xamxte/cve-to-cwe huggingface dataset:
CVE-2025-40070: In the Linux kernel, the following vulnerability has been resolved:  pps: fix warning in pps_register_cdev when register device fail  Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error handling in __video_register_device()"), the release hook should be set before device_register(). Otherwise, when device_register() return error and put_device() try to callback the release function, the below warning may happen.    ------------[ cut here ]------------   WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567   Modules linked in:   CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE   RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567   Call Trace:    <TASK>    kobject_cleanup+0x136/0x410 lib/kobject.c:689    kobject_release lib/kobject.c:720 [inline]    kref_put include/linux/kref.h:65 [inline]    kobject_put+0xe9/0x130 lib/kobject.c:737    put_device+0x24/0x30 drivers/base/core.c:3797    pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402    pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108    pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57    tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432    tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563    tiocsetd drivers/tty/tty_io.c:2429 [inline]    tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728    vfs_ioctl fs/ioctl.c:51 [inline]    __do_sys_ioctl fs/ioctl.c:598 [inline]    __se_sys_ioctl fs/ioctl.c:584 [inline]    __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]    do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94    entry_SYSCALL_64_after_hwframe+0x76/0x7e    </TASK>  Before commit c79a39dc8d06 ("pps: Fix a use-after-free"), pps_register_cdev() call device_create() to create pps->dev, which will init dev->release to device_create_release(). Now the comment is outdated, just remove it.  Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed in pps_register_source() to avoid a double free in the failure case.
CVE-2025-40072: In the Linux kernel, the following vulnerability has been resolved:  fanotify: Validate the return value of mnt_ns_from_dentry() before dereferencing  The function do_fanotify_mark() does not validate if mnt_ns_from_dentry() returns NULL before dereferencing mntns->user_ns. This causes a NULL pointer dereference in do_fanotify_mark() if the path is not a mount namespace object.  Fix this by checking mnt_ns_from_dentry()'s return value before dereferencing it.  Before the patch  $ gcc fanotify_nullptr.c -o fanotify_nullptr $ mkdir A $ ./fanotify_nullptr Fanotify fd: 3 fanotify_mark: Operation not permitted $ unshare -Urm Fanotify fd: 3 Killed  int main(void){     int ffd;     ffd = fanotify_init(FAN_CLASS_NOTIF | FAN_REPORT_MNT, 0);     if(ffd < 0){         perror("fanotify_init");         exit(EXIT_FAILURE);     }      printf("Fanotify fd: %d\n",ffd);      if(fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_MNTNS, FAN_MNT_ATTACH, AT_FDCWD, "A") < 0){         perror("fanotify_mark");         exit(EXIT_FAILURE);     }  return 0; }  After the patch  $ gcc fanotify_nullptr.c -o fanotify_nullptr $ mkdir A $ ./fanotify_nullptr Fanotify fd: 3 fanotify_mark: Operation not permitted $ unshare -Urm Fanotify fd: 3 fanotify_mark: Invalid argument  [   25.694973] BUG: kernel NULL pointer dereference, address: 0000000000000038 [   25.695006] #PF: supervisor read access in kernel mode [   25.695012] #PF: error_code(0x0000) - not-present page [   25.695017] PGD 109a30067 P4D 109a30067 PUD 142b46067 PMD 0 [   25.695025] Oops: Oops: 0000 [#1] SMP NOPTI [   25.695032] CPU: 4 UID: 1000 PID: 1478 Comm: fanotify_nullpt Not tainted 6.17.0-rc4 #1 PREEMPT(lazy) [   25.695040] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 [   25.695049] RIP: 0010:do_fanotify_mark+0x817/0x950 [   25.695066] Code: 04 00 00 e9 45 fd ff ff 48 8b 7c 24 48 4c 89 54 24 18 4c 89 5c 24 10 4c 89 0c 24 e8 b3 11 fc ff 4c 8b 54 24 18 4c 8b 5c 24 10 <48> 8b 78 38 4c 8b 0c 24 49 89 c4 e9 13 fd ff ff 8b 4c 24 28 85 c9 [   25.695081] RSP: 0018:ffffd31c469e3c08 EFLAGS: 00010203 [   25.695104] RAX: 0000000000000000 RBX: 0000000001000000 RCX: ffff8eb48aebd220 [   25.695110] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8eb4835e8180 [   25.695115] RBP: 0000000000000111 R08: 0000000000000000 R09: 0000000000000000 [   25.695142] R10: ffff8eb48a7d56c0 R11: ffff8eb482bede00 R12: 00000000004012a7 [   25.695148] R13: 0000000000000110 R14: 0000000000000001 R15: ffff8eb48a7d56c0 [   25.695154] FS:  00007f8733bda740(0000) GS:ffff8eb61ce5f000(0000) knlGS:0000000000000000 [   25.695162] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [   25.695170] CR2: 0000000000000038 CR3: 0000000136994006 CR4: 00000000003706f0 [   25.695201] Call Trace: [   25.695209]  <TASK> [   25.695215]  __x64_sys_fanotify_mark+0x1f/0x30 [   25.695222]  do_syscall_64+0x82/0x2c0 ...
