deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-43333
Published: 2025-09-15
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to gain root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.apple.com/en-us/125110; http://seclists.org/fulldisclosure/2025/Sep/53
CVE: CVE-2025-43337
Published: 2025-09-15
Description: An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/125110; https://support.apple.com/en-us/125635; http://seclists.org/fulldisclosure/2025/Sep/53
CVE: CVE-2025-43340
Published: 2025-09-15
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to break out of its sandbox.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://support.apple.com/en-us/125110; http://seclists.org/fulldisclosure/2025/Sep/53
CVE: CVE-2025-43341
Published: 2025-09-15
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to gain root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://support.apple.com/en-us/125110; https://support.apple.com/en-us/125112; http://seclists.org/fulldisclosure/2025/Sep/53
CVE: CVE-2025-43342
Published: 2025-09-15
Description: A correctness issue was addressed with improved checks. This issue is fixed in Safari 26, iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://support.apple.com/en-us/125108; https://support.apple.com/en-us/125109; https://support.apple.com/en-us/125110
CVE: CVE-2025-43343
Published: 2025-09-15
Description: The issue was addressed with improved memory handling. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://support.apple.com/en-us/125108; https://support.apple.com/en-us/125110; https://support.apple.com/en-us/125113
CVE: CVE-2025-43344
Published: 2025-09-15
Description: An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An app may be able to cause unexpected system termination.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://support.apple.com/en-us/125108; https://support.apple.com/en-us/125110; https://support.apple.com/en-us/125114
CVE: CVE-2025-43346
Published: 2025-09-15
Description: An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/en-us/125108; https://support.apple.com/en-us/125109; https://support.apple.com/en-us/125110
CVE: CVE-2025-43347
Published: 2025-09-15
Description: This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An input validation issue was addressed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://support.apple.com/en-us/125108; https://support.apple.com/en-us/125110; https://support.apple.com/en-us/125114
CVE: CVE-2025-43349
Published: 2025-09-15
Description: An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. Processing a maliciously crafted video file may lead to unexpected app termination.
CVSS Score: 2.8 (LOW)
CWE: CWE-787
References: https://support.apple.com/en-us/125108; https://support.apple.com/en-us/125109; https://support.apple.com/en-us/125110
CVE: CVE-2025-43353
Published: 2025-09-15
Description: The issue was addressed with improved bounds checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. Processing a maliciously crafted string may lead to heap corruption.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://support.apple.com/en-us/125110; https://support.apple.com/en-us/125111; https://support.apple.com/en-us/125112
CVE: CVE-2025-43354
Published: 2025-09-15
Description: A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://support.apple.com/en-us/125108; https://support.apple.com/en-us/125110; https://support.apple.com/en-us/125114
CVE: CVE-2025-43355
Published: 2025-09-15
Description: A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An app may be able to cause a denial-of-service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-843
References: https://support.apple.com/en-us/125108; https://support.apple.com/en-us/125109; https://support.apple.com/en-us/125110
CVE: CVE-2025-43356
Published: 2025-09-15
Description: The issue was addressed with improved handling of caches. This issue is fixed in Safari 26, iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. A website may be able to access sensor information without user consent.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/125108; https://support.apple.com/en-us/125109; https://support.apple.com/en-us/125110
CVE: CVE-2025-43357
Published: 2025-09-15
Description: This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26. An app may be able to fingerprint the user.
CVSS Score: 3.3 (LOW)
CWE: CWE-359
References: https://support.apple.com/en-us/125108; https://support.apple.com/en-us/125110; http://seclists.org/fulldisclosure/2025/Sep/49
CVE: CVE-2025-43358
Published: 2025-09-15
Description: A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. A shortcut may be able to bypass sandbox restrictions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://support.apple.com/en-us/125108; https://support.apple.com/en-us/125109; https://support.apple.com/en-us/125110
CVE: CVE-2025-43359
Published: 2025-09-15
Description: A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. A UDP server socket bound to a local interface may become bound to all interfaces.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-670
