deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-37958
Published: 2025-05-20
Description: In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: fix dereferencing invalid pmd migration entry

When migrating a THP, concurrent access to the PMD migration entry during
a deferred split scan can lead to an invalid address access, as
illustrated below.  To prevent this invalid access, it is necessary to
check the PMD migration entry and return early.  In this context, there is
no need to use pmd_to_swp_entry and pfn_swap_entry_to_page to verify the
equality of the target folio.  Since the PMD migration entry is locked, it
cannot be served as the target.

Mailing list discussion and explanation from Hugh Dickins: "An anon_vma
lookup points to a location which may contain the folio of interest, but
might instead contain another folio: and weeding out those other folios is
precisely what the "folio != pmd_folio((*pmd)" check (and the "risk of
replacing the wrong folio" comment a few lines above it) is for."

BUG: unable to handle page fault for address: ffffea60001db008
CPU: 0 UID: 0 PID: 2199114 Comm: tee Not tainted 6.14.0+ #4 NONE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:split_huge_pmd_locked+0x3b5/0x2b60
Call Trace:
<TASK>
try_to_migrate_one+0x28c/0x3730
rmap_walk_anon+0x4f6/0x770
unmap_folio+0x196/0x1f0
split_huge_page_to_list_to_order+0x9f6/0x1560
deferred_split_scan+0xac5/0x12a0
shrinker_debugfs_scan_write+0x376/0x470
full_proxy_write+0x15c/0x220
vfs_write+0x2fc/0xcb0
ksys_write+0x146/0x250
do_syscall_64+0x6a/0x120
entry_SYSCALL_64_after_hwframe+0x76/0x7e

The bug is found by syzkaller on an internal kernel, then confirmed on
upstream.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/22f[PII_REDACTED]260e862f35151d2e1c55cb1dc75; https://git.kernel.org/stable/c/3977946f61cdba87b6b5aaf7d7094e96089583a5; https://git.kernel.org/stable/c/6166c3cf405441f7147b322980144feb3cefc617
CVE: CVE-2025-37960
Published: 2025-05-20
Description: In the Linux kernel, the following vulnerability has been resolved:

memblock: Accept allocated memory before use in memblock_double_array()

When increasing the array size in memblock_double_array() and the slab
is not yet available, a call to memblock_find_in_range() is used to
reserve/allocate memory. However, the range returned may not have been
accepted, which can result in a crash when booting an SNP guest:

  RIP: 0010:memcpy_orig+0x68/0x130
  Code: ...
  RSP: 0000:ffffffff9cc03ce8 EFLAGS: 00010006
  RAX: ff11001ff83e5000 RBX: [PII_REDACTED] RCX: fffffffffffff000
  RDX:[PII_REDACTED]000bc0 RSI: ffffffff9dba8860 RDI: ff11001ff83e5c00
  RBP: [PII_REDACTED] R08: [PII_REDACTED] R09: [PII_REDACTED]
  R10: 000000207fffe000 R11: [PII_REDACTED] R12: ffffffff9d06ef78
  R13: ff11001ff83e5000 R14: ffffffff9dba7c60 R15:[PII_REDACTED]000c00
  memblock_double_array+0xff/0x310
  memblock_add_range+0x1fb/0x2f0
  memblock_reserve+0x4f/0xa0
  memblock_alloc_range_nid+0xac/0x130
  memblock_alloc_internal+0x53/0xc0
  memblock_alloc_try_nid+0x3d/0xa0
  swiotlb_init_remap+0x149/0x2f0
  mem_init+0xb/0xb0
  mm_core_init+0x8f/0x350
  start_kernel+0x17e/0x5d0
  x86_64_start_reservations+0x14/0x30
  x86_64_start_kernel+0x92/0xa0
  secondary_startup_64_no_verify+0x194/0x19b

Mitigate this by calling accept_memory() on the memory range returned
before the slab is available.

