deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-54744
Published: 2025-09-05
Description: Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through <= 3.6.15.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/masterstudy-lms-learning-management-system/vulnerability/wordpress-masterstudy-lms-plugin-3-6-15-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-57889
Published: 2025-09-05
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 InPost Gallery inpost-gallery allows PHP Local File Inclusion.This issue affects InPost Gallery: from n/a through <= 2.1.4.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/inpost-gallery/vulnerability/wordpress-inpost-gallery-plugin-2-1-4-5-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-58206
Published: 2025-09-05
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MaxCoach maxcoach allows PHP Local File Inclusion.This issue affects MaxCoach: from n/a through <= 3.2.5.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/maxcoach/vulnerability/wordpress-maxcoach-theme-3-2-5-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-58214
Published: 2025-09-05
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Indutri indutri allows PHP Local File Inclusion.This issue affects Indutri: from n/a through < 1.3.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/indutri/vulnerability/wordpress-indutri-theme-1-3-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-58440
Published: 2025-09-05
Description: Rejected reason: The unisharp/laravel-filemanager is a separate project, unrelated to laravel-filemanager.
CVE: CVE-2025-58628
Published: 2025-09-05
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav Miraculous miraculous allows Blind SQL Injection.This issue affects Miraculous: from n/a through < 2.0.9.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Theme/miraculous/vulnerability/wordpress-miraculous-theme-2-0-9-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-9998
Published: 2025-09-05
Description: The sequence of packets received by a Networking server are not correctly checked.

An attacker could exploit this vulnerability to send specially crafted messages to force the application to stop.
CWE: CWE-754
References: https://www.pcvue.com/security/#SB2025-4
CVE: CVE-2025-9999
Published: 2025-09-05
Description: Some payload elements of the messages sent between two stations in a networking architecture are not properly checked on the receiving station allowing an attacker to execute unauthorized commands in the application.
CWE: CWE-940, CWE-1288
References: https://www.pcvue.com/security/#SB2025-4
CVE: CVE-2025-10014
Published: 2025-09-05
Description: A flaw has been found in elunez eladmin up to 2.7. This impacts the function updateUserEmail of the file /api/users/updateEmail/ of the component Email Address Handler. Executing manipulation of the argument id/email can lead to improper authorization. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is said to be difficult. The exploit has been published and may be used. It is required to know the RSA-encrypted password of the attacked user account.
CVSS Score: 3.1 (LOW)
CWE: CWE-266, CWE-285
References: https://vuldb.com/?ctiid.322739; https://vuldb.com/?id.322739; https://vuldb.com/?submit.643840
CVE: CVE-2025-30198
Published: 2025-09-05
Description: ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-321, CWE-798, CWE-798
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-135-19.json; https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19; https://www.cve.org/CVERecord?id=CVE-2025-30198
CVE: CVE-2025-30199
Published: 2025-09-05
Description: ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection between robot and base station.
CVSS Score: 7.2 (HIGH)
CWE: CWE-494
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-135-19.json; https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19; https://www.cve.org/CVERecord?id=CVE-2025-30199
CVE: CVE-2025-30200
Published: 2025-09-05
Description: ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-321, CWE-798
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-135-19.json; https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-19; https://www.cve.org/CVERecord?id=CVE-2025-30200
CVE: CVE-2025-35451
Published: 2025-09-05
Description: PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The passwords can readily be cracked. Many cameras have SSH or telnet listening on all interfaces. The passwords cannot be changed by the user, nor can the SSH or telnet service be disabled by the user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-162-10.json; https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-10; https://www.cve.org/CVERecord?id=CVE-2025-35451
CVE: CVE-2025-35452
Published: 2025-09-05
Description: PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use default, shared credentials for the administrative web interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-1392
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-162-10.json; https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-10; https://www.cve.org/CVERecord?id=CVE-2025-35452
CVE: CVE-2025-38731
Published: 2025-09-05
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Fix vm_bind_ioctl double free bug

If the argument check during an array bind fails, the bind_ops are freed
twice as seen below. Fix this by setting bind_ops to NULL after freeing.

==================================================================
BUG: KASAN: double-free in xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]
Free of addr ffff88813bb9b800 by task xe_vm/14198

CPU: 5 UID: 0 PID: 14198 Comm: xe_vm Not tainted 6.16.0-xe-eudebug-cmanszew+ #520 PREEMPT(full)
Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR5 RVP, BIOS ADLPFWI1.R00.2411.A02[PII_REDACTED] 10/08/2021
Call Trace:
 <TASK>
 dump_stack_lvl+0x82/0xd0
 print_report+0xcb/0x610
 ? __virt_addr_valid+0x19a/0x300
 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]
 kasan_report_invalid_free+0xc8/0xf0
 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]
 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]
 check_slab_allocation+0x102/0x130
 kfree+0x10d/0x440
 ? should_fail_ex+0x57/0x2f0
 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]
 xe_vm_bind_ioctl+0x1b2/0x21f0 [xe]
 ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe]
 ? __lock_acquire+0xab9/0x27f0
 ? lock_acquire+0x165/0x300
 ? drm_dev_enter+0x53/0xe0 [drm]
 ? find_held_lock+0x2b/0x80
 ? drm_dev_exit+0x30/0x50 [drm]
 ? drm_ioctl_kernel+0x128/0x1c0 [drm]
 drm_ioctl_kernel+0x128/0x1c0 [drm]
 ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe]
 ? find_held_lock+0x2b/0x80
 ? __pfx_drm_ioctl_kernel+0x10/0x10 [drm]
 ? should_fail_ex+0x57/0x2f0
 ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe]
 drm_ioctl+0x352/0x620 [drm]
 ? __pfx_drm_ioctl+0x10/0x10 [drm]
 ? __pfx_rpm_resume+0x10/0x10
 ? do_raw_spin_lock+0x11a/0x1b0
 ? find_held_lock+0x2b/0x80
 ? __pm_runtime_resume+0x61/0xc0
 ? rcu_is_watching+0x20/0x50
 ? trace_irq_enable.constprop.0+0xac/0xe0
 xe_drm_ioctl+0x91/0xc0 [xe]
 __x64_sys_ioctl+0xb2/0x100
 ? rcu_is_watching+0x20/0x50
 do_syscall_64+0x68/0x2e0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7fa9acb24ded

(cherry picked from commit a01b704527c28a2fd43a17a85f8996b75ec8492a)
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://git.kernel.org/stable/c/111fb43a557726079a67ce3ab51f602ddbf7097e; https://git.kernel.org/stable/c/77a946bf1af0e8110ef6e243394217a17f9b7e33
CVE: CVE-2025-38732
Published: 2025-09-05
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_reject: don't leak dst refcount for loopback packets

recent patches to add a WARN() when replacing skb dst entry found an
old bug:

WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline]
WARNING: include/linux/skbuff.h:1165 skb_dst_set include/linux/skbuff.h:1210 [inline]
WARNING: include/linux/skbuff.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234
[..]
Call Trace:
 nf_send_unreach+0x17b/0x6e0 net/ipv4/netfilter/nf_reject_ipv4.c:325
 nft_reject_inet_eval+0x4bc/0x690 net/netfilter/nft_reject_inet.c:27
 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline]
 ..

This is because blamed commit forgot about loopback packets.
Such packets already have a dst_entry attached, even at PRE_ROUTING stage.

Instead of checking hook just check if the skb already has a route
attached to it.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/51e8531371f90bee742c63775c9a568e5d6bf3c5; https://git.kernel.org/stable/c/7b8b503c06274ef3c6c1a107743f1ec0d0a53ef8; https://git.kernel.org/stable/c/82ef97abf22790182f7d433c74960dfd61b99c33
CVE: CVE-2025-38733
Published: 2025-09-05
Description: In the Linux kernel, the following vulnerability has been resolved:

s390/mm: Do not map lowcore with identity mapping

Since the identity mapping is pinned to address zero the lowcore is always
also mapped to address zero, this happens regardless of the relocate_lowcore
command line option. If the option is specified the lowcore is mapped
twice, instead of only once.

This means that NULL pointer accesses will succeed instead of causing an
exception (low address protection still applies, but covers only parts).
To fix this never map the first two pages of physical memory with the
identity mapping.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/1d7864acd497cb468a998d44631f84896f885e85; https://git.kernel.org/stable/c/30bf5728bb217a6d1ba73f44094c9b9c6bc9a567; https://git.kernel.org/stable/c/93f616ff870a1fb7e84d472cad0af651b18f9f87
CVE: CVE-2025-38735
Published: 2025-09-05
Description: In the Linux kernel, the following vulnerability has been resolved:

gve: prevent ethtool ops after shutdown

A crash can occur if an ethtool operation is invoked
after shutdown() is called.

shutdown() is invoked during system shutdown to stop DMA operations
without performing expensive deallocations. It is discouraged to
unregister the netdev in this path, so the device may still be visible
to userspace and kernel helpers.

In gve, shutdown() tears down most internal data structures. If an
ethtool operation is dispatched after shutdown(), it will dereference
freed or NULL pointers, leading to a kernel panic. While graceful
shutdown normally quiesces userspace before invoking the reboot
syscall, forced shutdowns (as observed on GCP VMs) can still trigger
this path.

Fix by calling netif_device_detach() in shutdown().
This marks the device as detached so the ethtool ioctl handler
will skip dispatching operations to the driver.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/48a4e89d50e8ea52e800bc7865970b92fcf4647c; https://git.kernel.org/stable/c/75a9a46d67f46d608205888f9b34e315c1786345; https://git.kernel.org/stable/c/9d8a41e9a4ff83ff666de811e7f012167cdc00e9
CVE: CVE-2025-38736
Published: 2025-09-05
Description: In the Linux kernel, the following vulnerability has been resolved:

net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization

Syzbot reported shift-out-of-bounds exception on MDIO bus initialization.

The PHY address should be masked to 5 bits (0-31). Without this
mask, invalid PHY addresses could be used, potentially causing issues
with MDIO bus operations.

Fix this by masking the PHY address with 0x1f (31 decimal) to ensure
it stays within the valid range.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/22042ffedd8c2c6db08ccdd6d4273068eddd3c5c; https://git.kernel.org/stable/c/24ef2f53c07f273bad99173e27ee88d44d135b1c; https://git.kernel.org/stable/c/523eab02fce458fa6d3c51de5bb[PII_REDACTED]53e
CVE: CVE-2025-38737
Published: 2025-09-05
Description: In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix oops due to uninitialised variable

Fix smb3_init_transform_rq() to initialise buffer to NULL before calling
netfs_alloc_folioq_buffer() as netfs assumes it can append to the buffer it
is given.  Setting it to NULL means it should start a fresh buffer, but the
value is currently undefined.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://git.kernel.org/stable/c/453a6d2a68e54a483d67233c6e1e24c4095ee4be; https://git.kernel.org/stable/c/4931fe2dbe1cc0e7d350a4b51b0b330e43971d98; https://git.kernel.org/stable/c/6adaa9fae36f848afa7278945d725e197e33c496
CVE: CVE-2025-39673
Published: 2025-09-05
Description: In the Linux kernel, the following vulnerability has been resolved:

ppp: fix race conditions in ppp_fill_forward_path

ppp_fill_forward_path() has two race conditions:

1. The ppp->channels list can change between list_empty() and
   list_first_entry(), as ppp_lock() is not held. If the only channel
   is deleted in ppp_disconnect_channel(), list_first_entry() may
   access an empty head or a freed entry, and trigger a panic.

2. pch->chan can be NULL. When ppp_unregister_channel() is called,
   pch->chan is set to NULL before pch is removed from ppp->channels.

Fix these by using a lockless RCU approach:
- Use list_first_or_null_rcu() to safely test and access the first list
  entry.
- Convert list modifications on ppp->channels to their RCU variants and
  add synchronize_net() after removal.
- Check for a NULL pch->chan before dereferencing it.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://git.kernel.org/stable/c/0417adf367a0af11adf7ace849af4638cfb573f7; https://git.kernel.org/stable/c/0f1630be6fcca3f0c63e4b242ad202e5cde28a40; https://git.kernel.org/stable/c/94731cc551e29511d85aa8dec61a6c071b1f2430
CVE: CVE-2025-39674
Published: 2025-09-05
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: ufs-qcom: Fix ESI null pointer dereference

ESI/MSI is a performance optimization feature that provides dedicated
interrupts per MCQ hardware queue. This is optional feature and UFS MCQ
should work with and without ESI feature.

Commit e46a28cea29a ("scsi: ufs: qcom: Remove the MSI descriptor abuse")
brings a regression in ESI (Enhanced System Interrupt) configuration that
causes a null pointer dereference when Platform MSI allocation fails.

The issue occurs in when platform_device_msi_init_and_alloc_irqs() in
ufs_qcom_config_esi() fails (returns -EINVAL) but the current code uses
__free() macro for automatic cleanup free MSI resources that were never
successfully allocated.

Unable to handle kernel NULL pointer dereference at virtual
address [PII_REDACTED]

  Call trace:
  mutex_lock+0xc/0x54 (P)
  platform_device_msi_free_irqs_all+0x1c/0x40
  ufs_qcom_config_esi+0x1d0/0x220 [ufs_qcom]
  ufshcd_config_mcq+0x28/0x104
  ufshcd_init+0xa3c/0xf40
  ufshcd_pltfrm_init+0x504/0x7d4
  ufs_qcom_probe+0x20/0x58 [ufs_qcom]

Fix by restructuring the ESI configuration to try MSI allocation first,
before any other resource allocation and instead use explicit cleanup
instead of __free() macro to avoid cleanup of unallocated resources.

Tested on SM8750 platform with MCQ enabled, both with and without
Platform ESI support.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/6300d5c5438724c0876828da2f6e2c1a661871fc; https://git.kernel.org/stable/c/aaf17a35a59572c8b[PII_REDACTED]9c3dbb0ebb50a
CVE: CVE-2025-39675
Published: 2025-09-05
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session()

The function mod_hdcp_hdcp1_create_session() calls the function
get_first_active_display(), but does not check its return value.
The return value is a null pointer if the display list is empty.
This will lead to a null pointer dereference.

Add a null pointer check for get_first_active_display() and return
MOD_HDCP_STATUS_DISPLAY_NOT_FOUND if the function return null.

This is similar to the commit c3e9826a2202
("drm/amd/display: Add null pointer check for get_first_active_display()").

(cherry picked from commit 5e43eb3cd731649c4f8b9134f857be62a416c893)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/2af45aadb7b5d3852c76e2d1e985289ada6f48bf; https://git.kernel.org/stable/c/2ee86b764c54e0d6a5464fb023b630fdf20869cd; https://git.kernel.org/stable/c/7a2ca2ea64b1b63c8baa94a8f5deb70b2248d119
CVE: CVE-2025-39676
Published: 2025-09-05
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: qla4xxx: Prevent a potential error pointer dereference

The qla4xxx_get_ep_fwdb() function is supposed to return NULL on error,
but qla4xxx_ep_connect() returns error pointers.  Propagating the error
pointers will lead to an Oops in the caller, so change the error pointers
to NULL.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/325bf7d57c4e2a341e381c5805e454fb69dd78c3; https://git.kernel.org/stable/c/46288d12d1c30d08fbeffd05abc079f57a43a2d4; https://git.kernel.org/stable/c/9dcf111dd3e7ed5fce82bb108e3a3fc001c07225
CVE: CVE-2025-39677
Published: 2025-09-05
Description: In the Linux kernel, the following vulnerability has been resolved:

net/sched: Fix backlog accounting in qdisc_dequeue_internal

This issue applies for the following qdiscs: hhf, fq, fq_codel, and
fq_pie, and occurs in their change handlers when adjusting to the new
limit. The problem is the following in the values passed to the
subsequent qdisc_tree_reduce_backlog call given a tbf parent:

   When the tbf parent runs out of tokens, skbs of these qdiscs will
   be placed in gso_skb. Their peek handlers are qdisc_peek_dequeued,
   which accounts for both qlen and backlog. However, in the case of
   qdisc_dequeue_internal, ONLY qlen is accounted for when pulling
   from gso_skb. This means that these qdiscs are missing a
   qdisc_qstats_backlog_dec when dropping packets to satisfy the
   new limit in their change handlers.

   One can observe this issue with the following (with tc patched to
   support a limit of 0):

   export TARGET=fq
   tc qdisc del dev lo root
   tc qdisc add dev lo root handle 1: tbf rate 8bit burst 100b latency 1ms
   tc qdisc replace dev lo handle 3: parent 1:1 $TARGET limit 1000
   echo ''; echo 'add child'; tc -s -d qdisc show dev lo
   ping -I lo -f -c2 -s32 -W0.001 127.0.0.1 2>&1 >/dev/null
   echo ''; echo 'after ping'; tc -s -d qdisc show dev lo
   tc qdisc change dev lo handle 3: parent 1:1 $TARGET limit 0
   echo ''; echo 'after limit drop'; tc -s -d qdisc show dev lo
   tc qdisc replace dev lo handle 2: parent 1:1 sfq
   echo ''; echo 'post graft'; tc -s -d qdisc show dev lo

   The second to last show command shows 0 packets but a positive
   number (74) of backlog bytes. The problem becomes clearer in the
   last show command, where qdisc_purge_queue triggers
   qdisc_tree_reduce_backlog with the positive backlog and causes an
   underflow in the tbf parent's backlog (4096 Mb instead of 0).

To fix this issue, the codepath for all clients of qdisc_dequeue_internal
has been simplified: codel, pie, hhf, fq, fq_pie, and fq_codel.
qdisc_dequeue_internal handles the backlog adjustments for all cases that
do not directly use the dequeue handler.

The old fq_codel_change limit adjustment loop accumulated the arguments to
the subsequent qdisc_tree_reduce_backlog call through the cstats field.
However, this is confusing and error prone as fq_codel_dequeue could also
potentially mutate this field (which qdisc_dequeue_internal calls in the
non gso_skb case), so we have unified the code here with other qdiscs.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/52bf272636bda69587952b35ae97690b8dc89941; https://git.kernel.org/stable/c/a225f44d84b8900d679c5f5a9ea46fe9c0cc7802
CVE: CVE-2025-39678
Published: 2025-09-05
Description: In the Linux kernel, the following vulnerability has been resolved:

platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL

If metric table address is not allocated, accessing metrics_bin will
result in a NULL pointer dereference, so add a check.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/2c78fb287e1f430b929f2e[PII_REDACTED]0d15605c; https://git.kernel.org/stable/c/782977c0d8ba432b6fd3d5d0d87016a523ec1c69; https://git.kernel.org/stable/c/d47782d5c0cb87b9826041f[PII_REDACTED]4ccf703
CVE: CVE-2025-39679
Published: 2025-09-05
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor().

When the nvif_vmm_type is invalid, we will return error directly
without freeing the args in nvif_vmm_ctor(), which leading a memory
leak. Fix it by setting the ret -EINVAL and goto done.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/72553fe19317fe93cb8591c83095c446bc7fe292; https://git.kernel.org/stable/c/7d9110e3b35d08832661da1a1fc2d24455981a04; https://git.kernel.org/stable/c/bb8aeaa3191b617c6faf8ae937252e059673b7ea
CVE: CVE-2025-39680
Published: 2025-09-05
Description: In the Linux kernel, the following vulnerability has been resolved:

i2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer

The data->block[0] variable comes from user. Without proper check,
the variable may be very large to cause an out-of-bounds bug.

Fix this bug by checking the value of data->block[0] first.

1. commit 39244cc75482 ("i2c: ismt: Fix an out-of-bounds bug in
   ismt_access()")
2. commit 92fbb6d1296f ("i2c: xgene-slimpro: Fix out-of-bounds bug in
   xgene_slimpro_i2c_xfer()")
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/071e43fcba5ddd9a7813e6cc0aa10299eae41b21; https://git.kernel.org/stable/c/57f312b955938fc4663f430cb57a71f2414f601b
CVE: CVE-2025-39681
Published: 2025-09-05
Description: In the Linux kernel, the following vulnerability has been resolved:

x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper

Since

  923f3a2b48bd ("x86/resctrl: Query LLC monitoring properties once during boot")

resctrl_cpu_detect() has been moved from common CPU initialization code to
the vendor-specific BSP init helper, while Hygon didn't put that call in their
code.

This triggers a division by zero fault during early booting stage on our
machines with X86_FEATURE_CQM* supported, where get_rdt_mon_resources() tries
to calculate mon_l3_config with uninitialized boot_cpu_data.x86_cache_occ_scale.

Add the missing resctrl_cpu_detect() in the Hygon BSP init helper.

  [ bp: Massage commit message. ]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/62f12cde[PII_REDACTED]a7540e85606869bd69432; https://git.kernel.org/stable/c/7207923d8453ebfb35667c1736169f2dd796772e; https://git.kernel.org/stable/c/873f32201df8876bdb2563e3187e79149427cab4