References: https://support.apple.com/en-us/125108; https://support.apple.com/en-us/125109; https://support.apple.com/en-us/125110
CVE: CVE-2025-43362
Published: 2025-09-15
Description: The issue was addressed with improved checks. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26. An app may be able to monitor keystrokes without user permission.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://support.apple.com/en-us/125108; https://support.apple.com/en-us/125109; http://seclists.org/fulldisclosure/2025/Sep/49
CVE: CVE-2025-43366
Published: 2025-09-15
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Tahoe 26. An app may be able to disclose coprocessor memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/en-us/125110; http://seclists.org/fulldisclosure/2025/Sep/53
CVE: CVE-2025-43367
Published: 2025-09-15
Description: A privacy issue was addressed by moving sensitive data. This issue is fixed in macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to access protected user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/125110; https://support.apple.com/en-us/125112; http://seclists.org/fulldisclosure/2025/Sep/53
CVE: CVE-2025-43368
Published: 2025-09-15
Description: A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-416
References: https://support.apple.com/en-us/125108; https://support.apple.com/en-us/125110; https://support.apple.com/en-us/125113
CVE: CVE-2025-43369
Published: 2025-09-15
Description: This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Tahoe 26. An app may be able to access protected user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/125110; http://seclists.org/fulldisclosure/2025/Sep/53
CVE: CVE-2025-43370
Published: 2025-09-15
Description: A path handling issue was addressed with improved validation. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-120
References: https://support.apple.com/en-us/125117; http://seclists.org/fulldisclosure/2025/Sep/60
CVE: CVE-2025-43371
Published: 2025-09-15
Description: This issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to break out of its sandbox.
CVSS Score: 8.2 (HIGH)
CWE: CWE-284
References: https://support.apple.com/en-us/125117; http://seclists.org/fulldisclosure/2025/Sep/60
CVE: CVE-2025-43372
Published: 2025-09-15
Description: The issue was addressed with improved input validation. This issue is fixed in iOS 26 and iPadOS 26, macOS Sonoma 14.8.2, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://support.apple.com/en-us/125108; https://support.apple.com/en-us/125110; https://support.apple.com/en-us/125114
CVE: CVE-2025-43375
Published: 2025-09-15
Description: The issue was addressed with improved checks. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://support.apple.com/en-us/125117; http://seclists.org/fulldisclosure/2025/Sep/60
CVE: CVE-2025-59436
Published: 2025-09-16
Description: The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value[PII_REDACTED]01 is improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2024-29415.
CVSS Score: 3.2 (LOW)
CWE: CWE-918
References: https://cosmosofcyberspace.github.io/CVE-Application-Document.html; https://github.com/indutny/node-ip/issues/160
CVE: CVE-2025-59437
Published: 2025-09-16
Description: The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 0 is improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2024-29415. NOTE: in current versions of several applications, connection attempts to the IP address 0 (interpreted as 0.0.0.0) are blocked with error messages such as net::ERR_ADDRESS_INVALID. However, in some situations that depend on both application version and operating system, connection attempts to 0 and 0.0.0.0 are considered connection attempts to 127.0.0.1 (and, for this reason, a false value of isPublic would be preferable).
CVSS Score: 3.2 (LOW)
CWE: CWE-918
References: https://cosmosofcyberspace.github.io/CVE-Application-Document.html; https://github.com/indutny/node-ip/tags
CVE: CVE-2025-59453
Published: 2025-09-16
Description: Click Studios Passwordstate before 9.9 Build 9972 has a potential authentication bypass for Passwordstate emergency access. By using a crafted URL while on the Emergency Access web page, an unauthorized person can gain access to the Passwordstate Administration section.
CVSS Score: 3.2 (LOW)
CWE: CWE-669
References: https://www.clickstudios.com.au/passwordstate-changelog.aspx; https://www.clickstudios.com.au/security/advisories/
CVE: CVE-2025-9808
Published: 2025-09-16
Description: The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST endpoint. This makes it possible for unauthenticated attackers to extract information about password-protected vendors or venues.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3359403/; https://www.wordfence.com/threat-intel/vulnerabilities/id/0f2968d6-f1b1-4cd5-b76b-9dc0f6dd1a6a?source=cve
CVE: CVE-2023-53263
Published: 2025-09-16
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create

