deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-54402
Published: 2025-10-07
Description: Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to stack-based buffer overflow. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This buffer overflow is related to the `submit-url` and `ipaddr` request parameters combined.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2226; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2226
CVE: CVE-2025-54403
Published: 2025-10-07
Description: Multiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 v1.3411b190912. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is related to the `new_password` request parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2227; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2227
CVE: CVE-2025-54404
Published: 2025-10-07
Description: Multiple OS command injection vulnerabilities exist in the swctrl functionality of Planet WGR-500 v1.3411b190912. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is related to the `new_device_name` request parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2227; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2227
CVE: CVE-2025-54405
Published: 2025-10-07
Description: Multiple OS command injection vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to arbitrary command execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This command injection is related to the `ipaddr` request parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2229; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2229
CVE: CVE-2025-54406
Published: 2025-10-07
Description: Multiple OS command injection vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to arbitrary command execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This command injection is related to the `counts` request parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2229; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2229
CVE: CVE-2025-57564
Published: 2025-10-07
Description: CubeAPM nightly-2025-08-01-1 allow unauthenticated attackers to inject arbitrary log entries into production systems via the /api/logs/insert/elasticsearch/_bulk endpoint. This endpoint accepts bulk log data without requiring authentication or input validation, allowing remote attackers to perform unauthorized log injection. Exploitation may lead to false log entries, log poisoning, alert obfuscation, and potential performance degradation of the observability pipeline. The issue is present in the core CubeAPM platform and is not limited to specific deployment configurations.
CVSS Score: 8.2 (HIGH)
CWE: CWE-117
References: https://github.com/prassan10/CubeAPM/blob/main/CVE-2025-57564%3A%20Unauthenticated%20Log%20Injection%20in%20CubeAPM; https://github.com/prassan10/CubeAPM/blob/main/Unauthenticated-Log_Injection
CVE: CVE-2025-59425
Published: 2025-10-07
Description: vLLM is an inference and serving engine for large language models (LLMs). Before version 0.11.0rc2, the API key support in vLLM performs validation using a method that was vulnerable to a timing attack. API key validation uses a string comparison that takes longer the more characters the provided API key gets correct. Data analysis across many attempts could allow an attacker to determine when it finds the next correct character in the key sequence. Deployments relying on vLLM's built-in API key validation are vulnerable to authentication bypass using this technique. Version 0.11.0rc2 fixes the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-385
References: https://github.com/vllm-project/vllm/blob/4b946d693e0af15740e9ca9c0e059d5f333b1083/vllm/entrypoints/openai/api_server.py#L1270-L1274; https://github.com/vllm-project/vllm/commit/ee10d7e6ff5875386c7f136ce8b5f525c8fcef48; https://github.com/vllm-project/vllm/releases/tag/v0.11.0
CVE: CVE-2023-6215
Published: 2025-10-07
Description: A potential security vulnerability has been identified in HP Sure Start’s protection of the Intel Flash Descriptor in certain HP PC products, which might allow security bypass, arbitrary code execution, loss of integrity or confidentiality, or denial of service. HP is releasing BIOS updates to mitigate the potential vulnerability.
CWE: CWE-306
References: https://support.hp.com/us-en/document/ish_13[PII_REDACTED]4688-16/hpsbhf04061
CVE: CVE-2025-11398
Published: 2025-10-07
Description: A weakness has been identified in SourceCodester Hotel and Lodge Management System 1.0. The impacted element is an unknown function of the file /profile.php of the component Profile Page. Executing manipulation of the argument image can lead to unrestricted upload. The attack may be launched remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/TThuyyy/cve1/issues/7; https://vuldb.com/?ctiid.327335; https://vuldb.com/?id.327335
CVE: CVE-2025-61770
Published: 2025-10-07
Description: Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` buffers the entire multipart preamble (bytes before the first boundary) in memory without any size limit. A client can send a large preamble followed by a valid boundary, causing significant memory use and potential process termination due to out-of-memory (OOM) conditions. Remote attackers can trigger large transient memory spikes by including a long preamble in multipart/form-data requests. The impact scales with allowed request sizes and concurrency, potentially causing worker crashes or severe slowdown due to garbage collection. Versions 2.2.19, 3.1.17, and 3.2.2 enforce a preamble size limit (e.g., 16 KiB) or discard preamble data entirely. Workarounds include limiting total request body size at the proxy or web server level and monitoring memory and set per-process limits to prevent OOM conditions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/rack/rack/commit/589127f4ac8b5cf11cf88fb0cd116ffed4d2181e; https://github.com/rack/rack/commit/d869fed663b113b95a74ad53e1b5cae6ab31f29e; https://github.com/rack/rack/commit/e08f78c656c9394d6737c022bde087e0f33336fd
CVE: CVE-2025-61771
Published: 2025-10-07
Description: Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, ``Rack::Multipart::Parser` stores non-file form fields (parts without a `filename`) entirely in memory as Ruby `String` objects. A single large text field in a multipart/form-data request (hundreds of megabytes or more) can consume equivalent process memory, potentially leading to out-of-memory (OOM) conditions and denial of service (DoS). Attackers can send large non-file fields to trigger excessive memory usage. Impact scales with request size and concurrency, potentially leading to worker crashes or severe garbage-collection overhead. All Rack applications processing multipart form submissions are affected. Versions 2.2.19, 3.1.17, and 3.2.2 enforce a reasonable size cap for non-file fields (e.g., 2 MiB). Workarounds include restricting maximum request body size at the web-server or proxy layer (e.g., Nginx `client_max_body_size`) and validating and rejecting unusually large form fields at the application level.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/rack/rack/commit/589127f4ac8b5cf11cf88fb0cd116ffed4d2181e; https://github.com/rack/rack/commit/d869fed663b113b95a74ad53e1b5cae6ab31f29e; https://github.com/rack/rack/commit/e08f78c656c9394d6737c022bde087e0f33336fd
CVE: CVE-2025-61772
Published: 2025-10-07
Description: Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (`CRLFCRLF`). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS). Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected. Versions 2.2.19, 3.1.17, and 3.2.2 cap per-part header size (e.g., 64 KiB). As a workaround, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx `client_max_body_size`).
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/rack/rack/commit/589127f4ac8b5cf11cf88fb0cd116ffed4d2181e; https://github.com/rack/rack/commit/d869fed663b113b95a74ad53e1b5cae6ab31f29e; https://github.com/rack/rack/commit/e08f78c656c9394d6737c022bde087e0f33336fd
CVE: CVE-2022-50509
Published: 2025-10-07
Description: In the Linux kernel, the following vulnerability has been resolved:

