deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-40333
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix infinite loop in __insert_extent_tree()

When we get wrong extent info data, and look up extent_node in rb tree,
it will cause infinite loop (CONFIG_F2FS_CHECK_FS=n). Avoiding this by
return NULL and print some kernel messages in that case.
References: https://git.kernel.org/stable/c/23361bd54966b437e1ed3eb1a704572f4b279e58; https://git.kernel.org/stable/c/765f8816d3959ef1f3f7f85e2af748594d091f40; https://git.kernel.org/stable/c/c0b9951bb2668d67eb4817bb23fc109abc08c075
CVE: CVE-2025-40334
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: validate userq buffer virtual address and size

It needs to validate the userq object virtual address to
determine whether it is residented in a valid vm mapping.
References: https://git.kernel.org/stable/c/5a577de86c4a1c67ca405571d6ef84e65c6897d1; https://git.kernel.org/stable/c/9e46b8bb0539d7bc9a9e7b3072fa4f[PII_REDACTED]
CVE: CVE-2025-40335
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: validate userq input args

This will help on validating the userq input args, and
rejecting for the invalid userq request at the IOCTLs
first place.
References: https://git.kernel.org/stable/c/219be4711a1ba788bc2a9fafc117139d133e5fea; https://git.kernel.org/stable/c/bdaa7ad3a5bb606d7dbd5c8627dc7efcb2392eb9
CVE: CVE-2025-40336
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/gpusvm: fix hmm_pfn_to_map_order() usage

Handle the case where the hmm range partially covers a huge page (like
2M), otherwise we can potentially end up doing something nasty like
mapping memory which is outside the range, and maybe not even mapped by
the mm. Fix is based on the xe userptr code, which in a future patch
will directly use gpusvm, so needs alignment here.

v2:
  - Add kernel-doc (Matt B)
  - s/fls/ilog2/ (Thomas)
References: https://git.kernel.org/stable/c/08e9fd78ba1b9e95141181c69cc51795c9888157; https://git.kernel.org/stable/c/c50729c68aaf93611c855752b00e49ce1fdd1558
CVE: CVE-2025-40337
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: Correctly handle Rx checksum offload errors

The stmmac_rx function would previously set skb->ip_summed to
CHECKSUM_UNNECESSARY if hardware checksum offload (CoE) was enabled
and the packet was of a known IP ethertype.

However, this logic failed to check if the hardware had actually
reported a checksum error. The hardware status, indicating a header or
payload checksum failure, was being ignored at this stage. This could
cause corrupt packets to be passed up the network stack as valid.

This patch corrects the logic by checking the `csum_none` status flag,
which is set when the hardware reports a checksum error. If this flag
is set, skb->ip_summed is now correctly set to CHECKSUM_NONE,
ensuring the kernel's network stack will perform its own validation and
properly handle the corrupt packet.
References: https://git.kernel.org/stable/c/1aa319e0f12d2d761a31556b82a5852c98eb0bea; https://git.kernel.org/stable/c/63fbe0e6413279d5ea5842e2423e351ded547683; https://git.kernel.org/stable/c/719fcdf29051f7471d5d433475af76219019d33d
CVE: CVE-2025-40338
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: Intel: avs: Do not share the name pointer between components

By sharing 'name' directly, tearing down components may lead to
use-after-free errors. Duplicate the name to avoid that.

At the same time, update the order of operations - since commit
cee28113db17 ("ASoC: dmaengine_pcm: Allow passing component name via
config") the framework does not override component->name if set before
invoking the initializer.
References: https://git.kernel.org/stable/c/128bf29c992988f8b4f[PII_REDACTED]908fde5ec86; https://git.kernel.org/stable/c/4dee5c1cc439b0d5ef87f741518268ad6a95b23d
CVE: CVE-2025-40339
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix nullptr err of vm_handle_moved

If a amdgpu_bo_va is fpriv->prt_va, the bo of this one is always NULL.
So, such kind of amdgpu_bo_va should be updated separately before
amdgpu_vm_handle_moved.
References: https://git.kernel.org/stable/c/273d1ea12e42e9babb[PII_REDACTED]f3c466f213d3; https://git.kernel.org/stable/c/47281febebe337586569aa4c5694a7511063a42e; https://git.kernel.org/stable/c/859958a7faefe5b7742b7b8cdbc170713d4bf158
CVE: CVE-2025-40340
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.

I saw an oops in xe_gem_fault when running the xe-fast-feedback
testlist against the realtime kernel without debug options enabled.

The panic happens after core_hotunplug unbind-rebind finishes.
Presumably what happens is that a process mmaps, unlocks because
of the FAULT_FLAG_RETRY_NOWAIT logic, has no process memory left,
causing ttm_bo_vm_dummy_page() to return VM_FAULT_NOPAGE, since
there was nothing left to populate, and then oopses in
"mem_type_is_vram(tbo->resource->mem_type)" because tbo->resource
is NULL.

It's convoluted, but fits the data and explains the oops after
the test exits.
References: https://git.kernel.org/stable/c/1cda3c755bb7770be07d75949bb0f45fb88651f6; https://git.kernel.org/stable/c/29a3064f9c5a908aaf0b39cd6ed30374db11840d; https://git.kernel.org/stable/c/99428bd6123d5676209dfb1d7a8f176cc830b665
CVE: CVE-2025-40341
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

futex: Don't leak robust_list pointer on exec race

sys_get_robust_list() and compat_get_robust_list() use ptrace_may_access()
to check if the calling task is allowed to access another task's
robust_list pointer. This check is racy against a concurrent exec() in the
target process.

During exec(), a task may transition from a non-privileged binary to a
privileged one (e.g., setuid binary) and its credentials/memory mappings
may change. If get_robust_list() performs ptrace_may_access() before
this transition, it may erroneously allow access to sensitive information
after the target becomes privileged.

A racy access allows an attacker to exploit a window during which
ptrace_may_access() passes before a target process transitions to a
privileged state via exec().

For example, consider a non-privileged task T that is about to execute a
setuid-root binary. An attacker task A calls get_robust_list(T) while T
is still unprivileged. Since ptrace_may_access() checks permissions
based on current credentials, it succeeds. However, if T begins exec
immediately afterwards, it becomes privileged and may change its memory
mappings. Because get_robust_list() proceeds to access T->robust_list
without synchronizing with exec() it may read user-space pointers from a
now-privileged process.

This violates the intended post-exec access restrictions and could
expose sensitive memory addresses or be used as a primitive in a larger
exploit chain. Consequently, the race can lead to unauthorized
disclosure of information across privilege boundaries and poses a
potential security risk.

Take a read lock on signal->exec_update_lock prior to invoking
ptrace_may_access() and accessing the robust_list/compat_robust_list.
This ensures that the target task's exec state remains stable during the
check, allowing for consistent and synchronized validation of
credentials.
References: https://git.kernel.org/stable/c/3b[PII_REDACTED]f6d4b8705a496dab03384b7ca998; https://git.kernel.org/stable/c/4aced32596ead1820b7dbd8e40d30b30dc1f3ad4; https://git.kernel.org/stable/c/6511984d1aa1360181bcafb1ca75df7f291ef237
CVE: CVE-2025-40342
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

nvme-fc: use lock accessing port_state and rport state

nvme_fc_unregister_remote removes the remote port on a lport object at
any point in time when there is no active association. This races with
with the reconnect logic, because nvme_fc_create_association is not
taking a lock to check the port_state and atomically increase the
active count on the rport.
References: https://git.kernel.org/stable/c/25f4bf1f7979a7871974fd36c79d69ff1cf4b446; https://git.kernel.org/stable/c/4253e0a4546138a2bf9cb6acf66b32fee677fc7c; https://git.kernel.org/stable/c/891cdbb162ccdb079cd5228ae43bdeebce8597ad
CVE: CVE-2025-40343
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

nvmet-fc: avoid scheduling association deletion twice

When forcefully shutting down a port via the configfs interface,
nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and
then nvmet_disable_port(). Both functions will eventually schedule all
remaining associations for deletion.

The current implementation checks whether an association is about to be
removed, but only after the work item has already been scheduled. As a
result, it is possible for the first scheduled work item to free all
resources, and then for the same work item to be scheduled again for
deletion.

Because the association list is an RCU list, it is not possible to take
a lock and remove the list entry directly, so it cannot be looked up
again. Instead, a flag (terminating) must be used to determine whether
the association is already in the process of being deleted.
References: https://git.kernel.org/stable/c/04d17540ef51e2c291eb863ca87fd332259b2d40; https://git.kernel.org/stable/c/2f4852db87e25d4e226b25cb6f652fef9504360e; https://git.kernel.org/stable/c/601ed47b2363c24d948d7bac0c23abc8bd459570
CVE: CVE-2025-40344
Published: 2025-12-09
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: Intel: avs: Disable periods-elapsed work when closing PCM

avs_dai_fe_shutdown() handles the shutdown procedure for HOST HDAudio
stream while period-elapsed work services its IRQs. As the former
frees the DAI's private context, these two operations shall be
synchronized to avoid slab-use-after-free or worse errors.
References: https://git.kernel.org/stable/c/845f716dc5f354c719f6fda35048b6c2eca99331; https://git.kernel.org/stable/c/b41fca4aa60be896ba8a81b57aac5dcc6eee66c0; https://git.kernel.org/stable/c/ca6d2b7aca778afbf8c0c4b330d10cb228c14052
CVE: CVE-2025-40800
Published: 2025-12-09
Description: A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), NX V2412 (All versions < V2412.8700), NX V2506 (All versions < V2506.6000), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Solid Edge SE2025 (All versions < V225.0 Update 10), Solid Edge SE2026 (All versions < V226.0 Update 1). The IAM client in affected products is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://cert-portal.siemens.com/productcert/html/ssa-212953.html; https://cert-portal.siemens.com/productcert/html/ssa-868571.html
CVE: CVE-2025-40801
Published: 2025-12-09
Description: A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), JT Bi-Directional Translator for STEP (All versions), NX V2412 (All versions < V2412.8900 with Cloud Entitlement (bundled as NX X)), NX V2506 (All versions < V2506.6000 with Cloud Entitlement (bundled as NX X)), Simcenter 3D (All versions < V2506.6000 with Cloud Entitlement (bundled as Simcenter X Mechanical)), Simcenter Femap (All versions < V2506.0002 with Cloud Entitlement (bundled as Simcenter X Mechanical)), Simcenter Studio (All versions < V2506.0001), Simcenter System Architect (All versions < V2506.0001), Tecnomatix Plant Simulation (All versions < V2504.0007). The SALT SDK is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: https://cert-portal.siemens.com/productcert/html/ssa-212953.html; https://cert-portal.siemens.com/productcert/html/ssa-710408.html
CVE: CVE-2025-40806
Published: 2025-12-09
Description: A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to user enumeration due to distinguishable responses. This could allow an unauthenticated remote attacker to determine if a user is valid or not, enabling a brute force attack with valid users.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204
References: https://cert-portal.siemens.com/productcert/html/ssa-356310.html
CVE: CVE-2025-40807
Published: 2025-12-09
Description: A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to capture-replay of authentication tokens. This could allow an authenticated but already locked-out user to establish still valid user sessions.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-294
References: https://cert-portal.siemens.com/productcert/html/ssa-356310.html
CVE: CVE-2025-40818
Published: 2025-12-09
Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications contain private SSL/TLS keys on the server that are not properly protected allowing any user with server access to read these keys. This could allow an authenticated attacker to impersonate the server potentially enabling man-in-the-middle, traffic decryption or unauthorized access to services that trust these certificates.
CVSS Score: 3.3 (LOW)
CWE: CWE-732
References: https://cert-portal.siemens.com/productcert/html/ssa-626856.html
CVE: CVE-2025-40819
Published: 2025-12-09
Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications do not properly validate license restrictions against the database, allowing direct modification of the system_ticketinfo table to bypass license limitations without proper enforcement checks. This could allow with database access to circumvent licensing restrictions by directly modifying database values and potentially enabling unauthorized use beyond the permitted scope.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://cert-portal.siemens.com/productcert/html/ssa-626856.html
CVE: CVE-2025-40820
Published: 2025-12-09
Description: Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services.
CVSS Score: 7.5 (HIGH)
CWE: CWE-940
References: https://cert-portal.siemens.com/productcert/html/ssa-915282.html
CVE: CVE-2025-40830
Published: 2025-12-09
Description: A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application does not have proper authorization checks for the file_transfer feature in ssmctl-client command. This could allow an authenticated, lowly privileged local attacker to read or write to any file on server or sensor.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-285
References: https://cert-portal.siemens.com/productcert/html/ssa-882673.html
CVE: CVE-2025-40831
Published: 2025-12-09
Description: A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application lacks input validation of date parameter in report generation functionality. This could allow an authenticated, lowly privileged attacker to cause denial of service condition of the report functionality.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://cert-portal.siemens.com/productcert/html/ssa-882673.html
CVE: CVE-2025-40935
Published: 2025-12-09
Description: A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.10.1), RUGGEDCOM RS416Pv2 V5.X (All versions < V5.10.1), RUGGEDCOM RS416v2 V5.X (All versions < V5.10.1), RUGGEDCOM RS900 (32M) V5.X (All versions < V5.10.1), RUGGEDCOM RS900G (32M) V5.X (All versions < V5.10.1), RUGGEDCOM RSG2100 (32M) V5.X (All versions < V5.10.1), RUGGEDCOM RSG2100P (32M) V5.X (All versions < V5.10.1), RUGGEDCOM RSG2288 V5.X (All versions < V5.10.1), RUGGEDCOM RSG2300 V5.X (All versions < V5.10.1), RUGGEDCOM RSG2300P V5.X (All versions < V5.10.1), RUGGEDCOM RSG2488 V5.X (All versions < V5.10.1), RUGGEDCOM RSG907R (All versions < V5.10.1), RUGGEDCOM RSG908C (All versions < V5.10.1), RUGGEDCOM RSG909R (All versions < V5.10.1), RUGGEDCOM RSG910C (All versions < V5.10.1), RUGGEDCOM RSG920P V5.X (All versions < V5.10.1), RUGGEDCOM RSL910 (All versions < V5.10.1), RUGGEDCOM RST2228 (All versions < V5.10.1), RUGGEDCOM RST2228P (All versions < V5.10.1), RUGGEDCOM RST916C (All versions < V5.10.1), RUGGEDCOM RST916P (All versions < V5.10.1). Affected devices do not properly validate input during the TLS certificate upload process of the web service. This could allow an authenticated remote attacker to trigger a device crash and reboot, leading to a temporary Denial of Service on the device.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://cert-portal.siemens.com/productcert/html/ssa-763474.html
CVE: CVE-2025-40937
Published: 2025-12-09
Description: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected application do not properly validate input parameters in its REST API, resulting in improper handling of unexpected arguments.
This could allow an authenticated attacker to execute arbitrary code with limited privileges.
CVSS Score: 8.3 (HIGH)
CWE: CWE-77
References: https://cert-portal.siemens.com/productcert/html/ssa-416652.html
CVE: CVE-2025-40938
Published: 2025-12-09
Description: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device stores sensitive information in the firmware. This could allow an attacker to access and misuse this information, potentially impacting the device’s confidentiality, integrity, and availability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-798
References: https://cert-portal.siemens.com/productcert/html/ssa-416652.html
CVE: CVE-2025-40939
Published: 2025-12-09
Description: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device contains a USB port which allows unauthenticated connections. This could allow an attacker with physical access to the device to trigger reboot that could cause denial of service condition.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-284
References: https://cert-portal.siemens.com/productcert/html/ssa-416652.html
CVE: CVE-2025-40940
Published: 2025-12-09
Description: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected application exhibits inconsistent SNMP behavior, such as unexpected service availability and unreliable configuration handling across protocol versions. This could allow an attacker to access sensitive data, potentially leading to a breach of confidentiality.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: https://cert-portal.siemens.com/productcert/html/ssa-416652.html
CVE: CVE-2025-40941
Published: 2025-12-09
Description: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected devices exposes server information in its responses.
This could allow an attacker with network access to gain useful information, increasing the likelihood of targeted attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://cert-portal.siemens.com/productcert/html/ssa-416652.html
CVE: CVE-2025-41692
Published: 2025-12-09
Description: A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-916
References: https://certvde.com/de/advisories/VDE-2025-071
CVE: CVE-2025-41693
Published: 2025-12-09
Description: A low privileged remote attacker can use the ssh feature to execute commands directly after login. The process stays open and uses resources which leads to a reduced performance of the management functions. Switching functionality is not affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770
References: https://certvde.com/de/advisories/VDE-2025-071
CVE: CVE-2025-41694
Published: 2025-12-09
Description: A low privileged remote attacker can run the webshell with an empty command containing whitespace. The server will then block until it receives more data, resulting in a DoS condition of the websserver.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://certvde.com/de/advisories/VDE-2025-071
CVE: CVE-2025-41695
Published: 2025-12-09
Description: An XSS vulnerability in dyn_conn.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://certvde.com/de/advisories/VDE-2025-071
CVE: CVE-2025-41696
Published: 2025-12-09
Description: An attacker can use an undocumented UART port on the PCB as a side-channel with the user hardcoded credentials obtained from CVE-2025-41692 to gain read access to parts of the filesystem of the device.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-798
References: https://certvde.com/de/advisories/VDE-2025-071
CVE: CVE-2025-41697
Published: 2025-12-09
Description: An attacker can use an undocumented UART port on the PCB as a side-channel    to get root access e.g. with the credentials obtained from CVE-2025-41692.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1299
References: https://certvde.com/de/advisories/VDE-2025-071
CVE: CVE-2025-41745
Published: 2025-12-09
Description: An XSS vulnerability in pxc_portCntr2.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://certvde.com/de/advisories/VDE-2025-071
CVE: CVE-2025-41746
Published: 2025-12-09
Description: An XSS vulnerability in pxc_portSecCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://certvde.com/de/advisories/VDE-2025-071