deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-10443
Published: 2025-09-15
Description: A vulnerability was identified in Tenda AC9 and AC15 15.03.05.14/15.03.05.18. This vulnerability affects the function formexeCommand of the file /goform/exeCommand. Such manipulation of the argument cmdinput leads to buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/[PII_REDACTED]/mycve/blob/main/Tenda/Tenda_AC15_AC9_Bof.md; https://github.com/[PII_REDACTED]/mycve/blob/main/Tenda/Tenda_AC15_AC9_Bof.md#poc; https://vuldb.com/?ctiid.323877
CVE: CVE-2025-10444
Published: 2025-09-15
Description: A security flaw has been discovered in Campcodes Online Job Finder System 1.0. This issue affects some unknown processing of the file /advancesearch.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/HAO-RAY/HCR-CVE/issues/5; https://vuldb.com/?ctiid.323878; https://vuldb.com/?id.323878
CVE: CVE-2025-43794
Published: 2025-09-15
Description: Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote authenticated attackers with the instance administrator role to inject arbitrary web script or HTML into all pages via a crafted payload injected into the Instance Configuration's (1) CDN Host HTTP text field or (2) CDN Host HTTPS text field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43794
CVE: CVE-2025-59358
Published: 2025-09-15
Description: The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://github.com/chaos-mesh/chaos-mesh/pull/4702; https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeover
CVE: CVE-2025-59359
Published: 2025-09-15
Description: The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows  unauthenticated in-cluster attackers to perform remote code execution across the cluster.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/chaos-mesh/chaos-mesh/pull/4702; https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeover
CVE: CVE-2025-59360
Published: 2025-09-15
Description: The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/chaos-mesh/chaos-mesh/pull/4702; https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeover
CVE: CVE-2025-59361
Published: 2025-09-15
Description: The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/chaos-mesh/chaos-mesh/pull/4702; https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeover
CVE: CVE-2025-10445
Published: 2025-09-15
Description: A weakness has been identified in Campcodes Computer Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/us_transac.php?action=add. Executing manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/e1evensu/cve/issues/2; https://vuldb.com/?ctiid.323879; https://vuldb.com/?id.323879
CVE: CVE-2025-10446
Published: 2025-09-15
Description: A security vulnerability has been detected in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/cust_searchfrm.php?action=edit. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/e1evensu/cve/issues/3; https://vuldb.com/?ctiid.323880; https://vuldb.com/?id.323880
CVE: CVE-2025-39800
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: abort transaction on unexpected eb generation at btrfs_copy_root()

If we find an unexpected generation for the extent buffer we are cloning
at btrfs_copy_root(), we just WARN_ON() and don't error out and abort the
transaction, meaning we allow to persist metadata with an unexpected
generation. Instead of warning only, abort the transaction and return
-EUCLEAN.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/33e8f24b52d2796b8cfb28c19a1a7dd6476323a8; https://git.kernel.org/stable/c/4290e34fb87ae556b12c216efd0ae91583446b7a; https://git.kernel.org/stable/c/4734255ef39b416864139dcda96a387fe5f33a6a
CVE: CVE-2025-39801
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: Remove WARN_ON for device endpoint command timeouts

This commit addresses a rarely observed endpoint command timeout
which causes kernel panic due to warn when 'panic_on_warn' is enabled
and unnecessary call trace prints when 'panic_on_warn' is disabled.
It is seen during fast software-controlled connect/disconnect testcases.
The following is one such endpoint command timeout that we observed:

1. Connect
   =======
->dwc3_thread_interrupt
 ->dwc3_ep0_interrupt
  ->configfs_composite_setup
   ->composite_setup
    ->usb_ep_queue
     ->dwc3_gadget_ep0_queue
      ->__dwc3_gadget_ep0_queue
       ->__dwc3_ep0_do_control_data
        ->dwc3_send_gadget_ep_cmd

