deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-57922
Published: 2025-01-19
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Add check for granularity in dml ceil/floor helpers

[Why]
Wrapper functions for dcn_bw_ceil2() and dcn_bw_floor2()
should check for granularity is non zero to avoid assert and
divide-by-zero error in dcn_bw_ functions.

[How]
Add check for granularity 0.

(cherry picked from commit f6e09701c3eb2ccb8cb0518e0b67f1c69742a4ec)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369, CWE-369
References: https://git.kernel.org/stable/c/0881fbc4fd62e00a2b8e102725f76d10351b2ea8; https://git.kernel.org/stable/c/497471baf53bb8fd3cd1529d65d4d7f7b81f1917; https://git.kernel.org/stable/c/4f0dd09ed3001725ffd8cdc2868e71df585392fe
CVE: CVE-2024-57923
Published: 2025-01-19
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: zlib: fix avail_in bytes for s390 zlib HW compression path

Since the input data length passed to zlib_compress_folios() can be
arbitrary, always setting strm.avail_in to a multiple of PAGE_SIZE may
cause read-in bytes to exceed the input range. Currently this triggers
an assert in btrfs_compress_folios() on the debug kernel (see below).
Fix strm.avail_in calculation for S390 hardware acceleration path.

  assertion failed: *total_in <= orig_len, in fs/btrfs/compression.c:1041
  ------------[ cut here ]------------
  kernel BUG at fs/btrfs/compression.c:1041!
  monitor event: 0040 ilc:2 [#1] PREEMPT SMP
  CPU: 16 UID: 0 PID: 325 Comm: kworker/u273:3 Not tainted 6.13.0-20241204.rc1.git6.fae3b21430ca.300.fc41.s390x+debug #1
  Hardware name: IBM 3931 A01 703 (z/VM 7.4.0)
  Workqueue: btrfs-delalloc btrfs_work_helper
  Krnl PSW : 0704d[PII_REDACTED]0[PII_REDACTED]df6538 (btrfs_compress_folios+0x198/0x1a0)
             R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 RI:0 EA:3
  Krnl GPRS: [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] [PII_REDACTED]
             [PII_REDACTED] ffffff01757bb[PII_REDACTED]76232fcc0[PII_REDACTED]00130c
            [PII_REDACTED]32fcd0[PII_REDACTED]32fcc8 00000118ff4a0e30 [PII_REDACTED]
            [PII_REDACTED]1ab400 [PII_REDACTED][PII_REDACTED]df6[PII_REDACTED]76232fb58
  Krnl Code:[PII_REDACTED]df6528: c020006f5ef4        larl    %r2,[PII_REDACTED]be2310
            [PII_REDACTED]df652e: c0e5ffbd09d5        brasl   %r14,[PII_REDACTED]5978d8
            #[PII_REDACTED]df6534: af000000            mc      0,0
            >[PII_REDACTED]df6538: 0707                bcr     0,%r7
            [PII_REDACTED]df653a: 0707                bcr     0,%r7
            [PII_REDACTED]df653c: 0707                bcr     0,%r7
            [PII_REDACTED]df653e: 0707                bcr     0,%r7
            [PII_REDACTED]df6540: c004004bb7ec        brcl    0,[PII_REDACTED]76d518
  Call Trace:
   [<[PII_REDACTED]df6538>] btrfs_compress_folios+0x198/0x1a0
  ([<[PII_REDACTED]df6534>] btrfs_compress_folios+0x194/0x1a0)
   [<[PII_REDACTED]d97788>] compress_file_range+0x3b8/0x6d0
   [<[PII_REDACTED]dcee7c>] btrfs_work_helper+0x10c/0x160
   [<[PII_REDACTED]>] process_one_work+0x2b0/0x5d0
   [<[PII_REDACTED]64637e>] worker_thread+0x20e/0x3e0
   [<[PII_REDACTED]65221a>] kthread+0x15a/0x170
   [<[PII_REDACTED]5b859c>] __ret_from_fork+0x3c/0x60
   [<[PII_REDACTED]6e72d2>] ret_from_fork+0xa/0x38
  INFO: lockdep is turned off.
  Last Breaking-Event-Address:
   [<[PII_REDACTED]>] _printk+0x4c/0x58
  Kernel panic - not syncing: Fatal exception: panic_on_oops
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://git.kernel.org/stable/c/0ee4736c003daded513de0ff112d4a1e9c85bbab; https://git.kernel.org/stable/c/25adbb08aeadcff883ab801df99fd20fefbb6ca4
CVE: CVE-2024-57924
Published: 2025-01-19
Description: In the Linux kernel, the following vulnerability has been resolved:

fs: relax assertions on failure to encode file handles

Encoding file handles is usually performed by a filesystem >encode_fh()
method that may fail for various reasons.

