Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
g/stable/c/fe4a4fc179b7898055555a11685915473588392e - https://git.kernel.org/stable/c/ff9d61db59bb27d16d3f872bff2620d50856b80c - https://git.kernel.org/stable/c/bd496a44f041da9ef3afe14d1d6193d460424e91
CVE ID: CVE-2025-23148 State: PUBLISHED Published: 2025-05-01T12:55:36.726Z Last Updated: 2025-11-03T19:42:44.119Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() soc_dev_attr->revision could be NULL, thus, a pointer check is added to prevent potential NULL pointer dereference. This is similar to the fix in commit 3027e7b15b02 ("ice: Fix some null pointer dereference issues in ice_ptp.c"). This issue is found by our static analysis tool. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/8ce469d23205249bb17c
l. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/8ce469d23205249bb17c1135ccadea879576adfc - https://git.kernel.org/stable/c/8ee067cf0cf82429e9b204283c7d0d8d6891d10e - https://git.kernel.org/stable/c/475b9b45dc32eba58ab794b5d47ac689fc018398 - https://git.kernel.org/stable/c/5f80fd2ff8bfd13e41554741740e0ca8e6445ded - https://git.kernel.org/stable/c/44a2572a0fdcf3e7565763690d579b998a8f0562 - https://git.kernel.org/stable/c/4f51d169fd0d4821bce775618db024062b09a3f7 - https://git.kernel.org/stable/c/4129760e462f45f14e61b10408ace61aa7c2ed30 - https://git.kernel.org/stable/c/c8222ef6cf29dd7cad21643228f96535cc02b327
CVE ID: CVE-2025-23149 State: PUBLISHED Published: 2025-05-01T12:55:37.428Z Last Updated: 2025-05-26T05:19:30.523Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tpm: do not start chip while suspended Checking TPM_CHIP_FLAG_SUSPENDED after the call to tpm_find_get_ops() can lead to a spurious tpm_chip_start() call: [35985.503771] i2c i2c-1: Transfer while suspended [35985.503796] WARNING: CPU: 0 PID: 74 at drivers/i2c/i2c-core.h:56 __i2c_transfer+0xbe/0x810 [35985.503802] Modules linked in: [35985.503808] CPU: 0 UID: 0 PID: 74 Comm: hwrng Tainted: G W 6.13.0-next-20250203-00005-gfa0cb5642941 #19 9c3d7f78192f2d38e32010ac9c90fdc7
0 UID: 0 PID: 74 Comm: hwrng Tainted: G W 6.13.0-next-20250203-00005-gfa0cb5642941 #19 9c3d7f78192f2d38e32010ac9c90fdc71109ef6f [35985.503814] Tainted: [W]=WARN [35985.503817] Hardware name: Google Morphius/Morphius, BIOS Google_Morphius.13434.858.0 10/26/2023 [35985.503819] RIP: 0010:__i2c_transfer+0xbe/0x810 [35985.503825] Code: 30 01 00 00 4c 89 f7 e8 40 fe d8 ff 48 8b 93 80 01 00 00 48 85 d2 75 03 49 8b 16 48 c7 c7 0a fb 7c a7 48 89 c6 e8 32 ad b0 fe <0f> 0b b8 94 ff ff ff e9 33 04 00 00 be 02 00 00 00 83 fd 02 0f 5 [35985.503828] RSP: 0018:ffffa106c0333d30 EFLAGS: 00010246 [35985.503833] RAX: 074ba64aa20f7000 RBX: ffff8aa4c1167120 RCX: 0000000000000000 [35985.503836] RDX: 0000000000000
10246 [35985.503833] RAX: 074ba64aa20f7000 RBX: ffff8aa4c1167120 RCX: 0000000000000000 [35985.503836] RDX: 0000000000000000 RSI: ffffffffa77ab0e4 RDI: 0000000000000001 [35985.503838] RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000 [35985.503841] R10: 0000000000000004 R11: 00000001000313d5 R12: ffff8aa4c10f1820 [35985.503843] R13: ffff8aa4c0e243c0 R14: ffff8aa4c1167250 R15: ffff8aa4c1167120 [35985.503846] FS: 0000000000000000(0000) GS:ffff8aa4eae00000(0000) knlGS:0000000000000000 [35985.503849] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [35985.503852] CR2: 00007fab0aaf1000 CR3: 0000000105328000 CR4: 00000000003506f0 [35985.503855] Call Trace: [35985.503859] <TASK> [359
