Instruction: Please provide detailed information about CVE-2025-21626

CVE:CVE-2025-21626
Description:GLPI is a free asset and IT management software package. Starting in version 0.71 and prior to version 10.0.18, an anonymous user can fetch sensitive information from the `status.php` endpoint. Version 10.0.18 contains a fix for the issue. Some workarounds are available. One may delete the `status.php` file, restrict its access, or remove any sensitive values from the `name` field of the active LDAP directories, mail servers authentication providers and mail receivers.
published:2025-02-25T16:15:37.663


Instruction: Please provide detailed information about CVE-2025-21627

CVE:CVE-2025-21627
Description:GLPI is a free asset and IT management software package. In versions prior to 10.0.18, a malicious link can be crafted to perform a reflected XSS attack on the search page. If the anonymous ticket creation is enabled, this attack can be performed by an unauthenticated user. Version 10.0.18 contains a fix for the issue.
published:2025-02-25T16:15:37.863


Instruction: Please provide detailed information about CVE-2025-23024

CVE:CVE-2025-23024
Description:GLPI is a free asset and IT management software package. Starting in version 0.72 and prior to version 10.0.18, an anonymous user can disable all the active plugins. Version 10.0.18 contains a patch. As a workaround, one may delete the `install/update.php` file.
published:2025-02-25T16:15:38.053


Instruction: Please provide detailed information about CVE-2025-26594

CVE:CVE-2025-26594
Description:A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free.
published:2025-02-25T16:15:38.227


Instruction: Please provide detailed information about CVE-2025-26595

CVE:CVE-2025-26595
Description:A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size.
published:2025-02-25T16:15:38.390


Instruction: Please provide detailed information about CVE-2025-26596

CVE:CVE-2025-26596
Description:A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms() differs from what is written in XkbWriteKeySyms(), which may lead to a heap-based buffer overflow.
published:2025-02-25T16:15:38.603


Instruction: Please provide detailed information about CVE-2025-26597

CVE:CVE-2025-26597
Description:A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because the key actions are of the wrong size.
published:2025-02-25T16:15:38.797


Instruction: Please provide detailed information about CVE-2025-26598

CVE:CVE-2025-26598
Description:An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching device ID is found, which can lead to out-of-bounds memory access.
published:2025-02-25T16:15:38.977


Instruction: Please provide detailed information about CVE-2025-26599

CVE:CVE-2025-26599
Description:An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later.
published:2025-02-25T16:15:39.163


Instruction: Please provide detailed information about CVE-2025-26600

CVE:CVE-2025-26600
Description:A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free.
published:2025-02-25T16:15:39.350


Instruction: Please provide detailed information about CVE-2025-26601

CVE:CVE-2025-26601
Description:A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually, SyncInitTrigger() is called. If one of the changes triggers an error, the function will return early, not adding the new sync object, possibly causing a use-after-free when the alarm eventually triggers.
published:2025-02-25T16:15:39.537


Instruction: Please provide detailed information about CVE-2025-1067

CVE:CVE-2025-1067
Description:There is an untrusted search path vulnerability in Esri ArcGIS Pro 3.3 and 3.4 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the filesystem. When the victim performs a specific action using ArcGIS ArcGIS Pro, the file could execute and run malicious commands under the context of the victim. This issue is addressed in ArcGIS Pro 3.3.3 and 3.4.1.
published:2025-02-25T17:15:13.717


Instruction: Please provide detailed information about CVE-2025-1068

CVE:CVE-2025-1068
Description:There is an untrusted search path vulnerability in Esri ArcGIS AllSource 1.2 and 1.3 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the filesystem. When the victim performs a specific action using ArcGIS AllSource, the file could execute and run malicious commands under the context of the victim. This issue is corrected in ArcGIS AllSource 1.2.1 and 1.3.1.
published:2025-02-25T17:15:13.890


Instruction: Please provide detailed information about CVE-2025-1204

CVE:CVE-2025-1204
Description:The "update" binary in the firmware of the affected product sends attempts to mount to a hard-coded, routable IP address, bypassing existing device network settings to do so. The function triggers if the 'C' button is pressed at a specific time during the boot process. If an attacker is able to control or impersonate this IP address, they could upload and overwrite files on the device.
published:2025-02-25T17:15:14.057


Instruction: Please provide detailed information about CVE-2025-23046

CVE:CVE-2025-23046
Description:GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.18, if a "Mail servers" authentication provider is configured to use an Oauth connection provided by the OauthIMAP plugin, anyone can connect to GLPI using a user name on which an Oauth authorization has already been established. Version 10.0.18 contains a patch. As a workaround, one may disable any "Mail servers" authentication provider configured to use an Oauth connection provided by the OauthIMAP plugin.
published:2025-02-25T18:15:27.383


Instruction: Please provide detailed information about CVE-2025-25192

CVE:CVE-2025-25192
Description:GLPI is a free asset and IT management software package. Prior to version 10.0.18, a low privileged user can enable debug mode and access sensitive information. Version 10.0.18 contains a patch. As a workaround, one may delete the `install/update.php` file.
published:2025-02-25T18:15:27.583


Instruction: Please provide detailed information about CVE-2025-27135

CVE:CVE-2025-27135
Description:RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Versions 0.15.1 and prior are vulnerable to SQL injection. The ExeSQL component extracts the SQL statement from the input and sends it directly to the database query. As of time of publication, no patched version is available.
published:2025-02-25T19:15:15.677


Instruction: Please provide detailed information about CVE-2025-27110

CVE:CVE-2025-27110
Description:Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13 means that, in 3.0.13, Libmodsecurity3 can't decode encoded HTML entities if they contains leading zeroes. Version 3.0.14 contains a fix. No known workarounds are available.
published:2025-02-25T20:15:37.517


Instruction: Please provide detailed information about CVE-2025-27139

CVE:CVE-2025-27139
Description:Combodo iTop is a web based IT service management tool. Versions prior to 2.7.12, 3.1.2, and 3.2.0 are vulnerable to cross-site scripting when the preferences page is opened. Versions 2.7.12, 3.1.2, and 3.2.0 fix the issue.
published:2025-02-25T20:15:37.693


Instruction: Please provide detailed information about CVE-2025-27142

CVE:CVE-2025-27142
Description:LocalSend is a free, open-source app that allows users to securely share files and messages with nearby devices over their local network without needing an internet connection. Prior to version 1.17.0, due to the missing sanitization of the path in the `POST /api/localsend/v2/prepare-upload` and the `POST /api/localsend/v2/upload` endpoint, a malicious file transfer request can write files to the arbitrary location on the system, resulting in the remote command execution. A malicious file transfer request sent by nearby devices can write files into an arbitrary directory. This usually allows command execution via the startup folder on Windows or Bash-related files on Linux. If the user enables the `Quick Save` feature, it will silently write files without explicit user interaction. Version 1.17.0 fixes this issue.
published:2025-02-25T20:15:37.847


Instruction: Please provide detailed information about CVE-2025-27146

CVE:CVE-2025-27146
Description:matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user. The vulnerability has been patched in matrix-appservice-irc version 3.0.4.
published:2025-02-25T20:15:38.030


Instruction: Please provide detailed information about CVE-2025-27148

CVE:CVE-2025-27148
Description:Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. On Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. This library initialization could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreating files in the system temporary directory. Gradle builds that rely on versions of net.rubygrapefruit:native-platform prior to 0.22-milestone-28 could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreating files in the system temporary directory.  In net.rubygrapefruit:native-platform prior to version 0.22-milestone-28, if the `Native.get(Class<>)` method was called, without calling `Native.init(File)` first, with a non-`null` argument used as working file path, then the library would initialize itself using the system temporary directory and NativeLibraryLocator.java lines 68 through 78. Version 0.22-milestone-28 has been released with changes that fix the problem. Initialization is now mandatory and no longer uses the system temporary directory, unless such a path is passed for initialization. The only workaround for affected versions is to make sure to do a proper initialization, using a location that is safe.  Gradle 8.12, only that exact version, had codepaths where the initialization of the underlying native integration library took a default path, relying on copying the binaries to the system temporary directory. Any execution of Gradle exposed this exploit. Users of Windows or modern versions of macOS are not vulnerable, nor are users of a Unix-like operating system with the "sticky" bit set or `noexec` on their system temporary directory vulnerable. This problem was fixed in Gradle 8.12.1. Gradle 8.13 release also upgrades to a version of the native library that no longer has that bug. Some workarounds are available. On Unix-like operating systems, ensure that the "sticky" bit is set. This only allows the original user (or root) to delete a file. Mounting `/tmp` as `noexec` will prevent Gradle 8.12 from starting. Those who are are unable to change the permissions of the system temporary directory can move the Java temporary directory by setting the System Property java.io.tmpdir. The new path needs to limit permissions to the build user only.
published:2025-02-25T21:15:18.073


Instruction: Please provide detailed information about CVE-2025-0514

CVE:CVE-2025-0514
Description:Improper Input Validation vulnerability in The Document Foundation LibreOffice allows Windows Executable hyperlink  targets to be executed unconditionally on activation.This issue affects LibreOffice: from 24.8 before < 24.8.5.
published:2025-02-25T22:15:14.887


Instruction: Please provide detailed information about CVE-2025-22211

CVE:CVE-2025-22211
Description:A SQL injection vulnerability in the JoomShopping component versions 1.0.0-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the country management area in backend.
published:2025-02-25T22:15:15.200


Instruction: Please provide detailed information about CVE-2025-25514

CVE:CVE-2025-25514
Description:Seacms <=13.3 is vulnerable to SQL Injection in admin_collect_news.php.
published:2025-02-25T22:15:23.900


Instruction: Please provide detailed information about CVE-2025-25515

CVE:CVE-2025-25515
Description:Seacms <=13.3 is vulnerable to SQL Injection in admin_collect.php that allows an authenticated attacker to exploit the database.
published:2025-02-25T22:15:23.983


Instruction: Please provide detailed information about CVE-2025-25516

CVE:CVE-2025-25516
Description:Seacms <=13.3 is vulnerable to SQL Injection in admin_paylog.php.
published:2025-02-25T22:15:24.067


Instruction: Please provide detailed information about CVE-2025-25517

CVE:CVE-2025-25517
Description:Seacms <=13.3 is vulnerable to SQL Injection in admin_reslib.php.
published:2025-02-25T22:15:24.160


Instruction: Please provide detailed information about CVE-2025-25519

CVE:CVE-2025-25519
Description:Seacms <=13.3 is vulnerable to SQL Injection in admin_zyk.php.
published:2025-02-25T22:15:24.257


Instruction: Please provide detailed information about CVE-2025-25520

CVE:CVE-2025-25520
Description:Seacms <13.3 is vulnerable to SQL Injection in admin_pay.php.
published:2025-02-25T22:15:24.340


Instruction: Please provide detailed information about CVE-2025-25521

CVE:CVE-2025-25521
Description:Seacms <=13.3 is vulnerable to SQL Injection in admin_type_news.php.
published:2025-02-25T22:15:24.430


Instruction: Please provide detailed information about CVE-2025-0760

CVE:CVE-2025-0760
Description:A Credential Disclosure vulnerability exists where an administrator could extract the stored SMTP account credentials due to lack of encryption.
published:2025-02-26T00:15:10.890


Instruction: Please provide detailed information about CVE-2025-1091

CVE:CVE-2025-1091
Description:A Broken Authorization schema exists where any authenticated user could download IOA script and configuration files if the URL is known.
published:2025-02-26T00:15:11.250


Instruction: Please provide detailed information about CVE-2025-0234

CVE:CVE-2025-0234
Description:Out-of-bounds vulnerability in curve segmentation processing of Generic PCL6 V4 Printer Driver / Generic UFR II V4 Printer Driver / Generic LIPSLX V4 Printer Driver.
published:2025-02-26T08:12:46.393


Instruction: Please provide detailed information about CVE-2025-0235

CVE:CVE-2025-0235
Description:Out-of-bounds vulnerability due to improper memory release during image rendering in Generic PCL6 V4 Printer Driver / Generic UFR II V4 Printer Driver / Generic LIPSLX V4 Printer Driver.
published:2025-02-26T08:12:46.617


