deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-34076
Published: 2025-07-02
Description: An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the underlying filesystem. By specifying an absolute file path in the src parameter of the upload request, the server may relocate or delete the target file depending on the web service user’s privileges. The corresponding download endpoint can then be used to retrieve the file contents, effectively enabling local file disclosure. This behavior stems from insufficient validation of user-supplied paths and inadequate restrictions on file access and backup logic.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://github.com/microweber/microweber; https://github.com/microweber/microweber/commit/572bdc36b5b[PII_REDACTED]6f6b961c8df53226855; https://github.com/microweber/microweber/commit/98d025467128ecc24195dcb56c533febc3c91af6
CVE: CVE-2025-34078
Published: 2025-07-02
Description: A local privilege escalation vulnerability exists in NSClient++ 0.5.2.35 when both the web interface and ExternalScripts features are enabled. The configuration file (nsclient.ini) stores the administrative password in plaintext and is readable by local users. By extracting this password, an attacker can authenticate to the NSClient++ web interface (typically accessible on port 8443) and abuse the ExternalScripts plugin to inject and execute arbitrary commands as SYSTEM by registering a custom script, saving the configuration, and triggering it via the API.

This behavior is documented but insecure, as the plaintext credential exposure undermines access isolation between local users and administrative functions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522, CWE-522
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/local/nscp_pe.rb; https://vulncheck.com/advisories/nsclient-localtoremote-system-compromise; https://www.exploit-db.com/exploits/46802
CVE: CVE-2025-34079
Published: 2025-07-02
Description: An authenticated remote code execution vulnerability exists in NSClient++ version 0.5.2.35 when the web interface and ExternalScripts module are enabled. A remote attacker with the administrator password can authenticate to the web interface (default port 8443), inject arbitrary commands as external scripts via the /settings/query.json API, save the configuration, and trigger the script via the /query/{name} endpoint. The injected commands are executed with SYSTEM privileges, enabling full remote compromise.

This capability is an intended feature, but the lack of safeguards or privilege separation makes it risky when exposed to untrusted actors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94, CWE-306, CWE-94
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/nscp_authenticated_rce.rb; https://vulncheck.com/advisories/nsclient-localtoremote-system-compromise; https://www.exploit-db.com/exploits/48360
CVE: CVE-2025-34090
Published: 2025-07-02
Description: Rejected reason: Neither filed by Chrome nor a valid security vulnerability.
CVE: CVE-2025-34091
Published: 2025-07-02
Description: Rejected reason: Neither filed by Chrome nor a valid security vulnerability.
CVE: CVE-2025-34092
Published: 2025-07-02
Description: Rejected reason: Neither filed by Chrome nor a valid security vulnerability.
CVE: CVE-2025-43025
Published: 2025-07-02
Description: HP Universal Print Driver is potentially vulnerable to denial of service due to buffer overflow in versions of UPD 7.4 or older (e.g., v7.3.x, v7.2.x, v7.1.x, etc.).
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://support.hp.com/us-en/document/ish_12[PII_REDACTED]0598-16/hpsbpi04032
CVE: CVE-2025-52559
Published: 2025-07-02
Description: Zulip is an open-source team chat application. From versions 2.0.0-rc1 to before 10.4 in Zulip Server, the /digest/ URL of a server shows a preview of what the email weekly digest would contain. This URL, though not the digest itself, contains a cross-site scripting (XSS) vulnerability in both topic names and channel names. This issue has been fixed in Zulip Server 10.4. A workaround for this issue involves denying access to /digest/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/zulip/zulip/commit/175ec1f365b0db982d6eac9019701cbf6e8bc2f2; https://github.com/zulip/zulip/commit/1a8429e338ff53bdcc4b42e7e71b6fffdd84fcd1; https://github.com/zulip/zulip/commit/6608c8777254e73a4b540e5e1c4af92e680a55fc
CVE: CVE-2025-52842
Published: 2025-07-02
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Laundry on Linux, MacOS allows Account Takeover. This issue affects Laundry: 2.3.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://fluidattacks.com/advisories/winehouse; https://github.com/mohaiminur/laundry; https://fluidattacks.com/advisories/winehouse
CVE: CVE-2025-5944
Published: 2025-07-03
Description: The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-caption’ attribute in all versions up to, and including, 8.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://feedback.bdthemes.com/announcements?category=category_6l495r8q; https://github.com/uikit/uikit/issues/5162; https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/assets/js/bdt-uikit.js
CVE: CVE-2024-9017
Published: 2025-07-03
Description: The PeepSo Core: Groups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Group Description field in all versions up to, and including, 6.4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://www.peepso.com/changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/32ac79f4-ada7-4c14-8675-53f8375912d8?source=cve
CVE: CVE-2025-38094
Published: 2025-07-03
Description: In the Linux kernel, the following vulnerability has been resolved:

net: cadence: macb: Fix a possible deadlock in macb_halt_tx.

