xamxte/cve-to-cwe huggingface dataset:
CVE-2025-40102: In the Linux kernel, the following vulnerability has been resolved:  KVM: arm64: Prevent access to vCPU events before init  Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, leading to KVM interpreting a bunch of uninitialized garbage for routing / injecting the exception.  In one case the injection code and the hyp disagree on whether the vCPU has a 32bit EL1 and put the vCPU into an illegal mode for AArch64, tripping the BUG() in exception_target_el() during the next injection:    kernel BUG at arch/arm64/kvm/inject_fault.c:40!   Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP   CPU: 3 UID: 0 PID: 318 Comm: repro Not tainted 6.17.0-rc4-00104-g10fd0285305d #6 PREEMPT   Hardware name: linux,dummy-virt (DT)   pstate: 21402009 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)   pc : exception_target_el+0x88/0x8c   lr : pend_serror_exception+0x18/0x13c   sp : ffff800082f03a10   x29: ffff800082f03a10 x28: ffff0000cb132280 x27: 0000000000000000   x26: 0000000000000000 x25: ffff0000c2a99c20 x24: 0000000000000000   x23: 0000000000008000 x22: 0000000000000002 x21: 0000000000000004   x20: 0000000000008000 x19: ffff0000c2a99c20 x18: 0000000000000000   x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200000c0   x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000   x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000   x8 : ffff800082f03af8 x7 : 0000000000000000 x6 : 0000000000000000   x5 : ffff800080f621f0 x4 : 0000000000000000 x3 : 0000000000000000   x2 : 000000000040009b x1 : 0000000000000003 x0 : ffff0000c2a99c20   Call trace:    exception_target_el+0x88/0x8c (P)    kvm_inject_serror_esr+0x40/0x3b4    __kvm_arm_vcpu_set_events+0xf0/0x100    kvm_arch_vcpu_ioctl+0x180/0x9d4    kvm_vcpu_ioctl+0x60c/0x9f4    __arm64_sys_ioctl+0xac/0x104    invoke_syscall+0x48/0x110    el0_svc_common.constprop.0+0x40/0xe0    do_el0_svc+0x1c/0x28    el0_svc+0x34/0xf0    el0t_64_sync_handler+0xa0/0xe4    el0t_64_sync+0x198/0x19c   Code: f946bc01 b4fffe61 9101e020 17fffff2 (d4210000)  Reject the ioctls outright as no sane VMM would call these before KVM_ARM_VCPU_INIT anyway. Even if it did the exception would've been thrown away by the eventual reset of the vCPU's state.
CVE-2025-40103: In the Linux kernel, the following vulnerability has been resolved:  smb: client: Fix refcount leak for cifs_sb_tlink  Fix three refcount inconsistency issues related to `cifs_sb_tlink`.  Comments for `cifs_sb_tlink` state that `cifs_put_tlink()` needs to be called after successful calls to `cifs_sb_tlink()`. Three calls fail to update refcount accordingly, leading to possible resource leaks.
CVE-2025-40106: In the Linux kernel, the following vulnerability has been resolved:  comedi: fix divide-by-zero in comedi_buf_munge()  The comedi_buf_munge() function performs a modulo operation `async->munge_chan %= async->cmd.chanlist_len` without first checking if chanlist_len is zero. If a user program submits a command with chanlist_len set to zero, this causes a divide-by-zero error when the device processes data in the interrupt handler path.  Add a check for zero chanlist_len at the beginning of the function, similar to the existing checks for !map and CMDF_RAWDATA flag. When chanlist_len is zero, update munge_count and return early, indicating the data was handled without munging.  This prevents potential kernel panics from malformed user commands.
CVE-2025-40107: In the Linux kernel, the following vulnerability has been resolved:  can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled  This issue is similar to the vulnerability in the `mcp251x` driver, which was fixed in commit 03c427147b2d ("can: mcp251x: fix resume from sleep before interface was brought up").  In the `hi311x` driver, when the device resumes from sleep, the driver schedules `priv->restart_work`. However, if the network interface was not previously enabled, the `priv->wq` (workqueue) is not allocated and initialized, leading to a null pointer dereference.  To fix this, we move the allocation and initialization of the workqueue from the `hi3110_open` function to the `hi3110_can_probe` function. This ensures that the workqueue is properly initialized before it is used during device resume. And added logic to destroy the workqueue in the error handling paths of `hi3110_can_probe` and in the `hi3110_can_remove` function to prevent resource leaks.
