deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-57890
Published: 2025-08-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lannoy Sessions sessions allows Stored XSS.This issue affects Sessions: from n/a through <= 3.2.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sessions/vulnerability/wordpress-sessions-plugin-3-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57891
Published: 2025-08-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpecommerce Recurring PayPal Donations recurring-donation allows Stored XSS.This issue affects Recurring PayPal Donations: from n/a through <= 1.8.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/recurring-donation/vulnerability/wordpress-recurring-paypal-donations-plugin-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57892
Published: 2025-08-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in Jeff Starr Simple Statistics for Feeds simple-feed-stats allows Cross Site Request Forgery.This issue affects Simple Statistics for Feeds: from n/a through <= 20250322.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/simple-feed-stats/vulnerability/wordpress-simple-statistics-for-feeds-plugin-20250322-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-57893
Published: 2025-08-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Cross Site Request Forgery.This issue affects WP Fast Total Search: from n/a through <= 1.79.270.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/fulltext-search/vulnerability/wordpress-wp-fast-total-search-plugin-1-79-270-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-57894
Published: 2025-08-22
Description: Missing Authorization vulnerability in ollybach WPPizza wppizza allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPPizza: from n/a through <= 3.19.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wppizza/vulnerability/wordpress-wppizza-plugin-3-19-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-57895
Published: 2025-08-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak JobWP jobwp allows Cross Site Request Forgery.This issue affects JobWP: from n/a through <= 2.4.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/jobwp/vulnerability/wordpress-jobwp-plugin-2-4-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-57896
Published: 2025-08-22
Description: Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through <= 5.0.26.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/church-admin/vulnerability/wordpress-church-admin-plugin-5-0-26-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-9254
Published: 2025-08-22
Description: WebITR developed by Uniong has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to log into the system as arbitrary users by exploiting a specific functionality.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.twcert.org.tw/en/cp-139-10329-a1c5d-2.html; https://www.twcert.org.tw/tw/cp-132-10328-dbc35-1.html
CVE: CVE-2025-9255
Published: 2025-08-22
Description: WebITR developed by Uniong has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.twcert.org.tw/en/cp-139-10329-a1c5d-2.html; https://www.twcert.org.tw/tw/cp-132-10328-dbc35-1.html
CVE: CVE-2025-9256
Published: 2025-08-22
Description: WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to download arbitrary system files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-36
References: https://www.twcert.org.tw/en/cp-139-10329-a1c5d-2.html; https://www.twcert.org.tw/tw/cp-132-10328-dbc35-1.html
CVE: CVE-2025-9257
Published: 2025-08-22
Description: WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to download arbitrary system files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-36
References: https://www.twcert.org.tw/en/cp-139-10329-a1c5d-2.html; https://www.twcert.org.tw/tw/cp-132-10328-dbc35-1.html
CVE: CVE-2025-9258
Published: 2025-08-22
Description: WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to download arbitrary system files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-36
References: https://www.twcert.org.tw/en/cp-139-10329-a1c5d-2.html; https://www.twcert.org.tw/tw/cp-132-10328-dbc35-1.html
CVE: CVE-2025-9259
Published: 2025-08-22
Description: WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to download arbitrary system files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-36
References: https://www.twcert.org.tw/en/cp-139-10329-a1c5d-2.html; https://www.twcert.org.tw/tw/cp-132-10328-dbc35-1.html
CVE: CVE-2025-9331
Published: 2025-08-22
Description: The Spacious theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'welcome_notice_import_handler' function in all versions up to, and including, 1.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import demo data into the site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://research.cleantalk.org/cve-2025-9331/; https://themes.trac.wordpress.org/changeset/282946/; https://www.wordfence.com/threat-intel/vulnerabilities/id/03fd2eee-429c-4053-8105-e1816f99ea91?source=cve
CVE: CVE-2009-10006
Published: 2025-08-22
Description: UFO: Alien Invasion versions up to and including 2.2.1 contain a buffer overflow vulnerability in its built-in IRC client component. When the client connects to an IRC server and receives a crafted numeric reply (specifically a 001 message), the application fails to properly validate the length of the response string. This results in a stack-based buffer overflow, which may corrupt control flow structures and allow arbitrary code execution. The vulnerability is triggered during automatic IRC connection handling and does not require user interaction beyond launching the game.
CWE: CWE-121
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/osx/misc/ufo_ai.rb; https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/misc/ufo_ai.rb; https://www.exploit-db.com/exploits/14013
CVE: CVE-2024-56179
Published: 2025-08-22
Description: In MindManager Windows versions prior to 24.1.150, attackers could potentially write to unexpected directories in victims' machines via directory traversal if victims opened file attachments located in malicious mmap files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://alludo.com; https://pastebin.com/Ax078JVF
CVE: CVE-2024-58239
Published: 2025-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

tls: stop recv() if initial process_rx_list gave us non-DATA

If we have a non-DATA record on the rx_list and another record of the
same type still on the queue, we will end up merging them:
 - process_rx_list copies the non-DATA record
 - we start the loop and process the first available record since it's
   of the same type
 - we break out of the loop since the record was not DATA

Just check the record type and jump to the end in case process_rx_list
did some work.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/31e10d6cb0c9532ff070cf50da1657c3acee9276; https://git.kernel.org/stable/c/3b952d8fdfcf6fd8ea0b8954bc9277642cf0977f; https://git.kernel.org/stable/c/4338032aa90bd1d5b33a4274e8fa8347cda5ee09
CVE: CVE-2025-38616
Published: 2025-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

tls: handle data disappearing from under the TLS ULP

TLS expects that it owns the receive queue of the TCP socket.
This cannot be guaranteed in case the reader of the TCP socket
entered before the TLS ULP was installed, or uses some non-standard
read API (eg. zerocopy ones). Replace the WARN_ON() and a buggy
early exit (which leaves anchor pointing to a freed skb) with real
error handling. Wipe the parsing state and tell the reader to retry.

We already reload the anchor every time we (re)acquire the socket lock,
so the only condition we need to avoid is an out of bounds read
(not having enough bytes in the socket for previously parsed record len).

If some data was read from under TLS but there's enough in the queue
we'll reload and decrypt what is most likely not a valid TLS record.
Leading to some undefined behavior from TLS perspective (corrupting
a stream? missing an alert? missing an attack?) but no kernel crash
should take place.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/2fb97ed9e2672b4f6e24ce206ac1a875ce4bcb38; https://git.kernel.org/stable/c/6db015fc4b5d5f63a64a193f65d98da3a7fc811d; https://git.kernel.org/stable/c/db3658a12d5ec4db7185ae7476151a50521b7207
CVE: CVE-2025-38617
Published: 2025-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

net/packet: fix a race in packet_set_ring() and packet_notifier()

When packet_set_ring() releases po->bind_lock, another thread can
run packet_notifier() and process an NETDEV_UP event.

This race and the fix are both similar to that of commit 15fe076edea7
("net/packet: fix a race in packet_bind() and packet_notifier()").

There too the packet_notifier NETDEV_UP event managed to run while a
po->bind_lock critical section had to be temporarily released. And
the fix was similarly to temporarily set po->num to zero to keep
the socket unhooked until the lock is retaken.

The po->bind_lock in packet_set_ring and packet_notifier precede the
introduction of git history.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://blog.calif.io/p/a-race-within-a-race-exploiting-cve; https://git.kernel.org/stable/c/01d3c8417b9c1b884a8a981a3b886da556512f36; https://git.kernel.org/stable/c/18f13f2a83eb81be349a9757ba2141ff1da9ad73
CVE: CVE-2025-38618
Published: 2025-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

vsock: Do not allow binding to VMADDR_PORT_ANY

It is possible for a vsock to autobind to VMADDR_PORT_ANY. This can
cause a use-after-free when a connection is made to the bound socket.
The socket returned by accept() also has port VMADDR_PORT_ANY but is not
on the list of unbound sockets. Binding it will result in an extra
refcount decrement similar to the one fixed in fcdd2242c023 (vsock: Keep
the binding until socket destruction).

Modify the check in __vsock_bind_connectible() to also prevent binding
to VMADDR_PORT_ANY.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/32950b1907919be86a7a2697d6f93d57068b3865; https://git.kernel.org/stable/c/44bd006d5c93f6a8f28b106cbae2428c5d0275b7; https://git.kernel.org/stable/c/8f01093646b49f6330bb2d36761983fd829472b1
CVE: CVE-2025-50691
Published: 2025-08-22
Description: MCSManager 10.5.3 daemon process runs as a root account by default, and its sensitive data (including tokens and terminal content) is stored in the data directory, readable by all users. Other users on the system can read the daemon's key and use it to log in, leading to privilege escalation.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-266
References: https://github.com/MCSManager/MCSManager/pull/1596; https://github.com/bddjr/bddjr/discussions/9
CVE: CVE-2025-51825
Published: 2025-08-22
Description: JeecgBoot versions from 3.4.3 up to 3.8.0 were found to contain a SQL injection vulnerability in the /jeecg-boot/online/cgreport/head/parseSql endpoint, which allows bypassing SQL blacklist restrictions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/jeecgboot/JeecgBoot/issues/8335; https://r4gd0ll.github.io/2025/JEECGBOOT_BYPASS_SQLInject.html
CVE: CVE-2025-33120
Published: 2025-08-22
Description: IBM QRadar SIEM 7.5 through 7.5.0 UP13 could allow an authenticated user to escalate their privileges via a misconfigured cronjob due to execution with unnecessary privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250
References: https://www.ibm.com/support/pages/node/7242869
CVE: CVE-2025-36042
Published: 2025-08-22
Description: IBM QRadar SIEM 7.5 through 7.5.0 Dashboard is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7242869
CVE: CVE-2025-55573
Published: 2025-08-22
Description: QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://github.com/QuantumNous/new-api; https://github.com/zh0u9527/docs/blob/master/new-api-wp.md
CVE: CVE-2025-29365
Published: 2025-08-22
Description: spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in READ_STRING_SYSCALL.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-125, CWE-274, CWE-787
References: https://gist.github.com/Giles-one/3a80cd1c7014e50601bd1c0dd9d41663; https://github.com/Giles-one/spimsimulatorEscape?tab=readme-ov-file#bug1-out-of-bounds-write-in-read_input-function
CVE: CVE-2025-29366
Published: 2025-08-22
Description: In mupen64plus v2.6.0 there is an array overflow vulnerability in the write_rdram_regs and write_rdram_regs functions, which enables executing arbitrary commands on the host machine.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://gist.github.com/Giles-one/f4ea405c2a26000bb4ff4cfb9622be49; https://github.com/Giles-one/mupen64plusEscape/tree/main/BUG1; https://github.com/mupen64plus/mupen64plus-core/blob/2.6.0/src/device/rdram/rdram.c#L159
CVE: CVE-2025-38620
Published: 2025-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

zloop: fix KASAN use-after-free of tag set

When a zoned loop device, or zloop device, is removed, KASAN enabled
kernel reports "BUG KASAN use-after-free" in blk_mq_free_tag_set(). The
BUG happens because zloop_ctl_remove() calls put_disk(), which invokes
zloop_free_disk(). The zloop_free_disk() frees the memory allocated for
the zlo pointer. However, after the memory is freed, zloop_ctl_remove()
calls blk_mq_free_tag_set(&zlo->tag_set), which accesses the freed zlo.
Hence the KASAN use-after-free.

 zloop_ctl_remove()
  put_disk(zlo->disk)
   put_device()
    kobject_put()
     ...
      zloop_free_disk()
        kvfree(zlo)
  blk_mq_free_tag_set(&zlo->tag_set)

To avoid the BUG, move the call to blk_mq_free_tag_set(&zlo->tag_set)
from zloop_ctl_remove() into zloop_free_disk(). This ensures that
the tag_set is freed before the call to kvfree(zlo).
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/765761851d89c772f482494d452e[PII_REDACTED]78; https://git.kernel.org/stable/c/c7c87046b41a9ef28ee7ac476c369da5b5228bc5
CVE: CVE-2025-38621
Published: 2025-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

md: make rdev_addable usable for rcu mode

Our testcase trigger panic:

BUG: kernel NULL pointer dereference, address:[PII_REDACTED]0000e0
...
Oops: Oops: 0000 [#1] SMP NOPTI
CPU: 2 UID: 0 PID: 85 Comm: kworker/2:1 Not tainted 6.16.0+ #94
PREEMPT(none)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.16.1-2.fc37 04/01/2014
Workqueue: md_misc md_start_sync
RIP: 0010:rdev_addable+0x4d/0xf0
...
Call Trace:
 <TASK>
 md_start_sync+0x329/0x480
 process_one_work+0x226/0x6d0
 worker_thread+0x19e/0x340
 kthread+0x10f/0x250
 ret_from_fork+0x14d/0x180
 ret_from_fork_asm+0x1a/0x30
 </TASK>
Modules linked in: raid10
CR2:[PII_REDACTED]0000e0
---[ end trace [PII_REDACTED] ]---
RIP: 0010:rdev_addable+0x4d/0xf0

