Skip to content

Commit dda695f

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3hvv-xgr4-fr7x GHSA-3r7x-52q9-w4pw GHSA-43jc-vxjx-v42r GHSA-53c5-74px-fwch GHSA-6f84-p6h5-x3qm GHSA-753r-chc3-hcvj GHSA-cmwh-vhg7-3c9r GHSA-f6mg-77cc-c9pm GHSA-frjr-3w6j-qh2v GHSA-hx26-xg26-jr99 GHSA-jf2p-fggv-v92v GHSA-mr7g-g7q3-wvpx GHSA-pj73-39g5-xmf7 GHSA-q3v6-chw5-g495
1 parent e837c68 commit dda695f

File tree

14 files changed

+151
-55
lines changed

14 files changed

+151
-55
lines changed

‎advisories/unreviewed/2025/05/GHSA-3hvv-xgr4-fr7x/GHSA-3hvv-xgr4-fr7x.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-3hvv-xgr4-fr7x",
4-
"modified": "2025-11-03T21:33:42Z",
4+
"modified": "2025-11-05T18:14:26Z",
55
"published": "2025-05-01T15:31:41Z",
66
"aliases": [
77
"CVE-2025-23159"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: hfi: add a check to handle OOB in sfr region\n\nsfr->buf_size is in shared memory and can be modified by malicious user.\nOOB write is possible when the size is made higher than actual sfr data\nbuffer. Cap the size to allocated size for such cases.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -60,8 +65,10 @@
6065
}
6166
],
6267
"database_specific": {
63-
"cwe_ids": [],
64-
"severity": null,
68+
"cwe_ids": [
69+
"CWE-787"
70+
],
71+
"severity": "MODERATE",
6572
"github_reviewed": false,
6673
"github_reviewed_at": null,
6774
"nvd_published_at": "2025-05-01T13:15:51Z"

‎advisories/unreviewed/2025/05/GHSA-3r7x-52q9-w4pw/GHSA-3r7x-52q9-w4pw.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-3r7x-52q9-w4pw",
4-
"modified": "2025-11-03T21:33:41Z",
4+
"modified": "2025-11-05T18:14:23Z",
55
"published": "2025-05-01T15:31:40Z",
66
"aliases": [
77
"CVE-2025-23145"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix NULL pointer in can_accept_new_subflow\n\nWhen testing valkey benchmark tool with MPTCP, the kernel panics in\n'mptcp_can_accept_new_subflow' because subflow_req->msk is NULL.\n\nCall trace:\n\n mptcp_can_accept_new_subflow (./net/mptcp/subflow.c:63 (discriminator 4)) (P)\n subflow_syn_recv_sock (./net/mptcp/subflow.c:854)\n tcp_check_req (./net/ipv4/tcp_minisocks.c:863)\n tcp_v4_rcv (./net/ipv4/tcp_ipv4.c:2268)\n ip_protocol_deliver_rcu (./net/ipv4/ip_input.c:207)\n ip_local_deliver_finish (./net/ipv4/ip_input.c:234)\n ip_local_deliver (./net/ipv4/ip_input.c:254)\n ip_rcv_finish (./net/ipv4/ip_input.c:449)\n ...\n\nAccording to the debug log, the same req received two SYN-ACK in a very\nshort time, very likely because the client retransmits the syn ack due\nto multiple reasons.\n\nEven if the packets are transmitted with a relevant time interval, they\ncan be processed by the server on different CPUs concurrently). The\n'subflow_req->msk' ownership is transferred to the subflow the first,\nand there will be a risk of a null pointer dereference here.\n\nThis patch fixes this issue by moving the 'subflow_req->msk' under the\n`own_req == true` conditional.\n\nNote that the !msk check in subflow_hmac_valid() can be dropped, because\nthe same check already exists under the own_req mpj branch where the\ncode has been moved to.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -56,8 +61,10 @@
5661
}
5762
],
5863
"database_specific": {
59-
"cwe_ids": [],
60-
"severity": null,
64+
"cwe_ids": [
65+
"CWE-476"
66+
],
67+
"severity": "MODERATE",
6168
"github_reviewed": false,
6269
"github_reviewed_at": null,
6370
"nvd_published_at": "2025-05-01T13:15:50Z"

