deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-11679
Published: 2025-10-20
Description: Out-of-bounds Read in lws_upng_emit_next_line in warmcat libwebsockets allows, when the LWS_WITH_UPNG flag is enabled during compilation and the HTML display stack is used, to read past a heap allocated buffer possibly causing a crash, when the user visits an attacker controlled website that contains a crafted PNG file with a big height dimension.
CWE: CWE-125
References: https://libwebsockets.org/git/libwebsockets/commit?id=7df24cca7144d7bc9233b6b0a71108bd154ce101; https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11679
CVE: CVE-2025-11680
Published: 2025-10-20
Description: Out-of-bounds Write in unfilter_scanline in warmcat libwebsockets allows, when the LWS_WITH_UPNG flag is enabled during compilation and the HTML display stack is used, to write past a heap allocated buffer possibly causing a crash, when the user visits an attacker controlled website that contains a crafted PNG file with a big width value that causes an integer overflow which value is used for determining the size of a heap allocation.
CWE: CWE-787
References: https://libwebsockets.org/git/libwebsockets/commit?id=2b715249f39291c86443b969a1088d59b6a89b78; https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11680
CVE: CVE-2025-61455
Published: 2025-10-20
Description: SQL Injection vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the signup.inc.php endpoint. The application directly incorporates unsanitized user inputs into SQL queries, allowing unauthenticated attackers to bypass authentication and gain full access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/tansique-17/CVE-2025-61455
CVE: CVE-2025-41390
Published: 2025-10-20
Description: An arbitrary code execution vulnerability exists in the git functionality of Truffle Security Co. TruffleHog 3.90.2. A specially crafted repository can lead to a arbitrary code execution. An attacker can provide a malicious respository to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-829
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2243; https://trufflesecurity.com/blog/contributor-spotlight-adam-reiser-of-cisco-talos; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2243
CVE: CVE-2025-54957
Published: 2025-10-20
Description: An issue was discovered in Dolby UDC 4.5 through 4.13. A crash of the DD+ decoder process can occur when a malformed DD+ bitstream is processed. When Evolution data is processed by evo_priv.c from the DD+ bitstream, the decoder writes that data into a buffer. The length calculation for a write can overflow due to an integer wraparound. This can lead to the allocated buffer being too small, and the out-of-bounds check of the subsequent write to be ineffective, leading to an out-of-bounds write.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-787
References: https://professional.dolby.com/siteassets/pdfs/dolby-security-advisory-CVE-2025-54957-Oct-14-25.pdf; https://project-zero.issues.chromium.org/issues/428075495; https://projectzero.google/2026/01/pixel-0-click-part-1.html
CVE: CVE-2025-57738
Published: 2025-10-20
Description: Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machinery is set for runtime reload.
Such a feature has been available for a while, but recently it was discovered that a malicious administrator can inject Groovy code that can be executed remotely by a running Apache Syncope Core instance.
Users are recommended to upgrade to version 3.0.14 / 4.0.2, which fix this issue by forcing the Groovy code to run in a sandbox.
CVSS Score: 7.2 (HIGH)
CWE: CWE-653
References: https://lists.apache.org/thread/x7cv6xv7z76y49grdr1hgj1pzw5zbby6; http://www.openwall.com/lists/oss-security/2025/10/20/1
CVE: CVE-2025-61417
Published: 2025-10-20
Description: Cross-Site Scripting (XSS) vulnerability exists in TastyIgniter 3.7.7, affecting the /admin/media_manager component. Attackers can upload a malicious SVG file containing JavaScript code. When an administrator previews the file, the code executes in their browser context, allowing the attacker to perform unauthorized actions such as modifying the admin account credentials.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-434
References: https://github.com/mg7-x/CVEs/blob/main/CVE-2025-61417/README.md; https://github.com/tastyigniter/TastyIgniter
CVE: CVE-2025-61456
Published: 2025-10-20
Description: A Cross-Site Scripting (XSS) vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the index endpoint. Unsanitized input in the /index parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who visits a malicious link or submits a crafted request.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/tansique-17/CVE-2025-61456
CVE: CVE-2025-8884
Published: 2025-10-20
Description: Authorization Bypass Through User-Controlled Key vulnerability in VHS Electronic Software Ltd. Co. ACE Center allows Privilege Abuse, Exploitation of Trusted Identifiers.This issue affects ACE Center: from 3.10.100.1768 before 3.10.161.2255.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-639
References: https://www.usom.gov.tr/bildirim/tr-25-0348
CVE: CVE-2024-55568
Published: 2025-10-20
Description: An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400. The absence of a NULL check leads to a Denial of Service when an attacker sends malformed MM packets to the target.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-55568/
CVE: CVE-2025-10678
Published: 2025-10-20
Description: NetBird VPN when installed using vendor's provided script failed to remove or change default password of an admin account created by ZITADEL.
This issue affects instances installed using vendor's provided script. This issue may affect instances created with Docker if the default password was not changed nor the user was removed.