Prior to v6.12, the accept_memory() interface used a 'start' and 'end'
parameter instead of 'start' and 'size', therefore the accept_memory()
call must be adjusted to specify 'start + size' for 'end' when applying
to kernels prior to v6.12.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/7bcd29181bab8d508d2adfdbb132de8b1e088698; https://git.kernel.org/stable/c/aa513e69e011a2b19fa22ce62ce35effbd5e0c81; https://git.kernel.org/stable/c/d66a22f6a432a9dd376c9b365d7dc89bd416909c
CVE: CVE-2025-37962
Published: 2025-05-20
Description: In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix memory leak in parse_lease_state()

The previous patch that added bounds check for create lease context
introduced a memory leak. When the bounds check fails, the function
returns NULL without freeing the previously allocated lease_ctx_info
structure.

This patch fixes the issue by adding kfree(lreq) before returning NULL
in both boundary check cases.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/2148d34371b06dac696c0497a98a6bf905a51650; https://git.kernel.org/stable/c/829e19ef741d9e9932abdc3bee5466195e0852cf; https://git.kernel.org/stable/c/af9e2d4732a548db8f6f5a90c2c20a789a3d7240
CVE: CVE-2025-37963
Published: 2025-05-20
Description: In the Linux kernel, the following vulnerability has been resolved:

arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users

Support for eBPF programs loaded by unprivileged users is typically
disabled. This means only cBPF programs need to be mitigated for BHB.

In addition, only mitigate cBPF programs that were loaded by an
unprivileged user. Privileged users can also load the same program
via eBPF, making the mitigation pointless.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/038866e01ea5e5a3d948898ac216e531e7848669; https://git.kernel.org/stable/c/477481c[PII_REDACTED]227348984b6699d6370b685; https://git.kernel.org/stable/c/6e52d043f7dbf1839a24a3fab2b12b0d3839de7a
CVE: CVE-2025-37964
Published: 2025-05-20
Description: In the Linux kernel, the following vulnerability has been resolved:

x86/mm: Eliminate window where TLB flushes may be inadvertently skipped

tl;dr: There is a window in the mm switching code where the new CR3 is
set and the CPU should be getting TLB flushes for the new mm.  But
should_flush_tlb() has a bug and suppresses the flush.  Fix it by
widening the window where should_flush_tlb() sends an IPI.

Long Version:

=== History ===

There were a few things leading up to this.

First, updating mm_cpumask() was observed to be too expensive, so it was
made lazier.  But being lazy caused too many unnecessary IPIs to CPUs
due to the now-lazy mm_cpumask().  So code was added to cull
mm_cpumask() periodically[2].  But that culling was a bit too aggressive
and skipped sending TLB flushes to CPUs that need them.  So here we are
again.

=== Problem ===

The too-aggressive code in should_flush_tlb() strikes in this window:

	// Turn on IPIs for this CPU/mm combination, but only
	// if should_flush_tlb() agrees:
	cpumask_set_cpu(cpu, mm_cpumask(next));

	next_tlb_gen = atomic64_read(&next->context.tlb_gen);
	choose_new_asid(next, next_tlb_gen, &new_asid, &need_flush);
	load_new_mm_cr3(need_flush);
	// ^ After 'need_flush' is set to false, IPIs *MUST*
	// be sent to this CPU and not be ignored.

        this_cpu_write(cpu_tlbstate.loaded_mm, next);
	// ^ Not until this point does should_flush_tlb()
	// become true!

should_flush_tlb() will suppress TLB flushes between load_new_mm_cr3()
and writing to 'loaded_mm', which is a window where they should not be
suppressed.  Whoops.

=== Solution ===

Thankfully, the fuzzy "just about to write CR3" window is already marked
with loaded_mm==LOADED_MM_SWITCHING.  Simply checking for that state in
should_flush_tlb() is sufficient to ensure that the CPU is targeted with
an IPI.

