deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-46826
Published: 2025-05-07
Description: insa-auth is an authentication server for INSA Rouen. A minor issue allowed third-party websites to access the server's secondary authentication bridge, potentially revealing basic student information (name and number). However, the issue posed minimal risk, was never exploited, and had limited impact. A fix was implemented promptly on May 3, 2025.
CWE: CWE-601
References: https://github.com/INSAgenda/insa-auth/commit/8c1e68b2fb55aa952f522ead55a[PII_REDACTED]a2c; https://github.com/INSAgenda/insa-auth/commit/b0e7508e6ca4360e39fb1fd931f8d47b1f992ced; https://github.com/INSAgenda/insa-auth/commit/c77cf2e25778f83ebf5c4fdb4ded3ffcc8cfd74d
CVE: CVE-2025-0936
Published: 2025-05-07
Description: On affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may cause these remote-server credentials to be logged or accounted on the local EOS device or possibly on other remote accounting servers (i.e. TACACS, RADIUS, etc).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-256
References: https://www.arista.com/en/support/advisories-notices/security-advisory/21394-security-advisory-0117; https://www.arista.com/en/support/advisories-notices/security-advisory/21394-security-advisory-0117
CVE: CVE-2025-32441
Published: 2025-05-07
Description: Rack is a modular Ruby web server interface. Prior to version 2.2.14, when using the `Rack::Session::Pool` middleware, simultaneous rack requests can restore a deleted rack session, which allows the unauthenticated user to occupy that session. Rack session middleware prepares the session at the beginning of request, then saves is back to the store with possible changes applied by host rack application. This way the session becomes to be a subject of race conditions in general sense over concurrent rack requests. When using the `Rack::Session::Pool` middleware, and provided the attacker can acquire a session cookie (already a major issue), the session may be restored if the attacker can trigger a long running request (within that same session) adjacent to the user logging out, in order to retain illicit access even after a user has attempted to logout. Version 2.2.14 contains a patch for the issue. Some other mitigations are available. Either ensure the application invalidates sessions atomically by marking them as logged out e.g., using a `logged_out` flag, instead of deleting them, and check this flag on every request to prevent reuse; or implement a custom session store that tracks session invalidation timestamps and refuses to accept session data if the session was invalidated after the request began.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-362, CWE-367, CWE-613
References: https://github.com/rack/rack/blob/v2.2.13/lib/rack/session/abstract/id.rb#L263-L270; https://github.com/rack/rack/commit/c48e52f7c57e99e1e1bf54c8760d4f082cd1c89d; https://github.com/rack/rack/security/advisories/GHSA-vpfw-47h7-xj4g
CVE: CVE-2025-35939
Published: 2025-05-07
Description: Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at '/var/lib/php/sessions'. Such session files are named 'sess_[session_value]', where '[session_value]' is provided to the client in a 'Set-Cookie' response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-472
References: https://github.com/craftcms/cms/pull/17220; https://github.com/craftcms/cms/releases/tag/4.15.3; https://github.com/craftcms/cms/releases/tag/5.7.5
CVE: CVE-2025-46727
Published: 2025-05-07
Description: Rack is a modular Ruby web server interface. Prior to versions 2.2.14, 3.0.16, and 3.1.14, `Rack::QueryParser` parses query strings and `application/x-www-form-urlencoded` bodies into Ruby data structures without imposing any limit on the number of parameters, allowing attackers to send requests with extremely large numbers of parameters. The vulnerability arises because `Rack::QueryParser` iterates over each `&`-separated key-value pair and adds it to a Hash without enforcing an upper bound on the total number of parameters. This allows an attacker to send a single request containing hundreds of thousands (or more) of parameters, which consumes excessive memory and CPU during parsing. An attacker can trigger denial of service by sending specifically crafted HTTP requests, which can cause memory exhaustion or pin CPU resources, stalling or crashing the Rack server. This results in full service disruption until the affected worker is restarted. Versions 2.2.14, 3.0.16, and 3.1.14 fix the issue. Some other mitigations are available. One may use middleware to enforce a maximum query string size or parameter count, or employ a reverse proxy (such as Nginx) to limit request sizes and reject oversized query strings or bodies. Limiting request body sizes and query string lengths at the web server or CDN level is an effective mitigation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: https://github.com/rack/rack/commit/2bb5263b464b65ba4b648996a579dbd180d2b712; https://github.com/rack/rack/commit/3f5a4249118d09d199fe480466c8c6717e43b6e3; https://github.com/rack/rack/commit/cd6b70a1f2a1016b73dc906f924869f4902c2d74
CVE: CVE-2024-55651
Published: 2025-05-08
Description: i-Educar is free, fully online school management software. Version 2.9 of the application fails to properly validate and sanitize user supplied input, leading to a stored cross-site scripting vulnerability that resides within the user type (Tipo de Usuário) input field. Through this attacker vector a malicious user might be able to retrieve information belonging to another user, which may lead to sensitive information leakage or other malicious actions. As of time of publication, no patched versions are known to exist.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/portabilis/i-educar/security/advisories/GHSA-8fjj-9937-g84w
CVE: CVE-2025-32873
Published: 2025-05-08
Description: An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags().
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://docs.djangoproject.com/en/dev/releases/security/; https://groups.google.com/g/django-announce; https://www.djangoproject.com/weblog/2025/may/07/security-releases/
CVE: CVE-2024-13793
Published: 2025-05-08
Description: The Wolmart | Multi-Vendor Marketplace WooCommerce Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.8.11. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS Score: 7.3 (HIGH)
CWE: CWE-94
References: https://themeforest.net/item/wolmart-multivendor-marketplace-woocommerce-theme/32947681#item-description__changelog; https://www.wordfence.com/threat-intel/vulnerabilities/id/6eb57c97-f560-42d1-87bd-b19c60700956?source=cve
CVE: CVE-2025-3419
Published: 2025-05-08
Description: The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 4.0.26 via the proxy_image() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-47445 is a duplicate of this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-73
References: https://plugins.trac.wordpress.org/changeset/3284545/wp-event-solution/trunk/core/Admin/Hooks.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/1479071c-85c3-41fd-8ad7-f0dee32f201b?source=cve
CVE: CVE-2025-37800
Published: 2025-05-08
Description: In the Linux kernel, the following vulnerability has been resolved:

driver core: fix potential NULL pointer dereference in dev_uevent()

If userspace reads "uevent" device attribute at the same time as another
threads unbinds the device from its driver, change to dev->driver from a
valid pointer to NULL may result in crash. Fix this by using READ_ONCE()
when fetching the pointer, and take bus' drivers klist lock to make sure
driver instance will not disappear while we access it.

Use WRITE_ONCE() when setting the driver pointer to ensure there is no
tearing.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/18daa52418e7e4629ed1703b[PII_REDACTED]9d2622; https://git.kernel.org/stable/c/2b344e779d9afd0fcb5ee4000e4d0fc7d8d867eb; https://git.kernel.org/stable/c/3781e4b83e[PII_REDACTED]5de777e184cf0b62c40
CVE: CVE-2025-37801
Published: 2025-05-08
Description: In the Linux kernel, the following vulnerability has been resolved:

spi: spi-imx: Add check for spi_imx_setupxfer()

Add check for the return value of spi_imx_setupxfer().
spi_imx->rx and spi_imx->tx function pointer can be NULL when
spi_imx_setupxfer() return error, and make NULL pointer dereference.

 Unable to handle kernel NULL pointer dereference at virtual address [PII_REDACTED]
 Call trace:
  0x0
  spi_imx_pio_transfer+0x50/0xd8
  spi_imx_transfer_one+0x18c/0x858
  spi_transfer_one_message+0x43c/0x790
  __spi_pump_transfer_message+0x238/0x5d4
  __spi_sync+0x2b0/0x454
  spi_write_then_read+0x11c/0x200
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/055ef73bb1afc3f783a9a13b496770a781964a07; https://git.kernel.org/stable/c/185d376875ea6fb4256b9dc97ee0b4d2b0fdd399; https://git.kernel.org/stable/c/2b4479eb462ecb39001b38dfb331fc6028dedac8
CVE: CVE-2025-37802
Published: 2025-05-08
Description: In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING"

wait_event_timeout() will set the state of the current
task to TASK_UNINTERRUPTIBLE, before doing the condition check. This
means that ksmbd_durable_scavenger_alive() will try to acquire the mutex
while already in a sleeping state. The scheduler warns us by giving
the following warning:

do not call blocking ops when !TASK_RUNNING; state=2 set at
 [<[PII_REDACTED]515a6f>] prepare_to_wait_event+0x9f/0x6c0
WARNING: CPU: 2 PID: 4147 at kernel/sched/core.c:10099 __might_sleep+0x12f/0x160

