_nfsd_read_done tracepoint is active, as surfaced by the pynfs read.testNoFh conformance test. The flaw affects NFSv4 READ compound processing and results in a kernel crash (availability impact only, no data disclosure or code execution). It has been resolved upstream and shipped across multiple stable series; no public exploit is identified at time of analysis and EPSS exploitation probability is very low (0.05%).

CVE-2025-40323 Dec 08, 01:16 HIGH PATCH This Week

Local privilege escalation and kernel memory corruption in the Linux kernel's framebuffer console (fbcon) subsystem arises from a use-after-free: when a framebuffer device is unregistered, the freed mode list leaves dangling pointers in the global fb_display[] array, which fb_mode_is_equal() later dereferences. A local low-privileged attacker with access to framebuffer devices (/dev/fbN) can trigger the freed-memory read/write via FBIOPUT_CON2FBMAP and mode-deletion ioctls, enabling denial of service or potential arbitrary kernel code execution. The flaw was found via syzkaller (KASAN slab-use-after-free), it carries EPSS 0.04% (11th percentile), it is not in CISA KEV, and no public exploit is identified - though detailed reproduction steps are published in the commit message.

CVE-2025-40322 Dec 08, 01:16 HIGH PATCH This Week

Out-of-bounds read in the Linux kernel's framebuffer console (fbdev) bitblit code affects the built-in font rendering path, where bit_putcs_aligned() and bit_putcs_unaligned() masked the character value with 0xff/0x1ff and used it as a glyph index without validating it against the actual font's glyph count. A local low-privileged attacker able to drive framebuffer console output can trigger a global out-of-bounds read past the built-in font array, leaking adjacent kernel memory or crashing the system. Discovered by syzbot; no public exploit identified at time of analysis, and with an EPSS of 0.04% real-world exploitation is unlikely to be widespread.

CVE-2025-40320 Dec 08, 01:16 CRITICAL PATCH Act Now

Use-after-free in the Linux kernel's CIFS/SMB client (cifs module) affects the smb2_query_info_compound() function, where a cached fid (cfid) freed during a first attempt is not reset to NULL before a replay, so subsequent cleanup dereferences a stale pointer. Reachable through ordinary filesystem operations such as statfs() against an SMB mount, it manifests as a refcount underflow and use-after-free that most plausibly causes kernel memory corruption and denial of service on hosts with CIFS mounts. This is no public exploit identified at time of analysis; EPSS is very low (0.03%, 7th percentile) and it is not in CISA KEV, though a vendor patch and Ubuntu USN are available.

CVE-2025-40319 Dec 08, 01:16 HIGH PATCH This Week

Local privilege escalation and kernel memory corruption in the Linux kernel's BPF ring buffer subsystem allows a low-privileged user capable of loading BPF programs to trigger a use-after-free. A race exists where irq_work queued in bpf_ringbuf_commit() can execute after the ring buffer is freed, letting the irq_work handler access freed memory - a bug found by syzbot via a BPF program attached to sched_switch. The fix adds irq_work_sync(&rb->work) before freeing the buffer. There is no public exploit identified at time of analysis, and EPSS is very low (0.05%), but kernel UAF flaws are historically weaponizable for local privilege escalation.

CVE-2025-40318 Dec 08, 01:16 HIGH PATCH This Week

A use-after-free condition in the Linux kernel's Bluetooth HCI command-synchronization layer (hci_sync) lets a race between hci_cmd_sync_dequeue_once() and hci_cmd_sync_work() delete the same list entry twice, corrupting kernel memory. It affects the mainline Linux kernel Bluetooth stack up to the fixed stable releases (6.1.159, 6.6.117, 6.12.58, 6.17.8) and is fixed upstream. There is no public exploit identified and EPSS is very low (0.04%), but the NVD-scored CVSS of 8.8 reflects the high-impact memory-corruption potential (denial of service and possible privilege escalation) if the race is won.

CVE-2025-40317 Dec 08, 01:16 HIGH PATCH This Week

Kernel memory corruption in the Linux kernel SLIMbus regmap layer (regmap-slimbus) occurs because __devm_regmap_init_slimbus() and __regmap_init_slimbus() passed an incorrect bus_context pointer, causing an invalid-address dereference during SLIMbus register I/O. On affected Qualcomm-based platforms (e.g. wcd934x audio codec on SDM845 boards), a local user triggering audio playback crashes the kernel and may corrupt or disclose memory. This is a resolved regression exposed by commit 4e65bda8273c; there is no public exploit identified at time of analysis and EPSS probability is negligible (0.05%).

