deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-34083
Published: 2025-07-09
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36849.
CVE: CVE-2025-34084
Published: 2025-07-09
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36848.
CVE: CVE-2025-34085
Published: 2025-07-09
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36847.
CVE: CVE-2025-7207
Published: 2025-07-09
Description: A vulnerability, which was classified as problematic, was found in mruby up to 3.4.0-rc2. Affected is the function scope_new of the file mrbgems/mruby-compiler/core/codegen.c of the component nregs Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The name of the patch is 1fdd96104180cc0fb5d3cb086b05ab6458911bb9. It is recommended to apply a patch to fix this issue.
CVSS Score: 3.3 (LOW)
CWE: CWE-119, CWE-122, CWE-787
References: https://github.com/mruby/mruby/commit/1fdd96104180cc0fb5d3cb086b05ab6458911bb9; https://github.com/mruby/mruby/issues/6509; https://github.com/mruby/mruby/issues/6509#event[PII_REDACTED]9
CVE: CVE-2025-7208
Published: 2025-07-09
Description: A vulnerability was found in 9fans plan9port up to 9da5b44. It has been classified as critical. This affects the function edump in the library /src/plan9port/src/libsec/port/x509.c. The manipulation leads to heap-based buffer overflow. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is b3e06559475b0130a7a2fb56ac4d131d13d2012f. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-122
References: https://drive.google.com/drive/folders/1kedwNLNDiFQB2OAp7S-ZKYoF7nxfIZGO?usp=sharing; https://git.9front.org/plan9front/plan9front/b3e06559475b0130a7a2fb56ac4d131d13d2012f/commit.html; https://github.com/9fans/plan9port/issues/710#issuecomment[PII_REDACTED]
CVE: CVE-2025-7209
Published: 2025-07-09
Description: A vulnerability has been found in 9fans plan9port up to 9da5b44 and classified as problematic. Affected by this vulnerability is the function value_decode in the library src/libsec/port/x509.c. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is deae8939583d83fd798fca97665e0e94656c3ee8. It is recommended to apply a patch to fix this issue.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-476, CWE-476
References: https://git.9front.org/plan9front/plan9front/deae8939583d83fd798fca97665e0e94656c3ee8/commit.html; https://github.com/9fans/plan9port/issues/711; https://github.com/9fans/plan9port/issues/711#issuecomment[PII_REDACTED]
CVE: CVE-2025-5678
Published: 2025-07-09
Description: The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘redirectURL’ parameter in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.5.8/includes/assets/js/kb-countdown.min.js; https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.5.8/includes/blocks/class-kadence-blocks-countdown-block.php#L605; https://www.wordfence.com/threat-intel/vulnerabilities/id/fc712f6b-f11b-4731-8f89[PII_REDACTED]d6?source=cve
CVE: CVE-2025-7210
Published: 2025-07-09
Description: A vulnerability was found in code-projects/Fabian Ros Library Management System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file admin/profile_update.php. The manipulation of the argument photo leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/horytick/CVE/blob/main/Library%20Management%20System%20In%20PHP%20Arbitrary%20file%20upload.md; https://vuldb.com/?ctiid.315158; https://vuldb.com/?id.315158
CVE: CVE-2025-7211
Published: 2025-07-09
Description: A vulnerability was found in code-projects LifeStyle Store 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /cart_add.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/[PII_REDACTED]/cve/issues/4; https://vuldb.com/?ctiid.315160
CVE: CVE-2025-7212
Published: 2025-07-09
Description: A vulnerability was found in itsourcecode Insurance Management System up to 1.0. It has been rated as critical. This issue affects some unknown processing of the file /insertAgent.php. The manipulation of the argument agent_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/wishoper/CVE/issues/3; https://itsourcecode.com/; https://vuldb.com/?ctiid.315161
CVE: CVE-2025-7213
Published: 2025-07-09
Description: A vulnerability classified as critical has been found in FNKvision FNK-GU2 up to 40.1.7. Affected is an unknown function of the component UART Interface. The manipulation leads to on-chip debug and test interface with improper access control. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-1191
References: https://medium.com/@pundhapat/sqli-in-the-cloud-root-on-the-board-a-beginners-journey-into-iot-hacking-06efb2539a21; https://vuldb.com/?ctiid.315162; https://vuldb.com/?id.315162
CVE: CVE-2025-4606
Published: 2025-07-09
Description: The Sala - Startup & SaaS WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.4. This is due to the theme not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-620
References: https://themeforest.net/item/sala-startup-saas-wordpress-theme/33843955?s_rank=4; https://www.wordfence.com/threat-intel/vulnerabilities/id/aa385a1f-1623-4f0a-bb2f-d4564b8f91bf?source=cve
CVE: CVE-2025-7059
Published: 2025-07-09
Description: The Simple Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slideshow’ parameter in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/simple-featured-image/trunk/templates/slider.tpl.php#L24; https://wordpress.org/plugins/simple-featured-image/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/4d4ecc01-7969-4ff6-8210-530835a43dbc?source=cve
CVE: CVE-2025-7214
Published: 2025-07-09
Description: A vulnerability classified as problematic was found in FNKvision FNK-GU2 up to 40.1.7. Affected by this vulnerability is an unknown functionality of the file /etc/shadow of the component MD5. The manipulation leads to risky cryptographic algorithm. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
CVSS Score: 1.6 (LOW)
CWE: CWE-310, CWE-327
References: https://medium.com/@pundhapat/sqli-in-the-cloud-root-on-the-board-a-beginners-journey-into-iot-hacking-06efb2539a21; https://vuldb.com/?ctiid.315163; https://vuldb.com/?id.315163
CVE: CVE-2025-7215
Published: 2025-07-09
Description: A vulnerability, which was classified as problematic, has been found in FNKvision FNK-GU2 up to 40.1.7. Affected by this issue is some unknown functionality of the file /rom/wpa_supplicant.conf. The manipulation leads to cleartext storage of sensitive information. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
