Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ponse headers and bodies fully compromised including authorization tokens. The attack also allows obtaining full access to any signed-in Altair GraphQL Cloud account and replacing payment checkout pages with a malicious website. Version 8.0.5 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/altair-graphql/altair/security/advisories/GHSA-8v9h-hxp5-9jcx - https://github.com/altair-graphql/altair/blob/004f645d1cae032787fccf7166dc193b775e9660/packages/altair-electron/src/app/index.ts#L162-L170
CVE ID: CVE-2024-54148 State: PUBLISHED Published: 2024-12-23T15:22:48.244Z Last Updated: 2024-12-24T01:52:58.173Z Vendors: gogs Products: gogs Problem Types: CWE-61, CWE-22 Description: Gogs is an open source self-hosted Git service. A malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server. The vulnerability is fixed in 0.13.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gogs/gogs/security/advisories/GHSA-r7j8-5h9c-f6fx - https://github.com/gogs/gogs/issues/7582 - https://github.com/gogs/gogs/pull/7857 - https://github.com/gogs/gogs/commit/c94baec9ca923f38c19f0c7c5af722b9ec04022a
CVE ID: CVE-2024-54149 State: PUBLISHED Published: 2024-12-09T20:54:41.797Z Last Updated: 2024-12-10T17:13:11.005Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: wintercms Products: winter Problem Types: CWE-184 Description: Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed on Twig files and modify resources such as theme customisation values or modify, or remove, templates in the theme even if not provided direct access via the permissions. As all obje
values or modify, or remove, templates in the theme even if not provided direct access via the permissions. As all objects passed through to Twig are references to the live objects, it is also possible to also manipulate model data if models are passed directly to Twig, including changing attributes or even removing records entirely. In most cases, this is unwanted behavior and potentially dangerous. To actively exploit this security issue, an attacker would need access to the Backend with a user account with any of the following permissions: `cms.manage_layouts`; `cms.manage_pages`; or `cms.manage_partials`. The Winter CMS maintainers strongly recommend that these permissions only be reser
age_pages`; or `cms.manage_partials`. The Winter CMS maintainers strongly recommend that these permissions only be reserved to trusted administrators and developers in general. The maintainers of Winter CMS have significantly increased the scope of the sandbox, effectively making all models and datasources read-only in Twig, in versions 1.2.7, 1.1.11, and 1.0.476. Thse who cannot upgrade may apply commit fb88e6fabde3b3278ce1844e581c87dcf7daee22 to their Winter CMS installation manually to resolve the issue. In the rare event that a Winter user was relying on being able to write to models/datasources within their Twig templates, they should instead use or create components to make changes to
rite to models/datasources within their Twig templates, they should instead use or create components to make changes to their models. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wintercms/winter/security/advisories/GHSA-xhw3-4j3m-hq53 - https://github.com/wintercms/winter/commit/fb88e6fabde3b3278ce1844e581c87dcf7daee22
CVE ID: CVE-2024-54150 State: PUBLISHED Published: 2024-12-19T18:22:33.901Z Last Updated: 2024-12-20T17:34:34.675Z Vendors: xmidt-org Products: cjwt Problem Types: CWE-347 Description: cjwt is a C JSON Web Token (JWT) Implementation. Algorithm confusion occurs when a system improperly verifies the type of signature used, allowing attackers to exploit the lack of distinction between signing methods. If the system doesn't differentiate between an HMAC signed token and an RS/EC/PS signed token during verification, it becomes vulnerable to this kind of attack. For instance, an attacker could craft a token with the alg field set to "HS256" while the server expects an asymmetric algorithm like "RS
attacker could craft a token with the alg field set to "HS256" while the server expects an asymmetric algorithm like "RS256". The server might mistakenly use the wrong verification method, such as using a public key as the HMAC secret, leading to unauthorised access. For RSA, the key can be computed from a few signatures. For Elliptic Curve (EC), two potential keys can be recovered from one signature. This can be used to bypass the signature mechanism if an application relies on asymmetrically signed tokens. This issue has been addressed in version 2.3.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichm
dvised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xmidt-org/cjwt/security/advisories/GHSA-9h24-7qp5-gp82 - https://github.com/xmidt-org/cjwt/commit/096ab3e37f73c914b716e7259589179f363265fd
CVE ID: CVE-2024-54151 State: PUBLISHED Published: 2024-12-09T20:57:28.365Z Last Updated: 2024-12-10T17:09:06.417Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: directus Products: directus Problem Types: CWE-200 Description: Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` to "public", an unauthenticated user is able to do any of the supported operations (CRUD, subscriptions) with full admin privileges. This impacts any Directus instance that has either `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` set
n privileges. This impacts any Directus instance that has either `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` set to `public` allowing unauthenticated users to subscribe for changes on any collection or do REST CRUD operations on user defined collections ignoring permissions. Version 11.3.0 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/directus/directus/security/advisories/GHSA-849r-qrwj-8rv4 - https://github.com/directus/directus/commit/ce0397d16cf767b5293cd57f626c5349b5732a21
CVE ID: CVE-2024-54152 State: PUBLISHED Published: 2024-12-10T15:37:51.480Z Last Updated: 2024-12-10T16:34:57.533Z Vendors: peerigon Products: angular-expressions Problem Types: CWE-94 Description: Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to version 1.4.3, an attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system. With a more complex (undisclosed) payload, one can get full access to Arbitrary code execution on the system. The problem has been patched in version 1.4.3 of Angular Expressions. Two possible workarounds are available. One may either disable access to `__proto__` glob
1.4.3 of Angular Expressions. Two possible workarounds are available. One may either disable access to `__proto__` globally or make sure that one uses the function with just one argument. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/peerigon/angular-expressions/security/advisories/GHSA-5462-4vcx-jh7j - https://github.com/peerigon/angular-expressions/commit/97f7ad94006156eeb97fc942332578b6cfbf8eef
CVE ID: CVE-2024-54153 State: PUBLISHED Published: 2024-12-04T11:16:24.494Z Last Updated: 2024-12-04T14:09:11.280Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: YouTrack Problem Types: CWE-862 Description: In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameter Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-54154 State: PUBLISHED Published: 2024-12-04T11:16:25.244Z Last Updated: 2024-12-04T14:25:35.177Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: JetBrains Products: YouTrack Problem Types: CWE-23 Description: In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-54155 State: PUBLISHED Published: 2024-12-04T11:16:25.997Z Last Updated: 2024-12-04T14:09:11.056Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: YouTrack Problem Types: CWE-862 Description: In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-54156 State: PUBLISHED Published: 2024-12-04T11:16:26.573Z Last Updated: 2024-12-04T14:09:10.904Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: YouTrack Problem Types: CWE-1321 Description: In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-54157 State: PUBLISHED Published: 2024-12-04T11:16:27.323Z Last Updated: 2024-12-04T14:09:10.737Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: JetBrains Products: YouTrack Problem Types: CWE-1333 Description: In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detector Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-54158 State: PUBLISHED Published: 2024-12-04T11:16:27.904Z Last Updated: 2024-12-04T14:09:10.593Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: JetBrains Products: YouTrack Problem Types: CWE-173 Description: In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-54159 State: PUBLISHED Published: 2024-11-29T00:00:00 Last Updated: 2024-12-03T14:58:31.046Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AC:H/AV:L/A:L/C:N/I:L/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: stalld through 1.19.7 allows local users to cause a denial of service (file overwrite) via a /tmp/rtthrottle symlink attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.openwall.com/lists/oss-security/2024/11/29/3 - https://security.opensuse.org/2024/11/29/stalld-fixed-tmp-file.html - https://cwe.mitre.org/data/definitions/61.html