CVE-2025-40309 Dec 08, 01:16 HIGH PATCH This Week

Memory corruption (use-after-free) in the Linux kernel's Bluetooth SCO (Synchronous Connection-Oriented) socket subsystem allows a local attacker with Bluetooth socket access to trigger a slab use-after-free during connection teardown. The flaw affects net/bluetooth/sco.c, where sco_conn_free/sco_conn_put in the HCI command-sync workqueue can operate on a sco_conn object whose backing socket was already freed by a concurrent sco_sock_release, leading to a kernel write to freed memory. Rated CVSS 8.0 with a fix already merged upstream and shipped in stable kernels; no public exploit is identified and EPSS is very low (0.03%).

CVE-2025-40306 Dec 08, 01:16 HIGH PATCH This Week

Local denial-of-service and filesystem corruption in the Linux kernel's OrangeFS driver stems from a broken loop in the xattr_key() helper, which tests the pointer instead of the dereferenced character and therefore walks memory indefinitely instead of stopping at a C-string terminator. On systems mounting OrangeFS, an unprivileged local user issuing extended-attribute operations (setfattr/getfattr) can trigger a kernel oops, hung processes, and corrupted OrangeFS files; a secondary hash_add() misuse also leaks kernel memory on every security.capability getattr, driving the system toward OOM. There is no public exploit identified at time of analysis, and EPSS is very low (0.07%, 20th percentile), consistent with a niche, non-remote issue.

CVE-2025-40304 Dec 08, 01:16 HIGH PATCH This Week

Out-of-bounds memory corruption in the Linux kernel's fbdev console text-rendering path (bit_putcs) allows a local, low-privileged user to trigger vmalloc-out-of-bounds writes when text is rendered near screen edges, corrupting kernel heap memory adjacent to the framebuffer. The flaw stems from a character-count/buffer-size mismatch after horizontal clipping, and with a CVSS of 7.8 (local, low complexity, C:H/I:H/A:H) it can lead to memory corruption and potential privilege escalation or denial of service. No public exploit identified at time of analysis, and EPSS is very low (0.05%, 16th percentile), consistent with a non-remote, config- and hardware-dependent kernel bug rather than a mass-exploitation target.

CVE-2025-40303 Dec 08, 01:16 HIGH PATCH This Week

Use-after-free in the Linux kernel btrfs filesystem allows a local user to crash the system during unmount of an error-flagged filesystem, particularly when RAID56 is used for metadata. When btrfs marks a filesystem as errored, dirty tree-block folios linger in the btree inode page cache and are written back during close_ctree() after the worker threads have already been stopped and freed, causing queue_work() on a destroyed rmw_workers queue and a use-after-free. CVSS is 7.8 (High); this is a local privilege/DoS issue with no public exploit identified at time of analysis and a very low EPSS of 0.03%.

CVE-2025-40302 Dec 08, 01:16 HIGH PATCH This Week

Local privilege escalation via memory corruption in the Linux kernel's videobuf2 (vb2) media framework allows a local user with access to a V4L2 video device to corrupt internal queue state by invoking the VIDIOC_REMOVE_BUFS ioctl while legacy read/write fileio mode is active. The vb2_ioctl_remove_bufs() path manipulates the queue's internal buffer list and can overwrite pointers the fileio access mode still relies on, leading to high-impact confidentiality, integrity, and availability effects (CVSS 7.8, AV:L). No public exploit has been identified at time of analysis; EPSS is negligible (0.03%) and the flaw is not in CISA KEV.

CVE-2025-40301 Dec 08, 01:16 HIGH PATCH This Week

Uninitialized memory read in the Linux kernel Bluetooth HCI event layer allows a malicious or malfunctioning Bluetooth controller to leak a byte of kernel memory and induce undefined command-completion handling. The flaw lives in hci_cmd_complete_evt(), where an unknown Command Complete opcode causes the code to read skb->data[0] as a return status even after all parameter bytes were already pulled, leaving the buffer empty. It is a fixed upstream kernel bug (CWE-908-class use of uninitialized resource) with no public exploit identified at time of analysis and a very low EPSS score of 0.04%.

CVE-2025-40297 Dec 08, 01:16 HIGH PATCH This Week

Local privilege-level attackers can trigger a use-after-free in the Linux kernel's network bridge (net/bridge) MST implementation when a bridge port is deleted concurrently with FDB learning. The flaw stems from Multiple Spanning Tree (MST) mode bypassing the port's disabled state check, allowing FDB entries to be learned while a port is being torn down. EPSS is low (0.04%, 11th percentile) and there is no public exploit identified at time of analysis; the issue was found by syzbot fuzzing rather than in-the-wild exploitation.

