deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-3135
Published: 2025-04-03
Description: A vulnerability classified as critical was found in fcba_zzm ics-park Smart Park Management System 2.1. This vulnerability affects unknown code of the file /api/system/dept/update. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://vuldb.com/?ctiid.303040; https://vuldb.com/?id.303040; https://vuldb.com/?submit.525136
CVE: CVE-2025-3153
Published: 2025-04-03
Description: Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 are vulnerable to CSRF and XSS in the Concrete CMS Address attribute because addresses are not properly sanitized in the output when a country is not specified.  Attackers are limited to individuals whom a site administrator has granted the ability to fill in an address attribute. It is possible for the attacker to glean limited information from the site but amount and type is restricted by mitigating controls and the level of access of the attacker. Limited data modification is possible. The dashboard page itself could be rendered unavailable. 
The fix only sanitizes new data uploaded post update to Concrete CMS 9.4.0RC2. Existing database entries added before the update will still be “live” if there were successful exploits added under previous versions; a database search is recommended. The Concrete CMS security team gave this vulnerability CVSS v.4.0 score of 5.1  with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L Thanks Myq Larson for reporting.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-352
References: https://documentation.concretecms.org/9-x/developers/introduction/version-history/940-release-notes; https://github.com/concretecms/concretecms/pull/12511; https://github.com/concretecms/concretecms/pull/12512
CVE: CVE-2025-29991
Published: 2025-04-03
Description: Yubico YubiKey 5.4.1 through 5.7.3 before 5.7.4 has an incorrect FIDO CTAP PIN/UV Auth Protocol Two implementation. It uses the signature length from CTAP PIN/UV Auth Protocol One, even when CTAP PIN/UV Auth Protocol Two was chosen, resulting in a partial signature verification.
CVSS Score: 2.2 (LOW)
CWE: CWE-1390
References: https://www.yubico.com/support/security-advisories/ysa-2025-02/
CVE: CVE-2025-2784
Published: 2025-04-03
Description: A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server.
CVSS Score: 7.0 (HIGH)
CWE: CWE-125
References: https://access.redhat.com/errata/RHSA-2025:21657; https://access.redhat.com/errata/RHSA-2025:7505; https://access.redhat.com/errata/RHSA-2025:8126
CVE: CVE-2025-3136
Published: 2025-04-03
Description: A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0. This issue affects the function torch.cuda.memory.caching_allocator_delete of the file c10/cuda/CUDACachingAllocator.cpp. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.3 (LOW)
CWE: CWE-119, CWE-787
References: https://github.com/pytorch/pytorch/issues/149821; https://github.com/pytorch/pytorch/issues/149821#issue[PII_REDACTED]; https://github.com/pytorch/pytorch/issues/149821#issuecomment[PII_REDACTED]
CVE: CVE-2025-3137
Published: 2025-04-03
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Online Security Guards Hiring System 1.0. Affected is an unknown function of the file /admin/changeimage.php. The manipulation of the argument editid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ARPANET-cybersecurity/vuldb/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.303042
CVE: CVE-2025-3138
Published: 2025-04-03
Description: A vulnerability has been found in PHPGurukul Online Security Guards Hiring System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/edit-guard-detail.php. The manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ARPANET-cybersecurity/vuldb/issues/3; https://phpgurukul.com/; https://vuldb.com/?ctiid.303043
CVE: CVE-2025-3139
Published: 2025-04-03
Description: A vulnerability was found in code-projects Bus Reservation System 1.0 and classified as critical. Affected by this issue is the function Login of the component Login Form. The manipulation of the argument Str1 leads to buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-120, CWE-120
References: https://code-projects.org/; https://github.com/LxxxtSec/CVE/blob/main/CVE-Lxxxt.md; https://vuldb.com/?ctiid.303044
CVE: CVE-2025-3140
Published: 2025-04-03
Description: A vulnerability was found in SourceCodester Online Medicine Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file /view_category.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Lena-lyy/SQL/blob/main/SQL1.md; https://vuldb.com/?ctiid.303045; https://vuldb.com/?id.303045
CVE: CVE-2025-3141
Published: 2025-04-03
Description: A vulnerability was found in SourceCodester Online Medicine Ordering System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /manage_category.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Lena-lyy/SQL/blob/main/SQL2.md; https://vuldb.com/?ctiid.303046; https://vuldb.com/?id.303046
CVE: CVE-2025-2055
Published: 2025-04-03
Description: The MapPress Maps for WordPress plugin before 2.94.9 does not sanitise and escape some parameters when outputing them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a8bfdbbf-6963-4fab-826a-6be770ac72c3/
