deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-11817
Published: 2025-10-22
Description: The Simple Tableau Viz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableau' shortcode in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/simple-tableau-viz/tags/2.0/simple-tableau-viz.php#L24; https://wordpress.org/plugins/simple-tableau-viz/; https://www.wordfence.com/threat-intel/vulnerabilities/id/dbd33d03-81ba-468e-9e25-fe9f13914dbd?source=cve
CVE: CVE-2025-11818
Published: 2025-10-22
Description: The WP Responsive Meet The Team plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wprm_team' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-responsive-meet-the-team/tags/1.0.1/admin/layouts.php#L64; https://wordpress.org/plugins/wp-responsive-meet-the-team/; https://www.wordfence.com/threat-intel/vulnerabilities/id/30d79f14-b70c-403b-9e55-66e40b18aca7?source=cve
CVE: CVE-2025-11819
Published: 2025-10-22
Description: The WP-Thumbnail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'roboshot' shortcode in all versions up to, and including, 1.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-thumbnail/tags/1.1/wp-thumbnail.php#L67; https://wordpress.org/plugins/wp-thumbnail/; https://www.wordfence.com/threat-intel/vulnerabilities/id/9c641d50-51ac-47ca-beaf-3e79f436e091?source=cve
CVE: CVE-2025-11824
Published: 2025-10-22
Description: The Cinza Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cgrid_skin_content' post meta field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/cinza-grid/tags/1.2.1/includes/backend-cpts.php#L733; https://plugins.trac.wordpress.org/browser/cinza-grid/tags/1.2.1/includes/backend-shortcodes.php#L511; https://plugins.trac.wordpress.org/changeset/3381619/
CVE: CVE-2025-11825
Published: 2025-10-22
Description: The Playerzbr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'urlmeta' post meta field in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/playerzbr/tags/1.6/playerzbr.php#L193; https://plugins.trac.wordpress.org/browser/playerzbr/tags/1.6/playerzbr.php#L229; https://www.wordfence.com/threat-intel/vulnerabilities/id/ff065219-7f4f-4445-8dbe-11f4975f7bb9?source=cve
CVE: CVE-2025-11827
Published: 2025-10-22
Description: The Oboxmedia Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_widget' and 'after_widget' parameters of the oboxads-ad-widget shortcode in all versions up to, and including, 1.9.8. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/oboxmedia-ads/tags/1.9.8/includes/oboxads-ad-widget.php#L156; https://wordpress.org/plugins/oboxmedia-ads; https://www.wordfence.com/threat-intel/vulnerabilities/id/1d8b79cc-287e-420b-8eb8-6345a62e9fb9?source=cve
CVE: CVE-2025-11830
Published: 2025-10-22
Description: The WP Restaurant Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter of the restaurant_summary shortcode in all versions up to, and including, 1.0.2. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-restaurant-listings/tags/1.0.2/includes/class-wp-restaurant-listings-shortcodes.php#L511; https://www.wordfence.com/threat-intel/vulnerabilities/id/572b584e-b580-4d90-88b6-ee5b25678d9b?source=cve
CVE: CVE-2025-11834
Published: 2025-10-22
Description: The WP AD Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'startindex' parameter of the ad-gallery shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-ad-gallery/tags/1.3/shortcode/shortcode.php#L177; https://www.wordfence.com/threat-intel/vulnerabilities/id/0144ae03-00ce-481d-8d29-7a484f1f6cbf?source=cve
CVE: CVE-2025-11866
Published: 2025-10-22
Description: The Photographers galleries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcode attributes (`w`, `h`, `raw_css`, `look`, etc.) in all versions up to, and including, 1.1.8. This is due to the plugin not properly sanitizing user input or escaping output when inserting these values into HTML attributes and inline styles. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/photographers-galleries/tags/1.1.8/includes/shortcodes.php#L61; https://www.wordfence.com/threat-intel/vulnerabilities/id/9300af5d-7886-4f4e-8454-0dcf2d895fee?source=cve
CVE: CVE-2025-11867
Published: 2025-10-22
Description: The Bg Book Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `book_author` post meta, rendered through the `[book_author]` shortcode, in all versions up to, and including, 1.25. This is due to the plugin not properly escaping the meta value before output. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/bg-book-publisher/tags/1.25/bg_bpub.php#L121; https://www.wordfence.com/threat-intel/vulnerabilities/id/af181085-0a6b-4e87-b250-1fb4574d808d?source=cve
CVE: CVE-2025-11870
Published: 2025-10-22
Description: The Simple Business Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'simple_business_data' shortcode attributes in all versions up to, and including, 1.0.1. This is due to the plugin not properly sanitizing user input or escaping output when embedding the `type` attribute into the `class` attribute in rendered HTML. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/simple-business-data/tags/1.0.1/templates/simple-business-data-template.php#L14; https://www.wordfence.com/threat-intel/vulnerabilities/id/bd2754f9-11f7-4690-99dd-2204e69bf14b?source=cve
CVE: CVE-2025-11872
Published: 2025-10-22
Description: The Material Design Iconic Font Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdiconic' shortcode in all versions up to, and including, 2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/material-design-iconic-font-integration/tags/2/md-iconic-font-integration.php#L46; https://www.wordfence.com/threat-intel/vulnerabilities/id/06c1dc58-483e-49f7-aff0-e5a1e70bb149?source=cve
CVE: CVE-2025-11878
Published: 2025-10-22
Description: The ST Categories Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's st-categories shortcode in versions less than, or equal to, 1.0.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/st-category-wp/tags/1.0.0/st-categories-wp.php#L176; https://www.wordfence.com/threat-intel/vulnerabilities/id/0d127114-9c80-4722-953a-3ee1382b9f81?source=cve
CVE: CVE-2025-11880
Published: 2025-10-22
