Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-23112 State: PUBLISHED Published: 2025-01-10T00:00:00 Last Updated: 2025-01-13T20:47:26.043Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Vanderbilt Products: REDCap Problem Types: CWE-79 Description: An issue was discovered in REDCap 14.9.6. A stored cross-site scripting (XSS) vulnerability allows authenticated users to inject malicious scripts into the Survey field name of Survey. When a user receive the survey, if he clicks on the field name, it triggers the XSS payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ping-oui-no/Vulnerability-Research-CVESS/blob/main/RedCap/CVE_ZZZZ/README.md
CVE ID: CVE-2025-23113 State: PUBLISHED Published: 2025-01-10T00:00:00 Last Updated: 2025-01-13T20:35:35.849Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: Vanderbilt Products: REDCap Problem Types: CWE-352 Description: An issue was discovered in REDCap 14.9.6. It has an action=myprojects&logout=1 CSRF issue in the alert-title while performing an upload of a CSV file containing a list of alert configuration. An attacker can send the victim a CSV file containing an HTML injection payload in the alert-title. Once the victim uploads the file, he automatically lands on a page to view the uploaded data. If the victim click on the alert-title value, it can trigger
e automatically lands on a page to view the uploaded data. If the victim click on the alert-title value, it can trigger a logout request and terminates their session, or redirect to a phishing website. This vulnerability stems from the absence of CSRF protections on the logout functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ping-oui-no/Vulnerability-Research-CVESS/blob/main/RedCap/CVE_XXX/README.md
CVE ID: CVE-2025-23114 State: PUBLISHED Published: 2025-02-05T01:45:03.336Z Last Updated: 2025-03-13T18:23:04.462Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Veeam Products: Backup for AWS, Backup for Microsoft Azure, Backup for Google Cloud, Backup for Nutanix AHV, Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization, Backup for Salesforce Description: A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected server. This issue occurs due to a failure to properly validate TLS certificate. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.
o properly validate TLS certificate. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4712
CVE ID: CVE-2025-23115 State: PUBLISHED Published: 2025-03-01T01:52:36.149Z Last Updated: 2025-03-13T17:49:18.227Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Ubiquiti Inc Products: UniFi Protect Cameras Description: A Use After Free vulnerability on UniFi Protect Cameras could allow a Remote Code Execution (RCE) by a malicious actor with access to UniFi Protect Cameras management network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.ui.com/releases/Security-Advisory-Bulletin-046-046/9649ea8f-93db-4713-a875-c3fd7614943f
CVE ID: CVE-2025-23116 State: PUBLISHED Published: 2025-03-01T01:52:36.160Z Last Updated: 2025-03-04T19:12:37.661Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Ubiquiti Inc Products: UniFi Protect Application Description: An Authentication Bypass vulnerability on UniFi Protect Application with Auto-Adopt Bridge Devices enabled could allow a malicious actor with access to UniFi Protect Cameras adjacent network to take control of UniFi Protect Cameras. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.ui.com/releases/Security-Advisory-Bulletin-046-046/9649ea8f-93db-4713-a875-c3fd7614943f
