deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-50213
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: do not allow SET_ID to refer to another table

When doing lookups for sets on the same batch by using its ID, a set from a
different table can be used.

Then, when the table is removed, a reference to the set may be kept after
the set is freed, leading to a potential use-after-free.

When looking for sets by ID, use the table that was used for the lookup by
name, and only return sets belonging to that same table.

This fixes CVE-2022-2586, also reported as ZDI-CAN-17470.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/0d[PII_REDACTED]7361850c554c192e749cfc879ea9; https://git.kernel.org/stable/c/1a4b18b1ff11ba26f9a852019d674fde9d1d1cff; https://git.kernel.org/stable/c/470ee20e069a6d05ae549f7d0ef2bdbcee6a81b2
CVE: CVE-2022-50215
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: sg: Allow waiting for commands to complete on removed device

When a SCSI device is removed while in active use, currently sg will
immediately return -ENODEV on any attempt to wait for active commands that
were sent before the removal.  This is problematic for commands that use
SG_FLAG_DIRECT_IO since the data buffer may still be in use by the kernel
when userspace frees or reuses it after getting ENODEV, leading to
corrupted userspace memory (in the case of READ-type commands) or corrupted
data being sent to the device (in the case of WRITE-type commands).  This
has been seen in practice when logging out of a iscsi_tcp session, where
the iSCSI driver may still be processing commands after the device has been
marked for removal.

Change the policy to allow userspace to wait for active sg commands even
when the device is being removed.  Return -ENODEV only when there are no
more responses to read.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/03d8241112d5e3cccce1a01274a221099f07d2e1; https://git.kernel.org/stable/c/3455607fd7be10b449f5135c00dc306b85dc0d21; https://git.kernel.org/stable/c/35e60ec39e862159cb92923eefd5230d4a873cb9
CVE: CVE-2022-50216
Published: 2025-06-18
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-50217
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

fuse: write inode in fuse_release()

A race between write(2) and close(2) allows pages to be dirtied after
fuse_flush -> write_inode_now().  If these pages are not flushed from
fuse_release(), then there might not be a writable open file later.  So any
remaining dirty pages must be written back before the file is released.

This is a partial revert of the blamed commit.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/035ff33cf4db101250fb980a3941bf078f37a544; https://git.kernel.org/stable/c/4bd9d5d20f344d[PII_REDACTED]02d12653c903c271; https://git.kernel.org/stable/c/5ccb0420b7c9334ab[PII_REDACTED]101931b899301
CVE: CVE-2022-50218
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

iio: light: isl29028: Fix the warning in isl29028_remove()

The driver use the non-managed form of the register function in
isl29028_remove(). To keep the release order as mirroring the ordering
in probe, the driver should use non-managed form in probe, too.

The following log reveals it:

[   32.374955] isl29028 0-0010: remove
[   32.376861] general protection fault, probably for non-canonical address 0xdffffc[PII_REDACTED]: 0000 [#1] PREEMPT SMP KASAN PTI
[   32.377676] KASAN: null-ptr-deref in range [0x[PII_REDACTED]000030-0x[PII_REDACTED]000037]
[   32.379432] RIP: 0010:kernfs_find_and_get_ns+0x28/0xe0
[   32.385461] Call Trace:
[   32.385807]  sysfs_unmerge_group+0x59/0x110
[   32.386110]  dpm_sysfs_remove+0x58/0xc0
[   32.386391]  device_del+0x296/0xe50
[   32.386959]  cdev_device_del+0x1d/0xd0
[   32.387231]  devm_iio_device_unreg+0x27/0xb0
[   32.387542]  devres_release_group+0x319/0x3d0
[   32.388162]  i2c_device_remove+0x93/0x1f0
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/06674fc7c003b9d0aa1d37fef7ab2c24802cc6ad; https://git.kernel.org/stable/c/359f3b150eab30805fe0e4e9d616887d7257a625; https://git.kernel.org/stable/c/4f0ebfb4b9bfad2326c0b2c3cc7e37f4b9ee9eba
CVE: CVE-2022-50219
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix KASAN use-after-free Read in compute_effective_progs

