huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2025-14813: bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly
Component: bouncycastle
Severity: Important
CWE: CWE-327 (Use of a Broken or Risky Cryptographic Algorithm)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2026-04-15T08:56:34.057000+00:00

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The `GOSTCTR` implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the `G3413CTRBlockCipher`, potentially leading to the recovery and access of encrypted data.

Statement: To exploit this flaw, an attacker needs to capture ciphertext encrypted by the `GOSTCTR` implementation where the `G3413CTRBlockCipher` processed more than 255 blocks of data, resulting in keystream reuse. An attack typically requires capturing these overlapping ciphertexts to perform cryptanalysis and uncover the underlying data.
The primary impact of this vulnerability is the potential loss of confidentiality for data encrypted by the `GOSTCTR` implementation. This can compromise encrypted communications or sensitive stored data by allowing an attacker to fully recover the plaintext.

Affected upstream versions: 1.59 < 1.80.2, 1.81 < 1.81.1, 1.82 < 1.84
Fixed upstream versions: r1rv84
Upstream repository: https://github.com/bcgit/bc-java
Upstream fix commit: b42574345414e4b7c8051b16fa1fafe01c29871f
CVE-2025-15059: gimp: heap-based buffer overflow via specially crafted PSP file
Component: gimp
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-01-23T02:49:52.381000+00:00

A flaw was found in GIMP. Opening a specially crafted PSP file with GIMP can cause a heap-based buffer overflow due to improper input validation of the length of user-supplied data. An attacker can exploit this vulnerability by convincing a user to open a specially crafted PSP file, resulting in a denial of service or potentially code execution in the context of the current process.

Statement: To exploit this issue, an attacker needs to convince a user to process a specially crafted PSP file with GIMP, reducing the likelihood of exploitation. Due to this reason, this flaw has been rated with an important severity.

Affected upstream versions: 3.0.6
Fixed upstream versions: GIMP_3_2_0
Upstream repository: https://gitlab.gnome.org/GNOME/gimp
Upstream fix commit: 03575ac8cbb0ef3103b0a15d6598475088dcc15e
CVE-2025-15282: cpython: Header injection via newlines in data URL mediatype in Python
Component: cpython
Severity: Moderate
CWE: CWE-93 (Improper Neutralization of CRLF Sequences ('CRLF Injection'))
CVSS v3: 4.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N)
Public date: 2026-01-20T21:35:13.865000+00:00

Missing newline filtering has been discovered in Python. User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.


Affected upstream versions: 3.11.0 < 3.11.15, 3.12.0 < 3.12.13, 3.13.0 < 3.13.12, 3.14.0 < 3.14.3, 3.15.0a1 < 3.15.0a6
Fixed upstream versions: v3.15.0b1
Upstream repository: https://github.com/python/cpython
Upstream fix commit: f25509e78e8be6ea73c811ac2b8c928c28841b9f
CVE-2025-15284: qs: qs: Denial of Service via improper input validation in array parsing
Component: qs
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-29T22:56:45.240000+00:00

A flaw was found in qs, a module used for parsing query strings. A remote attacker can exploit an improper input validation vulnerability by sending specially crafted HTTP requests that use bracket notation (e.g., `a[]=value`). This bypasses the `arrayLimit` option, which is designed to limit the size of parsed arrays and prevent resource exhaustion. Successful exploitation can lead to memory exhaustion, causing a Denial of Service (DoS) where the application crashes or becomes unresponsive, making the service unavailable to users.

Statement: This vulnerability is rated Important for Red Hat products that utilize the `qs` module for parsing query strings, particularly when processing user-controlled input with bracket notation. The `arrayLimit` option, intended to prevent resource exhaustion, is bypassed when bracket notation (`a[]=value`) is used, allowing a remote attacker to cause a denial of service through memory exhaustion. This can lead to application crashes or unresponsiveness, making the service unavailable.

