Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-39993 State: PUBLISHED Published: 2025-10-15T07:58:18.621Z Last Updated: 2025-10-29T13:19:08.432Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: rc: fix races with imon_disconnect() Syzbot reports a KASAN issue as below: BUG: KASAN: use-after-free in __create_pipe include/linux/usb.h:1945 [inline] BUG: KASAN: use-after-free in send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627 Read of size 4 at addr ffff8880256fb000 by task syz-executor314/4465 CPU: 2 PID: 4465 Comm: syz-executor314 Not tainted 6.0.0-rc1-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Call Trace
t tainted 6.0.0-rc1-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x6e9 mm/kasan/report.c:433 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 __create_pipe include/linux/usb.h:1945 [inline] send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627 vfd_write+0x2d9/0x550 drivers/media/rc/imon.c:991 vfs_write+0x2d7/0xdd0 fs/read_write.c:576 ksys_write+0x127/0x250 fs/read_write.c:631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/co
7/0x250 fs/read_write.c:631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The iMON driver improperly releases the usb_device reference in imon_disconnect without coordinating with active users of the device. Specifically, the fields usbdev_intf0 and usbdev_intf1 are not protected by the users counter (ictx->users). During probe, imon_init_intf0 or imon_init_intf1 increments the usb_device reference count depending on the interface. However, during disconnect, usb_put_dev is called unconditionally, regardless of actual usage. As a result, if vfd_write or other operations are still in progress afte
ed unconditionally, regardless of actual usage. As a result, if vfd_write or other operations are still in progress after disconnect, this can lead to a use-after-free of the usb_device pointer. Thread 1 vfd_write Thread 2 imon_disconnect ... if usb_put_dev(ictx->usbdev_intf0) else usb_put_dev(ictx->usbdev_intf1) ... while send_packet if pipe = usb_sndintpipe( ictx->usbdev_intf0) UAF else pipe = usb_sndctrlpipe( ictx->usbdev_intf0, 0) UAF Guard access to usbdev_intf0 and usbdev_intf1 after disconnect by checking ictx->disconnected in all writer paths. Add early return with -ENODEV in send_packet(), vfd_write(), lcd_write() and display_open() if the device is no longer present. Set and read i
-ENODEV in send_packet(), vfd_write(), lcd_write() and display_open() if the device is no longer present. Set and read ictx->disconnected under ictx->lock to ensure memory synchronization. Acquire the lock in imon_disconnect() before setting the flag to synchronize with any ongoing operations. Ensure writers exit early and safely after disconnect before the USB core proceeds with cleanup. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. References: - https://git.kernel.org/stable/c/9348976003e39754af344949579e824a0a210fc4 - https://git.kernel.org/stable/c/b03fac6e2a38331faf8510b480becfa90cea1c9f - https://git.kernel.org/stable/c/71c52b073922d05e79e6de7fc7f5f38f927929a4 -
/c/b03fac6e2a38331faf8510b480becfa90cea1c9f - https://git.kernel.org/stable/c/71c52b073922d05e79e6de7fc7f5f38f927929a4 - https://git.kernel.org/stable/c/71096a6161a25e84acddb89a9d77f138502d26ab - https://git.kernel.org/stable/c/71da40648741d15b302700b68973fe8b382aef3c - https://git.kernel.org/stable/c/fd5d3e6b149ec8cce045d86a2b5e3664d6b32ba5 - https://git.kernel.org/stable/c/d9f6ce99624a41c3bcb29a8d7d79b800665229dd - https://git.kernel.org/stable/c/2e7fd93b9cc565b839bc55a6662475718963e156 - https://git.kernel.org/stable/c/fa0f61cc1d828178aa921475a9b786e7fbb65ccb