There is a situation where after THALT is set high, TGO stays high as
well. Because jiffies are never updated, as we are in a context with
interrupts disabled, we never exit that loop and have a deadlock.

That deadlock was noticed on a sama5d4 device that stayed locked for days.

Use retries instead of jiffies so that the timeout really works and we do
not have a deadlock anymore.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/0772a608d799ac0d127c0a36047a2725777aba9d; https://git.kernel.org/stable/c/1d60c0781c1bbeaa1196b0d8aad5c435f06cb7c4; https://git.kernel.org/stable/c/3e64d35475aa21d13dab71da51de51923c1a3a48
CVE: CVE-2025-38095
Published: 2025-07-03
Description: In the Linux kernel, the following vulnerability has been resolved:

dma-buf: insert memory barrier before updating num_fences

smp_store_mb() inserts memory barrier after storing operation.
It is different with what the comment is originally aiming so Null
pointer dereference can be happened if memory update is reordered.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/08680c4dadc6e736c75bc2409d833f03f9003c51; https://git.kernel.org/stable/c/3becc659f9cb76b481ad1fb71f54d5c8d6332d3f; https://git.kernel.org/stable/c/72c7d62583ebce7baeb61acce6057c361f73be4a
CVE: CVE-2025-38096
Published: 2025-07-03
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: don't warn when if there is a FW error

iwl_trans_reclaim is warning if it is called when the FW is not alive.
But if it is called when there is a pending restart, i.e. after a FW
error, there is no need to warn, instead - return silently.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0446d34a853d9576e2a7628c803d2abd2f8cf3a8; https://git.kernel.org/stable/c/c7f50d0433a016d[PII_REDACTED]6a3d484817bfb34; https://git.kernel.org/stable/c/d07a08f42dc7230c902e1af2a899a72b0a03aa69
CVE: CVE-2025-38097
Published: 2025-07-03
Description: In the Linux kernel, the following vulnerability has been resolved:

espintcp: remove encap socket caching to avoid reference leak

The current scheme for caching the encap socket can lead to reference
leaks when we try to delete the netns.

The reference chain is: xfrm_state -> enacp_sk -> netns

Since the encap socket is a userspace socket, it holds a reference on
the netns. If we delete the espintcp state (through flush or
individual delete) before removing the netns, the reference on the
socket is dropped and the netns is correctly deleted. Otherwise, the
netns may not be reachable anymore (if all processes within the ns
have terminated), so we cannot delete the xfrm state to drop its
reference on the socket.

This patch results in a small (~2% in my tests) performance
regression.

A GC-type mechanism could be added for the socket cache, to clear
references if the state hasn't been used "recently", but it's a lot
more complex than just not caching the socket.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/028363685bd0b7a19b4a820f82dd905b1dc83999; https://git.kernel.org/stable/c/74fd327767fb784c5875cf7c4ba1217f26020943; https://git.kernel.org/stable/c/9cbca30102028f9ad3d2098f935c4368f581fd07
CVE: CVE-2025-38098
Published: 2025-07-03
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink

Don't try to operate on a drm_wb_connector as an amdgpu_dm_connector.
While dereferencing aconnector->base will "work" it's wrong and
might lead to unknown bad things. Just... don't.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/18ca68f7c657721583a75cab01f0d0d2ec63a6c9; https://git.kernel.org/stable/c/b14e726d57f61085485f107a6203c50a09695abd; https://git.kernel.org/stable/c/cbf4890c6f28fb1ad733e14613fbd33c2004bced
CVE: CVE-2025-38099
Published: 2025-07-03
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken

A SCO connection without the proper voice_setting can cause
the controller to lock up.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/14d17c78a4b1660c443bae9d38c814edea506f62; https://git.kernel.org/stable/c/ec1f015ec0c6fd250a6564e8452f7bb3160b9cb1; https://git.kernel.org/stable/c/f48ee562c095e552a30b8d9cc0566a267b410f8a
CVE: CVE-2025-38100
Published: 2025-07-03
Description: In the Linux kernel, the following vulnerability has been resolved:

x86/iopl: Cure TIF_IO_BITMAP inconsistencies

io_bitmap_exit() is invoked from exit_thread() when a task exists or
when a fork fails. In the latter case the exit_thread() cleans up
resources which were allocated during fork().

io_bitmap_exit() invokes task_update_io_bitmap(), which in turn ends up
in tss_update_io_bitmap(). tss_update_io_bitmap() operates on the
current task. If current has TIF_IO_BITMAP set, but no bitmap installed,
tss_update_io_bitmap() crashes with a NULL pointer dereference.

There are two issues, which lead to that problem:

  1) io_bitmap_exit() should not invoke task_update_io_bitmap() when
     the task, which is cleaned up, is not the current task. That's a
     clear indicator for a cleanup after a failed fork().

  2) A task should not have TIF_IO_BITMAP set and neither a bitmap
     installed nor IOPL emulation level 3 activated.

     This happens when a kernel thread is created in the context of
     a user space thread, which has TIF_IO_BITMAP set as the thread
     flags are copied and the IO bitmap pointer is cleared.

     Other than in the failed fork() case this has no impact because
     kernel threads including IO workers never return to user space and
     therefore never invoke tss_update_io_bitmap().

Cure this by adding the missing cleanups and checks:

  1) Prevent io_bitmap_exit() to invoke task_update_io_bitmap() if
     the to be cleaned up task is not the current task.

  2) Clear TIF_IO_BITMAP in copy_thread() unconditionally. For user
     space forks it is set later, when the IO bitmap is inherited in
     io_bitmap_share().

For paranoia sake, add a warning into tss_update_io_bitmap() to catch
the case, when that code is invoked with inconsistent state.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/2cfcbe1554c119402e7382de974c26b0549899fe; https://git.kernel.org/stable/c/2dace5e016c991424a3dc6e83b1ae5dca8992d08; https://git.kernel.org/stable/c/73cfcc8445585b8af7e18be3c9246b851fdf336c
CVE: CVE-2025-38101
Published: 2025-07-03
Description: In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set()

Enlarge the critical section in ring_buffer_subbuf_order_set() to
ensure that error handling takes place with per-buffer mutex held,
thus preventing list corruption and other concurrency-related issues.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/0fc9a295cd8e59c3636e97395e7c74a9c89fee42; https://git.kernel.org/stable/c/40ee2afafc1d9fe3aa44a6fbe440d78a5c96a72e; https://git.kernel.org/stable/c/e09c0600beea469b3ebf974464e526a02d59ad62
CVE: CVE-2025-38102
Published: 2025-07-03
Description: In the Linux kernel, the following vulnerability has been resolved:

VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify

During our test, it is found that a warning can be trigger in try_grab_folio
as follow:

  ------------[ cut here ]------------
  WARNING: CPU: 0 PID: 1678 at mm/gup.c:147 try_grab_folio+0x106/0x130
  Modules linked in:
  CPU: 0 UID: 0 PID: 1678 Comm: syz.3.31 Not tainted 6.15.0-rc5 #163 PREEMPT(undef)
  RIP: 0010:try_grab_folio+0x106/0x130
  Call Trace:
   <TASK>
   follow_huge_pmd+0x240/0x8e0
   follow_pmd_mask.constprop.0.isra.0+0x40b/0x5c0
   follow_pud_mask.constprop.0.isra.0+0x14a/0x170
   follow_page_mask+0x1c2/0x1f0
   __get_user_pages+0x176/0x950
   __gup_longterm_locked+0x15b/0x1060
   ? gup_fast+0x120/0x1f0
   gup_fast_fallback+0x17e/0x230
   get_user_pages_fast+0x5f/0x80
   vmci_host_unlocked_ioctl+0x21c/0xf80
  RIP: 0033:0x54d2cd
  ---[ end trace [PII_REDACTED] ]---

Digging into the source, context->notify_page may init by get_user_pages_fast
and can be seen in vmci_ctx_unset_notify which will try to put_page. However
get_user_pages_fast is not finished here and lead to following
try_grab_folio warning. The race condition is shown as follow:

cpu0			cpu1
vmci_host_do_set_notify
vmci_host_setup_notify
get_user_pages_fast(uva, 1, FOLL_WRITE, &context->notify_page);
lockless_pages_from_mm
gup_pgd_range
gup_huge_pmd  // update &context->notify_page
			vmci_host_do_set_notify
			vmci_ctx_unset_notify
			notify_page = context->notify_page;
			if (notify_page)
			put_page(notify_page);	// page is freed
__gup_longterm_locked
__get_user_pages
follow_trans_huge_pmd
try_grab_folio // warn here