CVE-2025-40073: In the Linux kernel, the following vulnerability has been resolved:  drm/msm: Do not validate SSPP when it is not ready  Current code will validate current plane and previous plane to confirm they can share a SSPP with multi-rect mode. The SSPP is already allocated for previous plane, while current plane is not associated with any SSPP yet. Null pointer is referenced when validating the SSPP of current plane. Skip SSPP validation for current plane.  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 Mem abort info:   ESR = 0x0000000096000004   EC = 0x25: DABT (current EL), IL = 32 bits   SET = 0, FnV = 0   EA = 0, S1PTW = 0   FSC = 0x04: level 0 translation fault Data abort info:   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000   CM = 0, WnR = 0, TnD = 0, TagAccess = 0   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000888ac3000 [0000000000000020] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1]  SMP Modules linked in: CPU: 4 UID: 0 PID: 1891 Comm: modetest Tainted: G S                  6.15.0-rc2-g3ee3f6e1202e #335 PREEMPT Tainted: [S]=CPU_OUT_OF_SPEC Hardware name: SM8650 EV1 rev1 4slam 2et (DT) pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : dpu_plane_is_multirect_capable+0x68/0x90 lr : dpu_assign_plane_resources+0x288/0x410 sp : ffff800093dcb770 x29: ffff800093dcb770 x28: 0000000000002000 x27: ffff000817c6c000 x26: ffff000806b46368 x25: ffff0008013f6080 x24: ffff00080cbf4800 x23: ffff000810842680 x22: ffff0008013f1080 x21: ffff00080cc86080 x20: ffff000806b463b0 x19: ffff00080cbf5a00 x18: 00000000ffffffff x17: 707a5f657a696c61 x16: 0000000000000003 x15: 0000000000002200 x14: 00000000ffffffff x13: 00aaaaaa00aaaaaa x12: 0000000000000000 x11: ffff000817c6e2b8 x10: 0000000000000000 x9 : ffff80008106a950 x8 : ffff00080cbf48f4 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000438 x3 : 0000000000000438 x2 : ffff800082e245e0 x1 : 0000000000000008 x0 : 0000000000000000 Call trace:  dpu_plane_is_multirect_capable+0x68/0x90 (P)  dpu_crtc_atomic_check+0x5bc/0x650  drm_atomic_helper_check_planes+0x13c/0x220  drm_atomic_helper_check+0x58/0xb8  msm_atomic_check+0xd8/0xf0  drm_atomic_check_only+0x4a8/0x968  drm_atomic_commit+0x50/0xd8  drm_atomic_helper_update_plane+0x140/0x188  __setplane_atomic+0xfc/0x148  drm_mode_setplane+0x164/0x378  drm_ioctl_kernel+0xc0/0x140  drm_ioctl+0x20c/0x500  __arm64_sys_ioctl+0xbc/0xf8  invoke_syscall+0x50/0x120  el0_svc_common.constprop.0+0x48/0xf8  do_el0_svc+0x28/0x40  el0_svc+0x30/0xd0  el0t_64_sync_handler+0x144/0x168  el0t_64_sync+0x198/0x1a0 Code: b9402021 370fffc1 f9401441 3707ff81 (f94010a1) ---[ end trace 0000000000000000 ]---  Patchwork: https://patchwork.freedesktop.org/patch/669224/
CVE-2025-40074: In the Linux kernel, the following vulnerability has been resolved:  ipv4: start using dst_dev_rcu()  Change icmpv4_xrlim_allow(), ip_defrag() to prevent possible UAF.  Change ipmr_prepare_xmit(), ipmr_queue_fwd_xmit(), ip_mr_output(), ipv4_neigh_lookup() to use lockdep enabled dst_dev_rcu().