The legacy users of exportfs_encode_fh(), namely, nfsd and
name_to_handle_at(2) syscall are ready to cope with the possibility
of failure to encode a file handle.

There are a few other users of exportfs_encode_{fh,fid}() that
currently have a WARN_ON() assertion when ->encode_fh() fails.
Relax those assertions because they are wrong.

The second linked bug report states commit 16aac5ad1fa9 ("ovl: support
encoding non-decodable file handles") in v6.6 as the regressing commit,
but this is not accurate.

The aforementioned commit only increases the chances of the assertion
and allows triggering the assertion with the reproducer using overlayfs,
inotify and drop_caches.

Triggering this assertion was always possible with other filesystems and
other reasons of ->encode_fh() failures and more particularly, it was
also possible with the exact same reproducer using overlayfs that is
mounted with options index=on,nfs_export=on also on kernels < v6.6.
Therefore, I am not listing the aforementioned commit as a Fixes commit.

Backport hint: this patch will have a trivial conflict applying to
v6.6.y, and other trivial conflicts applying to stable kernels < v6.6.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://git.kernel.org/stable/c/73697928c806fe[PII_REDACTED]184a86fc1c1957b4; https://git.kernel.org/stable/c/974e3fe0ac61de85015bbe5a4990cf4127b304b2; https://git.kernel.org/stable/c/adcde2872f8fc399b249758ae1990dcd53b694ea
CVE: CVE-2024-57925
Published: 2025-01-19
Description: In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix a missing return value check bug

In the smb2_send_interim_resp(), if ksmbd_alloc_work_struct()
fails to allocate a node, it returns a NULL pointer to the
in_work pointer. This can lead to an illegal memory write of
in_work->response_buf when allocate_interim_rsp_buf() attempts
to perform a kzalloc() on it.

To address this issue, incorporating a check for the return
value of ksmbd_alloc_work_struct() ensures that the function
returns immediately upon allocation failure, thereby preventing
the aforementioned illegal memory access.
CVSS Score: 7.1 (HIGH)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/271ae0edbfc942795c162e6cf20d2bc02bd7fde4; https://git.kernel.org/stable/c/2976e91a3e569cf2c92c9f71512c0ab1312fe965; https://git.kernel.org/stable/c/4c16e1cadcbcaf3c82d5fc310fbd34d0f5d0db7c
CVE: CVE-2024-57927
Published: 2025-01-19
Description: In the Linux kernel, the following vulnerability has been resolved:

nfs: Fix oops in nfs_netfs_init_request() when copying to cache

When netfslib wants to copy some data that has just been read on behalf of
nfs, it creates a new write request and calls nfs_netfs_init_request() to
initialise it, but with a NULL file pointer.  This causes
nfs_file_open_context() to oops - however, we don't actually need the nfs
context as we're only going to write to the cache.

Fix this by just returning if we aren't given a file pointer and emit a
warning if the request was for something other than copy-to-cache.

Further, fix nfs_netfs_free_request() so that it doesn't try to free the
context if the pointer is NULL.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/13a07cc81e2d116cece727a83746c74b87a9d417; https://git.kernel.org/stable/c/86ad1a58f6a9453f49e06ef957a40a8dac00a13f
CVE: CVE-2024-57928
Published: 2025-01-19
Description: In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix enomem handling in buffered reads

If netfs_read_to_pagecache() gets an error from either ->prepare_read() or
from netfs_prepare_read_iterator(), it needs to decrement ->nr_outstanding,
cancel the subrequest and break out of the issuing loop.  Currently, it
only does this for two of the cases, but there are two more that aren't
handled.