CVE-2025-40292 Dec 08, 01:16 HIGH PATCH This Week

Denial-of-service (and potential out-of-bounds read) in the Linux kernel's virtio-net driver lets a malicious or compromised virtualization host crash guest VMs by announcing a receive buffer length larger than the guest allocated for 'big packets' mode. The flaw stems from an incomplete length check introduced when commit 4959aebba8c0 changed big-packet buffer sizing from a fixed MAX_SKB_FRAGS * PAGE_SIZE to an MTU-dependent value, leaving the receive-path validation stale. No public exploit has been identified at time of analysis, and EPSS is very low (0.04%), consistent with a host-to-guest condition rather than internet-facing mass exploitation.

CVE-2025-40291 Dec 08, 01:16 HIGH PATCH This Week

Local privilege escalation and memory corruption in the Linux kernel's io_uring subsystem arises from an integer truncation flaw in io_estimate_bvec_size(), where the calculated number of registered-buffer segments is truncated into an int and can overflow values used in later allocation and copy logic. Affected are Linux kernel builds carrying the vulnerable io_uring registered buffer vector code (6.15 through the fixed 6.17.8/6.18 line); a local user able to submit io_uring operations can trigger heap corruption with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%), consistent with a bug reported and fixed upstream rather than one under active exploitation.

CVE-2025-40290 Dec 08, 01:16 HIGH PATCH This Week

Memory corruption in the Linux kernel AF_XDP (xsk) zero-copy transmit path allows a local user with an AF_XDP socket to trigger a NULL pointer dereference and fatal kernel panic. The regression, introduced by commit 30f241fcf52a, misused the skb control block to store the completion-queue descriptor count; because the control block is reused by other subsystems (e.g. IP receive) after transmit, xsk_destruct_skb dereferences corrupted data. EPSS is 0.03% and there is no public exploit identified at time of analysis; the practical outcome is denial of service rather than the full CIA compromise implied by the raw 7.8 CVSS.

CVE-2025-40285 Dec 06, 22:15 HIGH PATCH This Week

Denial of service in the Linux kernel's in-kernel SMB3 server (ksmbd) arises from a reference-count leak in smb2_sess_setup() that is not released along the session-reconnect path. Remote attackers reaching an exposed ksmbd service can repeatedly drive session setups requiring reconnect to leak ksmbd_session references, progressively exhausting kernel memory and impacting availability (CVSS 7.5, A:H only). No public exploit is identified at time of analysis and EPSS is very low (0.04%), but vendor-released patches are already shipping across stable branches.

CVE-2025-40284 Dec 06, 22:15 HIGH PATCH This Week

Local privilege-boundary memory corruption in the Linux kernel Bluetooth Management (MGMT) subsystem allows a local low-privileged user to trigger a slab-use-after-free when a Bluetooth HCI device (hdev) is removed while the mesh_send_done timer is still pending. Because the timer was never canceled during hdev teardown, it can fire against freed memory (device_release path), causing a KASAN slab-use-after-free that typically crashes the kernel (denial of service), with a theoretical path to further corruption. EPSS is very low (0.04%, 11th percentile), there is no public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available.

CVE-2025-40283 Dec 06, 22:15 HIGH PATCH This Week

Local privilege escalation and memory corruption in the Linux kernel's Bluetooth btusb USB driver arises from a use-after-free in btusb_disconnect(), where the interface's btusb data is freed by usb_driver_release_interface() and then dereferenced later in the same function. Affected systems run vulnerable stable kernels (5.4/5.10/5.15/6.1/6.6/6.12/6.17 branches and 6.18 pre-release) with a Bluetooth USB adapter; a local attacker able to influence USB device teardown could corrupt kernel slab memory, potentially yielding code execution or a crash. There is no public exploit identified at time of analysis and EPSS is very low (0.05%), so this is a patch-hygiene item rather than an urgent, actively-exploited threat.

CVE-2025-40282 Dec 06, 22:15 HIGH PATCH This Week

Kernel panic (BUG) in the Linux kernel's Bluetooth 6LoWPAN subsystem (net/bluetooth/6lowpan.c) allows an adjacent attacker to crash the host by sending uncompressed IPv6 frames over a Bluetooth 6LoWPAN link. Because the 6lowpan netdev registers header_ops but never reset the MAC/link-local header on the uncompressed IPv6 RX path, delivery to a listener such as an AF_PACKET SOCK_RAW socket triggers a fatal skb_reset_mac_header assertion (kernel BUG at net/core/skbuff.c:212). Tagged as Denial of Service; EPSS is 0.05% (16th percentile), no KEV listing, and no public exploit identified at time of analysis.

CVE-2025-40280 Dec 06, 22:15 HIGH PATCH CISA Act Now

Local privilege escalation via kernel memory corruption in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem allows a local attacker with network-admin capability to trigger a use-after-free in tipc_mon_reinit_self(). The flaw stems from tipc_net_finalize_work() iterating the RTNL-protected monitors[] array from a workqueue without holding the RTNL lock, letting freed monitor structures be accessed. Reported by syzbot with no public exploit and a very low EPSS (0.05%); it is not in CISA KEV, and a vendor fix is available across all supported stable branches.

