deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-10629
Published: 2025-09-18
Description: A vulnerability was determined in D-Link DIR-852 1.00CN B09. This issue affects the function ssdpcgi_main of the file htodcs/cgibin of the component Simple Service Discovery Protocol Service. Executing manipulation of the argument ST can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/i-Corner/cve/issues/30; https://vuldb.com/?ctiid.324659; https://vuldb.com/?id.324659
CVE: CVE-2025-10631
Published: 2025-09-18
Description: A vulnerability was identified in itsourcecode Online Petshop Management System 1.0. Impacted is an unknown function of the file addcnp.php of the component Available Products Page. The manipulation of the argument name/description leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/drew-byte/Online-Pet-Shop-Management-System-Stored-XSS-PoC/blob/main/README.md; https://itsourcecode.com/; https://vuldb.com/?ctiid.324660
CVE: CVE-2025-10632
Published: 2025-09-18
Description: A security flaw has been discovered in itsourcecode Online Petshop Management System 1.0. The affected element is an unknown function of the file availableframe.php of the component Admin Dashboard. The manipulation of the argument name/address results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/drew-byte/Online-Pet-Shop-Management-System_AdminDashboard_Stored-XSS-PoC/blob/main/README.md; https://itsourcecode.com/; https://vuldb.com/?ctiid.324661
CVE: CVE-2025-10634
Published: 2025-09-18
Description: A weakness has been identified in D-Link DIR-823X 240126/240802/250416. The impacted element is the function sub_412E7C of the file /usr/sbin/goahead of the component Environment Variable Handler. This manipulation of the argument terminal_addr/server_ip/server_port causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/Cpppq43/D-Link/blob/main/DIink-DIR-823x.md; https://pan.baidu.com/s/1dWnXEa58P0KHw53L9U_PoQ; https://vuldb.com/?ctiid.324662
CVE: CVE-2025-10642
Published: 2025-09-18
Description: A vulnerability has been found in wangchenyi1996 chat_forum up to 80bdb92f5b460d36cab36e530a2c618acef5afd2. This impacts an unknown function of the file /q.php. Such manipulation of the argument path leads to cross site scripting. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/wangchenyi1996/chat_forum/blob/master/q.php#L31; https://vuldb.com/?ctiid.324675; https://vuldb.com/?id.324675
CVE: CVE-2023-49564
Published: 2025-09-18
Description: The CBIS/NCS Manager API is vulnerable to an authentication bypass. By sending a specially crafted HTTP header, an unauthenticated user can gain unauthorized access to API functions. This flaw allows attackers to reach restricted or sensitive endpoints of the HTTP API without providing any valid credentials. The root cause of this vulnerability lies in a weak verification mechanism within the authentication implementation present in the Nginx Podman container on the CBIS/NCS Manager host machine.
The risk can be partially mitigated by restricting access to the management network using external firewall.
CVSS Score: 8.8 (HIGH)
CWE: CWE-288
References: https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/CVE-2023-49564/
CVE: CVE-2023-49565
Published: 2025-09-18
Description: The cbis_manager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. Improper sanitization of the HTTP Headers X-FILENAME, X-PAGE, and X-FIELD allows for command injection. These headers are directly utilized within the subprocess.Popen Python function without adequate validation, enabling a remote attacker to execute arbitrary commands on the underlying system by crafting malicious header values within an HTTP request to the affected endpoint.
The web service executes with root privileges within the container environment, the demonstrated remote code execution permits an attacker to acquire elevated privileges for the command execution.
Restricting access to the management network with an external firewall can partially mitigate this risk.
CVSS Score: 8.4 (HIGH)
CWE: CWE-77
References: https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/CVE-2023-49565/
CVE: CVE-2025-5305
Published: 2025-09-18
Description: The Password Reset with Code for WordPress REST API WordPress plugin before 0.0.17 does not use cryptographically sound algorithms to generate OTP codes, potentially leading to account takeovers.
CVSS Score: 9.8 (CRITICAL)
References: https://wpscan.com/vulnerability/dcf5c003-91b0-4e7d-89f3-7459d8f01153/; https://wpscan.com/vulnerability/dcf5c003-91b0-4e7d-89f3-7459d8f01153/
CVE: CVE-2025-8942
Published: 2025-09-18
Description: The WP Hotel Booking WordPress plugin before 2.2.3 lacks proper server-side validation for review ratings, allowing an attacker to manipulate the rating value (e.g., sending negative or out-of-range values) by intercepting and modifying requests.
CVSS Score: 9.1 (CRITICAL)
References: https://wpscan.com/vulnerability/d89bb3b2-40ad-4c4f-9f17-4ccacc0f6e1a/; https://wpscan.com/vulnerability/d89bb3b2-40ad-4c4f-9f17-4ccacc0f6e1a/
CVE: CVE-2025-9083
Published: 2025-09-18
Description: The Ninja Forms  WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://wpscan.com/vulnerability/60b4d7fc-5d23-4dcf-bd7f-e202cabc2625/; https://wpscan.com/vulnerability/60b4d7fc-5d23-4dcf-bd7f-e202cabc2625/
CVE: CVE-2025-10493
Published: 2025-09-18
Description: The Chained Quiz plugin for WordPress is vulnerable to Insecure Direct Object Reference in version 1.3.4 and below via the quiz submission and completion mechanisms due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to hijack and modify other users' quiz attempts by manipulating the chained_completion_id cookie value, allowing them to alter quiz answers, scores, and results of any user. The vulnerability was partially patched in versions 1.3.4 and 1.3.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/browser/chained-quiz/tags/1.3.3/controllers/quizzes.php; https://plugins.trac.wordpress.org/browser/chained-quiz/tags/1.3.3/models/quiz.php; https://plugins.trac.wordpress.org/changeset/3362561/
CVE: CVE-2025-0547
Published: 2025-09-18
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Paraşüt Software Bizmu allows Cross-Site Scripting (XSS).This issue affects Bizmu: from 2.27.0 through 20250212.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0272
CVE: CVE-2025-6237
Published: 2025-09-18
Description: A vulnerability in invokeai version v6.0.0a1 and below allows attackers to perform path traversal and arbitrary file deletion via the GET /api/v1/images/download/{bulk_download_item_name} endpoint. By manipulating the filename arguments, attackers can read and delete any files on the server, including critical system files such as SSH keys, databases, and configuration files. This vulnerability results in high confidentiality, integrity, and availability impacts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-73
References: https://huntr.com/bounties/54ac9589-7c88-4fd4-8512-8b2f19fbaedf; https://huntr.com/bounties/54ac9589-7c88-4fd4-8512-8b2f19fbaedf
CVE: CVE-2025-30187
Published: 2025-09-18
Description: In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources.
CVSS Score: 3.7 (LOW)
CWE: CWE-835
References: https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2025-05.html; http://www.openwall.com/lists/oss-security/2025/09/18/1
CVE: CVE-2025-8565
Published: 2025-09-18
Description: The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on the wplp_gdpr_install_plugin_ajax_handler() function in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with Contributor-level access and above, to install arbitrary repository plugins.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3355766%40wplegalpages%2Ftrunk&old=3348524%40wplegalpages%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ed5f2c6d-a548-44c1-a07a-e33999bb164d?source=cve
CVE: CVE-2025-9992
Published: 2025-09-18
Description: The Ghost Kit – Page Builder Blocks, Motion Effects & Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS field in all versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3359701/ghostkit/trunk/gutenberg/plugins/custom-code/index.php?old=3037555&old_path=ghostkit%2Ftrunk%2Fgutenberg%2Fplugins%2Fcustom-code%2Findex.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/a58bdc25-6171-47d5-bdcc-b4fe89b906f1?source=cve
CVE: CVE-2025-10662
Published: 2025-09-18
Description: A vulnerability has been found in SeaCMS up to 13.3. The impacted element is an unknown function of the file /admin_members.php?ac=editsave. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This affects another injection point than CVE-2025-25513.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/coolcj-stack/seacms-v13.3-sqli/blob/main/README.md; https://vuldb.com/?ctiid.324783; https://vuldb.com/?id.324783
CVE: CVE-2025-10663
Published: 2025-09-18
Description: A vulnerability was found in PHPGurukul Online Course Registration 3.1. This affects an unknown function of the file /my-profile.php. Performing manipulation of the argument cgpa results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/LitBot123/mycve/issues/8; https://phpgurukul.com/; https://vuldb.com/?ctiid.324784
CVE: CVE-2024-13151
Published: 2025-09-18
Description: CWE - 89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ESBI Information and Telecommunication Industry and Trade Limited Company Auto Service Software allows SQL Injection.This issue affects Auto Service Software: before v.2025.10.01.
CVSS Score: 9.8 (CRITICAL)
References: https://www.usom.gov.tr/bildirim/tr-25-0273
CVE: CVE-2024-25011
Published: 2025-09-18
Description: Ericsson Catalog Manager and Ericsson Order Care APIs do not have authentication enabled by default. Authentication checks can be configured to remediate the information disclosure issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://www.ericsson.com/en/about-us/security/psirt/cve-2024-25011
CVE: CVE-2024-48851
Published: 2025-09-18
Description: Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.A remote code execution is possible due to an improper input validation.




