xamxte/cve-to-cwe huggingface dataset:
CVE-2025-38439: In the Linux kernel, the following vulnerability has been resolved:  bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT  When transmitting an XDP_REDIRECT packet, call dma_unmap_len_set() with the proper length instead of 0.  This bug triggers this warning on a system with IOMMU enabled:  WARNING: CPU: 36 PID: 0 at drivers/iommu/dma-iommu.c:842 __iommu_dma_unmap+0x159/0x170 RIP: 0010:__iommu_dma_unmap+0x159/0x170 Code: a8 00 00 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 c8 00 00 00 00 48 c7 45 a0 ff ff ff ff 4c 89 45 b8 4c 89 45 c0 e9 77 ff ff ff <0f> 0b e9 60 ff ff ff e8 8b bf 6a 00 66 66 2e 0f 1f 84 00 00 00 00 RSP: 0018:ff22d31181150c88 EFLAGS: 00010206 RAX: 0000000000002000 RBX: 00000000e13a0000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ff22d31181150cf0 R08: ff22d31181150ca8 R09: 0000000000000000 R10: 0000000000000000 R11: ff22d311d36c9d80 R12: 0000000000001000 R13: ff13544d10645010 R14: ff22d31181150c90 R15: ff13544d0b2bac00 FS: 0000000000000000(0000) GS:ff13550908a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005be909dacff8 CR3: 0008000173408003 CR4: 0000000000f71ef0 PKRU: 55555554 Call Trace: <IRQ> ? show_regs+0x6d/0x80 ? __warn+0x89/0x160 ? __iommu_dma_unmap+0x159/0x170 ? report_bug+0x17e/0x1b0 ? handle_bug+0x46/0x90 ? exc_invalid_op+0x18/0x80 ? asm_exc_invalid_op+0x1b/0x20 ? __iommu_dma_unmap+0x159/0x170 ? __iommu_dma_unmap+0xb3/0x170 iommu_dma_unmap_page+0x4f/0x100 dma_unmap_page_attrs+0x52/0x220 ? srso_alias_return_thunk+0x5/0xfbef5 ? xdp_return_frame+0x2e/0xd0 bnxt_tx_int_xdp+0xdf/0x440 [bnxt_en] __bnxt_poll_work_done+0x81/0x1e0 [bnxt_en] bnxt_poll+0xd3/0x1e0 [bnxt_en]
CVE-2025-38451: In the Linux kernel, the following vulnerability has been resolved:  md/md-bitmap: fix GPF in bitmap_get_stats()  The commit message of commit 6ec1f0239485 ("md/md-bitmap: fix stats collection for external bitmaps") states:      Remove the external bitmap check as the statistics should be     available regardless of bitmap storage location.      Return -EINVAL only for invalid bitmap with no storage (neither in     superblock nor in external file).  But, the code does not adhere to the above, as it does only check for a valid super-block for "internal" bitmaps. Hence, we observe:  Oops: GPF, probably for non-canonical address 0x1cd66f1f40000028 RIP: 0010:bitmap_get_stats+0x45/0xd0 Call Trace:   seq_read_iter+0x2b9/0x46a  seq_read+0x12f/0x180  proc_reg_read+0x57/0xb0  vfs_read+0xf6/0x380  ksys_read+0x6d/0xf0  do_syscall_64+0x8c/0x1b0  entry_SYSCALL_64_after_hwframe+0x76/0x7e  We fix this by checking the existence of a super-block for both the internal and external case.