CVE-2025-40277 Dec 06, 22:15 HIGH PATCH This Week

Out-of-bounds memory access in the Linux kernel's DRM vmwgfx (VMware SVGA/virtual GPU) driver allows a local, low-privileged user to trigger buffer over-reads or over-writes by submitting a command with an unvalidated header size. The driver failed to validate the userspace-supplied command header size against SVGA_CMD_MAX_DATASIZE before using it in buffer offset calculations, enabling an overflow that leads to out-of-bounds access with high confidentiality, integrity, and availability impact (CVSS 7.8). No public exploit identified at time of analysis, and with an EPSS of 0.05% (16th percentile) the vulnerability is not currently listed in CISA KEV.

CVE-2025-40276 Dec 06, 22:15 HIGH PATCH This Week

Information disclosure and memory corruption in the Linux kernel's drm/panthor GPU driver (ARM Mali CSF GPUs, kernel 6.10 through the 6.17.x series) arises because the driver maps freshly allocated shmem-backed GPU buffers as CPU-uncached without flushing the cached zeroing writes performed by the shmem layer, leaving dirty cachelines that can leak previously freed data or asynchronously corrupt buffer contents when those lines are later evicted. A local low-privileged user with access to the panthor GPU device can trigger the condition through normal buffer allocation. This carries CVSS 7.3; there is no public exploit identified at time of analysis and the EPSS score is very low (0.03%, 9th percentile).

CVE-2025-40274 Dec 06, 22:15 HIGH PATCH This Week

Local memory corruption in the Linux kernel's KVM guest_memfd subsystem (introduced in 6.8) lets a local user with KVM VM-management access trigger a slab use-after-free by racing memslot deletion against release of a dying guest_memfd file. When a memslot is freed before its guest_memfd file is fully released, kvm_gmem_release() writes to already-freed memory, as confirmed by a syzbot/KASAN report. There is no public exploit identified at time of analysis and EPSS is negligible (0.03%, 6th percentile), reflecting a narrow race rather than a broadly weaponizable flaw.

CVE-2025-40273 Dec 06, 22:15 HIGH PATCH This Week

Denial of service and kernel memory corruption in the Linux kernel NFS server (nfsd) allows an NFS client to trigger a linked-list corruption and kernel oops by exploiting improper cleanup of COPY_NOTIFY stateids. When a client performs OPEN then COPY_NOTIFY on the resulting parent stateid, then reboots and forces state expiry via CREATE_SESSION, nfs4_free_ol_stateid() frees the parent without releasing the associated copynotify stateid, so the laundromat worker later corrupts the list and crashes. Carries CVSS 8.8; EPSS is very low (0.05%, 16th percentile) and there is no public exploit identified at time of analysis.

CVE-2025-40272 Dec 06, 22:15 HIGH PATCH This Week

Local privilege-boundary instability in the Linux kernel's secret memory subsystem (mm/secretmem) stems from a use-after-free race in the page-fault handler for files created via memfd_secret(2). When two tasks fault the same secret-memory page concurrently, the losing task frees its folio before restoring the page to the kernel direct map, briefly returning a not-present page to the allocator; a subsequent allocation and kernel access triggers a supervisor not-present page fault. Affects long-lived kernel branches (5.14 through 6.18-rc) with no public exploit identified at time of analysis and a low EPSS score (0.05%, 16th percentile).

CVE-2025-40271 Dec 06, 22:15 HIGH POC PATCH CISA Act Now

Use-after-free in the Linux kernel's procfs directory-reading path (proc_readdir_de() in fs/proc) allows a local user to trigger a race between directory traversal and concurrent removal of proc entries, corrupting kernel memory. The bug arises because a proc_dir_entry is erased from the subdir red-black tree without clearing the node, so pde_subdir_next() can return a freed node; it was found via stress-ng running getdents against /proc/<pid>/net/dev_snmp6/ while network devices (tun interfaces) are unregistered. Publicly available exploit code exists and a vendor patch is available, but the CVE is not listed in CISA KEV and carries a very low EPSS score (0.05%), indicating no evidence of widespread exploitation.

CVE-2025-40270 Dec 06, 22:15 HIGH PATCH This Week

Local privilege-boundary memory corruption in the Linux kernel's swap subsystem (memory management) allows a race between swapoff on one device and swapin on another to trigger a use-after-free of a swap device structure during VMA (page-table-walking) swap readahead. Introduced by commit 78524b05f1a3 which removed redundant swap device pinning in __read_swap_cache_async, the flaw affects kernels from 6.15 up to the fixed releases; there is no public exploit identified at time of analysis and EPSS is negligible at 0.03%. Impact is scoped to systems with swap enabled across multiple swap devices where the readahead path can encounter entries belonging to a device it does not hold a reference to.