CVE-2025-40076: In the Linux kernel, the following vulnerability has been resolved:  PCI: rcar-host: Pass proper IRQ domain to generic_handle_domain_irq()  Starting with commit dd26c1a23fd5 ("PCI: rcar-host: Switch to msi_create_parent_irq_domain()"), the MSI parent IRQ domain is NULL because the object of type struct irq_domain_info passed to:  msi_create_parent_irq_domain() ->   irq_domain_instantiate()() ->     __irq_domain_instantiate()  has no reference to the parent IRQ domain. Using msi->domain->parent as an argument for generic_handle_domain_irq() leads to below error:   "Unable to handle kernel NULL pointer dereference at virtual address"  This error was identified while switching the upcoming RZ/G3S PCIe host controller driver to msi_create_parent_irq_domain() (which was using a similar pattern to handle MSIs (see link section)), but it was not tested on hardware using the pcie-rcar-host controller driver due to lack of hardware.  [mani: reworded subject and description]
CVE-2025-40077: In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix to avoid overflow while left shift operation  Should cast type of folio->index from pgoff_t to loff_t to avoid overflow while left shift operation.
CVE-2025-40081: In the Linux kernel, the following vulnerability has been resolved:  perf: arm_spe: Prevent overflow in PERF_IDX2OFF()  Cast nr_pages to unsigned long to avoid overflow when handling large AUX buffer sizes (>= 2 GiB).
CVE-2025-9544: The Doppler Forms WordPress plugin through 2.5.1 registers an AJAX action install_extension without verifying user capabilities or using a nonce. As a result, any authenticated user — including those with the Subscriber role — can install and activate additional Doppler Forms WordPress plugin through 2.5.1 (limited to those whitelisted by the main Doppler Forms WordPress plugin through 2.5.1).
CVE-2025-40083: In the Linux kernel, the following vulnerability has been resolved:  net/sched: sch_qfq: Fix null-deref in agg_dequeue  To prevent a potential crash in agg_dequeue (net/sched/sch_qfq.c) when cl->qdisc->ops->peek(cl->qdisc) returns NULL, we check the return value before using it, similar to the existing approach in sch_hfsc.c.  To avoid code duplication, the following changes are made:  1. Changed qdisc_warn_nonwc(include/net/pkt_sched.h) into a static inline function.  2. Moved qdisc_peek_len from net/sched/sch_hfsc.c to include/net/pkt_sched.h so that sch_qfq can reuse it.  3. Applied qdisc_peek_len in agg_dequeue to avoid crashing.
CVE-2025-40084: In the Linux kernel, the following vulnerability has been resolved:  ksmbd: transport_ipc: validate payload size before reading handle  handle_response() dereferences the payload as a 4-byte handle without verifying that the declared payload size is at least 4 bytes. A malformed or truncated message from ksmbd.mountd can lead to a 4-byte read past the declared payload size. Validate the size before dereferencing.  This is a minimal fix to guard the initial handle read.
CVE-2025-40085: In the Linux kernel, the following vulnerability has been resolved:  ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card  In try_to_register_card(), the return value of usb_ifnum_to_if() is passed directly to usb_interface_claimed() without a NULL check, which will lead to a NULL pointer dereference when creating an invalid USB audio device. Fix this by adding a check to ensure the interface pointer is valid before passing it to usb_interface_claimed().
CVE-2025-47912: The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.
CVE-2025-58183: tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.
CVE-2025-58186: Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.
CVE-2025-61725: The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption.
CVE-2025-10636: The NS Maintenance Mode for WP WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2025-40086: In the Linux kernel, the following vulnerability has been resolved:  drm/xe: Don't allow evicting of BOs in same VM in array of VM binds  An array of VM binds can potentially evict other buffer objects (BOs) within the same VM under certain conditions, which may lead to NULL pointer dereferences later in the bind pipeline. To prevent this, clear the allow_res_evict flag in the xe_bo_validate call.  v2:  - Invert polarity of no_res_evict (Thomas)  - Add comment in code explaining issue (Thomas)  (cherry picked from commit 8b9ba8d6d95fe75fed6b0480bb03da4b321bea08)
CVE-2025-40089: In the Linux kernel, the following vulnerability has been resolved:  cxl/features: Add check for no entries in cxl_feature_info  cxl EDAC calls cxl_feature_info() to get the feature information and if the hardware has no Features support, cxlfs may be passed in as NULL.  [   51.957498] BUG: kernel NULL pointer dereference, address: 0000000000000008 [   51.965571] #PF: supervisor read access in kernel mode [   51.971559] #PF: error_code(0x0000) - not-present page [   51.977542] PGD 17e4f6067 P4D 0 [   51.981384] Oops: Oops: 0000 [#1] SMP NOPTI [   51.986300] CPU: 49 UID: 0 PID: 3782 Comm: systemd-udevd Not tainted 6.17.0dj test+ #64 PREEMPT(voluntary) [   51.997355] Hardware name: <removed> [   52.009790] RIP: 0010:cxl_feature_info+0xa/0x80 [cxl_core]  Add a check for cxlfs before dereferencing it and return -EOPNOTSUPP if there is no cxlfs created due to no hardware support.