media: coda: Add check for kmalloc

As the kmalloc may return NULL pointer,
it should be better to check the return value
in order to avoid NULL poineter dereference,
same as the others.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0209e70ad496c1fcd85c2ec70e6736fd09f95d14; https://git.kernel.org/stable/c/11e32126b3e56c3156fb610d793732acd2bdac4f; https://git.kernel.org/stable/c/441c05485cf1a29eef05c1fd[PII_REDACTED]283315
CVE: CVE-2022-50510
Published: 2025-10-07
Description: In the Linux kernel, the following vulnerability has been resolved:

perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()

arm_smmu_pmu_init() won't remove the callback added by
cpuhp_setup_state_multi() when platform_driver_register() failed. Remove
the callback by cpuhp_remove_multi_state() in fail path.

Similar to the handling of arm_ccn_init() in commit 26242b330093 ("bus:
arm-ccn: Prevent hotplug callback leak")
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/359286f886feef38536eaa7e673dc3440f03b0a1; https://git.kernel.org/stable/c/582babe17ea878ec1d76f30e03f3a6ce6e30eb91; https://git.kernel.org/stable/c/6f2d566b46436a50a80d6445e82879686b89588c
CVE: CVE-2022-50511
Published: 2025-10-07
Description: In the Linux kernel, the following vulnerability has been resolved:

lib/fonts: fix undefined behavior in bit shift for get_default_font

Shifting signed 32-bit value by 31 bits is undefined, so changing
significant bit to unsigned.  The UBSAN warning calltrace like below:

UBSAN: shift-out-of-bounds in lib/fonts/fonts.c:139:20
left shift of 1 by 31 places cannot be represented in type 'int'
 <TASK>
 dump_stack_lvl+0x7d/0xa5
 dump_stack+0x15/0x1b
 ubsan_epilogue+0xe/0x4e
 __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c
 get_default_font+0x1c7/0x1f0
 fbcon_startup+0x347/0x3a0
 do_take_over_console+0xce/0x270
 do_fbcon_takeover+0xa1/0x170
 do_fb_registered+0x2a8/0x340
 fbcon_fb_registered+0x47/0xe0
 register_framebuffer+0x294/0x4a0
 __drm_fb_helper_initial_config_and_unlock+0x43c/0x880 [drm_kms_helper]
 drm_fb_helper_initial_config+0x52/0x80 [drm_kms_helper]
 drm_fbdev_client_hotplug+0x156/0x1b0 [drm_kms_helper]
 drm_fbdev_generic_setup+0xfc/0x290 [drm_kms_helper]
 bochs_pci_probe+0x6ca/0x772 [bochs]
 local_pci_probe+0x4d/0xb0
 pci_device_probe+0x119/0x320
 really_probe+0x181/0x550
 __driver_probe_device+0xc6/0x220
 driver_probe_device+0x32/0x100
 __driver_attach+0x195/0x200
 bus_for_each_dev+0xbb/0x120
 driver_attach+0x27/0x30
 bus_add_driver+0x22e/0x2f0
 driver_register+0xa9/0x190
 __pci_register_driver+0x90/0xa0
 bochs_pci_driver_init+0x52/0x1000 [bochs]
 do_one_initcall+0x76/0x430
 do_init_module+0x61/0x28a
 load_module+0x1f82/0x2e50
 __do_sys_finit_module+0xf8/0x190
 __x64_sys_finit_module+0x23/0x30
 do_syscall_64+0x58/0x80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
 </TASK>
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/6fe888c4d2fb174408e4540bb2d5602b9f507f90; https://git.kernel.org/stable/c/890d91b31f4874361e0df047f57d268a7021cb12; https://git.kernel.org/stable/c/9c14a85e18a58c102ec223144b7edb5b345c1bea
CVE: CVE-2022-50512
Published: 2025-10-07
Description: In the Linux kernel, the following vulnerability has been resolved:

ext4: fix potential memory leak in ext4_fc_record_regions()

As krealloc may return NULL, in this case 'state->fc_regions' may not be
freed by krealloc, but 'state->fc_regions' already set NULL. Then will
lead to 'state->fc_regions' memory leak.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/2cfb769d60a2a57eb[PII_REDACTED]b6131cd16dcfe; https://git.kernel.org/stable/c/417b0455a0b6d0f60a[PII_REDACTED]d1f8340e24be; https://git.kernel.org/stable/c/518566e71ad86b7c2f1bf6d9caee9588bb7ac158
CVE: CVE-2022-50513
Published: 2025-10-07
Description: In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv()

In rtw_init_cmd_priv(), if `pcmdpriv->rsp_allocated_buf` is allocated
in failure, then `pcmdpriv->cmd_allocated_buf` will be not properly
released. Besides, considering there are only two error paths and the
first one can directly return, so we do not need implicitly jump to the
`exit` tag to execute the error handler.

So this patch added `kfree(pcmdpriv->cmd_allocated_buf);` on the error
path to release the resource and simplified the return logic of
rtw_init_cmd_priv(). As there is no proper device to test with, no runtime
testing was performed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/39bef9c6a91bbb790d04c1347cfeae584541fb6a; https://git.kernel.org/stable/c/708056fba733a73d926772ea4ce9a42d240345da; https://git.kernel.org/stable/c/8db6ca84eee0ac258706f3fca54f7c021cb159ef
CVE: CVE-2022-50514
Published: 2025-10-07
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_hid: fix refcount leak on error path