2. Disconnect
   ==========
->dwc3_thread_interrupt
 ->dwc3_gadget_disconnect_interrupt
  ->dwc3_ep0_reset_state
   ->dwc3_ep0_end_control_data
    ->dwc3_send_gadget_ep_cmd

In the issue scenario, in Exynos platforms, we observed that control
transfers for the previous connect have not yet been completed and end
transfer command sent as a part of the disconnect sequence and
processing of USB_ENDPOINT_HALT feature request from the host timeout.
This maybe an expected scenario since the controller is processing EP
commands sent as a part of the previous connect. It maybe better to
remove WARN_ON in all places where device endpoint commands are sent to
avoid unnecessary kernel panic due to warn.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://git.kernel.org/stable/c/45eae113dccaf8e502090ecf5b3d9e9b805add6f; https://git.kernel.org/stable/c/5a1a847d841505dba2bd85602daf5c218e1d85b8; https://git.kernel.org/stable/c/84c95dbf5bece56086cdb65a64162af35158bdd9
CVE: CVE-2025-39802
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

lib/crypto: arm/poly1305: Fix register corruption in no-SIMD contexts

Restore the SIMD usability check that was removed by commit 773426f4771b
("crypto: arm/poly1305 - Add block-only interface").

This safety check is cheap and is well worth eliminating a footgun.
While the Poly1305 functions should not be called when SIMD registers
are unusable, if they are anyway, they should just do the right thing
instead of corrupting random tasks' registers and/or computing incorrect
MACs.  Fixing this is also needed for poly1305_kunit to pass.

Just use may_use_simd() instead of the original crypto_simd_usable(),
since poly1305_kunit won't rely on crypto_simd_disabled_for_test.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/52c3e242f4d0043186b70d65460ba1767f27494a; https://git.kernel.org/stable/c/87bdfba903be7084cb3ee04032b14a81181fe413
CVE: CVE-2025-39803
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: core: Remove WARN_ON_ONCE() call from ufshcd_uic_cmd_compl()

The UIC completion interrupt may be disabled while an UIC command is
being processed. When the UIC completion interrupt is reenabled, an UIC
interrupt is triggered and the WARN_ON_ONCE(!cmd) statement is hit.
Hence this patch that removes this kernel warning.
CVSS Score: 7.8 (HIGH)
CWE: CWE-617
References: https://git.kernel.org/stable/c/c0cc24c139e0f62859dbf88e050ba074cd93988f; https://git.kernel.org/stable/c/e5203d89d59bfcbe1f348aa0d2dc4449a8ba644c
CVE: CVE-2025-39804
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

lib/crypto: arm64/poly1305: Fix register corruption in no-SIMD contexts

Restore the SIMD usability check that was removed by commit a59e5468a921
("crypto: arm64/poly1305 - Add block-only interface").

This safety check is cheap and is well worth eliminating a footgun.
While the Poly1305 functions should not be called when SIMD registers
are unusable, if they are anyway, they should just do the right thing
instead of corrupting random tasks' registers and/or computing incorrect
MACs.  Fixing this is also needed for poly1305_kunit to pass.

Just use may_use_simd() instead of the original crypto_simd_usable(),
since poly1305_kunit won't rely on crypto_simd_disabled_for_test.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/eec76ea5a7213c48529a46eed1b343e5cee3aaab; https://git.kernel.org/stable/c/ef74efa598b7bbc5c24509f7f56af2806f81c339
CVE: CVE-2025-3025
Published: 2025-09-15
Description: Elevation of Privileges in the cleaning feature of Gen Digital CCleaner version 6.33.11465 on Windows allows a local user to gain SYSTEM privileges via exploiting insecure file delete operations. Reported in CCleaner v. 6.33.11465. This issue affects CCleaner: before < 6.36.11508.
CVSS Score: 7.3 (HIGH)
CWE: CWE-552
References: https://www.gendigital.com/us/en/contact-us/security-advisories/
CVE: CVE-2022-50234
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

io_uring/af_unix: defer registered files gc to io_uring release

Instead of putting io_uring's registered files in unix_gc() we want it
to be done by io_uring itself. The trick here is to consider io_uring
registered files for cycle detection but not actually putting them down.
Because io_uring can't register other ring instances, this will remove
all refs to the ring file triggering the ->release path and clean up
with io_ring_ctx_free().

