Advisory Database Sync

Author: advisory-database[bot]

advisories/github-reviewed/2025/09/GHSA-m68q-4hqr-mc6f/GHSA-m68q-4hqr-mc6f.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-m68q-4hqr-mc6f",
-  "modified": "2025-11-21T09:30:26Z",
+  "modified": "2025-11-28T15:30:29Z",
   "published": "2025-09-16T15:32:37Z",
   "aliases": [
     "CVE-2025-4953"
@@ -44,6 +44,10 @@
       "type": "WEB",
       "url": "https://github.com/containers/podman/pull/25173"
     },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2024:8690"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2025:15904"
@@ -60,6 +64,10 @@
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2025:17669"
     },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2025:2703"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/security/cve/CVE-2025-4953"

advisories/unreviewed/2025/06/GHSA-3fhm-f343-r7mm/GHSA-3fhm-f343-r7mm.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-3fhm-f343-r7mm",
-  "modified": "2025-06-18T12:30:53Z",
+  "modified": "2025-11-28T15:30:27Z",
   "published": "2025-06-18T12:30:52Z",
   "aliases": [
     "CVE-2022-50171"
   ],
   "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/sec - don't sleep when in softirq\n\nWhen kunpeng920 encryption driver is used to deencrypt and decrypt\npackets during the softirq, it is not allowed to use mutex lock. The\nkernel will report the following error:\n\nBUG: scheduling while atomic: swapper/57/0/0x00000300\nCall trace:\ndump_backtrace+0x0/0x1e4\nshow_stack+0x20/0x2c\ndump_stack+0xd8/0x140\n__schedule_bug+0x68/0x80\n__schedule+0x728/0x840\nschedule+0x50/0xe0\nschedule_preempt_disabled+0x18/0x24\n__mutex_lock.constprop.0+0x594/0x5dc\n__mutex_lock_slowpath+0x1c/0x30\nmutex_lock+0x50/0x60\nsec_request_init+0x8c/0x1a0 [hisi_sec2]\nsec_process+0x28/0x1ac [hisi_sec2]\nsec_skcipher_crypto+0xf4/0x1d4 [hisi_sec2]\nsec_skcipher_encrypt+0x1c/0x30 [hisi_sec2]\ncrypto_skcipher_encrypt+0x2c/0x40\ncrypto_authenc_encrypt+0xc8/0xfc [authenc]\ncrypto_aead_encrypt+0x2c/0x40\nechainiv_encrypt+0x144/0x1a0 [echainiv]\ncrypto_aead_encrypt+0x2c/0x40\nesp_output_tail+0x348/0x5c0 [esp4]\nesp_output+0x120/0x19c [esp4]\nxfrm_output_one+0x25c/0x4d4\nxfrm_output_resume+0x6c/0x1fc\nxfrm_output+0xac/0x3c0\nxfrm4_output+0x64/0x130\nip_build_and_send_pkt+0x158/0x20c\ntcp_v4_send_synack+0xdc/0x1f0\ntcp_conn_request+0x7d0/0x994\ntcp_v4_conn_request+0x58/0x6c\ntcp_v6_conn_request+0xf0/0x100\ntcp_rcv_state_process+0x1cc/0xd60\ntcp_v4_do_rcv+0x10c/0x250\ntcp_v4_rcv+0xfc4/0x10a4\nip_protocol_deliver_rcu+0xf4/0x200\nip_local_deliver_finish+0x58/0x70\nip_local_deliver+0x68/0x120\nip_sublist_rcv_finish+0x70/0x94\nip_list_rcv_finish.constprop.0+0x17c/0x1d0\nip_sublist_rcv+0x40/0xb0\nip_list_rcv+0x140/0x1dc\n__netif_receive_skb_list_core+0x154/0x28c\n__netif_receive_skb_list+0x120/0x1a0\nnetif_receive_skb_list_internal+0xe4/0x1f0\nnapi_complete_done+0x70/0x1f0\ngro_cell_poll+0x9c/0xb0\nnapi_poll+0xcc/0x264\nnet_rx_action+0xd4/0x21c\n__do_softirq+0x130/0x358\nirq_exit+0x11c/0x13c\n__handle_domain_irq+0x88/0xf0\ngic_handle_irq+0x78/0x2c0\nel1_irq+0xb8/0x140\narch_cpu_idle+0x18/0x40\ndefault_idle_call+0x5c/0x1c0\ncpuidle_idle_call+0x174/0x1b0\ndo_idle+0xc8/0x160\ncpu_startup_entry+0x30/0x11c\nsecondary_start_kernel+0x158/0x1e4\nsoftirq: huh, entered softirq 3 NET_RX 0000000093774ee4 with\npreempt_count 00000100, exited with fffffe00?",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -37,7 +42,7 @@
   ],
   "database_specific": {
     "cwe_ids": [],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-06-18T11:15:47Z"