Instruction: Please provide detailed information about CVE-2025-0236

CVE:CVE-2025-0236
Description:Out-of-bounds vulnerability in slope processing during curve rendering in Generic PCL6 V4 Printer Driver / Generic UFR II V4 Printer Driver / Generic LIPSLX V4 Printer Driver.
published:2025-02-26T08:12:46.730


Instruction: Please provide detailed information about CVE-2025-0889

CVE:CVE-2025-0889
Description:Prior to 25.2, a local authenticated attacker can elevate privileges on a system with Privilege Management for Windows installed, via the manipulation of COM objects under certain circumstances where an EPM policy allows for automatic privilege elevation of a user process.
published:2025-02-26T08:13:09.050


Instruction: Please provide detailed information about CVE-2025-22868

CVE:CVE-2025-22868
Description:An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.
published:2025-02-26T08:14:24.897


Instruction: Please provide detailed information about CVE-2025-22869

CVE:CVE-2025-22869
Description:SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.
published:2025-02-26T08:14:24.997


Instruction: Please provide detailed information about CVE-2025-22881

CVE:CVE-2025-22881
Description:Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process.
published:2025-02-26T08:14:25.137


Instruction: Please provide detailed information about CVE-2025-0731

CVE:CVE-2025-0731
Description:An unauthenticated remote attacker can upload a .aspx file instead of a PV system picture through the demo account. The code can only be executed in the security context of the user.
published:2025-02-26T13:15:41.040


Instruction: Please provide detailed information about CVE-2025-1517

CVE:CVE-2025-1517
Description:The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text, Countdown Widget, and Login Form shortcodes in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-02-26T13:15:41.193


Instruction: Please provide detailed information about CVE-2025-26698

CVE:CVE-2025-26698
Description:Incorrect resource transfer between spheres issue exists in RevoWorks SCVX and RevoWorks Browser. If exploited, malicious files may be downloaded to the system where using the product.
published:2025-02-26T13:15:41.983


Instruction: Please provide detailed information about CVE-2025-0719

CVE:CVE-2025-0719
Description:IBM Cloud Pak for Data 4.0.0 through 4.8.5 and 5.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
published:2025-02-26T14:15:11.587


Instruction: Please provide detailed information about CVE-2025-26925

CVE:CVE-2025-26925
Description:Cross-Site Request Forgery (CSRF) vulnerability in Required Admin Menu Manager allows Cross Site Request Forgery.This issue affects Admin Menu Manager: from n/a through 1.0.3.
published:2025-02-26T14:15:11.743


Instruction: Please provide detailed information about CVE-2025-1249

CVE:CVE-2025-1249
Description:Missing Authorization vulnerability in Pixelite Events Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Events Manager: from n/a through 6.6.4.1.
published:2025-02-26T15:15:24.470


Instruction: Please provide detailed information about CVE-2025-1716

CVE:CVE-2025-1716
Description:picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses Pickle to pull in a malicious PyPI package (hosted, for example, on pypi.org or GitHub) via `pip.main()`. Because pip is not a restricted global, the model, when scanned with picklescan, would pass security checks and appear to be safe, when it could instead prove to be problematic.
published:2025-02-26T15:15:24.653


Instruction: Please provide detailed information about CVE-2025-25783

CVE:CVE-2025-25783
Description:An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted Zip file.
published:2025-02-26T15:15:26.440


Instruction: Please provide detailed information about CVE-2025-25784

CVE:CVE-2025-25784
Description:An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to execute arbitrary code via uploading a crafted Zip file.
published:2025-02-26T15:15:26.580


Instruction: Please provide detailed information about CVE-2025-25785

CVE:CVE-2025-25785
Description:JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component \c\PluginsController.php. This vulnerability allows attackers to perform an intranet scan via a crafted request.
published:2025-02-26T15:15:26.720


Instruction: Please provide detailed information about CVE-2025-25789

CVE:CVE-2025-25789
Description:FoxCMS v1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the index() method at \controller\Sitemap.php.
published:2025-02-26T15:15:26.853


Instruction: Please provide detailed information about CVE-2025-25790

CVE:CVE-2025-25790
Description:An arbitrary file upload vulnerability in the component \controller\LocalTemplate.php of FoxCMS v1.2.5 allows attackers to execute arbitrary code via uploading a crafted Zip file.
published:2025-02-26T15:15:26.980


Instruction: Please provide detailed information about CVE-2025-25791

CVE:CVE-2025-25791
Description:An arbitrary file upload vulnerability in the plugin installation feature of YZNCMS v2.0.1 allows attackers to execute arbitrary code via uploading a crafted Zip file.
published:2025-02-26T15:15:27.100


Instruction: Please provide detailed information about CVE-2025-25792

CVE:CVE-2025-25792
Description:SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the isopen parameter at admin_weixin.php.
published:2025-02-26T15:15:27.230


Instruction: Please provide detailed information about CVE-2025-25793

CVE:CVE-2025-25793
Description:SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_notify.php.
published:2025-02-26T15:15:27.367


Instruction: Please provide detailed information about CVE-2025-25794

CVE:CVE-2025-25794
Description:SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ping.php.
published:2025-02-26T15:15:27.490


Instruction: Please provide detailed information about CVE-2025-25796

CVE:CVE-2025-25796
Description:SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_template.php.
published:2025-02-26T15:15:27.620


Instruction: Please provide detailed information about CVE-2025-25797

CVE:CVE-2025-25797
Description:SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_smtp.php.
published:2025-02-26T15:15:27.743


Instruction: Please provide detailed information about CVE-2025-25799

CVE:CVE-2025-25799
Description:SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe.php.
published:2025-02-26T15:15:27.870


Instruction: Please provide detailed information about CVE-2025-25800

CVE:CVE-2025-25800
Description:SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe_file.php.
published:2025-02-26T15:15:27.993


Instruction: Please provide detailed information about CVE-2025-25802

CVE:CVE-2025-25802
Description:SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ip.php.
published:2025-02-26T15:15:28.127


Instruction: Please provide detailed information about CVE-2025-25813

CVE:CVE-2025-25813
Description:SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_files.php.
published:2025-02-26T15:15:28.250


Instruction: Please provide detailed information about CVE-2025-25818

CVE:CVE-2025-25818
Description:A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the postStrVar function at article_save.php.
published:2025-02-26T15:15:28.367


Instruction: Please provide detailed information about CVE-2025-25823

CVE:CVE-2025-25823
Description:A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the article header at /admin/article.php.
published:2025-02-26T15:15:28.497


Instruction: Please provide detailed information about CVE-2025-25825

CVE:CVE-2025-25825
Description:A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Titile in the article category section.
published:2025-02-26T15:15:28.620


Instruction: Please provide detailed information about CVE-2025-25827

CVE:CVE-2025-25827
Description:A Server-Side Request Forgery (SSRF) in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL.
published:2025-02-26T15:15:28.747


Instruction: Please provide detailed information about CVE-2025-25462

CVE:CVE-2025-25462
Description:A SQL Injection vulnerability was found in /admin/add-propertytype.php in PHPGurukul Land Record System Project in PHP v1.0 allows remote attackers to execute arbitrary code via the propertytype POST request parameter.
published:2025-02-26T16:15:16.933


Instruction: Please provide detailed information about CVE-2025-0941

CVE:CVE-2025-0941
Description:MET ONE 3400+ instruments running software v1.0.41 can, under rare conditions, temporarily store credentials in plain text within the system. This data is not available to unauthenticated users.
published:2025-02-26T17:15:21.910


Instruction: Please provide detailed information about CVE-2025-1634

CVE:CVE-2025-1634
Description:A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.
published:2025-02-26T17:15:22.083


Instruction: Please provide detailed information about CVE-2025-20111

CVE:CVE-2025-20111
Description:A vulnerability in the health monitoring diagnostics of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, adjacent attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

 This vulnerability is due to the incorrect handling of specific Ethernet frames. An attacker could exploit this vulnerability by sending a sustained rate of crafted Ethernet frames to an affected device. A successful exploit could allow the attacker to cause the device to reload.
published:2025-02-26T17:15:22.240


Instruction: Please provide detailed information about CVE-2025-20116

CVE:CVE-2025-20116
Description:A vulnerability in the web UI of Cisco APIC could allow an authenticated, remote attacker to perform a stored XSS attack on an affected system. To exploit this vulnerability, the attacker must have valid administrative credentials.

 This vulnerability is due to improper input validation in the web UI. An authenticated attacker could exploit this vulnerability by injecting malicious code into specific pages of the web UI. A successful exploit could allow the attacker to execute arbitrary script code in the context of the web UI or access sensitive, browser-based information.
published:2025-02-26T17:15:22.403


Instruction: Please provide detailed information about CVE-2025-20117

CVE:CVE-2025-20117
Description:A vulnerability in the CLI of Cisco APIC could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.

 This vulnerability is due to insufficient validation of arguments that are passed to specific CLI commands. An attacker could exploit this vulnerability by including crafted input as the argument of an affected CLI command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of root.
published:2025-02-26T17:15:22.567


Instruction: Please provide detailed information about CVE-2025-20118

CVE:CVE-2025-20118
Description:A vulnerability in the implementation of the internal system processes of Cisco APIC could allow an authenticated, local attacker to access sensitive information on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.

 This vulnerability is due to insufficient masking of sensitive information that is displayed through system CLI commands. An attacker could exploit this vulnerability by using reconnaissance techniques at the device CLI. A successful exploit could allow the attacker to access sensitive information on an affected device that could be used for additional attacks.
published:2025-02-26T17:15:22.723


Instruction: Please provide detailed information about CVE-2025-20119

CVE:CVE-2025-20119
Description:A vulnerability in the system file permission handling of Cisco APIC could allow an authenticated, local attacker to overwrite critical system files, which could cause a DoS condition. To exploit this vulnerability, the attacker must have valid administrative credentials.

 This vulnerability is due to a race condition with handling system files. An attacker could exploit this vulnerability by doing specific operations on the file system. A successful exploit could allow the attacker to overwrite system files, which could lead to the device being in an inconsistent state and cause a DoS condition.
published:2025-02-26T17:15:22.883


Instruction: Please provide detailed information about CVE-2025-20161

CVE:CVE-2025-20161
Description:A vulnerability in the software upgrade process of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, local attacker with valid Administrator credentials to execute a command injection attack on the underlying operating system of an affected device.

 This vulnerability is due to insufficient validation of specific elements within a software image. An attacker could exploit this vulnerability by installing a crafted image. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.
 Note: Administrators should validate the hash of any software image before installation.
published:2025-02-26T17:15:23.053


Instruction: Please provide detailed information about CVE-2025-1726

CVE:CVE-2025-1726
Description:There is a SQL injection issue in Esri ArcGIS Monitor versions 2023.0 through 2024.x on Windows and Linux that allows a remote, authenticated attacker with low privileges to improperly read limited database schema information by passing crafted queries. While it is possible to enumerate some internal database identifiers, the impact to the confidentiality vector is "LOW' because any sensitive data returned in a response is encrypted. There is no evidence of impact to the integrity or availability vectors. This issue is addressed in ArcGIS Monitor 2024.1.
published:2025-02-26T20:15:13.510


Instruction: Please provide detailed information about CVE-2025-1728

CVE:CVE-2025-1728
Description:Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
published:2025-02-26T22:15:14.333


Instruction: Please provide detailed information about CVE-2025-1460

CVE:CVE-2025-1460
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-02-26T23:15:10.193


