Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
0000001 RDI: ffff8e9ecb652000 RBP: 0000000000000685 R08: ffff8e9ec6570000 R09: 0000000000000000 R10: ffff8e9ecd2ca000 R11: ffff8e9f22a217c0 R12: 0000000038010119 R13: 0000000080843801 R14: ffff8e9ec6570000 R15: ffff8e9ecb652000 FS: 0000000000000000(0000) GS:ffff8e9f22a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000400 CR3: 000000000d2ea000 CR4: 00000000000006f0 Call Trace: <TASK> ? __die_body.cold+0x19/0x27 ? page_fault_oops+0x15a/0x2f0 ? search_module_extables+0x19/0x60 ? search_bpf_extables+0x5f/0x80 ? exc_page_fault+0x7e/0x180 ? asm_exc_page_fault+0x26/0x30 ? mt792x_rx_get_wcid+0x48/0x140 [mt792x_lib] mt7921_queue_rx_skb+0x1c6/0xaa0 [
0x7e/0x180 ? asm_exc_page_fault+0x26/0x30 ? mt792x_rx_get_wcid+0x48/0x140 [mt792x_lib] mt7921_queue_rx_skb+0x1c6/0xaa0 [mt7921_common] mt76u_alloc_queues+0x784/0x810 [mt76_usb] ? __pfx___mt76_worker_fn+0x10/0x10 [mt76] __mt76_worker_fn+0x4f/0x80 [mt76] kthread+0xd2/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> ---[ end trace 0000000000000000 ]--- Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0cfea60966e4b1239d20bebf02258295e189e82a - https://git.kernel.org/stable/c/effec50381991bc067acf4b3351a57831c74d27f - https://git.kernel.org/stable/c/5a57f8eb2a17d469d65cd1186cea26b7
org/stable/c/effec50381991bc067acf4b3351a57831c74d27f - https://git.kernel.org/stable/c/5a57f8eb2a17d469d65cd1186cea26b798221d4a - https://git.kernel.org/stable/c/adc3fd2a2277b7cc0b61692463771bf9bd298036
CVE ID: CVE-2025-22033 State: PUBLISHED Published: 2025-04-16T14:11:52.696Z Last Updated: 2025-11-03T19:41:16.171Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: arm64: Don't call NULL in do_compat_alignment_fixup() do_alignment_t32_to_handler() only fixes up alignment faults for specific instructions; it returns NULL otherwise (e.g. LDREX). When that's the case, signal to the caller that it needs to proceed with the regular alignment fault handling (i.e. SIGBUS). Without this patch, the kernel panics: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000086000006 E
to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000086000006 EC = 0x21: IABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault user pgtable: 4k pages, 48-bit VAs, pgdp=00000800164aa000 [0000000000000000] pgd=0800081fdbd22003, p4d=0800081fdbd22003, pud=08000815d51c6003, pmd=0000000000000000 Internal error: Oops: 0000000086000006 [#1] SMP Modules linked in: cfg80211 rfkill xt_nat xt_tcpudp xt_conntrack nft_chain_nat xt_MASQUERADE nf_nat nf_conntrack_netlink nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xfrm_user xfrm_algo xt_addrtype nft_compat br_netfilter veth nvme_fa> libcrc32c crc32c_ge
nf_defrag_ipv6 nf_defrag_ipv4 xfrm_user xfrm_algo xt_addrtype nft_compat br_netfilter veth nvme_fa> libcrc32c crc32c_generic raid0 multipath linear dm_mod dax raid1 md_mod xhci_pci nvme xhci_hcd nvme_core t10_pi usbcore igb crc64_rocksoft crc64 crc_t10dif crct10dif_generic crct10dif_ce crct10dif_common usb_common i2c_algo_bit i2c> CPU: 2 PID: 3932954 Comm: WPEWebProcess Not tainted 6.1.0-31-arm64 #1 Debian 6.1.128-1 Hardware name: GIGABYTE MP32-AR1-00/MP32-AR1-00, BIOS F18v (SCP: 1.08.20211002) 12/01/2021 pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : 0x0 lr : do_compat_alignment_fixup+0xd8/0x3dc sp : ffff80000f973dd0 x29: ffff80000f973dd0 x28: ffff081b42526180 x27: 00
0x0 lr : do_compat_alignment_fixup+0xd8/0x3dc sp : ffff80000f973dd0 x29: ffff80000f973dd0 x28: ffff081b42526180 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 x23: 0000000000000004 x22: 0000000000000000 x21: 0000000000000001 x20: 00000000e8551f00 x19: ffff80000f973eb0 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : ffffaebc949bc488 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000400000 x4 : 0000fffffffffffe x3 : 0000000000000000 x2 : ffff80000f973eb0 x1 : 00000000e8