advisories/unreviewed/2025/06/GHSA-3wj6-j9c9-3mmg/GHSA-3wj6-j9c9-3mmg.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-3wj6-j9c9-3mmg",
-  "modified": "2025-06-18T12:30:53Z",
+  "modified": "2025-11-28T15:30:29Z",
   "published": "2025-06-18T12:30:53Z",
   "aliases": [
     "CVE-2022-50178"
   ],
   "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: 8852a: rfk: fix div 0 exception\n\nThe DPK is a kind of RF calibration whose algorithm is to fine tune\nparameters and calibrate, and check the result. If the result isn't good\nenough, it could adjust parameters and try again.\n\nThis issue is to read and show the result, but it could be a negative\ncalibration result that causes divisor 0 and core dump. So, fix it by\nphy_div() that does division only if divisor isn't zero; otherwise,\nzero is adopted.\n\n  divide error: 0000 [#1] PREEMPT SMP NOPTI\n  CPU: 1 PID: 728 Comm: wpa_supplicant Not tainted 5.10.114-16019-g462a1661811a #1 <HASH:d024 28>\n  RIP: 0010:rtw8852a_dpk+0x14ae/0x288f [rtw89_core]\n  RSP: 0018:ffffa9bb412a7520 EFLAGS: 00010246\n  RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n  RDX: 0000000000000000 RSI: 00000000000180fc RDI: ffffa141d01023c0\n  RBP: ffffa9bb412a76a0 R08: 0000000000001319 R09: 00000000ffffff92\n  R10: ffffffffc0292de3 R11: ffffffffc00d2f51 R12: 0000000000000000\n  R13: ffffa141d01023c0 R14: ffffffffc0290250 R15: ffffa141d0102638\n  FS:  00007fa99f5c2740(0000) GS:ffffa142e5e80000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 0000000013e8e010 CR3: 0000000110d2c000 CR4: 0000000000750ee0\n  PKRU: 55555554\n  Call Trace:\n   rtw89_core_sta_add+0x95/0x9c [rtw89_core <HASH:d239 29>]\n   rtw89_ops_sta_state+0x5d/0x108 [rtw89_core <HASH:d239 29>]\n   drv_sta_state+0x115/0x66f [mac80211 <HASH:81fe 30>]\n   sta_info_insert_rcu+0x45c/0x713 [mac80211 <HASH:81fe 30>]\n   sta_info_insert+0xf/0x1b [mac80211 <HASH:81fe 30>]\n   ieee80211_prep_connection+0x9d6/0xb0c [mac80211 <HASH:81fe 30>]\n   ieee80211_mgd_auth+0x2aa/0x352 [mac80211 <HASH:81fe 30>]\n   cfg80211_mlme_auth+0x160/0x1f6 [cfg80211 <HASH:00cd 31>]\n   nl80211_authenticate+0x2e5/0x306 [cfg80211 <HASH:00cd 31>]\n   genl_rcv_msg+0x371/0x3a1\n   ? nl80211_stop_sched_scan+0xe5/0xe5 [cfg80211 <HASH:00cd 31>]\n   ? genl_rcv+0x36/0x36\n   netlink_rcv_skb+0x8a/0xf9\n   genl_rcv+0x28/0x36\n   netlink_unicast+0x27b/0x3a0\n   netlink_sendmsg+0x2aa/0x469\n   sock_sendmsg_nosec+0x49/0x4d\n   ____sys_sendmsg+0xe5/0x213\n   __sys_sendmsg+0xec/0x157\n   ? syscall_enter_from_user_mode+0xd7/0x116\n   do_syscall_64+0x43/0x55\n   entry_SYSCALL_64_after_hwframe+0x44/0xa9\n  RIP: 0033:0x7fa99f6e689b",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -28,8 +33,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-369"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-06-18T11:15:48Z"