CVE-2025-40269 Dec 06, 22:15 HIGH PATCH This Week

Local privilege escalation and memory corruption in the Linux kernel's ALSA USB-audio driver (snd-usb-audio) arises because PCM transfer packet sizes are computed solely from the sample rate and packets-per-second without validating against the endpoint's wMaxPacketSize limit, allowing a crafted or malformed USB audio descriptor to overflow the URB packet buffer. An attacker with local access and the ability to attach a malicious USB device (or a compromised low-privileged context reaching the audio stack) can trigger heap buffer overflow, as originally reported by syzbot. There is no public exploit identified at time of analysis, and EPSS is low (0.16%), but the CVSS 7.8 reflects high impact to confidentiality, integrity, and availability once triggered.

CVE-2025-66623 Dec 05, 19:15 Maven HIGH PATCH This Week

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 and prior to 0.49.1, in some situations, Strimzi creates an incorrect Kubernetes Role which grants the Apache Kafka Connect and Apache Kafka MirrorMaker 2 operands the GET access to all Kubernetes Secrets that exist in the given Kubernetes namespace. The issue is fixed in Strimzi 0.49.1.

CVE-2025-66566 Dec 05, 18:15 Maven HIGH PATCH This Week

yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lead to disclosure of sensitive data. JNI-based implementations are not affected. This vulnerability is fixed in 1.10.1.

CVE-2025-66471 Dec 05, 17:16 PyPI HIGH PATCH This Week

A security vulnerability in version 1.0 and (CVSS 7.5). High severity vulnerability requiring prompt remediation. Vendor patch is available.

CVE-2025-66418 Dec 05, 16:15 PyPI HIGH PATCH This Week

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.

CVE-2025-58098 Dec 05, 14:15 HIGH POC PATCH This Week

CVE-2025-58098 is a security vulnerability (CVSS 8.3). High severity vulnerability requiring prompt remediation.

CVE-2025-6966 Dec 05, 13:16 MEDIUM POC PATCH This Month

NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.

CVE-2025-13654 Dec 05, 13:16 HIGH POC PATCH This Week

A stack buffer overflow vulnerability exists in the buffer_get function of duc, a disk management tool, where a condition can evaluate to true due to underflow, allowing an out-of-bounds read.

CVE-2025-66200 Dec 05, 11:15 MEDIUM POC PATCH This Month

A security vulnerability in Apache HTTP Server (CVSS 5.4). Remediation should follow standard vulnerability management procedures.

CVE-2025-65082 Dec 05, 11:15 MEDIUM PATCH This Month

A security vulnerability in Apache HTTP Server (CVSS 6.5). Remediation should follow standard vulnerability management procedures.

CVE-2025-59775 Dec 05, 11:15 HIGH POC PATCH This Week

Server-Side Request Forgery (SSRF) vulnerability  in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off  allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.66, which fixes the issue.

CVE-2025-55753 Dec 05, 11:15 HIGH POC PATCH This Week

An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds. This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

CVE-2025-32901 Dec 05, 05:17 MEDIUM PATCH This Month

In KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash.

CVE-2025-32899 Dec 05, 05:16 MEDIUM PATCH This Month

A security vulnerability in KDE Connect (CVSS 4.3). Remediation should follow standard vulnerability management procedures.

CVE-2025-66564 Dec 04, 23:15 Go HIGH PATCH This Week

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps.

CVE-2025-66506 Dec 04, 22:15 Go HIGH PATCH This Week

A security vulnerability in Fulcio (CVSS 7.5). High severity vulnerability requiring prompt remediation. Vendor patch is available.

CVE-2025-65637 Dec 04, 19:16 Go HIGH POC PATCH This Week

A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.

CVE-2025-66516 Dec 04, 17:15 Maven HIGH POC PATCH This Week

Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.

CVE-2025-40266 Dec 04, 16:16 HIGH PATCH This Week

Out-of-bounds memory access in the Linux kernel's arm64 protected-KVM (pKVM) hypervisor allows a compromised or malicious host kernel to read beyond the bounds of the hypervisor's FF-A (Arm Firmware Framework) shared-memory buffer by supplying an unvalidated composite-memory-region offset in the range [U32_MAX - sizeof(struct ffa_composite_mem_region) + 1, U32_MAX]. Because the host is normally treated as untrusted relative to the hypervisor in the pKVM confidential-compute model, this breaks the host/hypervisor isolation boundary (CVSS scope change) and can disclose hypervisor memory or crash it. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%), consistent with a hard-to-reach, config-specific hypervisor bug rather than mass exploitation.