Instruction: Please provide detailed information about CVE-2025-21705

CVE:CVE-2025-21705
Description:In the Linux kernel, the following vulnerability has been resolved:  mptcp: handle fastopen disconnect correctly  Syzbot was able to trigger a data stream corruption:    WARNING: CPU: 0 PID: 9846 at net/mptcp/protocol.c:1024 __mptcp_clean_una+0xddb/0xff0 net/mptcp/protocol.c:1024   Modules linked in:   CPU: 0 UID: 0 PID: 9846 Comm: syz-executor351 Not tainted 6.13.0-rc2-syzkaller-00059-g00a5acdbf398 #0   Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024   RIP: 0010:__mptcp_clean_una+0xddb/0xff0 net/mptcp/protocol.c:1024   Code: fa ff ff 48 8b 4c 24 18 80 e1 07 fe c1 38 c1 0f 8c 8e fa ff ff 48 8b 7c 24 18 e8 e0 db 54 f6 e9 7f fa ff ff e8 e6 80 ee f5 90 <0f> 0b 90 4c 8b 6c 24 40 4d 89 f4 e9 04 f5 ff ff 44 89 f1 80 e1 07   RSP: 0018:ffffc9000c0cf400 EFLAGS: 00010293   RAX: ffffffff8bb0dd5a RBX: ffff888033f5d230 RCX: ffff888059ce8000   RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000   RBP: ffffc9000c0cf518 R08: ffffffff8bb0d1dd R09: 1ffff110170c8928   R10: dffffc0000000000 R11: ffffed10170c8929 R12: 0000000000000000   R13: ffff888033f5d220 R14: dffffc0000000000 R15: ffff8880592b8000   FS:  00007f6e866496c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033   CR2: 00007f6e86f491a0 CR3: 00000000310e6000 CR4: 00000000003526f0   DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000   DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400   Call Trace:    <TASK>    __mptcp_clean_una_wakeup+0x7f/0x2d0 net/mptcp/protocol.c:1074    mptcp_release_cb+0x7cb/0xb30 net/mptcp/protocol.c:3493    release_sock+0x1aa/0x1f0 net/core/sock.c:3640    inet_wait_for_connect net/ipv4/af_inet.c:609 [inline]    __inet_stream_connect+0x8bd/0xf30 net/ipv4/af_inet.c:703    mptcp_sendmsg_fastopen+0x2a2/0x530 net/mptcp/protocol.c:1755    mptcp_sendmsg+0x1884/0x1b10 net/mptcp/protocol.c:1830    sock_sendmsg_nosec net/socket.c:711 [inline]    __sock_sendmsg+0x1a6/0x270 net/socket.c:726    ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2583    ___sys_sendmsg net/socket.c:2637 [inline]    __sys_sendmsg+0x269/0x350 net/socket.c:2669    do_syscall_x64 arch/x86/entry/common.c:52 [inline]    do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83    entry_SYSCALL_64_after_hwframe+0x77/0x7f   RIP: 0033:0x7f6e86ebfe69   Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 1f 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48   RSP: 002b:00007f6e86649168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e   RAX: ffffffffffffffda RBX: 00007f6e86f491b8 RCX: 00007f6e86ebfe69   RDX: 0000000030004001 RSI: 0000000020000080 RDI: 0000000000000003   RBP: 00007f6e86f491b0 R08: 00007f6e866496c0 R09: 0000000000000000   R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6e86f491bc   R13: 000000000000006e R14: 00007ffe445d9420 R15: 00007ffe445d9508    </TASK>  The root cause is the bad handling of disconnect() generated internally by the MPTCP protocol in case of connect FASTOPEN errors.  Address the issue increasing the socket disconnect counter even on such a case, to allow other threads waiting on the same socket lock to properly error out.
published:2025-02-27T02:15:14.137


Instruction: Please provide detailed information about CVE-2025-21706

CVE:CVE-2025-21706
Description:In the Linux kernel, the following vulnerability has been resolved:  mptcp: pm: only set fullmesh for subflow endp  With the in-kernel path-manager, it is possible to change the 'fullmesh' flag. The code in mptcp_pm_nl_fullmesh() expects to change it only on 'subflow' endpoints, to recreate more or less subflows using the linked address.  Unfortunately, the set_flags() hook was a bit more permissive, and allowed 'implicit' endpoints to get the 'fullmesh' flag while it is not allowed before.  That's what syzbot found, triggering the following warning:    WARNING: CPU: 0 PID: 6499 at net/mptcp/pm_netlink.c:1496 __mark_subflow_endp_available net/mptcp/pm_netlink.c:1496 [inline]   WARNING: CPU: 0 PID: 6499 at net/mptcp/pm_netlink.c:1496 mptcp_pm_nl_fullmesh net/mptcp/pm_netlink.c:1980 [inline]   WARNING: CPU: 0 PID: 6499 at net/mptcp/pm_netlink.c:1496 mptcp_nl_set_flags net/mptcp/pm_netlink.c:2003 [inline]   WARNING: CPU: 0 PID: 6499 at net/mptcp/pm_netlink.c:1496 mptcp_pm_nl_set_flags+0x974/0xdc0 net/mptcp/pm_netlink.c:2064   Modules linked in:   CPU: 0 UID: 0 PID: 6499 Comm: syz.1.413 Not tainted 6.13.0-rc5-syzkaller-00172-gd1bf27c4e176 #0   Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024   RIP: 0010:__mark_subflow_endp_available net/mptcp/pm_netlink.c:1496 [inline]   RIP: 0010:mptcp_pm_nl_fullmesh net/mptcp/pm_netlink.c:1980 [inline]   RIP: 0010:mptcp_nl_set_flags net/mptcp/pm_netlink.c:2003 [inline]   RIP: 0010:mptcp_pm_nl_set_flags+0x974/0xdc0 net/mptcp/pm_netlink.c:2064   Code: 01 00 00 49 89 c5 e8 fb 45 e8 f5 e9 b8 fc ff ff e8 f1 45 e8 f5 4c 89 f7 be 03 00 00 00 e8 44 1d 0b f9 eb a0 e8 dd 45 e8 f5 90 <0f> 0b 90 e9 17 ff ff ff 89 d9 80 e1 07 38 c1 0f 8c c9 fc ff ff 48   RSP: 0018:ffffc9000d307240 EFLAGS: 00010293   RAX: ffffffff8bb72e03 RBX: 0000000000000000 RCX: ffff88807da88000   RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000   RBP: ffffc9000d307430 R08: ffffffff8bb72cf0 R09: 1ffff1100b842a5e   R10: dffffc0000000000 R11: ffffed100b842a5f R12: ffff88801e2e5ac0   R13: ffff88805c214800 R14: ffff88805c2152e8 R15: 1ffff1100b842a5d   FS:  00005555619f6500(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033   CR2: 0000000020002840 CR3: 00000000247e6000 CR4: 00000000003526f0   DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000   DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400   Call Trace:    <TASK>    genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline]    genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]    genl_rcv_msg+0xb14/0xec0 net/netlink/genetlink.c:1210    netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2542    genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219    netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline]    netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1347    netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1891    sock_sendmsg_nosec net/socket.c:711 [inline]    __sock_sendmsg+0x221/0x270 net/socket.c:726    ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2583    ___sys_sendmsg net/socket.c:2637 [inline]    __sys_sendmsg+0x269/0x350 net/socket.c:2669    do_syscall_x64 arch/x86/entry/common.c:52 [inline]    do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83    entry_SYSCALL_64_after_hwframe+0x77/0x7f   RIP: 0033:0x7f5fe8785d29   Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48   RSP: 002b:00007fff571f5558 EFLAGS: 00000246 ORIG_RAX: 000000000000002e   RAX: ffffffffffffffda RBX: 00007f5fe8975fa0 RCX: 00007f5fe8785d29   RDX: 0000000000000000 RSI: 0000000020000480 RDI: 0000000000000007   RBP: 00007f5fe8801b08 R08: 0000000000000000 R09: 0000000000000000   R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000   R13: 00007f5fe8975fa0 R14: 00007f5fe8975fa0 R15: 000000 ---truncated---
published:2025-02-27T02:15:14.237


Instruction: Please provide detailed information about CVE-2025-21707

CVE:CVE-2025-21707
Description:In the Linux kernel, the following vulnerability has been resolved:  mptcp: consolidate suboption status  MPTCP maintains the received sub-options status is the bitmask carrying the received suboptions and in several bitfields carrying per suboption additional info.  Zeroing the bitmask before parsing is not enough to ensure a consistent status, and the MPTCP code has to additionally clear some bitfiled depending on the actually parsed suboption.  The above schema is fragile, and syzbot managed to trigger a path where a relevant bitfield is not cleared/initialized:    BUG: KMSAN: uninit-value in __mptcp_expand_seq net/mptcp/options.c:1030 [inline]   BUG: KMSAN: uninit-value in mptcp_expand_seq net/mptcp/protocol.h:864 [inline]   BUG: KMSAN: uninit-value in ack_update_msk net/mptcp/options.c:1060 [inline]   BUG: KMSAN: uninit-value in mptcp_incoming_options+0x2036/0x3d30 net/mptcp/options.c:1209    __mptcp_expand_seq net/mptcp/options.c:1030 [inline]    mptcp_expand_seq net/mptcp/protocol.h:864 [inline]    ack_update_msk net/mptcp/options.c:1060 [inline]    mptcp_incoming_options+0x2036/0x3d30 net/mptcp/options.c:1209    tcp_data_queue+0xb4/0x7be0 net/ipv4/tcp_input.c:5233    tcp_rcv_established+0x1061/0x2510 net/ipv4/tcp_input.c:6264    tcp_v4_do_rcv+0x7f3/0x11a0 net/ipv4/tcp_ipv4.c:1916    tcp_v4_rcv+0x51df/0x5750 net/ipv4/tcp_ipv4.c:2351    ip_protocol_deliver_rcu+0x2a3/0x13d0 net/ipv4/ip_input.c:205    ip_local_deliver_finish+0x336/0x500 net/ipv4/ip_input.c:233    NF_HOOK include/linux/netfilter.h:314 [inline]    ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254    dst_input include/net/dst.h:460 [inline]    ip_rcv_finish+0x4a2/0x520 net/ipv4/ip_input.c:447    NF_HOOK include/linux/netfilter.h:314 [inline]    ip_rcv+0xcd/0x380 net/ipv4/ip_input.c:567    __netif_receive_skb_one_core net/core/dev.c:5704 [inline]    __netif_receive_skb+0x319/0xa00 net/core/dev.c:5817    process_backlog+0x4ad/0xa50 net/core/dev.c:6149    __napi_poll+0xe7/0x980 net/core/dev.c:6902    napi_poll net/core/dev.c:6971 [inline]    net_rx_action+0xa5a/0x19b0 net/core/dev.c:7093    handle_softirqs+0x1a0/0x7c0 kernel/softirq.c:561    __do_softirq+0x14/0x1a kernel/softirq.c:595    do_softirq+0x9a/0x100 kernel/softirq.c:462    __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:389    local_bh_enable include/linux/bottom_half.h:33 [inline]    rcu_read_unlock_bh include/linux/rcupdate.h:919 [inline]    __dev_queue_xmit+0x2758/0x57d0 net/core/dev.c:4493    dev_queue_xmit include/linux/netdevice.h:3168 [inline]    neigh_hh_output include/net/neighbour.h:523 [inline]    neigh_output include/net/neighbour.h:537 [inline]    ip_finish_output2+0x187c/0x1b70 net/ipv4/ip_output.c:236    __ip_finish_output+0x287/0x810    ip_finish_output+0x4b/0x600 net/ipv4/ip_output.c:324    NF_HOOK_COND include/linux/netfilter.h:303 [inline]    ip_output+0x15f/0x3f0 net/ipv4/ip_output.c:434    dst_output include/net/dst.h:450 [inline]    ip_local_out net/ipv4/ip_output.c:130 [inline]    __ip_queue_xmit+0x1f2a/0x20d0 net/ipv4/ip_output.c:536    ip_queue_xmit+0x60/0x80 net/ipv4/ip_output.c:550    __tcp_transmit_skb+0x3cea/0x4900 net/ipv4/tcp_output.c:1468    tcp_transmit_skb net/ipv4/tcp_output.c:1486 [inline]    tcp_write_xmit+0x3b90/0x9070 net/ipv4/tcp_output.c:2829    __tcp_push_pending_frames+0xc4/0x380 net/ipv4/tcp_output.c:3012    tcp_send_fin+0x9f6/0xf50 net/ipv4/tcp_output.c:3618    __tcp_close+0x140c/0x1550 net/ipv4/tcp.c:3130    __mptcp_close_ssk+0x74e/0x16f0 net/mptcp/protocol.c:2496    mptcp_close_ssk+0x26b/0x2c0 net/mptcp/protocol.c:2550    mptcp_pm_nl_rm_addr_or_subflow+0x635/0xd10 net/mptcp/pm_netlink.c:889    mptcp_pm_nl_rm_subflow_received net/mptcp/pm_netlink.c:924 [inline]    mptcp_pm_flush_addrs_and_subflows net/mptcp/pm_netlink.c:1688 [inline]    mptcp_nl_flush_addrs_list net/mptcp/pm_netlink.c:1709 [inline]    mptcp_pm_nl_flush_addrs_doit+0xe10/0x1630 net/mptcp/pm_netlink.c:1750    genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline]   ---truncated---
published:2025-02-27T02:15:14.347