CVE-2025-43376: A logic issue was addressed with improved state management. This issue is fixed in Safari 26, tvOS 26, watchOS 26, iOS 26 and iPadOS 26, visionOS 26. A remote attacker may be able to view leaked DNS queries with Private Relay turned on.
CVE-2025-10567: The FunnelKit  WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its checkout-related AJAX actions, allowing attackers to conduct reflected XSS attacks against logged-in users.
CVE-2025-10873: The ElementInvader Addons for Elementor WordPress plugin before 1.4.1 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses due to missing authorization on the elementinvader_addons_for_elementor_forms_send_form action.
CVE-2025-11072: The MelAbu WP Download Counter Button WordPress plugin through 1.8.6.7 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files.
CVE-2025-21073: Insecure default configuration in USB connection mode prior to SMR Nov-2025 Release 1 allows privileged physical attackers to access user data. User interaction is required for triggering this vulnerability.
CVE-2025-21077: Improper input validation in Samsung Email prior to version 6.2.06.0 allows local attackers to launch arbitrary activity with Samsung Email privilege.
CVE-2025-21078: Use of insufficiently random value of secretKey in Smart Switch prior to version 3.7.68.6 allows adjacent attackers to access backup data from applications.
CVE-2025-21079: Improper input validation in Samsung Members prior to version 5.5.01.3 allows remote attackers to connect arbitrary URL and launch arbitrary activity with Samsung Members privilege. User interaction is required for triggering this vulnerability.
CVE-2025-6027: The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password reset token is associated with the user who requested it, allowing any authenticated users, such as subscriber to reset the password of arbitrary accounts, including administrators.
CVE-2025-10966: curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.  This prevents curl from detecting MITM attackers and more.
CVE-2025-11237: The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated user, such as a Subscriber, to update arbitrary WordPress options.
CVE-2025-11307: The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.48 does not sanitize user input provided via an AJAX action, allowing unauthenticated users to store XSS payloads which are later retrieved from another AJAX call and output unescaped.
CVE-2025-11855: The age-restriction WordPress plugin through 3.0.2 does not have authorisation in the age_restrictionRemoteSupportRequest function, allowing any authenticated users, such as subscriber to create an admin user with a hardcoded username and arbitrary password.
CVE-2025-40110: In the Linux kernel, the following vulnerability has been resolved:  drm/vmwgfx: Fix a null-ptr access in the cursor snooper  Check that the resource which is converted to a surface exists before trying to use the cursor snooper on it.  vmw_cmd_res_check allows explicit invalid (SVGA3D_INVALID_ID) identifiers because some svga commands accept SVGA3D_INVALID_ID to mean "no surface", unfortunately functions that accept the actual surfaces as objects might (and in case of the cursor snooper, do not) be able to handle null objects. Make sure that we validate not only the identifier (via the vmw_cmd_res_check) but also check that the actual resource exists before trying to do something with it.  Fixes unchecked null-ptr reference in the snooping code.
CVE-2025-40111: In the Linux kernel, the following vulnerability has been resolved:  drm/vmwgfx: Fix Use-after-free in validation  Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are expected to be cleared in vmw_validation_drop_ht but this node escaped because its resource was destroyed prematurely.
CVE-2025-11560: The Team Members Showcase WordPress plugin before 3.5.0 does not sanitize and escape a parameter before outputting it back in the page, leading to reflected cross-site scripting, which could be used against high-privilege users such as admins.
CVE-2025-40116: In the Linux kernel, the following vulnerability has been resolved:  usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup  The kthread_run() function returns error pointers so the max3421_hcd->spi_thread pointer can be either error pointers or NULL. Check for both before dereferencing it.
CVE-2025-40117: In the Linux kernel, the following vulnerability has been resolved:  misc: pci_endpoint_test: Fix array underflow in pci_endpoint_test_ioctl()  Commit eefb83790a0d ("misc: pci_endpoint_test: Add doorbell test case") added NO_BAR (-1) to the pci_barno enum which, in practical terms, changes the enum from an unsigned int to a signed int.  If the user passes a negative number in pci_endpoint_test_ioctl() then it results in an array underflow in pci_endpoint_test_bar().
