xamxte/cve-to-cwe huggingface dataset:
CVE-2025-39998: In the Linux kernel, the following vulnerability has been resolved:  scsi: target: target_core_configfs: Add length check to avoid buffer overflow  A buffer overflow arises from the usage of snprintf to write into the buffer "buf" in target_lu_gp_members_show function located in /drivers/target/target_core_configfs.c. This buffer is allocated with size LU_GROUP_NAME_BUF (256 bytes).  snprintf(...) formats multiple strings into buf with the HBA name (hba->hba_group.cg_item), a slash character, a devicename (dev-> dev_group.cg_item) and a newline character, the total formatted string length may exceed the buffer size of 256 bytes.  Since snprintf() returns the total number of bytes that would have been written (the length of %s/%sn ), this value may exceed the buffer length (256 bytes) passed to memcpy(), this will ultimately cause function memcpy reporting a buffer overflow error.  An additional check of the return value of snprintf() can avoid this buffer overflow.
CVE-2025-39999: In the Linux kernel, the following vulnerability has been resolved:  blk-mq: fix blk_mq_tags double free while nr_requests grown  In the case user trigger tags grow by queue sysfs attribute nr_requests, hctx->sched_tags will be freed directly and replaced with a new allocated tags, see blk_mq_tag_update_depth().  The problem is that hctx->sched_tags is from elevator->et->tags, while et->tags is still the freed tags, hence later elevator exit will try to free the tags again, causing kernel panic.  Fix this problem by replacing et->tags with new allocated tags as well.  Noted there are still some long term problems that will require some refactor to be fixed thoroughly[1].  [1] https://lore.kernel.org/all/20250815080216.410665-1-yukuai1@huaweicloud.com/
CVE-2025-40001: In the Linux kernel, the following vulnerability has been resolved:  scsi: mvsas: Fix use-after-free bugs in mvs_work_queue  During the detaching of Marvell's SAS/SATA controller, the original code calls cancel_delayed_work() in mvs_free() to cancel the delayed work item mwq->work_q. However, if mwq->work_q is already running, the cancel_delayed_work() may fail to cancel it. This can lead to use-after-free scenarios where mvs_free() frees the mvs_info while mvs_work_queue() is still executing and attempts to access the already-freed mvs_info.  A typical race condition is illustrated below:  CPU 0 (remove)            | CPU 1 (delayed work callback) mvs_pci_remove()          |   mvs_free()              | mvs_work_queue()     cancel_delayed_work() |       kfree(mvi)          |                           |   mvi-> // UAF  Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled and any executing delayed work item completes before the mvs_info is deallocated.  This bug was found by static analysis.
CVE-2025-40002: In the Linux kernel, the following vulnerability has been resolved:  thunderbolt: Fix use-after-free in tb_dp_dprx_work  The original code relies on cancel_delayed_work() in tb_dp_dprx_stop(), which does not ensure that the delayed work item tunnel->dprx_work has fully completed if it was already running. This leads to use-after-free scenarios where tb_tunnel is deallocated by tb_tunnel_put(), while tunnel->dprx_work remains active and attempts to dereference tb_tunnel in tb_dp_dprx_work().  A typical race condition is illustrated below:  CPU 0                            | CPU 1 tb_dp_tunnel_active()            |   tb_deactivate_and_free_tunnel()| tb_dp_dprx_start()     tb_tunnel_deactivate()       |   queue_delayed_work()       tb_dp_activate()           |         tb_dp_dprx_stop()        | tb_dp_dprx_work() //delayed worker           cancel_delayed_work()  |     tb_tunnel_put(tunnel);       |                                  |   tunnel = container_of(...); //UAF                                  |   tunnel-> //UAF  Replacing cancel_delayed_work() with cancel_delayed_work_sync() is not feasible as it would introduce a deadlock: both tb_dp_dprx_work() and the cleanup path acquire tb->lock, and cancel_delayed_work_sync() would wait indefinitely for the work item that cannot proceed.  Instead, implement proper reference counting: - If cancel_delayed_work() returns true (work is pending), we release   the reference in the stop function. - If it returns false (work is executing or already completed), the   reference is released in delayed work function itself.  This ensures the tb_tunnel remains valid during work item execution while preventing memory leaks.  This bug was found by static analysis.