This issue has been fixed in version 0.57.0
CWE: CWE-1392
References: https://cert.pl/en/posts/2025/10/CVE-2025-10678; https://netbird.io/
CVE: CVE-2025-26781
Published: 2025-10-20
Description: An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 9110, W920, W930, Modem 5123, and Modem 5300. Incorrect handling of RLC AM PDUs leads to a Denial of Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-119
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-26781/
CVE: CVE-2025-26782
Published: 2025-10-20
Description: An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 9110, W920, W930, Modem 5123, and Modem 5300. Incorrect handling of RLC AM PDUs leads to a Denial of Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-26782/
CVE: CVE-2025-40005
Published: 2025-10-20
Description: In the Linux kernel, the following vulnerability has been resolved:

spi: cadence-quadspi: Implement refcount to handle unbind during busy

driver support indirect read and indirect write operation with
assumption no force device removal(unbind) operation. However
force device removal(removal) is still available to root superuser.

Unbinding driver during operation causes kernel crash. This changes
ensure driver able to handle such operation for indirect read and
indirect write by implementing refcount to track attached devices
to the controller and gracefully wait and until attached devices
remove operation completed before proceed with removal operation.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/56787f4a75907ae99b5f5842b756fa68e2482f6d; https://git.kernel.org/stable/c/65ed52200080eafce3eead05cf22ce01238defca; https://git.kernel.org/stable/c/[PII_REDACTED]e8ef694fb[PII_REDACTED]49c773eefb3
CVE: CVE-2025-40006
Published: 2025-10-20
Description: In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix folio is still mapped when deleted

Migration may be raced with fallocating hole.  remove_inode_single_folio
will unmap the folio if the folio is still mapped.  However, it's called
without folio lock.  If the folio is migrated and the mapped pte has been
converted to migration entry, folio_mapped() returns false, and won't
unmap it.  Due to extra refcount held by remove_inode_single_folio,
migration fails, restores migration entry to normal pte, and the folio is
mapped again.  As a result, we triggered BUG in filemap_unaccount_folio.

The log is as follows:
 BUG: Bad page cache in process hugetlb  pfn:156c00
 page: refcount:515 mapcount:0 mapping:[PII_REDACTED]fef6e1 index:0x0 pfn:0x156c00
 head: order:9 mapcount:1 entire_mapcount:1 nr_pages_mapped:0 pincount:0
 aops:hugetlbfs_aops ino:dcc dentry name(?):"my_hugepage_file"
 flags: 0x17ffffc00000c1(locked|waiters|head|node=0|zone=2|lastcpupid=0x1fffff)
 page_type: f4(hugetlb)
 page dumped because: still mapped when deleted
 CPU: 1 UID: 0 PID: 395 Comm: hugetlb Not tainted 6.17.0-rc5-00044-g7aac71907bde-dirty #484 NONE
 Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015
 Call Trace:
  <TASK>
  dump_stack_lvl+0x4f/0x70
  filemap_unaccount_folio+0xc4/0x1c0
  __filemap_remove_folio+0x38/0x1c0
  filemap_remove_folio+0x41/0xd0
  remove_inode_hugepages+0x142/0x250
  hugetlbfs_fallocate+0x471/0x5a0
  vfs_fallocate+0x149/0x380