CR2: 00007fab0aaf1000 CR3: 0000000105328000 CR4: 00000000003506f0 [35985.503855] Call Trace: [35985.503859] <TASK> [35985.503863] ? __warn+0xd4/0x260 [35985.503868] ? __i2c_transfer+0xbe/0x810 [35985.503874] ? report_bug+0xf3/0x210 [35985.503882] ? handle_bug+0x63/0xb0 [35985.503887] ? exc_invalid_op+0x16/0x50 [35985.503892] ? asm_exc_invalid_op+0x16/0x20 [35985.503904] ? __i2c_transfer+0xbe/0x810 [35985.503913] tpm_cr50_i2c_transfer_message+0x24/0xf0 [35985.503920] tpm_cr50_i2c_read+0x8e/0x120 [35985.503928] tpm_cr50_request_locality+0x75/0x170 [35985.503935] tpm_chip_start+0x116/0x160 [35985.503942] tpm_try_get_ops+0x57/0x90 [35985.503948] tpm_find_get_ops+0x26/0xd0 [35985.503955] tpm_get
rt+0x116/0x160 [35985.503942] tpm_try_get_ops+0x57/0x90 [35985.503948] tpm_find_get_ops+0x26/0xd0 [35985.503955] tpm_get_random+0x2d/0x80 Don't move forward with tpm_chip_start() inside tpm_try_get_ops(), unless TPM_CHIP_FLAG_SUSPENDED is not set. tpm_find_get_ops() will return NULL in such a failure case. References: - https://git.kernel.org/stable/c/1404dff1e11bf927b70ac25e1de97bed9742ede4 - https://git.kernel.org/stable/c/f3cb81cb96d587f9f235a11789d1ec0992643078 - https://git.kernel.org/stable/c/e74e2394eed90aff5c3a08c1f51f476d4de71d02 - https://git.kernel.org/stable/c/f1044e995b64d70ef90ef6f2b89955b127497702 - https://git.kernel.org/stable/c/17d253af4c2c8a2acf84bb55a0c2045f150b7dfd
CVE ID: CVE-2025-23150 State: PUBLISHED Published: 2025-05-01T12:55:38.190Z Last Updated: 2025-11-03T19:42:46.918Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ext4: fix off-by-one error in do_split Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split. BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 Write of size 251 at addr ffff888074572f14 by task syz-executor335/5847 CPU: 0 UID: 0 PID: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0 Hardware name: Google Google Compu
D: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154 make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351 ext4_add_en
c:2109 add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154 make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351 ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2455 ext4_add_nondir+0x8d/0x290 fs/ext4/namei.c:2796 ext4_symlink+0x920/0xb50 fs/ext4/namei.c:3431 vfs_symlink+0x137/0x2e0 fs/namei.c:4615 do_symlinkat+0x222/0x3a0 fs/namei.c:4641 __do_sys_symlink fs/namei.c:4662 [inline] __se_sys_symlink fs/namei.c:4660 [inline] __x64_sys_symlink+0x7a/0x90 fs/namei.c:4660 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> The following loop is located right above 'if' statement. for (i = count-1; i >= 0; i-
4_after_hwframe+0x77/0x7f </TASK> The following loop is located right above 'if' statement. for (i = count-1; i >= 0; i--) { /* is more than half of this entry in 2nd half of the block? */ if (size + map[i].size/2 > blocksize/2) break; size += map[i].size; move++; } 'i' in this case could go down to -1, in which case sum of active entries wouldn't exceed half the block size, but previous behaviour would also do split in half if sum would exceed at the very last block, which in case of having too many long name files in a single block could lead to out-of-bounds access and following use-after-free. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Additional Analyst Notes:
ollowing use-after-free. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/b96bd2c3db26ad0daec5b78c85c098b53900e2e1 - https://git.kernel.org/stable/c/515c34cff899eb5dae6aa7eee01c1295b07d81af - https://git.kernel.org/stable/c/2883e9e74f73f9265e5f8d1aaaa89034b308e433 - https://git.kernel.org/stable/c/35d0aa6db9d93307085871ceab8a729594a98162 - https://git.kernel.org/stable/c/2eeb1085bf7bd5c7ba796ca4119925fa5d336a3f - https://git.kernel.org/stable/c/16d9067f00e3a7d1df7c3aa9c20d214923d27e10 - https://git.kernel.org/stable/c/17df39f455f1289319d4d09e4826aa46852ffd17 - https://git.ker