Fix this by moving the handling to a common place and jumping to it from
all four places.  This is in preference to inserting a wrapper around
netfs_prepare_read_iterator() as proposed by Dmitry Antipov[1].
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/105549d09a539a876b7c3330ab52d8aceedad358; https://git.kernel.org/stable/c/88ecdfea1b333de5c51442b45cd549eeadf01852
CVE: CVE-2024-57929
Published: 2025-01-19
Description: In the Linux kernel, the following vulnerability has been resolved:

dm array: fix releasing a faulty array block twice in dm_array_cursor_end

When dm_bm_read_lock() fails due to locking or checksum errors, it
releases the faulty block implicitly while leaving an invalid output
pointer behind. The caller of dm_bm_read_lock() should not operate on
this invalid dm_block pointer, or it will lead to undefined result.
For example, the dm_array_cursor incorrectly caches the invalid pointer
on reading a faulty array block, causing a double release in
dm_array_cursor_end(), then hitting the BUG_ON in dm-bufio cache_put().

Reproduce steps:

1. initialize a cache device

dmsetup create cmeta --table "0 8192 linear /dev/sdc 0"
dmsetup create cdata --table "0 65536 linear /dev/sdc 8192"
dmsetup create corig --table "0 524288 linear /dev/sdc $262144"
dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1
dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \
/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"

2. wipe the second array block offline

dmsteup remove cache cmeta cdata corig
mapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \
2>/dev/null | hexdump -e '1/8 "%u\n"')
ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \
2>/dev/null | hexdump -e '1/8 "%u\n"')
dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock

3. try reopen the cache device

dmsetup create cmeta --table "0 8192 linear /dev/sdc 0"
dmsetup create cdata --table "0 65536 linear /dev/sdc 8192"
dmsetup create corig --table "0 524288 linear /dev/sdc $262144"
dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \
/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"

Kernel logs:

(snip)
device-mapper: array: array_block_check failed: blocknr 0 != wanted 10
device-mapper: block manager: array validator check failed for block 10
device-mapper: array: get_ablock failed
device-mapper: cache metadata: dm_array_cursor_next for mapping failed
------------[ cut here ]------------
kernel BUG at drivers/md/dm-bufio.c:638!

Fix by setting the cached block pointer to NULL on errors.

In addition to the reproducer described above, this fix can be
verified using the "array_cursor/damaged" test in dm-unit:
  dm-unit run /pdata/array_cursor/damaged --kernel-dir <KERNEL_DIR>
CVSS Score: 7.1 (HIGH)
CWE: CWE-672
References: https://git.kernel.org/stable/c/017c4470bff[PII_REDACTED]8fec9341247bad358ff; https://git.kernel.org/stable/c/6002bec5354f86d1a2df21468f68e3ec03ede9da; https://git.kernel.org/stable/c/738994872d77e189b2d13c501a1d145e95d98f46
CVE: CVE-2024-38337
Published: 2025-01-19
Description: IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.1.0.0, and 6.2.0.0 could allow an unauthorized attacker to retrieve or alter sensitive information contents due to incorrect permission assignments.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-732
References: https://www.ibm.com/support/pages/node/7179166
CVE: CVE-2024-41742
Published: 2025-01-19
Description: IBM TXSeries for Multiplatforms 10.1 is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By conducting a slowloris-type attacks, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://www.ibm.com/support/pages/node/7172103
CVE: CVE-2024-41743
Published: 2025-01-19
Description: IBM TXSeries for Multiplatforms 10.1 could allow a remote attacker to cause a denial of service using persistent connections due to improper allocation of resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://www.ibm.com/support/pages/node/7172103
CVE: CVE-2024-41783
Published: 2025-01-19
Description: IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, 6.1.0.0, and 6.2.0.0 could allow a privileged user to inject commands into the underlying operating system due to improper validation of a specified type of input.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-77
References: https://www.ibm.com/support/pages/node/7176189
CVE: CVE-2025-0575
Published: 2025-01-19
Description: A vulnerability has been found in Union Bank of India Vyom 8.0.34 on Android and classified as problematic. This vulnerability affects unknown code of the component Rooting Detection. The manipulation leads to protection mechanism failure. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.9 (LOW)
CWE: CWE-693
References: https://drive.google.com/file/d/1kIXsZoD1FFps0bXQ1pbrfoo76Wy1pL7s/view?usp=drivesdk; https://vuldb.com/?ctiid.292540; https://vuldb.com/?id.292540
CVE: CVE-2025-0576
Published: 2025-01-20
Description: A vulnerability was found in Mobotix M15 4.3.4.83 and classified as problematic. This issue affects some unknown processing of the file /control/player?center&eventlist&pda&dummy_for_reload=[PII_REDACTED]&p_evt. The manipulation of the argument p_qual leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://vuldb.com/?ctiid.292541; https://vuldb.com/?id.292541; https://vuldb.com/?submit.475602
CVE: CVE-2025-0578
Published: 2025-01-20
Description: A vulnerability was found in Facile Sistemas Cloud Apps up to 20250107. It has been classified as problematic. Affected is an unknown function of the file /account/forgotpassword of the component Password Reset Handler. The manipulation of the argument reterros leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://vuldb.com/?ctiid.292596; https://vuldb.com/?id.292596; https://vuldb.com/?submit.476305
CVE: CVE-2025-0583
Published: 2025-01-20
Description: The a+HRD from aEnrich Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/en/cp-139-8369-cf396-2.html; https://www.twcert.org.tw/tw/cp-132-8368-1e317-1.html
CVE: CVE-2024-13524
Published: 2025-01-20
Description: A vulnerability has been found in obsproject OBS Studio up to 30.0.2 on Windows and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to untrusted search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. It is recommended to apply a patch to fix this issue. The vendor disagrees that this issue is "something worth reporting, as every attack surface requires privileged access/user compromise".
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-426
References: https://github.com/obsproject/obs-studio/pull/11569; https://vuldb.com/?ctiid.292495; https://vuldb.com/?id.292495
CVE: CVE-2025-0579
Published: 2025-01-20
Description: A vulnerability was found in Shiprocket Module 3/4 on OpenCart. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /index.php?route=extension/shiprocket/module/restapi of the component REST API Module. The manipulation of the argument x-username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://gist.github.com/mcdruid/3c9fc9bd4e882cee21f8a37998f56fce; https://vuldb.com/?ctiid.292597; https://vuldb.com/?id.292597
CVE: CVE-2025-0580
Published: 2025-01-20
Description: A vulnerability was found in Shiprocket Module 3 on OpenCart. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php?route=extension/module/rest_api&action=getOrders of the component REST API Module. The manipulation of the argument contentHash leads to incorrect authorization. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-285, CWE-863
References: https://gist.github.com/mcdruid/0d1fdbba445587639ee5da66e7abfcc9; https://vuldb.com/?ctiid.292598; https://vuldb.com/?id.292598
CVE: CVE-2025-0581
Published: 2025-01-20
Description: A vulnerability classified as problematic has been found in CampCodes School Management Software 1.0. This affects an unknown part of the file /chat/group/send of the component Chat History. The manipulation of the argument message leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/KhukuriRimal/Vulnerabilities/blob/main/CampCodes%20-%20Stored%20Cross%20Site%20Scripting-%20Account%20Takeover%20Possibility.pdf; https://vuldb.com/?ctiid.292599; https://vuldb.com/?id.292599
CVE: CVE-2025-0582
Published: 2025-01-20
Description: A vulnerability classified as critical was found in itsourcecode Farm Management System up to 1.0. This vulnerability affects unknown code of the file /add-pig.php. The manipulation of the argument pigphoto leads to unrestricted upload. The attack can be initiated remotely.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/yunhai666/cve/issues/2; https://itsourcecode.com/; https://vuldb.com/?ctiid.292600
CVE: CVE-2025-0584
Published: 2025-01-20
Description: The a+HRD from aEnrich Technology has a Server-side Request Forgery, allowing unauthenticated remote attackers to exploit this vulnerability to probe internal network.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://www.twcert.org.tw/en/cp-139-8371-1c17a-2.html; https://www.twcert.org.tw/tw/cp-132-8370-58eb5-1.html
CVE: CVE-2025-0585
Published: 2025-01-20
Description: The a+HRD from aEnrich Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.twcert.org.tw/en/cp-139-8373-91edc-2.html; https://www.twcert.org.tw/tw/cp-132-8372-19721-1.html
CVE: CVE-2025-0586
Published: 2025-01-20
Description: The a+HRD from aEnrich Technology has an Insecure Deserialization vulnerability, allowing remote attackers with database modification privileges and regular system privileges to perform arbitrary code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://www.twcert.org.tw/en/cp-139-8375-59abd-2.html; https://www.twcert.org.tw/tw/cp-132-8374-7085a-1.html
CVE: CVE-2025-0590
Published: 2025-01-20
Description: Improper permission settings for mobile applications (com.transsion.carlcare) may lead to 