This issue affects FLXEON: through 9.3.5.
CVSS Score: 7.2 (HIGH)
CWE: CWE-1287
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A7121&LanguageCode=en&DocumentPartId=pdf&Action=Launch
CVE: CVE-2025-10207
Published: 2025-09-18
Description: Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5.
CVSS Score: 7.2 (HIGH)
CWE: CWE-1287
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A7121&LanguageCode=en&DocumentPartId=pdf&Action=Launch
CVE: CVE-2025-10664
Published: 2025-09-18
Description: A vulnerability was determined in PHPGurukul Small CRM 4.0. This impacts an unknown function of the file /create-ticket.php. Executing manipulation of the argument subject can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/HF101010/myCVE/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.324785
CVE: CVE-2025-10665
Published: 2025-09-18
Description: A vulnerability was identified in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. Affected is an unknown function of the file /Profilers/PProfile/COUNT3s3.php. The manipulation of the argument csem leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/qi-wm/cve/issues/1; https://vuldb.com/?ctiid.324786; https://vuldb.com/?id.324786
CVE: CVE-2025-40677
Published: 2025-09-18
Description: SQL injection vulnerability in Summar Software´s Portal del Empleado. This vulnerability allows an attacker to retrieve, create, update, and delete the database by sending a POST request using the parameter “ctl00$ContentPlaceHolder1$filtroNombre” in “/MemberPages/quienesquien.aspx”.
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-summar-software-employee-portal
CVE: CVE-2025-40678
Published: 2025-09-18
Description: Unrestricted upload vulnerability for dangerous file types on Summar Software´s Portal del Empleado. This vulnerability allows an attacker to upload a dangerous file type by sending a POST request using the parameter “cctl00$ContentPlaceHolder1$fuAdjunto” in “/MemberPages/ntf_absentismo.aspx”.
CWE: CWE-434
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-summar-software-employee-portal
CVE: CVE-2025-10666
Published: 2025-09-18
Description: A security flaw has been discovered in D-Link DIR-825 up to 2.10. Affected by this vulnerability is the function sub_4106d4 of the file apply.cgi. The manipulation of the argument countdown_time results in buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be exploited. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/panda666-888/vuls/blob/main/d-link/dir-825/apply.cgi.md; https://github.com/panda666-888/vuls/blob/main/d-link/dir-825/apply.cgi.md#poc; https://vuldb.com/?ctiid.324787
CVE: CVE-2025-10667
Published: 2025-09-18
Description: A weakness has been identified in itsourcecode Online Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file /members/compose_msg.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/S77code/CVE1/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.324788
CVE: CVE-2022-50376
Published: 2025-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init()