Affected upstream versions: < 6.14.1
Fixed upstream versions: v6.14.1
Upstream repository: https://github.com/ljharb/qs
Upstream fix commit: 3086902ecf7f088d0d1803887643ac6c03d415b9
CVE-2025-15366: cpython: IMAP command injection in user-controlled commands
Component: cpython
Severity: Moderate
CWE: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
CVSS v3: 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N)
Public date: 2026-01-20T21:40:24.938000+00:00

A flaw was found in the imaplib module in the Python standard library. The imaplib module does not reject control characters, such as newlines, in user-controlled input passed to IMAP commands. This issue allows an attacker to inject additional commands to be executed in the IMAP server.

Statement: To exploit this issue, an attacker needs to have the privileges required to send malicious input to an application that sends IMAP commands to a server. Additionally, this flaw can allow attackers to manipulate the state of the mailbox (e.g., delete emails, move folders, flag messages) and to potentially read metadata or specific email content, but it does not allow arbitrary code execution or OS command injection. Due to these reasons, this issue has been rated with a moderate severity.

Affected upstream versions: <= v3.15.0a5
Fixed upstream versions: v3.15.0b1
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 6262704b134db2a4ba12e85ecfbd968534f28b45
CVE-2025-15367: cpython: POP3 command injection in user-controlled commands
Component: cpython
Severity: Moderate
CWE: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
CVSS v3: 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N)
Public date: 2026-01-20T21:47:09.885000+00:00

A flaw was found in the poplib module in the Python standard library. The poplib module does not reject control characters, such as newlines, in user-controlled input passed to POP3 commands. This issue allows an attacker to inject additional commands to be executed in the POP3 server.

Statement: To exploit this issue, an attacker needs to have the privileges required to send malicious input to an application that sends POP3 commands to a server. Additionally, this flaw can allow attackers to manipulate the state of the mailbox (e.g., delete emails) and to potentially read metadata or specific email content, but it does not allow arbitrary code execution or OS command injection. Due to these reasons, this issue has been rated with a moderate severity.

Affected upstream versions: <= v3.15.0a5
Fixed upstream versions: v3.15.0b1
Upstream repository: https://github.com/python/cpython
Upstream fix commit: b234a2b67539f787e191d2ef19a7cbdce32874e7
CVE-2025-15467: openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing
Component: openssl
Severity: Important
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-01-27T14:00:00+00:00

A flaw was found in OpenSSL. A remote attacker can exploit a stack buffer overflow vulnerability by supplying a crafted Cryptographic Message Syntax (CMS) message with an oversized Initialization Vector (IV) when parsing AuthEnvelopedData structures that use Authenticated Encryption with Associated Data (AEAD) ciphers such as AES-GCM. This can lead to a crash, causing a Denial of Service (DoS), or potentially allow for remote code execution.

Statement: This vulnerability is rated Important for Red Hat products. On Red Hat Enterprise Linux, OpenSSL is built with stack protections enabled which mitigate the risk of code execution though a denial-of-service condition remains possible. This vulnerability only affects applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers, such as Kerberos using the PKINIT plugin. OpenSSL versions 1.1.1 and 1.0.2 are not affected by this issue.

Affected upstream versions: 3.6.0 < 3.6.1, 3.5.0 < 3.5.5, 3.4.0 < 3.4.4, 3.3.0 < 3.3.6, 3.0.0 < 3.0.19
Fixed upstream versions: 3.0.19, 3.3.6, 3.4.4, 3.5.5, 3.6.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 2c8f0e5fa9b6ee5508a0349e4572ddb74db5a703
CVE-2025-15468: openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling
Component: openssl
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-01-27T00:00:00+00:00

A flaw was found in openssl. A remote attacker could trigger a NULL pointer dereference by sending an unknown or unsupported cipher ID during the client hello callback in applications using the QUIC (Quick UDP Internet Connections) protocol. This vulnerability, occurring when the SSL_CIPHER_find() function is called in this specific context, leads to an abnormal termination of the running process, causing a Denial of Service (DoS).