md_spares_need_change in md_start_sync will call rdev_addable which
protected by rcu_read_lock/rcu_read_unlock. This rcu context will help
protect rdev won't be released, but rdev->mddev will be set to NULL
before we call synchronize_rcu in md_kick_rdev_from_array. Fix this by
using READ_ONCE and check does rdev->mddev still alive.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/13017b427118f4311471ee47df74872372ca8482; https://git.kernel.org/stable/c/b5fbe940862339cdcc34dea7a057ad18d18fa137
CVE: CVE-2025-38622
Published: 2025-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

net: drop UFO packets in udp_rcv_segment()

When sending a packet with virtio_net_hdr to tun device, if the gso_type
in virtio_net_hdr is SKB_GSO_UDP and the gso_size is less than udphdr
size, below crash may happen.

  ------------[ cut here ]------------
  kernel BUG at net/core/skbuff.c:4572!
  Oops: invalid opcode: 0000 [#1] SMP NOPTI
  CPU: 0 UID: 0 PID: 62 Comm: mytest Not tainted 6.16.0-rc7 #203 PREEMPT(voluntary)
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
  RIP: 0010:skb_pull_rcsum+0x8e/0xa0
  Code: 00 00 5b c3 cc cc cc cc 8b 93 88 00 00 00 f7 da e8 37 44 38 00 f7 d8 89 83 88 00 00 00 48 8b 83 c8 00 00 00 5b c3 cc cc cc cc <0f> 0b 0f 0b 66 66 2e 0f 1f 84 00 000
  RSP: 0018:ffffc900001fba38 EFLAGS: 00000297
  RAX: [PII_REDACTED] RBX: ffff8880040c1000 RCX: ffffc900001fb948
  RDX: ffff888003e6d700 RSI: [PII_REDACTED] RDI: ffff88800411a062
  RBP: ffff8880040c1000 R08: [PII_REDACTED] R09: [PII_REDACTED]
  R10: ffff888003606c00 R11: [PII_REDACTED] R12: [PII_REDACTED]
  R13: ffff[PII_REDACTED]00 R14: ffff[PII_REDACTED]00 R15: ffff[PII_REDACTED]00
  FS: [PII_REDACTED]06d3c0(0000) GS:ffff888084a19000(0000) knlGS:[PII_REDACTED]
  CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
  CR2: [PII_REDACTED] CR3: [PII_REDACTED] CR4:[PII_REDACTED]0006f0
  Call Trace:
   <TASK>
   udp_queue_rcv_one_skb+0x176/0x4b0 net/ipv4/udp.c:2445
   udp_queue_rcv_skb+0x155/0x1f0 net/ipv4/udp.c:2475
   udp_unicast_rcv_skb+0x71/0x90 net/ipv4/udp.c:2626
   __udp4_lib_rcv+0x433/0xb00 net/ipv4/udp.c:2690
   ip_protocol_deliver_rcu+0xa6/0x160 net/ipv4/ip_input.c:205
   ip_local_deliver_finish+0x72/0x90 net/ipv4/ip_input.c:233
   ip_sublist_rcv_finish+0x5f/0x70 net/ipv4/ip_input.c:579
   ip_sublist_rcv+0x122/0x1b0 net/ipv4/ip_input.c:636
   ip_list_rcv+0xf7/0x130 net/ipv4/ip_input.c:670
   __netif_receive_skb_list_core+0x21d/0x240 net/core/dev.c:6067
   netif_receive_skb_list_internal+0x186/0x2b0 net/core/dev.c:6210
   napi_complete_done+0x78/0x180 net/core/dev.c:6580
   tun_get_user+0xa63/0x1120 drivers/net/tun.c:1909
   tun_chr_write_iter+0x65/0xb0 drivers/net/tun.c:1984
   vfs_write+0x300/0x420 fs/read_write.c:593
   ksys_write+0x60/0xd0 fs/read_write.c:686
   do_syscall_64+0x50/0x1c0 arch/x86/entry/syscall_64.c:63
   </TASK>

To trigger gso segment in udp_queue_rcv_skb(), we should also set option
UDP_ENCAP_ESPINUDP to enable udp_sk(sk)->encap_rcv. When the encap_rcv
hook return 1 in udp_queue_rcv_one_skb(), udp_csum_pull_header() will try
to pull udphdr, but the skb size has been segmented to gso size, which
leads to this crash.