When failing to allocate report_desc, opts->refcnt has already been
incremented so it needs to be decremented to avoid leaving the options
structure permanently locked.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/216437dd64fce36791a3b6cc8f8013df36856958; https://git.kernel.org/stable/c/70a3288a[PII_REDACTED]105c699b687d78cd32559a; https://git.kernel.org/stable/c/80dc47e751a837106c09bec73964ff8f7ea280b4
CVE: CVE-2022-50515
Published: 2025-10-07
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix memory leak in hpd_rx_irq_create_workqueue()

If construction of the array of work queues to handle hpd_rx_irq offload
work fails, we need to unwind. Destroy all the created workqueues and
the allocated memory for the hpd_rx_irq_offload_work_queue struct array.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/3ba3814c00a4817eb1cd31eff08d921c40e5f3a4; https://git.kernel.org/stable/c/600de40ed50c8b5ecb9c7a4f41eb882066c15a00; https://git.kernel.org/stable/c/7136f956c73c4ba50bfeb61653dfd6a9669ea915
CVE: CVE-2022-50518
Published: 2025-10-07
Description: In the Linux kernel, the following vulnerability has been resolved:

parisc: Fix locking in pdc_iodc_print() firmware call

Utilize pdc_lock spinlock to protect parallel modifications of the
iodc_dbuf[] buffer, check length to prevent buffer overflow of
iodc_dbuf[], drop the iodc_retbuf[] buffer and fix some wrong
indentings.
CVSS Score: 7.8 (HIGH)
CWE: CWE-667
References: https://git.kernel.org/stable/c/04a603058e70b8b881bb7860b8bd649f931f2591; https://git.kernel.org/stable/c/553bc5890ed96a8d006224c3a4673c47fee0d12a; https://git.kernel.org/stable/c/7236aae5f81f3efbd93d0601e74fc05994bc2580
CVE: CVE-2022-50519
Published: 2025-10-07
Description: In the Linux kernel, the following vulnerability has been resolved:

nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure

If creation or finalization of a checkpoint fails due to anomalies in the
checkpoint metadata on disk, a kernel warning is generated.

This patch replaces the WARN_ONs by nilfs_error, so that a kernel, booted
with panic_on_warn, does not panic.  A nilfs_error is appropriate here to
handle the abnormal filesystem condition.

This also replaces the detected error codes with an I/O error so that
neither of the internal error codes is returned to callers.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/090fcfb6edeb9367a915b2749e2bd1f8b48d8898; https://git.kernel.org/stable/c/259c0f68168ac6a598db3486597b10e74d625db0; https://git.kernel.org/stable/c/5c0776b5bc31de7cd28afb558fae37a20f33602e
CVE: CVE-2022-50520
Published: 2025-10-07
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()

As comment of pci_get_class() says, it returns a pci_device with its
refcount increased and decreased the refcount for the input parameter
@from if it is not NULL.

If we break the loop in radeon_atrm_get_bios() with 'pdev' not NULL, we
need to call pci_dev_put() to decrease the refcount. Add the missing
pci_dev_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1079df6acf56f99d86b0081a38c84701412cc90e; https://git.kernel.org/stable/c/3991d98a8a07b71c02f3a39f77d6d9a7f575a5c4; https://git.kernel.org/stable/c/470a77989037c3ab2b08bf2d026d2c0ddc35ff5b
CVE: CVE-2022-50521
Published: 2025-10-07
Description: In the Linux kernel, the following vulnerability has been resolved:

platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()

The ACPI buffer memory (out.pointer) returned by wmi_evaluate_method()
is not freed after the call, so it leads to memory leak.

The method results in ACPI buffer is not used, so just pass NULL to
wmi_evaluate_method() which fixes the memory leak.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/14bb4bde3b7b2584734b13747b345caeeb41bea3; https://git.kernel.org/stable/c/17cd8c46cbec4e6ad593fb9159928b8e7608c11a; https://git.kernel.org/stable/c/379e7794c5e7485193d25d73614fbbd1e1387f6f
CVE: CVE-2022-50522
Published: 2025-10-07
Description: In the Linux kernel, the following vulnerability has been resolved:

mcb: mcb-parse: fix error handing in chameleon_parse_gdd()