CVE ID: CVE-2025-39994 State: PUBLISHED Published: 2025-10-15T07:58:19.503Z Last Updated: 2025-10-29T13:19:10.377Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: tuner: xc5000: Fix use-after-free in xc5000_release The original code uses cancel_delayed_work() in xc5000_release(), which does not guarantee that the delayed work item timer_sleep has fully completed if it was already running. This leads to use-after-free scenarios where xc5000_release() may free the xc5000_priv while timer_sleep is still active and attempts to dereference the xc5000_priv. A typical race condition is illustrated below: CPU 0 (release thread) |
ive and attempts to dereference the xc5000_priv. A typical race condition is illustrated below: CPU 0 (release thread) | CPU 1 (delayed work callback) xc5000_release() | xc5000_do_timer_sleep() cancel_delayed_work() | hybrid_tuner_release_state(priv) | kfree(priv) | | priv = container_of() // UAF Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the timer_sleep is properly canceled before the xc5000_priv memory is deallocated. A deadlock concern was considered: xc5000_release() is called in a process context and is not holding any locks that the timer_sleep work item might also need. Therefore, the use of the _sync() variant is safe here. This bug was initially ide
imer_sleep work item might also need. Therefore, the use of the _sync() variant is safe here. This bug was initially identified through static analysis. [hverkuil: fix typo in Subject: tunner -> tuner] References: - https://git.kernel.org/stable/c/bc4ffd962ce16a154c44c68853b9d93f5b6fc4b8 - https://git.kernel.org/stable/c/e2f5eaafc0306a76fb1cb760aae804b065b8a341 - https://git.kernel.org/stable/c/3f876cd47ed8bca1e28d68435845949f51f90703 - https://git.kernel.org/stable/c/df0303b4839520b84d9367c2fad65b13650a4d42 - https://git.kernel.org/stable/c/71ed8b81a4906cb785966910f39cf7f5ad60a69e - https://git.kernel.org/stable/c/effb1c19583bca7022fa641a70766de45c6d41ac - https://git.kernel.org/stable/c/9a
ad60a69e - https://git.kernel.org/stable/c/effb1c19583bca7022fa641a70766de45c6d41ac - https://git.kernel.org/stable/c/9a00de20ed8ba90888479749b87bc1532cded4ce - https://git.kernel.org/stable/c/4266f012806fc18e46da4a04d130df59a4946f93 - https://git.kernel.org/stable/c/40b7a19f321e65789612ebaca966472055dab48c
CVE ID: CVE-2025-39995 State: PUBLISHED Published: 2025-10-15T07:58:20.365Z Last Updated: 2025-10-29T13:19:12.359Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe The state->timer is a cyclic timer that schedules work_i2c_poll and delayed_work_enable_hotplug, while rearming itself. Using timer_delete() fails to guarantee the timer isn't still running when destroyed, similarly cancel_delayed_work() cannot ensure delayed_work_enable_hotplug has terminated if already executing. During probe failure after timer initialization, these may continue running as
plug has terminated if already executing. During probe failure after timer initialization, these may continue running as orphans and reference the already-freed tc358743_state object through tc358743_irq_poll_timer. The following is the trace captured by KASAN. BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0 Write of size 8 at addr ffff88800ded83c8 by task swapper/1/0 ... Call Trace: <IRQ> dump_stack_lvl+0x55/0x70 print_report+0xcf/0x610 ? __pfx_sched_balance_find_src_group+0x10/0x10 ? __run_timer_base.part.0+0x7d7/0x8c0 kasan_report+0xb8/0xf0 ? __run_timer_base.part.0+0x7d7/0x8c0 __run_timer_base.part.0+0x7d7/0x8c0 ? rcu_sched_clock_irq+0xb06/0x27d0 ? __pfx___run_time