CVE: CVE-2025-31334
Published: 2025-04-03
Description: Issue that bypasses the "Mark of the Web" security warning function for files when opening a symbolic link that points to an executable file exists in WinRAR versions prior to 7.11. If a symbolic link specially crafted by an attacker is opened on the affected product, arbitrary code may be executed.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-356
References: https://jvn.jp/en/jp/JVN59547048/; https://www.win-rar.com/start.html?&L=0
CVE: CVE-2025-3142
Published: 2025-04-03
Description: A vulnerability was found in SourceCodester Apartment Visitor Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /add-apartment.php. The manipulation of the argument buildingno leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Multiple parameters might be affected.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/Lena-lyy/SQL/blob/main/SQL3.md; https://vuldb.com/?ctiid.303047; https://vuldb.com/?id.303047
CVE: CVE-2025-3143
Published: 2025-04-03
Description: A vulnerability classified as critical has been found in SourceCodester Apartment Visitor Management System 1.0. Affected is an unknown function of the file /visitor-entry.php. The manipulation of the argument visname/address leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Multiple parameters might be affected.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/Lena-lyy/SQL/blob/main/SQL4.md; https://github.com/Lena-lyy/SQL/blob/main/SQL5.md; https://vuldb.com/?ctiid.303048
CVE: CVE-2025-3144
Published: 2025-04-03
Description: A vulnerability classified as problematic was found in MindSpore 2.5.0. Affected by this vulnerability is the function mindspore.numpy.fft.hfftn. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.3 (LOW)
CWE: CWE-119
References: https://gitee.com/mindspore/mindspore/issues/IBVKM8; https://vuldb.com/?ctiid.303049; https://vuldb.com/?id.303049
CVE: CVE-2025-30485
Published: 2025-04-03
Description: UNIX symbolic link (Symlink) following issue exists in FutureNet NXR series, VXR series and WXR series routers. Attaching to the affected product an external storage containing malicious symbolic link files, a logged-in administrative user may obtain and/or destroy internal files.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-61
References: https://jvn.jp/en/vu/JVNVU92821536/; https://www.centurysys.co.jp/backnumber/common/jvnvu92821536.html
CVE: CVE-2025-3145
Published: 2025-04-03
Description: A vulnerability, which was classified as problematic, has been found in MindSpore 2.5.0. Affected by this issue is the function mindspore.numpy.fft.rfft2. The manipulation leads to memory corruption. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.3 (LOW)
CWE: CWE-119
References: https://gitee.com/mindspore/mindspore/issues/IBVKM8; https://vuldb.com/?ctiid.303050; https://vuldb.com/?id.303050
CVE: CVE-2025-3146
Published: 2025-04-03
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Bus Pass Management System 1.0. This affects an unknown part of the file /view-pass-detail.php. The manipulation of the argument viewid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/nabiland/cve/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.303051
CVE: CVE-2025-3147
Published: 2025-04-03
Description: A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /add-subadmin.php. The manipulation of the argument sadminusername leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/nabiland/cve/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.303052
CVE: CVE-2025-3148
Published: 2025-04-03
Description: A vulnerability was found in codeprojects Product Management System 1.0 and classified as problematic. This issue affects some unknown processing of the component Login. The manipulation of the argument Str1 leads to buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.3 (LOW)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/LxxxtSec/CVE/blob/main/CVE-Product_Management_System.md; https://vuldb.com/?ctiid.303053; https://vuldb.com/?id.303053
CVE: CVE-2024-13673
Published: 2025-04-03
Description: The Big Boom Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bbd-search' shortcode in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3258281%40big-boom-directory&new=3258281%40big-boom-directory&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3262078%40big-boom-directory&new=3262078%40big-boom-directory&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/5284cbe4-1550-4f3c-be54-e2de8a089512?source=cve
CVE: CVE-2025-1663
Published: 2025-04-03
Description: The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.142 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3258648%40unlimited-elements-for-elementor&new=3258648%40unlimited-elements-for-elementor&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/d07c43e0-783a-499b-b172-d058583d0749?source=cve
CVE: CVE-2025-21995
Published: 2025-04-03
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/sched: Fix fence reference count leak

