deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-11627
Published: 2025-10-30
Description: The Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue plugin for WordPress is vulnerable to log file poisoning in all versions up to, and including, 1.47. This makes it possible for unauthenticated attackers to insert arbitrary content into log files, and potentially cause denial of service via disk space exhaustion.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-117
References: https://plugins.trac.wordpress.org/browser/site-checkup/tags/1.47/includes/catch-errors/class_bill_catch_errors.php#L80; https://plugins.trac.wordpress.org/changeset/3380169/; https://www.wordfence.com/threat-intel/vulnerabilities/id/50251b17-58d7-4870-b825-a194312fb3e7?source=cve
CVE: CVE-2025-62229
Published: 2025-10-30
Description: A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can leave dangling pointers that lead to a use-after-free condition. This can cause memory corruption or a crash, potentially allowing an attacker to execute arbitrary code or cause a denial of service.
CVSS Score: 7.3 (HIGH)
CWE: CWE-416
References: https://access.redhat.com/errata/RHSA-2025:19432; https://access.redhat.com/errata/RHSA-2025:19433; https://access.redhat.com/errata/RHSA-2025:19434
CVE: CVE-2025-62230
Published: 2025-10-30
Description: A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling client resource cleanup. The software frees certain data structures without properly detaching related resources, leading to a use-after-free condition. This can cause memory corruption or a crash when affected clients disconnect.
CVSS Score: 7.3 (HIGH)
CWE: CWE-416
References: https://access.redhat.com/errata/RHSA-2025:19432; https://access.redhat.com/errata/RHSA-2025:19433; https://access.redhat.com/errata/RHSA-2025:19434
CVE: CVE-2025-11881
Published: 2025-10-30
Description: The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'myappp_verify' function in all versions up to, and including, 4.5.0. This makes it possible for unauthenticated attackers to extract sensitive data including plugin and theme names and version numbers, which can be used to facilitate targeted attacks against outdated or vulnerable components.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/apppresser/tags/4.5.0/inc/AppPresser_WPAPI_Mods.php#L162; https://plugins.trac.wordpress.org/browser/apppresser/tags/4.5.0/inc/AppPresser_WPAPI_Mods.php#L879; https://plugins.trac.wordpress.org/changeset/3385855/
CVE: CVE-2025-11906
Published: 2025-10-30
Description: A vulnerability exists in Progress Flowmon versions prior 12.5.6 where certain system configuration files have incorrect file permissions, allowing a user with access to the default flowmon system user account used for SSH access to potentially escalate privileges to root during service initialization.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-732
References: https://community.progress.com/s/article/Progress-Flowmon-CVE-2025-11906
CVE: CVE-2025-40086
Published: 2025-10-30
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Don't allow evicting of BOs in same VM in array of VM binds

An array of VM binds can potentially evict other buffer objects (BOs)
within the same VM under certain conditions, which may lead to NULL
pointer dereferences later in the bind pipeline. To prevent this, clear
the allow_res_evict flag in the xe_bo_validate call.

v2:
 - Invert polarity of no_res_evict (Thomas)
 - Add comment in code explaining issue (Thomas)

(cherry picked from commit 8b9ba8d6d95fe75fed6b0480bb03da4b321bea08)
References: https://git.kernel.org/stable/c/5aa0ab0ba7d94549cfe17d6ef7a4f33ba1de8384; https://git.kernel.org/stable/c/7ac74613e5f2ef3450f44fd[PII_REDACTED]c2563a9
CVE: CVE-2025-40087
Published: 2025-10-30
Description: In the Linux kernel, the following vulnerability has been resolved:

NFSD: Define a proc_layoutcommit for the FlexFiles layout type

Avoid a crash if a pNFS client should happen to send a LAYOUTCOMMIT
operation on a FlexFiles layout.
References: https://git.kernel.org/stable/c/34d187e020cbda112a6c6f094f0ca5e6a8672b75; https://git.kernel.org/stable/c/4b47a8601b71ad98833b447d465592d847b4dc77; https://git.kernel.org/stable/c/785ec512afa80d0540f2ca797c0e56de747a6083
CVE: CVE-2025-40089
Published: 2025-10-30
Description: In the Linux kernel, the following vulnerability has been resolved:

cxl/features: Add check for no entries in cxl_feature_info

cxl EDAC calls cxl_feature_info() to get the feature information and
if the hardware has no Features support, cxlfs may be passed in as
NULL.