This will cause more TLB flush IPIs.  But the window is relatively small
and I do not expect this to cause any kind of measurable performance
impact.

Update the comment where LOADED_MM_SWITCHING is written since it grew
yet another user.

Peter Z also raised a concern that should_flush_tlb() might not observe
'loaded_mm' and 'is_lazy' in the same order that switch_mm_irqs_off()
writes them.  Add a barrier to ensure that they are observed in the
order they are written.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/02ad4ce144bd27f71f583f667fdf3b3ba0753477; https://git.kernel.org/stable/c/12f703811af043d32b1c8a30001b2fa04d5cd0ac; https://git.kernel.org/stable/c/399ec9ca8fc4999e676ff89a90184ec40031cf59
CVE: CVE-2025-48014
Published: 2025-05-20
Description: Password guessing limits could be bypassed when using LDAP authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://selinc.com/products/software/latest-software-versions/
CVE: CVE-2025-48015
Published: 2025-05-20
Description: Failed login response could be different depending on whether the username was local or central.
CVSS Score: 3.7 (LOW)
CWE: CWE-204
References: https://selinc.com/products/software/latest-software-versions/
CVE: CVE-2025-48016
Published: 2025-05-20
Description: OpenFlow discovery protocol can exhaust resources because it is not rate limited
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-799
References: https://selinc.com/products/software/latest-software-versions/
CVE: CVE-2025-48017
Published: 2025-05-20
Description: Improper limitation of pathname in Circuit Provisioning and File Import applications allows modification and uploading of files
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-22
References: https://selinc.com/products/software/latest-software-versions/
CVE: CVE-2025-48018
Published: 2025-05-20
Description: An authenticated user can modify application state data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: https://selinc.com/products/software/latest-software-versions/
CVE: CVE-2025-37965
Published: 2025-05-20
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix invalid context error in dml helper

[Why]
"BUG: sleeping function called from invalid context" error.
after:
"drm/amd/display: Protect FPU in dml2_validate()/dml21_validate()"

The populate_dml_plane_cfg_from_plane_state() uses the GFP_KERNEL flag
for memory allocation, which shouldn't be used in atomic contexts.

The allocation is needed only for using another helper function
get_scaler_data_for_plane().

[How]
Modify helpers to pass a pointer to scaler_data within existing context,
eliminating the need for dynamic memory allocation/deallocation
and copying.

(cherry picked from commit bd3e84bc98f81b44f2c43936bdadc3241d654259)
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/9984db63742099ee3f3cff35cf71306d10e64356; https://git.kernel.org/stable/c/b371f8f6d89ec8dfea796e00a44a57c44fc8fcc0; https://git.kernel.org/stable/c/d8c4afe78385cd355e4d80299d785379d6e874df
CVE: CVE-2025-37966
Published: 2025-05-20
Description: In the Linux kernel, the following vulnerability has been resolved:

riscv: Fix kernel crash due to PR_SET_TAGGED_ADDR_CTRL

When userspace does PR_SET_TAGGED_ADDR_CTRL, but Supm extension is not
available, the kernel crashes:

Oops - illegal instruction [#1]
    [snip]
epc : set_tagged_addr_ctrl+0x112/0x15a
 ra : set_tagged_addr_ctrl+0x74/0x15a
epc : ffffffff80011ace ra : ffffffff80011a30 sp : ffffffc60039be10
    [snip]
status: [PII_REDACTED] badaddr:[PII_REDACTED]a79073 cause: [PII_REDACTED]
    set_tagged_addr_ctrl+0x112/0x15a
    __riscv_sys_prctl+0x352/0x73c
    do_trap_ecall_u+0x17c/0x20c
    andle_exception+0x150/0x15c

Fix it by checking if Supm is available.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/4b595a2f5656cd45d534ed2160c94f7662adefe5; https://git.kernel.org/stable/c/ae08d55807c099357c047dba17624b09414635dd
CVE: CVE-2025-37967
Published: 2025-05-20
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: displayport: Fix deadlock