7d1df7c3aa9c20d214923d27e10 - https://git.kernel.org/stable/c/17df39f455f1289319d4d09e4826aa46852ffd17 - https://git.kernel.org/stable/c/ab0cc5c25552ae0d20eae94b40a93be11b080fc5 - https://git.kernel.org/stable/c/94824ac9a8aaf2fb3c54b4bdde842db80ffa555d
CVE ID: CVE-2025-23151 State: PUBLISHED Published: 2025-05-01T12:55:38.833Z Last Updated: 2025-11-03T19:42:48.368Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Fix race between unprepare and queue_buf A client driver may use mhi_unprepare_from_transfer() to quiesce incoming data during the client driver's tear down. The client driver might also be processing data at the same time, resulting in a call to mhi_queue_buf() which will invoke mhi_gen_tre(). If mhi_gen_tre() runs after mhi_unprepare_from_transfer() has torn down the channel, a panic will occur due to an invalid dereference leading to a page fault. Th
_from_transfer() has torn down the channel, a panic will occur due to an invalid dereference leading to a page fault. This occurs because mhi_gen_tre() does not verify the channel state after locking it. Fix this by having mhi_gen_tre() confirm the channel state is valid, or return error to avoid accessing deinitialized data. [mani: added stable tag] Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/899d0353ea69681f474b6bc9de32c663b89672da - https://git.kernel.org/stable/c/3e7ecf181cbdde9753204ada3883ca1704d8702b - https://git.kernel.org/stable/c/5f084993c90d9d0b4a52a349ede5120f992a7ca1 - https://git.kernel.org/stable/c/a77955f7704b2a00385e232cb
kernel.org/stable/c/5f084993c90d9d0b4a52a349ede5120f992a7ca1 - https://git.kernel.org/stable/c/a77955f7704b2a00385e232cbcc1cb06b5c7a425 - https://git.kernel.org/stable/c/178e5657c8fd285125cc6743a81b513bce099760 - https://git.kernel.org/stable/c/ee1fce83ed56450087309b9b74ad9bcb2b010fa6 - https://git.kernel.org/stable/c/0686a818d77a431fc3ba2fab4b46bbb04e8c9380
CVE ID: CVE-2025-23152 State: PUBLISHED Published: 2025-05-01T12:55:39.454Z Last Updated: 2025-05-26T05:19:34.254Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: arm64/crc-t10dif: fix use of out-of-scope array in crc_t10dif_arch() Fix a silly bug where an array was used outside of its scope. References: - https://git.kernel.org/stable/c/bd9e1a03e579a01dfa66dbaa53d0219c33cbc463 - https://git.kernel.org/stable/c/d48b663f410f8b35b8ba9bd597bafaa00f53293b
CVE ID: CVE-2025-23153 State: PUBLISHED Published: 2025-05-01T12:55:40.116Z Last Updated: 2025-05-26T05:19:35.495Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: arm/crc-t10dif: fix use of out-of-scope array in crc_t10dif_arch() Fix a silly bug where an array was used outside of its scope. References: - https://git.kernel.org/stable/c/d8eba735be74e74776f9f6d9c691bdb75b08b29c - https://git.kernel.org/stable/c/3371f569223c4e8d36edbb0ba789ee5f5cb7316f
CVE ID: CVE-2025-23154 State: PUBLISHED Published: 2025-05-01T12:55:40.923Z Last Updated: 2025-05-26T05:19:36.773Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix io_req_post_cqe abuse by send bundle [ 114.987980][ T5313] WARNING: CPU: 6 PID: 5313 at io_uring/io_uring.c:872 io_req_post_cqe+0x12e/0x4f0 [ 114.991597][ T5313] RIP: 0010:io_req_post_cqe+0x12e/0x4f0 [ 115.001880][ T5313] Call Trace: [ 115.002222][ T5313] <TASK> [ 115.007813][ T5313] io_send+0x4fe/0x10f0 [ 115.009317][ T5313] io_issue_sqe+0x1a6/0x1740 [ 115.012094][ T5313] io_wq_submit_work+0x38b/0xed0 [ 115.013223][ T5313] io_worker_handle_work+0x62a
