deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-49214
Published: 2025-06-17
Description: An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code execution on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-477, CWE-502
References: https://success.trendmicro.com/en-US/solution/KA-0019928; https://www.zerodayinitiative.com/advisories/ZDI-25-371/
CVE: CVE-2025-49215
Published: 2025-06-17
Description: A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. 

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-242, CWE-89
References: https://success.trendmicro.com/en-US/solution/KA-0019928; https://www.zerodayinitiative.com/advisories/ZDI-25-372/
CVE: CVE-2025-49216
Published: 2025-06-17
Description: An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as an admin user and modify product configurations on affected installations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-477
References: https://success.trendmicro.com/en-US/solution/KA-0019928; https://www.zerodayinitiative.com/advisories/ZDI-25-373/
CVE: CVE-2025-49217
Published: 2025-06-17
Description: An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49213 but is in a different method.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-477, CWE-502
References: https://success.trendmicro.com/en-US/solution/KA-0019928; https://www.zerodayinitiative.com/advisories/ZDI-25-374/
CVE: CVE-2025-49218
Published: 2025-06-17
Description: A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. This is similar to, but not identical to CVE-2025-49215.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-89
References: https://success.trendmicro.com/en-US/solution/KA-0019928; https://www.zerodayinitiative.com/advisories/ZDI-25-375/
CVE: CVE-2025-49384
Published: 2025-06-17
Description: Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.
CVSS Score: 7.8 (HIGH)
CWE: CWE-64
References: https://helpcenter.trendmicro.com/en-us/article/TMKA-11112
CVE: CVE-2025-49385
Published: 2025-06-17
Description: Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.
CVSS Score: 7.8 (HIGH)
CWE: CWE-64
References: https://helpcenter.trendmicro.com/en-us/article/TMKA-18461; https://www.zerodayinitiative.com/advisories/ZDI-25-380/
CVE: CVE-2025-49824
Published: 2025-06-17
Description: conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.47.1, the travis_encrypt_binstar_token implementation in the conda-smithy package has been identified as vulnerable to an Oracle Padding Attack. This vulnerability results from the use of an outdated and insecure padding scheme during RSA encryption. A malicious actor with access to an oracle system can exploit this flaw by iteratively submitting modified ciphertexts and analyzing responses to infer the plaintext without possessing the private key. This issue has been patched in version 3.47.1.
CWE: CWE-200
References: https://github.com/conda-forge/conda-smithy/blob/46a06524eeeb7f59e0969c3967ce5f700643d322/conda_smithy/ci_register.py#L447; https://github.com/conda-forge/conda-smithy/commit/24cc0a55a363479e797c825be3a7f2603ef374a1; https://github.com/conda-forge/conda-smithy/security/advisories/GHSA-2xf4-hg9q-m58q
CVE: CVE-2025-49843
Published: 2025-06-17
Description: conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.47.1, the travis_headers function in the conda-smithy repository creates files with permissions exceeding 0o600, allowing read and write access beyond the intended user/owner. This violates the principle of least privilege, which mandates restricting file permissions to the minimum necessary. An attacker could exploit this to access configuration files in shared hosting environments. This issue has been patched in version 3.47.1.
CWE: CWE-276
References: https://github.com/conda-forge/conda-smithy/blob/1dc21086a476f6aeb6c1bad8bf58474bf3a8f8f0/conda_smithy/ci_register.py#L109-L111; https://github.com/conda-forge/conda-smithy/commit/24cc0a55a363479e797c825be3a7f2603ef374a1; https://github.com/conda-forge/conda-smithy/security/advisories/GHSA-h9v8-rrqg-3m95
CVE: CVE-2025-49593
Published: 2025-06-17
Description: Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. Prior to STS version 2.31.0 and LTS version 2.27.7, if a Portainer administrator can be convinced to register a malicious container registry, or an existing container registry can be taken over, HTTP Headers (including registry authentication credentials or Portainer session tokens) may be leaked to that registry. This issue has been patched in STS version 2.31.0 and LTS version 2.27.7.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: https://github.com/portainer/portainer/commit/384cb53c64af78af8e1ac7ef5b0f91bad530e989; https://github.com/portainer/portainer/commit/b767dcb27ed253b423facd2e04ef971985950fd3; https://github.com/portainer/portainer/security/advisories/GHSA-h5jw-8c32-xfv6