CVE-2025-40118: In the Linux kernel, the following vulnerability has been resolved:  scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod  Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone") UBSAN reports:    UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17   index 28 is out of range for type 'pm8001_phy [16]'  on rmmod when using an expander.  For a direct attached device, attached_phy contains the local phy id. For a device behind an expander, attached_phy contains the remote phy id, not the local phy id.  I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a device behind an expander, attached_phy can be much larger than pm8001_ha->chip->n_phy (depending on the amount of phys of the expander).  E.g. on my system pm8001_ha has 8 phys with phy ids 0-7.  One of the ports has an expander connected.  The expander has 31 phys with phy ids 0-30.  The pm8001_ha->phy array only contains the phys of the HBA.  It does not contain the phys of the expander.  Thus, it is wrong to use attached_phy to index the pm8001_ha->phy array for a device behind an expander.  Thus, we can only clear phy_attached for devices that are directly attached.
CVE-2025-40119: In the Linux kernel, the following vulnerability has been resolved:  ext4: fix potential null deref in ext4_mb_init()  In ext4_mb_init(), ext4_mb_avg_fragment_size_destroy() may be called when sbi->s_mb_avg_fragment_size remains uninitialized (e.g., if groupinfo slab cache allocation fails). Since ext4_mb_avg_fragment_size_destroy() lacks null pointer checking, this leads to a null pointer dereference.  ================================================================== EXT4-fs: no memory for groupinfo slab cache BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: Oops: 0002 [#1] SMP PTI CPU:2 UID: 0 PID: 87 Comm:mount Not tainted 6.17.0-rc2 #1134 PREEMPT(none) RIP: 0010:_raw_spin_lock_irqsave+0x1b/0x40 Call Trace:  <TASK>  xa_destroy+0x61/0x130  ext4_mb_init+0x483/0x540  __ext4_fill_super+0x116d/0x17b0  ext4_fill_super+0xd3/0x280  get_tree_bdev_flags+0x132/0x1d0  vfs_get_tree+0x29/0xd0  do_new_mount+0x197/0x300  __x64_sys_mount+0x116/0x150  do_syscall_64+0x50/0x1c0  entry_SYSCALL_64_after_hwframe+0x76/0x7e ==================================================================  Therefore, add necessary null check to ext4_mb_avg_fragment_size_destroy() to prevent this issue. The same fix is also applied to ext4_mb_largest_free_orders_destroy().
CVE-2025-40122: In the Linux kernel, the following vulnerability has been resolved:  perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error  When running perf_fuzzer on PTL, sometimes the below "unchecked MSR  access error" is seen when accessing IA32_PMC_x_CFG_B MSRs.  [   55.611268] unchecked MSR access error: WRMSR to 0x1986 (tried to write 0x0000000200000001) at rIP: 0xffffffffac564b28 (native_write_msr+0x8/0x30) [   55.611280] Call Trace: [   55.611282]  <TASK> [   55.611284]  ? intel_pmu_config_acr+0x87/0x160 [   55.611289]  intel_pmu_enable_acr+0x6d/0x80 [   55.611291]  intel_pmu_enable_event+0xce/0x460 [   55.611293]  x86_pmu_start+0x78/0xb0 [   55.611297]  x86_pmu_enable+0x218/0x3a0 [   55.611300]  ? x86_pmu_enable+0x121/0x3a0 [   55.611302]  perf_pmu_enable+0x40/0x50 [   55.611307]  ctx_resched+0x19d/0x220 [   55.611309]  __perf_install_in_context+0x284/0x2f0 [   55.611311]  ? __pfx_remote_function+0x10/0x10 [   55.611314]  remote_function+0x52/0x70 [   55.611317]  ? __pfx_remote_function+0x10/0x10 [   55.611319]  generic_exec_single+0x84/0x150 [   55.611323]  smp_call_function_single+0xc5/0x1a0 [   55.611326]  ? __pfx_remote_function+0x10/0x10 [   55.611329]  perf_install_in_context+0xd1/0x1e0 [   55.611331]  ? __pfx___perf_install_in_context+0x10/0x10 [   55.611333]  __do_sys_perf_event_open+0xa76/0x1040 [   55.611336]  __x64_sys_perf_event_open+0x26/0x30 [   55.611337]  x64_sys_call+0x1d8e/0x20c0 [   55.611339]  do_syscall_64+0x4f/0x120 [   55.611343]  entry_SYSCALL_64_after_hwframe+0x76/0x7e  On PTL, GP counter 0 and 1 doesn't support auto counter reload feature, thus it would trigger a #GP when trying to write 1 on bit 0 of CFG_B MSR which requires to enable auto counter reload on GP counter 0.  The root cause of causing this issue is the check for auto counter reload (ACR) counter mask from user space is incorrect in intel_pmu_acr_late_setup() helper. It leads to an invalid ACR counter mask from user space could be set into hw.config1 and then written into CFG_B MSRs and trigger the MSR access warning.  