When insert and remove the orangefs module, there are memory leaked
as below:

unreferenced object 0xffff88816b0cc000 (size 2048):
  comm "insmod", pid 783, jiffies[PII_REDACTED] (age 65.512s)
  hex dump (first 32 bytes):
    6e 6f 6e 65 0a 00 00 00 00 00 00 00 00 00 00 00  none............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<[PII_REDACTED]ab7788>] kmalloc_trace+0x27/0xa0
    [<000000005b405fee>] orangefs_debugfs_init.cold+0xaf/0x17f
    [<00000000e5a0085b>] 0xffffffffa02780f9
    [<[PII_REDACTED]32d9f7>] do_one_initcall+0x87/0x2a0
    [<[PII_REDACTED]f22384>] do_init_module+0xdf/0x320
    [<[PII_REDACTED]63bdea>] load_module+0x2f98/0x3330
    [<[PII_REDACTED]cd4153>] __do_sys_finit_module+0x113/0x1b0
    [<[PII_REDACTED]0ae02b>] do_syscall_64+0x35/0x80
    [<00000000f11c03c7>] entry_SYSCALL_64_after_hwframe+0x46/0xb0

Use the golbal variable as the buffer rather than dynamic allocate to
slove the problem.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/0cd303aad220fafa595e0ed593e99aa51b90412b; https://git.kernel.org/stable/c/31720a2b109b3080eb77e97b8f6f50a27b4ae599; https://git.kernel.org/stable/c/786e5296f9e3b045d5ff9098514ce7b8ba1d890d
CVE: CVE-2022-50377
Published: 2025-09-18
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-50379
Published: 2025-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix race between quota enable and quota rescan ioctl

When enabling quotas, at btrfs_quota_enable(), after committing the
transaction, we change fs_info->quota_root to point to the quota root we
created and set BTRFS_FS_QUOTA_ENABLED at fs_info->flags. Then we try
to start the qgroup rescan worker, first by initializing it with a call
to qgroup_rescan_init() - however if that fails we end up freeing the
quota root but we leave fs_info->quota_root still pointing to it, this
can later result in a use-after-free somewhere else.