Syzbot found a Use After Free bug in compute_effective_progs().
The reproducer creates a number of BPF links, and causes a fault
injected alloc to fail, while calling bpf_link_detach on them.
Link detach triggers the link to be freed by bpf_link_free(),
which calls __cgroup_bpf_detach() and update_effective_progs().
If the memory allocation in this function fails, the function restores
the pointer to the bpf_cgroup_link on the cgroup list, but the memory
gets freed just after it returns. After this, every subsequent call to
update_effective_progs() causes this already deallocated pointer to be
dereferenced in prog_list_length(), and triggers KASAN UAF error.

To fix this issue don't preserve the pointer to the prog or link in the
list, but remove it and replace it with a dummy prog without shrinking
the table. The subsequent call to __cgroup_bpf_detach() or
__cgroup_bpf_detach() will correct it.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/1f8ca9c40e6222ce431e9ba5dae3cccce8ef9443; https://git.kernel.org/stable/c/3527e3cbb84d8868c4d4e91ba55915f96d39ec3d; https://git.kernel.org/stable/c/4c46091ee985ae84c60c5e95055d779fcd291d87
CVE: CVE-2022-50220
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

usbnet: Fix linkwatch use-after-free on disconnect

usbnet uses the work usbnet_deferred_kevent() to perform tasks which may
sleep.  On disconnect, completion of the work was originally awaited in
->ndo_stop().  But in 2003, that was moved to ->disconnect() by historic
commit "[PATCH] USB: usbnet, prevent exotic rtnl deadlock":

  https://git.kernel.org/tglx/history/c/0f138bbfd83c

The change was made because back then, the kernel's workqueue
implementation did not allow waiting for a single work.  One had to wait
for completion of *all* work by calling flush_scheduled_work(), and that
could deadlock when waiting for usbnet_deferred_kevent() with rtnl_mutex
held in ->ndo_stop().

The commit solved one problem but created another:  It causes a
use-after-free in USB Ethernet drivers aqc111.c, asix_devices.c,
ax88179_178a.c, ch9200.c and smsc75xx.c:

* If the drivers receive a link change interrupt immediately before
  disconnect, they raise EVENT_LINK_RESET in their (non-sleepable)
  ->status() callback and schedule usbnet_deferred_kevent().
* usbnet_deferred_kevent() invokes the driver's ->link_reset() callback,
  which calls netif_carrier_{on,off}().
* That in turn schedules the work linkwatch_event().

Because usbnet_deferred_kevent() is awaited after unregister_netdev(),
netif_carrier_{on,off}() may operate on an unregistered netdev and
linkwatch_event() may run after free_netdev(), causing a use-after-free.

In 2010, usbnet was changed to only wait for a single instance of
usbnet_deferred_kevent() instead of *all* work by commit 23f333a2bfaf
("drivers/net: don't use flush_scheduled_work()").

Unfortunately the commit neglected to move the wait back to
->ndo_stop().  Rectify that omission at long last.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/135199a2edd459d2b123144efcd7f9bcd95128e4; https://git.kernel.org/stable/c/635fd8953e4309b54ca6a81bed1d4a87668694f4; https://git.kernel.org/stable/c/7f77dcbc030c2faa6d8e8a594985eeb34018409e
CVE: CVE-2022-50221
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/fb-helper: Fix out-of-bounds access

Clip memory range to screen-buffer size to avoid out-of-bounds access
in fbdev deferred I/O's damage handling.

Fbdev's deferred I/O can only track pages. From the range of pages, the
damage handler computes the clipping rectangle for the display update.
If the fbdev screen buffer ends near the beginning of a page, that page
could contain more scanlines. The damage handler would then track these
non-existing scanlines as dirty and provoke an out-of-bounds access
during the screen update. Hence, clip the maximum memory range to the
size of the screen buffer.

While at it, rename the variables min/max to min_off/max_off in
drm_fb_helper_deferred_io(). This avoids confusion with the macros of
the same name.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/9c49ac792c639dbec0728b513329a32461f72253; https://git.kernel.org/stable/c/ae25885bdf59fde40726863c57fd20e4a0642183
CVE: CVE-2022-50222
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

tty: vt: initialize unicode screen buffer

syzbot reports kernel infoleak at vcs_read() [1], for buffer can be read
immediately after resize operation. Initialize buffer using kzalloc().