Instruction: Please provide detailed information about CVE-2025-21708

CVE:CVE-2025-21708
Description:In the Linux kernel, the following vulnerability has been resolved:  net: usb: rtl8150: enable basic endpoint checking  Syzkaller reports [1] encountering a common issue of utilizing a wrong usb endpoint type during URB submitting stage. This, in turn, triggers a warning shown below.  For now, enable simple endpoint checking (specifically, bulk and interrupt eps, testing control one is not essential) to mitigate the issue with a view to do other related cosmetic changes later, if they are necessary.  [1] Syzkaller report: usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 2586 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 driv> Modules linked in: CPU: 1 UID: 0 PID: 2586 Comm: dhcpcd Not tainted 6.11.0-rc4-syzkaller-00069-gfc88bb11617> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503 Code: 84 3c 02 00 00 e8 05 e4 fc fc 4c 89 ef e8 fd 25 d7 fe 45 89 e0 89 e9 4c 89 f2 48 8> RSP: 0018:ffffc9000441f740 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff888112487a00 RCX: ffffffff811a99a9 RDX: ffff88810df6ba80 RSI: ffffffff811a99b6 RDI: 0000000000000001 RBP: 0000000000000003 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 R13: ffff8881023bf0a8 R14: ffff888112452a20 R15: ffff888112487a7c FS:  00007fc04eea5740(0000) GS:ffff8881f6300000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f0a1de9f870 CR3: 000000010dbd0000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace:  <TASK>  rtl8150_open+0x300/0xe30 drivers/net/usb/rtl8150.c:733  __dev_open+0x2d4/0x4e0 net/core/dev.c:1474  __dev_change_flags+0x561/0x720 net/core/dev.c:8838  dev_change_flags+0x8f/0x160 net/core/dev.c:8910  devinet_ioctl+0x127a/0x1f10 net/ipv4/devinet.c:1177  inet_ioctl+0x3aa/0x3f0 net/ipv4/af_inet.c:1003  sock_do_ioctl+0x116/0x280 net/socket.c:1222  sock_ioctl+0x22e/0x6c0 net/socket.c:1341  vfs_ioctl fs/ioctl.c:51 [inline]  __do_sys_ioctl fs/ioctl.c:907 [inline]  __se_sys_ioctl fs/ioctl.c:893 [inline]  __x64_sys_ioctl+0x193/0x220 fs/ioctl.c:893  do_syscall_x64 arch/x86/entry/common.c:52 [inline]  do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83  entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc04ef73d49 ...  This change has not been tested on real hardware.
published:2025-02-27T02:15:14.447


Instruction: Please provide detailed information about CVE-2025-21709

CVE:CVE-2025-21709
Description:In the Linux kernel, the following vulnerability has been resolved:  kernel: be more careful about dup_mmap() failures and uprobe registering  If a memory allocation fails during dup_mmap(), the maple tree can be left in an unsafe state for other iterators besides the exit path.  All the locks are dropped before the exit_mmap() call (in mm/mmap.c), but the incomplete mm_struct can be reached through (at least) the rmap finding the vmas which have a pointer back to the mm_struct.  Up to this point, there have been no issues with being able to find an mm_struct that was only partially initialised.  Syzbot was able to make the incomplete mm_struct fail with recent forking changes, so it has been proven unsafe to use the mm_struct that hasn't been initialised, as referenced in the link below.  Although 8ac662f5da19f ("fork: avoid inappropriate uprobe access to invalid mm") fixed the uprobe access, it does not completely remove the race.  This patch sets the MMF_OOM_SKIP to avoid the iteration of the vmas on the oom side (even though this is extremely unlikely to be selected as an oom victim in the race window), and sets MMF_UNSTABLE to avoid other potential users from using a partially initialised mm_struct.  When registering vmas for uprobe, skip the vmas in an mm that is marked unstable.  Modifying a vma in an unstable mm may cause issues if the mm isn't fully initialised.
published:2025-02-27T02:15:14.560


Instruction: Please provide detailed information about CVE-2025-21710

CVE:CVE-2025-21710
Description:In the Linux kernel, the following vulnerability has been resolved:  tcp: correct handling of extreme memory squeeze  Testing with iperf3 using the "pasta" protocol splicer has revealed a problem in the way tcp handles window advertising in extreme memory squeeze situations.  Under memory pressure, a socket endpoint may temporarily advertise a zero-sized window, but this is not stored as part of the socket data. The reasoning behind this is that it is considered a temporary setting which shouldn't influence any further calculations.  However, if we happen to stall at an unfortunate value of the current window size, the algorithm selecting a new value will consistently fail to advertise a non-zero window once we have freed up enough memory. This means that this side's notion of the current window size is different from the one last advertised to the peer, causing the latter to not send any data to resolve the sitution.  The problem occurs on the iperf3 server side, and the socket in question is a completely regular socket with the default settings for the fedora40 kernel. We do not use SO_PEEK or SO_RCVBUF on the socket.  The following excerpt of a logging session, with own comments added, shows more in detail what is happening:  //              tcp_v4_rcv(->) //                tcp_rcv_established(->) [5201<->39222]:     ==== Activating log @ net/ipv4/tcp_input.c/tcp_data_queue()/5257 ==== [5201<->39222]:     tcp_data_queue(->) [5201<->39222]:        DROPPING skb [265600160..265665640], reason: SKB_DROP_REASON_PROTO_MEM                        [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184]                        [copied_seq 259909392->260034360 (124968), unread 5565800, qlen 85, ofoq 0]                        [OFO queue: gap: 65480, len: 0] [5201<->39222]:     tcp_data_queue(<-) [5201<->39222]:     __tcp_transmit_skb(->)                         [tp->rcv_wup: 265469200, tp->rcv_wnd: 262144, tp->rcv_nxt 265600160] [5201<->39222]:       tcp_select_window(->) [5201<->39222]:         (inet_csk(sk)->icsk_ack.pending & ICSK_ACK_NOMEM) ? --> TRUE                         [tp->rcv_wup: 265469200, tp->rcv_wnd: 262144, tp->rcv_nxt 265600160]                         returning 0 [5201<->39222]:       tcp_select_window(<-) [5201<->39222]:       ADVERTISING WIN 0, ACK_SEQ: 265600160 [5201<->39222]:     [__tcp_transmit_skb(<-) [5201<->39222]:   tcp_rcv_established(<-) [5201<->39222]: tcp_v4_rcv(<-)  // Receive queue is at 85 buffers and we are out of memory. // We drop the incoming buffer, although it is in sequence, and decide // to send an advertisement with a window of zero. // We don't update tp->rcv_wnd and tp->rcv_wup accordingly, which means // we unconditionally shrink the window.  [5201<->39222]: tcp_recvmsg_locked(->) [5201<->39222]:   __tcp_cleanup_rbuf(->) tp->rcv_wup: 265469200, tp->rcv_wnd: 262144, tp->rcv_nxt 265600160 [5201<->39222]:     [new_win = 0, win_now = 131184, 2 * win_now = 262368] [5201<->39222]:     [new_win >= (2 * win_now) ? --> time_to_ack = 0] [5201<->39222]:     NOT calling tcp_send_ack()                     [tp->rcv_wup: 265469200, tp->rcv_wnd: 262144, tp->rcv_nxt 265600160] [5201<->39222]:   __tcp_cleanup_rbuf(<-)                   [rcv_nxt 265600160, rcv_wnd 262144, snt_ack 265469200, win_now 131184]                   [copied_seq 260040464->260040464 (0), unread 5559696, qlen 85, ofoq 0]                   returning 6104 bytes [5201<->39222]: tcp_recvmsg_locked(<-)  // After each read, the algorithm for calculating the new receive // window in __tcp_cleanup_rbuf() finds it is too small to advertise // or to update tp->rcv_wnd. // Meanwhile, the peer thinks the window is zero, and will not send // any more data to trigger an update from the interrupt mode side.  [5201<->39222]: tcp_recvmsg_locked(->) [5201<->39222]:   __tcp_cleanup_rbuf(->) tp->rcv_wup: 265469200, tp->rcv_wnd: 262144, tp->rcv_nxt 265600160 [5201<->39222]:     [new_win = 262144, win_now = 131184, 2 * win_n ---truncated---
published:2025-02-27T02:15:14.657


Instruction: Please provide detailed information about CVE-2025-21711

CVE:CVE-2025-21711
Description:In the Linux kernel, the following vulnerability has been resolved:  net/rose: prevent integer overflows in rose_setsockopt()  In case of possible unpredictably large arguments passed to rose_setsockopt() and multiplied by extra values on top of that, integer overflows may occur.  Do the safest minimum and fix these issues by checking the contents of 'opt' and returning -EINVAL if they are too large. Also, switch to unsigned int and remove useless check for negative 'opt' in ROSE_IDLE case.
published:2025-02-27T02:15:14.760


Instruction: Please provide detailed information about CVE-2025-21712

CVE:CVE-2025-21712
Description:In the Linux kernel, the following vulnerability has been resolved:  md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime  After commit ec6bb299c7c3 ("md/md-bitmap: add 'sync_size' into struct md_bitmap_stats"), following panic is reported:  Oops: general protection fault, probably for non-canonical address RIP: 0010:bitmap_get_stats+0x2b/0xa0 Call Trace:  <TASK>  md_seq_show+0x2d2/0x5b0  seq_read_iter+0x2b9/0x470  seq_read+0x12f/0x180  proc_reg_read+0x57/0xb0  vfs_read+0xf6/0x380  ksys_read+0x6c/0xf0  do_syscall_64+0x82/0x170  entry_SYSCALL_64_after_hwframe+0x76/0x7e  Root cause is that bitmap_get_stats() can be called at anytime if mddev is still there, even if bitmap is destroyed, or not fully initialized. Deferenceing bitmap in this case can crash the kernel. Meanwhile, the above commit start to deferencing bitmap->storage, make the problem easier to trigger.  Fix the problem by protecting bitmap_get_stats() with bitmap_info.mutex.
published:2025-02-27T02:15:14.863


Instruction: Please provide detailed information about CVE-2025-21713

CVE:CVE-2025-21713
Description:In the Linux kernel, the following vulnerability has been resolved:  powerpc/pseries/iommu: Don't unset window if it was never set  On pSeries, when user attempts to use the same vfio container used by different iommu group, the spapr_tce_set_window() returns -EPERM and the subsequent cleanup leads to the below crash.     Kernel attempted to read user page (308) - exploit attempt?    BUG: Kernel NULL pointer dereference on read at 0x00000308    Faulting instruction address: 0xc0000000001ce358    Oops: Kernel access of bad area, sig: 11 [#1]    NIP:  c0000000001ce358 LR: c0000000001ce05c CTR: c00000000005add0    <snip>    NIP [c0000000001ce358] spapr_tce_unset_window+0x3b8/0x510    LR [c0000000001ce05c] spapr_tce_unset_window+0xbc/0x510    Call Trace:      spapr_tce_unset_window+0xbc/0x510 (unreliable)      tce_iommu_attach_group+0x24c/0x340 [vfio_iommu_spapr_tce]      vfio_container_attach_group+0xec/0x240 [vfio]      vfio_group_fops_unl_ioctl+0x548/0xb00 [vfio]      sys_ioctl+0x754/0x1580      system_call_exception+0x13c/0x330      system_call_vectored_common+0x15c/0x2ec    <snip>    --- interrupt: 3000  Fix this by having null check for the tbl passed to the spapr_tce_unset_window().
published:2025-02-27T02:15:14.960