CVE ID: CVE-2025-23117 State: PUBLISHED Published: 2025-03-01T01:52:36.149Z Last Updated: 2025-03-05T15:26:14.804Z Vendors: Ubiquiti Inc Products: UniFi Protect Cameras Description: An Insufficient Firmware Update Validation vulnerability could allow an authenticated malicious actor with access to UniFi Protect Cameras adjacent network to make unsupported changes to the camera system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.ui.com/releases/Security-Advisory-Bulletin-046-046/9649ea8f-93db-4713-a875-c3fd7614943f
CVE ID: CVE-2025-23118 State: PUBLISHED Published: 2025-03-01T01:52:36.138Z Last Updated: 2025-03-04T19:14:53.108Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ubiquiti Inc Products: UniFi Protect Cameras Description: An Improper Certificate Validation vulnerability could allow an authenticated malicious actor with access to UniFi Protect Cameras adjacent network to make unsupported changes to the camera system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.ui.com/releases/Security-Advisory-Bulletin-046-046/9649ea8f-93db-4713-a875-c3fd7614943f
CVE ID: CVE-2025-23119 State: PUBLISHED Published: 2025-03-01T01:52:36.226Z Last Updated: 2025-03-04T19:07:42.185Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ubiquiti Inc Products: UniFi Protect Cameras Description: An Improper Neutralization of Escape Sequences vulnerability could allow an Authentication Bypass with a Remote Code Execution (RCE) by a malicious actor with access to UniFi Protect Cameras adjacent network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.ui.com/releases/Security-Advisory-Bulletin-046-046/9649ea8f-93db-4713-a875-c3fd7614943f
CVE ID: CVE-2025-23120 State: PUBLISHED Published: 2025-03-20T15:11:39.456Z Last Updated: 2025-03-20T16:13:01.660Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Veeam Products: Backup and Recovery Description: A vulnerability allowing remote code execution (RCE) for domain users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4724
CVE ID: CVE-2025-23121 State: PUBLISHED Published: 2025-06-18T23:30:48.375Z Last Updated: 2025-06-23T16:05:49.555Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Veeam Products: Backup and Recovery Description: A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4743
CVE ID: CVE-2025-23122 State: REJECTED Published: 2025-05-19T01:25:08.979Z Last Updated: 2025-05-20T21:59:31.237Z Description: No description available.
CVE ID: CVE-2025-23123 State: PUBLISHED Published: 2025-05-19T01:25:08.467Z Last Updated: 2025-05-19T13:59:32.551Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Ubiquiti Inc Products: UniFi Protect Cameras Description: A malicious actor with access to the management network could execute a remote code execution (RCE) by exploiting a heap buffer overflow vulnerability in the UniFi Protect Cameras (Version 4.75.43 and earlier) firmware. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.ui.com/releases/Security-Advisory-Bulletin-047-047/cef86c37-7421-44fd-b251-84e76475a5bc
CVE ID: CVE-2025-23124 State: REJECTED Published: 2025-01-11T14:31:01.507Z Last Updated: 2025-01-11T14:39:31.449Z Description: No description available.
CVE ID: CVE-2025-23125 State: REJECTED Published: 2025-01-11T14:31:02.416Z Last Updated: 2025-01-11T14:40:03.813Z Description: No description available.
CVE ID: CVE-2025-23126 State: REJECTED Published: 2025-01-11T14:31:03.250Z Last Updated: 2025-01-11T14:41:09.170Z Description: No description available.
CVE ID: CVE-2025-23127 State: REJECTED Published: 2025-01-11T14:31:03.969Z Last Updated: 2025-01-11T14:41:48.188Z Description: No description available.
CVE ID: CVE-2025-23128 State: REJECTED Published: 2025-01-11T14:31:04.696Z Last Updated: 2025-01-11T14:42:18.272Z Description: No description available.