Hold folio lock before checking if the folio is mapped to avold race with
migration.
References: https://git.kernel.org/stable/c/21ee79ce938127f88fe07e409c1817f477dbe7ea; https://git.kernel.org/stable/c/3e851448078f5b01f6264915df3cfef75e323a12; https://git.kernel.org/stable/c/7b7387650dcf2881fd8bb55bcf3c8bd6c9542dd7
CVE: CVE-2025-40007
Published: 2025-10-20
Description: In the Linux kernel, the following vulnerability has been resolved:

netfs: fix reference leak

Commit 20d72b00ca81 ("netfs: Fix the request's work item to not
require a ref") modified netfs_alloc_request() to initialize the
reference counter to 2 instead of 1.  The rationale was that the
requet's "work" would release the second reference after completion
(via netfs_{read,write}_collection_worker()).  That works most of the
time if all goes well.

However, it leaks this additional reference if the request is released
before the I/O operation has been submitted: the error code path only
decrements the reference counter once and the work item will never be
queued because there will never be a completion.

This has caused outages of our whole server cluster today because
tasks were blocked in netfs_wait_for_outstanding_io(), leading to
deadlocks in Ceph (another bug that I will address soon in another
patch).  This was caused by a netfs_pgpriv2_begin_copy_to_cache() call
which failed in fscache_begin_write_operation().  The leaked
netfs_io_request was never completed, leaving `netfs_inode.io_count`
with a positive value forever.

All of this is super-fragile code.  Finding out which code paths will
lead to an eventual completion and which do not is hard to see:

- Some functions like netfs_create_write_req() allocate a request, but
  will never submit any I/O.

- netfs_unbuffered_read_iter_locked() calls netfs_unbuffered_read()
  and then netfs_put_request(); however, netfs_unbuffered_read() can
  also fail early before submitting the I/O request, therefore another
  netfs_put_request() call must be added there.

A rule of thumb is that functions that return a `netfs_io_request` do
not submit I/O, and all of their callers must be checked.

For my taste, the whole netfs code needs an overhaul to make reference
counting easier to understand and less fragile & obscure.  But to fix
this bug here and now and produce a patch that is adequate for a
stable backport, I tried a minimal approach that quickly frees the
request object upon early failure.

I decided against adding a second netfs_put_request() each time
because that would cause code duplication which obscures the code
further.  Instead, I added the function netfs_put_failed_request()
which frees such a failed request synchronously under the assumption
that the reference count is exactly 2 (as initially set by
netfs_alloc_request() and never touched), verified by a
WARN_ON_ONCE().  It then deinitializes the request object (without
going through the "cleanup_work" indirection) and frees the allocation
(with RCU protection to protect against concurrent access by
netfs_requests_seq_start()).

All code paths that fail early have been changed to call
netfs_put_failed_request() instead of netfs_put_request().
Additionally, I have added a netfs_put_request() call to
netfs_unbuffered_read() as explained above because the
netfs_put_failed_request() approach does not work there.
References: https://git.kernel.org/stable/c/4d428dca252c858bfac691c31fa95d26cd008706; https://git.kernel.org/stable/c/8df142e93098b4531fadb5dfcf93087649f570b3
CVE: CVE-2025-40008
Published: 2025-10-20
Description: In the Linux kernel, the following vulnerability has been resolved:

kmsan: fix out-of-bounds access to shadow memory

Running sha224_kunit on a KMSAN-enabled kernel results in a crash in
kmsan_internal_set_shadow_origin():