If mcb_device_register() returns error in chameleon_parse_gdd(), the refcount
of bus and device name are leaked. Fix this by calling put_device() to give up
the reference, so they can be released in mcb_release_dev() and kobject_cleanup().
CVSS Score: 3.3 (LOW)
References: https://git.kernel.org/stable/c/110dc34c9fa33d37f55b394b1199ea6c0ad1ee84; https://git.kernel.org/stable/c/43bfc7c2402a22d3b4eb08c040f274ba2b76461a; https://git.kernel.org/stable/c/4a9f1a8b3af287581ffb690d0e1593c681729ddb
CVE: CVE-2022-50523
Published: 2025-10-07
Description: In the Linux kernel, the following vulnerability has been resolved:

clk: rockchip: Fix memory leak in rockchip_clk_register_pll()

If clk_register() fails, @pll->rate_table may have allocated memory by
kmemdup(), so it needs to be freed, otherwise will cause memory leak
issue, this patch fixes it.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/20201c3a0a32f127fa4bdf379d6ac01c2978702d; https://git.kernel.org/stable/c/26b94635f1c84d7f6cb482179125cb17e59c90a5; https://git.kernel.org/stable/c/5b0a1f1247cd42ac5e0d369f8dbb58762692edee
CVE: CVE-2022-50524
Published: 2025-10-07
Description: In the Linux kernel, the following vulnerability has been resolved:

iommu/mediatek: Check return value after calling platform_get_resource()

platform_get_resource() may return NULL pointer, we need check its
return value to avoid null-ptr-deref in resource_size().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/73b6924cdebc899de9b719e1319aa86c6bed4acf; https://git.kernel.org/stable/c/bfebf05883cdcf9ac983033987fae869bd59ca53; https://git.kernel.org/stable/c/feca904412483b2e0a903dd1f2e2843afd445f8c
CVE: CVE-2022-50525
Published: 2025-10-07
Description: In the Linux kernel, the following vulnerability has been resolved:

iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe()

The fsl_pamu_probe() returns directly when create_csd() failed, leaving
irq and memories unreleased.
Fix by jumping to error if create_csd() returns error.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/0d240ac0e4c35d3f64fc782c11433138c1bd016e; https://git.kernel.org/stable/c/17fd440594961c5e2ea0f58591bc1bdba0629c75; https://git.kernel.org/stable/c/73f5fc5f884ad0c5f7d57f66303af64f9f002526
CVE: CVE-2022-50526
Published: 2025-10-07
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/msm/dp: fix memory corruption with too many bridges

Add the missing sanity check on the bridge counter to avoid corrupting
data beyond the fixed-sized bridge array in case there are ever more
than eight bridges.

Patchwork: https://patchwork.freedesktop.org/patch/502664/
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/74466e46e7543c7f74f1502181e9ba93f7521374; https://git.kernel.org/stable/c/b312fcab461bd9484c61409007a6fe059f9c2074
CVE: CVE-2022-50527
Published: 2025-10-07
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix size validation for non-exclusive domains (v4)

Fix amdgpu_bo_validate_size() to check whether the TTM domain manager for the
requested memory exists, else we get a kernel oops when dereferencing "man".

v2: Make the patch standalone, i.e. not dependent on local patches.
v3: Preserve old behaviour and just check that the manager pointer is not
    NULL.
v4: Complain if GTT domain requested and it is uninitialized--most likely a
    bug.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/7554886daa31eacc8e7fac9e15bbce67d10b8f1f; https://git.kernel.org/stable/c/80546eef216854a7bd47e39e828f04b406c00599; https://git.kernel.org/stable/c/8ba7c55e112f4ffd2a95b99be1cb1c891ef08ba1
CVE: CVE-2022-50528
Published: 2025-10-07
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix memory leakage

This patch fixes potential memory leakage and seg fault
in  _gpuvm_import_dmabuf() function
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/7356d8e367d0e025a568e369c4cf575722cac60f; https://git.kernel.org/stable/c/75818afff631e1ea785a82c3e8bb82eb0dee539c; https://git.kernel.org/stable/c/8876793e56ec69b3be2a883b4bc440df3dbb1865