CVE-2025-38453: In the Linux kernel, the following vulnerability has been resolved:  io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU  syzbot reports that defer/local task_work adding via msg_ring can hit a request that has been freed:  CPU: 1 UID: 0 PID: 19356 Comm: iou-wrk-19354 Not tainted 6.16.0-rc4-syzkaller-00108-g17bbde2e1716 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace:  <TASK>  dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120  print_address_description mm/kasan/report.c:408 [inline]  print_report+0xd2/0x2b0 mm/kasan/report.c:521  kasan_report+0x118/0x150 mm/kasan/report.c:634  io_req_local_work_add io_uring/io_uring.c:1184 [inline]  __io_req_task_work_add+0x589/0x950 io_uring/io_uring.c:1252  io_msg_remote_post io_uring/msg_ring.c:103 [inline]  io_msg_data_remote io_uring/msg_ring.c:133 [inline]  __io_msg_ring_data+0x820/0xaa0 io_uring/msg_ring.c:151  io_msg_ring_data io_uring/msg_ring.c:173 [inline]  io_msg_ring+0x134/0xa00 io_uring/msg_ring.c:314  __io_issue_sqe+0x17e/0x4b0 io_uring/io_uring.c:1739  io_issue_sqe+0x165/0xfd0 io_uring/io_uring.c:1762  io_wq_submit_work+0x6e9/0xb90 io_uring/io_uring.c:1874  io_worker_handle_work+0x7cd/0x1180 io_uring/io-wq.c:642  io_wq_worker+0x42f/0xeb0 io_uring/io-wq.c:696  ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245  </TASK>  which is supposed to be safe with how requests are allocated. But msg ring requests alloc and free on their own, and hence must defer freeing to a sane time.  Add an rcu_head and use kfree_rcu() in both spots where requests are freed. Only the one in io_msg_tw_complete() is strictly required as it has been visible on the other ring, but use it consistently in the other spot as well.  This should not cause any other issues outside of KASAN rightfully complaining about it.
CVE-2025-38457: In the Linux kernel, the following vulnerability has been resolved:  net/sched: Abort __tc_modify_qdisc if parent class does not exist  Lion's patch [1] revealed an ancient bug in the qdisc API. Whenever a user creates/modifies a qdisc specifying as a parent another qdisc, the qdisc API will, during grafting, detect that the user is not trying to attach to a class and reject. However grafting is performed after qdisc_create (and thus the qdiscs' init callback) is executed. In qdiscs that eventually call qdisc_tree_reduce_backlog during init or change (such as fq, hhf, choke, etc), an issue arises. For example, executing the following commands:  sudo tc qdisc add dev lo root handle a: htb default 2 sudo tc qdisc add dev lo parent a: handle beef fq  Qdiscs such as fq, hhf, choke, etc unconditionally invoke qdisc_tree_reduce_backlog() in their control path init() or change() which then causes a failure to find the child class; however, that does not stop the unconditional invocation of the assumed child qdisc's qlen_notify with a null class. All these qdiscs make the assumption that class is non-null.  The solution is ensure that qdisc_leaf() which looks up the parent class, and is invoked prior to qdisc_create(), should return failure on not finding the class. In this patch, we leverage qdisc_leaf to return ERR_PTRs whenever the parentid doesn't correspond to a class, so that we can detect it earlier on and abort before qdisc_create is called.  [1] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/
CVE-2025-6241: LsiAgent.exe, a component of SysTrack from Lakeside Software, attempts to load several DLL files which are not present in the default installation. If a user-writable directory is present in the SYSTEM PATH environment variable, the user can write a malicious DLL to that directory with arbitrary code. This malicious DLL is executed in the context of NT AUTHORITY\SYSTEM upon service start or restart, due to the Windows default dynamic-link library search order, resulting in local elevation of privileges.
CVE-2025-38469: In the Linux kernel, the following vulnerability has been resolved:  KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls  kvm_xen_schedop_poll does a kmalloc_array() when a VM polls the host for more than one event channel potr (nr_ports > 1).  After the kmalloc_array(), the error paths need to go through the "out" label, but the call to kvm_read_guest_virt() does not.  [Adjusted commit message. - Paolo]
CVE-2025-38481: In the Linux kernel, the following vulnerability has been resolved:  comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large  The handling of the `COMEDI_INSNLIST` ioctl allocates a kernel buffer to hold the array of `struct comedi_insn`, getting the length from the `n_insns` member of the `struct comedi_insnlist` supplied by the user. The allocation will fail with a WARNING and a stack dump if it is too large.  Avoid that by failing with an `-EINVAL` error if the supplied `n_insns` value is unreasonable.  Define the limit on the `n_insns` value in the `MAX_INSNS` macro.  Set this to the same value as `MAX_SAMPLES` (65536), which is the maximum allowed sum of the values of the member `n` in the array of `struct comedi_insn`, and sensible comedi instructions will have an `n` of at least 1.