e.g., User may create a perf event with ACR counter mask (config2=0xcb), and there is only 1 event created, so "cpuc->n_events" is 1.  The correct check condition should be "i + idx >= cpuc->n_events" instead of "i + idx > cpuc->n_events" (it looks a typo). Otherwise, the counter mask would traverse twice and an invalid "cpuc->assign[1]" bit (bit 0) is set into hw.config1 and cause MSR accessing error.  Besides, also check if the ACR counter mask corresponding events are ACR events. If not, filter out these counter mask. If a event is not a ACR event, it could be scheduled to an HW counter which doesn't support ACR. It's invalid to add their counter index in ACR counter mask.  Furthermore, remove the WARN_ON_ONCE() since it's easily triggered as user could set any invalid ACR counter mask and the warning message could mislead users.
CVE-2025-40123: In the Linux kernel, the following vulnerability has been resolved:  bpf: Enforce expected_attach_type for tailcall compatibility  Yinhao et al. recently reported:    Our fuzzer tool discovered an uninitialized pointer issue in the   bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem.   This leads to a NULL pointer dereference when a BPF program attempts to   deference the txq member of struct xdp_buff object.  The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the entry point for bpf_prog_test_run_xdp() and its expected_attach_type can neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP to pass xdp_is_valid_access() validation. The program returns struct xdp_md's egress_ifindex, and the latter is only allowed to be accessed under mentioned expected_attach_type. progB is then inserted into the tailcall which progA calls.  The underlying issue goes beyond XDP though. Another example are programs of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well as sock_addr_func_proto() have different logic depending on the programs' expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME should not be allowed doing a tailcall into a program which calls bpf_bind() out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT.  In short, specifying expected_attach_type allows to open up additional functionality or restrictions beyond what the basic bpf_prog_type enables. The use of tailcalls must not violate these constraints. Fix it by enforcing expected_attach_type in __bpf_prog_map_compatible().  Note that we only enforce this for tailcall maps, but not for BPF devmaps or cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and cpu_map_bpf_prog_run*() which set up a new environment / context and therefore these situations are not prone to this issue.
CVE-2025-40124: In the Linux kernel, the following vulnerability has been resolved:  sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III  Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios enabled resulted from copy_from_user() returning impossibly large values greater than the size to be copied. This lead to __copy_from_iter() returning impossible values instead of the actual number of bytes it was able to copy.  The BUG_ON has been reported in https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de  The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. The exception handlers expect that %o2 has already been masked during the bulk copy loop, but the masking was performed after that loop. This will fix the return value of copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.
CVE-2025-40127: In the Linux kernel, the following vulnerability has been resolved:  hwrng: ks-sa - fix division by zero in ks_sa_rng_init  Fix division by zero in ks_sa_rng_init caused by missing clock pointer initialization. The clk_get_rate() call is performed on an uninitialized clk pointer, resulting in division by zero when calculating delay values.  Add clock initialization code before using the clock.    drivers/char/hw_random/ks-sa-rng.c | 7 +++++++  1 file changed, 7 insertions(+)
CVE-2025-40129: In the Linux kernel, the following vulnerability has been resolved:  sunrpc: fix null pointer dereference on zero-length checksum  In xdr_stream_decode_opaque_auth(), zero-length checksum.len causes checksum.data to be set to NULL. This triggers a NPD when accessing checksum.data in gss_krb5_verify_mic_v2(). This patch ensures that the value of checksum.len is not less than XDR_UNIT.