[   51.957498] BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
[   51.965571] #PF: supervisor read access in kernel mode
[   51.971559] #PF: error_code(0x0000) - not-present page
[   51.977542] PGD 17e4f6067 P4D 0
[   51.981384] Oops: Oops: 0000 [#1] SMP NOPTI
[   51.986300] CPU: 49 UID: 0 PID: 3782 Comm: systemd-udevd Not tainted 6.17.0dj
test+ #64 PREEMPT(voluntary)
[   51.997355] Hardware name: <removed>
[   52.009790] RIP: 0010:cxl_feature_info+0xa/0x80 [cxl_core]

Add a check for cxlfs before dereferencing it and return -EOPNOTSUPP if
there is no cxlfs created due to no hardware support.
References: https://git.kernel.org/stable/c/a375246fcf2bbdaeb1df7fa7ee5a8b884a89085e; https://git.kernel.org/stable/c/b8a69e3b1a460bf5d96dd53cbd121aa2cd346886
CVE: CVE-2025-40090
Published: 2025-10-30
Description: In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix recursive locking in RPC handle list access

Since commit 305853cce3794 ("ksmbd: Fix race condition in RPC handle list
access"), ksmbd_session_rpc_method() attempts to lock sess->rpc_lock.

This causes hung connections / tasks when a client attempts to open
a named pipe. Using Samba's rpcclient tool:

 $ rpcclient //192.168.1.254 -U user%password
 $ rpcclient $> srvinfo
 <connection hung here>

Kernel side:
  "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
  task:kworker/0:0 state:D stack:0 pid:5021 tgid:5021 ppid:2 flags:0x00200000
  Workqueue: ksmbd-io handle_ksmbd_work
  Call trace:
  __schedule from schedule+0x3c/0x58
  schedule from schedule_preempt_disabled+0xc/0x10
  schedule_preempt_disabled from rwsem_down_read_slowpath+0x1b0/0x1d8
  rwsem_down_read_slowpath from down_read+0x28/0x30
  down_read from ksmbd_session_rpc_method+0x18/0x3c
  ksmbd_session_rpc_method from ksmbd_rpc_open+0x34/0x68
  ksmbd_rpc_open from ksmbd_session_rpc_open+0x194/0x228
  ksmbd_session_rpc_open from create_smb2_pipe+0x8c/0x2c8
  create_smb2_pipe from smb2_open+0x10c/0x27ac
  smb2_open from handle_ksmbd_work+0x238/0x3dc
  handle_ksmbd_work from process_scheduled_works+0x160/0x25c
  process_scheduled_works from worker_thread+0x16c/0x1e8
  worker_thread from kthread+0xa8/0xb8
  kthread from ret_from_fork+0x14/0x38
  Exception stack(0x8529ffb0 to 0x8529fff8)

The task deadlocks because the lock is already held:
  ksmbd_session_rpc_open
    down_write(&sess->rpc_lock)
    ksmbd_rpc_open
      ksmbd_session_rpc_method
        down_read(&sess->rpc_lock)   <-- deadlock

Adjust ksmbd_session_rpc_method() callers to take the lock when necessary.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674
References: https://git.kernel.org/stable/c/1891abe832cbf5a11039e088766131d0f1642d02; https://git.kernel.org/stable/c/3412fbd81b46b9cfae013817b61d4bbd27e09e36; https://git.kernel.org/stable/c/4602b8cee1481dbb896182e5cb1e8cf12910e9e7
CVE: CVE-2025-40091
Published: 2025-10-30
Description: In the Linux kernel, the following vulnerability has been resolved:

ixgbe: fix too early devlink_free() in ixgbe_remove()

Since ixgbe_adapter is embedded in devlink, calling devlink_free()
prematurely in the ixgbe_remove() path can lead to UAF. Move devlink_free()
to the end.

KASAN report:

 BUG: KASAN: use-after-free in ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]
 Read of size 8 at addr ffff0000adf813e0 by task bash/2095
 CPU: 1 UID: 0 PID: 2095 Comm: bash Tainted: G S  6.17.0-rc2-tnguy.net-queue+ #1 PREEMPT(full)
 [...]
 Call trace:
  show_stack+0x30/0x90 (C)
  dump_stack_lvl+0x9c/0xd0
  print_address_description.constprop.0+0x90/0x310
  print_report+0x104/0x1f0
  kasan_report+0x88/0x180
  __asan_report_load8_noabort+0x20/0x30
  ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]
  ixgbe_clear_interrupt_scheme+0xf8/0x130 [ixgbe]
  ixgbe_remove+0x2d0/0x8c0 [ixgbe]
  pci_device_remove+0xa0/0x220
  device_remove+0xb8/0x170
  device_release_driver_internal+0x318/0x490
  device_driver_detach+0x40/0x68
  unbind_store+0xec/0x118
  drv_attr_store+0x64/0xb8
  sysfs_kf_write+0xcc/0x138
  kernfs_fop_write_iter+0x294/0x440
  new_sync_write+0x1fc/0x588
  vfs_write+0x480/0x6a0
  ksys_write+0xf0/0x1e0
  __arm64_sys_write+0x70/0xc0
  invoke_syscall.constprop.0+0xcc/0x280
  el0_svc_common.constprop.0+0xa8/0x248
  do_el0_svc+0x44/0x68
  el0_svc+0x54/0x160
  el0t_64_sync_handler+0xa0/0xe8
  el0t_64_sync+0x1b0/0x1b8
References: https://git.kernel.org/stable/c/5feef67b646d8f5064bac288e22204ffba2b9a4a; https://git.kernel.org/stable/c/df445969aa727cd64f3f29dc1f85fb60aca238d1
CVE: CVE-2025-40092
Published: 2025-10-30
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_ncm: Refactor bind path to use __free()

After an bind/unbind cycle, the ncm->notify_req is left stale. If a
subsequent bind fails, the unified error label attempts to free this
stale request, leading to a NULL pointer dereference when accessing
ep->ops->free_request.

Refactor the error handling in the bind path to use the __free()
automatic cleanup mechanism.

Unable to handle kernel NULL pointer dereference at virtual address [PII_REDACTED]
Call trace:
 usb_ep_free_request+0x2c/0xec
 ncm_bind+0x39c/0x3dc
 usb_add_function+0xcc/0x1f0
 configfs_composite_bind+0x468/0x588
 gadget_bind_driver+0x104/0x270
 really_probe+0x190/0x374
 __driver_probe_device+0xa0/0x12c
 driver_probe_device+0x3c/0x218
 __device_attach_driver+0x14c/0x188
 bus_for_each_drv+0x10c/0x168
 __device_attach+0xfc/0x198
 device_initial_probe+0x14/0x24
 bus_probe_device+0x94/0x11c
 device_add+0x268/0x48c
 usb_add_gadget+0x198/0x28c
 dwc3_gadget_init+0x700/0x858
 __dwc3_set_mode+0x3cc/0x664
 process_scheduled_works+0x1d8/0x488
 worker_thread+0x244/0x334
 kthread+0x114/0x1bc
 ret_from_fork+0x10/0x20
References: https://git.kernel.org/stable/c/185193a4714aa9c78437a7a1858fbe5771f0f45c; https://git.kernel.org/stable/c/1cde4516295a030cb8ab4c93114ca3b6c3c6a1e2; https://git.kernel.org/stable/c/75a5b8d4ddd4eb6b16cb0b475d14ff4ae64295ef
CVE: CVE-2025-40093
Published: 2025-10-30
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_ecm: Refactor bind path to use __free()

After an bind/unbind cycle, the ecm->notify_req is left stale. If a
subsequent bind fails, the unified error label attempts to free this
stale request, leading to a NULL pointer dereference when accessing
ep->ops->free_request.

Refactor the error handling in the bind path to use the __free()
automatic cleanup mechanism.
References: https://git.kernel.org/stable/c/070f341d86cf2c098d63e484a86c7c1d2696a868; https://git.kernel.org/stable/c/15b9faf53ba[PII_REDACTED]e7ef78879ce200e8c2e; https://git.kernel.org/stable/c/42988380ac67c76bb9dff8f77d7ef3eefd50b7b5
CVE: CVE-2025-40094
Published: 2025-10-30
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_acm: Refactor bind path to use __free()

After an bind/unbind cycle, the acm->notify_req is left stale. If a
subsequent bind fails, the unified error label attempts to free this
stale request, leading to a NULL pointer dereference when accessing
ep->ops->free_request.

Refactor the error handling in the bind path to use the __free()
automatic cleanup mechanism.

Unable to handle kernel NULL pointer dereference at virtual address [PII_REDACTED]
Call trace:
 usb_ep_free_request+0x2c/0xec
 gs_free_req+0x30/0x44
 acm_bind+0x1b8/0x1f4
 usb_add_function+0xcc/0x1f0
 configfs_composite_bind+0x468/0x588
 gadget_bind_driver+0x104/0x270
 really_probe+0x190/0x374
 __driver_probe_device+0xa0/0x12c
 driver_probe_device+0x3c/0x218
 __device_attach_driver+0x14c/0x188
 bus_for_each_drv+0x10c/0x168
 __device_attach+0xfc/0x198
 device_initial_probe+0x14/0x24
 bus_probe_device+0x94/0x11c
 device_add+0x268/0x48c
 usb_add_gadget+0x198/0x28c
 dwc3_gadget_init+0x700/0x858
 __dwc3_set_mode+0x3cc/0x664
 process_scheduled_works+0x1d8/0x488
 worker_thread+0x244/0x334
 kthread+0x114/0x1bc
 ret_from_fork+0x10/0x20
References: https://git.kernel.org/stable/c/201a66d8e6630762e760e1d78f1d149da1691e7b; https://git.kernel.org/stable/c/2b1546f7c5fc6c44555a8e7a2b34229d1dcd2175; https://git.kernel.org/stable/c/47b2116e54b4a[PII_REDACTED]87e8b55249e926324
CVE: CVE-2025-40095
Published: 2025-10-30
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_rndis: Refactor bind path to use __free()

After an bind/unbind cycle, the rndis->notify_req is left stale. If a
subsequent bind fails, the unified error label attempts to free this
stale request, leading to a NULL pointer dereference when accessing
ep->ops->free_request.

Refactor the error handling in the bind path to use the __free()
automatic cleanup mechanism.
References: https://git.kernel.org/stable/c/[PII_REDACTED]6047bdcd35a612c1aec0912a29d8cd; https://git.kernel.org/stable/c/380353c3a92be7d928e6f973bd065c5b79755ac3; https://git.kernel.org/stable/c/5f65c8ad8c7292ed7e3716343fcd590a51818cc3
CVE: CVE-2025-40096
Published: 2025-10-30
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies

When adding dependencies with drm_sched_job_add_dependency(), that
function consumes the fence reference both on success and failure, so in
the latter case the dma_fence_put() on the error path (xarray failed to
expand) is a double free.

Interestingly this bug appears to have been present ever since
commit ebd5f74255b9 ("drm/sched: Add dependency tracking"), since the code
back then looked like this:

drm_sched_job_add_implicit_dependencies():
...
       for (i = 0; i < fence_count; i++) {
               ret = drm_sched_job_add_dependency(job, fences[i]);
               if (ret)
                       break;
       }

       for (; i < fence_count; i++)
               dma_fence_put(fences[i]);

Which means for the failing 'i' the dma_fence_put was already a double
free. Possibly there were no users at that time, or the test cases were
insufficient to hit it.

The bug was then only noticed and fixed after
commit 9c2ba265352a ("drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2")
landed, with its fixup of
commit 4eaf02d6076c ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies").