CVSS Score: 1.6 (LOW)
CWE: CWE-310, CWE-312
References: https://medium.com/@pundhapat/sqli-in-the-cloud-root-on-the-board-a-beginners-journey-into-iot-hacking-06efb2539a21; https://vuldb.com/?ctiid.315164; https://vuldb.com/?id.315164
CVE: CVE-2025-7216
Published: 2025-07-09
Description: A vulnerability, which was classified as critical, was found in lty628 Aidigu up to 1.8.2. This affects the function checkUserCookie of the file /application/common.php of the component PHP Object Handler. The manipulation of the argument rememberMe leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20, CWE-502
References: https://note-hxlab.wetolink.com/share/Bon2P1OSuNDc; https://vuldb.com/?ctiid.315165; https://vuldb.com/?id.315165
CVE: CVE-2025-7217
Published: 2025-07-09
Description: A vulnerability has been found in Campcodes Payroll Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ajax.php?action=save_position. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/falling-snow1/vuldb/issues/1; https://vuldb.com/?ctiid.315166; https://vuldb.com/?id.315166
CVE: CVE-2025-6691
Published: 2025-07-09
Description: The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS Score: 8.1 (HIGH)
CWE: CWE-73, CWE-610
References: https://plugins.trac.wordpress.org/browser/sureforms/trunk/admin/views/entries-list-table.php#L661; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3319753%40sureforms&new=3319753%40sureforms&sfp_email=&sfph_mail=; https://wordpress.org/plugins/sureforms/
CVE: CVE-2025-6742
Published: 2025-07-09
Description: The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.3 via the use of file_exists() in the delete_entry_files() function without restriction on the path provided. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3319753%40sureforms&new=3319753%40sureforms&sfp_email=&sfph_mail=; https://wordpress.org/plugins/sureforms/; https://www.wordfence.com/threat-intel/vulnerabilities/id/1de12d1c-5ac4-4f80-b33d-a689a6916ee0?source=cve
CVE: CVE-2025-7218
Published: 2025-07-09
Description: A vulnerability was found in Campcodes Payroll Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /ajax.php?action=delete_position. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/falling-snow1/vuldb/issues/2; https://vuldb.com/?ctiid.315167; https://vuldb.com/?id.315167
CVE: CVE-2025-7219
Published: 2025-07-09
Description: A vulnerability was found in Campcodes Payroll Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /ajax.php?action=delete_allowances. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/skyrainoh/CVE/issues/7; https://vuldb.com/?ctiid.315168; https://vuldb.com/?id.315168
CVE: CVE-2025-7220
Published: 2025-07-09
Description: A vulnerability was found in Campcodes Payroll Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=save_deductions. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/skyrainoh/CVE/issues/8; https://vuldb.com/?ctiid.315169; https://vuldb.com/?id.315169
CVE: CVE-2025-7378
Published: 2025-07-09
Description: An improper Input Validation vulnerability allows injecting arbitrary values of the NAS configuration file in ASUSTOR ADM. This could potentially lead to system misconfiguration and break the format of the configuation file, causing the NAS to exhibit unexpected behavior.
This issue affects ADM: from 4.1 before 4.3.1.R5A1.
CWE: CWE-20
References: https://www.asustor.com/security/security_advisory_detail?id=41
CVE: CVE-2025-27027
Published: 2025-07-09
Description: A user with vpuser credentials that opens an SSH connection to the device, gets a restricted shell rbash that allows only a small list of allowed commands. This vulnerability enables the user to get a full-featured Linux shell, bypassing the rbash restrictions.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-653
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27027
CVE: CVE-2025-27028
Published: 2025-07-09
Description: The Linux deprivileged user vpuser in Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) can read the entire file system content, including files belonging to other users and having restricted access (like, for example, the root password hash).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-266
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27028
CVE: CVE-2025-3497
Published: 2025-07-09
Description: The Linux distribution underlying the Radiflow iSAP Smart Collector 
(CentOS 7 - VSAP 1.20) is obsolete and 
reached end of life (EOL) on
June 30, 2024.  Thus, any 
unmitigated vulnerability could be exploited to affect this product.
CVSS Score: 8.7 (HIGH)
CWE: CWE-1104
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2025-3497
CVE: CVE-2025-3498
Published: 2025-07-09
Description: An unauthenticated user with management network access can get and 
modify the Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) 
configuration. The device has two web servers that expose unauthenticated REST APIs on the management network (TCP
ports 8084 and 8086). An attacker can use these APIs to get access to all system settings, modify the configuration
and execute some commands (e.g., system reboot).
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-306
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2025-3498
CVE: CVE-2025-3499
Published: 2025-07-09
Description: The device has two web servers that expose unauthenticated REST APIs on the management network (TCP
ports 8084 and 8086). Exploiting OS command injection through these APIs, an attacker can send arbitrary
commands that are executed with administrative permissions by the underlying operating system.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2025-3499
CVE: CVE-2025-7379
Published: 2025-07-09
Description: A security bypass vulnerability allows exploitation via Reverse Tabnabbing, a type of phishing attack where attackers can manipulate the content of the original tab, leading to credential theft and other security risks. This issue affects DataSync Center: from 1.1.0 before 1.1.0.r207, and from 1.2.0 before 1.2.0.r206.
CWE: CWE-352
References: https://www.asustor.com/security/security_advisory_detail?id=42
CVE: CVE-2025-38238
Published: 2025-07-09
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out