_timer_base.part.0+0x7d7/0x8c0 __run_timer_base.part.0+0x7d7/0x8c0 ? rcu_sched_clock_irq+0xb06/0x27d0 ? __pfx___run_timer_base.part.0+0x10/0x10 ? try_to_wake_up+0xb15/0x1960 ? tmigr_update_events+0x280/0x740 ? _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 tmigr_handle_remote_up+0x603/0x7e0 ? __pfx_tmigr_handle_remote_up+0x10/0x10 ? sched_balance_trigger+0x98/0x9f0 ? sched_tick+0x221/0x5a0 ? _raw_spin_lock_irq+0x80/0xe0 ? __pfx__raw_spin_lock_irq+0x10/0x10 ? tick_nohz_handler+0x339/0x440 ? __pfx_tmigr_handle_remote_up+0x10/0x10 __walk_groups.isra.0+0x42/0x150 tmigr_handle_remote+0x1f4/0x2e0 ? __pfx_tmigr_handle_remote+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x1
x150 tmigr_handle_remote+0x1f4/0x2e0 ? __pfx_tmigr_handle_remote+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 ? clockevents_program_event+0x1d4/0x2a0 ? hrtimer_interrupt+0x322/0x780 handle_softirqs+0x16a/0x550 irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 </IRQ> ... Allocated by task 141: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 __kmalloc_node_track_caller_noprof+0x198/0x430 devm_kmalloc+0x7b/0x1e0 tc358743_probe+0xb7/0x610 i2c_device_probe+0x51d/0x880 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __device_attach_driver+0x174/0x220 bus_for_each_drv+0x100/0x190 __device_attach+0x
/0x310 driver_probe_device+0x44/0x120 __device_attach_driver+0x174/0x220 bus_for_each_drv+0x100/0x190 __device_attach+0x206/0x370 bus_probe_device+0x123/0x170 device_add+0xd25/0x1470 i2c_new_client_device+0x7a0/0xcd0 do_one_initcall+0x89/0x300 do_init_module+0x29d/0x7f0 load_module+0x4f48/0x69e0 init_module_from_file+0xe4/0x150 idempotent_init_module+0x320/0x670 __x64_sys_finit_module+0xbd/0x120 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 141: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x3f/0x50 kfree+0x137/0x370 release_nodes+0xa4/0x100 devres_release_group+0x1b2/0x380 i2c_device_probe+0x694/0x88
b_free+0x3f/0x50 kfree+0x137/0x370 release_nodes+0xa4/0x100 devres_release_group+0x1b2/0x380 i2c_device_probe+0x694/0x880 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __device_attach_driver+0x174/0x220 bus_for_each_drv+0x100/0x190 __device_attach+0x206/0x370 bus_probe_device+0x123/0x170 device_add+0xd25/0x1470 i2c_new_client_device+0x7a0/0xcd0 do_one_initcall+0x89/0x300 do_init_module+0x29d/0x7f0 load_module+0x4f48/0x69e0 init_module_from_file+0xe4/0x150 idempotent_init_module+0x320/0x670 __x64_sys_finit_module+0xbd/0x120 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... Replace timer_delete() with timer_delete_sync() and cance
all_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... Replace timer_delete() with timer_delete_sync() and cancel_delayed_work() with cancel_delayed_work_sync() to ensure proper termination of timer and work items before resource cleanup. This bug was initially identified through static analysis. For reproduction and testing, I created a functional emulation of the tc358743 device via a kernel module and introduced faults through the debugfs interface. References: - https://git.kernel.org/stable/c/9205fb6e617a1c596d9a9ad2a160ee696e09d520 - https://git.kernel.org/stable/c/70913586c717dd25cfbade7a418e92cc9c99398a - https://git.kernel.org/stable/c/663faf1179db9663a3793c75e9bc869358bad91
ble/c/70913586c717dd25cfbade7a418e92cc9c99398a - https://git.kernel.org/stable/c/663faf1179db9663a3793c75e9bc869358bad910 - https://git.kernel.org/stable/c/3d17701c156579969470e58b3a906511f8bc018d - https://git.kernel.org/stable/c/228d06c4cbfc750f1216a3fd91b4693b0766d2f6 - https://git.kernel.org/stable/c/f92181c0e13cad9671d07b15be695a97fc2534a3 - https://git.kernel.org/stable/c/f3f3f00bcabbd2ce0a77a2ac7a6797b8646bfd8b - https://git.kernel.org/stable/c/2610617effb4454d2f1c434c011ccb5cc7140711 - https://git.kernel.org/stable/c/79d10f4f21a92e459b2276a77be62c59c1502c9d