‎advisories/unreviewed/2025/05/GHSA-43jc-vxjx-v42r/GHSA-43jc-vxjx-v42r.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-43jc-vxjx-v42r",
4-
"modified": "2025-11-03T21:33:41Z",
4+
"modified": "2025-11-05T18:14:24Z",
55
"published": "2025-05-01T15:31:40Z",
66
"aliases": [
77
"CVE-2025-23146"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmfd: ene-kb3930: Fix a potential NULL pointer dereference\n\nThe off_gpios could be NULL. Add missing check in the kb3930_probe().\nThis is similar to the issue fixed in commit b1ba8bcb2d1f\n(\"backlight: hx8357: Fix potential NULL pointer dereference\").\n\nThis was detected by our static analysis tool.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -56,8 +61,10 @@
5661
}
5762
],
5863
"database_specific": {
59-
"cwe_ids": [],
60-
"severity": null,
64+
"cwe_ids": [
65+
"CWE-476"
66+
],
67+
"severity": "MODERATE",
6168
"github_reviewed": false,
6269
"github_reviewed_at": null,
6370
"nvd_published_at": "2025-05-01T13:15:50Z"

‎advisories/unreviewed/2025/05/GHSA-53c5-74px-fwch/GHSA-53c5-74px-fwch.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-53c5-74px-fwch",
4-
"modified": "2025-11-03T21:33:42Z",
4+
"modified": "2025-11-05T18:14:25Z",
55
"published": "2025-05-01T15:31:40Z",
66
"aliases": [
77
"CVE-2025-23151"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: mhi: host: Fix race between unprepare and queue_buf\n\nA client driver may use mhi_unprepare_from_transfer() to quiesce\nincoming data during the client driver's tear down. The client driver\nmight also be processing data at the same time, resulting in a call to\nmhi_queue_buf() which will invoke mhi_gen_tre(). If mhi_gen_tre() runs\nafter mhi_unprepare_from_transfer() has torn down the channel, a panic\nwill occur due to an invalid dereference leading to a page fault.\n\nThis occurs because mhi_gen_tre() does not verify the channel state\nafter locking it. Fix this by having mhi_gen_tre() confirm the channel\nstate is valid, or return error to avoid accessing deinitialized data.\n\n[mani: added stable tag]",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -48,8 +53,10 @@
4853
}
4954
],
5055
"database_specific": {
51-
"cwe_ids": [],
52-
"severity": null,
56+
"cwe_ids": [
57+
"CWE-362"
58+
],
59+
"severity": "MODERATE",
5360
"github_reviewed": false,
5461
"github_reviewed_at": null,
5562
"nvd_published_at": "2025-05-01T13:15:51Z"

‎advisories/unreviewed/2025/05/GHSA-6f84-p6h5-x3qm/GHSA-6f84-p6h5-x3qm.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-6f84-p6h5-x3qm",
4-
"modified": "2025-11-03T21:33:41Z",
4+
"modified": "2025-11-05T18:14:24Z",
55
"published": "2025-05-01T15:31:40Z",
66
"aliases": [
77
"CVE-2025-23147"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: Add NULL pointer check in i3c_master_queue_ibi()\n\nThe I3C master driver may receive an IBI from a target device that has not\nbeen probed yet. In such cases, the master calls `i3c_master_queue_ibi()`\nto queue an IBI work task, leading to \"Unable to handle kernel read from\nunreadable memory\" and resulting in a kernel panic.\n\nTypical IBI handling flow:\n1. The I3C master scans target devices and probes their respective drivers.\n2. The target device driver calls `i3c_device_request_ibi()` to enable IBI\n and assigns `dev->ibi = ibi`.\n3. The I3C master receives an IBI from the target device and calls\n `i3c_master_queue_ibi()` to queue the target device driver’s IBI\n handler task.\n\nHowever, since target device events are asynchronous to the I3C probe\nsequence, step 3 may occur before step 2, causing `dev->ibi` to be `NULL`,\nleading to a kernel panic.\n\nAdd a NULL pointer check in `i3c_master_queue_ibi()` to prevent accessing\nan uninitialized `dev->ibi`, ensuring stability.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -60,8 +65,10 @@
6065
}
6166
],
6267
"database_specific": {
63-
"cwe_ids": [],
64-
"severity": null,
68+
"cwe_ids": [
69+
"CWE-476"
70+
],
71+
"severity": "MODERATE",
6572
"github_reviewed": false,
6673
"github_reviewed_at": null,
6774
"nvd_published_at": "2025-05-01T13:15:50Z"