  ----------
  #include <fcntl.h>
  #include <unistd.h>
  #include <sys/ioctl.h>
  #include <linux/fb.h>

  int main(int argc, char *argv[])
  {
    struct fb_var_screeninfo var = { };
    const int fb_fd = open("/dev/fb0", 3);
    ioctl(fb_fd, FBIOGET_VSCREENINFO, &var);
    var.yres = 0x21;
    ioctl(fb_fd, FBIOPUT_VSCREENINFO, &var);
    return read(open("/dev/vcsu", O_RDONLY), &var, sizeof(var)) == -1;
  }
  ----------
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/446f123aa6021e5f75a20789f05ff3f7ae51a42f; https://git.kernel.org/stable/c/5c6c65681f39bf71bc72ed589dec3b8b20e75cac; https://git.kernel.org/stable/c/777a462e1ae50a01fc4a871efa8e34d596a1e17d
CVE: CVE-2022-50223
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

LoongArch: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK

When CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS is selected,
cpu_max_bits_warn() generates a runtime warning similar as below while
we show /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit)
instead of NR_CPUS to iterate CPUs.

[    3.052463] ------------[ cut here ]------------
[    3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0
[    3.070072] Modules linked in: efivarfs autofs4
[    3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052
[    3.084034] Hardware name: Loongson Loongson-3A5000-7A1000-1w-V0.1-CRB/Loongson-LS3A5000-7A1000-1w-EVB-V1.21, BIOS Loongson-UDK2018-V2.0.04082-beta7 04/27
[    3.099465] Stack :[PII_REDACTED]157b08[PII_REDACTED]f18[PII_REDACTED]000cf846c [PII_REDACTED]
[    3.109127]        [PII_REDACTED]157a50 [PII_REDACTED][PII_REDACTED]157a58[PII_REDACTED]ef7430
[    3.118774]        [PII_REDACTED]1578e8 [PII_REDACTED] [PII_REDACTED] ffffffffffffffff
[    3.128412]        [PII_REDACTED]aaaaaa 1ab25f00eec96a37[PII_REDACTED]21de80[PII_REDACTED]01c890
[    3.138056]         [PII_REDACTED] [PII_REDACTED] [PII_REDACTED][PII_REDACTED]aaaaaa
[    3.147711]         ffff8000339dc220 [PII_REDACTED][PII_REDACTED]ab4000 [PII_REDACTED]
[    3.157364]        [PII_REDACTED]01c998 [PII_REDACTED][PII_REDACTED]ef7430 [PII_REDACTED]
[    3.167012]         [PII_REDACTED][PII_REDACTED]00006c [PII_REDACTED] [PII_REDACTED]
[    3.176641]        [PII_REDACTED]d3de08 [PII_REDACTED][PII_REDACTED]2086d8 00007ffff0080286
[    3.186260]        [PII_REDACTED]0000b0 [PII_REDACTED] [PII_REDACTED][PII_REDACTED]071c1c
[    3.195868]         ...
[    3.199917] Call Trace:
[    3.203941] [<[PII_REDACTED]2086d8>] show_stack+0x38/0x14c
[    3.210666] [<[PII_REDACTED]cf846c>] dump_stack_lvl+0x60/0x88
[    3.217625] [<[PII_REDACTED]23d268>] __warn+0xd0/0x100
[    3.223958] [<[PII_REDACTED]cf3c90>] warn_slowpath_fmt+0x7c/0xcc
[    3.231150] [<[PII_REDACTED]>] show_cpuinfo+0x5e8/0x5f0
[    3.238080] [<[PII_REDACTED]4f578c>] seq_read_iter+0x354/0x4b4
[    3.245098] [<[PII_REDACTED]4c2e90>] new_sync_read+0x17c/0x1c4
[    3.252114] [<[PII_REDACTED]4c5174>] vfs_read+0x138/0x1d0
[    3.258694] [<[PII_REDACTED]4c55f8>] ksys_read+0x70/0x100
[    3.265265] [<[PII_REDACTED]cfde9c>] do_syscall+0x7c/0x94
[    3.271820] [<[PII_REDACTED]202fe4>] handle_syscall+0xc4/0x160
[    3.281824] ---[ end trace 8b484262b4b8c24c ]---
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/28e112afa44ad0814120d41c68fa72372a2cd2c2; https://git.kernel.org/stable/c/37268c7badd36f5381056d1651a6ee0b63b8ff3c
CVE: CVE-2022-50224
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