CVE-2025-40130: In the Linux kernel, the following vulnerability has been resolved:  scsi: ufs: core: Fix data race in CPU latency PM QoS request handling  The cpu_latency_qos_add/remove/update_request interfaces lack internal synchronization by design, requiring the caller to ensure thread safety. The current implementation relies on the 'pm_qos_enabled' flag, which is insufficient to prevent concurrent access and cannot serve as a proper synchronization mechanism. This has led to data races and list corruption issues.  A typical race condition call trace is:  [Thread A] ufshcd_pm_qos_exit()   --> cpu_latency_qos_remove_request()     --> cpu_latency_qos_apply();       --> pm_qos_update_target()         --> plist_del              <--(1) delete plist node     --> memset(req, 0, sizeof(*req));   --> hba->pm_qos_enabled = false;  [Thread B] ufshcd_devfreq_target   --> ufshcd_devfreq_scale     --> ufshcd_scale_clks       --> ufshcd_pm_qos_update     <--(2) pm_qos_enabled is true         --> cpu_latency_qos_update_request           --> pm_qos_update_target             --> plist_del          <--(3) plist node use-after-free  Introduces a dedicated mutex to serialize PM QoS operations, preventing data races and ensuring safe access to PM QoS resources, including sysfs interface reads.
CVE-2025-40131: In the Linux kernel, the following vulnerability has been resolved:  wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu()  In ath12k_dp_mon_rx_deliver_msdu(), peer lookup fails because rxcb->peer_id is not updated with a valid value. This is expected in monitor mode, where RX frames bypass the regular RX descriptor path that typically sets rxcb->peer_id. As a result, the peer is NULL, and link_id and link_valid fields in the RX status are not populated. This leads to a WARN_ON in mac80211 when it receives data frame from an associated station with invalid link_id.  Fix this potential issue by using ppduinfo->peer_id, which holds the correct peer id for the received frame. This ensures that the peer is correctly found and the associated link metadata is updated accordingly.  Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
CVE-2025-40132: In the Linux kernel, the following vulnerability has been resolved:  ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback  In create_sdw_dailink() check that sof_end->codec_info->add_sidecar is not NULL before calling it.  The original code assumed that if include_sidecar is true, the codec on that link has an add_sidecar callback. But there could be other codecs on the same link that do not have an add_sidecar callback.
CVE-2025-40133: In the Linux kernel, the following vulnerability has been resolved:  mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().  mptcp_active_enable() is called from subflow_finish_connect(), which is icsk->icsk_af_ops->sk_rx_dst_set() and it's not always under RCU.  Using sk_dst_get(sk)->dev could trigger UAF.  Let's use __sk_dst_get() and dst_dev_rcu().
CVE-2025-40134: In the Linux kernel, the following vulnerability has been resolved:  dm: fix NULL pointer dereference in __dm_suspend()  There is a race condition between dm device suspend and table load that can lead to null pointer dereference. The issue occurs when suspend is invoked before table load completes:  BUG: kernel NULL pointer dereference, address: 0000000000000054 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 6 PID: 6798 Comm: dmsetup Not tainted 6.6.0-g7e52f5f0ca9b #62 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:blk_mq_wait_quiesce_done+0x0/0x50 Call Trace:   <TASK>   blk_mq_quiesce_queue+0x2c/0x50   dm_stop_queue+0xd/0x20   __dm_suspend+0x130/0x330   dm_suspend+0x11a/0x180   dev_suspend+0x27e/0x560   ctl_ioctl+0x4cf/0x850   dm_ctl_ioctl+0xd/0x20   vfs_ioctl+0x1d/0x50   __se_sys_ioctl+0x9b/0xc0   __x64_sys_ioctl+0x19/0x30   x64_sys_call+0x2c4a/0x4620   do_syscall_64+0x9e/0x1b0  The issue can be triggered as below:  T1       T2 dm_suspend     table_load __dm_suspend     dm_setup_md_queue       dm_mq_init_request_queue       blk_mq_init_allocated_queue       => q->mq_ops = set->ops; (1) dm_stop_queue / dm_wait_for_completion => q->tag_set NULL pointer! (2)       => q->tag_set = set; (3)  Fix this by checking if a valid table (map) exists before performing request-based suspend and waiting for target I/O. When map is NULL, skip these table-dependent suspend steps.  Even when map is NULL, no I/O can reach any target because there is no table loaded; I/O submitted in this state will fail early in the DM layer. Skipping the table-dependent suspend logic in this case is safe and avoids NULL pointer dereferences.
CVE-2025-40135: In the Linux kernel, the following vulnerability has been resolved:  ipv6: use RCU in ip6_xmit()  Use RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent possible UAF.