‎advisories/unreviewed/2025/05/GHSA-753r-chc3-hcvj/GHSA-753r-chc3-hcvj.json‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-753r-chc3-hcvj",
4-
"modified": "2025-11-03T21:33:45Z",
4+
"modified": "2025-11-05T18:14:27Z",
55
"published": "2025-05-01T15:31:44Z",
66
"aliases": [
77
"CVE-2025-37773"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtiofs: add filesystem context source name check\n\nIn certain scenarios, for example, during fuzz testing, the source\nname may be NULL, which could lead to a kernel panic. Therefore, an\nextra check for the source name should be added.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -57,7 +62,7 @@
5762
],
5863
"database_specific": {
5964
"cwe_ids": [],
60-
"severity": null,
65+
"severity": "MODERATE",
6166
"github_reviewed": false,
6267
"github_reviewed_at": null,
6368
"nvd_published_at": "2025-05-01T14:15:40Z"

‎advisories/unreviewed/2025/05/GHSA-cmwh-vhg7-3c9r/GHSA-cmwh-vhg7-3c9r.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-cmwh-vhg7-3c9r",
4-
"modified": "2025-11-03T21:33:41Z",
4+
"modified": "2025-11-05T18:14:24Z",
55
"published": "2025-05-01T15:31:40Z",
66
"aliases": [
77
"CVE-2025-23148"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe()\n\nsoc_dev_attr->revision could be NULL, thus,\na pointer check is added to prevent potential NULL pointer dereference.\nThis is similar to the fix in commit 3027e7b15b02\n(\"ice: Fix some null pointer dereference issues in ice_ptp.c\").\n\nThis issue is found by our static analysis tool.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -56,8 +61,10 @@
5661
}
5762
],
5863
"database_specific": {
59-
"cwe_ids": [],
60-
"severity": null,
64+
"cwe_ids": [
65+
"CWE-476"
66+
],
67+
"severity": "MODERATE",
6168
"github_reviewed": false,
6269
"github_reviewed_at": null,
6370
"nvd_published_at": "2025-05-01T13:15:50Z"

‎advisories/unreviewed/2025/05/GHSA-f6mg-77cc-c9pm/GHSA-f6mg-77cc-c9pm.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-f6mg-77cc-c9pm",
4-
"modified": "2025-11-03T21:33:42Z",
4+
"modified": "2025-11-05T18:14:25Z",
55
"published": "2025-05-01T15:31:41Z",
66
"aliases": [
77
"CVE-2025-23158"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: hfi: add check to handle incorrect queue size\n\nqsize represents size of shared queued between driver and video\nfirmware. Firmware can modify this value to an invalid large value. In\nsuch situation, empty_space will be bigger than the space actually\navailable. Since new_wr_idx is not checked, so the following code will\nresult in an OOB write.\n...\nqsize = qhdr->q_size\n\nif (wr_idx >= rd_idx)\n empty_space = qsize - (wr_idx - rd_idx)\n....\nif (new_wr_idx < qsize) {\n memcpy(wr_ptr, packet, dwords << 2) --> OOB write\n\nAdd check to ensure qsize is within the allocated size while\nreading and writing packets into the queue.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -60,8 +65,10 @@
6065
}
6166
],
6267
"database_specific": {
63-
"cwe_ids": [],
64-
"severity": null,
68+
"cwe_ids": [
69+
"CWE-787"
70+
],
71+
"severity": "HIGH",
6572
"github_reviewed": false,
6673
"github_reviewed_at": null,
6774
"nvd_published_at": "2025-05-01T13:15:51Z"