Statement: This vulnerability is rated Low for Red Hat. The NULL pointer dereference in the `SSL_CIPHER_find()` function, affecting OpenSSL versions 3.3, 3.4, 3.5, and 3.6, occurs only when applications utilizing the QUIC protocol uncommonly invoke this function from the `client_hello_cb` callback with an unknown cipher ID. This specific usage pattern and the resulting Denial of Service limit the overall impact in the Red Hat context.

Affected upstream versions: 3.6.0 < 3.6.1, 3.5.0 < 3.5.5, 3.4.0 < 3.4.4, 3.3.0 < 3.3.6
Fixed upstream versions: 3.3.6, 3.4.4, 3.5.5, 3.6.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: b2539639400288a4580fe2d76247541b976bade4
CVE-2025-15469: openssl: OpenSSL: Data integrity bypass in `openssl dgst` command due to silent truncation
Component: openssl
Severity: Low
CWE: CWE-1284 (Improper Validation of Specified Quantity in Input)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Public date: 2026-01-27T00:00:00+00:00

A flaw was found in openssl. When a user signs or verifies files larger than 16MB using the `openssl dgst` command with one-shot algorithms, the tool silently truncates the input to 16MB. This creates an integrity gap, allowing trailing data beyond the initial 16MB to be modified without detection because it remains unauthenticated. This vulnerability primarily impacts workflows that both sign and verify files using the affected `openssl dgst` command.

Statement: This vulnerability is rated Low for Red Hat. The flaw affects the `openssl dgst` command-line tool when used with one-shot algorithms (such as Ed25519, Ed448, or ML-DSA) on files larger than 16MB. Impact is limited as it requires both signing and verification to be performed using the affected command, and verifiers using library APIs are not impacted.

Affected upstream versions: 3.6.0 < 3.6.1, 3.5.0 < 3.5.5
Fixed upstream versions: 3.5.5, 3.6.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 310f305eb92ea8040d6b3cb75a5feeba8e6acf2f
CVE-2025-15661: libssh2: libssh2: Information disclosure and denial of service via crafted SFTP response
Component: libssh2
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H)
Public date: 2026-06-18T20:18:29.475000+00:00

A flaw in libssh2's sftp_symlink() function allows a malicious SSH server or man-in-the-middle attacker to trigger an out-of-bounds heap read via a crafted SSH_FXP_NAME response. This can disclose heap memory contents or crash the application, causing a denial of service (DoS).

Statement: This Moderate-impact out-of-bounds heap read flaw in libssh2 allows a malicious SSH server or man-in-the-middle attacker to crash the application (DoS) or disclose heap memory by sending a crafted SFTP response.

Affected upstream versions: <= libssh2-1.11.1
Upstream repository: https://github.com/libssh2/libssh2
Upstream fix commit: 2dae3024897e1898d389835151f4e9606227721d
CVE-2025-2099: transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers
Component: transformers
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-05-19T11:22:36.908000+00:00

A flaw was found in the preprocess_string() function of the transformers.testing_utils module in HuggingFace Transformers. This vulnerability allows a Regular Expression Denial of Service (ReDoS) via a specially crafted input string containing many newline characters that trigger excessive backtracking.


Affected upstream versions: unspecified < 4.50.0
Fixed upstream versions: 4.50.0
Upstream repository: https://github.com/huggingface/transformers
Upstream fix commit: 8cb522b4190bd556ce51be04942720650b1a3e57
CVE-2025-21646: kernel: afs: Fix the maximum cell name length
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-01-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

afs: Fix the maximum cell name length

The kafs filesystem limits the maximum length of a cell to 256 bytes, but a
problem occurs if someone actually does that: kafs tries to create a
directory under /proc/net/afs/ with the name of the cell, but that fails
with a warning:

        WARNING: CPU: 0 PID: 9 at fs/proc/generic.c:405

because procfs limits the maximum filename length to 255.

