deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-12558
Published: 2025-12-09
Description: The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4 via the 'get_attachment_sizes' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the path and meta data of private attachments, which can be used to view the attachments.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/trunk/classes/class-fl-controls.php#L216; https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/trunk/classes/class-fl-controls.php#L71; https://plugins.trac.wordpress.org/changeset/3406987
CVE: CVE-2025-12705
Published: 2025-12-09
Description: The Social Reviews & Recommendations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in the 'trim_text' function in all versions up to, and including, 2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 2.5.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/fb-reviews-widget/trunk/includes/class-view.php#L447; https://plugins.trac.wordpress.org/browser/fb-reviews-widget/trunk/includes/class-view.php#L449; https://plugins.trac.wordpress.org/browser/fb-reviews-widget/trunk/includes/class-view.php#L452
CVE: CVE-2025-12807
Published: 2025-12-09
Description: A security issue was discovered in DataMosaix Private Cloud, allowing users with low privilege to perform sensitive database operations through exposed API endpoints.
CWE: CWE-89
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1765.html
CVE: CVE-2025-13031
Published: 2025-12-09
Description: The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.13 does not sanitize and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.9 (MEDIUM)
References: https://wpscan.com/vulnerability/9bf76fed-8f0a-4aef-8cf4-f6839c8f0a53/; https://wpscan.com/vulnerability/9bf76fed-8f0a-4aef-8cf4-f6839c8f0a53/
CVE: CVE-2025-13070
Published: 2025-12-09
Description: The CSV to SortTable WordPress plugin through 4.2 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as contributor to perform LFI attacks.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-22
References: https://wpscan.com/vulnerability/deb52d69-d7f8-43a5-a709-1f543fd343c6/
CVE: CVE-2025-13071
Published: 2025-12-09
Description: The Custom Admin Menu WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/83c47c58-0395-4224-beaa-2f64ed92ef16/
CVE: CVE-2025-13428
Published: 2025-12-09
Description: A vulnerability exists in the SecOps SOAR server. The custom integrations feature allowed an authenticated user with an "IDE role" to achieve Remote Code Execution (RCE) in the server. The flaw stemmed from weak validation of uploaded Python package code. An attacker could upload a package containing a malicious setup.py file, which would execute on the server during the installation process, leading to potential server compromise.

No customer action is required. 