The last_scheduled fence leaks when an entity is being killed and adding
the cleanup callback fails.

Decrement the reference count of prev when dma_fence_add_callback()
fails, ensuring proper balance.

[phasta: add git tag info for stable kernel]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1135a[PII_REDACTED]466ea9ac37ebd756ecbe35fff; https://git.kernel.org/stable/c/35399c84dcedd6d31448fb9e1336ef52673f2882; https://git.kernel.org/stable/c/a952f1ab696873be124e31ce5ef964d36bce817f
CVE: CVE-2025-21996
Published: 2025-04-03
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()

On the off chance that command stream passed from userspace via
ioctl() call to radeon_vce_cs_parse() is weirdly crafted and
first command to execute is to encode (case 0x03000001), the function
in question will attempt to call radeon_vce_cs_reloc() with size
argument that has not been properly initialized. Specifically, 'size'
will point to 'tmp' variable before the latter had a chance to be
assigned any value.

Play it safe and init 'tmp' with 0, thus ensuring that
radeon_vce_cs_reloc() will catch an early error in cases like these.

Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.

(cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908, CWE-908
References: https://git.kernel.org/stable/c/0effb378ebce52b897f85cd7f828854b8c7cb636; https://git.kernel.org/stable/c/3ce08215cad55c10a6eeeb33d3583b6cfffe3ab8; https://git.kernel.org/stable/c/5b4d9d20fd455a97920cf158dd19163b879cf65d
CVE: CVE-2025-21997
Published: 2025-04-03
Description: In the Linux kernel, the following vulnerability has been resolved:

xsk: fix an integer overflow in xp_create_and_assign_umem()

Since the i and pool->chunk_size variables are of type 'u32',
their product can wrap around and then be cast to 'u64'.
This can lead to two different XDP buffers pointing to the same
memory area.

Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://git.kernel.org/stable/c/130290f44bce0eead2b827302109afc3fe189ddd; https://git.kernel.org/stable/c/205649d642a5b376724f04f3a5b3586815e43d3b; https://git.kernel.org/stable/c/559847f56769037e5b2e0474d3dbff985b98083d
CVE: CVE-2025-21998
Published: 2025-04-03
Description: In the Linux kernel, the following vulnerability has been resolved:

firmware: qcom: uefisecapp: fix efivars registration race

Since the conversion to using the TZ allocator, the efivars service is
registered before the memory pool has been allocated, something which
can lead to a NULL-pointer dereference in case of a racing EFI variable
access.

Make sure that all resources have been set up before registering the
efivars.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-367, CWE-476, CWE-476
References: https://git.kernel.org/stable/c/c4e37b381a7a243c298a4858fc0a5a74e737c79a; https://git.kernel.org/stable/c/da8d493a80993972c427002684d0742560f3be4a; https://git.kernel.org/stable/c/f15a2b96a0e41c426c63a932d0e63cde7b9784aa
CVE: CVE-2025-21999
Published: 2025-04-03
Description: In the Linux kernel, the following vulnerability has been resolved:

proc: fix UAF in proc_get_inode()

Fix race between rmmod and /proc/XXX's inode instantiation.

The bug is that pde->proc_ops don't belong to /proc, it belongs to a
module, therefore dereferencing it after /proc entry has been registered
is a bug unless use_pde/unuse_pde() pair has been used.

use_pde/unuse_pde can be avoided (2 atomic ops!) because pde->proc_ops
never changes so information necessary for inode instantiation can be
saved _before_ proc_register() in PDE itself and used later, avoiding
pde->proc_ops->...  dereference.

      rmmod                         lookup
sys_delete_module
                         proc_lookup_de
			   pde_get(de);
			   proc_get_inode(dir->i_sb, de);
  mod->exit()
    proc_remove
      remove_proc_subtree
       proc_entry_rundown(de);
  free_module(mod);

                               if (S_ISREG(inode->i_mode))
	                         if (de->proc_ops->proc_read_iter)
                           --> As module is already freed, will trigger UAF

BUG: unable to handle page fault for address: fffffbfff80a702b
PGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0
Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
RIP: 0010:proc_get_inode+0x302/0x6e0
RSP: 0018:ffff88811c837998 EFLAGS: 00010a06
RAX: dffffc[PII_REDACTED] RBX: ffffffffc0538140 RCX: [PII_REDACTED]
RDX: 1ffffffff80a702b RSI: [PII_REDACTED] RDI: ffffffffc0538158
RBP: ffff8881299a6000 R08:[PII_REDACTED]bbe1e5 R09: 1ffff11023906f20
R10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0
R13: ffff[PII_REDACTED]48 R14: ffff8881299a6004 R15: [PII_REDACTED]
FS:  00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:[PII_REDACTED]
CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
CR2: fffffbfff80a702b CR3:[PII_REDACTED]dd2000 CR4:[PII_REDACTED]0006f0
DR0: [PII_REDACTED] DR1: [PII_REDACTED] DR2: [PII_REDACTED]
DR3: [PII_REDACTED] DR6: 00000000fffe0ff0 DR7: [PII_REDACTED]
Call Trace:
 <TASK>
 proc_lookup_de+0x11f/0x2e0
 __lookup_slow+0x188/0x350
 walk_component+0x2ab/0x4f0
 path_lookupat+0x120/0x660
 filename_lookup+0x1ce/0x560
 vfs_statx+0xac/0x150
 __do_sys_newstat+0x96/0x110
 do_syscall_64+0x5f/0x170
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

[adobriyan@gmail.com: don't do 2 atomic ops on the common path]
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/4b0b8445b6fd41e6f62ac90547a0ea9d348de3fa; https://git.kernel.org/stable/c/63b53198aff2e4e6c5866a4ff73c7891f958ffa4; https://git.kernel.org/stable/c/64dc7c68e040251d9ec6e989acb69f8f6ae4a10b
CVE: CVE-2025-22000
Published: 2025-04-03
Description: In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: drop beyond-EOF folios with the right number of refs

When an after-split folio is large and needs to be dropped due to EOF,
folio_put_refs(folio, folio_nr_pages(folio)) should be used to drop all
page cache refs.  Otherwise, the folio will not be freed, causing memory
leak.

This leak would happen on a filesystem with blocksize > page_size and a
truncate is performed, where the blocksize makes folios split to >0 order
ones, causing truncated folios not being freed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/14efb4793519d73fb2902bb0ece319b886e4b4b9; https://git.kernel.org/stable/c/86368616a9ce51f6b41efa251b6e066893851d67; https://git.kernel.org/stable/c/92ad820a1f2d95d5a8d6c2bd3f391bbb068a5f9e
CVE: CVE-2025-22001
Published: 2025-04-03
Description: In the Linux kernel, the following vulnerability has been resolved:

accel/qaic: Fix integer overflow in qaic_validate_req()

These are u64 variables that come from the user via
qaic_attach_slice_bo_ioctl().  Use check_add_overflow() to ensure that
the math doesn't have an integer wrapping bug.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://git.kernel.org/stable/c/4b2a170c25862ad116bd31be6b9841646b4862e8; https://git.kernel.org/stable/c/57fae0c505f49bb1e3d5660cd2cc49697ed85f7c; https://git.kernel.org/stable/c/67d15c7aa0864dfd82325c7e7e7d8548b5224c7b
CVE: CVE-2025-22002
Published: 2025-04-03
Description: In the Linux kernel, the following vulnerability has been resolved:

netfs: Call `invalidate_cache` only if implemented

Many filesystems such as NFS and Ceph do not implement the
`invalidate_cache` method.  On those filesystems, if writing to the
cache (`NETFS_WRITE_TO_CACHE`) fails for some reason, the kernel
crashes like this:

 BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
 #PF: supervisor instruction fetch in kernel mode
 #PF: error_code(0x0010) - not-present page
 PGD 0 P4D 0
 Oops: Oops: 0010 [#1] SMP PTI
 CPU: 9 UID: 0 PID: 3380 Comm: kworker/u193:11 Not tainted 6.13.3-cm4all1-hp #437
 Hardware name: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 10/17/2018
 Workqueue: events_unbound netfs_write_collection_worker
 RIP: 0010:0x0
 Code: Unable to access opcode bytes at 0xffffffffffffffd6.
 RSP: 0018:ffff9b86e2ca7dc0 EFLAGS: 00010202
 RAX: [PII_REDACTED] RBX: [PII_REDACTED] RCX: 7fffffffffffffff
 RDX: [PII_REDACTED] RSI: ffff89259d576a18 RDI: ffff89259d576900
 RBP: ffff89259d5769b0 R08: ffff9b86e2ca7d28 R09: [PII_REDACTED]
 R10: ffff89258ceaca80 R11: [PII_REDACTED] R12: [PII_REDACTED]
 R13: ffff893d158b9338 R14: ffff89259d576900 R15: ffff89259d5769b0
 FS:  [PII_REDACTED](0000) GS:ffff893c9fa40000(0000) knlGS:[PII_REDACTED]
 CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
 CR2: ffffffffffffffd6 CR3:[PII_REDACTED]42e003 CR4:[PII_REDACTED]1706f0
 Call Trace:
  <TASK>
  ? __die+0x1f/0x60
  ? page_fault_oops+0x15c/0x460
  ? try_to_wake_up+0x2d2/0x530
  ? exc_page_fault+0x5e/0x100
  ? asm_exc_page_fault+0x22/0x30
  netfs_write_collection_worker+0xe9f/0x12b0
  ? xs_poll_check_readable+0x3f/0x80
  ? xs_stream_data_receive_workfn+0x8d/0x110
  process_one_work+0x134/0x2d0
  worker_thread+0x299/0x3a0
  ? __pfx_worker_thread+0x10/0x10
  kthread+0xba/0xe0
  ? __pfx_kthread+0x10/0x10
  ret_from_fork+0x30/0x50
  ? __pfx_kthread+0x10/0x10
  ret_from_fork_asm+0x1a/0x30
  </TASK>
 Modules linked in:
 CR2: [PII_REDACTED]

This patch adds the missing `NULL` check.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/0def1a40c3e76a468f8f66aa572caed44ec37277; https://git.kernel.org/stable/c/344b7ef248f420ed4ba3a3539cb0a0fc18df9a6c; https://git.kernel.org/stable/c/c2d5d14a7bcbb045d0cd0095cefe95f2a4b91159