KVM: x86/mmu: Treat NX as a valid SPTE bit for NPT

Treat the NX bit as valid when using NPT, as KVM will set the NX bit when
the NX huge page mitigation is enabled (mindblowing) and trigger the WARN
that fires on reserved SPTE bits being set.

KVM has required NX support for SVM since commit b26a71a1a5b9 ("KVM: SVM:
Refuse to load kvm_amd if NX support is not available") for exactly this
reason, but apparently it never occurred to anyone to actually test NPT
with the mitigation enabled.

  ------------[ cut here ]------------
  spte = 0x800000018a600ee7, level = 2, rsvd bits = 0x800f0000001fe000
  WARNING: CPU: 152 PID: 15966 at arch/x86/kvm/mmu/spte.c:215 make_spte+0x327/0x340 [kvm]
  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 10.48.0 01/27/2022
  RIP: 0010:make_spte+0x327/0x340 [kvm]
  Call Trace:
   <TASK>
   tdp_mmu_map_handle_target_level+0xc3/0x230 [kvm]
   kvm_tdp_mmu_map+0x343/0x3b0 [kvm]
   direct_page_fault+0x1ae/0x2a0 [kvm]
   kvm_tdp_page_fault+0x7d/0x90 [kvm]
   kvm_mmu_page_fault+0xfb/0x2e0 [kvm]
   npf_interception+0x55/0x90 [kvm_amd]
   svm_invoke_exit_handler+0x31/0xf0 [kvm_amd]
   svm_handle_exit+0xf6/0x1d0 [kvm_amd]
   vcpu_enter_guest+0xb6d/0xee0 [kvm]
   ? kvm_pmu_trigger_event+0x6d/0x230 [kvm]
   vcpu_run+0x65/0x2c0 [kvm]
   kvm_arch_vcpu_ioctl_run+0x355/0x610 [kvm]
   kvm_vcpu_ioctl+0x551/0x610 [kvm]
   __se_sys_ioctl+0x77/0xc0
   __x64_sys_ioctl+0x1d/0x20
   do_syscall_64+0x44/0xa0
   entry_SYSCALL_64_after_hwframe+0x46/0xb0
   </TASK>
  ---[ end trace [PII_REDACTED] ]---
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/6271f2854b9233702e236e576b885a876dde4889; https://git.kernel.org/stable/c/6c6ab524cfae0799e55c82b2c1d61f1af0156f8d
CVE: CVE-2022-50225
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

riscv:uprobe fix SR_SPIE set/clear handling

In riscv the process of uprobe going to clear spie before exec
the origin insn,and set spie after that.But When access the page
which origin insn has been placed a page fault may happen and
irq was disabled in arch_uprobe_pre_xol function,It cause a WARN
as follows.
There is no need to clear/set spie in arch_uprobe_pre/post/abort_xol.
We can just remove it.

[   31.684157] BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1488
[   31.684677] in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 76, name: work
[   31.684929] preempt_count: 0, expected: 0
[   31.685969] CPU: 2 PID: 76 Comm: work Tainted: G
[   31.686542] Hardware name: riscv-virtio,qemu (DT)
[   31.686797] Call Trace:
[   31.687053] [<ffffffff80006442>] dump_backtrace+0x30/0x38
[   31.687699] [<ffffffff80812118>] show_stack+0x40/0x4c
[   31.688141] [<ffffffff8081817a>] dump_stack_lvl+0x44/0x5c
[   31.688396] [<ffffffff808181aa>] dump_stack+0x18/0x20
[   31.688653] [<ffffffff8003e454>] __might_resched+0x114/0x122
[   31.688948] [<ffffffff8003e4b2>] __might_sleep+0x50/0x7a
[   31.689435] [<ffffffff80822676>] down_read+0x30/0x130
[   31.689728] [<ffffffff8000b650>] do_page_fault+0x166/x446
[   31.689997] [<ffffffff80003c0c>] ret_from_exception+0x0/0xc
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/3811d[PII_REDACTED]4d27d8c9a98f73410fb3b471d; https://git.kernel.org/stable/c/3dbe5829408bc1586f75b4667ef60e5aab0209c7; https://git.kernel.org/stable/c/73fc099eaefd9a92c83b6c07dad066411fd5a192
CVE: CVE-2022-50226
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent kernel memory leak

For some sev ioctl interfaces, input may be passed that is less than or
equal to SEV_FW_BLOB_MAX_SIZE, but larger than the data that PSP
firmware returns. In this case, kmalloc will allocate memory that is the
size of the input rather than the size of the data. Since PSP firmware
doesn't fully overwrite the buffer, the sev ioctl interfaces with the
issue may return uninitialized slab memory.

Currently, all of the ioctl interfaces in the ccp driver are safe, but
to prevent future problems, change all ioctl interfaces that allocate
memory with kmalloc to use kzalloc and memset the data buffer to zero
in sev_ioctl_do_platform_status.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/13dc15a3f5fd7f884e4bfa8c011a0ae868df12ae; https://git.kernel.org/stable/c/4c5300f6f5e18b11c02a92f136e69b98fddba15e; https://git.kernel.org/stable/c/caa395aa16e7c9193fd7fa6cde462dd8229d4953
CVE: CVE-2022-50227
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

KVM: x86/xen: Initialize Xen timer only once

Add a check for existing xen timers before initializing a new one.

Currently kvm_xen_init_timer() is called on every
KVM_XEN_VCPU_ATTR_TYPE_TIMER, which is causing the following ODEBUG
crash when vcpu->arch.xen.timer is already set.

ODEBUG: init active (active state 0)
object type: hrtimer hint: xen_timer_callbac0
RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:502
Call Trace:
__debug_object_init
debug_hrtimer_init
debug_init
hrtimer_init
kvm_xen_init_timer
kvm_xen_vcpu_set_attr
kvm_arch_vcpu_ioctl
kvm_vcpu_ioctl
vfs_ioctl
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/9a9b5771e930f408c[PII_REDACTED]f76a9abaf2278; https://git.kernel.org/stable/c/af735db31285fa699384c649be72a9f32ecbb665
CVE: CVE-2022-50228
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0

Don't BUG/WARN on interrupt injection due to GIF being cleared,
since it's trivial for userspace to force the situation via
KVM_SET_VCPU_EVENTS (even if having at least a WARN there would be correct
for KVM internally generated injections).

  kernel BUG at arch/x86/kvm/svm/svm.c:3386!
  invalid opcode: 0000 [#1] SMP
  CPU: 15 PID: 926 Comm: smm_test Not tainted 5.17.0-rc3+ #264
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
  RIP: 0010:svm_inject_irq+0xab/0xb0 [kvm_amd]
  Code: <0f> 0b 0f 1f 00 0f 1f 44 00 00 80 3d ac b3 01 00 00 55 48 89 f5 53
  RSP: 0018:ffffc90000b37d88 EFLAGS: 00010246
  RAX: [PII_REDACTED] RBX: ffff88810a234ac0 RCX: [PII_REDACTED]
  RDX: [PII_REDACTED] RSI: ffffc90000b37df7 RDI: ffff88810a234ac0
  RBP: ffffc90000b37df7 R08: ffff88810a1fa410 R09: [PII_REDACTED]
  R10: [PII_REDACTED] R11: [PII_REDACTED] R12: [PII_REDACTED]
  R13: ffff[PII_REDACTED]00 R14: ffff88810a234ac0 R15: [PII_REDACTED]
  FS:  [PII_REDACTED](0000) GS:ffff88846fdc0000(0000) knlGS:[PII_REDACTED]
  CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
  CR2: 00007f74fc550008 CR3: 000000010a6fe000 CR4:[PII_REDACTED]350ea0
  Call Trace:
   <TASK>
   inject_pending_event+0x2f7/0x4c0 [kvm]
   kvm_arch_vcpu_ioctl_run+0x791/0x17a0 [kvm]
   kvm_vcpu_ioctl+0x26d/0x650 [kvm]
   __x64_sys_ioctl+0x82/0xb0
   do_syscall_64+0x3b/0xc0
   entry_SYSCALL_64_after_hwframe+0x44/0xae
   </TASK>
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2c49adeb020995236e63722ef6d0bee14372f471; https://git.kernel.org/stable/c/2eee1dba70f57148fc7f8252613bfae6bd4b04e3; https://git.kernel.org/stable/c/3d4e2d884da6312df7c9b85fbf671de49204ead6
CVE: CVE-2022-50229
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: bcd2000: Fix a UAF bug on the error path of probing