CVE ID: CVE-2025-23129 State: PUBLISHED Published: 2025-04-16T14:13:11.663Z Last Updated: 2025-11-24T09:49:46.072Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path If a shared IRQ is used by the driver due to platform limitation, then the IRQ affinity hint is set right after the allocation of IRQ vectors in ath11k_pci_alloc_msi(). This does no harm unless one of the functions requesting the IRQ fails and attempt to free the IRQ. This results in the below warning: WARNING: CPU: 7 PID: 349 at kernel/irq/manage.c:1929 free_irq+0x278/0x29c Call trac
. This results in the below warning: WARNING: CPU: 7 PID: 349 at kernel/irq/manage.c:1929 free_irq+0x278/0x29c Call trace: free_irq+0x278/0x29c ath11k_pcic_free_irq+0x70/0x10c [ath11k] ath11k_pci_probe+0x800/0x820 [ath11k_pci] local_pci_probe+0x40/0xbc The warning is due to not clearing the affinity hint before freeing the IRQs. So to fix this issue, clear the IRQ affinity hint before calling ath11k_pcic_free_irq() in the error path. The affinity will be cleared once again further down the error path due to code organization, but that does no harm. Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-05266-QCAHSTSWPLZ_V2_TO_X86-1 References: - https://git.kernel.org/stable/c/80dc5a2ce5b75d648e0854961
PCI WLAN.HST.1.0.1-05266-QCAHSTSWPLZ_V2_TO_X86-1 References: - https://git.kernel.org/stable/c/80dc5a2ce5b75d648e08549617f5c555d07ae43c - https://git.kernel.org/stable/c/3fc42cfcc6e336f25dee79b34e57c4a63cd652a5 - https://git.kernel.org/stable/c/68410c5bd381a81bcc92b808e7dc4e6b9ed25d11
CVE ID: CVE-2025-23130 State: PUBLISHED Published: 2025-04-16T14:13:12.333Z Last Updated: 2025-11-02T13:30:29.954Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid panic once fallocation fails for pinfile syzbot reports a f2fs bug as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:2746! CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted 6.13.0-rc2-syzkaller-00018-g7cb1b4663150 #0 RIP: 0010:get_new_segment fs/f2fs/segment.c:2746 [inline] RIP: 0010:new_curseg+0x1f52/0x1f70 fs/f2fs/segment.c:2876 Call Trace: <TASK> __allocate_new_segment+0x1ce/0x940 fs/f2fs/segment.c:3210 f2fs_allocate_n
1f70 fs/f2fs/segment.c:2876 Call Trace: <TASK> __allocate_new_segment+0x1ce/0x940 fs/f2fs/segment.c:3210 f2fs_allocate_new_section fs/f2fs/segment.c:3224 [inline] f2fs_allocate_pinning_section+0xfa/0x4e0 fs/f2fs/segment.c:3238 f2fs_expand_inode_data+0x696/0xca0 fs/f2fs/file.c:1830 f2fs_fallocate+0x537/0xa10 fs/f2fs/file.c:1940 vfs_fallocate+0x569/0x6e0 fs/open.c:327 do_vfs_ioctl+0x258c/0x2e40 fs/ioctl.c:885 __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0x80/0x170 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Concurrent pinfile allocation may run out of free section, result
y/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Concurrent pinfile allocation may run out of free section, result in panic in get_new_segment(), let's expand pin_sem lock coverage to include f2fs_gc(), so that we can make sure to reclaim enough free space for following allocation. In addition, do below changes to enhance error path handling: - call f2fs_bug_on() only in non-pinfile allocation path in get_new_segment(). - call reset_curseg_fields() to reset all fields of curseg in new_curseg() References: - https://git.kernel.org/stable/c/2dda0930fb79b847b4bfceb737577d0f6bc24d7d - https://git.kernel.org/stable/c/9392862608d081a8346a3b841f862d732fce954b - https://git.kernel.org/stable/c
d0f6bc24d7d - https://git.kernel.org/stable/c/9392862608d081a8346a3b841f862d732fce954b - https://git.kernel.org/stable/c/48ea8b200414ac69ea96f4c231f5c7ef1fbeffef