This patch introduces the ucsi_con_mutex_lock / ucsi_con_mutex_unlock
functions to the UCSI driver. ucsi_con_mutex_lock ensures the connector
mutex is only locked if a connection is established and the partner pointer
is valid. This resolves a deadlock scenario where
ucsi_displayport_remove_partner holds con->mutex waiting for
dp_altmode_work to complete while dp_altmode_work attempts to acquire it.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/364618c89d4c57c85e5fc51a2446cd939bf57802; https://git.kernel.org/stable/c/5924b324468845fc795bd76f588f51d7ab4f202d; https://git.kernel.org/stable/c/61fc1a8e1e10cc784cab[PII_REDACTED]aaf1d37af5
CVE: CVE-2025-37968
Published: 2025-05-20
Description: In the Linux kernel, the following vulnerability has been resolved:

iio: light: opt3001: fix deadlock due to concurrent flag access

The threaded IRQ function in this driver is reading the flag twice: once to
lock a mutex and once to unlock it. Even though the code setting the flag
is designed to prevent it, there are subtle cases where the flag could be
true at the mutex_lock stage and false at the mutex_unlock stage. This
results in the mutex not being unlocked, resulting in a deadlock.

Fix it by making the opt3001_irq() code generally more robust, reading the
flag into a variable and using the variable value at both stages.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/1d7def97e7eb65865ccc01bbdf4eb9e6bbe8a5b5; https://git.kernel.org/stable/c/2c95c8f0959d0a72575eabf2ff888f47ed6d8b77; https://git.kernel.org/stable/c/748ebd8e61d0bc182c331b8df3887af7285c8a8f
CVE: CVE-2025-37969
Published: 2025-05-20
Description: In the Linux kernel, the following vulnerability has been resolved:

iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo

Prevent st_lsm6dsx_read_tagged_fifo from falling in an infinite loop in
case pattern_len is equal to zero and the device FIFO is not empty.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/16857370b3a[PII_REDACTED]6b3bd27f3def6a2cf06; https://git.kernel.org/stable/c/35b8c0a284983b71d92d082c54b7eb655ed4194f; https://git.kernel.org/stable/c/4db7d923a8c298788181b796f71adf6ca499f966
CVE: CVE-2025-37970
Published: 2025-05-20
Description: In the Linux kernel, the following vulnerability has been resolved:

iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo

Prevent st_lsm6dsx_read_fifo from falling in an infinite loop in case
pattern_len is equal to zero and the device FIFO is not empty.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/159ca7f18129834b6f4c7eae67de48e96c752fc9; https://git.kernel.org/stable/c/3bb6c02d6fe8347ce1785016d135ff539c20043c; https://git.kernel.org/stable/c/6c4a5000618a8c44200d455c92e2f2a4db264717
CVE: CVE-2025-37971
Published: 2025-05-20
Description: In the Linux kernel, the following vulnerability has been resolved:

staging: bcm2835-camera: Initialise dev in v4l2_dev

Commit 42a2f6664e18 ("staging: vc04_services: Move global g_state to
vchiq_state") changed mmal_init to pass dev->v4l2_dev.dev to
vchiq_mmal_init, however nothing iniitialised dev->v4l2_dev, so we got
a NULL pointer dereference.

Set dev->v4l2_dev.dev during bcm2835_mmal_probe. The device pointer
could be passed into v4l2_device_register to set it, however that also
has other effects that would need additional changes.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/06753f49336ab161ea0e249a0720125b81b7b31b; https://git.kernel.org/stable/c/98698ca0e58734bc5c1c24e5bbc7429f981cd186; https://git.kernel.org/stable/c/b70bdd4923e8b8edbacde2af83ca337bb7005261
CVE: CVE-2025-37972
Published: 2025-05-20
Description: In the Linux kernel, the following vulnerability has been resolved:

Input: mtk-pmic-keys - fix possible null pointer dereference

In mtk_pmic_keys_probe, the regs parameter is only set if the button is
parsed in the device tree. However, on hardware where the button is left
floating, that node will most likely be removed not to enable that
input. In that case the code will try to dereference a null pointer.