When the driver fails in snd_card_register() at probe time, it will free
the 'bcd2k->midi_out_urb' before killing it, which may cause a UAF bug.

The following log can reveal it:

[   50.727020] BUG: KASAN: use-after-free in bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000]
[   50.727623] Read of size 8 at addr ffff88810fab0e88 by task swapper/4/0
[   50.729530] Call Trace:
[   50.732899]  bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000]

Fix this by adding usb_kill_urb() before usb_free_urb().
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/05e0bb8c3c4dde3e21b9c1cf9395afb04e8b24db; https://git.kernel.org/stable/c/1d6a246cf97c380f2da76591f03019dd9c9599c3; https://git.kernel.org/stable/c/348620464a5c127399ac09b266f494f393661952
CVE: CVE-2022-50230
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

arm64: set UXN on swapper page tables

[ This issue was fixed upstream by accident in c3cee924bd85 ("arm64:
  head: cover entire kernel image in initial ID map") as part of a
  large refactoring of the arm64 boot flow. This simple fix is therefore
  preferred for -stable backporting ]

On a system that implements FEAT_EPAN, read/write access to the idmap
is denied because UXN is not set on the swapper PTEs. As a result,
idmap_kpti_install_ng_mappings panics the kernel when accessing
__idmap_kpti_flag. Fix it by setting UXN on these PTEs.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/9283e708a9b8529e7aafac9ab5c5c79a9fab8846; https://git.kernel.org/stable/c/c3cee924bd855184d15bc4aa6088dcf8e2c1394c
CVE: CVE-2022-50232
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

arm64: set UXN on swapper page tables

[ This issue was fixed upstream by accident in c3cee924bd85 ("arm64:
  head: cover entire kernel image in initial ID map") as part of a
  large refactoring of the arm64 boot flow. This simple fix is therefore
  preferred for -stable backporting ]

On a system that implements FEAT_EPAN, read/write access to the idmap
is denied because UXN is not set on the swapper PTEs. As a result,
idmap_kpti_install_ng_mappings panics the kernel when accessing
__idmap_kpti_flag. Fix it by setting UXN on these PTEs.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/775871d4be0d75e219cca937af843a4a1b60489a; https://git.kernel.org/stable/c/c3cee924bd855184d15bc4aa6088dcf8e2c1394c
CVE: CVE-2025-6220
Published: 2025-06-18
Description: The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_options' function in all versions up to, and including, 3.5.12. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/d0n601/CVE-2025-6220; https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/trunk/admin/tf-options/classes/UACF7_Settings.php#L894-920; https://plugins.trac.wordpress.org/changeset/3288584/
CVE: CVE-2025-45661
Published: 2025-06-18
Description: A cross-site scripting (XSS) vulnerability in miniTCG v1.3.1 beta allows attackers to execute abritrary web scripts or HTML via injecting a crafted payload into the id parameter at /members/edit.php.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: http://ambiguous.aniyu.net/; https://github.com/J4cky1028/vulnerability-research/tree/main/CVE-2025-45661; https://github.com/nekocari/miniTCG