We have previously set the flags BTRFS_FS_QUOTA_ENABLED and
BTRFS_QGROUP_STATUS_FLAG_ON, so we can only fail with -EINPROGRESS at
btrfs_quota_enable(), which is possible if someone already called the
quota rescan ioctl, and therefore started the rescan worker.

So fix this by ignoring an -EINPROGRESS and asserting we can't get any
other error.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://git.kernel.org/stable/c/0efd9dfc00d677a1d0929319a6103cb2dfc41c22; https://git.kernel.org/stable/c/26b7c0ac49a3eea15559c9d84863736a6d1164b4; https://git.kernel.org/stable/c/331cd9461412e103d07595a10289de90004ac890
CVE: CVE-2022-50380
Published: 2025-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

mm: /proc/pid/smaps_rollup: fix no vma's null-deref

Commit 258f669e7e88 ("mm: /proc/pid/smaps_rollup: convert to single value
seq_file") introduced a null-deref if there are no vma's in the task in
show_smaps_rollup.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/33fc9e26b7cb39f0d4219c875a[PII_REDACTED]c225; https://git.kernel.org/stable/c/6bb8769326c46db3058780c0640dcc49d8187b24; https://git.kernel.org/stable/c/97898139ca9b81ba9322a585e07490983c53b55a
CVE: CVE-2022-50382
Published: 2025-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

padata: Always leave BHs disabled when running ->parallel()

A deadlock can happen when an overloaded system runs ->parallel() in the
context of the current task:

    padata_do_parallel
      ->parallel()
        pcrypt_aead_enc/dec
          padata_do_serial
            spin_lock(&reorder->lock) // BHs still enabled
              <interrupt>
                ...
                  __do_softirq
                    ...
                      padata_do_serial
                        spin_lock(&reorder->lock)

It's a bug for BHs to be on in _do_serial as Steffen points out, so
ensure they're off in the "current task" case like they are in
padata_parallel_worker to avoid this situation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://git.kernel.org/stable/c/17afa98bccec4f52203508b3f49b5f948c6fd6ac; https://git.kernel.org/stable/c/34c3a47d20ae55b3600fed733bf96eafe9c500d5; https://git.kernel.org/stable/c/6cfa9e60c0f88fdec6368e081ab968411cc706b1
CVE: CVE-2022-50383
Published: 2025-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

media: mediatek: vcodec: Can't set dst buffer to done when lat decode error

Core thread will call v4l2_m2m_buf_done to set dst buffer done for
lat architecture. If lat call v4l2_m2m_buf_done_and_job_finish to
free dst buffer when lat decode error, core thread will access kernel
NULL pointer dereference, then crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/3568ecd3f3a6d133ab7feffbba34955c8c79bbc4; https://git.kernel.org/stable/c/66d26ed30056e7d2da3e9c14125ffe6049a4f907; https://git.kernel.org/stable/c/eeb090420f3477eb[PII_REDACTED]409fc655c2b16c
CVE: CVE-2022-50384
Published: 2025-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

staging: vme_user: Fix possible UAF in tsi148_dma_list_add

Smatch report warning as follows:

drivers/staging/vme_user/vme_tsi148.c:1757 tsi148_dma_list_add() warn:
  '&entry->list' not removed from list

In tsi148_dma_list_add(), the error path "goto err_dma" will not
remove entry->list from list->entries, but entry will be freed,
then list traversal may cause UAF.

Fix by removeing it from list->entries before free().
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/stable/c/1f5661388f43df3ac106ce93e67d8d22b16a78ff; https://git.kernel.org/stable/c/357057ee55d3c99a5de5abe8150f7bca04f8e53b; https://git.kernel.org/stable/c/51c0ad3b7c5b01f[PII_REDACTED]a13f157b05fa56d
CVE: CVE-2022-50385
Published: 2025-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

NFS: Fix an Oops in nfs_d_automount()

When mounting from a NFSv4 referral, path->dentry can end up being a
negative dentry, so derive the struct nfs_server from the dentry
itself instead.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/35e3b6ae84935d0d7ff76cbdaa83411b0ad5e471; https://git.kernel.org/stable/c/5458bc0f9df639d83471ca384152cc62dbee0aeb; https://git.kernel.org/stable/c/6f3d56783fbed861e483736a7001bdafd0dddd53