CVE-2025-40262 Dec 04, 16:16 HIGH PATCH CISA Act Now

Local memory corruption in the Linux kernel's imx_sc_key input driver (drivers/input/keyboard/imx_sc_key.c) for NXP i.MX SoCs occurs during module unload/unbind: a devm cleanup action was registered with the address of a stack variable (&priv) instead of the priv pointer itself, so imx_sc_key_action() dereferences a stale stack address. Triggering the corruption requires unloading or unbinding the driver on affected i.MX hardware, and there is no public exploit identified at time of analysis. EPSS is negligible (0.05%, 16th percentile) and it is not in CISA KEV, so this is a stability/robustness fix on niche hardware rather than a broadly exploited flaw.

CVE-2025-40261 Dec 04, 16:16 CRITICAL PATCH CISA Act Now

Kernel crash and use-after-free list corruption in the Linux kernel's NVMe-over-Fibre-Channel (nvme-fc) transport driver occurs when tearing down a controller: nvme_fc_delete_ctrl() calls cancel_work_sync() on ->ioerr_work before nvme_fc_delete_association() completes, so a late I/O error can re-queue ->ioerr_work after cancellation and let it run against a freed nvme_fc_ctrl object. The result is a kworker hitting kernel BUG at lib/list_debug.c (list_del corruption) and an oops, affecting hosts using NVMe/FC attached storage. There is no public exploit identified at time of analysis, and EPSS is very low (0.05%), consistent with a local, hardware-conditional stability bug rather than a broadly weaponizable flaw.

CVE-2025-40258 Dec 04, 16:16 CRITICAL PATCH CISA Act Now

Use-after-free in the Linux kernel's MPTCP subsystem stems from a race in mptcp_schedule_work() (net/mptcp/protocol.c), where the socket refcount was taken only after the work item was queued, allowing mptcp_worker() to run and free the socket before sock_hold() executes. Reachable via the MPTCP timeout timer (mptcp_tout_timer), it was found by syzbot and produces a refcount 'addition on 0' warning that signals kernel memory corruption. No public exploit identified at time of analysis and EPSS is very low (0.05%), consistent with a hard-to-time race rather than a readily weaponized flaw despite the auto-generated 9.8 score.

CVE-2025-40257 Dec 04, 16:16 CRITICAL PATCH CISA Act Now

Denial-of-service via a use-after-free in the Linux kernel's MPTCP path-manager allows the add-address timer (mptcp_pm_del_add_timer()) to call sk_stop_timer_sync() on an announcement-list entry that another context has already freed, corrupting kernel memory. The flaw affects the mptcp subsystem across multiple long-lived stable branches and was found by syzbot via a KASAN slab-use-after-free report; the upstream fix adds RCU protection. No public exploit is identified at time of analysis, EPSS is 0.05%, and it is not listed in CISA KEV.

CVE-2025-40253 Dec 04, 16:16 HIGH PATCH This Week

Memory corruption in the Linux kernel's s390/ctcm mainframe network driver stems from a double-kfree: mpc_rcvd_sweep_req() frees the mpcginfo structure, then ctcmpc_unpack_skb() frees the same pointer again after the conditional call returns. Discovered via clang static analysis, it affects IBM Z (s390) systems using the CTCM MPC networking driver and could lead to kernel memory corruption, denial of service, or potentially escalation when a crafted MPC sweep-request frame is processed. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.05%), and it is not listed in CISA KEV; the fix has shipped in stable kernel releases.

CVE-2025-40252 Dec 04, 16:16 CRITICAL PATCH CISA Act Now

Out-of-bounds read in the Linux kernel's QLogic qede (FastLinQ 4xxxx) Ethernet driver arises in the TPA hardware-aggregation handlers qede_tpa_cont() and qede_tpa_end(), where loops walk the fixed-size cqe->len_list[] array using only a zero-length terminator as the stop condition; a missing or malformed terminator lets the loop read past the array. It affects systems running the qede driver on QLogic FastLinQ NICs and, if triggered, exposes the kernel to adjacent-memory disclosure or a crash. There is no public exploit identified at time of analysis, EPSS is very low (0.05%), and the flaw was found by static analysis (SVACE) rather than observed exploitation, so the published 9.8 CVSS appears substantially inflated relative to the true read-primitive impact.

CVE-2025-40250 Dec 04, 16:16 HIGH PATCH CISA Act Now

Local denial of service in the Linux kernel's mlx5_core driver (Mellanox/NVIDIA ConnectX network adapters) allows a system crash when mlx5_irq_alloc() fails on an exhausted IRQ vector pool. The faulty error path frees the entire CPU reverse-map (rmap) instead of only the newly added IRQ glue object, producing a general protection fault in free_irq_cpu_rmap() when another thread later dereferences the freed structure. The fix is available from vendor; EPSS is very low (0.03%, 7th percentile) and there is no public exploit identified at time of analysis.