e_sqe+0x1a6/0x1740 [ 115.012094][ T5313] io_wq_submit_work+0x38b/0xed0 [ 115.013223][ T5313] io_worker_handle_work+0x62a/0x1600 [ 115.013876][ T5313] io_wq_worker+0x34f/0xdf0 As the comment states, io_req_post_cqe() should only be used by multishot requests, i.e. REQ_F_APOLL_MULTISHOT, which bundled sends are not. Add a flag signifying whether a request wants to post multiple CQEs. Eventually REQ_F_APOLL_MULTISHOT should imply the new flag, but that's left out for simplicity. References: - https://git.kernel.org/stable/c/b7c6d081c19a5e11bbd77bb97a62cff2b6b21cb5 - https://git.kernel.org/stable/c/7888c9fc0b2d3636f2e821ed1ad3c6920fa8e378 - https://git.kernel.org/stable/c/9aa804e6b9696998308095f
t.kernel.org/stable/c/7888c9fc0b2d3636f2e821ed1ad3c6920fa8e378 - https://git.kernel.org/stable/c/9aa804e6b9696998308095fb9d335046a71550f1 - https://git.kernel.org/stable/c/6889ae1b4df1579bcdffef023e2ea9a982565dff
CVE ID: CVE-2025-23155 State: PUBLISHED Published: 2025-05-01T12:55:41.607Z Last Updated: 2025-11-24T09:49:47.670Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Fix accessing freed irq affinity_hint In stmmac_request_irq_multi_msi(), a pointer to the stack variable cpu_mask is passed to irq_set_affinity_hint(). This value is stored in irq_desc->affinity_hint, but once stmmac_request_irq_multi_msi() returns, the pointer becomes dangling. The affinity_hint is exposed via procfs with S_IRUGO permissions, allowing any unprivileged process to read it. Accessing this stale pointer can lead to: - a kernel oops or panic i
ions, allowing any unprivileged process to read it. Accessing this stale pointer can lead to: - a kernel oops or panic if the referenced memory has been released and unmapped, or - leakage of kernel data into userspace if the memory is re-used for other purposes. All platforms that use stmmac with PCI MSI (Intel, Loongson, etc) are affected. References: - https://git.kernel.org/stable/c/960dab23f6d405740c537d095f90a4ee9ddd9285 - https://git.kernel.org/stable/c/442312c2a90d60c7a5197246583fa91d9e579985 - https://git.kernel.org/stable/c/e148266e104fce396ad624079a6812ac3a9982ef - https://git.kernel.org/stable/c/9e51a6a44e2c4de780a26e8fe110d708e806a8cd - https://git.kernel.org/stable/c/c60d101a22
- https://git.kernel.org/stable/c/9e51a6a44e2c4de780a26e8fe110d708e806a8cd - https://git.kernel.org/stable/c/c60d101a226f18e9a8f01bb4c6ca2b47dfcb15ef
CVE ID: CVE-2025-23156 State: PUBLISHED Published: 2025-05-01T12:55:42.545Z Last Updated: 2025-11-03T19:42:51.136Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi_parser: refactor hfi packet parsing logic words_count denotes the number of words in total payload, while data points to payload of various property within it. When words_count reaches last word, data can access memory beyond the total payload. This can lead to OOB access. With this patch, the utility api for handling individual properties now returns the size of data consumed. Accordingly remaining bytes are calculated before parsing the payload, the
erties now returns the size of data consumed. Accordingly remaining bytes are calculated before parsing the payload, thereby eliminates the OOB access possibilities. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/0beabe9b49190a02321b02792b29fc0f0e28b51f - https://git.kernel.org/stable/c/f195e94c7af921d99abd79f57026a218d191d2c7 - https://git.kernel.org/stable/c/0f9a4bab7d83738963365372e4745854938eab2d - https://git.kernel.org/stable/c/05b07e52a0d08239147ba3460045855f4fb398de - https://git.kernel.org/stable/c/bb3fd8b7906a12dc2b61389abb742bf6542d97fb - https://git.kernel.org/stable/c/a736c72d476d1c7ca7be5018f2614ee61168ad01 - https://git.kernel.