advisories/unreviewed/2025/06/GHSA-729q-4w2j-59v3/GHSA-729q-4w2j-59v3.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-729q-4w2j-59v3",
-  "modified": "2025-06-18T12:30:52Z",
+  "modified": "2025-11-28T15:30:27Z",
   "published": "2025-06-18T12:30:52Z",
   "aliases": [
     "CVE-2022-50170"
   ],
   "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nkunit: executor: Fix a memory leak on failure in kunit_filter_tests\n\nIt's possible that memory allocation for 'filtered' will fail, but for the\ncopy of the suite to succeed. In this case, the copy could be leaked.\n\nProperly free 'copy' in the error case for the allocation of 'filtered'\nfailing.\n\nNote that there may also have been a similar issue in\nkunit_filter_subsuites, before it was removed in \"kunit: flatten\nkunit_suite*** to kunit_suite** in .kunit_test_suites\".\n\nThis was reported by clang-analyzer via the kernel test robot, here:\nhttps://lore.kernel.org/all/[email protected]/\n\nAnd by smatch via Dan Carpenter and the kernel test robot:\nhttps://lore.kernel.org/all/[email protected]/",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -28,8 +33,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-401"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-06-18T11:15:47Z"

advisories/unreviewed/2025/06/GHSA-84c4-xmv6-2wm2/GHSA-84c4-xmv6-2wm2.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-84c4-xmv6-2wm2",
-  "modified": "2025-06-18T12:30:53Z",
+  "modified": "2025-11-28T15:30:29Z",
   "published": "2025-06-18T12:30:53Z",
   "aliases": [
     "CVE-2022-50175"
   ],
   "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: tw686x: Fix memory leak in tw686x_video_init\n\nvideo_device_alloc() allocates memory for vdev,\nwhen video_register_device() fails, it doesn't release the memory and\nleads to memory leak, call video_device_release() to fix this.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -36,8 +41,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-401"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-06-18T11:15:47Z"

advisories/unreviewed/2025/06/GHSA-9qr2-gp6m-mxr4/GHSA-9qr2-gp6m-mxr4.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-9qr2-gp6m-mxr4",
-  "modified": "2025-06-18T12:30:53Z",
+  "modified": "2025-11-28T15:30:28Z",
   "published": "2025-06-18T12:30:53Z",
   "aliases": [
     "CVE-2022-50172"
   ],
   "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmt76: mt76x02u: fix possible memory leak in __mt76x02u_mcu_send_msg\n\nFree the skb if mt76u_bulk_msg fails in __mt76x02u_mcu_send_msg routine.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -36,8 +41,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-401"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-06-18T11:15:47Z"