CVE-2025-40249 Dec 04, 16:16 HIGH PATCH This Week

Local privilege-context memory corruption in the Linux kernel's GPIO character device (gpio cdev) subsystem allows a use-after-free on the file structure backing an open GPIO chardev descriptor. When a GPIO line-change event fires after the final fput() has dropped the fd's reference count to zero but before the deferred .release() callback unregisters the notifier, the kernel calls get_file() on a file with a zero refcount, triggering a use-after-free (warned as 'f_count incremented from zero; use-after-free condition present'). No public exploit has been identified at time of analysis and the EPSS score is negligible (0.03%), consistent with a hard-to-win local race rather than a widely exploited flaw.

CVE-2025-40248 Dec 04, 16:16 HIGH PATCH CISA Act Now

Local privilege-escalation-grade memory corruption in the Linux kernel's AF_VSOCK (virtio/vhost vsock) stack allows a local user to trigger a use-after-free or NULL-pointer dereference by racing a signal or timeout against an in-progress connect() on an already-established socket. Aborting the connect could tear down a connected socket while a concurrent sendmsg() or sockmap operation runs, corrupting credit accounting (bytes_unsent), breaking sockmap invariants, and enabling a transport change/drop after TCP_ESTABLISHED. No public exploit is identified at time of analysis and EPSS is 0.05%, but the flaw is patched across many stable branches and tracked by Ubuntu, Debian, and Siemens.

CVE-2025-40245 Dec 04, 16:16 HIGH PATCH This Week

Memory-map miscalculation in the Linux kernel's nios2 architecture code allows local low-privileged users to trigger kernel paging failures and denial of service on affected nios2 (soft-core) systems built with CONFIG_FLATMEM. Because memblock.current_limit is left at its default MEMBLOCK_ALLOC_ANYWHERE when pfn limits are computed, max_low_pfn can exceed max_pfn and push mem_map beyond valid DRAM, producing 'Unable to handle kernel paging request' oopses and kernel panics. No public exploit identified at time of analysis; EPSS is 0.04% (11th percentile) and the flaw is not in CISA KEV.

CVE-2025-40244 Dec 04, 16:16 HIGH PATCH This Week

Uninitialized-memory read in the Linux kernel's HFS+ filesystem driver (__hfsplus_ext_cache_extent) allows a local actor who can write to a mounted HFS+ volume to trigger use of uninitialized heap data, leading to information disclosure or a kernel crash. The flaw, found by syzbot via KMSAN on kernel 6.12-rc5, is fixed across multiple stable trees; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%, 11th percentile). Distributions including Ubuntu (USN-8029/8030/8033/8034) and Debian (DLA-4404-1) have shipped patches.

CVE-2025-40243 Dec 04, 16:16 HIGH PATCH This Week

Uninitialized-memory (KMSAN uninit-value) defect in the Linux kernel HFS filesystem driver allows a local attacker who can mount or operate on a crafted HFS volume to corrupt on-disk allocation state and destabilize the filesystem. The bitmap buffer in hfs_mdb_get() was allocated with kmalloc() (leaving residual heap garbage) and later consumed by hfs_find_set_zero_bits() during block allocation, so non-zero uninitialized bits can drive incorrect bitmap decisions leading to volume corruption and driver misbehavior. Discovered by syzbot fuzzing; there is no public exploit identified at time of analysis and EPSS risk is very low (0.04%).

CVE-2025-40242 Dec 04, 16:16 HIGH PATCH This Week

Kernel memory corruption in the Linux kernel's GFS2 clustered filesystem stems from a use-after-free race in gdlm_put_lock(), where a small window exists after the DFL_UNMOUNT flag is set but before the DLM lockspace is released. During that window the DLM callbacks gdlm_ast() and gdlm_bast() can still fire and dereference already-freed glock objects, potentially crashing the kernel or corrupting memory on systems using GFS2. The issue carries a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L), has an EPSS of only 0.03%, is not in CISA KEV, and has no public exploit identified at time of analysis; it is patched upstream and shipped by Ubuntu and Debian.

CVE-2025-40241 Dec 04, 16:16 HIGH PATCH This Week

Denial of service in the Linux kernel EROFS filesystem driver (versions 6.15 through the 6.17.x series before 6.17.6) lets a local user crash the system by mounting or reading a specially crafted read-only filesystem image. The flaw lives in the 'encoded extents' feature added in Linux 6.15, where malformed physical-length (plen) values and out-of-48-bit physical block addresses trigger an out-of-bounds access in z_erofs_submit_queue(). No public exploit identified at time of analysis, and EPSS probability is very low (0.03%), but vendor patches are available and the issue is tracked by Ubuntu (medium priority) and Debian.