CVE ID: CVE-2025-23131 State: PUBLISHED Published: 2025-04-16T14:13:13.056Z Last Updated: 2025-05-26T05:19:08.896Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dlm: prevent NPD when writing a positive value to event_done do_uevent returns the value written to event_done. In case it is a positive value, new_lockspace would undo all the work, and lockspace would not be set. __dlm_new_lockspace, however, would treat that positive value as a success due to commit 8511a2728ab8 ("dlm: fix use count with multiple joins"). Down the line, device_create_lockspace would pass that NULL lockspace to dlm_find_lockspace_local, leading to a
oins"). Down the line, device_create_lockspace would pass that NULL lockspace to dlm_find_lockspace_local, leading to a NULL pointer dereference. Treating such positive values as successes prevents the problem. Given this has been broken for so long, this is unlikely to break userspace expectations. References: - https://git.kernel.org/stable/c/b73c4ad4d387fe5bc988145bd9f1bc0de76afd5c - https://git.kernel.org/stable/c/8e2bad543eca5c25cd02cbc63d72557934d45f13
CVE ID: CVE-2025-23132 State: PUBLISHED Published: 2025-04-16T14:13:13.697Z Last Updated: 2025-05-26T05:19:10.216Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: quota: fix to avoid warning in dquot_writeback_dquots() F2FS-fs (dm-59): checkpoint=enable has some unwritten data. ------------[ cut here ]------------ WARNING: CPU: 6 PID: 8013 at fs/quota/dquot.c:691 dquot_writeback_dquots+0x2fc/0x308 pc : dquot_writeback_dquots+0x2fc/0x308 lr : f2fs_quota_sync+0xcc/0x1c4 Call trace: dquot_writeback_dquots+0x2fc/0x308 f2fs_quota_sync+0xcc/0x1c4 f2fs_write_checkpoint+0x3d4/0x9b0 f2fs_issue_checkpoint+0x1bc/0x2c0 f2fs_sync_fs+0x
2fc/0x308 f2fs_quota_sync+0xcc/0x1c4 f2fs_write_checkpoint+0x3d4/0x9b0 f2fs_issue_checkpoint+0x1bc/0x2c0 f2fs_sync_fs+0x54/0x150 f2fs_do_sync_file+0x2f8/0x814 __f2fs_ioctl+0x1960/0x3244 f2fs_ioctl+0x54/0xe0 __arm64_sys_ioctl+0xa8/0xe4 invoke_syscall+0x58/0x114 checkpoint and f2fs_remount may race as below, resulting triggering warning in dquot_writeback_dquots(). atomic write remount - do_remount - down_write(&sb->s_umount); - f2fs_remount - ioctl - f2fs_do_sync_file - f2fs_sync_fs - f2fs_write_checkpoint - block_operations - locked = down_read_trylock(&sbi->sb->s_umount) : fail to lock due to the write lock was held by remount - up_write(&sb->s_umount); - f2fs_quota_sync - dquot_writeback_d
fail to lock due to the write lock was held by remount - up_write(&sb->s_umount); - f2fs_quota_sync - dquot_writeback_dquots - WARN_ON_ONCE(!rwsem_is_locked(&sb->s_umount)) : trigger warning because s_umount lock was unlocked by remount If checkpoint comes from mount/umount/remount/freeze/quotactl, caller of checkpoint has already held s_umount lock, calling dquot_writeback_dquots() in the context should be safe. So let's record task to sbi->umount_lock_holder, so that checkpoint can know whether the lock has held in the context or not by checking current w/ it. In addition, in order to not misrepresent caller of checkpoint, we should not allow to trigger async checkpoint for those callers:
n, in order to not misrepresent caller of checkpoint, we should not allow to trigger async checkpoint for those callers: mount/umount/remount/ freeze/quotactl. References: - https://git.kernel.org/stable/c/d7acf0a6c87aa282c86a36dbaa2f92fda88c5884 - https://git.kernel.org/stable/c/eb85c2410d6f581e957cd03a644ff6ddbe592af9
CVE ID: CVE-2025-23133 State: PUBLISHED Published: 2025-04-16T14:13:14.485Z Last Updated: 2025-09-09T17:05:55.103Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: update channel list in reg notifier instead reg worker Currently when ath11k gets a new channel list, it will be processed according to the following steps: 1. update new channel list to cfg80211 and queue reg_work. 2. cfg80211 handles new channel list during reg_work. 3. update cfg80211's handled channel list to firmware by ath11k_reg_update_chan_list(). But ath11k will immediately execute step 3 after reg_work is just queued. Since step 2 is asynchronou