When both the RHBA and RPA FDMI requests time out, fnic reuses a frame to
send ABTS for each of them. On send completion, this causes an attempt to
free the same frame twice that leads to a crash.

Fix crash by allocating separate frames for RHBA and RPA, and modify ABTS
logic accordingly.

Tested by checking MDS for FDMI information.

Tested by using instrumented driver to:

 - Drop PLOGI response
 - Drop RHBA response
 - Drop RPA response
 - Drop RHBA and RPA response
 - Drop PLOGI response + ABTS response
 - Drop RHBA response + ABTS response
 - Drop RPA response + ABTS response
 - Drop RHBA and RPA response + ABTS response for both of them
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/09679e9abedfbc5a2590759a1a7893c1c26e6044; https://git.kernel.org/stable/c/a35b29bdedb4d2ae3160d4d6684a6f1ecd9ca7c2
CVE: CVE-2025-38239
Published: 2025-07-09
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: megaraid_sas: Fix invalid node index

On a system with DRAM interleave enabled, out-of-bound access is
detected:

megaraid_sas 0000:3f:00.0: requested/available msix 128/128 poll_queue 0
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in ./arch/x86/include/asm/topology.h:72:28
index -1 is out of range for type 'cpumask *[1024]'
dump_stack_lvl+0x5d/0x80
ubsan_epilogue+0x5/0x2b
__ubsan_handle_out_of_bounds.cold+0x46/0x4b
megasas_alloc_irq_vectors+0x149/0x190 [megaraid_sas]
megasas_probe_one.cold+0xa4d/0x189c [megaraid_sas]
local_pci_probe+0x42/0x90
pci_device_probe+0xdc/0x290
really_probe+0xdb/0x340
__driver_probe_device+0x78/0x110
driver_probe_device+0x1f/0xa0
__driver_attach+0xba/0x1c0
bus_for_each_dev+0x8b/0xe0
bus_add_driver+0x142/0x220
driver_register+0x72/0xd0
megasas_init+0xdf/0xff0 [megaraid_sas]
do_one_initcall+0x57/0x310
do_init_module+0x90/0x250
init_module_from_file+0x85/0xc0
idempotent_init_module+0x114/0x310
__x64_sys_finit_module+0x65/0xc0
do_syscall_64+0x82/0x170
entry_SYSCALL_64_after_hwframe+0x76/0x7e