CVE-2025-40091: In the Linux kernel, the following vulnerability has been resolved:  ixgbe: fix too early devlink_free() in ixgbe_remove()  Since ixgbe_adapter is embedded in devlink, calling devlink_free() prematurely in the ixgbe_remove() path can lead to UAF. Move devlink_free() to the end.  KASAN report:   BUG: KASAN: use-after-free in ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]  Read of size 8 at addr ffff0000adf813e0 by task bash/2095  CPU: 1 UID: 0 PID: 2095 Comm: bash Tainted: G S  6.17.0-rc2-tnguy.net-queue+ #1 PREEMPT(full)  [...]  Call trace:   show_stack+0x30/0x90 (C)   dump_stack_lvl+0x9c/0xd0   print_address_description.constprop.0+0x90/0x310   print_report+0x104/0x1f0   kasan_report+0x88/0x180   __asan_report_load8_noabort+0x20/0x30   ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]   ixgbe_clear_interrupt_scheme+0xf8/0x130 [ixgbe]   ixgbe_remove+0x2d0/0x8c0 [ixgbe]   pci_device_remove+0xa0/0x220   device_remove+0xb8/0x170   device_release_driver_internal+0x318/0x490   device_driver_detach+0x40/0x68   unbind_store+0xec/0x118   drv_attr_store+0x64/0xb8   sysfs_kf_write+0xcc/0x138   kernfs_fop_write_iter+0x294/0x440   new_sync_write+0x1fc/0x588   vfs_write+0x480/0x6a0   ksys_write+0xf0/0x1e0   __arm64_sys_write+0x70/0xc0   invoke_syscall.constprop.0+0xcc/0x280   el0_svc_common.constprop.0+0xa8/0x248   do_el0_svc+0x44/0x68   el0_svc+0x54/0x160   el0t_64_sync_handler+0xa0/0xe8   el0t_64_sync+0x1b0/0x1b8
CVE-2025-40092: In the Linux kernel, the following vulnerability has been resolved:  usb: gadget: f_ncm: Refactor bind path to use __free()  After an bind/unbind cycle, the ncm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request.  Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 Call trace:  usb_ep_free_request+0x2c/0xec  ncm_bind+0x39c/0x3dc  usb_add_function+0xcc/0x1f0  configfs_composite_bind+0x468/0x588  gadget_bind_driver+0x104/0x270  really_probe+0x190/0x374  __driver_probe_device+0xa0/0x12c  driver_probe_device+0x3c/0x218  __device_attach_driver+0x14c/0x188  bus_for_each_drv+0x10c/0x168  __device_attach+0xfc/0x198  device_initial_probe+0x14/0x24  bus_probe_device+0x94/0x11c  device_add+0x268/0x48c  usb_add_gadget+0x198/0x28c  dwc3_gadget_init+0x700/0x858  __dwc3_set_mode+0x3cc/0x664  process_scheduled_works+0x1d8/0x488  worker_thread+0x244/0x334  kthread+0x114/0x1bc  ret_from_fork+0x10/0x20
CVE-2025-40093: In the Linux kernel, the following vulnerability has been resolved:  usb: gadget: f_ecm: Refactor bind path to use __free()  After an bind/unbind cycle, the ecm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request.  Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.