All customers have been automatically upgraded to the fixed version: 6.3.64 or higher.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://cloud.google.com/support/bulletins#gcp-2025-075
CVE: CVE-2025-13604
Published: 2025-12-09
Description: The Login Security, FireWall, Malware removal by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the page URL in all versions up to, and including, 2.168 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/security-malware-firewall/tags/2.168/inc/spbc-settings.php#L2342; https://www.wordfence.com/threat-intel/vulnerabilities/id/1e35eb83-716e-4177-99ba-24a884725265?source=cve
CVE: CVE-2025-13642
Published: 2025-12-09
Description: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.7 due to insufficient input sanitization on the `type` parameter in the form preview functionality. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes via the `pp_preview_form` endpoint.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/wp-user-avatar/trunk/src/Classes/FormPreviewHandler.php#L15; https://plugins.trac.wordpress.org/browser/wp-user-avatar/trunk/src/Classes/FormPreviewHandler.php#L71; https://plugins.trac.wordpress.org/changeset/3408055/
CVE: CVE-2025-13659
Published: 2025-12-09
Description: Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files on the server, potentially leading to remote code execution. User interaction is required.
CVSS Score: 8.8 (HIGH)
CWE: CWE-913
References: https://forums.ivanti.com/s/article/Security-Advisory-EPM-December-2025-for-EPM-2024
CVE: CVE-2025-13661
Published: 2025-12-09
Description: Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory. User interaction is required.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22
References: https://forums.ivanti.com/s/article/Security-Advisory-EPM-December-2025-for-EPM-2024
CVE: CVE-2025-13662
Published: 2025-12-09
Description: Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary code. User Interaction is required.
CVSS Score: 7.8 (HIGH)
CWE: CWE-347
References: https://forums.ivanti.com/s/article/Security-Advisory-EPM-December-2025-for-EPM-2024
CVE: CVE-2025-14284
Published: 2025-12-09
Description: Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allowed in setting or toggling links. An attacker can execute arbitrary JavaScript code in the context of the application by injecting a javascript: URL payload into these attributes, which is then triggered either by user interaction.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/th4s1s/3d1b6cd3e7257b14947242f712ec6e1f; https://github.com/ueberdosis/tiptap/commit/1c2fefe3d61ab1c8fbaa6d6b597251e1b6d9aaed; https://github.com/ueberdosis/tiptap/releases/tag/v2.10.4
CVE: CVE-2025-14286
Published: 2025-12-09
Description: A vulnerability was determined in Tenda AC9 15.03.05.14_multi. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/DownloadCfg.jpg of the component Configuration File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN11.md; https://vuldb.com/?ctiid.334874; https://vuldb.com/?id.334874
CVE: CVE-2025-14306
Published: 2025-12-09
Description: A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. The recursivelyDelete method fails to properly sanitize file paths, allowing attackers to traverse directories and delete arbitrary files on the system. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the file path, leading to potential unauthorized file deletions.  https://robo-code.blogspot.com/
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://github.com/robo-code/robocode/pull/67; https://github.com/robo-code/robocode/commit/26b6ba8ed5b2a11a646ce2d5da8d42cd53574b1f
CVE: CVE-2025-14307
Published: 2025-12-09
Description: An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The createTempFile method fails to securely create temporary files, allowing attackers to exploit race conditions and potentially execute arbitrary code or overwrite critical files. This vulnerability can be exploited by manipulating the temporary file creation process, leading to potential unauthorized actions.
CVSS Score: 8.1 (HIGH)
CWE: CWE-377
References: https://github.com/robo-code/robocode/pull/68
CVE: CVE-2025-14308
Published: 2025-12-09
Description: An integer overflow vulnerability exists in the write method of the Buffer class in Robocode version 1.9.3.6. The method fails to properly validate the length of data being written, allowing attackers to cause an overflow, potentially leading to buffer overflows and arbitrary code execution. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the data length, leading to potential unauthorized code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://github.com/robo-code/robocode/pull/70
CVE: CVE-2025-14309
Published: 2025-12-09
Description: NULL Pointer Dereference vulnerability in ravynsoft ravynos.This issue affects ravynos: through 0.5.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/ravynsoft/ravynos/pull/502
CVE: CVE-2025-14310
Published: 2025-12-09
Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in rethinkdb.This issue affects rethinkdb: before 2.4.4.
CWE: CWE-120
References: https://github.com/rethinkdb/rethinkdb/pull/7163
CVE: CVE-2025-14311
Published: 2025-12-09
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JMRI.This issue affects JMRI: before 5.13.3.
CWE: CWE-22
References: https://github.com/JMRI/JMRI/pull/14340
CVE: CVE-2025-14321
Published: 2025-12-09
Description: Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1992760; https://www.mozilla.org/security/advisories/mfsa2025-92/; https://www.mozilla.org/security/advisories/mfsa2025-94/
CVE: CVE-2025-14322
Published: 2025-12-09
Description: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
CVSS Score: 8.0 (HIGH)
CWE: CWE-754
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1996473; https://www.mozilla.org/security/advisories/mfsa2025-92/; https://www.mozilla.org/security/advisories/mfsa2025-93/
CVE: CVE-2025-14323
Published: 2025-12-09
Description: Privilege escalation in the DOM: Notifications component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
CVSS Score: 8.8 (HIGH)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1996555; https://www.mozilla.org/security/advisories/mfsa2025-92/; https://www.mozilla.org/security/advisories/mfsa2025-93/
CVE: CVE-2025-14324
Published: 2025-12-09
Description: JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1996840; https://www.mozilla.org/security/advisories/mfsa2025-92/; https://www.mozilla.org/security/advisories/mfsa2025-93/
CVE: CVE-2025-14325
Published: 2025-12-09
Description: JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
CVSS Score: 7.3 (HIGH)
CWE: CWE-843
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1998050; https://www.mozilla.org/security/advisories/mfsa2025-92/; https://www.mozilla.org/security/advisories/mfsa2025-94/
CVE: CVE-2025-14326
Published: 2025-12-09
Description: Use-after-free in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 146 and Thunderbird 146.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1840666; https://www.mozilla.org/security/advisories/mfsa2025-92/; https://www.mozilla.org/security/advisories/mfsa2025-95/
CVE: CVE-2025-14327
Published: 2025-12-09
Description: Spoofing issue in the Downloads Panel component. This vulnerability was fixed in Firefox 146, Thunderbird 146, Firefox ESR 140.7, and Thunderbird 140.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-290, CWE-290
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1970743; https://www.mozilla.org/security/advisories/mfsa2025-92/; https://www.mozilla.org/security/advisories/mfsa2025-95/
CVE: CVE-2025-14328
Published: 2025-12-09
Description: Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
CVSS Score: 8.8 (HIGH)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1996761; https://www.mozilla.org/security/advisories/mfsa2025-92/; https://www.mozilla.org/security/advisories/mfsa2025-94/
CVE: CVE-2025-14329
Published: 2025-12-09
Description: Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
CVSS Score: 8.8 (HIGH)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1997018; https://www.mozilla.org/security/advisories/mfsa2025-92/; https://www.mozilla.org/security/advisories/mfsa2025-94/
CVE: CVE-2025-14330
Published: 2025-12-09
Description: JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-686, CWE-843
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1997503; https://www.mozilla.org/security/advisories/mfsa2025-92/; https://www.mozilla.org/security/advisories/mfsa2025-94/
CVE: CVE-2025-14331
Published: 2025-12-09
Description: Same-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346, CWE-346
References: https://bugzilla.mozilla.org/show_bug.cgi?id=2000218; https://www.mozilla.org/security/advisories/mfsa2025-92/; https://www.mozilla.org/security/advisories/mfsa2025-93/
CVE: CVE-2025-14332
Published: 2025-12-09
Description: Memory safety bugs present in Firefox 145 and Thunderbird 145. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 146 and Thunderbird 146.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1963153%2C1985058%2C1995637%2C1997118; https://www.mozilla.org/security/advisories/mfsa2025-92/; https://www.mozilla.org/security/advisories/mfsa2025-95/
CVE: CVE-2025-14333
Published: 2025-12-09
Description: Memory safety bugs present in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145 and Thunderbird 145. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
CVSS Score: 8.1 (HIGH)
CWE: CWE-787, CWE-119
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1966501%2C1997639; https://www.mozilla.org/security/advisories/mfsa2025-92/; https://www.mozilla.org/security/advisories/mfsa2025-94/
CVE: CVE-2025-14345
Published: 2025-12-09
Description: A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very short period of time. This error can cause the transaction coordination logic to misinterpret the transaction as committed, resulting in inconsistent state on those shards. This may lead to low integrity and availability impact.

This issue impacts MongoDB Server v8.0 versions prior to 8.0.16, MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB server v8.2 versions prior to 8.2.2.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-667
References: https://jira.mongodb.org/browse/SERVER-106075
CVE: CVE-2025-2296
Published: 2025-12-09
Description: EDK2 contains a vulnerability in BIOS where an attacker may cause “ Improper Input Validation” by local access. Successful exploitation of this vulnerability could alter control flow in unexpected ways, potentially allowing arbitrary command execution and impacting Confidentiality, Integrity, and Availability.
CWE: CWE-20
References: https://github.com/tianocore/edk2/security/advisories/GHSA-6pp6-cm5h-86g5
CVE: CVE-2025-40327
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

perf/core: Fix system hang caused by cpu-clock usage

cpu-clock usage by the async-profiler tool can trigger a system hang,
which got bisected back to the following commit by Octavia Togami:

  18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage") causes this issue

The root cause of the hang is that cpu-clock is a special type of SW
event which relies on hrtimers. The __perf_event_overflow() callback
is invoked from the hrtimer handler for cpu-clock events, and
__perf_event_overflow() tries to call cpu_clock_event_stop()
to stop the event, which calls htimer_cancel() to cancel the hrtimer.

But that's a recursion into the hrtimer code from a hrtimer handler,
which (unsurprisingly) deadlocks.

To fix this bug, use hrtimer_try_to_cancel() instead, and set
the PERF_HES_STOPPED flag, which causes perf_swevent_hrtimer()
to stop the event once it sees the PERF_HES_STOPPED flag.

[ mingo: Fixed the comments and improved the changelog. ]
References: https://git.kernel.org/stable/c/6b8c512811644cf2f5eaf6f44e928683c54127f0; https://git.kernel.org/stable/c/eb3182ef0405ff2f6668fd3e5ff9883f60ce8801
CVE: CVE-2025-40328
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF in smb2_close_cached_fid()

find_or_create_cached_dir() could grab a new reference after kref_put()
had seen the refcount drop to zero but before cfid_list_lock is acquired
in smb2_close_cached_fid(), leading to use-after-free.

Switch to kref_put_lock() so cfid_release() is called with
cfid_list_lock held, closing that gap.
References: https://git.kernel.org/stable/c/065bd62412271a2d734810dd50336cae88c54427; https://git.kernel.org/stable/c/734e99623c5b65bf2c03e35978a0b980ebc3c2f8; https://git.kernel.org/stable/c/bdb596ceb4b7c3f28786a[PII_REDACTED]8217fbcf5
CVE: CVE-2025-40329
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb

The Mesa issue referenced below pointed out a possible deadlock:

[ 1231.611031]  Possible interrupt unsafe locking scenario:

[ 1231.611033]        CPU0                    CPU1
[ 1231.611034]        ----                    ----
[ 1231.611035]   lock(&xa->xa_lock#17);
[ 1231.611038]                                local_irq_disable();
[ 1231.611039]                                lock(&fence->lock);
[ 1231.611041]                                lock(&xa->xa_lock#17);
[ 1231.611044]   <Interrupt>
[ 1231.611045]     lock(&fence->lock);
[ 1231.611047]
                *** DEADLOCK ***

In this example, CPU0 would be any function accessing job->dependencies
through the xa_* functions that don't disable interrupts (eg:
drm_sched_job_add_dependency(), drm_sched_entity_kill_jobs_cb()).

CPU1 is executing drm_sched_entity_kill_jobs_cb() as a fence signalling
callback so in an interrupt context. It will deadlock when trying to
grab the xa_lock which is already held by CPU0.

Replacing all xa_* usage by their xa_*_irq counterparts would fix
this issue, but Christian pointed out another issue: dma_fence_signal
takes fence.lock and so does dma_fence_add_callback.

  dma_fence_signal() // locks f1.lock
  -> drm_sched_entity_kill_jobs_cb()
  -> foreach dependencies
     -> dma_fence_add_callback() // locks f2.lock

This will deadlock if f1 and f2 share the same spinlock.

To fix both issues, the code iterating on dependencies and re-arming them
is moved out to drm_sched_entity_kill_jobs_work().

[phasta: commit message nits]
References: https://git.kernel.org/stable/c/0d63031ee4a57be0252cb9a4e09ae921c75cece9; https://git.kernel.org/stable/c/3e8ada4fd838e3fd2cca94000dac054f3a347c01; https://git.kernel.org/stable/c/487df8b698345dd5a91346335f05170ed5f29d4e
CVE: CVE-2025-40330
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Shutdown FW DMA in bnxt_shutdown()

The netif_close() call in bnxt_shutdown() only stops packet DMA.  There
may be FW DMA for trace logging (recently added) that will continue.  If
we kexec to a new kernel, the DMA will corrupt memory in the new kernel.

Add bnxt_hwrm_func_drv_unrgtr() to unregister the driver from the FW.
This will stop the FW DMA.  In case the call fails, call pcie_flr() to
reset the function and stop the DMA.
References: https://git.kernel.org/stable/c/1a8a15c3f71d1199d510ccba4bc201cbd2204048; https://git.kernel.org/stable/c/bc7208ca805ae6062f353a4753467d913d963bc6
CVE: CVE-2025-40331
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

sctp: Prevent TOCTOU out-of-bounds write

For the following path not holding the sock lock,

  sctp_diag_dump() -> sctp_for_each_endpoint() -> sctp_ep_dump()

make sure not to exceed bounds in case the address list has grown
between buffer allocation (time-of-check) and write (time-of-use).
References: https://git.kernel.org/stable/c/2fe08fcaacb7eb019fa9c81db39b2214de216677; https://git.kernel.org/stable/c/[PII_REDACTED]007fc2eae4a078f823c680fa52de1a; https://git.kernel.org/stable/c/584307275b2048991b2e[PII_REDACTED]b6cc0a9b85
CVE: CVE-2025-40332
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix mmap write lock not release

If mmap write lock is taken while draining retry fault, mmap write lock
is not released because svm_range_restore_pages calls mmap_read_unlock
then returns. This causes deadlock and system hangs later because mmap
read or write lock cannot be taken.

Downgrade mmap write lock to read lock if draining retry fault fix this
bug.
References: https://git.kernel.org/stable/c/7574f30337e19045f03126b4c51f525b84e5049e; https://git.kernel.org/stable/c/e2105ba1c262dcaa9573f11844b6e1e1ca762c3f; https://git.kernel.org/stable/c/f7569ef1cf978aa87aa81b5e9bf40a77497f3685