We can't simply free the connector after calling drm_connector_init on it.
We need to clean up the drm side first.

It might not fix all regressions from commit 2b5d1c29f6c4
("drm/nouveau/disp: PIOR DP uses GPIO for HPD, not PMGR AUX interrupts"),
but at least it fixes a memory corruption in error handling related to
that commit.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/stable/c/1b254b791d7b7dea6e8adc887fbbd51746d8bb27; https://git.kernel.org/stable/c/3f27451c9f29d5ed[PII_REDACTED]0c7838a44dcac7; https://git.kernel.org/stable/c/872feeecd08c81d212a52211d212897b8a857544
CVE: CVE-2023-53264
Published: 2025-09-16
Description: In the Linux kernel, the following vulnerability has been resolved:

clk: imx: clk-imxrt1050: fix memory leak in imxrt1050_clocks_probe

Use devm_of_iomap() instead of of_iomap() to automatically
handle the unused ioremap region. If any error occurs, regions allocated by
kzalloc() will leak, but using devm_kzalloc() instead will automatically
free the memory using devm_kfree().

Also, fix error handling of hws by adding unregister_hws label, which
unregisters remaining hws when iomap failed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/02e54db221bb001b32f839e0149ee8d890ab9aa1; https://git.kernel.org/stable/c/0fbdfd2542252e4c02e8158a06b7c0c9cfd40f99; https://git.kernel.org/stable/c/[PII_REDACTED]a66f2ae5a043c495532830a55d28c4
CVE: CVE-2023-53266
Published: 2025-09-16
Description: In the Linux kernel, the following vulnerability has been resolved:

arm64: acpi: Fix possible memory leak of ffh_ctxt

Allocated 'ffh_ctxt' memory leak is possible if the SMCCC version
and conduit checks fail and -EOPNOTSUPP is returned without freeing the
allocated memory.

Fix the same by moving the allocation after the SMCCC version and
conduit checks.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/1b561d3949f8478c5403c9752b5533211a757226; https://git.kernel.org/stable/c/7521da2eb42d65f89f511b7912d3757cf3d9168a
CVE: CVE-2023-53267
Published: 2025-09-16
Description: In the Linux kernel, the following vulnerability has been resolved:

driver: soc: xilinx: fix memory leak in xlnx_add_cb_for_notify_event()

The kfree() should be called when memory fails to be allocated for
cb_data in xlnx_add_cb_for_notify_event(), otherwise there will be
a memory leak, so add kfree() to fix it.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/1bea534991b9b35c41848a397666ada436456beb; https://git.kernel.org/stable/c/9dfb6c784e385f6e61994bb4e16ce12f3e4940be; https://git.kernel.org/stable/c/d35290addcbac94b076babe0a798a8c043421812
CVE: CVE-2023-53268
Published: 2025-09-16
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: fsl_mqs: move of_node_put() to the correct location

of_node_put() should have been done directly after
mqs_priv->regmap = syscon_node_to_regmap(gpr_np);
otherwise it creates a reference leak on the success path.

To fix this, of_node_put() is moved to the correct location, and change
all the gotos to direct returns.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1bdb4a5ccab2316935ce4ad4fd4df8d36f0ffc6e; https://git.kernel.org/stable/c/1c34890273a020d61d6127ade3f68ed1cb21c16a; https://git.kernel.org/stable/c/402299cca89273b62384b5f9645ea49cd5fc4a57
CVE: CVE-2023-53269
Published: 2025-09-16
Description: In the Linux kernel, the following vulnerability has been resolved:

block: ublk: make sure that block size is set correctly

block size is one very key setting for block layer, and bad block size
could panic kernel easily.