However, the DNS limits the maximum lookup length and, by extension, the
maximum cell name, to 255 less two (length count and trailing NUL).

Fix this by limiting the maximum acceptable cellname length to 253.  This
also allows us to be sure we can create the "/afs/.<cell>/" mountpoint too.

Further, split the YFS VL record cell name maximum to be the 256 allowed by
the protocol and ignore the record retrieved by YFSVL.GetCellName if it
exceeds 253.


Affected upstream versions: 5.8
Fixed upstream versions: 0, 5.10.234, 5.15.177, 6.1.125, 6.12.10, 6.13, 6.6.72
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9340385468d056bb700b8f28df236b81fc86a079
CVE-2025-21647: kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-01-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

sched: sch_cake: add bounds checks to host bulk flow fairness counts

Even though we fixed a logic error in the commit cited below, syzbot
still managed to trigger an underflow of the per-host bulk flow
counters, leading to an out of bounds memory access.

To avoid any such logic errors causing out of bounds memory accesses,
this commit factors out all accesses to the per-host bulk flow counters
to a series of helpers that perform bounds-checking before any
increments and decrements. This also has the benefit of improving
readability by moving the conditional checks for the flow mode into
these helpers, instead of having them spread out throughout the
code (which was the cause of the original logic error).

As part of this change, the flow quantum calculation is consolidated
into a helper function, which means that the dithering applied to the
ost load scaling is now applied both in the DRR rotation and when a
sparse flow's quantum is first initiated. The only user-visible effect
of this is that the maximum packet size that can be sent while a flow
stays sparse will now vary with +/- one byte in some cases. This should
not make a noticeable difference in practice, and thus it's not worth
complicating the code to preserve the old behaviour.


Affected upstream versions: 5.4.284 < 5.4.291, 5.10.226 < 5.10.235, 5.15.167 < 5.15.179, 6.1.110 < 6.1.125, 6.6.51 < 6.6.72, 6.10.10 < 6.11, 6.11
Fixed upstream versions: 0, 5.10.235, 5.15.179, 5.4.291, 6.1.125, 6.11, 6.12.10, 6.13, 6.6.72
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 44fe1efb4961c1a5ccab16bb579dfc6b308ad58b
CVE-2025-21648: kernel: netfilter: conntrack: clamp maximum hashtable size to INT_MAX
Component: kernel
Severity: Moderate
CWE: CWE-789 (Memory Allocation with Excessive Size Value)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-01-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: conntrack: clamp maximum hashtable size to INT_MAX

Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it
is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when
resizing hashtable because __GFP_NOWARN is unset. See:

  0708a0afe291 ("mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls")

Note: hashtable resize is only possible from init_netns.


Affected upstream versions: 4.7
Fixed upstream versions: 0, 5.10.234, 5.15.177, 6.1.125, 6.12.10, 6.13, 6.6.72
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a965f7f0ea3ae61b9165bed619d5d6da02c75f80
CVE-2025-21655: kernel: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
Public date: 2025-01-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period

io_eventfd_do_signal() is invoked from an RCU callback, but when
dropping the reference to the io_ev_fd, it calls io_eventfd_free()
directly if the refcount drops to zero. This isn't correct, as any
potential freeing of the io_ev_fd should be deferred another RCU grace
period.

Just call io_eventfd_put() rather than open-code the dec-and-test and
free, which will correctly defer it another RCU grace period.


Affected upstream versions: 6.1
Fixed upstream versions: 0, 6.1.125, 6.12.10, 6.13, 6.6.72
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6b63308c28987c6010b1180c72a6db4df6c68033
CVE-2025-21666: kernel: vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-01-31T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]

Recent reports have shown how we sometimes call vsock_*_has_data()
when a vsock socket has been de-assigned from a transport (see attached
links), but we shouldn't.

Previous commits should have solved the real problems, but we may have
more in the future, so to avoid null-ptr-deref, we can return 0
(no space, no data available) but with a warning.