CVE-2025-38486: In the Linux kernel, the following vulnerability has been resolved:  soundwire: Revert "soundwire: qcom: Add set_channel_map api support"  This reverts commit 7796c97df6b1b2206681a07f3c80f6023a6593d5.  This patch broke Dragonboard 845c (sdm845). I see:      Unexpected kernel BRK exception at EL1     Internal error: BRK handler: 00000000f20003e8 [#1]  SMP     pc : qcom_swrm_set_channel_map+0x7c/0x80 [soundwire_qcom]     lr : snd_soc_dai_set_channel_map+0x34/0x78     Call trace:      qcom_swrm_set_channel_map+0x7c/0x80 [soundwire_qcom] (P)      sdm845_dai_init+0x18c/0x2e0 [snd_soc_sdm845]      snd_soc_link_init+0x28/0x6c      snd_soc_bind_card+0x5f4/0xb0c      snd_soc_register_card+0x148/0x1a4      devm_snd_soc_register_card+0x50/0xb0      sdm845_snd_platform_probe+0x124/0x148 [snd_soc_sdm845]      platform_probe+0x6c/0xd0      really_probe+0xc0/0x2a4      __driver_probe_device+0x7c/0x130      driver_probe_device+0x40/0x118      __device_attach_driver+0xc4/0x108      bus_for_each_drv+0x8c/0xf0      __device_attach+0xa4/0x198      device_initial_probe+0x18/0x28      bus_probe_device+0xb8/0xbc      deferred_probe_work_func+0xac/0xfc      process_one_work+0x244/0x658      worker_thread+0x1b4/0x360      kthread+0x148/0x228      ret_from_fork+0x10/0x20     Kernel panic - not syncing: BRK handler: Fatal exception  Dan has also reported following issues with the original patch https://lore.kernel.org/all/33fe8fe7-719a-405a-9ed2-d9f816ce1d57@sabinyo.mountain/  Bug #1: The zeroeth element of ctrl->pconfig[] is supposed to be unused.  We start counting at 1.  However this code sets ctrl->pconfig[0].ch_mask = 128.  Bug #2: There are SLIM_MAX_TX_PORTS (16) elements in tx_ch[] array but only QCOM_SDW_MAX_PORTS + 1 (15) in the ctrl->pconfig[] array so it corrupts memory like Yongqin Liu pointed out.  Bug 3: Like Jie Gan pointed out, it erases all the tx information with the rx information.
CVE-2025-38494: In the Linux kernel, the following vulnerability has been resolved:  HID: core: do not bypass hid_hw_raw_request  hid_hw_raw_request() is actually useful to ensure the provided buffer and length are valid. Directly calling in the low level transport driver function bypassed those checks and allowed invalid paramto be used.
CVE-2025-31716: In bootloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed.
CVE-2025-6076: Partner Software's Partner Software application and Partner Web application do not sanitize files uploaded on the "reports" tab, allowing an authenticated attacker to upload a malicious file and compromise the device. By default, the software runs as SYSTEM, heightening the severity of the vulnerability.
CVE-2025-6078: Partner Software's Partner Software application and Partner Web application allows an authenticated user to add notes on the 'Notes' page when viewing a job but does not completely sanitize input, making it possible to add notes with HTML tags and JavaScript, enabling an attacker to add a note containing malicious JavaScript, leading to stored XSS (cross-site scripting).
CVE-2025-20990: Improper access control in accessing system device node prior to SMR Aug-2025 Release 1 allows local attackers to access device identifier.
CVE-2025-21010: Improper privilege management in SamsungAccount prior to SMR Aug-2025 Release 1 allows local privileged attackers to deactivate Samsung account.
CVE-2025-21011: Improper access control in SemSensorService for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information related to motion and body sensors.
CVE-2025-21012: Improper access control in fall detection for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to modify fall detection configuration.
CVE-2025-21013: Improper access control in SemSensorManager for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information related to outdoor exercise and sleep time.
CVE-2025-21014: Improper export of android application component in Emergency SoS prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information.
CVE-2025-21016: Improper access control in PkgPredictorService prior to SMR Aug-2025 Release 1 in Chinese Android 13, 14, 15 and 16 allows local attackers to use the privileged APIs.
CVE-2025-21019: Improper authorization in Samsung Health prior to version 6.30.1.003 allows local attackers to access data in Samsung Health. User interaction is required for triggering this vulnerability.
CVE-2025-21022: Improper access control in Galaxy Wearable prior to version 2.2.63.25042861 allows local attackers to access sensitive information.
CVE-2025-21023: Improper access control in WcsExtension for Galaxy Watch prior to Android Watch 16 allows local attackers to access sensitive information.
CVE-2024-8244: The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.
CVE-2025-47908: Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.