CVE-2025-40004: In the Linux kernel, the following vulnerability has been resolved:  net/9p: Fix buffer overflow in USB transport layer  A buffer overflow vulnerability exists in the USB 9pfs transport layer where inconsistent size validation between packet header parsing and actual data copying allows a malicious USB host to overflow heap buffers.  The issue occurs because: - usb9pfs_rx_header() validates only the declared size in packet header - usb9pfs_rx_complete() uses req->actual (actual received bytes) for memcpy  This allows an attacker to craft packets with small declared size (bypassing validation) but large actual payload (triggering overflow in memcpy).  Add validation in usb9pfs_rx_complete() to ensure req->actual does not exceed the buffer capacity before copying data.
CVE-2025-40006: In the Linux kernel, the following vulnerability has been resolved:  mm/hugetlb: fix folio is still mapped when deleted  Migration may be raced with fallocating hole.  remove_inode_single_folio will unmap the folio if the folio is still mapped.  However, it's called without folio lock.  If the folio is migrated and the mapped pte has been converted to migration entry, folio_mapped() returns false, and won't unmap it.  Due to extra refcount held by remove_inode_single_folio, migration fails, restores migration entry to normal pte, and the folio is mapped again.  As a result, we triggered BUG in filemap_unaccount_folio.  The log is as follows:  BUG: Bad page cache in process hugetlb  pfn:156c00  page: refcount:515 mapcount:0 mapping:0000000099fef6e1 index:0x0 pfn:0x156c00  head: order:9 mapcount:1 entire_mapcount:1 nr_pages_mapped:0 pincount:0  aops:hugetlbfs_aops ino:dcc dentry name(?):"my_hugepage_file"  flags: 0x17ffffc00000c1(locked|waiters|head|node=0|zone=2|lastcpupid=0x1fffff)  page_type: f4(hugetlb)  page dumped because: still mapped when deleted  CPU: 1 UID: 0 PID: 395 Comm: hugetlb Not tainted 6.17.0-rc5-00044-g7aac71907bde-dirty #484 NONE  Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015  Call Trace:   <TASK>   dump_stack_lvl+0x4f/0x70   filemap_unaccount_folio+0xc4/0x1c0   __filemap_remove_folio+0x38/0x1c0   filemap_remove_folio+0x41/0xd0   remove_inode_hugepages+0x142/0x250   hugetlbfs_fallocate+0x471/0x5a0   vfs_fallocate+0x149/0x380  Hold folio lock before checking if the folio is mapped to avold race with migration.