CVE-2025-40094: In the Linux kernel, the following vulnerability has been resolved:  usb: gadget: f_acm: Refactor bind path to use __free()  After an bind/unbind cycle, the acm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request.  Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 Call trace:  usb_ep_free_request+0x2c/0xec  gs_free_req+0x30/0x44  acm_bind+0x1b8/0x1f4  usb_add_function+0xcc/0x1f0  configfs_composite_bind+0x468/0x588  gadget_bind_driver+0x104/0x270  really_probe+0x190/0x374  __driver_probe_device+0xa0/0x12c  driver_probe_device+0x3c/0x218  __device_attach_driver+0x14c/0x188  bus_for_each_drv+0x10c/0x168  __device_attach+0xfc/0x198  device_initial_probe+0x14/0x24  bus_probe_device+0x94/0x11c  device_add+0x268/0x48c  usb_add_gadget+0x198/0x28c  dwc3_gadget_init+0x700/0x858  __dwc3_set_mode+0x3cc/0x664  process_scheduled_works+0x1d8/0x488  worker_thread+0x244/0x334  kthread+0x114/0x1bc  ret_from_fork+0x10/0x20
CVE-2025-40095: In the Linux kernel, the following vulnerability has been resolved:  usb: gadget: f_rndis: Refactor bind path to use __free()  After an bind/unbind cycle, the rndis->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer dereference when accessing ep->ops->free_request.  Refactor the error handling in the bind path to use the __free() automatic cleanup mechanism.
CVE-2025-40096: In the Linux kernel, the following vulnerability has been resolved:  drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies  When adding dependencies with drm_sched_job_add_dependency(), that function consumes the fence reference both on success and failure, so in the latter case the dma_fence_put() on the error path (xarray failed to expand) is a double free.  Interestingly this bug appears to have been present ever since commit ebd5f74255b9 ("drm/sched: Add dependency tracking"), since the code back then looked like this:  drm_sched_job_add_implicit_dependencies(): ...        for (i = 0; i < fence_count; i++) {                ret = drm_sched_job_add_dependency(job, fences[i]);                if (ret)                        break;        }         for (; i < fence_count; i++)                dma_fence_put(fences[i]);  Which means for the failing 'i' the dma_fence_put was already a double free. Possibly there were no users at that time, or the test cases were insufficient to hit it.  The bug was then only noticed and fixed after commit 9c2ba265352a ("drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2") landed, with its fixup of commit 4eaf02d6076c ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies").  At that point it was a slightly different flavour of a double free, which commit 963d0b356935 ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder") noticed and attempted to fix.  But it only moved the double free from happening inside the drm_sched_job_add_dependency(), when releasing the reference not yet obtained, to the caller, when releasing the reference already released by the former in the failure case.  As such it is not easy to identify the right target for the fixes tag so lets keep it simple and just continue the chain.  While fixing we also improve the comment and explain the reason for taking the reference and not dropping it.
CVE-2025-40097: In the Linux kernel, the following vulnerability has been resolved:  ALSA: hda: Fix missing pointer check in hda_component_manager_init function  The __component_match_add function may assign the 'matchptr' pointer the value ERR_PTR(-ENOMEM), which will subsequently be dereferenced.  The call stack leading to the error looks like this:  hda_component_manager_init |-> component_match_add     |-> component_match_add_release         |-> __component_match_add ( ... ,**matchptr, ... )             |-> *matchptr = ERR_PTR(-ENOMEM);       // assign |-> component_master_add_with_match( ...  match)     |-> component_match_realloc(match, match->num); // dereference  Add IS_ERR() check to prevent the crash.  Found by Linux Verification Center (linuxtesting.org) with SVACE.
CVE-2025-40098: In the Linux kernel, the following vulnerability has been resolved:  ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state()  Return value of a function acpi_evaluate_dsm() is dereferenced  without checking for NULL, but it is usually checked for this function.  acpi_evaluate_dsm() may return NULL, when acpi_evaluate_object() returns acpi_status other than ACPI_SUCCESS, so add a check to prevent the crach.  Found by Linux Verification Center (linuxtesting.org) with SVACE.
CVE-2025-40099: In the Linux kernel, the following vulnerability has been resolved:  cifs: parse_dfs_referrals: prevent oob on malformed input  Malicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS  - reply smaller than sizeof(struct get_dfs_referral_rsp) - reply with number of referrals smaller than NumberOfReferrals in the header  Processing of such replies will cause oob.  Return -EINVAL error on such replies to prevent oob-s.
CVE-2025-40101: In the Linux kernel, the following vulnerability has been resolved:  btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST  At the end of btrfs_load_block_group_zone_info() the first thing we do is to ensure that if the mapping type is not a SINGLE one and there is no RAID stripe tree, then we return early with an error.  Doing that, though, prevents the code from running the last calls from this function which are about freeing memory allocated during its run. Hence, in this case, instead of returning early, we set the ret value and fall through the rest of the cleanup code.