CVE: CVE-2025-49825
Published: 2025-06-17
Description: Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://github.com/gravitational/teleport/security/advisories/GHSA-8cqv-pj7f-pwpc
CVE: CVE-2025-49149
Published: 2025-06-17
Description: Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filtering of user input by web applications. Attackers can use website vulnerabilities to inject malicious script code into web pages. This may result in a cross-site scripting (XSS) attack when a user browses these web pages. At time of posting, there is no known patched version.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/langgenius/dify/security/advisories/GHSA-grmh-ww4v-5cgj
CVE: CVE-2025-23252
Published: 2025-06-18
Description: The NVIDIA NVDebug tool contains a vulnerability that may allow an actor to gain access to restricted components. A successful exploit of this vulnerability may lead to information disclosure.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-1244
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5651
CVE: CVE-2025-4413
Published: 2025-06-18
Description: The Pixabay Images plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pixabay_upload function in all versions up to, and including, 3.4. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/pixabay-images/trunk/pixabay-images.php#L177; https://www.wordfence.com/threat-intel/vulnerabilities/id/44e71dea-d736-49c2-a630-f42905ac6b4d?source=cve
CVE: CVE-2025-50202
Published: 2025-06-18
Description: Lychee is a free photo-management tool. In versions starting from 6.6.6 to before 6.6.10, an attacker can leak local files including environment variables, nginx logs, other user's uploaded images, and configuration secrets due to a path traversal exploit in SecurePathController.php. This issue has been patched in version 6.6.10.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/LycheeOrg/Lychee/blob/0709f5d984d4df77fc5e23a29a0231437e684e99/app/Http/Controllers/SecurePathController.php#L61; https://github.com/LycheeOrg/Lychee/commit/ae7270b7b47e4a284ea1f69d260e52d592711072; https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-6rj9-gm78-vhf9
CVE: CVE-2025-51381
Published: 2025-06-18
Description: An authentication bypass vulnerability exists in KCM3100 Ver1.4.2 and earlier. If this vulnerability is exploited, an attacker may bypass the authentication of the product from within the LAN to which the product is connected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://jvn.jp/en/jp/JVN46288336/; https://notices.jcom.co.jp/notice/93847.html
CVE: CVE-2025-4955
Published: 2025-06-18
Description: The tarteaucitron.io WordPress plugin before 1.9.5 uses query parameters from YouTube oEmbed URLs without sanitizing these parameters correctly, which could allow users with the contributor role and above to perform Stored Cross-site Scripting attacks.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b84a73a4-7e9b-4994-a9bb-ad47f7cf45da/
CVE: CVE-2025-1562
Published: 2025-06-18
Description: The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_or_activate_addon_plugins() function and a weak nonce hash in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to install arbitrary plugins on the site that can be leveraged to further infect a vulnerable site.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/wp-marketing-automations/tags/2.5.0/includes/api/plugin_status/class-bwfan-api-install-and-activate-plugin.php; https://plugins.trac.wordpress.org/browser/wp-marketing-automations/tags/2.5.0/includes/class-bwfan-db.php#L153; https://plugins.trac.wordpress.org/changeset/3305437/wp-marketing-automations/trunk/admin/class-bwfan-admin.php
CVE: CVE-2025-5981
Published: 2025-06-18
Description: Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-427, CWE-22
References: https://github.com/google/osv-scalibr/commit/2444419b1818c2d6917fc3394c947fb3276e9d59; https://github.com/google/osv-scalibr/releases/tag/v0.1.8
CVE: CVE-2025-1088
Published: 2025-06-18
Description: In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana.
This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.
CVSS Score: 2.7 (LOW)
CWE: CWE-20
References: https://grafana.com/security/security-advisories/cve-2025-1088/
CVE: CVE-2025-23999
Published: 2025-06-18
Description: Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.2.13.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/breeze/vulnerability/wordpress-breeze-plugin-2-2-13-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-38005
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

dmaengine: ti: k3-udma: Add missing locking

Recent kernels complain about a missing lock in k3-udma.c when the lock
validator is enabled:

[    4.128073] WARNING: CPU: 0 PID: 746 at drivers/dma/ti/../virt-dma.h:169 udma_start.isra.0+0x34/0x238
[    4.137352] CPU: 0 UID: 0 PID: 746 Comm: kworker/0:3 Not tainted 6.12.9-arm64 #28
[    4.144867] Hardware name: pp-v12 (DT)
[    4.148648] Workqueue: events udma_check_tx_completion
[    4.153841] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[    4.160834] pc : udma_start.isra.0+0x34/0x238
[    4.165227] lr : udma_start.isra.0+0x30/0x238
[    4.169618] sp : ffffffc083cabcf0
[    4.172963] x29: ffffffc083cabcf0 x28: [PII_REDACTED] x27: ffffff800001b005
[    4.180167] x26: ffffffc0812f0000 x25: [PII_REDACTED] x24: [PII_REDACTED]
[    4.187370] x23: [PII_REDACTED] x22: 00000000e21eabe9 x21: ffffff8000fa0670
[    4.194571] x20: ffffff8001b6bf00 x19: ffffff8000fa0430 x18: ffffffc083b95030
[    4.201773] x17: [PII_REDACTED] x16: 00000000f0000000 x15: [PII_REDACTED]
[    4.208976] x14: [PII_REDACTED] x13: [PII_REDACTED] x12: [PII_REDACTED]
[    4.216179] x11: ffffffc08151a240 x10:[PII_REDACTED]003ea1 x9 : ffffffc08046ab68
[    4.223381] x8 : ffffffc083cabac0 x7 : ffffffc081df3718 x6 :[PII_REDACTED]029fc8
[    4.230583] x5 : ffffffc0817ee6d8 x4 :[PII_REDACTED]000bc0 x3 : [PII_REDACTED]
[    4.237784] x2 : [PII_REDACTED] x1 :[PII_REDACTED]1fffff x0 : [PII_REDACTED]
[    4.244986] Call trace:
[    4.247463]  udma_start.isra.0+0x34/0x238
[    4.251509]  udma_check_tx_completion+0xd0/0xdc
[    4.256076]  process_one_work+0x244/0x3fc
[    4.260129]  process_scheduled_works+0x6c/0x74
[    4.264610]  worker_thread+0x150/0x1dc
[    4.268398]  kthread+0xd8/0xe8
[    4.271492]  ret_from_fork+0x10/0x20
[    4.275107] irq event stamp: 220
[    4.278363] hardirqs last  enabled at (219): [<ffffffc080a27c7c>] _raw_spin_unlock_irq+0x38/0x50
[    4.287183] hardirqs last disabled at (220): [<ffffffc080a1c154>] el1_dbg+0x24/0x50
[    4.294879] softirqs last  enabled at (182): [<ffffffc080037e68>] handle_softirqs+0x1c0/0x3cc
[    4.303437] softirqs last disabled at (177): [<ffffffc080010170>] __do_softirq+0x1c/0x28
[    4.311559] ---[ end trace [PII_REDACTED] ]---

This commit adds the missing locking.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0ea0433f822ed0549715f7044c9cd1cf132ff7fa; https://git.kernel.org/stable/c/26e63b2fe30c61bd25981c6084f67a8af79945d0; https://git.kernel.org/stable/c/27e71fa08711e09d81e06a54007b362a5426fd22
CVE: CVE-2025-38006
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

net: mctp: Don't access ifa_index when missing

In mctp_dump_addrinfo, ifa_index can be used to filter interfaces, but
only when the struct ifaddrmsg is provided. Otherwise it will be
comparing to uninitialised memory - reproducible in the syzkaller case from
dhcpd, or busybox "ip addr show".

The kernel MCTP implementation has always filtered by ifa_index, so
existing userspace programs expecting to dump MCTP addresses must
already be passing a valid ifa_index value (either 0 or a real index).