CVE-2025-40007: In the Linux kernel, the following vulnerability has been resolved:  netfs: fix reference leak  Commit 20d72b00ca81 ("netfs: Fix the request's work item to not require a ref") modified netfs_alloc_request() to initialize the reference counter to 2 instead of 1.  The rationale was that the requet's "work" would release the second reference after completion (via netfs_{read,write}_collection_worker()).  That works most of the time if all goes well.  However, it leaks this additional reference if the request is released before the I/O operation has been submitted: the error code path only decrements the reference counter once and the work item will never be queued because there will never be a completion.  This has caused outages of our whole server cluster today because tasks were blocked in netfs_wait_for_outstanding_io(), leading to deadlocks in Ceph (another bug that I will address soon in another patch).  This was caused by a netfs_pgpriv2_begin_copy_to_cache() call which failed in fscache_begin_write_operation().  The leaked netfs_io_request was never completed, leaving `netfs_inode.io_count` with a positive value forever.  All of this is super-fragile code.  Finding out which code paths will lead to an eventual completion and which do not is hard to see:  - Some functions like netfs_create_write_req() allocate a request, but   will never submit any I/O.  - netfs_unbuffered_read_iter_locked() calls netfs_unbuffered_read()   and then netfs_put_request(); however, netfs_unbuffered_read() can   also fail early before submitting the I/O request, therefore another   netfs_put_request() call must be added there.  A rule of thumb is that functions that return a `netfs_io_request` do not submit I/O, and all of their callers must be checked.  For my taste, the whole netfs code needs an overhaul to make reference counting easier to understand and less fragile & obscure.  But to fix this bug here and now and produce a patch that is adequate for a stable backport, I tried a minimal approach that quickly frees the request object upon early failure.  I decided against adding a second netfs_put_request() each time because that would cause code duplication which obscures the code further.  Instead, I added the function netfs_put_failed_request() which frees such a failed request synchronously under the assumption that the reference count is exactly 2 (as initially set by netfs_alloc_request() and never touched), verified by a WARN_ON_ONCE().  It then deinitializes the request object (without going through the "cleanup_work" indirection) and frees the allocation (with RCU protection to protect against concurrent access by netfs_requests_seq_start()).  All code paths that fail early have been changed to call netfs_put_failed_request() instead of netfs_put_request(). Additionally, I have added a netfs_put_request() call to netfs_unbuffered_read() as explained above because the netfs_put_failed_request() approach does not work there.
CVE-2025-40008: In the Linux kernel, the following vulnerability has been resolved:  kmsan: fix out-of-bounds access to shadow memory  Running sha224_kunit on a KMSAN-enabled kernel results in a crash in kmsan_internal_set_shadow_origin():      BUG: unable to handle page fault for address: ffffbc3840291000     #PF: supervisor read access in kernel mode     #PF: error_code(0x0000) - not-present page     PGD 1810067 P4D 1810067 PUD 192d067 PMD 3c17067 PTE 0     Oops: 0000 [#1] SMP NOPTI     CPU: 0 UID: 0 PID: 81 Comm: kunit_try_catch Tainted: G                 N  6.17.0-rc3 #10 PREEMPT(voluntary)     Tainted: [N]=TEST     Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014     RIP: 0010:kmsan_internal_set_shadow_origin+0x91/0x100     [...]     Call Trace:     <TASK>     __msan_memset+0xee/0x1a0     sha224_final+0x9e/0x350     test_hash_buffer_overruns+0x46f/0x5f0     ? kmsan_get_shadow_origin_ptr+0x46/0xa0     ? __pfx_test_hash_buffer_overruns+0x10/0x10     kunit_try_run_case+0x198/0xa00  This occurs when memset() is called on a buffer that is not 4-byte aligned and extends to the end of a guard page, i.e.  the next page is unmapped.  The bug is that the loop at the end of kmsan_internal_set_shadow_origin() accesses the wrong shadow memory bytes when the address is not 4-byte aligned.  Since each 4 bytes are associated with an origin, it rounds the address and size so that it can access all the origins that contain the buffer.  However, when it checks the corresponding shadow bytes for a particular origin, it incorrectly uses the original unrounded shadow address.  This results in reads from shadow memory beyond the end of the buffer's shadow memory, which crashes when that memory is not mapped.  To fix this, correctly align the shadow address before accessing the 4 shadow bytes corresponding to each origin.