Previous commit cf329aa42b66 ("udp: cope with UDP GRO packet misdirection")
introduces segmentation in UDP receive path only for GRO, which was never
intended to be used for UFO, so drop UFO packets in udp_rcv_segment().
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0c639c6479ec[PII_REDACTED]a5fc566f7588cf5522; https://git.kernel.org/stable/c/0d45954034f8edd6d4052e0190d3d6335c37e4de; https://git.kernel.org/stable/c/4c1022220b1b6fea802175e80444923a3bbf93a5
CVE: CVE-2025-38623
Published: 2025-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

PCI: pnv_php: Fix surprise plug detection and recovery

The existing PowerNV hotplug code did not handle surprise plug events
correctly, leading to a complete failure of the hotplug system after device
removal and a required reboot to detect new devices.

This comes down to two issues:

 1) When a device is surprise removed, often the bridge upstream
    port will cause a PE freeze on the PHB.  If this freeze is not
    cleared, the MSI interrupts from the bridge hotplug notification
    logic will not be received by the kernel, stalling all plug events
    on all slots associated with the PE.

 2) When a device is removed from a slot, regardless of surprise or
    programmatic removal, the associated PHB/PE ls left frozen.
    If this freeze is not cleared via a fundamental reset, skiboot
    is unable to clear the freeze and cannot retrain / rescan the
    slot.  This also requires a reboot to clear the freeze and redetect
    the device in the slot.

Issue the appropriate unfreeze and rescan commands on hotplug events,
and don't oops on hotplug if pci_bus_to_OF_node() returns NULL.

[bhelgaas: tidy comments]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1d2f63680c5719a5da92639e981c6c9a87fcee08; https://git.kernel.org/stable/c/2ec8ec57bb8ebde3e2a015eff80e5d66e6634fe3; https://git.kernel.org/stable/c/473999ba937eac9776be791deed7c84a21d7880b
CVE: CVE-2025-38624
Published: 2025-08-22
Description: In the Linux kernel, the following vulnerability has been resolved:

PCI: pnv_php: Clean up allocated IRQs on unplug

When the root of a nested PCIe bridge configuration is unplugged, the
pnv_php driver leaked the allocated IRQ resources for the child bridges'
hotplug event notifications, resulting in a panic.

Fix this by walking all child buses and deallocating all its IRQ resources
before calling pci_hp_remove_devices().

Also modify the lifetime of the workqueue at struct pnv_php_slot::wq so
that it is only destroyed in pnv_php_free_slot(), instead of
pnv_php_disable_irq(). This is required since pnv_php_disable_irq() will
now be called by workers triggered by hot unplug interrupts, so the
workqueue needs to stay allocated.

The abridged kernel panic that occurs without this patch is as follows:

  WARNING: CPU: 0 PID: 687 at kernel/irq/msi.c:292 msi_device_data_release+0x6c/0x9c
  CPU: 0 UID: 0 PID: 687 Comm: bash Not tainted 6.14.0-rc5+ #2
  Call Trace:
   msi_device_data_release+0x34/0x9c (unreliable)
   release_nodes+0x64/0x13c
   devres_release_all+0xc0/0x140
   device_del+0x2d4/0x46c
   pci_destroy_dev+0x5c/0x194
   pci_hp_remove_devices+0x90/0x128
   pci_hp_remove_devices+0x44/0x128
   pnv_php_disable_slot+0x54/0xd4
   power_write_file+0xf8/0x18c
   pci_slot_attr_store+0x40/0x5c
   sysfs_kf_write+0x64/0x78
   kernfs_fop_write_iter+0x1b0/0x290
   vfs_write+0x3bc/0x50c
   ksys_write+0x84/0x140
   system_call_exception+0x124/0x230
   system_call_vectored_common+0x15c/0x2ec

[bhelgaas: tidy comments]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1773c19fa55e944cdd2634e2d9e552f87f2d38d5; https://git.kernel.org/stable/c/28aa3cfce[PII_REDACTED]e7667ec84424e1f43227; https://git.kernel.org/stable/c/32173edf3fe2d447e14e5e3b299387c6f9602a88