CVE ID: CVE-2024-54160 State: PUBLISHED Published: 2025-02-12T00:00:00.000Z Last Updated: 2025-02-12T16:10:21.588Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: LF Projects Products: OpenSearch Problem Types: CWE-79 Description: dashboards-reporting (aka Dashboards Reports) before 2.19.0.0, as shipped in OpenSearch before 2.19, allows XSS because Markdown is not sanitized when previewing a header or footer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://opensearch.org/releases.html - https://github.com/opensearch-project/dashboards-reporting/pull/476 - https://github.com/Jflye/CVE-2024-54160--Opensearch-HTML-Injection - https://gi
-project/dashboards-reporting/pull/476 - https://github.com/Jflye/CVE-2024-54160--Opensearch-HTML-Injection - https://github.com/opensearch-project/opensearch-build/blob/main/release-notes/opensearch-release-notes-2.19.0.md - https://github.com/opensearch-project/dashboards-reporting/compare/2.18.0.0...2.19.0.0
CVE ID: CVE-2024-54169 State: PUBLISHED Published: 2025-02-27T14:54:33.884Z Last Updated: 2025-02-27T15:12:27.087Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: EntireX Problem Types: CWE-22 Description: IBM EntireX 11.1 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7184194
CVE ID: CVE-2024-54170 State: PUBLISHED Published: 2025-02-27T14:55:47.166Z Last Updated: 2025-02-27T15:12:51.277Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: EntireX Problem Types: CWE-1333 Description: IBM EntireX 11.1 could allow a local user to cause a denial of service due to use of a regular expression with an inefficient complexity that consumes excessive CPU cycles. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7184194
CVE ID: CVE-2024-54171 State: PUBLISHED Published: 2025-02-06T20:29:04.129Z Last Updated: 2025-02-22T22:11:33.331Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) Vendors: IBM Products: EntireX Problem Types: CWE-611 Description: IBM EntireX 11.1 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. An authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182693
CVE ID: CVE-2024-54172 State: PUBLISHED Published: 2025-06-18T16:13:10.754Z Last Updated: 2025-08-24T11:46:45.622Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: IBM Products: Sterling B2B Integrator Problem Types: CWE-352 Description: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7237059
CVE ID: CVE-2024-54173 State: PUBLISHED Published: 2025-02-28T02:22:14.364Z Last Updated: 2025-02-28T16:37:38.519Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: MQ Problem Types: CWE-1323 Description: IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD reveals potentially sensitive information in trace files that could be read by a local user when webconsole trace is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7183370
CVE ID: CVE-2024-54175 State: PUBLISHED Published: 2025-02-28T16:19:56.817Z Last Updated: 2025-08-27T21:43:05.342Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: MQ Problem Types: CWE-754 Description: IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow a local user to cause a denial of service due to an improper check for unusual or exceptional conditions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7184453
CVE ID: CVE-2024-54176 State: PUBLISHED Published: 2025-02-08T16:15:40.041Z Last Updated: 2025-02-22T22:12:32.094Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: UrbanCode Deploy, DevOps Deploy Problem Types: CWE-306 Description: IBM DevOps Deploy 8.0 through 8.0.1.4, 8.1 through 8.1.0.0 and IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14 and 7.3 through 7.3.2 could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization for a function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/no
on for a function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182840
CVE ID: CVE-2024-54179 State: PUBLISHED Published: 2025-03-03T13:56:50.099Z Last Updated: 2025-09-01T01:10:19.247Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Business Automation Workflow, Business Automation Workflow Enterprise Service Bus Problem Types: CWE-79 Description: IBM Business Automation Workflow and IBM Business Automation Workflow Enterprise Service Bus 24.0.0, 24.0.1 and earlier unsupported versions are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within
Script code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7184647
CVE ID: CVE-2024-54181 State: PUBLISHED Published: 2024-12-30T13:41:57.834Z Last Updated: 2024-12-30T14:12:56.069Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: WebSphere Automation Problem Types: CWE-78 Description: IBM WebSphere Automation 1.7.5 could allow a remote privileged user, who has authorized access to the swagger UI, to execute arbitrary code. Using specially crafted input, the user could exploit this vulnerability to execute arbitrary code on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7179994