To slove this, use local variable page to make notify_page can be seen
after finish get_user_pages_fast.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://git.kernel.org/stable/c/00ddc7dad55b7bbb78df80d6e174d0c4764dea0c; https://git.kernel.org/stable/c/1bd6406fb5f36c2bb1e96e27d4c3e9f4d09edde4; https://git.kernel.org/stable/c/468aec888f838ce5174b96e0cb4396790d6f60ca
CVE: CVE-2025-38103
Published: 2025-07-03
Description: In the Linux kernel, the following vulnerability has been resolved:

HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()

Update struct hid_descriptor to better reflect the mandatory and
optional parts of the HID Descriptor as per USB HID 1.11 specification.
Note: the kernel currently does not parse any optional HID class
descriptors, only the mandatory report descriptor.

Update all references to member element desc[0] to rpt_desc.

Add test to verify bLength and bNumDescriptors values are valid.

Replace the for loop with direct access to the mandatory HID class
descriptor member for the report descriptor. This eliminates the
possibility of getting an out-of-bounds fault.

Add a warning message if the HID descriptor contains any unsupported
optional HID class descriptors.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/1df80d748f984290c895e[PII_REDACTED]15dcfbfb0; https://git.kernel.org/stable/c/41827a2dbdd7880df9881506dee13bc88d4230bb; https://git.kernel.org/stable/c/485e1b741eb838cbe1d6b0e81e5ab62ae6c095cf
CVE: CVE-2025-38105
Published: 2025-07-03
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Kill timer properly at removal

The USB-audio MIDI code initializes the timer, but in a rare case, the
driver might be freed without the disconnect call.  This leaves the
timer in an active state while the assigned object is released via
snd_usbmidi_free(), which ends up with a kernel warning when the debug
configuration is enabled, as spotted by fuzzer.

For avoiding the problem, put timer_shutdown_sync() at
snd_usbmidi_free(), so that the timer can be killed properly.
While we're at it, replace the existing timer_delete_sync() at the
disconnect callback with timer_shutdown_sync(), too.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0718a78f6a9f04b88d0dc9616cc216b31c5f3cf1; https://git.kernel.org/stable/c/62066758d2ae169278e5d6aea5995b1b6f6ddeb5; https://git.kernel.org/stable/c/647410a7da46067953a53c0d03f8680eff570959
CVE: CVE-2025-38107
Published: 2025-07-03
Description: In the Linux kernel, the following vulnerability has been resolved:

net_sched: ets: fix a race in ets_qdisc_change()

Gerrard Tai reported a race condition in ETS, whenever SFQ perturb timer
fires at the wrong time.

The race is as follows:

CPU 0                                 CPU 1
[1]: lock root
[2]: qdisc_tree_flush_backlog()
[3]: unlock root
 |
 |                                    [5]: lock root
 |                                    [6]: rehash
 |                                    [7]: qdisc_tree_reduce_backlog()
 |
[4]: qdisc_put()

This can be abused to underflow a parent's qlen.

Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog()
should fix the race, because all packets will be purged from the qdisc
before releasing the lock.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://git.kernel.org/stable/c/0383b25488a545be[PII_REDACTED]7549d4a2d3d6c; https://git.kernel.org/stable/c/073f64c03516bcfaf790f8edc772e0cfb8a84ec3; https://git.kernel.org/stable/c/0b479d0aa488cb478eb2e1d8868be946ac8afb4f
CVE: CVE-2025-38108
Published: 2025-07-03
Description: In the Linux kernel, the following vulnerability has been resolved:

net_sched: red: fix a race in __red_change()

Gerrard Tai reported a race condition in RED, whenever SFQ perturb timer
fires at the wrong time.

The race is as follows:

CPU 0                                 CPU 1
[1]: lock root
[2]: qdisc_tree_flush_backlog()
[3]: unlock root
 |
 |                                    [5]: lock root
 |                                    [6]: rehash
 |                                    [7]: qdisc_tree_reduce_backlog()
 |
[4]: qdisc_put()

This can be abused to underflow a parent's qlen.

Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog()
should fix the race, because all packets will be purged from the qdisc
before releasing the lock.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://git.kernel.org/stable/c/110a47efcf23438ff8d31dbd9c854fae2a48bf98; https://git.kernel.org/stable/c/2790c4ec481be45a80948d059cd7c9a06bc37493; https://git.kernel.org/stable/c/2a71924ca4af59ffc00f0444732b6cd54b153d0e
CVE: CVE-2025-38109
Published: 2025-07-03
Description: In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix ECVF vports unload on shutdown flow

Fix shutdown flow UAF when a virtual function is created on the embedded
chip (ECVF) of a BlueField device. In such case the vport acl ingress
table is not properly destroyed.

ECVF functionality is independent of ecpf_vport_exists capability and
thus functions mlx5_eswitch_(enable|disable)_pf_vf_vports() should not
test it when enabling/disabling ECVF vports.

kernel log:
[] refcount_t: underflow; use-after-free.
[] WARNING: CPU: 3 PID: 1 at lib/refcount.c:28
   refcount_warn_saturate+0x124/0x220
----------------
[] Call trace:
[] refcount_warn_saturate+0x124/0x220
[] tree_put_node+0x164/0x1e0 [mlx5_core]
[] mlx5_destroy_flow_table+0x98/0x2c0 [mlx5_core]
[] esw_acl_ingress_table_destroy+0x28/0x40 [mlx5_core]
[] esw_acl_ingress_lgcy_cleanup+0x80/0xf4 [mlx5_core]
[] esw_legacy_vport_acl_cleanup+0x44/0x60 [mlx5_core]
[] esw_vport_cleanup+0x64/0x90 [mlx5_core]
[] mlx5_esw_vport_disable+0xc0/0x1d0 [mlx5_core]
[] mlx5_eswitch_unload_ec_vf_vports+0xcc/0x150 [mlx5_core]
[] mlx5_eswitch_disable_sriov+0x198/0x2a0 [mlx5_core]
[] mlx5_device_disable_sriov+0xb8/0x1e0 [mlx5_core]
[] mlx5_sriov_detach+0x40/0x50 [mlx5_core]
[] mlx5_unload+0x40/0xc4 [mlx5_core]
[] mlx5_unload_one_devl_locked+0x6c/0xe4 [mlx5_core]
[] mlx5_unload_one+0x3c/0x60 [mlx5_core]
[] shutdown+0x7c/0xa4 [mlx5_core]
[] pci_device_shutdown+0x3c/0xa0
[] device_shutdown+0x170/0x340
[] __do_sys_reboot+0x1f4/0x2a0
[] __arm64_sys_reboot+0x2c/0x40
[] invoke_syscall+0x78/0x100
[] el0_svc_common.constprop.0+0x54/0x184
[] do_el0_svc+0x30/0xac
[] el0_svc+0x48/0x160
[] el0t_64_sync_handler+0xa4/0x12c
[] el0t_64_sync+0x1a4/0x1a8
[] --[ end trace 9c4601d68c70030e ]---
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/24db585d369f949f698e03d7d8017e5ae19d0497; https://git.kernel.org/stable/c/5953ae44dfe5dbad374318875be834c3b7b71ee6; https://git.kernel.org/stable/c/687560d8a9a2d654829ad0da1ec24242f1de711d
CVE: CVE-2025-38110
Published: 2025-07-03
Description: In the Linux kernel, the following vulnerability has been resolved:

net/mdiobus: Fix potential out-of-bounds clause 45 read/write access

When using publicly available tools like 'mdio-tools' to read/write data
from/to network interface and its PHY via C45 (clause 45) mdiobus,
there is no verification of parameters passed to the ioctl and
it accepts any mdio address.
Currently there is support for 32 addresses in kernel via PHY_MAX_ADDR define,
but it is possible to pass higher value than that via ioctl.
While read/write operation should generally fail in this case,
mdiobus provides stats array, where wrong address may allow out-of-bounds
read/write.

Fix that by adding address verification before C45 read/write operation.
While this excludes this access from any statistics, it improves security of
read/write operation.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/260388f79e94fb3026c419a208ece8358bb7b555; https://git.kernel.org/stable/c/31bf7b2b92563a352788cf9df3698682f659bacc; https://git.kernel.org/stable/c/4ded22f7f3ce9714ed72c3e9c68fea1cb9388ae7