Fix it accordingly.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://git.kernel.org/stable/c/074efb35552556a4b3b25eedab076d5dc24a8199; https://git.kernel.org/stable/c/19a47c966deb36624843b7301f0373a3dc541a05; https://git.kernel.org/stable/c/752eb816b55adb0673727ba0ed96609a17895654
CVE: CVE-2025-38243
Published: 2025-07-09
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix invalid inode pointer dereferences during log replay

In a few places where we call read_one_inode(), if we get a NULL pointer
we end up jumping into an error path, or fallthrough in case of
__add_inode_ref(), where we then do something like this:

   iput(&inode->vfs_inode);

which results in an invalid inode pointer that triggers an invalid memory
access, resulting in a crash.

Fix this by making sure we don't do such dereferences.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/2dcf838cf5c2f0f4501edaa1680fcad03618d760; https://git.kernel.org/stable/c/401d098f92ea69d8a75f8b845daf343e511681ba; https://git.kernel.org/stable/c/ba8386d662cc51cc5382688bbf7a152b0b0b27cf
CVE: CVE-2025-38247
Published: 2025-07-09
Description: In the Linux kernel, the following vulnerability has been resolved:

userns and mnt_idmap leak in open_tree_attr(2)

Once want_mount_setattr() has returned a positive, it does require
finish_mount_kattr() to release ->mnt_userns.  Failing do_mount_setattr()
does not change that.

As the result, we can end up leaking userns and possibly mnt_idmap as
well.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0748e553df0225754c316a92af3a77fdc057b358; https://git.kernel.org/stable/c/142db4e76110dd80239f4e79810f85ea1735ad60
CVE: CVE-2025-38249
Published: 2025-07-09
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()

In snd_usb_get_audioformat_uac3(), the length value returned from
snd_usb_ctl_msg() is used directly for memory allocation without
validation. This length is controlled by the USB device.

The allocated buffer is cast to a uac3_cluster_header_descriptor
and its fields are accessed without verifying that the buffer
is large enough. If the device returns a smaller than expected
length, this leads to an out-of-bounds read.

Add a length check to ensure the buffer is large enough for
uac3_cluster_header_descriptor.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/0ee87c2814deb5e[PII_REDACTED]6ac3abcb326880b; https://git.kernel.org/stable/c/11e740dc1a2c8590eb7074b5c4ab921bb6224c36; https://git.kernel.org/stable/c/24ff7d465c4284529bbfa207757bffb6f44b6403
CVE: CVE-2025-38251
Published: 2025-07-09
Description: In the Linux kernel, the following vulnerability has been resolved:

atm: clip: prevent NULL deref in clip_push()

Blamed commit missed that vcc_destroy_socket() calls
clip_push() with a NULL skb.

If clip_devs is NULL, clip_push() then crashes when reading
skb->truesize.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/3c709dce16999bf6a1d2ce377deb5dd6fdd8cb08; https://git.kernel.org/stable/c/41f6420ee845006354c004839fed07da71e34aee; https://git.kernel.org/stable/c/88c88f91f4b3563956bb52e7a71a3640f7ece157
CVE: CVE-2025-38252
Published: 2025-07-09
Description: In the Linux kernel, the following vulnerability has been resolved:

cxl/ras: Fix CPER handler device confusion

By inspection, cxl_cper_handle_prot_err() is making a series of fragile
assumptions that can lead to crashes:

1/ It assumes that endpoints identified in the record are a CXL-type-3
   device, nothing guarantees that.

2/ It assumes that the device is bound to the cxl_pci driver, nothing
   guarantees that.

3/ Minor, it holds the device lock over the switch-port tracing for no
   reason as the trace is 100% generated from data in the record.

Correct those by checking that the PCIe endpoint parents a cxl_memdev
before assuming the format of the driver data, and move the lock to where
it is required. Consequently this also makes the implementation ready for
CXL accelerators that are not bound to cxl_pci.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/3c70ec71abdaf4e4fa48cd8fdfbbd864d78235a8; https://git.kernel.org/stable/c/4bcb8dd36e9e3fad6c22862ac5b6993df838309b