    BUG: unable to handle page fault for address: ffffbc[PII_REDACTED]
    #PF: supervisor read access in kernel mode
    #PF: error_code(0x0000) - not-present page
    PGD 1810067 P4D 1810067 PUD 192d067 PMD 3c17067 PTE 0
    Oops: 0000 [#1] SMP NOPTI
    CPU: 0 UID: 0 PID: 81 Comm: kunit_try_catch Tainted: G                 N  6.17.0-rc3 #10 PREEMPT(voluntary)
    Tainted: [N]=TEST
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
    RIP: 0010:kmsan_internal_set_shadow_origin+0x91/0x100
    [...]
    Call Trace:
    <TASK>
    __msan_memset+0xee/0x1a0
    sha224_final+0x9e/0x350
    test_hash_buffer_overruns+0x46f/0x5f0
    ? kmsan_get_shadow_origin_ptr+0x46/0xa0
    ? __pfx_test_hash_buffer_overruns+0x10/0x10
    kunit_try_run_case+0x198/0xa00

This occurs when memset() is called on a buffer that is not 4-byte aligned
and extends to the end of a guard page, i.e.  the next page is unmapped.

The bug is that the loop at the end of kmsan_internal_set_shadow_origin()
accesses the wrong shadow memory bytes when the address is not 4-byte
aligned.  Since each 4 bytes are associated with an origin, it rounds the
address and size so that it can access all the origins that contain the
buffer.  However, when it checks the corresponding shadow bytes for a
particular origin, it incorrectly uses the original unrounded shadow
address.  This results in reads from shadow memory beyond the end of the
buffer's shadow memory, which crashes when that memory is not mapped.

To fix this, correctly align the shadow address before accessing the 4
shadow bytes corresponding to each origin.
References: https://git.kernel.org/stable/c/5855792c6bb9a825607845db3feaddaff0414ec3; https://git.kernel.org/stable/c/85e1ff61060a765d91ee62dc5606d4d547d9d105; https://git.kernel.org/stable/c/df1fa034c0fc229a63d01ffb20bb919b839cb576
CVE: CVE-2025-40009
Published: 2025-10-20
Description: In the Linux kernel, the following vulnerability has been resolved:

fs/proc/task_mmu: check p->vec_buf for NULL

When the PAGEMAP_SCAN ioctl is invoked with vec_len = 0 reaches
pagemap_scan_backout_range(), kernel panics with null-ptr-deref:

[   44.936808] Oops: general protection fault, probably for non-canonical address 0xdffffc[PII_REDACTED]: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI
[   44.937797] KASAN: null-ptr-deref in range [0x[PII_REDACTED]000000-0x[PII_REDACTED]000007]
[   44.938391] CPU: 1 UID: 0 PID: 2480 Comm: reproducer Not tainted 6.17.0-rc6 #22 PREEMPT(none)
[   44.939062] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[   44.939935] RIP: 0010:pagemap_scan_thp_entry.isra.0+0x741/0xa80

<snip registers, unreliable trace>

[   44.946828] Call Trace:
[   44.947030]  <TASK>
[   44.949219]  pagemap_scan_pmd_entry+0xec/0xfa0
[   44.952593]  walk_pmd_range.isra.0+0x302/0x910
[   44.954069]  walk_pud_range.isra.0+0x419/0x790
[   44.954427]  walk_p4d_range+0x41e/0x620
[   44.954743]  walk_pgd_range+0x31e/0x630
[   44.955057]  __walk_page_range+0x160/0x670
[   44.956883]  walk_page_range_mm+0x408/0x980
[   44.958677]  walk_page_range+0x66/0x90
[   44.958984]  do_pagemap_scan+0x28d/0x9c0
[   44.961833]  do_pagemap_cmd+0x59/0x80
[   44.962484]  __x64_sys_ioctl+0x18d/0x210
[   44.962804]  do_syscall_64+0x5b/0x290
[   44.963111]  entry_SYSCALL_64_after_hwframe+0x76/0x7e

vec_len = 0 in pagemap_scan_init_bounce_buffer() means no buffers are
allocated and p->vec_buf remains set to NULL.