b61389abb742bf6542d97fb - https://git.kernel.org/stable/c/a736c72d476d1c7ca7be5018f2614ee61168ad01 - https://git.kernel.org/stable/c/6d278c5548d840c4d85d445347b2a5c31b2ab3a0 - https://git.kernel.org/stable/c/9edaaa8e3e15aab1ca413ab50556de1975bcb329
CVE ID: CVE-2025-23157 State: PUBLISHED Published: 2025-05-01T12:55:43.193Z Last Updated: 2025-11-03T19:42:53.952Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi_parser: add check to avoid out of bound access There is a possibility that init_codecs is invoked multiple times during manipulated payload from video firmware. In such case, if codecs_count can get incremented to value more than MAX_CODEC_NUM, there can be OOB access. Reset the count so that it always starts from beginning. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/e5133a0b25463674903fdc0528e0a29
al Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/e5133a0b25463674903fdc0528e0a29b7267130e - https://git.kernel.org/stable/c/2b8b9ea4e26a501eb220ea189e42b4527e65bdfa - https://git.kernel.org/stable/c/1ad6aa1464b8a5ce5c194458315021e8d216108e - https://git.kernel.org/stable/c/26bbedd06d85770581fda5d78e78539bb088fad1 - https://git.kernel.org/stable/c/d4d88ece4ba91df5b02f1d3f599650f9e9fc0f45 - https://git.kernel.org/stable/c/53e376178ceacca3ef1795038b22fc9ef45ff1d3 - https://git.kernel.org/stable/c/b2541e29d82da8a0df728aadec3e0a8db55d517b - https://git.kernel.org/stable/c/cb5be9039f91979f8a2fac29f529f746d7848f3e - https://git.kernel.org/stable/c/172bf5a9ef7
- https://git.kernel.org/stable/c/cb5be9039f91979f8a2fac29f529f746d7848f3e - https://git.kernel.org/stable/c/172bf5a9ef70a399bb227809db78442dc01d9e48
CVE ID: CVE-2025-23158 State: PUBLISHED Published: 2025-05-01T12:55:43.804Z Last Updated: 2025-11-03T19:42:56.722Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add check to handle incorrect queue size qsize represents size of shared queued between driver and video firmware. Firmware can modify this value to an invalid large value. In such situation, empty_space will be bigger than the space actually available. Since new_wr_idx is not checked, so the following code will result in an OOB write. ... qsize = qhdr->q_size if (wr_idx >= rd_idx) empty_space = qsize - (wr_idx - rd_idx) .... if (new_wr_idx < qsize)
te. ... qsize = qhdr->q_size if (wr_idx >= rd_idx) empty_space = qsize - (wr_idx - rd_idx) .... if (new_wr_idx < qsize) { memcpy(wr_ptr, packet, dwords << 2) --> OOB write Add check to ensure qsize is within the allocated size while reading and writing packets into the queue. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/1b86c1917e16bafbbb08ab90baaff533aa36c62d - https://git.kernel.org/stable/c/a45957bcde529169188929816775a575de77d84f - https://git.kernel.org/stable/c/32af5c1fdb9bc274f52ee0472d3b060b18e4aab4 - https://git.kernel.org/stable/c/cf5f7bb4e0d786f4d9d50ae6b5963935eab71d75 - https://git.kernel.org/stable/c/40084302f639b3fe954398c5ba
ernel.org/stable/c/cf5f7bb4e0d786f4d9d50ae6b5963935eab71d75 - https://git.kernel.org/stable/c/40084302f639b3fe954398c5ba5ee556b7242b54 - https://git.kernel.org/stable/c/679424f8b31446f90080befd0300ea915485b096 - https://git.kernel.org/stable/c/edb89d69b1438681daaf5ca90aed3242df94cc96 - https://git.kernel.org/stable/c/101a86619aab42bb61f2253bbf720121022eab86 - https://git.kernel.org/stable/c/69baf245b23e20efda0079238b27fc63ecf13de1