This way the code should continue to run in a nearly consistent state
and have a warning that allows us to debug future problems.


Affected upstream versions: 5.5
Fixed upstream versions: 0, 5.10.234, 5.15.177, 6.1.127, 6.12.11, 6.13, 6.6.74
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: daeac89cdb03d30028186f5ff7dc26ec8fa843e7
CVE-2025-21668: kernel: pmdomain: imx8mp-blk-ctrl: add missing loop break condition
Component: kernel
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-01-31T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

pmdomain: imx8mp-blk-ctrl: add missing loop break condition

Currently imx8mp_blk_ctrl_remove() will continue the for loop
until an out-of-bounds exception occurs.

pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : dev_pm_domain_detach+0x8/0x48
lr : imx8mp_blk_ctrl_shutdown+0x58/0x90
sp : ffffffc084f8bbf0
x29: ffffffc084f8bbf0 x28: ffffff80daf32ac0 x27: 0000000000000000
x26: ffffffc081658d78 x25: 0000000000000001 x24: ffffffc08201b028
x23: ffffff80d0db9490 x22: ffffffc082340a78 x21: 00000000000005b0
x20: ffffff80d19bc180 x19: 000000000000000a x18: ffffffffffffffff
x17: ffffffc080a39e08 x16: ffffffc080a39c98 x15: 4f435f464f006c72
x14: 0000000000000004 x13: ffffff80d0172110 x12: 0000000000000000
x11: ffffff80d0537740 x10: ffffff80d05376c0 x9 : ffffffc0808ed2d8
x8 : ffffffc084f8bab0 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffffff80d19b9420 x4 : fffffffe03466e60 x3 : 0000000080800077
x2 : 0000000000000000 x1 : 0000000000000001 x0 : 0000000000000000
Call trace:
 dev_pm_domain_detach+0x8/0x48
 platform_shutdown+0x2c/0x48
 device_shutdown+0x158/0x268
 kernel_restart_prepare+0x40/0x58
 kernel_kexec+0x58/0xe8
 __do_sys_reboot+0x198/0x258
 __arm64_sys_reboot+0x2c/0x40
 invoke_syscall+0x5c/0x138
 el0_svc_common.constprop.0+0x48/0xf0
 do_el0_svc+0x24/0x38
 el0_svc+0x38/0xc8
 el0t_64_sync_handler+0x120/0x130
 el0t_64_sync+0x190/0x198
Code: 8128c2d0 ffffffc0 aa1e03e9 d503201f


Affected upstream versions: 5.19
Fixed upstream versions: 0, 6.1.127, 6.12.11, 6.13, 6.6.74
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 699cc10cc3068f9097a506eae7fe178c860dca4e
CVE-2025-21669: kernel: vsock/virtio: discard packets if the transport changes
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-01-31T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: discard packets if the transport changes

If the socket has been de-assigned or assigned to another transport,
we must discard any packets received because they are not expected
and would cause issues when we access vsk->transport.

A possible scenario is described by Hyunwoo Kim in the attached link,
where after a first connect() interrupted by a signal, and a second
connect() failed, we can find `vsk->transport` at NULL, leading to a
NULL pointer dereference.


Affected upstream versions: 5.5
Fixed upstream versions: 0, 5.10.234, 5.15.177, 6.1.127, 6.12.11, 6.13, 6.6.74
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 18a7fc371d1dbf8deff16c2dd9292bcc73f43040
CVE-2025-21671: kernel: zram: fix potential UAF of zram table
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-01-31T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

zram: fix potential UAF of zram table

If zram_meta_alloc failed early, it frees allocated zram->table without
setting it NULL.  Which will potentially cause zram_meta_free to access
the table if user reset an failed and uninitialized device.


Affected upstream versions: 6.1.122 < 6.1.127, 6.6.68 < 6.6.74, 6.12.7 < 6.12.11
Fixed upstream versions: 6.1.127, 6.12.11, 6.6.74
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fe3de867f94819ba0f28e035c0b0182150147d95