CVE ID: CVE-2024-54183 State: PUBLISHED Published: 2025-06-18T15:08:50.493Z Last Updated: 2025-08-24T11:47:06.405Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Sterling B2B Integrator Problem Types: CWE-79 Description: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7237060
CVE ID: CVE-2024-54188 State: PUBLISHED Published: 2025-05-22T00:00:00.000Z Last Updated: 2025-05-23T18:26:09.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: Infoblox NETMRI before 7.6.1 has a vulnerability allowing remote authenticated users to read arbitrary files with root access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.infoblox.com/s/article/Infoblox-NetMRI-is-vulnerable-to-CVE-2024-54188
CVE ID: CVE-2024-54189 State: PUBLISHED Published: 2025-06-03T09:43:27.168Z Last Updated: 2025-06-03T13:19:52.966Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Parallels Products: Parallels Desktop for Mac Problem Types: CWE-62 Description: A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is taken, a root service writes to a file owned by a normal user. By using a hard link, an attacker can write to an arbitrary file, potentially leading to privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
tentially leading to privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2124
CVE ID: CVE-2024-54191 State: PUBLISHED Published: 2025-01-11T12:29:52.753Z Last Updated: 2025-10-01T19:57:21.849Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: iso: Fix circular lock in iso_conn_big_sync This fixes the circular locking dependency warning below, by reworking iso_sock_recvmsg, to ensure that the socket lock is always released before calling a function that locks hdev. [ 561.670344] ====================================================== [ 561.670346] WARNING: possible circular locking dependency detected [ 561.670349] 6.12.0-rc6+ #26 Not tainted [ 561.670351] ------------------------------------------
g dependency detected [ 561.670349] 6.12.0-rc6+ #26 Not tainted [ 561.670351] ------------------------------------------------------ [ 561.670353] iso-tester/3289 is trying to acquire lock: [ 561.670355] ffff88811f600078 (&hdev->lock){+.+.}-{3:3}, at: iso_conn_big_sync+0x73/0x260 [bluetooth] [ 561.670405] but task is already holding lock: [ 561.670407] ffff88815af58258 (sk_lock-AF_BLUETOOTH){+.+.}-{0:0}, at: iso_sock_recvmsg+0xbf/0x500 [bluetooth] [ 561.670450] which lock already depends on the new lock. [ 561.670452] the existing dependency chain (in reverse order) is: [ 561.670453] -> #2 (sk_lock-AF_BLUETOOTH){+.+.}-{0:0}: [ 561.670458] lock_acquire+0x7c/0xc0 [ 561.670463] lock_sock_nested
61.670453] -> #2 (sk_lock-AF_BLUETOOTH){+.+.}-{0:0}: [ 561.670458] lock_acquire+0x7c/0xc0 [ 561.670463] lock_sock_nested+0x3b/0xf0 [ 561.670467] bt_accept_dequeue+0x1a5/0x4d0 [bluetooth] [ 561.670510] iso_sock_accept+0x271/0x830 [bluetooth] [ 561.670547] do_accept+0x3dd/0x610 [ 561.670550] __sys_accept4+0xd8/0x170 [ 561.670553] __x64_sys_accept+0x74/0xc0 [ 561.670556] x64_sys_call+0x17d6/0x25f0 [ 561.670559] do_syscall_64+0x87/0x150 [ 561.670563] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 561.670567] -> #1 (sk_lock-AF_BLUETOOTH-BTPROTO_ISO){+.+.}-{0:0}: [ 561.670571] lock_acquire+0x7c/0xc0 [ 561.670574] lock_sock_nested+0x3b/0xf0 [ 561.670577] iso_sock_listen+0x2de/0xf30 [bluetooth] [ 561.67
cquire+0x7c/0xc0 [ 561.670574] lock_sock_nested+0x3b/0xf0 [ 561.670577] iso_sock_listen+0x2de/0xf30 [bluetooth] [ 561.670617] __sys_listen_socket+0xef/0x130 [ 561.670620] __x64_sys_listen+0xe1/0x190 [ 561.670623] x64_sys_call+0x2517/0x25f0 [ 561.670626] do_syscall_64+0x87/0x150 [ 561.670629] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 561.670632] -> #0 (&hdev->lock){+.+.}-{3:3}: [ 561.670636] __lock_acquire+0x32ad/0x6ab0 [ 561.670639] lock_acquire.part.0+0x118/0x360 [ 561.670642] lock_acquire+0x7c/0xc0 [ 561.670644] __mutex_lock+0x18d/0x12f0 [ 561.670647] mutex_lock_nested+0x1b/0x30 [ 561.670651] iso_conn_big_sync+0x73/0x260 [bluetooth] [ 561.670687] iso_sock_recvmsg+0x3e9/0x500 [bluetooth] [
x1b/0x30 [ 561.670651] iso_conn_big_sync+0x73/0x260 [bluetooth] [ 561.670687] iso_sock_recvmsg+0x3e9/0x500 [bluetooth] [ 561.670722] sock_recvmsg+0x1d5/0x240 [ 561.670725] sock_read_iter+0x27d/0x470 [ 561.670727] vfs_read+0x9a0/0xd30 [ 561.670731] ksys_read+0x1a8/0x250 [ 561.670733] __x64_sys_read+0x72/0xc0 [ 561.670736] x64_sys_call+0x1b12/0x25f0 [ 561.670738] do_syscall_64+0x87/0x150 [ 561.670741] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 561.670744] other info that might help us debug this: [ 561.670745] Chain exists of: &hdev->lock --> sk_lock-AF_BLUETOOTH-BTPROTO_ISO --> sk_lock-AF_BLUETOOTH [ 561.670751] Possible unsafe locking scenario: [ 561.670753] CPU0 CPU1 [ 561.670754] ---- ----