Description: The SM CountDown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's smcountdown shortcode in versions less than, or equal to, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/smcountdown/tags/1.2/smcountdown-widget.php#L67; https://www.wordfence.com/threat-intel/vulnerabilities/id/53419b7c-e1a5-46ef-9110-c88f43b7df1d?source=cve
CVE: CVE-2025-11883
Published: 2025-10-22
Description: The Responsive Progress Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rprogress shortcode in versions less than, or equal to, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/responsive-progress-bar/tags/1.0/responsive-progress-bar.php#L64; https://wordpress.org/plugins/responsive-progress-bar/; https://www.wordfence.com/threat-intel/vulnerabilities/id/e6ebe12c-17ed-4be9-8af7-4c822b753af1?source=cve
CVE: CVE-2025-11952
Published: 2025-10-22
Description: Stored Cross-site Scripting (XSS) in Oct8ne Chatbot v2.3. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting a malicious payload through the creation of a transcript that is sent by email. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user, through /Records/SendSummaryMail.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-oct8ne-chatbot
CVE: CVE-2025-41108
Published: 2025-10-22
Description: The communication protocol implemented in Ghost Robotics Vision 60 v0.27.2 could allow an attacker to send commands to the robot from an external attack station, impersonating the control station (tablet) and gaining unauthorised full control of the robot. The absence of encryption and authentication mechanisms in the communication protocol allows an attacker to capture legitimate traffic between the robot and the controller, replicate it, and send any valid command to the robot from any attacking computer or device. The communication protocol used in this interface is based on MAVLink, a widely documented protocol, which increases the likelihood of attack. There are two methods for connecting to the robot remotely: Wi-Fi and 4G/LTE.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ghost-robotics-vision-60
CVE: CVE-2025-41109
Published: 2025-10-22
Description: Ghost Robotics Vision 60 v0.27.2 includes, among its physical interfaces, three RJ45 connectors and a USB Type-C port. The vulnerability is due to the lack of authentication mechanisms when establishing connections through these ports. Specifically, with regard to network connectivity, the robot's internal router automatically assigns IP addresses to any device physically connected to it. An attacker could connect a WiFi access point under their control to gain access to the robot's network without needing the credentials for the deployed network. Once inside, the attacker can monitor all its data, as the robot runs on ROS 2 without authentication by default.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-798
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ghost-robotics-vision-60
CVE: CVE-2025-41110
Published: 2025-10-22
Description: Encrypted WiFi and SSH credentials were found in the Ghost Robotics Vision 60 v0.27.2 APK. This vulnerability allows an attacker to connect to the robot's WiFi and view all its data, as it runs on ROS 2 without default authentication. In addition, the attacker can connect via SSH and gain full control of the robot, which could cause physical damage to the robot itself or its environment.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-306
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ghost-robotics-vision-60
CVE: CVE-2025-11915
Published: 2025-10-22
Description: Connection desynchronization between an HTTP proxy and the model backend. The fixes were rolled out for all proxies in front of impacted models by 2025-09-28. Users do not need to take any action.
CWE: CWE-444
References: https://cloud.google.com/vertex-ai/generative-ai/docs/security-bulletins#gcp-2025-059
CVE: CVE-2025-6833
Published: 2025-10-22
Description: The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0 via the 'aio_time_clock_lite_js' AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber access and above, to clock other users in and out.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3336943%40aio-time-clock-lite&new=3336943%40aio-time-clock-lite&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/c6c48173-ffe3-40f8-a2fa-cee66869e343?source=cve
CVE: CVE-2025-11086
Published: 2025-10-22
Description: The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.7. This is due to the plugin not properly validating a user's role prior to registering a user via the Social Login addon. This makes it possible for unauthenticated attackers to update their role to Administrator when registering on the site.
CVSS Score: 8.1 (HIGH)
CWE: CWE-269
References: https://academylms.net/; https://academylms.net/whats-new/; https://www.wordfence.com/threat-intel/vulnerabilities/id/0f42f0be-5386-448b-9e65-5d2584cc2175?source=cve
CVE: CVE-2025-11411
Published: 2025-10-22
Description: NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks. Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. Usually these RRSets are used to update the resolver's knowledge of the zone's name servers. A malicious actor can exploit the possible poisonous effect by injecting NS RRSets (and possibly their respective address records) in a reply. This could be done for example by trying to spoof a packet or fragmentation attacks. Unbound would then proceed to update the NS RRSet data it already has since the new data has enough trust for it, i.e., in-zone data for the delegation point. Unbound 1.24.1 includes a fix that scrubs unsolicited NS RRSets (and their respective address records) from replies mitigating the possible poison effect. Unbound 1.24.2 includes an additional fix that scrubs unsolicited NS RRSets (and their respective address records) from YXDOMAIN and non-referral nodata replies, further mitigating the possible poison effect.
CWE: CWE-349
References: https://www.nlnetlabs.nl/downloads/unbound/CVE-2025-11411.txt; http://www.openwall.com/lists/oss-security/2025/11/26/4; https://lists.debian.org/debian-lts-announce/2025/11/msg00008.html
CVE: CVE-2022-50556
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