pdate_chan_list(). But ath11k will immediately execute step 3 after reg_work is just queued. Since step 2 is asynchronous, cfg80211 may not have completed handling the new channel list, which may leading to an out-of-bounds write error: BUG: KASAN: slab-out-of-bounds in ath11k_reg_update_chan_list Call Trace: ath11k_reg_update_chan_list+0xbfe/0xfe0 [ath11k] kfree+0x109/0x3a0 ath11k_regd_update+0x1cf/0x350 [ath11k] ath11k_regd_update_work+0x14/0x20 [ath11k] process_one_work+0xe35/0x14c0 Should ensure step 2 is completely done before executing step 3. Thus Wen raised patch[1]. When flag NL80211_REGDOM_SET_BY_DRIVER is set, cfg80211 will notify ath11k after step 2 is done. So enable the flag NL
. When flag NL80211_REGDOM_SET_BY_DRIVER is set, cfg80211 will notify ath11k after step 2 is done. So enable the flag NL80211_REGDOM_SET_BY_DRIVER then cfg80211 will notify ath11k after step 2 is done. At this time, there will be no KASAN bug during the execution of the step 3. [1] https://patchwork.kernel.org/project/linux-wireless/patch/20230201065313.27203-1-quic_wgong@quicinc.com/ Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3 References: - https://git.kernel.org/stable/c/26618c039b78a76c373d4e02c5fbd52e3a73aead - https://git.kernel.org/stable/c/f952fb83c9c6f908d27500764c4aee1df04b9d3f - https://git.kernel.org/stable/c/933ab187e679e6fbdeea1835ae39efcc59c
/stable/c/f952fb83c9c6f908d27500764c4aee1df04b9d3f - https://git.kernel.org/stable/c/933ab187e679e6fbdeea1835ae39efcc59c022d2
CVE ID: CVE-2025-23134 State: PUBLISHED Published: 2025-04-16T14:13:15.144Z Last Updated: 2025-10-01T16:15:15.661Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Don't take register_mutex with copy_from/to_user() The infamous mmap_lock taken in copy_from/to_user() can be often problematic when it's called inside another mutex, as they might lead to deadlocks. In the case of ALSA timer code, the bad pattern is with guard(mutex)(&register_mutex) that covers copy_from/to_user() -- which was mistakenly introduced at converting to guard(), and it had been carefully worked around in the past. This patch fixes those piece
y introduced at converting to guard(), and it had been carefully worked around in the past. This patch fixes those pieces simply by moving copy_from/to_user() out of the register mutex lock again. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/15291b561d8cc835a2eea76b394070cf8e072771 - https://git.kernel.org/stable/c/296f7a9e15aab276db11206cbc1e2ae1215d7862 - https://git.kernel.org/stable/c/b074f47e55df93832bbbca1b524c501e6fea1c0d - https://git.kernel.org/stable/c/3424c8f53bc63c87712a7fc22dc13d0cc85fb0d6
CVE ID: CVE-2025-23135 State: PUBLISHED Published: 2025-04-16T14:13:15.795Z Last Updated: 2025-05-26T05:19:13.878Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Teardown riscv specific bits after kvm_exit During a module removal, kvm_exit invokes arch specific disable call which disables AIA. However, we invoke aia_exit before kvm_exit resulting in the following warning. KVM kernel module can't be inserted afterwards due to inconsistent state of IRQ. [25469.031389] percpu IRQ 31 still enabled on CPU0! [25469.031732] WARNING: CPU: 3 PID: 943 at kernel/irq/manage.c:2476 __free_percpu_irq+0xa2/0x150 [25469.031804] Mo
CPU0! [25469.031732] WARNING: CPU: 3 PID: 943 at kernel/irq/manage.c:2476 __free_percpu_irq+0xa2/0x150 [25469.031804] Modules linked in: kvm(-) [25469.031848] CPU: 3 UID: 0 PID: 943 Comm: rmmod Not tainted 6.14.0-rc5-06947-g91c763118f47-dirty #2 [25469.031905] Hardware name: riscv-virtio,qemu (DT) [25469.031928] epc : __free_percpu_irq+0xa2/0x150 [25469.031976] ra : __free_percpu_irq+0xa2/0x150 [25469.032197] epc : ffffffff8007db1e ra : ffffffff8007db1e sp : ff2000000088bd50 [25469.032241] gp : ffffffff8131cef8 tp : ff60000080b96400 t0 : ff2000000088baf8 [25469.032285] t1 : fffffffffffffffc t2 : 5249207570637265 s0 : ff2000000088bd90 [25469.032329] s1 : ff60000098b21080 a0 : 037d527a15eb4f00