mutex lock is not needed in ksmbd_durable_scavenger_alive().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/1df0d4c616138784e033ad337961b6e1a6bcd999; https://git.kernel.org/stable/c/8f805b3746d2f41702c77cba22f94f8415fadd1a; https://git.kernel.org/stable/c/cd161198e091e8a62b9bd631be970ea9a87d2d6a
CVE: CVE-2025-37803
Published: 2025-05-08
Description: In the Linux kernel, the following vulnerability has been resolved:

udmabuf: fix a buf size overflow issue during udmabuf creation

by casting size_limit_mb to u64  when calculate pglimit.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://git.kernel.org/stable/c/021ba7f1babd029e714d13a6bf2571b08af96d0f; https://git.kernel.org/stable/c/13fe12c037b470321436deec393030c6153cfeb9; https://git.kernel.org/stable/c/29b65a3171a49c9b69f31035146be966cec40b7a
CVE: CVE-2025-37804
Published: 2025-05-08
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-37805
Published: 2025-05-08
Description: In the Linux kernel, the following vulnerability has been resolved:

sound/virtio: Fix cancel_sync warnings on uninitialized work_structs

Betty reported hitting the following warning:

[    8.709131][  T221] WARNING: CPU: 2 PID: 221 at kernel/workqueue.c:4182
...
[    8.713282][  T221] Call trace:
[    8.713365][  T221]  __flush_work+0x8d0/0x914
[    8.713468][  T221]  __cancel_work_sync+0xac/0xfc
[    8.713570][  T221]  cancel_work_sync+0x24/0x34
[    8.713667][  T221]  virtsnd_remove+0xa8/0xf8 [virtio_snd ab15f34d0dd772f6d11327e08a81d46dc9c36276]
[    8.713868][  T221]  virtsnd_probe+0x48c/0x664 [virtio_snd ab15f34d0dd772f6d11327e08a81d46dc9c36276]
[    8.714035][  T221]  virtio_dev_probe+0x28c/0x390
[    8.714139][  T221]  really_probe+0x1bc/0x4c8
...

It seems we're hitting the error path in virtsnd_probe(), which
triggers a virtsnd_remove() which iterates over the substreams
calling cancel_work_sync() on the elapsed_period work_struct.

Looking at the code, from earlier in:
virtsnd_probe()->virtsnd_build_devs()->virtsnd_pcm_parse_cfg()

We set snd->nsubstreams, allocate the snd->substreams, and if
we then hit an error on the info allocation or something in
virtsnd_ctl_query_info() fails, we will exit without having
initialized the elapsed_period work_struct.

When that error path unwinds we then call virtsnd_remove()
which as long as the substreams array is allocated, will iterate
through calling cancel_work_sync() on the uninitialized work
struct hitting this warning.

Takashi Iwai suggested this fix, which initializes the substreams
structure right after allocation, so that if we hit the error
paths we avoid trying to cleanup uninitialized data.

Note: I have not yet managed to reproduce the issue myself, so
this patch has had limited testing.

Feedback or thoughts would be appreciated!
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://git.kernel.org/stable/c/3c7df2e27346eb40a0e86230db1ccab195c97cfe; https://git.kernel.org/stable/c/54c7b864fbe4423a07b443a4ada[PII_REDACTED]116; https://git.kernel.org/stable/c/5be9407b41eae20eef9140f5cfbfcbc3d01aaf45
CVE: CVE-2025-37807
Published: 2025-05-08
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix kmemleak warning for percpu hashmap

Vlad Poenaru reported the following kmemleak issue:

  unreferenced object 0x606fd7c44ac8 (size 32):
    backtrace (crc 0):
      pcpu_alloc_noprof+0x730/0xeb0
      bpf_map_alloc_percpu+0x69/0xc0
      prealloc_init+0x9d/0x1b0
      htab_map_alloc+0x363/0x510
      map_create+0x215/0x3a0
      __sys_bpf+0x16b/0x3e0
      __x64_sys_bpf+0x18/0x20
      do_syscall_64+0x7b/0x150
      entry_SYSCALL_64_after_hwframe+0x4b/0x53

Further investigation shows the reason is due to not 8-byte aligned
store of percpu pointer in htab_elem_set_ptr():
  *(void __percpu **)(l->key + key_size) = pptr;

Note that the whole htab_elem alignment is 8 (for x86_64). If the key_size
is 4, that means pptr is stored in a location which is 4 byte aligned but
not 8 byte aligned. In mm/kmemleak.c, scan_block() scans the memory based
on 8 byte stride, so it won't detect above pptr, hence reporting the memory
leak.