drm: Fix potential null-ptr-deref due to drmm_mode_config_init()

drmm_mode_config_init() will call drm_mode_create_standard_properties()
and won't check the ret value. When drm_mode_create_standard_properties()
failed due to alloc, property will be a NULL pointer and may causes the
null-ptr-deref. Fix the null-ptr-deref by adding the ret value check.

Found null-ptr-deref while testing insert module bochs:
general protection fault, probably for non-canonical address
    0xdffffc000000000c: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x[PII_REDACTED]000060-0x[PII_REDACTED]000067]
CPU: 3 PID: 249 Comm: modprobe Not tainted 6.1.0-rc1+ #364
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
RIP: 0010:drm_object_attach_property+0x73/0x3c0 [drm]
Call Trace:
 <TASK>
 __drm_connector_init+0xb6c/0x1100 [drm]
 bochs_pci_probe.cold.11+0x4cb/0x7fe [bochs]
 pci_device_probe+0x17d/0x340
 really_probe+0x1db/0x5d0
 __driver_probe_device+0x1e7/0x250
 driver_probe_device+0x4a/0x120
 __driver_attach+0xcd/0x2c0
 bus_for_each_dev+0x11a/0x1b0
 bus_add_driver+0x3d7/0x500
 driver_register+0x18e/0x320
 do_one_initcall+0xc4/0x3e0
 do_init_module+0x1b4/0x630
 load_module+0x5dca/0x7230
 __do_sys_finit_module+0x100/0x170
 do_syscall_64+0x3f/0x90
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7ff65af9f839
References: https://git.kernel.org/stable/c/5ae70041a6d7de62a0cdb2bbcfe0c9cf753035d0; https://git.kernel.org/stable/c/834c23e4f798dcdc8af251b3c428ceef94741991; https://git.kernel.org/stable/c/961620ad67611a7320a49f4b6f3c5e2906833a03
CVE: CVE-2022-50557
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

pinctrl: thunderbay: fix possible memory leak in thunderbay_build_functions()

The thunderbay_add_functions() will free memory of thunderbay_funcs
when everything is ok, but thunderbay_funcs will not be freed when
thunderbay_add_functions() fails, then there will be a memory leak,
so we need to add kfree() when thunderbay_add_functions() fails to
fix it.