[axboe: add kerneldoc comment to skb, fold in skb leak fix]
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/0091bfc81741b8d3aeb3b7ab8636f911b2de6e80; https://git.kernel.org/stable/c/04df9719df1865f6770af9bc7880874af0e594b2; https://git.kernel.org/stable/c/75e94c7e8859e58aadc15a98cc9704edff47d4f2
CVE: CVE-2022-50235
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

NFSD: Protect against send buffer overflow in NFSv2 READDIR

Restore the previous limit on the @count argument to prevent a
buffer overflow attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/00b4492686e0497fdb924a9d4c8f6f99377e176c; https://git.kernel.org/stable/c/0e57d696f60dee6117a8ace0cac7c5761d375277; https://git.kernel.org/stable/c/c2a878095b5c6f04f90553a3c45872f990dab14e
CVE: CVE-2022-50236
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

iommu/mediatek: Fix crash on isr after kexec()

If the system is rebooted via isr(), the IRQ handler might
be triggered before the domain is initialized. Resulting on
an invalid memory access error.

Fix:
[    0.500930] Unable to handle kernel read from unreadable memory at virtual address [PII_REDACTED]
[    0.501166] Call trace:
[    0.501174]  report_iommu_fault+0x28/0xfc
[    0.501180]  mtk_iommu_isr+0x10c/0x1c0

[ joro: Fixed spelling in commit message ]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://git.kernel.org/stable/c/00ef8885a945c37551547d8ac8361cacd20c4e42; https://git.kernel.org/stable/c/85cc8a187f2de7a91e2cea522e9406fa12999269; https://git.kernel.org/stable/c/f13acee780cedb3e06a6dadf64d9104cccd2b9fc
CVE: CVE-2022-50239
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

cpufreq: qcom: fix writes in read-only memory region

This commit fixes a kernel oops because of a write in some read-only memory:

	[    9.068287] Unable to handle kernel write to read-only memory at virtual address ffff800009240ad8
	..snip..
	[    9.138790] Internal error: Oops: 9600004f [#1] PREEMPT SMP
	..snip..
	[    9.269161] Call trace:
	[    9.276271]  __memcpy+0x5c/0x230
	[    9.278531]  snprintf+0x58/0x80
	[    9.282002]  qcom_cpufreq_msm8939_name_version+0xb4/0x190
	[    9.284869]  qcom_cpufreq_probe+0xc8/0x39c
	..snip..

The following line defines a pointer that point to a char buffer stored
in read-only memory:

	char *pvs_name = "speedXX-pvsXX-vXX";

This pointer is meant to hold a template "speedXX-pvsXX-vXX" where the
XX values get overridden by the qcom_cpufreq_krait_name_version function. Since
the template is actually stored in read-only memory, when the function
executes the following call we get an oops:

	snprintf(*pvs_name, sizeof("speedXX-pvsXX-vXX"), "speed%d-pvs%d-v%d",
		 speed, pvs, pvs_ver);

To fix this issue, we instead store the template name onto the stack by
using the following syntax:

	char pvs_name_buffer[] = "speedXX-pvsXX-vXX";

Because the `pvs_name` needs to be able to be assigned to NULL, the
template buffer is stored in the pvs_name_buffer and not under the
pvs_name variable.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/01039fb8e90c9cb684430414bff70cea9eb168c5; https://git.kernel.org/stable/c/14d260f94ff89543597ffea13db8b277a810e08e; https://git.kernel.org/stable/c/794ded0bc461287a268bed21fea2eebb6e5d232c
CVE: CVE-2022-50240
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

android: binder: stop saving a pointer to the VMA

Do not record a pointer to a VMA outside of the mmap_lock for later use. 
This is unsafe and there are a number of failure paths *after* the
recorded VMA pointer may be freed during setup.  There is no callback to
the driver to clear the saved pointer from generic mm code.  Furthermore,
the VMA pointer may become stale if any number of VMA operations end up
freeing the VMA so saving it was fragile to being with.