Let's use the regs struct instead as it is defined for all supported
platforms. Note that it is ok setting the key reg even if that latter is
disabled as the interrupt won't be enabled anyway.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/09429ddb5a91e9e8f72cd18c012ec4171c2f85ec; https://git.kernel.org/stable/c/11cdb506d0fbf5ac05bf55f5afcb3a215c316490; https://git.kernel.org/stable/c/334d74a798463ceec02a41eb0e2354aaac0d6249
CVE: CVE-2025-37973
Published: 2025-05-20
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation

Currently during the multi-link element defragmentation process, the
multi-link element length added to the total IEs length when calculating
the length of remaining IEs after the multi-link element in
cfg80211_defrag_mle(). This could lead to out-of-bounds access if the
multi-link element or its corresponding fragment elements are the last
elements in the IEs buffer.

To address this issue, correctly calculate the remaining IEs length by
deducting the multi-link element end offset from total IEs end offset.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/023c1f2f[PII_REDACTED]cbcb48e0104b144d4a16dc; https://git.kernel.org/stable/c/73dde269a1a43e6b1aa92eba13ad2df58bfdd38e; https://git.kernel.org/stable/c/9423f6da825172b8dc60d4688ed3d147291c3be9
CVE: CVE-2025-37974
Published: 2025-05-20
Description: In the Linux kernel, the following vulnerability has been resolved:

s390/pci: Fix missing check for zpci_create_device() error return

The zpci_create_device() function returns an error pointer that needs to
be checked before dereferencing it as a struct zpci_dev pointer. Add the
missing check in __clp_add() where it was missed when adding the
scan_list in the fixed commit. Simply not adding the device to the scan
list results in the previous behavior.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/2769b718e164df983c20c314b263a71a699be6cd; https://git.kernel.org/stable/c/42420c50c68f3e95e90de2479464f420602229fc; https://git.kernel.org/stable/c/be54b750c333a9db7c3b3686846bb06b07b011fe
CVE: CVE-2025-37975
Published: 2025-05-20
Description: In the Linux kernel, the following vulnerability has been resolved:

riscv: module: Fix out-of-bounds relocation access

The current code allows rel[j] to access one element past the end of the
relocation section. Simplify to num_relocations which is equivalent to
the existing size expression.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/0b4cce68efb93e31a8e51795d696df6e379cb41c; https://git.kernel.org/stable/c/95e4e1c1cf614d125f159db9726b7abb32e18385; https://git.kernel.org/stable/c/a068ea00009d373d825c528f9c[PII_REDACTED]1b4
CVE: CVE-2025-37976
Published: 2025-05-20
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-37977
Published: 2025-05-20
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set

If dma-coherent property isn't set then descriptors are non-cacheable
and the iocc shareability bits should be disabled. Without this UFS can
end up in an incompatible configuration and suffer from random cache
related stability issues.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/869749e48115ef944eeabec8e[PII_REDACTED]1fa51; https://git.kernel.org/stable/c/f0c6728a6f2e269ebb234a9b5bb6c2c24aafeb51; https://git.kernel.org/stable/c/f92bb7436802f8eb7ee72dc911a33c8897fde366
CVE: CVE-2025-37978
Published: 2025-05-20
Description: In the Linux kernel, the following vulnerability has been resolved:

block: integrity: Do not call set_page_dirty_lock()

Placing multiple protection information buffers inside the same page
can lead to oopses because set_page_dirty_lock() can't be called from
interrupt context.