Instruction: Please provide detailed information about CVE-2025-21714

CVE:CVE-2025-21714
Description:In the Linux kernel, the following vulnerability has been resolved:  RDMA/mlx5: Fix implicit ODP use after free  Prevent double queueing of implicit ODP mr destroy work by using __xa_cmpxchg() to make sure this is the only time we are destroying this specific mr.  Without this change, we could try to invalidate this mr twice, which in turn could result in queuing a MR work destroy twice, and eventually the second work could execute after the MR was freed due to the first work, causing a user after free and trace below.     refcount_t: underflow; use-after-free.    WARNING: CPU: 2 PID: 12178 at lib/refcount.c:28 refcount_warn_saturate+0x12b/0x130    Modules linked in: bonding ib_ipoib vfio_pci ip_gre geneve nf_tables ip6_gre gre ip6_tunnel tunnel6 ipip tunnel4 ib_umad rdma_ucm mlx5_vfio_pci vfio_pci_core vfio_iommu_type1 mlx5_ib vfio ib_uverbs mlx5_core iptable_raw openvswitch nsh rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay zram zsmalloc fuse [last unloaded: ib_uverbs]    CPU: 2 PID: 12178 Comm: kworker/u20:5 Not tainted 6.5.0-rc1_net_next_mlx5_58c644e #1    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014    Workqueue: events_unbound free_implicit_child_mr_work [mlx5_ib]    RIP: 0010:refcount_warn_saturate+0x12b/0x130    Code: 48 c7 c7 38 95 2a 82 c6 05 bc c6 fe 00 01 e8 0c 66 aa ff 0f 0b 5b c3 48 c7 c7 e0 94 2a 82 c6 05 a7 c6 fe 00 01 e8 f5 65 aa ff <0f> 0b 5b c3 90 8b 07 3d 00 00 00 c0 74 12 83 f8 01 74 13 8d 50 ff    RSP: 0018:ffff8881008e3e40 EFLAGS: 00010286    RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000027    RDX: ffff88852c91b5c8 RSI: 0000000000000001 RDI: ffff88852c91b5c0    RBP: ffff8881dacd4e00 R08: 00000000ffffffff R09: 0000000000000019    R10: 000000000000072e R11: 0000000063666572 R12: ffff88812bfd9e00    R13: ffff8881c792d200 R14: ffff88810011c005 R15: ffff8881002099c0    FS:  0000000000000000(0000) GS:ffff88852c900000(0000) knlGS:0000000000000000    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033    CR2: 00007f5694b5e000 CR3: 00000001153f6003 CR4: 0000000000370ea0    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400    Call Trace:     <TASK>     ? refcount_warn_saturate+0x12b/0x130     free_implicit_child_mr_work+0x180/0x1b0 [mlx5_ib]     process_one_work+0x1cc/0x3c0     worker_thread+0x218/0x3c0     kthread+0xc6/0xf0     ret_from_fork+0x1f/0x30     </TASK>
published:2025-02-27T02:15:15.050


Instruction: Please provide detailed information about CVE-2025-21715

CVE:CVE-2025-21715
Description:In the Linux kernel, the following vulnerability has been resolved:  net: davicom: fix UAF in dm9000_drv_remove  dm is netdev private data and it cannot be used after free_netdev() call. Using dm after free_netdev() can cause UAF bug. Fix it by moving free_netdev() at the end of the function.  This is similar to the issue fixed in commit ad297cd2db89 ("net: qcom/emac: fix UAF in emac_remove").  This bug is detected by our static analysis tool.
published:2025-02-27T02:15:15.167


Instruction: Please provide detailed information about CVE-2025-21716

CVE:CVE-2025-21716
Description:In the Linux kernel, the following vulnerability has been resolved:  vxlan: Fix uninit-value in vxlan_vnifilter_dump()  KMSAN reported an uninit-value access in vxlan_vnifilter_dump() [1].  If the length of the netlink message payload is less than sizeof(struct tunnel_msg), vxlan_vnifilter_dump() accesses bytes beyond the message. This can lead to uninit-value access. Fix this by returning an error in such situations.  [1] BUG: KMSAN: uninit-value in vxlan_vnifilter_dump+0x328/0x920 drivers/net/vxlan/vxlan_vnifilter.c:422  vxlan_vnifilter_dump+0x328/0x920 drivers/net/vxlan/vxlan_vnifilter.c:422  rtnl_dumpit+0xd5/0x2f0 net/core/rtnetlink.c:6786  netlink_dump+0x93e/0x15f0 net/netlink/af_netlink.c:2317  __netlink_dump_start+0x716/0xd60 net/netlink/af_netlink.c:2432  netlink_dump_start include/linux/netlink.h:340 [inline]  rtnetlink_dump_start net/core/rtnetlink.c:6815 [inline]  rtnetlink_rcv_msg+0x1256/0x14a0 net/core/rtnetlink.c:6882  netlink_rcv_skb+0x467/0x660 net/netlink/af_netlink.c:2542  rtnetlink_rcv+0x35/0x40 net/core/rtnetlink.c:6944  netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline]  netlink_unicast+0xed6/0x1290 net/netlink/af_netlink.c:1347  netlink_sendmsg+0x1092/0x1230 net/netlink/af_netlink.c:1891  sock_sendmsg_nosec net/socket.c:711 [inline]  __sock_sendmsg+0x330/0x3d0 net/socket.c:726  ____sys_sendmsg+0x7f4/0xb50 net/socket.c:2583  ___sys_sendmsg+0x271/0x3b0 net/socket.c:2637  __sys_sendmsg net/socket.c:2669 [inline]  __do_sys_sendmsg net/socket.c:2674 [inline]  __se_sys_sendmsg net/socket.c:2672 [inline]  __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2672  x64_sys_call+0x3878/0x3d90 arch/x86/include/generated/asm/syscalls_64.h:47  do_syscall_x64 arch/x86/entry/common.c:52 [inline]  do_syscall_64+0xd9/0x1d0 arch/x86/entry/common.c:83  entry_SYSCALL_64_after_hwframe+0x77/0x7f  Uninit was created at:  slab_post_alloc_hook mm/slub.c:4110 [inline]  slab_alloc_node mm/slub.c:4153 [inline]  kmem_cache_alloc_node_noprof+0x800/0xe80 mm/slub.c:4205  kmalloc_reserve+0x13b/0x4b0 net/core/skbuff.c:587  __alloc_skb+0x347/0x7d0 net/core/skbuff.c:678  alloc_skb include/linux/skbuff.h:1323 [inline]  netlink_alloc_large_skb+0xa5/0x280 net/netlink/af_netlink.c:1196  netlink_sendmsg+0xac9/0x1230 net/netlink/af_netlink.c:1866  sock_sendmsg_nosec net/socket.c:711 [inline]  __sock_sendmsg+0x330/0x3d0 net/socket.c:726  ____sys_sendmsg+0x7f4/0xb50 net/socket.c:2583  ___sys_sendmsg+0x271/0x3b0 net/socket.c:2637  __sys_sendmsg net/socket.c:2669 [inline]  __do_sys_sendmsg net/socket.c:2674 [inline]  __se_sys_sendmsg net/socket.c:2672 [inline]  __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2672  x64_sys_call+0x3878/0x3d90 arch/x86/include/generated/asm/syscalls_64.h:47  do_syscall_x64 arch/x86/entry/common.c:52 [inline]  do_syscall_64+0xd9/0x1d0 arch/x86/entry/common.c:83  entry_SYSCALL_64_after_hwframe+0x77/0x7f  CPU: 0 UID: 0 PID: 30991 Comm: syz.4.10630 Not tainted 6.12.0-10694-gc44daa7e3c73 #29 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014
published:2025-02-27T02:15:15.273


Instruction: Please provide detailed information about CVE-2025-21717

CVE:CVE-2025-21717
Description:In the Linux kernel, the following vulnerability has been resolved:  net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq  kvzalloc_node is not doing a runtime check on the node argument (__alloc_pages_node_noprof does have a VM_BUG_ON, but it expands to nothing on !CONFIG_DEBUG_VM builds), so doing any ethtool/netlink operation that calls mlx5e_open on a CPU that's larger that MAX_NUMNODES triggers OOB access and panic (see the trace below).  Add missing cpu_to_node call to convert cpu id to node id.  [  165.427394] mlx5_core 0000:5c:00.0 beth1: Link up [  166.479327] BUG: unable to handle page fault for address: 0000000800000010 [  166.494592] #PF: supervisor read access in kernel mode [  166.505995] #PF: error_code(0x0000) - not-present page ... [  166.816958] Call Trace: [  166.822380]  <TASK> [  166.827034]  ? __die_body+0x64/0xb0 [  166.834774]  ? page_fault_oops+0x2cd/0x3f0 [  166.843862]  ? exc_page_fault+0x63/0x130 [  166.852564]  ? asm_exc_page_fault+0x22/0x30 [  166.861843]  ? __kvmalloc_node_noprof+0x43/0xd0 [  166.871897]  ? get_partial_node+0x1c/0x320 [  166.880983]  ? deactivate_slab+0x269/0x2b0 [  166.890069]  ___slab_alloc+0x521/0xa90 [  166.898389]  ? __kvmalloc_node_noprof+0x43/0xd0 [  166.908442]  __kmalloc_node_noprof+0x216/0x3f0 [  166.918302]  ? __kvmalloc_node_noprof+0x43/0xd0 [  166.928354]  __kvmalloc_node_noprof+0x43/0xd0 [  166.938021]  mlx5e_open_channels+0x5e2/0xc00 [  166.947496]  mlx5e_open_locked+0x3e/0xf0 [  166.956201]  mlx5e_open+0x23/0x50 [  166.963551]  __dev_open+0x114/0x1c0 [  166.971292]  __dev_change_flags+0xa2/0x1b0 [  166.980378]  dev_change_flags+0x21/0x60 [  166.988887]  do_setlink+0x38d/0xf20 [  166.996628]  ? ep_poll_callback+0x1b9/0x240 [  167.005910]  ? __nla_validate_parse.llvm.10713395753544950386+0x80/0xd70 [  167.020782]  ? __wake_up_sync_key+0x52/0x80 [  167.030066]  ? __mutex_lock+0xff/0x550 [  167.038382]  ? security_capable+0x50/0x90 [  167.047279]  rtnl_setlink+0x1c9/0x210 [  167.055403]  ? ep_poll_callback+0x1b9/0x240 [  167.064684]  ? security_capable+0x50/0x90 [  167.073579]  rtnetlink_rcv_msg+0x2f9/0x310 [  167.082667]  ? rtnetlink_bind+0x30/0x30 [  167.091173]  netlink_rcv_skb+0xb1/0xe0 [  167.099492]  netlink_unicast+0x20f/0x2e0 [  167.108191]  netlink_sendmsg+0x389/0x420 [  167.116896]  __sys_sendto+0x158/0x1c0 [  167.125024]  __x64_sys_sendto+0x22/0x30 [  167.133534]  do_syscall_64+0x63/0x130 [  167.141657]  ? __irq_exit_rcu.llvm.17843942359718260576+0x52/0xd0 [  167.155181]  entry_SYSCALL_64_after_hwframe+0x4b/0x53
published:2025-02-27T02:15:15.373


Instruction: Please provide detailed information about CVE-2025-21718

CVE:CVE-2025-21718
Description:In the Linux kernel, the following vulnerability has been resolved:  net: rose: fix timer races against user threads  Rose timers only acquire the socket spinlock, without checking if the socket is owned by one user thread.  Add a check and rearm the timers if needed.  BUG: KASAN: slab-use-after-free in rose_timer_expiry+0x31d/0x360 net/rose/rose_timer.c:174 Read of size 2 at addr ffff88802f09b82a by task swapper/0/0  CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5-syzkaller-00172-gd1bf27c4e176 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace:  <IRQ>   __dump_stack lib/dump_stack.c:94 [inline]   dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120   print_address_description mm/kasan/report.c:378 [inline]   print_report+0x169/0x550 mm/kasan/report.c:489   kasan_report+0x143/0x180 mm/kasan/report.c:602   rose_timer_expiry+0x31d/0x360 net/rose/rose_timer.c:174   call_timer_fn+0x187/0x650 kernel/time/timer.c:1793   expire_timers kernel/time/timer.c:1844 [inline]   __run_timers kernel/time/timer.c:2418 [inline]   __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2430   run_timer_base kernel/time/timer.c:2439 [inline]   run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449   handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561   __do_softirq kernel/softirq.c:595 [inline]   invoke_softirq kernel/softirq.c:435 [inline]   __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662   irq_exit_rcu+0x9/0x30 kernel/softirq.c:678   instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]   sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049  </IRQ>
published:2025-02-27T02:15:15.473