Instead, change the binder_alloc struct to record the start address of the
VMA and use vma_lookup() to get the vma when needed.  Add lockdep
mmap_lock checks on updates to the vma pointer to ensure the lock is held
and depend on that lock for synchronization of readers and writers - which
was already the case anyways, so the smp_wmb()/smp_rmb() was not
necessary.

[akpm@linux-foundation.org: fix drivers/android/binder_alloc_selftest.c]
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/015ac18be7de25d17d6e5f1643cb3b60bfbe859e; https://git.kernel.org/stable/c/1ec3f76a436d750fd5023caec5da0494fc2870d2; https://git.kernel.org/stable/c/27a594bc7a7c8238d239e3cdbcf2edfa3bbe9a1b
CVE: CVE-2022-50241
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

NFSD: fix use-after-free on source server when doing inter-server copy

Use-after-free occurred when the laundromat tried to free expired
cpntf_state entry on the s2s_cp_stateids list after inter-server
copy completed. The sc_cp_list that the expired copy state was
inserted on was already freed.

When COPY completes, the Linux client normally sends LOCKU(lock_state x),
FREE_STATEID(lock_state x) and CLOSE(open_state y) to the source server.
The nfs4_put_stid call from nfsd4_free_stateid cleans up the copy state
from the s2s_cp_stateids list before freeing the lock state's stid.

However, sometimes the CLOSE was sent before the FREE_STATEID request.
When this happens, the nfsd4_close_open_stateid call from nfsd4_close
frees all lock states on its st_locks list without cleaning up the copy
state on the sc_cp_list list. When the time the FREE_STATEID arrives the
server returns BAD_STATEID since the lock state was freed. This causes
the use-after-free error to occur when the laundromat tries to free
the expired cpntf_state.

This patch adds a call to nfs4_free_cpntf_statelist in
nfsd4_close_open_stateid to clean up the copy state before calling
free_ol_stateid_reaplist to free the lock state's stid on the reaplist.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/019805fea91599b22dfa62ffb29c022f35abeb06; https://git.kernel.org/stable/c/35aa0fb8c3033a3d78603356e96fc18c5b9cceb2; https://git.kernel.org/stable/c/6ea71246b7a02af675d733e72d14bd0d591d5f4a
CVE: CVE-2022-50242
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init()

If vp alloc failed in qlcnic_sriov_init(), all previously allocated vp
needs to be freed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/01de1123322e4fe1bbd0fcdf0982511b55519c03; https://git.kernel.org/stable/c/0aefadf23ee5e33b747df195ace42d3be2025e4e; https://git.kernel.org/stable/c/132c502919bb08e16e3054cb28bb7b149ec20cf5
CVE: CVE-2022-50243
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

sctp: handle the error returned from sctp_auth_asoc_init_active_key

When it returns an error from sctp_auth_asoc_init_active_key(), the
active_key is actually not updated. The old sh_key will be freeed
while it's still used as active key in asoc. Then an use-after-free
will be triggered when sending patckets, as found by syzbot:

  sctp_auth_shkey_hold+0x22/0xa0 net/sctp/auth.c:112
  sctp_set_owner_w net/sctp/socket.c:132 [inline]
  sctp_sendmsg_to_asoc+0xbd5/0x1a20 net/sctp/socket.c:1863
  sctp_sendmsg+0x1053/0x1d50 net/sctp/socket.c:2025
  inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:819
  sock_sendmsg_nosec net/socket.c:714 [inline]
  sock_sendmsg+0xcf/0x120 net/socket.c:734

This patch is to fix it by not replacing the sh_key when it returns
errors from sctp_auth_asoc_init_active_key() in sctp_auth_set_key().
For sctp_auth_set_active_key(), old active_key_id will be set back
to asoc->active_key_id when the same thing happens.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/022152aaebe116a25c39818a07e175a8cd3c1e11; https://git.kernel.org/stable/c/0f90099d18e3abdc01babf686f41f63fe04939c1; https://git.kernel.org/stable/c/19d636b663e0e92951bba5fced929ca7fd25c552
CVE: CVE-2022-50244
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter()

If device_register() fails in cxl_pci_afu|adapter(), the device
is not added, device_unregister() can not be called in the error
path, otherwise it will cause a null-ptr-deref because of removing
not added device.

As comment of device_register() says, it should use put_device() to give
up the reference in the error path. So split device_unregister() into
device_del() and put_device(), then goes to put dev when register fails.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/02cd3032b154fa02fdf90e7467abaeed889330b2; https://git.kernel.org/stable/c/0f63c0ddc2ea20d783d29243f4dbe0f9e95dfdec; https://git.kernel.org/stable/c/139abd4c626a6f7ce02789ed5f73aa2256e0542b
CVE: CVE-2022-50245
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

rapidio: fix possible UAF when kfifo_alloc() fails

If kfifo_alloc() fails in mport_cdev_open(), goto err_fifo and just free
priv. But priv is still in the chdev->file_list, then list traversal
may cause UAF. This fixes the following smatch warning:

drivers/rapidio/devices/rio_mport_cdev.c:1930 mport_cdev_open() warn: '&priv->list' not removed from list
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/02d7d89f816951e0862147d751b1150d67aaebdd; https://git.kernel.org/stable/c/2a6c75adf8192f07ddcdd4a1a13488c890a73919; https://git.kernel.org/stable/c/2ba06e57f933f0eac242e8b389433da1cc00d4d5
CVE: CVE-2022-50246
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: typec: tcpci: fix of node refcount leak in tcpci_register_port()

I got the following report while doing device(mt6370-tcpc) load
test with CONFIG_OF_UNITTEST and CONFIG_OF_DYNAMIC enabled:

  OF: ERROR: memory leak, expected refcount 1 instead of 2,
  of_node_get()/of_node_put() unbalanced - destroy cset entry:
  attach overlay node /i2c/pmic@34/tcpc/connector

The 'fwnode' set in tcpci_parse_config() which is called
in tcpci_register_port(), its node refcount is increased
in device_get_named_child_node(). It needs be put while
exiting, so call fwnode_handle_put() in the error path of
tcpci_register_port() and in tcpci_unregister_port() to
avoid leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0384e87e3fec735e47f1c133c796f32ef7a72a9b; https://git.kernel.org/stable/c/4f257e2eba419ab4cd880c822346450e4e7b2af3; https://git.kernel.org/stable/c/5f125507d2270035dfcf83fbff6cff5a143e200c
CVE: CVE-2022-50247
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: xhci-mtk: fix leakage of shared hcd when fail to set wakeup irq

Can not set the @shared_hcd to NULL before decrease the usage count
by usb_put_hcd(), this will cause the shared hcd not released.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/03a88b0bafbe3f548729d970d8366f48718c9b19; https://git.kernel.org/stable/c/05680a91ae60ddd0319e6618456f0883b5dd765d; https://git.kernel.org/stable/c/c8e[PII_REDACTED]dc8344bbb9cbad88cdce9cb8077
CVE: CVE-2022-50249
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

memory: of: Fix refcount leak bug in of_get_ddr_timings()

We should add the of_node_put() when breaking out of
for_each_child_of_node() as it will automatically increase
and decrease the refcount.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/05215fb32010d4afb68fbdbb4d237df6e2d4567b; https://git.kernel.org/stable/c/1c6cac6fa4d08aea161f83d38117d733b3c3a000; https://git.kernel.org/stable/c/2680690f9ce4e6abbb4f559e97271c15b7eeda97