CVE ID: CVE-2025-39996 State: PUBLISHED Published: 2025-10-15T07:58:21.049Z Last Updated: 2025-10-29T13:19:14.572Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove The original code uses cancel_delayed_work() in flexcop_pci_remove(), which does not guarantee that the delayed work item irq_check_work has fully completed if it was already running. This leads to use-after-free scenarios where flexcop_pci_remove() may free the flexcop_device while irq_check_work is still active and attempts to dereference the device. A typical race condition is illustrate
vice while irq_check_work is still active and attempts to dereference the device. A typical race condition is illustrated below: CPU 0 (remove) | CPU 1 (delayed work callback) flexcop_pci_remove() | flexcop_pci_irq_check_work() cancel_delayed_work() | flexcop_device_kfree(fc_pci->fc_dev) | | fc = fc_pci->fc_dev; // UAF This is confirmed by a KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0 Write of size 8 at addr ffff8880093aa8c8 by task bash/135 ... Call Trace: <IRQ> dump_stack_lvl+0x55/0x70 print_report+0xcf/0x610 ? __run_timer_base.part.0+0x7d7/0x8c0 kasan_report+0xb8/0xf0 ? __run_timer_
_stack_lvl+0x55/0x70 print_report+0xcf/0x610 ? __run_timer_base.part.0+0x7d7/0x8c0 kasan_report+0xb8/0xf0 ? __run_timer_base.part.0+0x7d7/0x8c0 __run_timer_base.part.0+0x7d7/0x8c0 ? __pfx___run_timer_base.part.0+0x10/0x10 ? __pfx_read_tsc+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 ? clockevents_program_event+0x1d4/0x2a0 run_timer_softirq+0xd1/0x190 handle_softirqs+0x16a/0x550 irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 </IRQ> ... Allocated by task 1: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 __kmalloc_noprof+0x1be/0x460 flexcop_device_kmalloc+0x54/0xe0 flexcop_pci_probe+0x1f/0x9d0 local_pci_probe+0xdc/0x190 pci_device_
_noprof+0x1be/0x460 flexcop_device_kmalloc+0x54/0xe0 flexcop_pci_probe+0x1f/0x9d0 local_pci_probe+0xdc/0x190 pci_device_probe+0x2fe/0x470 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __driver_attach+0xd2/0x310 bus_for_each_dev+0xed/0x170 bus_add_driver+0x208/0x500 driver_register+0x132/0x460 do_one_initcall+0x89/0x300 kernel_init_freeable+0x40d/0x720 kernel_init+0x1a/0x150 ret_from_fork+0x10c/0x1a0 ret_from_fork_asm+0x1a/0x30 Freed by task 135: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x3f/0x50 kfree+0x137/0x370 flexcop_device_kfree+0x32/0x50 pci_device_remove+0xa6/0x1d0 device_release_
_kasan_slab_free+0x3f/0x50 kfree+0x137/0x370 flexcop_device_kfree+0x32/0x50 pci_device_remove+0xa6/0x1d0 device_release_driver_internal+0xf8/0x210 pci_stop_bus_device+0x105/0x150 pci_stop_and_remove_bus_device_locked+0x15/0x30 remove_store+0xcc/0xe0 kernfs_fop_write_iter+0x2c3/0x440 vfs_write+0x871/0xd70 ksys_write+0xee/0x1c0 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled and any executing delayed work has finished before the device memory is deallocated. This bug was initially identified through static analysis. To reproduce and test it, I simulated
memory is deallocated. This bug was initially identified through static analysis. To reproduce and test it, I simulated the B2C2 FlexCop PCI device in QEMU and introduced artificial delays within the flexcop_pci_irq_check_work() function to increase the likelihood of triggering the bug. References: - https://git.kernel.org/stable/c/607010d07b8a509b01ed15ea12744acac6536a98 - https://git.kernel.org/stable/c/bde8173def374230226e8554efb51b271f4066ec - https://git.kernel.org/stable/c/120e221b4bbe9d0f6c09b5c4dc53ca4ad91d956b - https://git.kernel.org/stable/c/d502df8a716d993fa0f9d8c00684f1190750e28e - https://git.kernel.org/stable/c/bb10a9ddc8d6c5dbf098f21eb1055a652652e524 - https://git.kernel.org/
8c00684f1190750e28e - https://git.kernel.org/stable/c/bb10a9ddc8d6c5dbf098f21eb1055a652652e524 - https://git.kernel.org/stable/c/514a519baa9e2be7ddc2714bd730bc5a883e1244 - https://git.kernel.org/stable/c/3ffabc79388e68877d9c02f724a0b7a38d519daf - https://git.kernel.org/stable/c/6a92f5796880f5aa345f0fed53ef511e3fd6f706 - https://git.kernel.org/stable/c/01e03fb7db419d39e18d6090d4873c1bff103914
CVE ID: CVE-2025-39997 State: PUBLISHED Published: 2025-10-15T07:58:21.702Z Last Updated: 2025-10-15T07:58:21.702Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free The previous commit 0718a78f6a9f ("ALSA: usb-audio: Kill timer properly at removal") patched a UAF issue caused by the error timer. However, because the error timer kill added in this patch occurs after the endpoint delete, a race condition to UAF still occurs, albeit rarely. Additionally, since kill-cleanup for urb is also missing, freed memory can be accessed in interrupt context related to urb, which can
since kill-cleanup for urb is also missing, freed memory can be accessed in interrupt context related to urb, which can cause UAF. Therefore, to prevent this, error timer and urb must be killed before freeing the heap memory. References: - https://git.kernel.org/stable/c/dc4874366cf6cf4a31d8fa4b7f0e2a5b2d7647ba - https://git.kernel.org/stable/c/647d6b8d22be12842fde6ed0c56859ebc615f21e - https://git.kernel.org/stable/c/af600e7f5526d16146b3ae99f6ad57bfea79ca33 - https://git.kernel.org/stable/c/353d8c715cc951a980728133c9dd64ca5a0a186c - https://git.kernel.org/stable/c/9f2c0ac1423d5f267e7f1d1940780fc764b0fee3
CVE ID: CVE-2025-39998 State: PUBLISHED Published: 2025-10-15T07:58:22.354Z Last Updated: 2025-10-29T13:19:16.766Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: target: target_core_configfs: Add length check to avoid buffer overflow A buffer overflow arises from the usage of snprintf to write into the buffer "buf" in target_lu_gp_members_show function located in /drivers/target/target_core_configfs.c. This buffer is allocated with size LU_GROUP_NAME_BUF (256 bytes). snprintf(...) formats multiple strings into buf with the HBA name (hba->hba_group.cg_item), a slash character, a devicename (dev-> dev_group.cg_item) and a n
s into buf with the HBA name (hba->hba_group.cg_item), a slash character, a devicename (dev-> dev_group.cg_item) and a newline character, the total formatted string length may exceed the buffer size of 256 bytes. Since snprintf() returns the total number of bytes that would have been written (the length of %s/%sn ), this value may exceed the buffer length (256 bytes) passed to memcpy(), this will ultimately cause function memcpy reporting a buffer overflow error. An additional check of the return value of snprintf() can avoid this buffer overflow. References: - https://git.kernel.org/stable/c/e6eeee5dc0d9221ff96d1b229b1d0222c8871b84 - https://git.kernel.org/stable/c/764a91e2fc9639e07aac93bc7
kernel.org/stable/c/e6eeee5dc0d9221ff96d1b229b1d0222c8871b84 - https://git.kernel.org/stable/c/764a91e2fc9639e07aac93bc70e387e6b1e33084 - https://git.kernel.org/stable/c/ddc79fba132b807ff775467acceaf48b456e008b - https://git.kernel.org/stable/c/e73fe0eefac3e15bf88fb5b4afae4c76215ee4d4 - https://git.kernel.org/stable/c/f03aa5e39da7d045615b3951d2a6ca1d7132f881 - https://git.kernel.org/stable/c/53c6351597e6a17ec6619f6f060d54128cb9a187 - https://git.kernel.org/stable/c/4b292286949588bd2818e66ff102db278de8dd26 - https://git.kernel.org/stable/c/a150275831b765b0f1de8b8ff52ec5c6933ac15d - https://git.kernel.org/stable/c/27e06650a5eafe832a90fd2604f0c5e920857fae
CVE ID: CVE-2025-39999 State: PUBLISHED Published: 2025-10-15T07:58:23.038Z Last Updated: 2025-10-15T07:58:23.038Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix blk_mq_tags double free while nr_requests grown In the case user trigger tags grow by queue sysfs attribute nr_requests, hctx->sched_tags will be freed directly and replaced with a new allocated tags, see blk_mq_tag_update_depth(). The problem is that hctx->sched_tags is from elevator->et->tags, while et->tags is still the freed tags, hence later elevator exit will try to free the tags again, causing kernel panic. Fix this problem by replacing et->tags with
e later elevator exit will try to free the tags again, causing kernel panic. Fix this problem by replacing et->tags with new allocated tags as well. Noted there are still some long term problems that will require some refactor to be fixed thoroughly[1]. [1] https://lore.kernel.org/all/20250815080216.410665-1-yukuai1@huaweicloud.com/ References: - https://git.kernel.org/stable/c/8faee580d63bc2a54a59dcdb7f9ce4de29384fec - https://git.kernel.org/stable/c/392b1d64911f4de8887fe8b68299fa8bd6e5b923 - https://git.kernel.org/stable/c/ba28afbd9eff2a6370f23ef4e6a036ab0cfda409
CVE ID: CVE-2025-3000 State: PUBLISHED Published: 2025-03-31T15:00:10.521Z Last Updated: 2025-03-31T18:55:52.815Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: PyTorch Problem Types: CWE-119 Description: A vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function torch.jit.script. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.302049 - https://vuldb.com/?ctiid.302049 - https://vuldb.com/?submit.524197 - htt
t: References: - https://vuldb.com/?id.302049 - https://vuldb.com/?ctiid.302049 - https://vuldb.com/?submit.524197 - https://github.com/pytorch/pytorch/issues/149623 - https://github.com/pytorch/pytorch/issues/149623#issue-2935703015
CVE ID: CVE-2025-3001 State: PUBLISHED Published: 2025-03-31T15:31:05.008Z Last Updated: 2025-03-31T18:47:18.769Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: PyTorch Problem Types: CWE-119 Description: A vulnerability classified as critical was found in PyTorch 2.6.0. This vulnerability affects the function torch.lstm_cell. The manipulation leads to memory corruption. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.302050 - https://vuldb.com/?ctiid.302050 - https://vuldb.com/?submit.524212 - https:/
eferences: - https://vuldb.com/?id.302050 - https://vuldb.com/?ctiid.302050 - https://vuldb.com/?submit.524212 - https://github.com/pytorch/pytorch/issues/149626 - https://github.com/pytorch/pytorch/issues/149626#issue-2935860995
CVE ID: CVE-2025-3002 State: PUBLISHED Published: 2025-03-31T16:00:13.225Z Last Updated: 2025-03-31T18:05:58.087Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Digital China Products: DCME-520 Problem Types: CWE-78, CWE-77 Description: A vulnerability, which was classified as critical, has been found in Digital China DCME-520 up to 20250320. This issue affects some unknown processing of the file /usr/local/WWW/function/audit/newstatistics/mon_merge_stat_hist.php. The manipulation of the argument type_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
ated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.302051 - https://vuldb.com/?ctiid.302051 - https://vuldb.com/?submit.524225 - https://github.com/Fizz-L/CVE1/blob/main/DCME-520%20Remote%20command%20execution.md