Instruction: Please provide detailed information about CVE-2025-21719

CVE:CVE-2025-21719
Description:In the Linux kernel, the following vulnerability has been resolved:  ipmr: do not call mr_mfc_uses_dev() for unres entries  syzbot found that calling mr_mfc_uses_dev() for unres entries would crash [1], because c->mfc_un.res.minvif / c->mfc_un.res.maxvif alias to "struct sk_buff_head unresolved", which contain two pointers.  This code never worked, lets remove it.  [1] Unable to handle kernel paging request at virtual address ffff5fff2d536613 KASAN: maybe wild-memory-access in range [0xfffefff96a9b3098-0xfffefff96a9b309f] Modules linked in: CPU: 1 UID: 0 PID: 7321 Comm: syz.0.16 Not tainted 6.13.0-rc7-syzkaller-g1950a0af2d55 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)  pc : mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline]  pc : mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334  lr : mr_mfc_uses_dev net/ipv4/ipmr_base.c:289 [inline]  lr : mr_table_dump+0x694/0x8b0 net/ipv4/ipmr_base.c:334 Call trace:   mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline] (P)   mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334 (P)   mr_rtm_dumproute+0x254/0x454 net/ipv4/ipmr_base.c:382   ipmr_rtm_dumproute+0x248/0x4b4 net/ipv4/ipmr.c:2648   rtnl_dump_all+0x2e4/0x4e8 net/core/rtnetlink.c:4327   rtnl_dumpit+0x98/0x1d0 net/core/rtnetlink.c:6791   netlink_dump+0x4f0/0xbc0 net/netlink/af_netlink.c:2317   netlink_recvmsg+0x56c/0xe64 net/netlink/af_netlink.c:1973   sock_recvmsg_nosec net/socket.c:1033 [inline]   sock_recvmsg net/socket.c:1055 [inline]   sock_read_iter+0x2d8/0x40c net/socket.c:1125   new_sync_read fs/read_write.c:484 [inline]   vfs_read+0x740/0x970 fs/read_write.c:565   ksys_read+0x15c/0x26c fs/read_write.c:708
published:2025-02-27T02:15:15.580


Instruction: Please provide detailed information about CVE-2025-21720

CVE:CVE-2025-21720
Description:In the Linux kernel, the following vulnerability has been resolved:  xfrm: delete intermediate secpath entry in packet offload mode  Packets handled by hardware have added secpath as a way to inform XFRM core code that this path was already handled. That secpath is not needed at all after policy is checked and it is removed later in the stack.  However, in the case of IP forwarding is enabled (/proc/sys/net/ipv4/ip_forward), that secpath is not removed and packets which already were handled are reentered to the driver TX path with xfrm_offload set.  The following kernel panic is observed in mlx5 in such case:   mlx5_core 0000:04:00.0 enp4s0f0np0: Link up  mlx5_core 0000:04:00.1 enp4s0f1np1: Link up  Initializing XFRM netlink socket  IPsec XFRM device driver  BUG: kernel NULL pointer dereference, address: 0000000000000000  #PF: supervisor instruction fetch in kernel mode  #PF: error_code(0x0010) - not-present page  PGD 0 P4D 0  Oops: Oops: 0010 [#1] PREEMPT SMP  CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc1-alex #3  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014  RIP: 0010:0x0  Code: Unable to access opcode bytes at 0xffffffffffffffd6.  RSP: 0018:ffffb87380003800 EFLAGS: 00010206  RAX: ffff8df004e02600 RBX: ffffb873800038d8 RCX: 00000000ffff98cf  RDX: ffff8df00733e108 RSI: ffff8df00521fb80 RDI: ffff8df001661f00  RBP: ffffb87380003850 R08: ffff8df013980000 R09: 0000000000000010  R10: 0000000000000002 R11: 0000000000000002 R12: ffff8df001661f00  R13: ffff8df00521fb80 R14: ffff8df00733e108 R15: ffff8df011faf04e  FS:  0000000000000000(0000) GS:ffff8df46b800000(0000) knlGS:0000000000000000  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  CR2: ffffffffffffffd6 CR3: 0000000106384000 CR4: 0000000000350ef0  Call Trace:   <IRQ>   ? show_regs+0x63/0x70   ? __die_body+0x20/0x60   ? __die+0x2b/0x40   ? page_fault_oops+0x15c/0x550   ? do_user_addr_fault+0x3ed/0x870   ? exc_page_fault+0x7f/0x190   ? asm_exc_page_fault+0x27/0x30   mlx5e_ipsec_handle_tx_skb+0xe7/0x2f0 [mlx5_core]   mlx5e_xmit+0x58e/0x1980 [mlx5_core]   ? __fib_lookup+0x6a/0xb0   dev_hard_start_xmit+0x82/0x1d0   sch_direct_xmit+0xfe/0x390   __dev_queue_xmit+0x6d8/0xee0   ? __fib_lookup+0x6a/0xb0   ? internal_add_timer+0x48/0x70   ? mod_timer+0xe2/0x2b0   neigh_resolve_output+0x115/0x1b0   __neigh_update+0x26a/0xc50   neigh_update+0x14/0x20   arp_process+0x2cb/0x8e0   ? __napi_build_skb+0x5e/0x70   arp_rcv+0x11e/0x1c0   ? dev_gro_receive+0x574/0x820   __netif_receive_skb_list_core+0x1cf/0x1f0   netif_receive_skb_list_internal+0x183/0x2a0   napi_complete_done+0x76/0x1c0   mlx5e_napi_poll+0x234/0x7a0 [mlx5_core]   __napi_poll+0x2d/0x1f0   net_rx_action+0x1a6/0x370   ? atomic_notifier_call_chain+0x3b/0x50   ? irq_int_handler+0x15/0x20 [mlx5_core]   handle_softirqs+0xb9/0x2f0   ? handle_irq_event+0x44/0x60   irq_exit_rcu+0xdb/0x100   common_interrupt+0x98/0xc0   </IRQ>   <TASK>   asm_common_interrupt+0x27/0x40  RIP: 0010:pv_native_safe_halt+0xb/0x10  Code: 09 c3 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 0f 22  0f 1f 84 00 00 00 00 00 90 eb 07 0f 00 2d 7f e9 36 00 fb 40 00 83 ff 07 77 21 89 ff ff 24 fd 88 3d a1 bd 0f 21 f8  RSP: 0018:ffffffffbe603de8 EFLAGS: 00000202  RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000f92f46680  RDX: 0000000000000037 RSI: 00000000ffffffff RDI: 00000000000518d4  RBP: ffffffffbe603df0 R08: 000000cd42e4dffb R09: ffffffffbe603d70  R10: 0000004d80d62680 R11: 0000000000000001 R12: ffffffffbe60bf40  R13: 0000000000000000 R14: 0000000000000000 R15: ffffffffbe60aff8   ? default_idle+0x9/0x20   arch_cpu_idle+0x9/0x10   default_idle_call+0x29/0xf0   do_idle+0x1f2/0x240   cpu_startup_entry+0x2c/0x30   rest_init+0xe7/0x100   start_kernel+0x76b/0xb90   x86_64_start_reservations+0x18/0x30   x86_64_start_kernel+0xc0/0x110   ? setup_ghcb+0xe/0x130   common_startup_64+0x13e/0x141   </TASK>  Modules linked in: esp4_offload esp4 xfrm_interface xfrm6_tunnel tunnel4 tunnel6 xfrm_user xfrm_algo binf ---truncated---
published:2025-02-27T02:15:15.683


Instruction: Please provide detailed information about CVE-2025-21721

CVE:CVE-2025-21721
Description:In the Linux kernel, the following vulnerability has been resolved:  nilfs2: handle errors that nilfs_prepare_chunk() may return  Patch series "nilfs2: fix issues with rename operations".  This series fixes BUG_ON check failures reported by syzbot around rename operations, and a minor behavioral issue where the mtime of a child directory changes when it is renamed instead of moved.   This patch (of 2):  The directory manipulation routines nilfs_set_link() and nilfs_delete_entry() rewrite the directory entry in the folio/page previously read by nilfs_find_entry(), so error handling is omitted on the assumption that nilfs_prepare_chunk(), which prepares the buffer for rewriting, will always succeed for these.  And if an error is returned, it triggers the legacy BUG_ON() checks in each routine.  This assumption is wrong, as proven by syzbot: the buffer layer called by nilfs_prepare_chunk() may call nilfs_get_block() if necessary, which may fail due to metadata corruption or other reasons.  This has been there all along, but improved sanity checks and error handling may have made it more reproducible in fuzzing tests.  Fix this issue by adding missing error paths in nilfs_set_link(), nilfs_delete_entry(), and their caller nilfs_rename().
published:2025-02-27T02:15:15.787


Instruction: Please provide detailed information about CVE-2025-21722

CVE:CVE-2025-21722
Description:In the Linux kernel, the following vulnerability has been resolved:  nilfs2: do not force clear folio if buffer is referenced  Patch series "nilfs2: protect busy buffer heads from being force-cleared".  This series fixes the buffer head state inconsistency issues reported by syzbot that occurs when the filesystem is corrupted and falls back to read-only, and the associated buffer head use-after-free issue.   This patch (of 2):  Syzbot has reported that after nilfs2 detects filesystem corruption and falls back to read-only, inconsistencies in the buffer state may occur.  One of the inconsistencies is that when nilfs2 calls mark_buffer_dirty() to set a data or metadata buffer as dirty, but it detects that the buffer is not in the uptodate state:   WARNING: CPU: 0 PID: 6049 at fs/buffer.c:1177 mark_buffer_dirty+0x2e5/0x520   fs/buffer.c:1177  ...  Call Trace:   <TASK>   nilfs_palloc_commit_alloc_entry+0x4b/0x160 fs/nilfs2/alloc.c:598   nilfs_ifile_create_inode+0x1dd/0x3a0 fs/nilfs2/ifile.c:73   nilfs_new_inode+0x254/0x830 fs/nilfs2/inode.c:344   nilfs_mkdir+0x10d/0x340 fs/nilfs2/namei.c:218   vfs_mkdir+0x2f9/0x4f0 fs/namei.c:4257   do_mkdirat+0x264/0x3a0 fs/namei.c:4280   __do_sys_mkdirat fs/namei.c:4295 [inline]   __se_sys_mkdirat fs/namei.c:4293 [inline]   __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:4293   do_syscall_x64 arch/x86/entry/common.c:52 [inline]   do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83   entry_SYSCALL_64_after_hwframe+0x77/0x7f  The other is when nilfs_btree_propagate(), which propagates the dirty state to the ancestor nodes of a b-tree that point to a dirty buffer, detects that the origin buffer is not dirty, even though it should be:   WARNING: CPU: 0 PID: 5245 at fs/nilfs2/btree.c:2089   nilfs_btree_propagate+0xc79/0xdf0 fs/nilfs2/btree.c:2089  ...  Call Trace:   <TASK>   nilfs_bmap_propagate+0x75/0x120 fs/nilfs2/bmap.c:345   nilfs_collect_file_data+0x4d/0xd0 fs/nilfs2/segment.c:587   nilfs_segctor_apply_buffers+0x184/0x340 fs/nilfs2/segment.c:1006   nilfs_segctor_scan_file+0x28c/0xa50 fs/nilfs2/segment.c:1045   nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1216 [inline]   nilfs_segctor_collect fs/nilfs2/segment.c:1540 [inline]   nilfs_segctor_do_construct+0x1c28/0x6b90 fs/nilfs2/segment.c:2115   nilfs_segctor_construct+0x181/0x6b0 fs/nilfs2/segment.c:2479   nilfs_segctor_thread_construct fs/nilfs2/segment.c:2587 [inline]   nilfs_segctor_thread+0x69e/0xe80 fs/nilfs2/segment.c:2701   kthread+0x2f0/0x390 kernel/kthread.c:389   ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244   </TASK>  Both of these issues are caused by the callbacks that handle the page/folio write requests, forcibly clear various states, including the working state of the buffers they hold, at unexpected times when they detect read-only fallback.  Fix these issues by checking if the buffer is referenced before clearing the page/folio state, and skipping the clear if it is.
published:2025-02-27T02:15:15.883