fffffffffffffffc t2 : 5249207570637265 s0 : ff2000000088bd90 [25469.032329] s1 : ff60000098b21080 a0 : 037d527a15eb4f00 a1 : 037d527a15eb4f00 [25469.032372] a2 : 0000000000000023 a3 : 0000000000000001 a4 : ffffffff8122dbf8 [25469.032410] a5 : 0000000000000fff a6 : 0000000000000000 a7 : ffffffff8122dc10 [25469.032448] s2 : ff60000080c22eb0 s3 : 0000000200000022 s4 : 000000000000001f [25469.032488] s5 : ff60000080c22e00 s6 : ffffffff80c351c0 s7 : 0000000000000000 [25469.032582] s8 : 0000000000000003 s9 : 000055556b7fb490 s10: 00007ffff0e12fa0 [25469.032621] s11: 00007ffff0e13e9a t3 : ffffffff81354ac7 t4 : ffffffff81354ac7 [25469.032664] t5 : ffffffff81354ac8 t6 : ffffffff81354ac7 [25469.03269
3e9a t3 : ffffffff81354ac7 t4 : ffffffff81354ac7 [25469.032664] t5 : ffffffff81354ac8 t6 : ffffffff81354ac7 [25469.032698] status: 0000000200000100 badaddr: ffffffff8007db1e cause: 0000000000000003 [25469.032738] [<ffffffff8007db1e>] __free_percpu_irq+0xa2/0x150 [25469.032797] [<ffffffff8007dbfc>] free_percpu_irq+0x30/0x5e [25469.032856] [<ffffffff013a57dc>] kvm_riscv_aia_exit+0x40/0x42 [kvm] [25469.033947] [<ffffffff013b4e82>] cleanup_module+0x10/0x32 [kvm] [25469.035300] [<ffffffff8009b150>] __riscv_sys_delete_module+0x18e/0x1fc [25469.035374] [<ffffffff8000c1ca>] syscall_handler+0x3a/0x46 [25469.035456] [<ffffffff809ec9a4>] do_trap_ecall_u+0x72/0x134 [25469.035536] [<ffffffff809f5e18>] ha
_handler+0x3a/0x46 [25469.035456] [<ffffffff809ec9a4>] do_trap_ecall_u+0x72/0x134 [25469.035536] [<ffffffff809f5e18>] handle_exception+0x148/0x156 Invoke aia_exit and other arch specific cleanup functions after kvm_exit so that disable gets a chance to be called first before exit. References: - https://git.kernel.org/stable/c/1edb2de48616b11ee05e9a65d74c70abcb6d9939 - https://git.kernel.org/stable/c/1521cc04f0b6e737ff30105aa57fa9dde8493231 - https://git.kernel.org/stable/c/2d117e67f318303f6ab699a5511d1fac3f170545
CVE ID: CVE-2025-23136 State: PUBLISHED Published: 2025-04-16T14:13:16.439Z Last Updated: 2025-11-03T19:42:20.085Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: thermal: int340x: Add NULL check for adev Not all devices have an ACPI companion fwnode, so adev might be NULL. This is similar to the commit cd2fd6eab480 ("platform/x86: int3472: Check for adev == NULL"). Add a check for adev not being set and return -ENODEV in that case to avoid a possible NULL pointer deref in int3402_thermal_probe(). Note, under the same directory, int3400_thermal_probe() has such a check. [ rjw: Subject edit, added Fixes: ] Additional Analyst Note
he same directory, int3400_thermal_probe() has such a check. [ rjw: Subject edit, added Fixes: ] Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d0d21c8e44216fa9afdb3809edf213f3c0a8c060 - https://git.kernel.org/stable/c/bc7b5f782d28942dbdfda70df30ce132694a06de - https://git.kernel.org/stable/c/3155d5261b518776d1b807d9d922669991bbee56 - https://git.kernel.org/stable/c/6a810c462f099353e908c70619638884cb82229c - https://git.kernel.org/stable/c/ac2eb7378319e3836cdf3a2c15a0bdf04c50e81d - https://git.kernel.org/stable/c/953d28a4f459fcbde2d08f51aeca19d6b0f179f3 - https://git.kernel.org/stable/c/0c49f12c77b77a706fd41370c119106
.org/stable/c/953d28a4f459fcbde2d08f51aeca19d6b0f179f3 - https://git.kernel.org/stable/c/0c49f12c77b77a706fd41370c11910635e491845 - https://git.kernel.org/stable/c/8e8f1ddf4186731649df8bc9646017369eb19186 - https://git.kernel.org/stable/c/2542a3f70e563a9e70e7ded314286535a3321bdb