BUG: KMSAN: uninit-value in mctp_dump_addrinfo+0x208/0xac0 net/mctp/device.c:128
 mctp_dump_addrinfo+0x208/0xac0 net/mctp/device.c:128
 rtnl_dump_all+0x3ec/0x5b0 net/core/rtnetlink.c:4380
 rtnl_dumpit+0xd5/0x2f0 net/core/rtnetlink.c:6824
 netlink_dump+0x97b/0x1690 net/netlink/af_netlink.c:2309
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://git.kernel.org/stable/c/24fa213dffa470166ec014f979f36c6ff44afb45; https://git.kernel.org/stable/c/8ef7b3f0db69e2f4a80be351f6aee9a4c2332ef9; https://git.kernel.org/stable/c/acab78ae12c7fefb4f3bfe22e00770a5faa42724
CVE: CVE-2025-38007
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

HID: uclogic: Add NULL check in uclogic_input_configured()

devm_kasprintf() returns NULL when memory allocation fails. Currently,
uclogic_input_configured() does not check for this case, which results
in a NULL pointer dereference.

Add NULL check after devm_kasprintf() to prevent this issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/00d52b2fa6083dd0f5c44f3604cd1bad1f9177dc; https://git.kernel.org/stable/c/01b76cc8ca243fc3376b035aa326bbc4f03d384b; https://git.kernel.org/stable/c/94e7272b636a0677082e0604609e4c471e0a2caf
CVE: CVE-2025-38008
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

mm/page_alloc: fix race condition in unaccepted memory handling

The page allocator tracks the number of zones that have unaccepted memory
using static_branch_enc/dec() and uses that static branch in hot paths to
determine if it needs to deal with unaccepted memory.

Borislav and Thomas pointed out that the tracking is racy: operations on
static_branch are not serialized against adding/removing unaccepted pages
to/from the zone.

Sanity checks inside static_branch machinery detects it:

WARNING: CPU: 0 PID: 10 at kernel/jump_label.c:276 __static_key_slow_dec_cpuslocked+0x8e/0xa0

The comment around the WARN() explains the problem:

	/*
	 * Warn about the '-1' case though; since that means a
	 * decrement is concurrent with a first (0->1) increment. IOW
	 * people are trying to disable something that wasn't yet fully
	 * enabled. This suggests an ordering problem on the user side.
	 */

The effect of this static_branch optimization is only visible on
microbenchmark.

Instead of adding more complexity around it, remove it altogether.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://git.kernel.org/stable/c/71dda1cb10702dc2859f00eb789b0502de2176a9; https://git.kernel.org/stable/c/74953f93f47a45296cc2a3fd04e2a3202ff3fa53; https://git.kernel.org/stable/c/98fdd2f612e949c652693f6df00442c81037776d
CVE: CVE-2025-38009
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: disable napi on driver removal

A warning on driver removal started occurring after commit 9dd05df8403b
("net: warn if NAPI instance wasn't shut down"). Disable tx napi before
deleting it in mt76_dma_cleanup().

 WARNING: CPU: 4 PID: 18828 at net/core/dev.c:7288 __netif_napi_del_locked+0xf0/0x100
 CPU: 4 UID: 0 PID: 18828 Comm: modprobe Not tainted 6.15.0-rc4 #4 PREEMPT(lazy)
 Hardware name: ASUS System Product Name/PRIME X670E-PRO WIFI, BIOS 3035 09/05/2024
 RIP: 0010:__netif_napi_del_locked+0xf0/0x100
 Call Trace:
 <TASK>
 mt76_dma_cleanup+0x54/0x2f0 [mt76]
 mt7921_pci_remove+0xd5/0x190 [mt7921e]
 pci_device_remove+0x47/0xc0
 device_release_driver_internal+0x19e/0x200
 driver_detach+0x48/0x90
 bus_remove_driver+0x6d/0xf0
 pci_unregister_driver+0x2e/0xb0
 __do_sys_delete_module.isra.0+0x197/0x2e0
 do_syscall_64+0x7b/0x160
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Tested with mt7921e but the same pattern can be actually applied to other
mt76 drivers calling mt76_dma_cleanup() during removal. Tx napi is enabled
in their *_dma_init() functions and only toggled off and on again inside
their suspend/resume/reset paths. So it should be okay to disable tx
napi in such a generic way.

Found by Linux Verification Center (linuxtesting.org).
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2b81e76db3667d1f7f2ad44e9835cdaf8dea95a8; https://git.kernel.org/stable/c/5e700b06b970fc19e3a1ecb244e14785f3fbb8e3; https://git.kernel.org/stable/c/78ab4be549533432d97ea8989d2f00b508fa68d8
CVE: CVE-2025-38010
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking

The current implementation uses bias_pad_enable as a reference count to
manage the shared bias pad for all UTMI PHYs. However, during system
suspension with connected USB devices, multiple power-down requests for
the UTMI pad result in a mismatch in the reference count, which in turn
produces warnings such as:

[  237.762967] WARNING: CPU: 10 PID: 1618 at tegra186_utmi_pad_power_down+0x160/0x170
[  237.763103] Call trace:
[  237.763104]  tegra186_utmi_pad_power_down+0x160/0x170
[  237.763107]  tegra186_utmi_phy_power_off+0x10/0x30
[  237.763110]  phy_power_off+0x48/0x100
[  237.763113]  tegra_xusb_enter_elpg+0x204/0x500
[  237.763119]  tegra_xusb_suspend+0x48/0x140
[  237.763122]  platform_pm_suspend+0x2c/0xb0
[  237.763125]  dpm_run_callback.isra.0+0x20/0xa0
[  237.763127]  __device_suspend+0x118/0x330
[  237.763129]  dpm_suspend+0x10c/0x1f0
[  237.763130]  dpm_suspend_start+0x88/0xb0
[  237.763132]  suspend_devices_and_enter+0x120/0x500
[  237.763135]  pm_suspend+0x1ec/0x270

The root cause was traced back to the dynamic power-down changes
introduced in commit a30951d31b25 ("xhci: tegra: USB2 pad power controls"),
where the UTMI pad was being powered down without verifying its current
state. This unbalanced behavior led to discrepancies in the reference
count.

To rectify this issue, this patch replaces the single reference counter
with a bitmask, renamed to utmi_pad_enabled. Each bit in the mask
corresponds to one of the four USB2 PHYs, allowing us to track each pad's
enablement status individually.

With this change:
  - The bias pad is powered on only when the mask is clear.
  - Each UTMI pad is powered on or down based on its corresponding bit
    in the mask, preventing redundant operations.
  - The overall power state of the shared bias pad is maintained
    correctly during suspend/resume cycles.

The mutex used to prevent race conditions during UTMI pad enable/disable
operations has been moved from the tegra186_utmi_bias_pad_power_on/off
functions to the parent functions tegra186_utmi_pad_power_on/down. This
change ensures that there are no race conditions when updating the bitmask.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1db527f0cb8f677adadd4e28e5bc77aaf5d4e4c9; https://git.kernel.org/stable/c/628bec9ed68a2204184fc8230a2609075b08666e; https://git.kernel.org/stable/c/b47158fb42959c417ff2662075c0d46fb783d5d1
CVE: CVE-2025-38011
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: csa unmap use uninterruptible lock

After process exit to unmap csa and free GPU vm, if signal is accepted
and then waiting to take vm lock is interrupted and return, it causes
memory leaking and below warning backtrace.

Change to use uninterruptible wait lock fix the issue.

WARNING: CPU: 69 PID: 167800 at amd/amdgpu/amdgpu_kms.c:1525
 amdgpu_driver_postclose_kms+0x294/0x2a0 [amdgpu]
 Call Trace:
  <TASK>
  drm_file_free.part.0+0x1da/0x230 [drm]
  drm_close_helper.isra.0+0x65/0x70 [drm]
  drm_release+0x6a/0x120 [drm]
  amdgpu_drm_release+0x51/0x60 [amdgpu]
  __fput+0x9f/0x280
  ____fput+0xe/0x20
  task_work_run+0x67/0xa0
  do_exit+0x217/0x3c0
  do_group_exit+0x3b/0xb0
  get_signal+0x14a/0x8d0
  arch_do_signal_or_restart+0xde/0x100
  exit_to_user_mode_loop+0xc1/0x1a0
  exit_to_user_mode_prepare+0xf4/0x100
  syscall_exit_to_user_mode+0x17/0x40
  do_syscall_64+0x69/0xc0

(cherry picked from commit 7dbbfb3c171a6f63b[PII_REDACTED]9c9c26abf38ab)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/8d2979b9bb1be0f4a52dff600e56d780403e04ac; https://git.kernel.org/stable/c/8d71c3231b33e24a911b8f2d8c3a17ee40aa32d5; https://git.kernel.org/stable/c/a0fa7873f2f869087b1e7793f7fac3713a1e3afe