Instruction: Please provide detailed information about CVE-2025-21723

CVE:CVE-2025-21723
Description:In the Linux kernel, the following vulnerability has been resolved:  scsi: mpi3mr: Fix possible crash when setting up bsg fails  If bsg_setup_queue() fails, the bsg_queue is assigned a non-NULL value. Consequently, in mpi3mr_bsg_exit(), the condition "if(!mrioc->bsg_queue)" will not be satisfied, preventing execution from entering bsg_remove_queue(), which could lead to the following crash:  BUG: kernel NULL pointer dereference, address: 000000000000041c Call Trace:   <TASK>   mpi3mr_bsg_exit+0x1f/0x50 [mpi3mr]   mpi3mr_remove+0x6f/0x340 [mpi3mr]   pci_device_remove+0x3f/0xb0   device_release_driver_internal+0x19d/0x220   unbind_store+0xa4/0xb0   kernfs_fop_write_iter+0x11f/0x200   vfs_write+0x1fc/0x3e0   ksys_write+0x67/0xe0   do_syscall_64+0x38/0x80   entry_SYSCALL_64_after_hwframe+0x78/0xe2
published:2025-02-27T02:15:15.993


Instruction: Please provide detailed information about CVE-2025-21724

CVE:CVE-2025-21724
Description:In the Linux kernel, the following vulnerability has been resolved:  iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()  Resolve a UBSAN shift-out-of-bounds issue in iova_bitmap_offset_to_index() where shifting the constant "1" (of type int) by bitmap->mapped.pgshift (an unsigned long value) could result in undefined behavior.  The constant "1" defaults to a 32-bit "int", and when "pgshift" exceeds 31 (e.g., pgshift = 63) the shift operation overflows, as the result cannot be represented in a 32-bit type.  To resolve this, the constant is updated to "1UL", promoting it to an unsigned long type to match the operand's type.
published:2025-02-27T02:15:16.113


Instruction: Please provide detailed information about CVE-2025-21725

CVE:CVE-2025-21725
Description:In the Linux kernel, the following vulnerability has been resolved:  smb: client: fix oops due to unset link speed  It isn't guaranteed that NETWORK_INTERFACE_INFO::LinkSpeed will always be set by the server, so the client must handle any values and then prevent oopses like below from happening:  Oops: divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 UID: 0 PID: 1323 Comm: cat Not tainted 6.13.0-rc7 #2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41 04/01/2014 RIP: 0010:cifs_debug_data_proc_show+0xa45/0x1460 [cifs] Code: 00 00 48 89 df e8 3b cd 1b c1 41 f6 44 24 2c 04 0f 84 50 01 00 00 48 89 ef e8 e7 d0 1b c1 49 8b 44 24 18 31 d2 49 8d 7c 24 28 <48> f7 74 24 18 48 89 c3 e8 6e cf 1b c1 41 8b 6c 24 28 49 8d 7c 24 RSP: 0018:ffffc90001817be0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88811230022c RCX: ffffffffc041bd99 RDX: 0000000000000000 RSI: 0000000000000567 RDI: ffff888112300228 RBP: ffff888112300218 R08: fffff52000302f5f R09: ffffed1022fa58ac R10: ffff888117d2c566 R11: 00000000fffffffe R12: ffff888112300200 R13: 000000012a15343f R14: 0000000000000001 R15: ffff888113f2db58 FS: 00007fe27119e740(0000) GS:ffff888148600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe2633c5000 CR3: 0000000124da0000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace:  <TASK>  ? __die_body.cold+0x19/0x27  ? die+0x2e/0x50  ? do_trap+0x159/0x1b0  ? cifs_debug_data_proc_show+0xa45/0x1460 [cifs]  ? do_error_trap+0x90/0x130  ? cifs_debug_data_proc_show+0xa45/0x1460 [cifs]  ? exc_divide_error+0x39/0x50  ? cifs_debug_data_proc_show+0xa45/0x1460 [cifs]  ? asm_exc_divide_error+0x1a/0x20  ? cifs_debug_data_proc_show+0xa39/0x1460 [cifs]  ? cifs_debug_data_proc_show+0xa45/0x1460 [cifs]  ? seq_read_iter+0x42e/0x790  seq_read_iter+0x19a/0x790  proc_reg_read_iter+0xbe/0x110  ? __pfx_proc_reg_read_iter+0x10/0x10  vfs_read+0x469/0x570  ? do_user_addr_fault+0x398/0x760  ? __pfx_vfs_read+0x10/0x10  ? find_held_lock+0x8a/0xa0  ? __pfx_lock_release+0x10/0x10  ksys_read+0xd3/0x170  ? __pfx_ksys_read+0x10/0x10  ? __rcu_read_unlock+0x50/0x270  ? mark_held_locks+0x1a/0x90  do_syscall_64+0xbb/0x1d0  entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe271288911 Code: 00 48 8b 15 01 25 10 00 f7 d8 64 89 02 b8 ff ff ff ff eb bd e8 20 ad 01 00 f3 0f 1e fa 80 3d b5 a7 10 00 00 74 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 4f c3 66 0f 1f 44 00 00 55 48 89 e5 48 83 ec RSP: 002b:00007ffe87c079d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 0000000000040000 RCX: 00007fe271288911 RDX: 0000000000040000 RSI: 00007fe2633c6000 RDI: 0000000000000003 RBP: 00007ffe87c07a00 R08: 0000000000000000 R09: 00007fe2713e6380 R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000040000 R13: 00007fe2633c6000 R14: 0000000000000003 R15: 0000000000000000  </TASK>  Fix this by setting cifs_server_iface::speed to a sane value (1Gbps) by default when link speed is unset.
published:2025-02-27T02:15:16.220


Instruction: Please provide detailed information about CVE-2025-21726

CVE:CVE-2025-21726
Description:In the Linux kernel, the following vulnerability has been resolved:  padata: avoid UAF for reorder_work  Although the previous patch can avoid ps and ps UAF for _do_serial, it can not avoid potential UAF issue for reorder_work. This issue can happen just as below:  crypto_request			crypto_request		crypto_del_alg padata_do_serial   ...   padata_reorder     // processes all remaining     // requests then breaks     while (1) {       if (!padata)         break;       ...     }  				padata_do_serial 				  // new request added 				  list_add     // sees the new request     queue_work(reorder_work) 				  padata_reorder 				    queue_work_on(squeue->work) ...  				<kworker context> 				padata_serial_worker 				// completes new request, 				// no more outstanding 				// requests  							crypto_del_alg 							  // free pd  <kworker context> invoke_padata_reorder   // UAF of pd  To avoid UAF for 'reorder_work', get 'pd' ref before put 'reorder_work' into the 'serial_wq' and put 'pd' ref until the 'serial_wq' finish.
published:2025-02-27T02:15:16.323


Instruction: Please provide detailed information about CVE-2025-21727

CVE:CVE-2025-21727
Description:In the Linux kernel, the following vulnerability has been resolved:  padata: fix UAF in padata_reorder  A bug was found when run ltp test:  BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0 Read of size 4 at addr ffff88bbfe003524 by task kworker/u113:2/3039206  CPU: 0 PID: 3039206 Comm: kworker/u113:2 Kdump: loaded Not tainted 6.6.0+ Workqueue: pdecrypt_parallel padata_parallel_worker Call Trace: <TASK> dump_stack_lvl+0x32/0x50 print_address_description.constprop.0+0x6b/0x3d0 print_report+0xdd/0x2c0 kasan_report+0xa5/0xd0 padata_find_next+0x29/0x1a0 padata_reorder+0x131/0x220 padata_parallel_worker+0x3d/0xc0 process_one_work+0x2ec/0x5a0  If 'mdelay(10)' is added before calling 'padata_find_next' in the 'padata_reorder' function, this issue could be reproduced easily with ltp test (pcrypt_aead01).  This can be explained as bellow:  pcrypt_aead_encrypt ... padata_do_parallel refcount_inc(&pd->refcnt); // add refcnt ... padata_do_serial padata_reorder // pd while (1) { padata_find_next(pd, true); // using pd queue_work_on ... padata_serial_worker				crypto_del_alg padata_put_pd_cnt // sub refcnt 						padata_free_shell 						padata_put_pd(ps->pd); 						// pd is freed // loop again, but pd is freed // call padata_find_next, UAF }  In the padata_reorder function, when it loops in 'while', if the alg is deleted, the refcnt may be decreased to 0 before entering 'padata_find_next', which leads to UAF.  As mentioned in [1], do_serial is supposed to be called with BHs disabled and always happen under RCU protection, to address this issue, add synchronize_rcu() in 'padata_free_shell' wait for all _do_serial calls to finish.  [1] https://lore.kernel.org/all/20221028160401.cccypv4euxikusiq@parnassus.localdomain/ [2] https://lore.kernel.org/linux-kernel/jfjz5d7zwbytztackem7ibzalm5lnxldi2eofeiczqmqs2m7o6@fq426cwnjtkm/
published:2025-02-27T02:15:16.423


Instruction: Please provide detailed information about CVE-2025-21728

CVE:CVE-2025-21728
Description:In the Linux kernel, the following vulnerability has been resolved:  bpf: Send signals asynchronously if !preemptible  BPF programs can execute in all kinds of contexts and when a program running in a non-preemptible context uses the bpf_send_signal() kfunc, it will cause issues because this kfunc can sleep. Change `irqs_disabled()` to `!preemptible()`.
published:2025-02-27T02:15:16.530