CVE-2025-40240 Dec 04, 16:16 HIGH PATCH This Week

Denial of service in the Linux kernel SCTP subsystem allows remote attackers to crash affected systems via a NULL pointer dereference triggered when an SCTP chunk arrives without a data buffer. The flaw stems from dereferencing chunk->skb inside a code path that assumes it is NULL, and is fixed across multiple stable trees (5.4.301, 5.10.246, 5.15.196, 6.1.158, 6.6.115, 6.12.56, 6.17.6, 6.18). No public exploit identified at time of analysis, and EPSS probability is very low (0.04%, 11th percentile), indicating minimal real-world exploitation likelihood despite the network-reachable vector.

CVE-2025-40233 Dec 04, 16:16 HIGH PATCH This Week

Stale extent-map cache handling in the Linux kernel's OCFS2 clustered filesystem lets a local, low-privileged user with access to an OCFS2 mount crash the kernel and read or corrupt on-disk extent data. After a reflinked (OCFS2_EXT_REFCOUNTED) extent is moved or defragmented, the in-memory extent cache retains stale flags while the disk holds updated ones; a subsequent write hits a BUG_ON in ocfs2_refcount_cal_cow_clusters(), producing a panic (denial of service) and potential data/integrity impact. There is no public exploit identified at time of analysis, and EPSS is very low (0.05%, 16th percentile), consistent with a niche, non-KEV local kernel bug rather than a mass-exploited flaw.

CVE-2025-40216 Dec 04, 15:15 HIGH PATCH This Week

Local privilege-relevant memory corruption in the Linux kernel's io_uring resource (rsrc) subsystem stems from faulty offset arithmetic when computing the first page of a coalesced folio from an unaligned user virtual address, allowing a local low-privileged user submitting io_uring requests to trigger out-of-bounds access with high confidentiality, integrity, and availability impact. Fixed upstream and backported to stable trees (6.12.36, 6.15.5, 6.16); no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.03%, 6th percentile). Not listed in CISA KEV.

CVE-2025-40215 Dec 04, 13:15 HIGH PATCH This Week

Improper cleanup of IPComp fallback tunnel xfrm states in the Linux kernel's IPsec (xfrm) subsystem allows a local low-privileged attacker to trigger memory corruption (use-after-free) leading to full compromise of confidentiality, integrity, and availability. The flaw arises because fallback tunnel states were only deleted when the last user state was destroyed rather than deleted, so lingering skb references (via IP reassembly queues or deferred skb freeing) leave stale states on xfrm hashtables/lists, tripping the WARN in xfrm_state_fini and leaving dangling structures. This is not in CISA KEV and no public exploit was identified at time of analysis; EPSS is very low at 0.05%, but the 7.8 CVSS and CIA-high impact make it a meaningful local privilege-escalation candidate.

CVE-2025-40214 Dec 04, 13:15 HIGH PATCH CISA Act Now

Local privilege escalation / kernel memory corruption in the Linux kernel's AF_UNIX garbage collector arises because unix_add_edge() fails to initialise the new vertex's scc_index field. On kernels where GC has already run and grouped sockets into strongly-connected components, a freshly allocated in-flight socket inherits a stale SCC index (via heap spraying), causing unix_vertex_dead() to misjudge an alive in-flight socket as dead and garbage-collect its receive queue - a use-after-free. A detailed public reproducer exists (publicly available exploit code exists); it is not in CISA KEV and EPSS is very low (0.04%).

CVE-2025-41080 Dec 04, 12:16 MEDIUM This Month

A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the victim's browser by storing malicious payloads with POST parámetro 'p' in '/api/v2.1/repos/{repo_id}/file/'.

CVE-2025-41079 Dec 04, 12:16 MEDIUM This Month

A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the victim's browser by storing malicious payloads with PUT parámetro 'name' in '/api/v2.1/user/'.

CVE-2025-14010 Dec 04, 10:16 PyPI MEDIUM PATCH This Month

A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically plaintext passwords, via verbose output when running Ansible with debug modes. Attackers with access to logs could retrieve these secrets and potentially compromise Keycloak accounts or administrative access.

CVE-2025-66293 Dec 03, 21:15 HIGH POC PATCH This Week

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management. Upgrade to libpng 1.6.52 or later.

CVE-2025-66406 Dec 03, 20:16 Go MEDIUM PATCH This Month

A security vulnerability in Step CA (CVSS 5.0). Remediation should follow standard vulnerability management procedures.

CVE-2025-61727 Dec 03, 20:16 Go MEDIUM PATCH This Month

An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.

CVE-2025-13086 Dec 03, 20:16 HIGH PATCH This Week

Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client

CVE-2025-66220 Dec 03, 19:15 Go MEDIUM POC PATCH This Month

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches.

CVE-2025-13992 Dec 03, 19:15 MEDIUM PATCH This Month

Side-channel information leakage in Navigation and Loading in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)