This breaks an assumption made later in pagemap_scan_backout_range(), that
page_region is always allocated for p->vec_buf_index.

Fix it by explicitly checking p->vec_buf for NULL before dereferencing.

Other sites that might run into same deref-issue are already (directly or
transitively) protected by checking p->vec_buf.

Note:
From PAGEMAP_SCAN man page, it seems vec_len = 0 is valid when no output
is requested and it's only the side effects caller is interested in,
hence it passes check in pagemap_scan_get_args().

This issue was found by syzkaller.
References: https://git.kernel.org/stable/c/28aa29986dde79e8466bc[PII_REDACTED]1053833f5; https://git.kernel.org/stable/c/a2cb8818a3d915cd33a1e8b2babc1bb0c34862c3; https://git.kernel.org/stable/c/ca988dcdc6683ecd9de5f525ce469588a9141c21
CVE: CVE-2025-40010
Published: 2025-10-20
Description: In the Linux kernel, the following vulnerability has been resolved:

afs: Fix potential null pointer dereference in afs_put_server

afs_put_server() accessed server->debug_id before the NULL check, which
could lead to a null pointer dereference. Move the debug_id assignment,
ensuring we never dereference a NULL server pointer.
References: https://git.kernel.org/stable/c/41782c44bb8431c43043129ae42f2ba614938479; https://git.kernel.org/stable/c/7b8381f3c405b864a814d747e526e078c3ef4bc2; https://git.kernel.org/stable/c/9158c6bb245113d4966df9b2ba602197a379412e
CVE: CVE-2025-40011
Published: 2025-10-20
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/gma500: Fix null dereference in hdmi teardown

pci_set_drvdata sets the value of pdev->driver_data to NULL,
after which the driver_data obtained from the same dev is
dereferenced in oaktrail_hdmi_i2c_exit, and the i2c_dev is
extracted from it. To prevent this, swap these calls.

Found by Linux Verification Center (linuxtesting.org) with Svacer.
References: https://git.kernel.org/stable/c/02e4ff4941efb9bbb40d8d5b61efa1a4119b1ba7; https://git.kernel.org/stable/c/0fc650fa475b50c1da8236c5e900b9460c7027bc; https://git.kernel.org/stable/c/352e66900cde63f3dadb142364d3c35170bbaaff
CVE: CVE-2025-40012
Published: 2025-10-20
Description: In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix warning in smc_rx_splice() when calling get_page()

smc_lo_register_dmb() allocates DMB buffers with kzalloc(), which are
later passed to get_page() in smc_rx_splice(). Since kmalloc memory is
not page-backed, this triggers WARN_ON_ONCE() in get_page() and prevents
holding a refcount on the buffer. This can lead to use-after-free if
the memory is released before splice_to_pipe() completes.

Use folio_alloc() instead, ensuring DMBs are page-backed and safe for
get_page().