advisories/unreviewed/2025/06/GHSA-g694-9fmr-cmm3/GHSA-g694-9fmr-cmm3.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-g694-9fmr-cmm3",
-  "modified": "2025-06-18T12:30:53Z",
+  "modified": "2025-11-28T15:30:29Z",
   "published": "2025-06-18T12:30:53Z",
   "aliases": [
     "CVE-2022-50177"
   ],
   "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcutorture: Fix ksoftirqd boosting timing and iteration\n\nThe RCU priority boosting can fail in two situations:\n\n1) If (nr_cpus= > maxcpus=), which means if the total number of CPUs\nis higher than those brought online at boot, then torture_onoff() may\nlater bring up CPUs that weren't online on boot. Now since rcutorture\ninitialization only boosts the ksoftirqds of the CPUs that have been\nset online on boot, the CPUs later set online by torture_onoff won't\nbenefit from the boost, making RCU priority boosting fail.\n\n2) The ksoftirqd kthreads are boosted after the creation of\nrcu_torture_boost() kthreads, which opens a window large enough for these\nrcu_torture_boost() kthreads to wait (despite running at FIFO priority)\nfor ksoftirqds that are still running at SCHED_NORMAL priority.\n\nThe issues can trigger for example with:\n\n\t./kvm.sh --configs TREE01 --kconfig \"CONFIG_RCU_BOOST=y\"\n\n\t[   34.968561] rcu-torture: !!!\n\t[   34.968627] ------------[ cut here ]------------\n\t[   35.014054] WARNING: CPU: 4 PID: 114 at kernel/rcu/rcutorture.c:1979 rcu_torture_stats_print+0x5ad/0x610\n\t[   35.052043] Modules linked in:\n\t[   35.069138] CPU: 4 PID: 114 Comm: rcu_torture_sta Not tainted 5.18.0-rc1 #1\n\t[   35.096424] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.14.0-0-g155821a-rebuilt.opensuse.org 04/01/2014\n\t[   35.154570] RIP: 0010:rcu_torture_stats_print+0x5ad/0x610\n\t[   35.198527] Code: 63 1b 02 00 74 02 0f 0b 48 83 3d 35 63 1b 02 00 74 02 0f 0b 48 83 3d 21 63 1b 02 00 74 02 0f 0b 48 83 3d 0d 63 1b 02 00 74 02 <0f> 0b 83 eb 01 0f 8e ba fc ff ff 0f 0b e9 b3 fc ff f82\n\t[   37.251049] RSP: 0000:ffffa92a0050bdf8 EFLAGS: 00010202\n\t[   37.277320] rcu: De-offloading 8\n\t[   37.290367] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000001\n\t[   37.290387] RDX: 0000000000000000 RSI: 00000000ffffbfff RDI: 00000000ffffffff\n\t[   37.290398] RBP: 000000000000007b R08: 0000000000000000 R09: c0000000ffffbfff\n\t[   37.290407] R10: 000000000000002a R11: ffffa92a0050bc18 R12: ffffa92a0050be20\n\t[   37.290417] R13: ffffa92a0050be78 R14: 0000000000000000 R15: 000000000001bea0\n\t[   37.290427] FS:  0000000000000000(0000) GS:ffff96045eb00000(0000) knlGS:0000000000000000\n\t[   37.290448] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n\t[   37.290460] CR2: 0000000000000000 CR3: 000000001dc0c000 CR4: 00000000000006e0\n\t[   37.290470] Call Trace:\n\t[   37.295049]  <TASK>\n\t[   37.295065]  ? preempt_count_add+0x63/0x90\n\t[   37.295095]  ? _raw_spin_lock_irqsave+0x12/0x40\n\t[   37.295125]  ? rcu_torture_stats_print+0x610/0x610\n\t[   37.295143]  rcu_torture_stats+0x29/0x70\n\t[   37.295160]  kthread+0xe3/0x110\n\t[   37.295176]  ? kthread_complete_and_exit+0x20/0x20\n\t[   37.295193]  ret_from_fork+0x22/0x30\n\t[   37.295218]  </TASK>\n\nFix this with boosting the ksoftirqds kthreads from the boosting\nhotplug callback itself and before the boosting kthreads are created.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -33,7 +38,7 @@
   ],
   "database_specific": {
     "cwe_ids": [],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-06-18T11:15:48Z"

advisories/unreviewed/2025/06/GHSA-mxqg-5wmf-7c29/GHSA-mxqg-5wmf-7c29.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-mxqg-5wmf-7c29",
-  "modified": "2025-06-18T12:30:53Z",
+  "modified": "2025-11-28T15:30:28Z",
   "published": "2025-06-18T12:30:53Z",
   "aliases": [
     "CVE-2022-50173"
   ],
   "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/mdp5: Fix global state lock backoff\n\nWe need to grab the lock after the early return for !hwpipe case.\nOtherwise, we could have hit contention yet still returned 0.\n\nFixes an issue that the new CONFIG_DRM_DEBUG_MODESET_LOCK stuff flagged\nin CI:\n\n   WARNING: CPU: 0 PID: 282 at drivers/gpu/drm/drm_modeset_lock.c:296 drm_modeset_lock+0xf8/0x154\n   Modules linked in:\n   CPU: 0 PID: 282 Comm: kms_cursor_lega Tainted: G        W         5.19.0-rc2-15930-g875cc8bc536a #1\n   Hardware name: Qualcomm Technologies, Inc. DB820c (DT)\n   pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n   pc : drm_modeset_lock+0xf8/0x154\n   lr : drm_atomic_get_private_obj_state+0x84/0x170\n   sp : ffff80000cfab6a0\n   x29: ffff80000cfab6a0 x28: 0000000000000000 x27: ffff000083bc4d00\n   x26: 0000000000000038 x25: 0000000000000000 x24: ffff80000957ca58\n   x23: 0000000000000000 x22: ffff000081ace080 x21: 0000000000000001\n   x20: ffff000081acec18 x19: ffff80000cfabb80 x18: 0000000000000038\n   x17: 0000000000000000 x16: 0000000000000000 x15: fffffffffffea0d0\n   x14: 0000000000000000 x13: 284e4f5f4e524157 x12: 5f534b434f4c5f47\n   x11: ffff80000a386aa8 x10: 0000000000000029 x9 : ffff80000cfab610\n   x8 : 0000000000000029 x7 : 0000000000000014 x6 : 0000000000000000\n   x5 : 0000000000000001 x4 : ffff8000081ad904 x3 : 0000000000000029\n   x2 : ffff0000801db4c0 x1 : ffff80000cfabb80 x0 : ffff000081aceb58\n   Call trace:\n    drm_modeset_lock+0xf8/0x154\n    drm_atomic_get_private_obj_state+0x84/0x170\n    mdp5_get_global_state+0x54/0x6c\n    mdp5_pipe_release+0x2c/0xd4\n    mdp5_plane_atomic_check+0x2ec/0x414\n    drm_atomic_helper_check_planes+0xd8/0x210\n    drm_atomic_helper_check+0x54/0xb0\n    ...\n   ---[ end trace 0000000000000000 ]---\n   drm_modeset_lock attempting to lock a contended lock without backoff:\n      drm_modeset_lock+0x148/0x154\n      mdp5_get_global_state+0x30/0x6c\n      mdp5_pipe_release+0x2c/0xd4\n      mdp5_plane_atomic_check+0x290/0x414\n      drm_atomic_helper_check_planes+0xd8/0x210\n      drm_atomic_helper_check+0x54/0xb0\n      drm_atomic_check_only+0x4b0/0x8f4\n      drm_atomic_commit+0x68/0xe0\n\nPatchwork: https://patchwork.freedesktop.org/patch/492701/",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -44,8 +49,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-667"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-06-18T11:15:47Z"