Make sure that block size is set correctly.

Meantime if ublk_validate_params() fails, clear ub->params so that disk
is prevented from being added.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1d1665279a845d16c93687389e364386e3fe0f38; https://git.kernel.org/stable/c/231a49460ac0203270da2471928d392e5586370f; https://git.kernel.org/stable/c/9dbe85ac618ef6ae60abe5dd17ae2b29065d9c1e
CVE: CVE-2023-53270
Published: 2025-09-16
Description: In the Linux kernel, the following vulnerability has been resolved:

ext4: fix i_disksize exceeding i_size problem in paritally written case

It is possible for i_disksize can exceed i_size, triggering a warning.

generic_perform_write
 copied = iov_iter_copy_from_user_atomic(len) // copied < len
 ext4_da_write_end
 | ext4_update_i_disksize
 |  new_i_size = pos + copied;
 |  WRITE_ONCE(EXT4_I(inode)->i_disksize, newsize) // update i_disksize
 | generic_write_end
 |  copied = block_write_end(copied, len) // copied = 0
 |   if (unlikely(copied < len))
 |    if (!PageUptodate(page))
 |     copied = 0;
 |  if (pos + copied > inode->i_size) // return false
 if (unlikely(copied == 0))
  goto again;
 if (unlikely(iov_iter_fault_in_readable(i, bytes))) {
  status = -EFAULT;
  break;
 }

We get i_disksize greater than i_size here, which could trigger WARNING
check 'i_size_read(inode) < EXT4_I(inode)->i_disksize' while doing dio:

ext4_dio_write_iter
 iomap_dio_rw
  __iomap_dio_rw // return err, length is not aligned to 512
 ext4_handle_inode_extension
  WARN_ON_ONCE(i_size_read(inode) < EXT4_I(inode)->i_disksize) // Oops

 WARNING: CPU: 2 PID: 2609 at fs/ext4/file.c:319
 CPU: 2 PID: 2609 Comm: aa Not tainted 6.3.0-rc2
 RIP: 0010:ext4_file_write_iter+0xbc7
 Call Trace:
  vfs_write+0x3b1
  ksys_write+0x77
  do_syscall_64+0x39

Fix it by updating 'copied' value before updating i_disksize just like
ext4_write_inline_data_end() does.

A reproducer can be found in the buganizer link below.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/18eb23891aeae3229baf8c7c23b76be3364e1967; https://git.kernel.org/stable/c/1dedde690303c05ef732b7c5c8356fdf60a4ade3; https://git.kernel.org/stable/c/3ecea2fee[PII_REDACTED]c8b54ad99d471e61de92
CVE: CVE-2023-53271
Published: 2025-09-16
Description: In the Linux kernel, the following vulnerability has been resolved:

ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()

There is a memory leaks problem reported by kmemleak:

unreferenced object 0xffff888102007a00 (size 128):
  comm "ubirsvol", pid 32090, jiffies[PII_REDACTED] (age 2361.231s)
  hex dump (first 32 bytes):
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
  backtrace:
[<ffffffff8176cecd>] __kmalloc+0x4d/0x150
[<ffffffffa02a9a36>] ubi_eba_create_table+0x76/0x170 [ubi]
[<ffffffffa029764e>] ubi_resize_volume+0x1be/0xbc0 [ubi]
[<ffffffffa02a3321>] ubi_cdev_ioctl+0x701/0x1850 [ubi]
[<ffffffff81975d2d>] __x64_sys_ioctl+0x11d/0x170
[<ffffffff83c142a5>] do_syscall_64+0x35/0x80
[<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0

This is due to a mismatch between create and destroy interfaces, and
in detail that "new_eba_tbl" created by ubi_eba_create_table() but
destroyed by kfree(), while will causing "new_eba_tbl->entries" not
freed.