Instruction: Please provide detailed information about CVE-2025-21729

CVE:CVE-2025-21729
Description:In the Linux kernel, the following vulnerability has been resolved:  wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion  The rtwdev->scanning flag isn't protected by mutex originally, so cancel_hw_scan can pass the condition, but suddenly hw_scan completion unset the flag and calls ieee80211_scan_completed() that will free local->hw_scan_req. Then, cancel_hw_scan raises null-ptr-deref and use-after-free. Fix it by moving the check condition to where protected by mutex.   KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f]  CPU: 2 PID: 6922 Comm: kworker/2:2 Tainted: G           OE  Hardware name: LENOVO 2356AD1/2356AD1, BIOS G7ETB6WW (2.76 ) 09/10/2019  Workqueue: events cfg80211_conn_work [cfg80211]  RIP: 0010:rtw89_fw_h2c_scan_offload_be+0xc33/0x13c3 [rtw89_core]  Code: 00 45 89 6c 24 1c 0f 85 23 01 00 00 48 8b 85 20 ff ff ff 48 8d  RSP: 0018:ffff88811fd9f068 EFLAGS: 00010206  RAX: dffffc0000000000 RBX: ffff88811fd9f258 RCX: 0000000000000001  RDX: 0000000000000011 RSI: 0000000000000001 RDI: 0000000000000089  RBP: ffff88811fd9f170 R08: 0000000000000000 R09: 0000000000000000  R10: ffff88811fd9f108 R11: 0000000000000000 R12: ffff88810e47f960  R13: 0000000000000000 R14: 000000000000ffff R15: 0000000000000000  FS:  0000000000000000(0000) GS:ffff8881d6f00000(0000) knlGS:0000000000000000  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  CR2: 00007531dfca55b0 CR3: 00000001be296004 CR4: 00000000001706e0  Call Trace:   <TASK>   ? show_regs+0x61/0x73   ? __die_body+0x20/0x73   ? die_addr+0x4f/0x7b   ? exc_general_protection+0x191/0x1db   ? asm_exc_general_protection+0x27/0x30   ? rtw89_fw_h2c_scan_offload_be+0xc33/0x13c3 [rtw89_core]   ? rtw89_fw_h2c_scan_offload_be+0x458/0x13c3 [rtw89_core]   ? __pfx_rtw89_fw_h2c_scan_offload_be+0x10/0x10 [rtw89_core]   ? do_raw_spin_lock+0x75/0xdb   ? __pfx_do_raw_spin_lock+0x10/0x10   rtw89_hw_scan_offload+0xb5e/0xbf7 [rtw89_core]   ? _raw_spin_unlock+0xe/0x24   ? __mutex_lock.constprop.0+0x40c/0x471   ? __pfx_rtw89_hw_scan_offload+0x10/0x10 [rtw89_core]   ? __mutex_lock_slowpath+0x13/0x1f   ? mutex_lock+0xa2/0xdc   ? __pfx_mutex_lock+0x10/0x10   rtw89_hw_scan_abort+0x58/0xb7 [rtw89_core]   rtw89_ops_cancel_hw_scan+0x120/0x13b [rtw89_core]   ieee80211_scan_cancel+0x468/0x4d0 [mac80211]   ieee80211_prep_connection+0x858/0x899 [mac80211]   ieee80211_mgd_auth+0xbea/0xdde [mac80211]   ? __pfx_ieee80211_mgd_auth+0x10/0x10 [mac80211]   ? cfg80211_find_elem+0x15/0x29 [cfg80211]   ? is_bss+0x1b7/0x1d7 [cfg80211]   ieee80211_auth+0x18/0x27 [mac80211]   cfg80211_mlme_auth+0x3bb/0x3e7 [cfg80211]   cfg80211_conn_do_work+0x410/0xb81 [cfg80211]   ? __pfx_cfg80211_conn_do_work+0x10/0x10 [cfg80211]   ? __kasan_check_read+0x11/0x1f   ? psi_group_change+0x8bc/0x944   ? __kasan_check_write+0x14/0x22   ? mutex_lock+0x8e/0xdc   ? __pfx_mutex_lock+0x10/0x10   ? __pfx___radix_tree_lookup+0x10/0x10   cfg80211_conn_work+0x245/0x34d [cfg80211]   ? __pfx_cfg80211_conn_work+0x10/0x10 [cfg80211]   ? update_cfs_rq_load_avg+0x3bc/0x3d7   ? sched_clock_noinstr+0x9/0x1a   ? sched_clock+0x10/0x24   ? sched_clock_cpu+0x7e/0x42e   ? newidle_balance+0x796/0x937   ? __pfx_sched_clock_cpu+0x10/0x10   ? __pfx_newidle_balance+0x10/0x10   ? __kasan_check_read+0x11/0x1f   ? psi_group_change+0x8bc/0x944   ? _raw_spin_unlock+0xe/0x24   ? raw_spin_rq_unlock+0x47/0x54   ? raw_spin_rq_unlock_irq+0x9/0x1f   ? finish_task_switch.isra.0+0x347/0x586   ? __schedule+0x27bf/0x2892   ? mutex_unlock+0x80/0xd0   ? do_raw_spin_lock+0x75/0xdb   ? __pfx___schedule+0x10/0x10   process_scheduled_works+0x58c/0x821   worker_thread+0x4c7/0x586   ? __kasan_check_read+0x11/0x1f   kthread+0x285/0x294   ? __pfx_worker_thread+0x10/0x10   ? __pfx_kthread+0x10/0x10   ret_from_fork+0x29/0x6f   ? __pfx_kthread+0x10/0x10   ret_from_fork_asm+0x1b/0x30   </TASK>
published:2025-02-27T02:15:16.637


Instruction: Please provide detailed information about CVE-2025-21730

CVE:CVE-2025-21730
Description:In the Linux kernel, the following vulnerability has been resolved:  wifi: rtw89: avoid to init mgnt_entry list twice when WoWLAN failed  If WoWLAN failed in resume flow, the rtw89_ops_add_interface() triggered without removing the interface first. Then the mgnt_entry list init again, causing the list_empty() check in rtw89_chanctx_ops_assign_vif() useless, and list_add_tail() again. Therefore, we have added a check to prevent double adding of the list.  rtw89_8852ce 0000:01:00.0: failed to check wow status disabled rtw89_8852ce 0000:01:00.0: wow: failed to check disable fw ready rtw89_8852ce 0000:01:00.0: wow: failed to swap to normal fw rtw89_8852ce 0000:01:00.0: failed to disable wow rtw89_8852ce 0000:01:00.0: failed to resume for wow -110 rtw89_8852ce 0000:01:00.0: MAC has already powered on i2c_hid_acpi i2c-ILTK0001:00: PM: acpi_subsys_resume+0x0/0x60 returned 0 after 284705 usecs list_add corruption. prev->next should be next (ffff9d9719d82228), but was ffff9d9719f96030. (prev=ffff9d9719f96030). ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:34! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 2 PID: 6918 Comm: kworker/u8:19 Tainted: G     U     O Hardware name: Google Anraggar/Anraggar, BIOS Google_Anraggar.15217.514.0 03/25/2024 Workqueue: events_unbound async_run_entry_fn RIP: 0010:__list_add_valid_or_report+0x9f/0xb0 Code: e8 56 89 ff ff 0f 0b 48 c7 c7 3e fc e0 96 48 89 c6 e8 45 89 ff ... RSP: 0018:ffffa51b42bbbaf0 EFLAGS: 00010246 RAX: 0000000000000075 RBX: ffff9d9719d82ab0 RCX: 13acb86e047a4400 RDX: 3fffffffffffffff RSI: 0000000000000000 RDI: 00000000ffffdfff RBP: ffffa51b42bbbb28 R08: ffffffff9768e250 R09: 0000000000001fff R10: ffffffff9765e250 R11: 0000000000005ffd R12: ffff9d9719f95c40 R13: ffff9d9719f95be8 R14: ffff9d97081bfd78 R15: ffff9d9719d82060 FS:  0000000000000000(0000) GS:ffff9d9a6fb00000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007e7d029a4060 CR3: 0000000345e38000 CR4: 0000000000750ee0 PKRU: 55555554 Call Trace:  <TASK>  ? __die_body+0x68/0xb0  ? die+0xaa/0xd0  ? do_trap+0x9f/0x170  ? __list_add_valid_or_report+0x9f/0xb0  ? __list_add_valid_or_report+0x9f/0xb0  ? handle_invalid_op+0x69/0x90  ? __list_add_valid_or_report+0x9f/0xb0  ? exc_invalid_op+0x3c/0x50  ? asm_exc_invalid_op+0x16/0x20  ? __list_add_valid_or_report+0x9f/0xb0  rtw89_chanctx_ops_assign_vif+0x1f9/0x210 [rtw89_core cbb375c44bf28564ce479002bff66617a25d9ac1]  ? __mutex_unlock_slowpath+0xa0/0xf0  rtw89_ops_assign_vif_chanctx+0x4b/0x90 [rtw89_core cbb375c44bf28564ce479002bff66617a25d9ac1]  drv_assign_vif_chanctx+0xa7/0x1f0 [mac80211 6efaad16237edaaea0868b132d4f93ecf918a8b6]  ieee80211_reconfig+0x9cb/0x17b0 [mac80211 6efaad16237edaaea0868b132d4f93ecf918a8b6]  ? __pfx_wiphy_resume+0x10/0x10 [cfg80211 572d03acaaa933fe38251be7fce3b3675284b8ed]  ? dev_printk_emit+0x51/0x70  ? _dev_info+0x6e/0x90  wiphy_resume+0x89/0x180 [cfg80211 572d03acaaa933fe38251be7fce3b3675284b8ed]  ? __pfx_wiphy_resume+0x10/0x10 [cfg80211 572d03acaaa933fe38251be7fce3b3675284b8ed]  dpm_run_callback+0x37/0x1e0  device_resume+0x26d/0x4b0  ? __pfx_dpm_watchdog_handler+0x10/0x10  async_resume+0x1d/0x30  async_run_entry_fn+0x29/0xd0  worker_thread+0x397/0x970  kthread+0xed/0x110  ? __pfx_worker_thread+0x10/0x10  ? __pfx_kthread+0x10/0x10  ret_from_fork+0x38/0x50  ? __pfx_kthread+0x10/0x10  ret_from_fork_asm+0x1b/0x30  </TASK>
published:2025-02-27T02:15:16.733


Instruction: Please provide detailed information about CVE-2025-21731

CVE:CVE-2025-21731
Description:In the Linux kernel, the following vulnerability has been resolved:  nbd: don't allow reconnect after disconnect  Following process can cause nbd_config UAF:  1) grab nbd_config temporarily;  2) nbd_genl_disconnect() flush all recv_work() and release the initial reference:    nbd_genl_disconnect    nbd_disconnect_and_put     nbd_disconnect      flush_workqueue(nbd->recv_workq)     if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, ...))      nbd_config_put      -> due to step 1), reference is still not zero  3) nbd_genl_reconfigure() queue recv_work() again;    nbd_genl_reconfigure    config = nbd_get_config_unlocked(nbd)    if (!config)    -> succeed    if (!test_bit(NBD_RT_BOUND, ...))    -> succeed    nbd_reconnect_socket     queue_work(nbd->recv_workq, &args->work)  4) step 1) release the reference;  5) Finially, recv_work() will trigger UAF:    recv_work    nbd_config_put(nbd)    -> nbd_config is freed    atomic_dec(&config->recv_threads)    -> UAF  Fix the problem by clearing NBD_RT_BOUND in nbd_genl_disconnect(), so that nbd_genl_reconfigure() will fail.
published:2025-02-27T02:15:16.833


Instruction: Please provide detailed information about CVE-2025-21732

CVE:CVE-2025-21732
Description:In the Linux kernel, the following vulnerability has been resolved:  RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error  This patch addresses a race condition for an ODP MR that can result in a CQE with an error on the UMR QP.  During the __mlx5_ib_dereg_mr() flow, the following sequence of calls occurs:  mlx5_revoke_mr()  mlx5r_umr_revoke_mr()  mlx5r_umr_post_send_wait()  At this point, the lkey is freed from the hardware's perspective.  However, concurrently, mlx5_ib_invalidate_range() might be triggered by another task attempting to invalidate a range for the same freed lkey.  This task will:  - Acquire the umem_odp->umem_mutex lock.  - Call mlx5r_umr_update_xlt() on the UMR QP.  - Since the lkey has already been freed, this can lead to a CQE error,    causing the UMR QP to enter an error state [1].  To resolve this race condition, the umem_odp->umem_mutex lock is now also acquired as part of the mlx5_revoke_mr() scope.  Upon successful revoke, we set umem_odp->private which points to that MR to NULL, preventing any further invalidation attempts on its lkey.  [1] From dmesg:     infiniband rocep8s0f0: dump_cqe:277:(pid 0): WC error: 6, Message: memory bind operation error    cqe_dump: 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    cqe_dump: 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    cqe_dump: 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    cqe_dump: 00000030: 00 00 00 00 08 00 78 06 25 00 11 b9 00 0e dd d2     WARNING: CPU: 15 PID: 1506 at drivers/infiniband/hw/mlx5/umr.c:394 mlx5r_umr_post_send_wait+0x15a/0x2b0 [mlx5_ib]    Modules linked in: ip6table_mangle ip6table_natip6table_filter ip6_tables iptable_mangle xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_umad ib_ipoib ib_cm mlx5_ib ib_uverbs ib_core fuse mlx5_core    CPU: 15 UID: 0 PID: 1506 Comm: ibv_rc_pingpong Not tainted 6.12.0-rc7+ #1626    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014    RIP: 0010:mlx5r_umr_post_send_wait+0x15a/0x2b0 [mlx5_ib]    [..]    Call Trace:    <TASK>    mlx5r_umr_update_xlt+0x23c/0x3e0 [mlx5_ib]    mlx5_ib_invalidate_range+0x2e1/0x330 [mlx5_ib]    __mmu_notifier_invalidate_range_start+0x1e1/0x240    zap_page_range_single+0xf1/0x1a0    madvise_vma_behavior+0x677/0x6e0    do_madvise+0x1a2/0x4b0    __x64_sys_madvise+0x25/0x30    do_syscall_64+0x6b/0x140    entry_SYSCALL_64_after_hwframe+0x76/0x7e
published:2025-02-27T03:15:13.820