CVE-2025-40009: In the Linux kernel, the following vulnerability has been resolved:  fs/proc/task_mmu: check p->vec_buf for NULL  When the PAGEMAP_SCAN ioctl is invoked with vec_len = 0 reaches pagemap_scan_backout_range(), kernel panics with null-ptr-deref:  [   44.936808] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [   44.937797] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [   44.938391] CPU: 1 UID: 0 PID: 2480 Comm: reproducer Not tainted 6.17.0-rc6 #22 PREEMPT(none) [   44.939062] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [   44.939935] RIP: 0010:pagemap_scan_thp_entry.isra.0+0x741/0xa80  <snip registers, unreliable trace>  [   44.946828] Call Trace: [   44.947030]  <TASK> [   44.949219]  pagemap_scan_pmd_entry+0xec/0xfa0 [   44.952593]  walk_pmd_range.isra.0+0x302/0x910 [   44.954069]  walk_pud_range.isra.0+0x419/0x790 [   44.954427]  walk_p4d_range+0x41e/0x620 [   44.954743]  walk_pgd_range+0x31e/0x630 [   44.955057]  __walk_page_range+0x160/0x670 [   44.956883]  walk_page_range_mm+0x408/0x980 [   44.958677]  walk_page_range+0x66/0x90 [   44.958984]  do_pagemap_scan+0x28d/0x9c0 [   44.961833]  do_pagemap_cmd+0x59/0x80 [   44.962484]  __x64_sys_ioctl+0x18d/0x210 [   44.962804]  do_syscall_64+0x5b/0x290 [   44.963111]  entry_SYSCALL_64_after_hwframe+0x76/0x7e  vec_len = 0 in pagemap_scan_init_bounce_buffer() means no buffers are allocated and p->vec_buf remains set to NULL.  This breaks an assumption made later in pagemap_scan_backout_range(), that page_region is always allocated for p->vec_buf_index.  Fix it by explicitly checking p->vec_buf for NULL before dereferencing.  Other sites that might run into same deref-issue are already (directly or transitively) protected by checking p->vec_buf.  Note: From PAGEMAP_SCAN man page, it seems vec_len = 0 is valid when no output is requested and it's only the side effects caller is interested in, hence it passes check in pagemap_scan_get_args().  This issue was found by syzkaller.
CVE-2025-40010: In the Linux kernel, the following vulnerability has been resolved:  afs: Fix potential null pointer dereference in afs_put_server  afs_put_server() accessed server->debug_id before the NULL check, which could lead to a null pointer dereference. Move the debug_id assignment, ensuring we never dereference a NULL server pointer.
CVE-2025-40011: In the Linux kernel, the following vulnerability has been resolved:  drm/gma500: Fix null dereference in hdmi teardown  pci_set_drvdata sets the value of pdev->driver_data to NULL, after which the driver_data obtained from the same dev is dereferenced in oaktrail_hdmi_i2c_exit, and the i2c_dev is extracted from it. To prevent this, swap these calls.  Found by Linux Verification Center (linuxtesting.org) with Svacer.
CVE-2025-40012: In the Linux kernel, the following vulnerability has been resolved:  net/smc: fix warning in smc_rx_splice() when calling get_page()  smc_lo_register_dmb() allocates DMB buffers with kzalloc(), which are later passed to get_page() in smc_rx_splice(). Since kmalloc memory is not page-backed, this triggers WARN_ON_ONCE() in get_page() and prevents holding a refcount on the buffer. This can lead to use-after-free if the memory is released before splice_to_pipe() completes.  Use folio_alloc() instead, ensuring DMBs are page-backed and safe for get_page().  