Since a protection information buffer is not backed by a file there is
no point in setting its page dirty, there is nothing to synchronize.
Drop the call to set_page_dirty_lock() and remove the last argument to
bio_integrity_unpin_bvec().
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/39e160505198ff8c158f11bce2ba19809a756e8b; https://git.kernel.org/stable/c/9487fc1a10b3aa89feb24e7cedeccaaf63074617; https://git.kernel.org/stable/c/c38a005e6efb9ddfa06bd8353b82379d6fd5d6c4
CVE: CVE-2025-37979
Published: 2025-05-20
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: qcom: Fix sc7280 lpass potential buffer overflow

Case values introduced in commit
5f78e1fb7a3e ("ASoC: qcom: Add driver support for audioreach solution")
cause out of bounds access in arrays of sc7280 driver data (e.g. in case
of RX_CODEC_DMA_RX_0 in sc7280_snd_hw_params()).

Redefine LPASS_MAX_PORTS to consider the maximum possible port id for
q6dsp as sc7280 driver utilizes some of those values.

Found by Linux Verification Center (linuxtesting.org) with SVACE.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/a12c14577882b1f2b4cff0f86265682f16e97b0c; https://git.kernel.org/stable/c/a31a4934b31faea76e735bab17e63d02fcd8e029; https://git.kernel.org/stable/c/b807b7c81a6d066757a94af7b8fa5b6a37e4d0b3
CVE: CVE-2025-37980
Published: 2025-05-20
Description: In the Linux kernel, the following vulnerability has been resolved:

block: fix resource leak in blk_register_queue() error path

When registering a queue fails after blk_mq_sysfs_register() is
successful but the function later encounters an error, we need
to clean up the blk_mq_sysfs resources.

Add the missing blk_mq_sysfs_unregister() call in the error path
to properly clean up these resources and prevent a memory leak.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/40f2eb9b531475dd01b683fdaf61ca3cfd03a51e; https://git.kernel.org/stable/c/41e43134ddda35949974be40520460a12dda3502; https://git.kernel.org/stable/c/549cbbd14bbec12469ceb279b79c763c8a24224e
CVE: CVE-2025-37981
Published: 2025-05-20
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: smartpqi: Use is_kdump_kernel() to check for kdump

The smartpqi driver checks the reset_devices variable to determine
whether special adjustments need to be made for kdump. This has the
effect that after a regular kexec reboot, some driver parameters such as
max_transfer_size are much lower than usual. More importantly, kexec
reboot tests have revealed memory corruption caused by the driver log
being written to system memory after a kexec.

Fix this by testing is_kdump_kernel() rather than reset_devices where
appropriate.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/7cc670e8ebaa5241dd99c0ad75eceb8f8f64f607; https://git.kernel.org/stable/c/a2d5a0072235a69749ceb04c1a26dc75df66a31a; https://git.kernel.org/stable/c/ebf673c76ce91e612a882dfaa9a[PII_REDACTED]aae
CVE: CVE-2025-37982
Published: 2025-05-20
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: wl1251: fix memory leak in wl1251_tx_work

The skb dequeued from tx_queue is lost when wl1251_ps_elp_wakeup fails
with a -ETIMEDOUT error. Fix that by queueing the skb back to tx_queue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/13c9744c1bcdb5de4e7dc1a78784788ecec52add; https://git.kernel.org/stable/c/2996144be660d930d5e394652abe08fe89dbe00e; https://git.kernel.org/stable/c/4a43fd36710669d67dbb5c16287a58412582ca26
CVE: CVE-2025-44084
Published: 2025-05-20
Description: D-link DI-8100 16.07.26A1 is vulnerable to Command Injection. An attacker can exploit this vulnerability by crafting specific HTTP requests, triggering the command execution flaw and gaining the highest privilege shell access to the firmware system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/piposy/IOTsec/blob/main/Dlink/DI8100/DI8100-A1-2.md; https://github.com/piposy/IOTsec/blob/main/Dlink/DI8100/DI8100-A1-2.md