0000000000000000 x5 : 0000000000400000 x4 : 0000fffffffffffe x3 : 0000000000000000 x2 : ffff80000f973eb0 x1 : 00000000e8551f00 x0 : 0000000000000001 Call trace: 0x0 do_alignment_fault+0x40/0x50 do_mem_abort+0x4c/0xa0 el0_da+0x48/0xf0 el0t_32_sync_handler+0x110/0x140 el0t_32_sync+0x190/0x194 Code: bad PC value ---[ end trace 0000000000000000 ]--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/cf187601053ecaf671ae645edb898901f81d03e9 - https://git.kernel.org/stable/c/617a4b0084a547917669fef2b54253cc9c064990 - https://git.kernel.org/stable/c/2df8ee605eb6806cd41c2095306db05206633a08 - https://git.kernel.org/stable/c/fa2a9
64990 - https://git.kernel.org/stable/c/2df8ee605eb6806cd41c2095306db05206633a08 - https://git.kernel.org/stable/c/fa2a9f625f185c6acb4ee5be8d71359a567afac9 - https://git.kernel.org/stable/c/ecf798573bbe0805803f7764e12a34b4bcc65074 - https://git.kernel.org/stable/c/c28f31deeacda307acfee2f18c0ad904e5123aac
CVE ID: CVE-2025-22034 State: PUBLISHED Published: 2025-04-16T14:11:53.301Z Last Updated: 2025-05-26T05:17:02.343Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs Patch series "mm: fixes for device-exclusive entries (hmm)", v2. Discussing the PageTail() call in make_device_exclusive_range() with Willy, I recently discovered [1] that device-exclusive handling does not properly work with THP, making the hmm-tests selftests fail if THPs are enabled on the system. Looking into more details, I found that hugetlb is not properly fenced, and I realized that something that was bugging me f
king into more details, I found that hugetlb is not properly fenced, and I realized that something that was bugging me for longer -- how device-exclusive entries interact with mapcounts -- completely breaks migration/swapout/split/hwpoison handling of these folios while they have device-exclusive PTEs. The program below can be used to allocate 1 GiB worth of pages and making them device-exclusive on a kernel with CONFIG_TEST_HMM. Once they are device-exclusive, these folios cannot get swapped out (proc$pid/smaps_rollup will always indicate 1 GiB RSS no matter how much one forces memory reclaim), and when having a memory block onlined to ZONE_MOVABLE, trying to offline it will loop forever an
orces memory reclaim), and when having a memory block onlined to ZONE_MOVABLE, trying to offline it will loop forever and complain about failed migration of a page that should be movable. # echo offline > /sys/devices/system/memory/memory136/state # echo online_movable > /sys/devices/system/memory/memory136/state # ./hmm-swap & ... wait until everything is device-exclusive # echo offline > /sys/devices/system/memory/memory136/state [ 285.193431][T14882] page: refcount:2 mapcount:0 mapping:0000000000000000 index:0x7f20671f7 pfn:0x442b6a [ 285.196618][T14882] memcg:ffff888179298000 [ 285.198085][T14882] anon flags: 0x5fff0000002091c(referenced|uptodate| dirty|active|owner_2|swapbacked|node=1|z
298000 [ 285.198085][T14882] anon flags: 0x5fff0000002091c(referenced|uptodate| dirty|active|owner_2|swapbacked|node=1|zone=3|lastcpupid=0x7ff) [ 285.201734][T14882] raw: ... [ 285.204464][T14882] raw: ... [ 285.207196][T14882] page dumped because: migration failure [ 285.209072][T14882] page_owner tracks the page as allocated [ 285.210915][T14882] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), id 14926, tgid 14926 (hmm-swap), ts 254506295376, free_ts 227402023774 [ 285.216765][T14882] post_alloc_hook+0x197/0x1b0 [ 285.218874][T14882] get_page_from_freelist+0x76e/0x3280 [ 285.220864][T14882] __alloc_frozen_pages_noprof+0x3
97/0x1b0 [ 285.218874][T14882] get_page_from_freelist+0x76e/0x3280 [ 285.220864][T14882] __alloc_frozen_pages_noprof+0x38e/0x2740 [ 285.223302][T14882] alloc_pages_mpol+0x1fc/0x540 [ 285.225130][T14882] folio_alloc_mpol_noprof+0x36/0x340 [ 285.227222][T14882] vma_alloc_folio_noprof+0xee/0x1a0 [ 285.229074][T14882] __handle_mm_fault+0x2b38/0x56a0 [ 285.230822][T14882] handle_mm_fault+0x368/0x9f0 ... This series fixes all issues I found so far. There is no easy way to fix without a bigger rework/cleanup. I have a bunch of cleanups on top (some previous sent, some the result of the discussion in v1) that I will send out separately once this landed and I get to it. I wish we could just use some
f the discussion in v1) that I will send out separately once this landed and I get to it. I wish we could just use some special present PROT_NONE PTEs instead of these (non-present, non-none) fake-swap entries; but that just results in the same problem we keep having (lack of spare PTE bits), and staring at other similar fake-swap entries, that ship has sailed. With this series, make_device_exclusive() doesn't actually belong into mm/rmap.c anymore, but I'll leave moving that for another day. I only tested this series with the hmm-tests selftests due to lack of HW, so I'd appreciate some testing, especially if the interaction between two GPUs wanting a device-exclusive entry works as expecte
ppreciate some testing, especially if the interaction between two GPUs wanting a device-exclusive entry works as expected. <program> #include <stdio.h> #include <fcntl.h> #include <stdint.h> #include <unistd.h> #include <stdlib.h> #include <string.h> #include <sys/mman.h> #include <sys/ioctl.h> #include <linux/types.h> #include <linux/ioctl.h> #define HMM_DMIRROR_EXCLUSIVE _IOWR('H', 0x05, struct hmm_dmirror_cmd) struct hmm_dmirror_cmd { __u64 addr; __u64 ptr; __u64 npages; __u64 cpages; __u64 faults; }; const size_t size = 1 * 1024 * 1024 * 1024ul; const size_t chunk_size = 2 * 1024 * 1024ul; int m ---truncated--- References: - https://git.kernel.org/stable/c/2e877ff3492267def06dd50cb165dc9
= 2 * 1024 * 1024ul; int m ---truncated--- References: - https://git.kernel.org/stable/c/2e877ff3492267def06dd50cb165dc9ab8838e7d - https://git.kernel.org/stable/c/48d28417c66cce2f3b0ba773fcb6695a56eff220 - https://git.kernel.org/stable/c/fd900832e8440046627b60697687ab5d04398008 - https://git.kernel.org/stable/c/8977752c8056a6a094a279004a49722da15bace3
CVE ID: CVE-2025-22035 State: PUBLISHED Published: 2025-04-16T14:11:53.958Z Last Updated: 2025-11-03T19:41:18.919Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in print_graph_function_flags during tracer switching Kairui reported a UAF issue in print_graph_function_flags() during ftrace stress testing [1]. This issue can be reproduced if puting a 'mdelay(10)' after 'mutex_unlock(&trace_types_lock)' in s_start(), and executing the following script: $ echo function_graph > current_tracer $ cat trace > /dev/null & $ sleep 5 # Ensure the 'cat' reaches the 'mdelay(10)' point $ echo timerlat > current_tr
racer $ cat trace > /dev/null & $ sleep 5 # Ensure the 'cat' reaches the 'mdelay(10)' point $ echo timerlat > current_tracer The root cause lies in the two calls to print_graph_function_flags within print_trace_line during each s_show(): * One through 'iter->trace->print_line()'; * Another through 'event->funcs->trace()', which is hidden in print_trace_fmt() before print_trace_line returns. Tracer switching only updates the former, while the latter continues to use the print_line function of the old tracer, which in the script above is print_graph_function_flags. Moreover, when switching from the 'function_graph' tracer to the 'timerlat' tracer, s_start only calls graph_trace_close of the 'f
when switching from the 'function_graph' tracer to the 'timerlat' tracer, s_start only calls graph_trace_close of the 'function_graph' tracer to free 'iter->private', but does not set it to NULL. This provides an opportunity for 'event->funcs->trace()' to use an invalid 'iter->private'. To fix this issue, set 'iter->private' to NULL immediately after freeing it in graph_trace_close(), ensuring that an invalid pointer is not passed to other tracers. Additionally, clean up the unnecessary 'iter->private = NULL' during each 'cat trace' when using wakeup and irqsoff tracers. [1] https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/ Additional Analyst Notes: - CISA ADP Vulnrichment
] https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/ Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/42561fe62c3628ea3bc9623f64f047605e98857f - https://git.kernel.org/stable/c/de7b309139f862a44379ecd96e93c9133c69f813 - https://git.kernel.org/stable/c/81a85b12132c8ffe98f5ddbdc185481790aeaa1b - https://git.kernel.org/stable/c/a2cce54c1748216535dda02e185d07a084be837e - https://git.kernel.org/stable/c/099ef3385800828b74933a96c117574637c3fb3a - https://git.kernel.org/stable/c/c85efe6e13743cac6ba4ccf144cb91f44c86231a - https://git.kernel.org/stable/c/f14752d66056d0c7bffe5092130409417d3baa70 - https://git.ke
3cac6ba4ccf144cb91f44c86231a - https://git.kernel.org/stable/c/f14752d66056d0c7bffe5092130409417d3baa70 - https://git.kernel.org/stable/c/70be951bc01e4a0e10d443f3510bb17426f257fb - https://git.kernel.org/stable/c/7f81f27b1093e4895e87b74143c59c055c3b1906
CVE ID: CVE-2025-22036 State: PUBLISHED Published: 2025-04-16T14:11:54.916Z Last Updated: 2025-10-01T17:04:32.804Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: exfat: fix random stack corruption after get_block When get_block is called with a buffer_head allocated on the stack, such as do_mpage_readpage, stack corruption due to buffer_head UAF may occur in the following race condition situation. <CPU 0> <CPU 1> mpage_read_folio <<bh on stack>> do_mpage_readpage exfat_get_block bh_read __bh_read get_bh(bh) submit_bh wait_on_buffer ... end_buffer_read_sync __end_buffer_read_notouch unlock_buffer <<keep going>> ... ... ... ... <
bmit_bh wait_on_buffer ... end_buffer_read_sync __end_buffer_read_notouch unlock_buffer <<keep going>> ... ... ... ... <<bh is not valid out of mpage_read_folio>> . . another_function <<variable A on stack>> put_bh(bh) atomic_dec(bh->b_count) * stack corruption here * This patch returns -EAGAIN if a folio does not have buffers when bh_read needs to be called. By doing this, the caller can fallback to functions like block_read_full_folio(), create a buffer_head in the folio, and then call get_block again. Let's do not call bh_read() with on-stack buffer_head. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/49b0a6ab8e528a0c1c50e37cef9b9c7c121365
yst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/49b0a6ab8e528a0c1c50e37cef9b9c7c121365f2 - https://git.kernel.org/stable/c/f7447286363dc1e410bf30b87d75168f3519f9cc - https://git.kernel.org/stable/c/f807a6bf2005740fa26b4f59c4a003dc966b9afd - https://git.kernel.org/stable/c/1bb7ff4204b6d4927e982cd256286c09ed4fd8ca
CVE ID: CVE-2025-22037 State: PUBLISHED Published: 2025-04-16T14:11:55.670Z Last Updated: 2025-09-19T14:53:58.094Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in alloc_preauth_hash() The Client send malformed smb2 negotiate request. ksmbd return error response. Subsequently, the client can send smb2 session setup even thought conn->preauth_info is not allocated. This patch add KSMBD_SESS_NEED_SETUP status of connection to ignore session setup request if smb2 negotiate phase is not complete. References: - https://git.kernel.org/stable/c/cce57cd8c5dead24127cf2308fdd60fcad2d6ba6 - https://git
se is not complete. References: - https://git.kernel.org/stable/c/cce57cd8c5dead24127cf2308fdd60fcad2d6ba6 - https://git.kernel.org/stable/c/ca8bed31edf728a662ef9d6f39f50e7a7dc2b5ad - https://git.kernel.org/stable/c/8f216b33a5e1b3489c073b1ea1b3d7cb63c8dc4d - https://git.kernel.org/stable/c/b8eb243e670ecf30e91524dd12f7260dac07d335 - https://git.kernel.org/stable/c/c8b5b7c5da7d0c31c9b7190b4a7bba5281fc4780 - https://www.zerodayinitiative.com/advisories/ZDI-25-310/
CVE ID: CVE-2025-22038 State: PUBLISHED Published: 2025-04-16T14:11:56.316Z Last Updated: 2025-11-03T19:41:20.321Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate zero num_subauth before sub_auth is accessed Access psid->sub_auth[psid->num_subauth - 1] without checking if num_subauth is non-zero leads to an out-of-bounds read. This patch adds a validation step to ensure num_subauth != 0 before sub_auth is accessed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/3ac65de111c686c95316ade660f8ba7aea3cd3cc - https://git.kernel.org/stable/c/0e36
ences: - https://git.kernel.org/stable/c/3ac65de111c686c95316ade660f8ba7aea3cd3cc - https://git.kernel.org/stable/c/0e36a3e080d6d8bd7a34e089345d043da4ac8283 - https://git.kernel.org/stable/c/56de7778a48560278c334077ace7b9ac4bfb2fd1 - https://git.kernel.org/stable/c/68c6c3142bfcdb049839d40a9a59ebe8ea865002 - https://git.kernel.org/stable/c/c8bfe1954a0b89e7b29b3a3e7f4c5e0ebd295e20 - https://git.kernel.org/stable/c/bf21e29d78cd2c2371023953d9c82dfef82ebb36
CVE ID: CVE-2025-22039 State: PUBLISHED Published: 2025-04-16T14:11:56.975Z Last Updated: 2025-05-26T05:17:08.699Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix overflow in dacloffset bounds check The dacloffset field was originally typed as int and used in an unchecked addition, which could overflow and bypass the existing bounds check in both smb_check_perm_dacl() and smb_inherit_dacl(). This could result in out-of-bounds memory access and a kernel crash when dereferencing the DACL pointer. This patch converts dacloffset to unsigned int and uses check_add_overflow() to validate access to the DACL. References: - ht
patch converts dacloffset to unsigned int and uses check_add_overflow() to validate access to the DACL. References: - https://git.kernel.org/stable/c/6a9cd9ff0fa2bcc30b2bfb8bdb161eb20e44b9dc - https://git.kernel.org/stable/c/6b8d379048b168a0dff5ab1acb975b933f368514 - https://git.kernel.org/stable/c/443b373a4df5a2cb9f7b8c4658b2afedeb16397f - https://git.kernel.org/stable/c/beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42
CVE ID: CVE-2025-22040 State: PUBLISHED Published: 2025-04-16T14:11:57.601Z Last Updated: 2025-11-03T19:41:21.699Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix session use-after-free in multichannel connection There is a race condition between session setup and ksmbd_sessions_deregister. The session can be freed before the connection is added to channel list of session. This patch check reference count of session before freeing it. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/596407adb9af1ee75fe7c7529607783d31b66e7f - https://git.kernel.or
ontainer: References: - https://git.kernel.org/stable/c/596407adb9af1ee75fe7c7529607783d31b66e7f - https://git.kernel.org/stable/c/3980770cb1470054e6400fd97668665975726737 - https://git.kernel.org/stable/c/9069939d762138e232a6f79e3e1462682ed6a17d - https://git.kernel.org/stable/c/94c281721d4ed2d972232414b91d98a6f5bdb16b - https://git.kernel.org/stable/c/7dfbd4c43eed91dd2548a95236908025707a8dfd - https://git.kernel.org/stable/c/fa4cdb8cbca7d6cb6aa13e4d8d83d1103f6345db
CVE ID: CVE-2025-22041 State: PUBLISHED Published: 2025-04-16T14:11:58.250Z Last Updated: 2025-11-03T19:41:23.122Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_sessions_deregister() In multichannel mode, UAF issue can occur in session_deregister when the second channel sets up a session through the connection of the first channel. session that is freed through the global session table can be accessed again through ->sessions of connection. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f0eb3f575138b816da74697bd5066825
DP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f0eb3f575138b816da74697bd506682574742fcd - https://git.kernel.org/stable/c/a8a8ae303a8395cbac270b5b404d85df6ec788f8 - https://git.kernel.org/stable/c/ca042cc0e4f9e0d2c8f86dd67e4b22f30a516a9b - https://git.kernel.org/stable/c/8ed0e9d2f410f63525afb8351181eea36c80bcf1 - https://git.kernel.org/stable/c/33cc29e221df7a3085ae413e8c26c4e81a151153 - https://git.kernel.org/stable/c/15a9605f8d69dc85005b1a00c31a050b8625e1aa
CVE ID: CVE-2025-22042 State: PUBLISHED Published: 2025-04-16T14:12:03.896Z Last Updated: 2025-11-03T19:41:24.487Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: add bounds check for create lease context Add missing bounds check for create lease context. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/629dd37acc336ad778979361c351e782053ea284 - https://git.kernel.org/stable/c/60b7207893a8a06c78441934931a08fdad63f18e - https://git.kernel.org/stable/c/800c482c9ef5910f05e3a713943c67cc6c1d4939 - https://git.kernel.org/stable/c/a41cd52f00907a040ca22c73d4805bb79b0d0972 - https://
2c9ef5910f05e3a713943c67cc6c1d4939 - https://git.kernel.org/stable/c/a41cd52f00907a040ca22c73d4805bb79b0d0972 - https://git.kernel.org/stable/c/9a1b6ea955e6c7b29939a6d98701202f9d9644ec - https://git.kernel.org/stable/c/bab703ed8472aa9d109c5f8c1863921533363dae
CVE ID: CVE-2025-22043 State: PUBLISHED Published: 2025-04-16T14:12:04.558Z Last Updated: 2025-05-26T05:17:13.769Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: add bounds check for durable handle context Add missing bounds check for durable handle context. References: - https://git.kernel.org/stable/c/8d4848c45943c9cf5e86142fd7347efa97f497db - https://git.kernel.org/stable/c/29b946714d6aa77de54c71243bba39469ac43ef2 - https://git.kernel.org/stable/c/1107b9ed92194603593c51829a3887812ae9e806 - https://git.kernel.org/stable/c/f0db3d9d416e332a0d6f045a1509539d3a4cd898 - https://git.kernel.org/stable/c/542027e123fc0bfd61dd59e
t.kernel.org/stable/c/f0db3d9d416e332a0d6f045a1509539d3a4cd898 - https://git.kernel.org/stable/c/542027e123fc0bfd61dd59e21ae0ee4ef2101b29
CVE ID: CVE-2025-22044 State: PUBLISHED Published: 2025-04-16T14:12:05.199Z Last Updated: 2025-11-03T19:41:27.322Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: acpi: nfit: fix narrowing conversion in acpi_nfit_ctl Syzkaller has reported a warning in to_nfit_bus_uuid(): "only secondary bus families can be translated". This warning is emited if the argument is equal to NVDIMM_BUS_FAMILY_NFIT == 0. Function acpi_nfit_ctl() first verifies that a user-provided value call_pkg->nd_family of type u64 is not equal to 0. Then the value is converted to int, and only after that is compared to NVDIMM_BUS_FAMILY_MAX. This can lead to passi