WARNING: CPU: 18 PID: 12152 at ./include/linux/mm.h:1330 smc_rx_splice+0xaf8/0xe20 [smc] CPU: 18 UID: 0 PID: 12152 Comm: smcapp Kdump: loaded Not tainted 6.17.0-rc3-11705-g9cf4672ecfee #10 NONE Hardware name: IBM 3931 A01 704 (z/VM 7.4.0) Krnl PSW : 0704e00180000000 000793161032696c (smc_rx_splice+0xafc/0xe20 [smc])            R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3 Krnl GPRS: 0000000000000000 001cee80007d3001 00077400000000f8 0000000000000005            0000000000000001 001cee80007d3006 0007740000001000 001c000000000000            000000009b0c99e0 0000000000001000 001c0000000000f8 001c000000000000            000003ffcc6f7c88 0007740003e98000 0007931600000005 000792969b2ff7b8 Krnl Code: 0007931610326960: af000000  mc 0,0            0007931610326964: a7f4ff43  brc 15,00079316103267ea           #0007931610326968: af000000  mc 0,0           >000793161032696c: a7f4ff3f  brc 15,00079316103267ea            0007931610326970: e320f1000004 lg %r2,256(%r15)            0007931610326976: c0e53fd1b5f5 brasl %r14,000793168fd5d560            000793161032697c: a7f4fbb5  brc 15,00079316103260e6            0007931610326980: b904002b  lgr %r2,%r11 Call Trace:  smc_rx_splice+0xafc/0xe20 [smc]  smc_rx_splice+0x756/0xe20 [smc])  smc_rx_recvmsg+0xa74/0xe00 [smc]  smc_splice_read+0x1ce/0x3b0 [smc]  sock_splice_read+0xa2/0xf0  do_splice_read+0x198/0x240  splice_file_to_pipe+0x7e/0x110  do_splice+0x59e/0xde0  __do_splice+0x11a/0x2d0  __s390x_sys_splice+0x140/0x1f0  __do_syscall+0x122/0x280  system_call+0x6e/0x90 Last Breaking-Event-Address: smc_rx_splice+0x960/0xe20 [smc] ---[ end trace 0000000000000000 ]---
CVE-2025-40013: In the Linux kernel, the following vulnerability has been resolved:  ASoC: qcom: audioreach: fix potential null pointer dereference  It is possible that the topology parsing function audioreach_widget_load_module_common() could return NULL or an error pointer. Add missing NULL check so that we do not dereference it.
CVE-2025-40015: In the Linux kernel, the following vulnerability has been resolved:  media: stm32-csi: Fix dereference before NULL check  In 'stm32_csi_start', 'csidev->s_subdev' is dereferenced directly while assigning a value to the 'src_pad'. However the same value is being checked against NULL at a later point of time indicating that there are chances that the value can be NULL.  Move the dereference after the NULL check.
CVE-2025-40017: In the Linux kernel, the following vulnerability has been resolved:  media: iris: Fix memory leak by freeing untracked persist buffer  One internal buffer which is allocated only once per session was not being freed during session close because it was not being tracked as part of internal buffer list which resulted in a memory leak.  Add the necessary logic to explicitly free the untracked internal buffer during session close to ensure all allocated memory is released properly.
CVE-2025-10916: The FormGent  WordPress plugin before 1.0.4 is vulnerable to arbitrary file deletion due to insufficient file path validation. This makes it possible for unauthenticated attackers to delete arbitrary files on the server.
CVE-2025-10638: The NS Maintenance Mode for WP WordPress plugin through 1.3.1 lacks authorization in its subscriber export function allowing unauthenticated attackers to download a list of a site's subscribers containing their name and email address
CVE-2025-5983: The Meta Tag Manager WordPress plugin before 3.3 does not restrict which roles can create http-equiv refresh meta tags.
CVE-2022-50556: In the Linux kernel, the following vulnerability has been resolved:  drm: Fix potential null-ptr-deref due to drmm_mode_config_init()  drmm_mode_config_init() will call drm_mode_create_standard_properties() and won't check the ret value. When drm_mode_create_standard_properties() failed due to alloc, property will be a NULL pointer and may causes the null-ptr-deref. Fix the null-ptr-deref by adding the ret value check.  Found null-ptr-deref while testing insert module bochs: general protection fault, probably for non-canonical address     0xdffffc000000000c: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] CPU: 3 PID: 249 Comm: modprobe Not tainted 6.1.0-rc1+ #364 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:drm_object_attach_property+0x73/0x3c0 [drm] Call Trace:  <TASK>  __drm_connector_init+0xb6c/0x1100 [drm]  bochs_pci_probe.cold.11+0x4cb/0x7fe [bochs]  pci_device_probe+0x17d/0x340  really_probe+0x1db/0x5d0  __driver_probe_device+0x1e7/0x250  driver_probe_device+0x4a/0x120  __driver_attach+0xcd/0x2c0  bus_for_each_dev+0x11a/0x1b0  bus_add_driver+0x3d7/0x500  driver_register+0x18e/0x320  do_one_initcall+0xc4/0x3e0  do_init_module+0x1b4/0x630  load_module+0x5dca/0x7230  __do_sys_finit_module+0x100/0x170  do_syscall_64+0x3f/0x90  entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7ff65af9f839
CVE-2022-50557: In the Linux kernel, the following vulnerability has been resolved:  pinctrl: thunderbay: fix possible memory leak in thunderbay_build_functions()  The thunderbay_add_functions() will free memory of thunderbay_funcs when everything is ok, but thunderbay_funcs will not be freed when thunderbay_add_functions() fails, then there will be a memory leak, so we need to add kfree() when thunderbay_add_functions() fails to fix it.  In addition, doing some cleaner works, moving kfree(funcs) from thunderbay_add_functions() to thunderbay_build_functions().
CVE-2022-50558: In the Linux kernel, the following vulnerability has been resolved:  regmap-irq: Use the new num_config_regs property in regmap_add_irq_chip_fwnode  Commit faa87ce9196d ("regmap-irq: Introduce config registers for irq types") added the num_config_regs, then commit 9edd4f5aee84 ("regmap-irq: Deprecate type registers and virtual registers") suggested to replace num_type_reg with it. However, regmap_add_irq_chip_fwnode wasn't modified to use the new property. Later on, commit 255a03bb1bb3 ("ASoC: wcd9335: Convert irq chip to config regs") removed the old num_type_reg property from the WCD9335 driver's struct regmap_irq_chip, causing a null pointer dereference in regmap_irq_set_type when it tried to index d->type_buf as it was never allocated in regmap_add_irq_chip_fwnode:  [   39.199374] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000  [   39.200006] Call trace: [   39.200014]  regmap_irq_set_type+0x84/0x1c0 [   39.200026]  __irq_set_trigger+0x60/0x1c0 [   39.200040]  __setup_irq+0x2f4/0x78c [   39.200051]  request_threaded_irq+0xe8/0x1a0  Use num_config_regs in regmap_add_irq_chip_fwnode instead of num_type_reg, and fall back to it if num_config_regs isn't defined to maintain backward compatibility.
CVE-2022-50559: In the Linux kernel, the following vulnerability has been resolved:  clk: imx: scu: fix memleak on platform_device_add() fails  No error handling is performed when platform_device_add() fails. Add error processing before return, and modified the return value.
CVE-2022-50561: In the Linux kernel, the following vulnerability has been resolved:  iio: fix memory leak in iio_device_register_eventset()  When iio_device_register_sysfs_group() returns failed, iio_device_register_eventset() needs to free attrs array.  Otherwise, kmemleak would scan & report memory leak as below:  unreferenced object 0xffff88810a1cc3c0 (size 32):   comm "100-i2c-vcnl302", pid 728, jiffies 4295052307 (age 156.027s)   backtrace:     __kmalloc+0x46/0x1b0     iio_device_register_eventset at drivers/iio/industrialio-event.c:541     __iio_device_register at drivers/iio/industrialio-core.c:1959     __devm_iio_device_register at drivers/iio/industrialio-core.c:2040
CVE-2022-50562: In the Linux kernel, the following vulnerability has been resolved:  tpm: acpi: Call acpi_put_table() to fix memory leak  The start and length of the event log area are obtained from TPM2 or TCPA table, so we call acpi_get_table() to get the ACPI information, but the acpi_get_table() should be coupled with acpi_put_table() to release the ACPI memory, add the acpi_put_table() properly to fix the memory leak.  While we are at it, remove the redundant empty line at the end of the tpm_read_log_acpi().