CVE ID: CVE-2025-23159 State: PUBLISHED Published: 2025-05-01T12:55:44.695Z Last Updated: 2025-11-03T19:42:59.661Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add a check to handle OOB in sfr region sfr->buf_size is in shared memory and can be modified by malicious user. OOB write is possible when the size is made higher than actual sfr data buffer. Cap the size to allocated size for such cases. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/4dd109038d513b92d4d33524ffc89ba32e02ba48 - https://git.kernel.org/stable/c/8879397c0da5e5ec1515262995e82cdfd61b282a -
/c/4dd109038d513b92d4d33524ffc89ba32e02ba48 - https://git.kernel.org/stable/c/8879397c0da5e5ec1515262995e82cdfd61b282a - https://git.kernel.org/stable/c/1b8fb257234e7d2d4b3f48af07c5aa5e11c71634 - https://git.kernel.org/stable/c/4e95233af57715d81830fe82b408c633edff59f4 - https://git.kernel.org/stable/c/5af611c70fb889d46d2f654b8996746e59556750 - https://git.kernel.org/stable/c/530f623f56a6680792499a8404083e17f8ec51f4 - https://git.kernel.org/stable/c/a062d8de0be5525ec8c52f070acf7607ec8cbfe4 - https://git.kernel.org/stable/c/d78a8388a27b265fcb2b8d064f088168ac9356b0 - https://git.kernel.org/stable/c/f4b211714bcc70effa60c34d9fa613d182e3ef1e
CVE ID: CVE-2025-23160 State: PUBLISHED Published: 2025-05-01T12:55:45.405Z Last Updated: 2025-11-03T17:32:15.840Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization On Mediatek devices with a system companion processor (SCP) the mtk_scp structure has to be removed explicitly to avoid a resource leak. Free the structure in case the allocation of the firmware structure fails during the firmware initialization. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/69dd5bbdd79c65445bb17c3c53510783bc1d7
lyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/69dd5bbdd79c65445bb17c3c53510783bc1d756c - https://git.kernel.org/stable/c/fd7bb97ede487b9f075707b7408a9073e0d474b1 - https://git.kernel.org/stable/c/9f009fa823c54ca0857c81f7525ea5a5d32de29c - https://git.kernel.org/stable/c/d6cb086aa52bd51378a4c9e2b25d2def97770205 - https://git.kernel.org/stable/c/ac94e1db4b2053059779472eb58a64d504964240 - https://git.kernel.org/stable/c/4936cd5817af35d23e4d283f48fa59a18ef481e4
CVE ID: CVE-2025-23161 State: PUBLISHED Published: 2025-05-01T12:55:46.021Z Last Updated: 2025-11-03T19:43:01.027Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type The access to the PCI config space via pci_ops::read and pci_ops::write is a low-level hardware access. The functions can be accessed with disabled interrupts even on PREEMPT_RT. The pci_lock is a raw_spinlock_t for this purpose. A spinlock_t becomes a sleeping lock on PREEMPT_RT, so it cannot be acquired with disabled interrupts. The vmd_dev::cfg_lock is accessed in the same context as the pci_lock. Make vmd_dev::
acquired with disabled interrupts. The vmd_dev::cfg_lock is accessed in the same context as the pci_lock. Make vmd_dev::cfg_lock a raw_spinlock_t type so it can be used with interrupts disabled. This was reported as: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 Call Trace: rt_spin_lock+0x4e/0x130 vmd_pci_read+0x8d/0x100 [vmd] pci_user_read_config_byte+0x6f/0xe0 pci_read_config+0xfe/0x290 sysfs_kf_bin_read+0x68/0x90 [bigeasy: reword commit message] Tested-off-by: Luis Claudio R. Goncalves <lgoncalv@redhat.com> [kwilczynski: commit log] [bhelgaas: add back report info from https://lore.kernel.org/lkml/20241218115951.83062-1-ryotkkr98@gmail.com/] Additio