‎advisories/unreviewed/2025/05/GHSA-frjr-3w6j-qh2v/GHSA-frjr-3w6j-qh2v.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-frjr-3w6j-qh2v",
4-
"modified": "2025-11-03T21:33:45Z",
4+
"modified": "2025-11-05T18:14:26Z",
55
"published": "2025-05-01T15:31:44Z",
66
"aliases": [
77
"CVE-2025-37772"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cma: Fix workqueue crash in cma_netevent_work_handler\n\nstruct rdma_cm_id has member \"struct work_struct net_work\"\nthat is reused for enqueuing cma_netevent_work_handler()s\nonto cma_wq.\n\nBelow crash[1] can occur if more than one call to\ncma_netevent_callback() occurs in quick succession,\nwhich further enqueues cma_netevent_work_handler()s for the\nsame rdma_cm_id, overwriting any previously queued work-item(s)\nthat was just scheduled to run i.e. there is no guarantee\nthe queued work item may run between two successive calls\nto cma_netevent_callback() and the 2nd INIT_WORK would overwrite\nthe 1st work item (for the same rdma_cm_id), despite grabbing\nid_table_lock during enqueue.\n\nAlso drgn analysis [2] indicates the work item was likely overwritten.\n\nFix this by moving the INIT_WORK() to __rdma_create_id(),\nso that it doesn't race with any existing queue_work() or\nits worker thread.\n\n[1] Trimmed crash stack:\n=============================================\nBUG: kernel NULL pointer dereference, address: 0000000000000008\nkworker/u256:6 ... 6.12.0-0...\nWorkqueue: cma_netevent_work_handler [rdma_cm] (rdma_cm)\nRIP: 0010:process_one_work+0xba/0x31a\nCall Trace:\n worker_thread+0x266/0x3a0\n kthread+0xcf/0x100\n ret_from_fork+0x31/0x50\n ret_from_fork_asm+0x1a/0x30\n=============================================\n\n[2] drgn crash analysis:\n\n>>> trace = prog.crashed_thread().stack_trace()\n>>> trace\n(0) crash_setup_regs (./arch/x86/include/asm/kexec.h:111:15)\n(1) __crash_kexec (kernel/crash_core.c:122:4)\n(2) panic (kernel/panic.c:399:3)\n(3) oops_end (arch/x86/kernel/dumpstack.c:382:3)\n...\n(8) process_one_work (kernel/workqueue.c:3168:2)\n(9) process_scheduled_works (kernel/workqueue.c:3310:3)\n(10) worker_thread (kernel/workqueue.c:3391:4)\n(11) kthread (kernel/kthread.c:389:9)\n\nLine workqueue.c:3168 for this kernel version is in process_one_work():\n3168\tstrscpy(worker->desc, pwq->wq->name, WORKER_DESC_LEN);\n\n>>> trace[8][\"work\"]\n*(struct work_struct *)0xffff92577d0a21d8 = {\n\t.data = (atomic_long_t){\n\t\t.counter = (s64)536870912, <=== Note\n\t},\n\t.entry = (struct list_head){\n\t\t.next = (struct list_head *)0xffff924d075924c0,\n\t\t.prev = (struct list_head *)0xffff924d075924c0,\n\t},\n\t.func = (work_func_t)cma_netevent_work_handler+0x0 = 0xffffffffc2cec280,\n}\n\nSuspicion is that pwq is NULL:\n>>> trace[8][\"pwq\"]\n(struct pool_workqueue *)<absent>\n\nIn process_one_work(), pwq is assigned from:\nstruct pool_workqueue *pwq = get_work_pwq(work);\n\nand get_work_pwq() is:\nstatic struct pool_workqueue *get_work_pwq(struct work_struct *work)\n{\n \tunsigned long data = atomic_long_read(&work->data);\n\n \tif (data & WORK_STRUCT_PWQ)\n \t\treturn work_struct_pwq(data);\n \telse\n \t\treturn NULL;\n}\n\nWORK_STRUCT_PWQ is 0x4:\n>>> print(repr(prog['WORK_STRUCT_PWQ']))\nObject(prog, 'enum work_flags', value=4)\n\nBut work->data is 536870912 which is 0x20000000.\nSo, get_work_pwq() returns NULL and we crash in process_one_work():\n3168\tstrscpy(worker->desc, pwq->wq->name, WORKER_DESC_LEN);\n=============================================",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -40,8 +45,10 @@
4045
}
4146
],
4247
"database_specific": {
43-
"cwe_ids": [],
44-
"severity": null,
48+
"cwe_ids": [
49+
"CWE-476"
50+
],
51+
"severity": "MODERATE",
4552
"github_reviewed": false,
4653
"github_reviewed_at": null,
4754
"nvd_published_at": "2025-05-01T14:15:40Z"

‎advisories/unreviewed/2025/05/GHSA-hx26-xg26-jr99/GHSA-hx26-xg26-jr99.json‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-hx26-xg26-jr99",
4-
"modified": "2025-11-03T21:33:42Z",
4+
"modified": "2025-11-05T18:14:25Z",
55
"published": "2025-05-01T15:31:41Z",
66
"aliases": [
77
"CVE-2025-23156"
88
],
99
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: hfi_parser: refactor hfi packet parsing logic\n\nwords_count denotes the number of words in total payload, while data\npoints to payload of various property within it. When words_count\nreaches last word, data can access memory beyond the total payload. This\ncan lead to OOB access. With this patch, the utility api for handling\nindividual properties now returns the size of data consumed. Accordingly\nremaining bytes are calculated before parsing the payload, thereby\neliminates the OOB access possibilities.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -56,8 +61,10 @@
5661
}
5762
],
5863
"database_specific": {
59-
"cwe_ids": [],
60-
"severity": null,
64+
"cwe_ids": [
65+
"CWE-125"
66+
],
67+
"severity": "HIGH",
6168
"github_reviewed": false,
6269
"github_reviewed_at": null,
6370
"nvd_published_at": "2025-05-01T13:15:51Z"

0 commit comments

Comments
 (0)