In htab_map_alloc(), we already have

        htab->elem_size = sizeof(struct htab_elem) +
                          round_up(htab->map.key_size, 8);
        if (percpu)
                htab->elem_size += sizeof(void *);
        else
                htab->elem_size += round_up(htab->map.value_size, 8);

So storing pptr with 8-byte alignment won't cause any problem and can fix
kmemleak too.

The issue can be reproduced with bpf selftest as well:
  1. Enable CONFIG_DEBUG_KMEMLEAK config
  2. Add a getchar() before skel destroy in test_hash_map() in prog_tests/for_each.c.
     The purpose is to keep map available so kmemleak can be detected.
  3. run './test_progs -t for_each/hash_map &' and a kmemleak should be reported.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/11ba7ce076e5903e7bdc1fd1498979c331b3c286; https://git.kernel.org/stable/c/1f1c29aa[PII_REDACTED]c17e3c32e68ec38a7a56df; https://git.kernel.org/stable/c/7758e308aeda1038aba1944f7302d34161b3effe
CVE: CVE-2025-37808
Published: 2025-05-08
Description: In the Linux kernel, the following vulnerability has been resolved:

crypto: null - Use spin lock instead of mutex

As the null algorithm may be freed in softirq context through
af_alg, use spin locks instead of mutexes to protect the default
null algorithm.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0486de3c1b8223138dcc614846bd76364f758de6; https://git.kernel.org/stable/c/1b66a5920b7fc7cc6251192a3fcad115b6d75dd5; https://git.kernel.org/stable/c/1dd4a8561d85dea545cf93f56efc48df8176e218
CVE: CVE-2025-37809
Published: 2025-05-08
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: typec: class: Fix NULL pointer access

Concurrent calls to typec_partner_unlink_device can lead to a NULL pointer
dereference. This patch adds a mutex to protect USB device pointers and
prevent this issue. The same mutex protects both the device pointers and
the partner device registration.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/1fdde62411fe65640e69bc55ea027d5b7b2f0093; https://git.kernel.org/stable/c/de7c24febd21413ea8f49f61b36338b676c02852; https://git.kernel.org/stable/c/ec27386de23a511008c53aa2f3434ad180a3ca9a
CVE: CVE-2025-37810
Published: 2025-05-08
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: gadget: check that event count does not exceed event buffer length

The event count is read from register DWC3_GEVNTCOUNT.
There is a check for the count being zero, but not for exceeding the
event buffer length.
Check that event count does not exceed event buffer length,
avoiding an out-of-bounds access when memcpy'ing the event.
Crash log:
Unable to handle kernel paging request at virtual address ffffffc0129be000
pc : __memcpy+0x114/0x180
lr : dwc3_check_event_buf+0xec/0x348
x3 : [PII_REDACTED] x2 :[PII_REDACTED]00dfc4
x1 : ffffffc0129be000 x0 : ffffff87aad60080
Call trace:
__memcpy+0x114/0x180
dwc3_interrupt+0x24/0x34
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/015c39f38e69a491d2abd5e98869a500a9459b3b; https://git.kernel.org/stable/c/52a7c9d930b95aa8b1620edaba4818040c32631f; https://git.kernel.org/stable/c/63ccd26cd1f[PII_REDACTED]f6ca3e625076be06c9f
CVE: CVE-2025-37811
Published: 2025-05-08
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: chipidea: ci_hdrc_imx: fix usbmisc handling

usbmisc is an optional device property so it is totally valid for the
corresponding data->usbmisc_data to have a NULL value.

Check that before dereferencing the pointer.

Found by Linux Verification Center (linuxtesting.org) with Svace static
analysis tool.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0ee460498ced[PII_REDACTED]7c9f6d29a10e5e0798; https://git.kernel.org/stable/c/121e9f80ea5478bca3a8f3f26593fd66f87da649; https://git.kernel.org/stable/c/2aa87bd825377f5073b76701780a902cd0fc725a
CVE: CVE-2025-37812
Published: 2025-05-08
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: cdns3: Fix deadlock when using NCM gadget

The cdns3 driver has the same NCM deadlock as fixed in cdnsp by commit
58f2fcb3a845 ("usb: cdnsp: Fix deadlock issue during using NCM gadget").

Under PREEMPT_RT the deadlock can be readily triggered by heavy network
traffic, for example using "iperf --bidir" over NCM ethernet link.