Fix it by replacing kfree(new_eba_tbl) with
ubi_eba_destroy_table(new_eba_tbl)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/07b60f7452d2fa[PII_REDACTED]37cb81821919f874; https://git.kernel.org/stable/c/09780a44093b53f9cbca76246af2e4ff0884e512; https://git.kernel.org/stable/c/1e591ea072df7211f64542a09482b5f81cb3ad27
CVE: CVE-2023-53272
Published: 2025-09-16
Description: In the Linux kernel, the following vulnerability has been resolved:

net: ena: fix shift-out-of-bounds in exponential backoff

The ENA adapters on our instances occasionally reset.  Once recently
logged a UBSAN failure to console in the process:

  UBSAN: shift-out-of-bounds in build/linux/drivers/net/ethernet/amazon/ena/ena_com.c:540:13
  shift exponent 32 is too large for 32-bit type 'unsigned int'
  CPU: 28 PID: 70012 Comm: kworker/u72:2 Kdump: loaded not tainted 5.15.117
  Hardware name: Amazon EC2 c5d.9xlarge/, BIOS 1.0 10/16/2017
  Workqueue: ena ena_fw_reset_device [ena]
  Call Trace:
  <TASK>
  dump_stack_lvl+0x4a/0x63
  dump_stack+0x10/0x16
  ubsan_epilogue+0x9/0x36
  __ubsan_handle_shift_out_of_bounds.cold+0x61/0x10e
  ? __const_udelay+0x43/0x50
  ena_delay_exponential_backoff_us.cold+0x16/0x1e [ena]
  wait_for_reset_state+0x54/0xa0 [ena]
  ena_com_dev_reset+0xc8/0x110 [ena]
  ena_down+0x3fe/0x480 [ena]
  ena_destroy_device+0xeb/0xf0 [ena]
  ena_fw_reset_device+0x30/0x50 [ena]
  process_one_work+0x22b/0x3d0
  worker_thread+0x4d/0x3f0
  ? process_one_work+0x3d0/0x3d0
  kthread+0x12a/0x150
  ? set_kthread_struct+0x50/0x50
  ret_from_fork+0x22/0x30
  </TASK>

Apparently, the reset delays are getting so large they can trigger a
UBSAN panic.

Looking at the code, the current timeout is capped at 5000us.  Using a
base value of 100us, the current code will overflow after (1<<29).  Even
at values before 32, this function wraps around, perhaps
unintentionally.

Cap the value of the exponent used for this backoff at (1<<16) which is
larger than currently necessary, but large enough to support bigger
values in the future.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://git.kernel.org/stable/c/0939c264729d4a081ff88efce2ffdf85dc5331e0; https://git.kernel.org/stable/c/1e760b2d18bf129b3da052c2946c02758e97d15e; https://git.kernel.org/stable/c/1e9cb763e9bacf0c932aa948f50dcfca6f519a26
CVE: CVE-2023-53273
Published: 2025-09-16
Description: In the Linux kernel, the following vulnerability has been resolved:

Drivers: vmbus: Check for channel allocation before looking up relids

relid2channel() assumes vmbus channel array to be allocated when called.
However, in cases such as kdump/kexec, not all relids will be reset by the host.
When the second kernel boots and if the guest receives a vmbus interrupt during
vmbus driver initialization before vmbus_connect() is called, before it finishes,
or if it fails, the vmbus interrupt service routine is called which in turn calls
relid2channel() and can cause a null pointer dereference.

Print a warning and error out in relid2channel() for a channel id that's invalid
in the second kernel.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/176c6b4889195fbe7016d9401175b48c5c9edf68; https://git.kernel.org/stable/c/1eb65c8687316c65140b48fad27133d583178e15; https://git.kernel.org/stable/c/8c3f0ae5435fd20bb1e3a8308488aa6ac33151ee