At that point it was a slightly different flavour of a double free, which
commit 963d0b356935 ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder")
noticed and attempted to fix.

But it only moved the double free from happening inside the
drm_sched_job_add_dependency(), when releasing the reference not yet
obtained, to the caller, when releasing the reference already released by
the former in the failure case.

As such it is not easy to identify the right target for the fixes tag so
lets keep it simple and just continue the chain.

While fixing we also improve the comment and explain the reason for taking
the reference and not dropping it.
References: https://git.kernel.org/stable/c/4c38a63ae12ecc9370a7678077bde2d61aa80e9c; https://git.kernel.org/stable/c/57239762aa90ad768dac055021f27705dae73344; https://git.kernel.org/stable/c/5801e65206b065b0b2af032f7f1eef222aa2fd83
CVE: CVE-2025-40097
Published: 2025-10-30
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda: Fix missing pointer check in hda_component_manager_init function

The __component_match_add function may assign the 'matchptr' pointer
the value ERR_PTR(-ENOMEM), which will subsequently be dereferenced.

The call stack leading to the error looks like this:

hda_component_manager_init
|-> component_match_add
    |-> component_match_add_release
        |-> __component_match_add ( ... ,**matchptr, ... )
            |-> *matchptr = ERR_PTR(-ENOMEM);       // assign
|-> component_master_add_with_match( ...  match)
    |-> component_match_realloc(match, match->num); // dereference

Add IS_ERR() check to prevent the crash.

Found by Linux Verification Center (linuxtesting.org) with SVACE.
References: https://git.kernel.org/stable/c/1cf11d80db5df805b538c942269e05a65bcaf5bc; https://git.kernel.org/stable/c/218a8504e62fc2c8a1fd12523346b7a2b9bd2474; https://git.kernel.org/stable/c/47d1b9ca923b55c3f407788f1f15b04957e0e027
CVE: CVE-2025-40098
Published: 2025-10-30
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state()

Return value of a function acpi_evaluate_dsm() is dereferenced  without
checking for NULL, but it is usually checked for this function.

acpi_evaluate_dsm() may return NULL, when acpi_evaluate_object() returns
acpi_status other than ACPI_SUCCESS, so add a check to prevent the crach.

Found by Linux Verification Center (linuxtesting.org) with SVACE.
References: https://git.kernel.org/stable/c/8527bbb[PII_REDACTED]5a3504a00932b2f8fd75754; https://git.kernel.org/stable/c/b518386db2b993d786c431caa9f46ce063c5cb05
CVE: CVE-2025-40099
Published: 2025-10-30
Description: In the Linux kernel, the following vulnerability has been resolved:

cifs: parse_dfs_referrals: prevent oob on malformed input

Malicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS

- reply smaller than sizeof(struct get_dfs_referral_rsp)
- reply with number of referrals smaller than NumberOfReferrals in the
header

Processing of such replies will cause oob.

Return -EINVAL error on such replies to prevent oob-s.
References: https://git.kernel.org/stable/c/15c73964da9df994302f579ed14ee5fdbce7a332; https://git.kernel.org/stable/c/6447b0e355562a1ff748c4a2ffb89aae7e84d2c9; https://git.kernel.org/stable/c/8bc4a8d39bac23d8b044fd3e2dbfd965f1d9b058
CVE: CVE-2025-40101
Published: 2025-10-30
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST

At the end of btrfs_load_block_group_zone_info() the first thing we do
is to ensure that if the mapping type is not a SINGLE one and there is
no RAID stripe tree, then we return early with an error.

Doing that, though, prevents the code from running the last calls from
this function which are about freeing memory allocated during its
run. Hence, in this case, instead of returning early, we set the ret
value and fall through the rest of the cleanup code.
References: https://git.kernel.org/stable/c/187333e6d484c6630286bfdd07c79d6815a63887; https://git.kernel.org/stable/c/602701d00439e113331ee9c1283e95afdcb8849d; https://git.kernel.org/stable/c/fec9b9d3ced39f16be8d7afdf81f4dd2653da319
CVE: CVE-2025-40102
Published: 2025-10-30
Description: In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Prevent access to vCPU events before init

Another day, another syzkaller bug. KVM erroneously allows userspace to
pend vCPU events for a vCPU that hasn't been initialized yet, leading to
KVM interpreting a bunch of uninitialized garbage for routing /
injecting the exception.