The deadlock occurs because the threaded interrupt handler gets
preempted by a softirq, but both are protected by the same spinlock.
Prevent deadlock by disabling softirq during threaded irq handler.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/09e90a9689a4aac7a2f726dc2aa472b0b37937b7; https://git.kernel.org/stable/c/48a62deb857f0694f611949015e70ad194d97159; https://git.kernel.org/stable/c/59a760e4796a3cd88d8b9d7706e0a638de677751
CVE: CVE-2025-37813
Published: 2025-05-08
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: xhci: Fix invalid pointer dereference in Etron workaround

This check is performed before prepare_transfer() and prepare_ring(), so
enqueue can already point at the final link TRB of a segment. And indeed
it will, some 0.4% of times this code is called.

Then enqueue + 1 is an invalid pointer. It will crash the kernel right
away or load some junk which may look like a link TRB and cause the real
link TRB to be replaced with a NOOP. This wouldn't end well.

Use a functionally equivalent test which doesn't dereference the pointer
and always gives correct result.

Something has crashed my machine twice in recent days while playing with
an Etron HC, and a control transfer stress test ran for confirmation has
just crashed it again. The same test passes with this patch applied.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0624e29c595b05e7a0e6d1c368f0a05799928e30; https://git.kernel.org/stable/c/142273a49f2c315eabdbdf5a71c15e479b75ca91; https://git.kernel.org/stable/c/1ea050da5562af9b930d17cbbe9632d30f5df43a
CVE: CVE-2025-37815
Published: 2025-05-08
Description: In the Linux kernel, the following vulnerability has been resolved:

misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration

Resolve kernel panic while accessing IRQ handler associated with the
generated IRQ. This is done by acquiring the spinlock and storing the
current interrupt state before handling the interrupt request using
generic_handle_irq.

A previous fix patch was submitted where 'generic_handle_irq' was
replaced with 'handle_nested_irq'. However, this change also causes
the kernel panic where after determining which GPIO triggered the
interrupt and attempting to call handle_nested_irq with the mapped
IRQ number, leads to a failure in locating the registered handler.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1263d5f581908602c618c6665e683c4436383a09; https://git.kernel.org/stable/c/12cc2193f2b9548e8ea5fbce8201b44158222edf; https://git.kernel.org/stable/c/18eb77c75ed01439f96ae5c0f33461eb5134b907
CVE: CVE-2025-37816
Published: 2025-05-08
Description: In the Linux kernel, the following vulnerability has been resolved:

mei: vsc: Fix fortify-panic caused by invalid counted_by() use

gcc 15 honors the __counted_by(len) attribute on vsc_tp_packet.buf[]
and the vsc-tp.c code is using this in a wrong way. len does not contain
the available size in the buffer, it contains the actual packet length
*without* the crc. So as soon as vsc_tp_xfer() tries to add the crc to
buf[] the fortify-panic handler gets triggered:

[   80.842193] memcpy: detected buffer overflow: 4 byte write of buffer size 0
[   80.842243] WARNING: CPU: 4 PID: 272 at lib/string_helpers.c:1032 __fortify_report+0x45/0x50
...
[   80.843175]  __fortify_panic+0x9/0xb
[   80.843186]  vsc_tp_xfer.cold+0x67/0x67 [mei_vsc_hw]
[   80.843210]  ? seqcount_lockdep_reader_access.constprop.0+0x82/0x90
[   80.843229]  ? lockdep_hardirqs_on+0x7c/0x110
[   80.843250]  mei_vsc_hw_start+0x98/0x120 [mei_vsc]
[   80.843270]  mei_reset+0x11d/0x420 [mei]

The easiest fix would be to just drop the counted-by but with the exception
of the ack buffer in vsc_tp_xfer_helper() which only contains enough room
for the packet-header, all other uses of vsc_tp_packet always use a buffer
of VSC_TP_MAX_XFER_SIZE bytes for the packet.

Instead of just dropping the counted-by, split the vsc_tp_packet struct
definition into a header and a full-packet definition and use a fixed
size buf[] in the packet definition, this way fortify-source buffer
overrun checking still works when enabled.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/00f1cc14da0f06d2897b8c528df7c7dcf1b8da50; https://git.kernel.org/stable/c/3e243378f27cc7d11682a3ad720228b0723affa5; https://git.kernel.org/stable/c/ac04663c67f244810b3492e9ecd9f7cdbefeca2d