WARNING: CPU: 18 PID: 12152 at ./include/linux/mm.h:1330 smc_rx_splice+0xaf8/0xe20 [smc]
CPU: 18 UID: 0 PID: 12152 Comm: smcapp Kdump: loaded Not tainted 6.17.0-rc3-11705-g9cf4672ecfee #10 NONE
Hardware name: IBM 3931 A01 704 (z/VM 7.4.0)
Krnl PSW : 0704e[PII_REDACTED]0[PII_REDACTED]32696c (smc_rx_splice+0xafc/0xe20 [smc])
           R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3
Krnl GPRS: [PII_REDACTED] 001cee80007d3[PII_REDACTED]0000000f8 [PII_REDACTED]
           [PII_REDACTED] 001cee80007d3006 [PII_REDACTED] 001c[PII_REDACTED]00
           000000009b0c99e0 [PII_REDACTED] 001c[PII_REDACTED]f8 001c[PII_REDACTED]00
           000003ffcc6f7c88[PII_REDACTED]e98000 [PII_REDACTED] 000792969b2ff7b8
Krnl Code: [PII_REDACTED]: af000000		mc	0,0
           [PII_REDACTED]: a7f4ff43		brc	15,[PII_REDACTED]3267ea
          #[PII_REDACTED]: af000000		mc	0,0
          >[PII_REDACTED]32696c: a7f4ff3f		brc	15,[PII_REDACTED]3267ea
           [PII_REDACTED]: e320f1000004	lg	%r2,256(%r15)
           [PII_REDACTED]: c0e53fd1b5f5	brasl	%r14,000793168fd5d560
          [PII_REDACTED]32697c: a7f4fbb5		brc	15,[PII_REDACTED]3260e6
           [PII_REDACTED]: b904002b		lgr	%r2,%r11
Call Trace:
 smc_rx_splice+0xafc/0xe20 [smc]
 smc_rx_splice+0x756/0xe20 [smc])
 smc_rx_recvmsg+0xa74/0xe00 [smc]
 smc_splice_read+0x1ce/0x3b0 [smc]
 sock_splice_read+0xa2/0xf0
 do_splice_read+0x198/0x240
 splice_file_to_pipe+0x7e/0x110
 do_splice+0x59e/0xde0
 __do_splice+0x11a/0x2d0
 __s390x_sys_splice+0x140/0x1f0
 __do_syscall+0x122/0x280
 system_call+0x6e/0x90
Last Breaking-Event-Address:
smc_rx_splice+0x960/0xe20 [smc]
---[ end trace [PII_REDACTED] ]---
References: https://git.kernel.org/stable/c/14fc4fdae42e34d7ee871b292ac2ecc61c2c5de7; https://git.kernel.org/stable/c/a35c04de2565db191726b5741e6b66a35002c652; https://git.kernel.org/stable/c/d5411685dc2f6ac7bdf01a0a204d56cae38c6cf6
CVE: CVE-2025-40013
Published: 2025-10-20
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: qcom: audioreach: fix potential null pointer dereference

It is possible that the topology parsing function
audioreach_widget_load_module_common() could return NULL or an error
pointer. Add missing NULL check so that we do not dereference it.
References: https://git.kernel.org/stable/c/4dda55d04caac3b4102c26e29b1c27fa35636be3; https://git.kernel.org/stable/c/70e1e5fe9f7e05ff831b56ebc02543e7811b8e18; https://git.kernel.org/stable/c/8318e04ab2526b155773313b66a1542476ce1106
CVE: CVE-2025-40015
Published: 2025-10-20
Description: In the Linux kernel, the following vulnerability has been resolved:

media: stm32-csi: Fix dereference before NULL check

In 'stm32_csi_start', 'csidev->s_subdev' is dereferenced directly while
assigning a value to the 'src_pad'. However the same value is being
checked against NULL at a later point of time indicating that there
are chances that the value can be NULL.

Move the dereference after the NULL check.
References: https://git.kernel.org/stable/c/1f053d82e59c785b2b939cbed12f13657f84b296; https://git.kernel.org/stable/c/4eeafff163e80d576c5efc1360ae310c0ceedd02; https://git.kernel.org/stable/c/80eaf32672871bd2623ce6ba13ffc1f018756580
CVE: CVE-2025-40017
Published: 2025-10-20
Description: In the Linux kernel, the following vulnerability has been resolved:

media: iris: Fix memory leak by freeing untracked persist buffer

One internal buffer which is allocated only once per session was not
being freed during session close because it was not being tracked as
part of internal buffer list which resulted in a memory leak.

Add the necessary logic to explicitly free the untracked internal buffer
during session close to ensure all allocated memory is released
properly.
References: https://git.kernel.org/stable/c/02a24f13b3a1d9da9f3de56aa5fdb7cc1fe167a2; https://git.kernel.org/stable/c/c9e024e907cafafd6b094f69a0d0f5d18fd28876; https://git.kernel.org/stable/c/ec2f87ad035e8d1ad[PII_REDACTED]2f1f23a4dbde2