advisories/unreviewed/2025/06/GHSA-w89w-9482-vj48/GHSA-w89w-9482-vj48.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-w89w-9482-vj48",
-  "modified": "2025-06-18T12:30:53Z",
+  "modified": "2025-11-28T15:30:29Z",
   "published": "2025-06-18T12:30:52Z",
   "aliases": [
     "CVE-2022-50174"
   ],
   "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hinic: avoid kernel hung in hinic_get_stats64()\n\nWhen using hinic device as a bond slave device, and reading device stats\nof master bond device, the kernel may hung.\n\nThe kernel panic calltrace as follows:\nKernel panic - not syncing: softlockup: hung tasks\nCall trace:\n  native_queued_spin_lock_slowpath+0x1ec/0x31c\n  dev_get_stats+0x60/0xcc\n  dev_seq_printf_stats+0x40/0x120\n  dev_seq_show+0x1c/0x40\n  seq_read_iter+0x3c8/0x4dc\n  seq_read+0xe0/0x130\n  proc_reg_read+0xa8/0xe0\n  vfs_read+0xb0/0x1d4\n  ksys_read+0x70/0xfc\n  __arm64_sys_read+0x20/0x30\n  el0_svc_common+0x88/0x234\n  do_el0_svc+0x2c/0x90\n  el0_svc+0x1c/0x30\n  el0_sync_handler+0xa8/0xb0\n  el0_sync+0x148/0x180\n\nAnd the calltrace of task that actually caused kernel hungs as follows:\n  __switch_to+124\n  __schedule+548\n  schedule+72\n  schedule_timeout+348\n  __down_common+188\n  __down+24\n  down+104\n  hinic_get_stats64+44 [hinic]\n  dev_get_stats+92\n  bond_get_stats+172 [bonding]\n  dev_get_stats+92\n  dev_seq_printf_stats+60\n  dev_seq_show+24\n  seq_read_iter+964\n  seq_read+220\n  proc_reg_read+164\n  vfs_read+172\n  ksys_read+108\n  __arm64_sys_read+28\n  el0_svc_common+132\n  do_el0_svc+40\n  el0_svc+24\n  el0_sync_handler+164\n  el0_sync+324\n\nWhen getting device stats from bond, kernel will call bond_get_stats().\nIt first holds the spinlock bond->stats_lock, and then call\nhinic_get_stats64() to collect hinic device's stats.\nHowever, hinic_get_stats64() calls `down(&nic_dev->mgmt_lock)` to\nprotect its critical section, which may schedule current task out.\nAnd if system is under high pressure, the task cannot be woken up\nimmediately, which eventually triggers kernel hung panic.\n\nSince previous patch has replaced hinic_dev.tx_stats/rx_stats with local\nvariable in hinic_get_stats64(), there is nothing need to be protected\nby lock, so just removing down()/up() is ok.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -36,8 +41,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-667"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-06-18T11:15:47Z"