In addition, doing some cleaner works, moving kfree(funcs) from
thunderbay_add_functions() to thunderbay_build_functions().
References: https://git.kernel.org/stable/c/3650943bab29d03ef[PII_REDACTED]7713ed1942cd; https://git.kernel.org/stable/c/83e1bcaf8cef26edaaf2a6098ef760f563683483; https://git.kernel.org/stable/c/aae4846e8e49044cb51d0276bec2a3fc2d5cd8da
CVE: CVE-2022-50558
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

regmap-irq: Use the new num_config_regs property in regmap_add_irq_chip_fwnode

Commit faa87ce9196d ("regmap-irq: Introduce config registers for irq
types") added the num_config_regs, then commit 9edd4f5aee84 ("regmap-irq:
Deprecate type registers and virtual registers") suggested to replace
num_type_reg with it. However, regmap_add_irq_chip_fwnode wasn't modified
to use the new property. Later on, commit 255a03bb1bb3 ("ASoC: wcd9335:
Convert irq chip to config regs") removed the old num_type_reg property
from the WCD9335 driver's struct regmap_irq_chip, causing a null pointer
dereference in regmap_irq_set_type when it tried to index d->type_buf as
it was never allocated in regmap_add_irq_chip_fwnode:

[   39.199374] Unable to handle kernel NULL pointer dereference at virtual address [PII_REDACTED]

[   39.200006] Call trace:
[   39.200014]  regmap_irq_set_type+0x84/0x1c0
[   39.200026]  __irq_set_trigger+0x60/0x1c0
[   39.200040]  __setup_irq+0x2f4/0x78c
[   39.200051]  request_threaded_irq+0xe8/0x1a0

Use num_config_regs in regmap_add_irq_chip_fwnode instead of num_type_reg,
and fall back to it if num_config_regs isn't defined to maintain backward
compatibility.
References: https://git.kernel.org/stable/c/57bb34330c0fc70bb4ab96399a3c1b80e73e9d49; https://git.kernel.org/stable/c/84498d1fb35de6ab71bdfdb6270a464fb4a0951b; https://git.kernel.org/stable/c/961db32e52f4d34a9a95939a30393fd190397f84
CVE: CVE-2022-50559
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

clk: imx: scu: fix memleak on platform_device_add() fails

No error handling is performed when platform_device_add()
fails. Add error processing before return, and modified
the return value.
References: https://git.kernel.org/stable/c/05fe0b3d69b8e094db207648ab21cade56d71cd8; https://git.kernel.org/stable/c/43c589b7a187ef481b594317eaab8c8f269e4a68; https://git.kernel.org/stable/c/855ae87a2073ebf1b395e020de54fdf9ce7d166f
CVE: CVE-2022-50561
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

iio: fix memory leak in iio_device_register_eventset()

When iio_device_register_sysfs_group() returns failed,
iio_device_register_eventset() needs to free attrs array.

Otherwise, kmemleak would scan & report memory leak as below:

unreferenced object 0xffff88810a1cc3c0 (size 32):
  comm "100-i2c-vcnl302", pid 728, jiffies[PII_REDACTED] (age 156.027s)
  backtrace:
    __kmalloc+0x46/0x1b0
    iio_device_register_eventset at drivers/iio/industrialio-event.c:541
    __iio_device_register at drivers/iio/industrialio-core.c:1959
    __devm_iio_device_register at drivers/iio/industrialio-core.c:2040
References: https://git.kernel.org/stable/c/5de3add7509c95685f1185683b817dd206c4b1f1; https://git.kernel.org/stable/c/86fdd15e10e404e70ecb2a3bff24d70356d42b36; https://git.kernel.org/stable/c/a154b1c139fbf6a49762159be81d425d41ceec87