information leakage risk.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://security.tecno.com/SRC/blogdetail/381?lang=en_US; https://security.tecno.com/SRC/securityUpdates
CVE: CVE-2023-52923
Published: 2025-01-20
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: adapt set backend to use GC transaction API

Use the GC transaction API to replace the old and buggy gc API and the
busy mark approach.

No set elements are removed from async garbage collection anymore,
instead the _DEAD bit is set on so the set element is not visible from
lookup path anymore. Async GC enqueues transaction work that might be
aborted and retried later.

rbtree and pipapo set backends does not set on the _DEAD bit from the
sync GC path since this runs in control plane path where mutex is held.
In this case, set elements are deactivated, removed and then released
via RCU callback, sync GC never fails.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/146c[PII_REDACTED]3dbc19998f36718d7986ad302b; https://git.kernel.org/stable/c/479a2cf5259347d6a1f658b0f791d27a34908e91; https://git.kernel.org/stable/c/c357648929c8dff[PII_REDACTED]69aafb8f0452bc2
CVE: CVE-2025-0479
Published: 2025-01-20
Description: This vulnerability exists in the CP Plus Router due to insecure handling of cookie flags used within its web interface. A remote attacker could exploit this vulnerability by intercepting data transmissions during an HTTP session on the vulnerable system.
 
Successful exploitation of this vulnerability could allow the attacker to obtain sensitive information and compromise the targeted system.
CWE: CWE-614, CWE-1004
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0005
CVE: CVE-2024-13176
Published: 2025-01-20
Description: Issue summary: A timing side-channel which could potentially allow recovering
the private key exists in the ECDSA signature computation.

Impact summary: A timing side-channel in ECDSA signature computations
could allow recovering the private key by an attacker. However, measuring
the timing would require either local access to the signing application or
a very fast network connection with low latency.

There is a timing signal of around 300 nanoseconds when the top word of
the inverted ECDSA nonce value is zero. This can happen with significant
probability only for some of the supported elliptic curves. In particular
the NIST P-521 curve is affected. To be able to measure this leak, the attacker
process must either be located in the same physical computer or must
have a very fast network connection with low latency. For that reason
the severity of this vulnerability is Low.

The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-385
References: https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844; https://github.com/openssl/openssl/commit/2af62e74fb59bc469506bc37eb2990ea408d9467; https://github.com/openssl/openssl/commit/392dcb336405a0c94486aa6655057f59fd3a0902
CVE: CVE-2025-21655
Published: 2025-01-20
Description: In the Linux kernel, the following vulnerability has been resolved:

io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period

io_eventfd_do_signal() is invoked from an RCU callback, but when
dropping the reference to the io_ev_fd, it calls io_eventfd_free()
directly if the refcount drops to zero. This isn't correct, as any
potential freeing of the io_ev_fd should be deferred another RCU grace
period.

Just call io_eventfd_put() rather than open-code the dec-and-test and
free, which will correctly defer it another RCU grace period.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-416
References: https://git.kernel.org/stable/c/6b63308c28987c6010b1180c72a6db4df6c68033; https://git.kernel.org/stable/c/8efff2aa2d95dc437ab67c5b4a9f1d3f367baa10; https://git.kernel.org/stable/c/a7085c3ae43b86d4b3d1b8275e6a67f14257e3b7
CVE: CVE-2025-24337
Published: 2025-01-20
Description: WriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini.
CVSS Score: 8.4 (HIGH)
CWE: CWE-281
References: https://github.com/writefreely/writefreely/releases/tag/v0.15.1; https://raphus.social/@TV4Fun/[PII_REDACTED]2643161; https://www.openwall.com/lists/oss-security/2025/01/18/1