CVE-2025-6572: The OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVE-2024-58238: In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test  This fixes the tx timeout issue seen while running a stress test on btnxpuart for couple of hours, such that the interval between two HCI commands coincide with the power save timeout value of 2 seconds.  Test procedure using bash script: <load btnxpuart.ko> hciconfig hci0 up //Enable Power Save feature hcitool -i hci0 cmd 3f 23 02 00 00 while (true) do     hciconfig hci0 leadv     sleep 2     hciconfig hci0 noleadv     sleep 2 done  Error log, after adding few more debug prints: Bluetooth: btnxpuart_queue_skb(): 01 0A 20 01 00 Bluetooth: hci0: Set UART break: on, status=0 Bluetooth: hci0: btnxpuart_tx_wakeup() tx_work scheduled Bluetooth: hci0: btnxpuart_tx_work() dequeue: 01 0A 20 01 00 Can't set advertise mode on hci0: Connection timed out (110) Bluetooth: hci0: command 0x200a tx timeout  When the power save mechanism turns on UART break, and btnxpuart_tx_work() is scheduled simultaneously, psdata->ps_state is read as PS_STATE_AWAKE, which prevents the psdata->work from being scheduled, which is responsible to turn OFF UART break.  This issue is fixed by adding a ps_lock mutex around UART break on/off as well as around ps_state read/write. btnxpuart_tx_wakeup() will now read updated ps_state value. If ps_state is PS_STATE_SLEEP, it will first schedule psdata->work, and then it will reschedule itself once UART break has been turned off and ps_state is PS_STATE_AWAKE.  Tested above script for 50,000 iterations and TX timeout error was not observed anymore.
CVE-2025-6715: The LatePoint  WordPress plugin before 5.1.94 is vulnerable to Local File Inclusion via the layout parameter. This makes it possible for attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files.
CVE-2025-3414: The Structured Content (JSON-LD) #wpsc WordPress plugin before 1.7.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVE-2025-6790: The Quiz and Survey Master (QSM)  WordPress plugin before 10.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
CVE-2025-5998: The PPWP – Password Protect Pages WordPress plugin before version 1.9.11 allows to put the site content behind a password authorization, however users with subscriber or greater roles can view content via the REST API.
CVE-2025-8047: The disable-right-click-powered-by-pixterme through v1.2 and pixter-image-digital-license thtough v1.0 WordPress plugins load a JavaScript file which has been compromised from an apparent abandoned S3 bucket. It can be used as a backdoor by those who control it, but it currently displays an alert marketing security services. Users that pay are added to allowedDomains to suppress the popup.
CVE-2025-38509: In the Linux kernel, the following vulnerability has been resolved:  wifi: mac80211: reject VHT opmode for unsupported channel widths  VHT operating mode notifications are not defined for channel widths below 20 MHz. In particular, 5 MHz and 10 MHz are not valid under the VHT specification and must be rejected.  Without this check, malformed notifications using these widths may reach ieee80211_chan_width_to_rx_bw(), leading to a WARN_ON due to invalid input. This issue was reported by syzbot.  Reject these unsupported widths early in sta_link_apply_parameters() when opmode_notif is used. The accepted set includes 20, 40, 80, 160, and 80+80 MHz, which are valid for VHT. While 320 MHz is not defined for VHT, it is allowed to avoid rejecting HE or EHT clients that may still send a VHT opmode notification.
CVE-2025-38511: In the Linux kernel, the following vulnerability has been resolved:  drm/xe/pf: Clear all LMTT pages on alloc  Our LMEM buffer objects are not cleared by default on alloc and during VF provisioning we only setup LMTT PTEs for the actually provisioned LMEM range. But beyond that valid range we might leave some stale data that could either point to some other VFs allocations or even to the PF pages.  Explicitly clear all new LMTT page to avoid the risk that a malicious VF would try to exploit that gap.  While around add asserts to catch any undesired PTE overwrites and low-level debug traces to track LMTT PT life-cycle.  (cherry picked from commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d)
CVE-2025-38514: In the Linux kernel, the following vulnerability has been resolved:  rxrpc: Fix oops due to non-existence of prealloc backlog struct  If an AF_RXRPC service socket is opened and bound, but calls are preallocated, then rxrpc_alloc_incoming_call() will oops because the rxrpc_backlog struct doesn't get allocated until the first preallocation is made.  Fix this by returning NULL from rxrpc_alloc_incoming_call() if there is no backlog struct.  This will cause the incoming call to be aborted.