In one case the injection code and the hyp disagree on whether the vCPU
has a 32bit EL1 and put the vCPU into an illegal mode for AArch64,
tripping the BUG() in exception_target_el() during the next injection:

  kernel BUG at arch/arm64/kvm/inject_fault.c:40!
  Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP
  CPU: 3 UID: 0 PID: 318 Comm: repro Not tainted 6.17.0-rc4-00104-g10fd0285305d #6 PREEMPT
  Hardware name: linux,dummy-virt (DT)
  pstate: 21402009 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
  pc : exception_target_el+0x88/0x8c
  lr : pend_serror_exception+0x18/0x13c
  sp : ffff800082f03a10
  x29: ffff800082f03a10 x28: ffff0000cb132280 x27: [PII_REDACTED]
  x26: [PII_REDACTED] x25: ffff0000c2a99c20 x24: [PII_REDACTED]
  x23: [PII_REDACTED] x22: [PII_REDACTED] x21: [PII_REDACTED]
  x20: [PII_REDACTED] x19: ffff0000c2a99c20 x18: [PII_REDACTED]
  x17: [PII_REDACTED] x16: [PII_REDACTED] x15:[PII_REDACTED]0000c0
  x14: [PII_REDACTED] x13: [PII_REDACTED] x12: [PII_REDACTED]
  x11: [PII_REDACTED] x10: [PII_REDACTED] x9 : [PII_REDACTED]
  x8 : ffff800082f03af8 x7 : [PII_REDACTED] x6 : [PII_REDACTED]
  x5 : ffff800080f621f0 x4 : [PII_REDACTED] x3 : [PII_REDACTED]
  x2 :[PII_REDACTED]40009b x1 : [PII_REDACTED] x0 : ffff0000c2a99c20
  Call trace:
   exception_target_el+0x88/0x8c (P)
   kvm_inject_serror_esr+0x40/0x3b4
   __kvm_arm_vcpu_set_events+0xf0/0x100
   kvm_arch_vcpu_ioctl+0x180/0x9d4
   kvm_vcpu_ioctl+0x60c/0x9f4
   __arm64_sys_ioctl+0xac/0x104
   invoke_syscall+0x48/0x110
   el0_svc_common.constprop.0+0x40/0xe0
   do_el0_svc+0x1c/0x28
   el0_svc+0x34/0xf0
   el0t_64_sync_handler+0xa0/0xe4
   el0t_64_sync+0x198/0x19c
  Code: f946bc01 b4fffe61 9101e020 17fffff2 (d4210000)

Reject the ioctls outright as no sane VMM would call these before
KVM_ARM_VCPU_INIT anyway. Even if it did the exception would've been
thrown away by the eventual reset of the vCPU's state.
References: https://git.kernel.org/stable/c/0aa1b76fe[PII_REDACTED]a7c79820e4b96233ac4a3; https://git.kernel.org/stable/c/64a04e6320fc5affbadc59dc7024d79f909bfe84
CVE: CVE-2025-40103
Published: 2025-10-30
Description: In the Linux kernel, the following vulnerability has been resolved:

smb: client: Fix refcount leak for cifs_sb_tlink

Fix three refcount inconsistency issues related to `cifs_sb_tlink`.

Comments for `cifs_sb_tlink` state that `cifs_put_tlink()` needs to be
called after successful calls to `cifs_sb_tlink()`. Three calls fail to
update refcount accordingly, leading to possible resource leaks.
References: https://git.kernel.org/stable/c/790282abe9d805f08618c1c24ea2529e7259b692; https://git.kernel.org/stable/c/896bb31e1416f582503db1350cf1bd10dc64e5a6; https://git.kernel.org/stable/c/c2b77f42205ef485a647f62082c442c1cd69d3fc