CVE-2025-38515: In the Linux kernel, the following vulnerability has been resolved:  drm/sched: Increment job count before swapping tail spsc queue  A small race exists between spsc_queue_push and the run-job worker, in which spsc_queue_push may return not-first while the run-job worker has already idled due to the job count being zero. If this race occurs, job scheduling stops, leading to hangs while waiting on the job’s DMA fences.  Seal this race by incrementing the job count before appending to the SPSC queue.  This race was observed on a drm-tip 6.16-rc1 build with the Xe driver in an SVM test case.
CVE-2025-38528: In the Linux kernel, the following vulnerability has been resolved:  bpf: Reject %p% format string in bprintf-like helpers  static const char fmt[] = "%p%";     bpf_trace_printk(fmt, sizeof(fmt));  The above BPF program isn't rejected and causes a kernel warning at runtime:      Please remove unsupported %\x00 in format string     WARNING: CPU: 1 PID: 7244 at lib/vsprintf.c:2680 format_decode+0x49c/0x5d0  This happens because bpf_bprintf_prepare skips over the second %, detected as punctuation, while processing %p. This patch fixes it by not skipping over punctuation. %\x00 is then processed in the next iteration and rejected.
CVE-2025-38537: In the Linux kernel, the following vulnerability has been resolved:  net: phy: Don't register LEDs for genphy  If a PHY has no driver, the genphy driver is probed/removed directly in phy_attach/detach. If the PHY's ofnode has an "leds" subnode, then the LEDs will be (un)registered when probing/removing the genphy driver. This could occur if the leds are for a non-generic driver that isn't loaded for whatever reason. Synchronously removing the PHY device in phy_detach leads to the following deadlock:  rtnl_lock() ndo_close()     ...     phy_detach()         phy_remove()             phy_leds_unregister()                 led_classdev_unregister()                     led_trigger_set()                         netdev_trigger_deactivate()                             unregister_netdevice_notifier()                                 rtnl_lock()  There is a corresponding deadlock on the open/register side of things (and that one is reported by lockdep), but it requires a race while this one is deterministic.  Generic PHYs do not support LEDs anyway, so don't bother registering them.
CVE-2025-38539: In the Linux kernel, the following vulnerability has been resolved:  tracing: Add down_write(trace_event_sem) when adding trace event  When a module is loaded, it adds trace events defined by the module. It may also need to modify the modules trace printk formats to replace enum names with their values.  If two modules are loaded at the same time, the adding of the event to the ftrace_events list can corrupt the walking of the list in the code that is modifying the printk format strings and crash the kernel.  The addition of the event should take the trace_event_sem for write while it adds the new event.  Also add a lockdep_assert_held() on that semaphore in __trace_add_event_dirs() as it iterates the list.
CVE-2025-38542: In the Linux kernel, the following vulnerability has been resolved:  net: appletalk: Fix device refcount leak in atrtr_create()  When updating an existing route entry in atrtr_create(), the old device reference was not being released before assigning the new device, leading to a device refcount leak. Fix this by calling dev_put() to release the old device reference before holding the new one.
CVE-2025-38547: In the Linux kernel, the following vulnerability has been resolved:  iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps  The AXP717 ADC channel maps is missing a sentinel entry at the end. This causes a KASAN warning.  Add the missing sentinel entry.
CVE-2025-38550: In the Linux kernel, the following vulnerability has been resolved:  ipv6: mcast: Delay put pmc->idev in mld_del_delrec()  pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec() does, the reference should be put after ip6_mc_clear_src() return.
CVE-2023-4130: In the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea()  There are multiple smb2_ea_info buffers in FILE_FULL_EA_INFORMATION request from client. ksmbd find next smb2_ea_info using ->NextEntryOffset of current smb2_ea_info. ksmbd need to validate buffer length Before accessing the next ea. ksmbd should check buffer length using buf_len, not next variable. next is the start offset of current ea that got from previous ea.
CVE-2023-4515: In the Linux kernel, the following vulnerability has been resolved:  ksmbd: validate command request size  In commit 2b9b8f3b68ed ("ksmbd: validate command payload size"), except for SMB2_OPLOCK_BREAK_HE command, the request size of other commands is not checked, it's not expected. Fix it by add check for request size of other commands.
CVE-2025-31713: In engineer mode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed.
CVE-2025-31715: In vowifi service, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed.