Instruction: Please provide detailed information about CVE-2025-21733

CVE:CVE-2025-21733
Description:In the Linux kernel, the following vulnerability has been resolved:  tracing/osnoise: Fix resetting of tracepoints  If a timerlat tracer is started with the osnoise option OSNOISE_WORKLOAD disabled, but then that option is enabled and timerlat is removed, the tracepoints that were enabled on timerlat registration do not get disabled. If the option is disabled again and timelat is started, then it triggers a warning in the tracepoint code due to registering the tracepoint again without ever disabling it.  Do not use the same user space defined options to know to disable the tracepoints when timerlat is removed. Instead, set a global flag when it is enabled and use that flag to know to disable the events.   ~# echo NO_OSNOISE_WORKLOAD > /sys/kernel/tracing/osnoise/options  ~# echo timerlat > /sys/kernel/tracing/current_tracer  ~# echo OSNOISE_WORKLOAD > /sys/kernel/tracing/osnoise/options  ~# echo nop > /sys/kernel/tracing/current_tracer  ~# echo NO_OSNOISE_WORKLOAD > /sys/kernel/tracing/osnoise/options  ~# echo timerlat > /sys/kernel/tracing/current_tracer  Triggers:   ------------[ cut here ]------------  WARNING: CPU: 6 PID: 1337 at kernel/tracepoint.c:294 tracepoint_add_func+0x3b6/0x3f0  Modules linked in:  CPU: 6 UID: 0 PID: 1337 Comm: rtla Not tainted 6.13.0-rc4-test-00018-ga867c441128e-dirty #73  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014  RIP: 0010:tracepoint_add_func+0x3b6/0x3f0  Code: 48 8b 53 28 48 8b 73 20 4c 89 04 24 e8 23 59 11 00 4c 8b 04 24 e9 36 fe ff ff 0f 0b b8 ea ff ff ff 45 84 e4 0f 84 68 fe ff ff <0f> 0b e9 61 fe ff ff 48 8b 7b 18 48 85 ff 0f 84 4f ff ff ff 49 8b  RSP: 0018:ffffb9b003a87ca0 EFLAGS: 00010202  RAX: 00000000ffffffef RBX: ffffffff92f30860 RCX: 0000000000000000  RDX: 0000000000000000 RSI: ffff9bf59e91ccd0 RDI: ffffffff913b6410  RBP: 000000000000000a R08: 00000000000005c7 R09: 0000000000000002  R10: ffffb9b003a87ce0 R11: 0000000000000002 R12: 0000000000000001  R13: ffffb9b003a87ce0 R14: ffffffffffffffef R15: 0000000000000008  FS:  00007fce81209240(0000) GS:ffff9bf6fdd00000(0000) knlGS:0000000000000000  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  CR2: 000055e99b728000 CR3: 00000001277c0002 CR4: 0000000000172ef0  Call Trace:   <TASK>   ? __warn.cold+0xb7/0x14d   ? tracepoint_add_func+0x3b6/0x3f0   ? report_bug+0xea/0x170   ? handle_bug+0x58/0x90   ? exc_invalid_op+0x17/0x70   ? asm_exc_invalid_op+0x1a/0x20   ? __pfx_trace_sched_migrate_callback+0x10/0x10   ? tracepoint_add_func+0x3b6/0x3f0   ? __pfx_trace_sched_migrate_callback+0x10/0x10   ? __pfx_trace_sched_migrate_callback+0x10/0x10   tracepoint_probe_register+0x78/0xb0   ? __pfx_trace_sched_migrate_callback+0x10/0x10   osnoise_workload_start+0x2b5/0x370   timerlat_tracer_init+0x76/0x1b0   tracing_set_tracer+0x244/0x400   tracing_set_trace_write+0xa0/0xe0   vfs_write+0xfc/0x570   ? do_sys_openat2+0x9c/0xe0   ksys_write+0x72/0xf0   do_syscall_64+0x79/0x1c0   entry_SYSCALL_64_after_hwframe+0x76/0x7e
published:2025-02-27T03:15:13.923


Instruction: Please provide detailed information about CVE-2025-21734

CVE:CVE-2025-21734
Description:In the Linux kernel, the following vulnerability has been resolved:  misc: fastrpc: Fix copy buffer page size  For non-registered buffer, fastrpc driver copies the buffer and pass it to the remote subsystem. There is a problem with current implementation of page size calculation which is not considering the offset in the calculation. This might lead to passing of improper and out-of-bounds page size which could result in memory issue. Calculate page start and page end using the offset adjusted address instead of absolute address.
published:2025-02-27T03:15:14.030


Instruction: Please provide detailed information about CVE-2025-21735

CVE:CVE-2025-21735
Description:In the Linux kernel, the following vulnerability has been resolved:  NFC: nci: Add bounds checking in nci_hci_create_pipe()  The "pipe" variable is a u8 which comes from the network.  If it's more than 127, then it results in memory corruption in the caller, nci_hci_connect_gate().
published:2025-02-27T03:15:14.130


Instruction: Please provide detailed information about CVE-2025-21736

CVE:CVE-2025-21736
Description:In the Linux kernel, the following vulnerability has been resolved:  nilfs2: fix possible int overflows in nilfs_fiemap()  Since nilfs_bmap_lookup_contig() in nilfs_fiemap() calculates its result by being prepared to go through potentially maxblocks == INT_MAX blocks, the value in n may experience an overflow caused by left shift of blkbits.  While it is extremely unlikely to occur, play it safe and cast right hand expression to wider type to mitigate the issue.  Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.
published:2025-02-27T03:15:14.230


Instruction: Please provide detailed information about CVE-2025-21737

CVE:CVE-2025-21737
Description:In the Linux kernel, the following vulnerability has been resolved:  ceph: fix memory leak in ceph_mds_auth_match()  We now free the temporary target path substring allocation on every possible branch, instead of omitting the default branch.  In some cases, a memory leak occured, which could rapidly crash the system (depending on how many file accesses were attempted).  This was detected in production because it caused a continuous memory growth, eventually triggering kernel OOM and completely hard-locking the kernel.  Relevant kmemleak stacktrace:      unreferenced object 0xffff888131e69900 (size 128):       comm "git", pid 66104, jiffies 4295435999       hex dump (first 32 bytes):         76 6f 6c 75 6d 65 73 2f 63 6f 6e 74 61 69 6e 65  volumes/containe         72 73 2f 67 69 74 65 61 2f 67 69 74 65 61 2f 67  rs/gitea/gitea/g       backtrace (crc 2f3bb450):         [<ffffffffaa68fb49>] __kmalloc_noprof+0x359/0x510         [<ffffffffc32bf1df>] ceph_mds_check_access+0x5bf/0x14e0 [ceph]         [<ffffffffc3235722>] ceph_open+0x312/0xd80 [ceph]         [<ffffffffaa7dd786>] do_dentry_open+0x456/0x1120         [<ffffffffaa7e3729>] vfs_open+0x79/0x360         [<ffffffffaa832875>] path_openat+0x1de5/0x4390         [<ffffffffaa834fcc>] do_filp_open+0x19c/0x3c0         [<ffffffffaa7e44a1>] do_sys_openat2+0x141/0x180         [<ffffffffaa7e4945>] __x64_sys_open+0xe5/0x1a0         [<ffffffffac2cc2f7>] do_syscall_64+0xb7/0x210         [<ffffffffac400130>] entry_SYSCALL_64_after_hwframe+0x77/0x7f  It can be triggered by mouting a subdirectory of a CephFS filesystem, and then trying to access files on this subdirectory with an auth token using a path-scoped capability:      $ ceph auth get client.services     [client.services]             key = REDACTED             caps mds = "allow rw fsname=cephfs path=/volumes/"             caps mon = "allow r fsname=cephfs"             caps osd = "allow rw tag cephfs data=cephfs"      $ cat /proc/self/mounts     services@[REDACTED].cephfs=/volumes/containers /ceph/containers ceph rw,noatime,name=services,secret=<hidden>,ms_mode=prefer-crc,mount_timeout=300,acl,mon_addr=[REDACTED]:3300,recover_session=clean 0 0      $ seq 1 1000000 | xargs -P32 --replace={} touch /ceph/containers/file-{} && \     seq 1 1000000 | xargs -P32 --replace={} cat /ceph/containers/file-{}  [ idryomov: combine if statements, rename rc to path_matched and make             it a bool, formatting ]
published:2025-02-27T03:15:14.327


Instruction: Please provide detailed information about CVE-2025-21738

CVE:CVE-2025-21738
Description:In the Linux kernel, the following vulnerability has been resolved:  ata: libata-sff: Ensure that we cannot write outside the allocated buffer  reveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len set to 0xd42, SCSI command set to ATA_16 PASS-THROUGH, ATA command set to ATA_NOP, and protocol set to ATA_PROT_PIO, can cause ata_pio_sector() to write outside the allocated buffer, overwriting random memory.  While a ATA device is supposed to abort a ATA_NOP command, there does seem to be a bug either in libata-sff or QEMU, where either this status is not set, or the status is cleared before read by ata_sff_hsm_move(). Anyway, that is most likely a separate bug.  Looking at __atapi_pio_bytes(), it already has a safety check to ensure that __atapi_pio_bytes() cannot write outside the allocated buffer.  Add a similar check to ata_pio_sector(), such that also ata_pio_sector() cannot write outside the allocated buffer.
published:2025-02-27T03:15:14.427


Instruction: Please provide detailed information about CVE-2025-21739

CVE:CVE-2025-21739
Description:In the Linux kernel, the following vulnerability has been resolved:  scsi: ufs: core: Fix use-after free in init error and remove paths  devm_blk_crypto_profile_init() registers a cleanup handler to run when the associated (platform-) device is being released. For UFS, the crypto private data and pointers are stored as part of the ufs_hba's data structure 'struct ufs_hba::crypto_profile'. This structure is allocated as part of the underlying ufshcd and therefore Scsi_host allocation.  During driver release or during error handling in ufshcd_pltfrm_init(), this structure is released as part of ufshcd_dealloc_host() before the (platform-) device associated with the crypto call above is released. Once this device is released, the crypto cleanup code will run, using the just-released 'struct ufs_hba::crypto_profile'. This causes a use-after-free situation:    Call trace:    kfree+0x60/0x2d8 (P)    kvfree+0x44/0x60    blk_crypto_profile_destroy_callback+0x28/0x70    devm_action_release+0x1c/0x30    release_nodes+0x6c/0x108    devres_release_all+0x98/0x100    device_unbind_cleanup+0x20/0x70    really_probe+0x218/0x2d0  In other words, the initialisation code flow is:    platform-device probe     ufshcd_pltfrm_init()       ufshcd_alloc_host()         scsi_host_alloc()           allocation of struct ufs_hba           creation of scsi-host devices     devm_blk_crypto_profile_init()       devm registration of cleanup handler using platform-device  and during error handling of ufshcd_pltfrm_init() or during driver removal:    ufshcd_dealloc_host()     scsi_host_put()       put_device(scsi-host)         release of struct ufs_hba   put_device(platform-device)     crypto cleanup handler  To fix this use-after free, change ufshcd_alloc_host() to register a devres action to automatically cleanup the underlying SCSI device on ufshcd destruction, without requiring explicit calls to ufshcd_dealloc_host(). This way:      * the crypto profile and all other ufs_hba-owned resources are       destroyed before SCSI (as they've been registered after)     * a memleak is plugged in tc-dwc-g210-pci.c remove() as a       side-effect     * EXPORT_SYMBOL_GPL(ufshcd_dealloc_host) can be removed fully as       it's not needed anymore     * no future drivers using ufshcd_alloc_host() could ever forget       adding the cleanup
published:2025-02-27T03:15:14.530


Instruction: Please provide detailed information about CVE-2025-21740

CVE:CVE-2025-21740
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-02-27T03:15:14.630


Instruction: Please provide detailed information about CVE-2025-21741

CVE:CVE-2025-21741
Description:In the Linux kernel, the following vulnerability has been resolved:  usbnet: ipheth: fix DPE OoB read  Fix an out-of-bounds DPE read, limit the number of processed DPEs to the amount that fits into the fixed-size NDP16 header.
published:2025-02-27T03:15:14.730


Instruction: Please provide detailed information about CVE-2025-21742

CVE:CVE-2025-21742
Description:In the Linux kernel, the following vulnerability has been resolved:  usbnet: ipheth: use static NDP16 location in URB  Original code allowed for the start of NDP16 to be anywhere within the URB based on the `wNdpIndex` value in NTH16. Only the start position of NDP16 was checked, so it was possible for even the fixed-length part of NDP16 to extend past the end of URB, leading to an out-of-bounds read.  On iOS devices, the NDP16 header always directly follows NTH16. Rely on and check for this specific format.  This, along with NCM-specific minimal URB length check that already exists, will ensure that the fixed-length part of NDP16 plus a set amount of DPEs fit within the URB.  Note that this commit alone does not fully address the OoB read. The limit on the amount of DPEs needs to be enforced separately.
published:2025-02-27T03:15:14.830


Instruction: Please provide detailed information about CVE-2025-21743

CVE:CVE-2025-21743
Description:In the Linux kernel, the following vulnerability has been resolved:  usbnet: ipheth: fix possible overflow in DPE length check  Originally, it was possible for the DPE length check to overflow if wDatagramIndex + wDatagramLength > U16_MAX. This could lead to an OoB read.  Move the wDatagramIndex term to the other side of the inequality.  An existing condition ensures that wDatagramIndex < urb->actual_length.
published:2025-02-27T03:15:14.933


Instruction: Please provide detailed information about CVE-2025-21744

CVE:CVE-2025-21744
Description:In the Linux kernel, the following vulnerability has been resolved:  wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()  On removal of the device or unloading of the kernel module a potential NULL pointer dereference occurs.  The following sequence deletes the interface:    brcmf_detach()     brcmf_remove_interface()       brcmf_del_if()  Inside the brcmf_del_if() function the drvr->if2bss[ifidx] is updated to BRCMF_BSSIDX_INVALID (-1) if the bsscfgidx matches.  After brcmf_remove_interface() call the brcmf_proto_detach() function is called providing the following sequence:    brcmf_detach()     brcmf_proto_detach()       brcmf_proto_msgbuf_detach()         brcmf_flowring_detach()           brcmf_msgbuf_delete_flowring()             brcmf_msgbuf_remove_flowring()               brcmf_flowring_delete()                 brcmf_get_ifp()                 brcmf_txfinalize()  Since brcmf_get_ip() can and actually will return NULL in this case the call to brcmf_txfinalize() will result in a NULL pointer dereference inside brcmf_txfinalize() when trying to update ifp->ndev->stats.tx_errors.  This will only happen if a flowring still has an skb.  Although the NULL pointer dereference has only been seen when trying to update the tx statistic, all other uses of the ifp pointer have been guarded as well with an early return if ifp is NULL.
published:2025-02-27T03:15:15.037


Instruction: Please provide detailed information about CVE-2025-21745

CVE:CVE-2025-21745
Description:In the Linux kernel, the following vulnerability has been resolved:  blk-cgroup: Fix class @block_class's subsystem refcount leakage  blkcg_fill_root_iostats() iterates over @block_class's devices by class_dev_iter_(init|next)(), but does not end iterating with class_dev_iter_exit(), so causes the class's subsystem refcount leakage.  Fix by ending the iterating with class_dev_iter_exit().
published:2025-02-27T03:15:15.137


Instruction: Please provide detailed information about CVE-2025-21746

CVE:CVE-2025-21746
Description:In the Linux kernel, the following vulnerability has been resolved:  Input: synaptics - fix crash when enabling pass-through port  When enabling a pass-through port an interrupt might come before psmouse driver binds to the pass-through port. However synaptics sub-driver tries to access psmouse instance presumably associated with the pass-through port to figure out if only 1 byte of response or entire protocol packet needs to be forwarded to the pass-through port and may crash if psmouse instance has not been attached to the port yet.  Fix the crash by introducing open() and close() methods for the port and check if the port is open before trying to access psmouse instance. Because psmouse calls serio_open() only after attaching psmouse instance to serio port instance this prevents the potential crash.
published:2025-02-27T03:15:15.243


Instruction: Please provide detailed information about CVE-2025-21747

CVE:CVE-2025-21747
Description:In the Linux kernel, the following vulnerability has been resolved:  drm/ast: astdp: Fix timeout for enabling video signal  The ASTDP transmitter sometimes takes up to 1 second for enabling the video signal, while the timeout is only 200 msec. This results in a kernel error message. Increase the timeout to 1 second. An example of the error message is shown below.  [  697.084433] ------------[ cut here ]------------ [  697.091115] ast 0000:02:00.0: [drm] drm_WARN_ON(!__ast_dp_wait_enable(ast, enabled)) [  697.091233] WARNING: CPU: 1 PID: 160 at drivers/gpu/drm/ast/ast_dp.c:232 ast_dp_set_enable+0x123/0x140 [ast] [...] [  697.272469] RIP: 0010:ast_dp_set_enable+0x123/0x140 [ast] [...] [  697.415283] Call Trace: [  697.420727]  <TASK> [  697.425908]  ? show_trace_log_lvl+0x196/0x2c0 [  697.433304]  ? show_trace_log_lvl+0x196/0x2c0 [  697.440693]  ? drm_atomic_helper_commit_modeset_enables+0x30a/0x470 [  697.450115]  ? ast_dp_set_enable+0x123/0x140 [ast] [  697.458059]  ? __warn.cold+0xaf/0xca [  697.464713]  ? ast_dp_set_enable+0x123/0x140 [ast] [  697.472633]  ? report_bug+0x134/0x1d0 [  697.479544]  ? handle_bug+0x58/0x90 [  697.486127]  ? exc_invalid_op+0x13/0x40 [  697.492975]  ? asm_exc_invalid_op+0x16/0x20 [  697.500224]  ? preempt_count_sub+0x14/0xc0 [  697.507473]  ? ast_dp_set_enable+0x123/0x140 [ast] [  697.515377]  ? ast_dp_set_enable+0x123/0x140 [ast] [  697.523227]  drm_atomic_helper_commit_modeset_enables+0x30a/0x470 [  697.532388]  drm_atomic_helper_commit_tail+0x58/0x90 [  697.540400]  ast_mode_config_helper_atomic_commit_tail+0x30/0x40 [ast] [  697.550009]  commit_tail+0xfe/0x1d0 [  697.556547]  drm_atomic_helper_commit+0x198/0x1c0  This is a cosmetical problem. Enabling the video signal still works even with the error message. The problem has always been present, but only recent versions of the ast driver warn about missing the timeout.
published:2025-02-27T03:15:15.337


Instruction: Please provide detailed information about CVE-2025-21748

CVE:CVE-2025-21748
Description:In the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix integer overflows on 32 bit systems  On 32bit systems the addition operations in ipc_msg_alloc() can potentially overflow leading to memory corruption. Add bounds checking using KSMBD_IPC_MAX_PAYLOAD to avoid overflow.
published:2025-02-27T03:15:15.440


Instruction: Please provide detailed information about CVE-2025-21749

CVE:CVE-2025-21749
Description:In the Linux kernel, the following vulnerability has been resolved:  net: rose: lock the socket in rose_bind()  syzbot reported a soft lockup in rose_loopback_timer(), with a repro calling bind() from multiple threads.  rose_bind() must lock the socket to avoid this issue.
published:2025-02-27T03:15:15.543


Instruction: Please provide detailed information about CVE-2025-21750

CVE:CVE-2025-21750
Description:In the Linux kernel, the following vulnerability has been resolved:  wifi: brcmfmac: Check the return value of of_property_read_string_index()  Somewhen between 6.10 and 6.11 the driver started to crash on my MacBookPro14,3. The property doesn't exist and 'tmp' remains uninitialized, so we pass a random pointer to devm_kstrdup().  The crash I am getting looks like this:  BUG: unable to handle page fault for address: 00007f033c669379 PF: supervisor read access in kernel mode PF: error_code(0x0001) - permissions violation PGD 8000000101341067 P4D 8000000101341067 PUD 101340067 PMD 1013bb067 PTE 800000010aee9025 Oops: Oops: 0001 [#1] SMP PTI CPU: 4 UID: 0 PID: 827 Comm: (udev-worker) Not tainted 6.11.8-gentoo #1 Hardware name: Apple Inc. MacBookPro14,3/Mac-551B86E5744E2388, BIOS 529.140.2.0.0 06/23/2024 RIP: 0010:strlen+0x4/0x30 Code: f7 75 ec 31 c0 c3 cc cc cc cc 48 89 f8 c3 cc cc cc cc 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <80> 3f 00 74 14 48 89 f8 48 83 c0 01 80 38 00 75 f7 48 29 f8 c3 cc RSP: 0018:ffffb4aac0683ad8 EFLAGS: 00010202 RAX: 00000000ffffffea RBX: 00007f033c669379 RCX: 0000000000000001 RDX: 0000000000000cc0 RSI: 00007f033c669379 RDI: 00007f033c669379 RBP: 00000000ffffffea R08: 0000000000000000 R09: 00000000c0ba916a R10: ffffffffffffffff R11: ffffffffb61ea260 R12: ffff91f7815b50c8 R13: 0000000000000cc0 R14: ffff91fafefffe30 R15: ffffb4aac0683b30 FS:  00007f033ccbe8c0(0000) GS:ffff91faeed00000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f033c669379 CR3: 0000000107b1e004 CR4: 00000000003706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace:  <TASK>  ? __die+0x23/0x70  ? page_fault_oops+0x149/0x4c0  ? raw_spin_rq_lock_nested+0xe/0x20  ? sched_balance_newidle+0x22b/0x3c0  ? update_load_avg+0x78/0x770  ? exc_page_fault+0x6f/0x150  ? asm_exc_page_fault+0x26/0x30  ? __pfx_pci_conf1_write+0x10/0x10  ? strlen+0x4/0x30  devm_kstrdup+0x25/0x70  brcmf_of_probe+0x273/0x350 [brcmfmac]
published:2025-02-27T03:15:15.647


Instruction: Please provide detailed information about CVE-2025-21751

CVE:CVE-2025-21751
Description:In the Linux kernel, the following vulnerability has been resolved:  net/mlx5: HWS, change error flow on matcher disconnect  Currently, when firmware failure occurs during matcher disconnect flow, the error flow of the function reconnects the matcher back and returns an error, which continues running the calling function and eventually frees the matcher that is being disconnected. This leads to a case where we have a freed matcher on the matchers list, which in turn leads to use-after-free and eventual crash.  This patch fixes that by not trying to reconnect the matcher back when some FW command fails during disconnect.  Note that we're dealing here with FW error. We can't overcome this problem. This might lead to bad steering state (e.g. wrong connection between matchers), and will also lead to resource leakage, as it is the case with any other error handling during resource destruction.  However, the goal here is to allow the driver to continue and not crash the machine with use-after-free error.
published:2025-02-27T03:15:15.760


Instruction: Please provide detailed information about CVE-2025-21752

CVE:CVE-2025-21752
Description:In the Linux kernel, the following vulnerability has been resolved:  btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents  Don't use btrfs_set_item_key_safe() to modify the keys in the RAID stripe-tree, as this can lead to corruption of the tree, which is caught by the checks in btrfs_set_item_key_safe():   BTRFS info (device nvme1n1): leaf 49168384 gen 15 total ptrs 194 free space 8329 owner 12  BTRFS info (device nvme1n1): refs 2 lock_owner 1030 current 1030   [ snip ]   item 105 key (354549760 230 20480) itemoff 14587 itemsize 16                   stride 0 devid 5 physical 67502080   item 106 key (354631680 230 4096) itemoff 14571 itemsize 16                   stride 0 devid 1 physical 88559616   item 107 key (354631680 230 32768) itemoff 14555 itemsize 16                   stride 0 devid 1 physical 88555520   item 108 key (354717696 230 28672) itemoff 14539 itemsize 16                   stride 0 devid 2 physical 67604480   [ snip ]  BTRFS critical (device nvme1n1): slot 106 key (354631680 230 32768) new key (354635776 230 4096)  ------------[ cut here ]------------  kernel BUG at fs/btrfs/ctree.c:2602!  Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI  CPU: 1 UID: 0 PID: 1055 Comm: fsstress Not tainted 6.13.0-rc1+ #1464  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014  RIP: 0010:btrfs_set_item_key_safe+0xf7/0x270  Code: <snip>  RSP: 0018:ffffc90001337ab0 EFLAGS: 00010287  RAX: 0000000000000000 RBX: ffff8881115fd000 RCX: 0000000000000000  RDX: 0000000000000001 RSI: 0000000000000001 RDI: 00000000ffffffff  RBP: ffff888110ed6f50 R08: 00000000ffffefff R09: ffffffff8244c500  R10: 00000000ffffefff R11: 00000000ffffffff R12: ffff888100586000  R13: 00000000000000c9 R14: ffffc90001337b1f R15: ffff888110f23b58  FS:  00007f7d75c72740(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  CR2: 00007fa811652c60 CR3: 0000000111398001 CR4: 0000000000370eb0  Call Trace:   <TASK>   ? __die_body.cold+0x14/0x1a   ? die+0x2e/0x50   ? do_trap+0xca/0x110   ? do_error_trap+0x65/0x80   ? btrfs_set_item_key_safe+0xf7/0x270   ? exc_invalid_op+0x50/0x70   ? btrfs_set_item_key_safe+0xf7/0x270   ? asm_exc_invalid_op+0x1a/0x20   ? btrfs_set_item_key_safe+0xf7/0x270   btrfs_partially_delete_raid_extent+0xc4/0xe0   btrfs_delete_raid_extent+0x227/0x240   __btrfs_free_extent.isra.0+0x57f/0x9c0   ? exc_coproc_segment_overrun+0x40/0x40   __btrfs_run_delayed_refs+0x2fa/0xe80   btrfs_run_delayed_refs+0x81/0xe0   btrfs_commit_transaction+0x2dd/0xbe0   ? preempt_count_add+0x52/0xb0   btrfs_sync_file+0x375/0x4c0   do_fsync+0x39/0x70   __x64_sys_fsync+0x13/0x20   do_syscall_64+0x54/0x110   entry_SYSCALL_64_after_hwframe+0x76/0x7e  RIP: 0033:0x7f7d7550ef90  Code: <snip>  RSP: 002b:00007ffd70237248 EFLAGS: 00000202 ORIG_RAX: 000000000000004a  RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f7d7550ef90  RDX: 000000000000013a RSI: 000000000040eb28 RDI: 0000000000000004  RBP: 000000000000001b R08: 0000000000000078 R09: 00007ffd7023725c  R10: 00007f7d75400390 R11: 0000000000000202 R12: 028f5c28f5c28f5c  R13: 8f5c28f5c28f5c29 R14: 000000000040b520 R15: 00007f7d75c726c8   </TASK>  While the root cause of the tree order corruption isn't clear, using btrfs_duplicate_item() to copy the item and then adjusting both the key and the per-device physical addresses is a safe way to counter this problem.
published:2025-02-27T03:15:15.853


Instruction: Please provide detailed information about CVE-2025-21753

CVE:CVE-2025-21753
Description:In the Linux kernel, the following vulnerability has been resolved:  btrfs: fix use-after-free when attempting to join an aborted transaction  When we are trying to join the current transaction and if it's aborted, we read its 'aborted' field after unlocking fs_info->trans_lock and without holding any extra reference count on it. This means that a concurrent task that is aborting the transaction may free the transaction before we read its 'aborted' field, leading to a use-after-free.  Fix this by reading the 'aborted' field while holding fs_info->trans_lock since any freeing task must first acquire that lock and set fs_info->running_transaction to NULL before freeing the transaction.  This was reported by syzbot and Dmitry with the following stack traces from KASAN:     ==================================================================    BUG: KASAN: slab-use-after-free in join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278    Read of size 4 at addr ffff888011839024 by task kworker/u4:9/1128     CPU: 0 UID: 0 PID: 1128 Comm: kworker/u4:9 Not tainted 6.13.0-rc7-syzkaller-00019-gc45323b7560e #0    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014    Workqueue: events_unbound btrfs_async_reclaim_data_space    Call Trace:     <TASK>     __dump_stack lib/dump_stack.c:94 [inline]     dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120     print_address_description mm/kasan/report.c:378 [inline]     print_report+0x169/0x550 mm/kasan/report.c:489     kasan_report+0x143/0x180 mm/kasan/report.c:602     join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278     start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697     flush_space+0x448/0xcf0 fs/btrfs/space-info.c:803     btrfs_async_reclaim_data_space+0x159/0x510 fs/btrfs/space-info.c:1321     process_one_work kernel/workqueue.c:3236 [inline]     process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317     worker_thread+0x870/0xd30 kernel/workqueue.c:3398     kthread+0x2f0/0x390 kernel/kthread.c:389     ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147     ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244     </TASK>     Allocated by task 5315:     kasan_save_stack mm/kasan/common.c:47 [inline]     kasan_save_track+0x3f/0x80 mm/kasan/common.c:68     poison_kmalloc_redzone mm/kasan/common.c:377 [inline]     __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394     kasan_kmalloc include/linux/kasan.h:260 [inline]     __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329     kmalloc_noprof include/linux/slab.h:901 [inline]     join_transaction+0x144/0xda0 fs/btrfs/transaction.c:308     start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697     btrfs_create_common+0x1b2/0x2e0 fs/btrfs/inode.c:6572     lookup_open fs/namei.c:3649 [inline]     open_last_lookups fs/namei.c:3748 [inline]     path_openat+0x1c03/0x3590 fs/namei.c:3984     do_filp_open+0x27f/0x4e0 fs/namei.c:4014     do_sys_openat2+0x13e/0x1d0 fs/open.c:1402     do_sys_open fs/open.c:1417 [inline]     __do_sys_creat fs/open.c:1495 [inline]     __se_sys_creat fs/open.c:1489 [inline]     __x64_sys_creat+0x123/0x170 fs/open.c:1489     do_syscall_x64 arch/x86/entry/common.c:52 [inline]     do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83     entry_SYSCALL_64_after_hwframe+0x77/0x7f     Freed by task 5336:     kasan_save_stack mm/kasan/common.c:47 [inline]     kasan_save_track+0x3f/0x80 mm/kasan/common.c:68     kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582     poison_slab_object mm/kasan/common.c:247 [inline]     __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264     kasan_slab_free include/linux/kasan.h:233 [inline]     slab_free_hook mm/slub.c:2353 [inline]     slab_free mm/slub.c:4613 [inline]     kfree+0x196/0x430 mm/slub.c:4761     cleanup_transaction fs/btrfs/transaction.c:2063 [inline]     btrfs_commit_transaction+0x2c97/0x3720 fs/btrfs/transaction.c:2598     insert_balance_item+0x1284/0x20b0 fs/btrfs/volumes.c:3757     btrfs_balance+0x992/ ---truncated---
published:2025-02-27T03:15:15.950


Instruction: Please provide detailed information about CVE-2025-21754

CVE:CVE-2025-21754
Description:In the Linux kernel, the following vulnerability has been resolved:  btrfs: fix assertion failure when splitting ordered extent after transaction abort  If while we are doing a direct IO write a transaction abort happens, we mark all existing ordered extents with the BTRFS_ORDERED_IOERR flag (done at btrfs_destroy_ordered_extents()), and then after that if we enter btrfs_split_ordered_extent() and the ordered extent has bytes left (meaning we have a bio that doesn't cover the whole ordered extent, see details at btrfs_extract_ordered_extent()), we will fail on the following assertion at btrfs_split_ordered_extent():     ASSERT(!(flags & ~BTRFS_ORDERED_TYPE_FLAGS));  because the BTRFS_ORDERED_IOERR flag is set and the definition of BTRFS_ORDERED_TYPE_FLAGS is just the union of all flags that identify the type of write (regular, nocow, prealloc, compressed, direct IO, encoded).  Fix this by returning an error from btrfs_extract_ordered_extent() if we find the BTRFS_ORDERED_IOERR flag in the ordered extent. The error will be the error that resulted in the transaction abort or -EIO if no transaction abort happened.  This was recently reported by syzbot with the following trace:     FAULT_INJECTION: forcing a failure.    name failslab, interval 1, probability 0, space 0, times 1    CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted 6.13.0-rc5-syzkaller #0    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014    Call Trace:     <TASK>     __dump_stack lib/dump_stack.c:94 [inline]     dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120     fail_dump lib/fault-inject.c:53 [inline]     should_fail_ex+0x3b0/0x4e0 lib/fault-inject.c:154     should_failslab+0xac/0x100 mm/failslab.c:46     slab_pre_alloc_hook mm/slub.c:4072 [inline]     slab_alloc_node mm/slub.c:4148 [inline]     __do_kmalloc_node mm/slub.c:4297 [inline]     __kmalloc_noprof+0xdd/0x4c0 mm/slub.c:4310     kmalloc_noprof include/linux/slab.h:905 [inline]     kzalloc_noprof include/linux/slab.h:1037 [inline]     btrfs_chunk_alloc_add_chunk_item+0x244/0x1100 fs/btrfs/volumes.c:5742     reserve_chunk_space+0x1ca/0x2c0 fs/btrfs/block-group.c:4292     check_system_chunk fs/btrfs/block-group.c:4319 [inline]     do_chunk_alloc fs/btrfs/block-group.c:3891 [inline]     btrfs_chunk_alloc+0x77b/0xf80 fs/btrfs/block-group.c:4187     find_free_extent_update_loop fs/btrfs/extent-tree.c:4166 [inline]     find_free_extent+0x42d1/0x5810 fs/btrfs/extent-tree.c:4579     btrfs_reserve_extent+0x422/0x810 fs/btrfs/extent-tree.c:4672     btrfs_new_extent_direct fs/btrfs/direct-io.c:186 [inline]     btrfs_get_blocks_direct_write+0x706/0xfa0 fs/btrfs/direct-io.c:321     btrfs_dio_iomap_begin+0xbb7/0x1180 fs/btrfs/direct-io.c:525     iomap_iter+0x697/0xf60 fs/iomap/iter.c:90     __iomap_dio_rw+0xeb9/0x25b0 fs/iomap/direct-io.c:702     btrfs_dio_write fs/btrfs/direct-io.c:775 [inline]     btrfs_direct_write+0x610/0xa30 fs/btrfs/direct-io.c:880     btrfs_do_write_iter+0x2a0/0x760 fs/btrfs/file.c:1397     do_iter_readv_writev+0x600/0x880     vfs_writev+0x376/0xba0 fs/read_write.c:1050     do_pwritev fs/read_write.c:1146 [inline]     __do_sys_pwritev2 fs/read_write.c:1204 [inline]     __se_sys_pwritev2+0x196/0x2b0 fs/read_write.c:1195     do_syscall_x64 arch/x86/entry/common.c:52 [inline]     do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83     entry_SYSCALL_64_after_hwframe+0x77/0x7f    RIP: 0033:0x7f1281f85d29    RSP: 002b:00007f12819fe038 EFLAGS: 00000246 ORIG_RAX: 0000000000000148    RAX: ffffffffffffffda RBX: 00007f1282176080 RCX: 00007f1281f85d29    RDX: 0000000000000001 RSI: 0000000020000240 RDI: 0000000000000005    RBP: 00007f12819fe090 R08: 0000000000000000 R09: 0000000000000003    R10: 0000000000007000 R11: 0000000000000246 R12: 0000000000000002    R13: 0000000000000000 R14: 00007f1282176080 R15: 00007ffcb9e23328     </TASK>    BTRFS error (device loop0 state A): Transaction aborted (error -12)    BTRFS: error (device loop0 state A ---truncated---
published:2025-02-27T03:15:16.050


Instruction: Please provide detailed information about CVE-2025-21755

CVE:CVE-2025-21755
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-02-27T03:15:16.150


Instruction: Please provide detailed information about CVE-2025-21756

CVE:CVE-2025-21756
Description:In the Linux kernel, the following vulnerability has been resolved:  vsock: Keep the binding until socket destruction  Preserve sockets bindings; this includes both resulting from an explicit bind() and those implicitly bound through autobind during connect().  Prevents socket unbinding during a transport reassignment, which fixes a use-after-free:      1. vsock_create() (refcnt=1) calls vsock_insert_unbound() (refcnt=2)     2. transport->release() calls vsock_remove_bound() without checking if        sk was bound and moved to bound list (refcnt=1)     3. vsock_bind() assumes sk is in unbound list and before        __vsock_insert_bound(vsock_bound_sockets()) calls        __vsock_remove_bound() which does:            list_del_init(&vsk->bound_table); // nop            sock_put(&vsk->sk);               // refcnt=0  BUG: KASAN: slab-use-after-free in __vsock_bind+0x62e/0x730 Read of size 4 at addr ffff88816b46a74c by task a.out/2057  dump_stack_lvl+0x68/0x90  print_report+0x174/0x4f6  kasan_report+0xb9/0x190  __vsock_bind+0x62e/0x730  vsock_bind+0x97/0xe0  __sys_bind+0x154/0x1f0  __x64_sys_bind+0x6e/0xb0  do_syscall_64+0x93/0x1b0  entry_SYSCALL_64_after_hwframe+0x76/0x7e  Allocated by task 2057:  kasan_save_stack+0x1e/0x40  kasan_save_track+0x10/0x30  __kasan_slab_alloc+0x85/0x90  kmem_cache_alloc_noprof+0x131/0x450  sk_prot_alloc+0x5b/0x220  sk_alloc+0x2c/0x870  __vsock_create.constprop.0+0x2e/0xb60  vsock_create+0xe4/0x420  __sock_create+0x241/0x650  __sys_socket+0xf2/0x1a0  __x64_sys_socket+0x6e/0xb0  do_syscall_64+0x93/0x1b0  entry_SYSCALL_64_after_hwframe+0x76/0x7e  Freed by task 2057:  kasan_save_stack+0x1e/0x40  kasan_save_track+0x10/0x30  kasan_save_free_info+0x37/0x60  __kasan_slab_free+0x4b/0x70  kmem_cache_free+0x1a1/0x590  __sk_destruct+0x388/0x5a0  __vsock_bind+0x5e1/0x730  vsock_bind+0x97/0xe0  __sys_bind+0x154/0x1f0  __x64_sys_bind+0x6e/0xb0  do_syscall_64+0x93/0x1b0  entry_SYSCALL_64_after_hwframe+0x76/0x7e  refcount_t: addition on 0; use-after-free. WARNING: CPU: 7 PID: 2057 at lib/refcount.c:25 refcount_warn_saturate+0xce/0x150 RIP: 0010:refcount_warn_saturate+0xce/0x150  __vsock_bind+0x66d/0x730  vsock_bind+0x97/0xe0  __sys_bind+0x154/0x1f0  __x64_sys_bind+0x6e/0xb0  do_syscall_64+0x93/0x1b0  entry_SYSCALL_64_after_hwframe+0x76/0x7e  refcount_t: underflow; use-after-free. WARNING: CPU: 7 PID: 2057 at lib/refcount.c:28 refcount_warn_saturate+0xee/0x150 RIP: 0010:refcount_warn_saturate+0xee/0x150  vsock_remove_bound+0x187/0x1e0  __vsock_release+0x383/0x4a0  vsock_release+0x90/0x120  __sock_release+0xa3/0x250  sock_close+0x14/0x20  __fput+0x359/0xa80  task_work_run+0x107/0x1d0  do_exit+0x847/0x2560  do_group_exit+0xb8/0x250  __x64_sys_exit_group+0x3a/0x50  x64_sys_call+0xfec/0x14f0  do_syscall_64+0x93/0x1b0  entry_SYSCALL_64_after_hwframe+0x76/0x7e
published:2025-02-27T03:15:16.250


Instruction: Please provide detailed information about CVE-2025-21757

CVE:CVE-2025-21757
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-02-27T03:15:16.353


Instruction: Please provide detailed information about CVE-2025-21758

CVE:CVE-2025-21758
Description:In the Linux kernel, the following vulnerability has been resolved:  ipv6: mcast: add RCU protection to mld_newpack()  mld_newpack() can be called without RTNL or RCU being held.  Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.  Instead use alloc_skb() and charge the net->ipv6.igmp_sk socket under RCU protection.
published:2025-02-27T03:15:16.450


Instruction: Please provide detailed information about CVE-2025-21759

CVE:CVE-2025-21759
Description:In the Linux kernel, the following vulnerability has been resolved:  ipv6: mcast: extend RCU protection in igmp6_send()  igmp6_send() can be called without RTNL or RCU being held.  Extend RCU protection so that we can safely fetch the net pointer and avoid a potential UAF.  Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.  Instead use alloc_skb() and charge the net->ipv6.igmp_sk socket under RCU protection.
published:2025-02-27T03:15:16.550


Instruction: Please provide detailed information about CVE-2025-21760

CVE:CVE-2025-21760
Description:In the Linux kernel, the following vulnerability has been resolved:  ndisc: extend RCU protection in ndisc_send_skb()  ndisc_send_skb() can be called without RTNL or RCU held.  Acquire rcu_read_lock() earlier, so that we can use dev_net_rcu() and avoid a potential UAF.
published:2025-02-27T03:15:16.653


Instruction: Please provide detailed information about CVE-2025-21761

CVE:CVE-2025-21761
Description:In the Linux kernel, the following vulnerability has been resolved:  openvswitch: use RCU protection in ovs_vport_cmd_fill_info()  ovs_vport_cmd_fill_info() can be called without RTNL or RCU.  Use RCU protection and dev_net_rcu() to avoid potential UAF.
published:2025-02-27T03:15:16.757


Instruction: Please provide detailed information about CVE-2025-21762

CVE:CVE-2025-21762
Description:In the Linux kernel, the following vulnerability has been resolved:  arp: use RCU protection in arp_xmit()  arp_xmit() can be called without RTNL or RCU protection.  Use RCU protection to avoid potential UAF.
published:2025-02-27T03:15:16.857


Instruction: Please provide detailed information about CVE-2025-21763

CVE:CVE-2025-21763
Description:In the Linux kernel, the following vulnerability has been resolved:  neighbour: use RCU protection in __neigh_notify()  __neigh_notify() can be called without RTNL or RCU protection.  Use RCU protection to avoid potential UAF.
published:2025-02-27T03:15:16.960


Instruction: Please provide detailed information about CVE-2025-21764

CVE:CVE-2025-21764
Description:In the Linux kernel, the following vulnerability has been resolved:  ndisc: use RCU protection in ndisc_alloc_skb()  ndisc_alloc_skb() can be called without RTNL or RCU being held.  Add RCU protection to avoid possible UAF.
published:2025-02-27T03:15:17.063


Instruction: Please provide detailed information about CVE-2025-21765

CVE:CVE-2025-21765
Description:In the Linux kernel, the following vulnerability has been resolved:  ipv6: use RCU protection in ip6_default_advmss()  ip6_default_advmss() needs rcu protection to make sure the net structure it reads does not disappear.
published:2025-02-27T03:15:17.173


Instruction: Please provide detailed information about CVE-2025-21766

CVE:CVE-2025-21766
Description:In the Linux kernel, the following vulnerability has been resolved:  ipv4: use RCU protection in __ip_rt_update_pmtu()  __ip_rt_update_pmtu() must use RCU protection to make sure the net structure it reads does not disappear.
published:2025-02-27T03:15:17.273


Instruction: Please provide detailed information about CVE-2025-21767

CVE:CVE-2025-21767
Description:In the Linux kernel, the following vulnerability has been resolved:  clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context  The following bug report happened with a PREEMPT_RT kernel:    BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48   in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2012, name: kwatchdog   preempt_count: 1, expected: 0   RCU nest depth: 0, expected: 0   get_random_u32+0x4f/0x110   clocksource_verify_choose_cpus+0xab/0x1a0   clocksource_verify_percpu.part.0+0x6b/0x330   clocksource_watchdog_kthread+0x193/0x1a0  It is due to the fact that clocksource_verify_choose_cpus() is invoked with preemption disabled.  This function invokes get_random_u32() to obtain random numbers for choosing CPUs.  The batched_entropy_32 local lock and/or the base_crng.lock spinlock in driver/char/random.c will be acquired during the call. In PREEMPT_RT kernel, they are both sleeping locks and so cannot be acquired in atomic context.  Fix this problem by using migrate_disable() to allow smp_processor_id() to be reliably used without introducing atomic context. preempt_disable() is then called after clocksource_verify_choose_cpus() but before the clocksource measurement is being run to avoid introducing unexpected latency.
published:2025-02-27T03:15:17.383


Instruction: Please provide detailed information about CVE-2025-21768

CVE:CVE-2025-21768
Description:In the Linux kernel, the following vulnerability has been resolved:  net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels  Some lwtunnels have a dst cache for post-transformation dst. If the packet destination did not change we may end up recording a reference to the lwtunnel in its own cache, and the lwtunnel state will never be freed.  Discovered by the ioam6.sh test, kmemleak was recently fixed to catch per-cpu memory leaks. I'm not sure if rpl and seg6 can actually hit this, but in principle I don't see why not.
published:2025-02-27T03:15:17.480


Instruction: Please provide detailed information about CVE-2025-21769

CVE:CVE-2025-21769
Description:In the Linux kernel, the following vulnerability has been resolved:  ptp: vmclock: Add .owner to vmclock_miscdev_fops  Without the .owner field, the module can be unloaded while /dev/vmclock0 is open, leading to an oops.
published:2025-02-27T03:15:17.580


Instruction: Please provide detailed information about CVE-2025-21770

CVE:CVE-2025-21770
Description:In the Linux kernel, the following vulnerability has been resolved:  iommu: Fix potential memory leak in iopf_queue_remove_device()  The iopf_queue_remove_device() helper removes a device from the per-iommu iopf queue when PRI is disabled on the device. It responds to all outstanding iopf's with an IOMMU_PAGE_RESP_INVALID code and detaches the device from the queue.  However, it fails to release the group structure that represents a group of iopf's awaiting for a response after responding to the hardware. This can cause a memory leak if iopf_queue_remove_device() is called with pending iopf's.  Fix it by calling iopf_free_group() after the iopf group is responded.
published:2025-02-27T03:15:17.677


Instruction: Please provide detailed information about CVE-2025-21771

CVE:CVE-2025-21771
Description:In the Linux kernel, the following vulnerability has been resolved:  sched_ext: Fix incorrect autogroup migration detection  scx_move_task() is called from sched_move_task() and tells the BPF scheduler that cgroup migration is being committed. sched_move_task() is used by both cgroup and autogroup migrations and scx_move_task() tried to filter out autogroup migrations by testing the destination cgroup and PF_EXITING but this is not enough. In fact, without explicitly tagging the thread which is doing the cgroup migration, there is no good way to tell apart scx_move_task() invocations for racing migration to the root cgroup and an autogroup migration.  This led to scx_move_task() incorrectly ignoring a migration from non-root cgroup to an autogroup of the root cgroup triggering the following warning:    WARNING: CPU: 7 PID: 1 at kernel/sched/ext.c:3725 scx_cgroup_can_attach+0x196/0x340   ...   Call Trace:   <TASK>     cgroup_migrate_execute+0x5b1/0x700     cgroup_attach_task+0x296/0x400     __cgroup_procs_write+0x128/0x140     cgroup_procs_write+0x17/0x30     kernfs_fop_write_iter+0x141/0x1f0     vfs_write+0x31d/0x4a0     __x64_sys_write+0x72/0xf0     do_syscall_64+0x82/0x160     entry_SYSCALL_64_after_hwframe+0x76/0x7e  Fix it by adding an argument to sched_move_task() that indicates whether the moving is for a cgroup or autogroup migration. After the change, scx_move_task() is called only for cgroup migrations and renamed to scx_cgroup_move_task().
published:2025-02-27T03:15:17.767


Instruction: Please provide detailed information about CVE-2025-21772

CVE:CVE-2025-21772
Description:In the Linux kernel, the following vulnerability has been resolved:  partitions: mac: fix handling of bogus partition table  Fix several issues in partition probing:   - The bailout for a bad partoffset must use put_dev_sector(), since the    preceding read_part_sector() succeeded.  - If the partition table claims a silly sector size like 0xfff bytes    (which results in partition table entries straddling sector boundaries),    bail out instead of accessing out-of-bounds memory.  - We must not assume that the partition table contains proper NUL    termination - use strnlen() and strncmp() instead of strlen() and    strcmp().
published:2025-02-27T03:15:17.867


Instruction: Please provide detailed information about CVE-2025-21773

CVE:CVE-2025-21773
Description:In the Linux kernel, the following vulnerability has been resolved:  can: etas_es58x: fix potential NULL pointer dereference on udev->serial  The driver assumed that es58x_dev->udev->serial could never be NULL. While this is true on commercially available devices, an attacker could spoof the device identity providing a NULL USB serial number. That would trigger a NULL pointer dereference.  Add a check on es58x_dev->udev->serial before accessing it.
published:2025-02-27T03:15:17.970


Instruction: Please provide detailed information about CVE-2025-21774

CVE:CVE-2025-21774
Description:In the Linux kernel, the following vulnerability has been resolved:  can: rockchip: rkcanfd_handle_rx_fifo_overflow_int(): bail out if skb cannot be allocated  Fix NULL pointer check in rkcanfd_handle_rx_fifo_overflow_int() to bail out if skb cannot be allocated.
published:2025-02-27T03:15:18.070


Instruction: Please provide detailed information about CVE-2025-21775

CVE:CVE-2025-21775
Description:In the Linux kernel, the following vulnerability has been resolved:  can: ctucanfd: handle skb allocation failure  If skb allocation fails, the pointer to struct can_frame is NULL. This is actually handled everywhere inside ctucan_err_interrupt() except for the only place.  Add the missed NULL check.  Found by Linux Verification Center (linuxtesting.org) with SVACE static analysis tool.
published:2025-02-27T03:15:18.167


Instruction: Please provide detailed information about CVE-2025-21776

CVE:CVE-2025-21776
Description:In the Linux kernel, the following vulnerability has been resolved:  USB: hub: Ignore non-compliant devices with too many configs or interfaces  Robert Morris created a test program which can cause usb_hub_to_struct_hub() to dereference a NULL or inappropriate pointer:  Oops: general protection fault, probably for non-canonical address 0xcccccccccccccccc: 0000 [#1] SMP DEBUG_PAGEALLOC PTI CPU: 7 UID: 0 PID: 117 Comm: kworker/7:1 Not tainted 6.13.0-rc3-00017-gf44d154d6e3d #14 Hardware name: FreeBSD BHYVE/BHYVE, BIOS 14.0 10/17/2021 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_hub_adjust_deviceremovable+0x78/0x110 ... Call Trace:  <TASK>  ? die_addr+0x31/0x80  ? exc_general_protection+0x1b4/0x3c0  ? asm_exc_general_protection+0x26/0x30  ? usb_hub_adjust_deviceremovable+0x78/0x110  hub_probe+0x7c7/0xab0  usb_probe_interface+0x14b/0x350  really_probe+0xd0/0x2d0  ? __pfx___device_attach_driver+0x10/0x10  __driver_probe_device+0x6e/0x110  driver_probe_device+0x1a/0x90  __device_attach_driver+0x7e/0xc0  bus_for_each_drv+0x7f/0xd0  __device_attach+0xaa/0x1a0  bus_probe_device+0x8b/0xa0  device_add+0x62e/0x810  usb_set_configuration+0x65d/0x990  usb_generic_driver_probe+0x4b/0x70  usb_probe_device+0x36/0xd0  The cause of this error is that the device has two interfaces, and the hub driver binds to interface 1 instead of interface 0, which is where usb_hub_to_struct_hub() looks.  We can prevent the problem from occurring by refusing to accept hub devices that violate the USB spec by having more than one configuration or interface.
published:2025-02-27T03:15:18.263


Instruction: Please provide detailed information about CVE-2025-21777

CVE:CVE-2025-21777
Description:In the Linux kernel, the following vulnerability has been resolved:  ring-buffer: Validate the persistent meta data subbuf array  The meta data for a mapped ring buffer contains an array of indexes of all the subbuffers. The first entry is the reader page, and the rest of the entries lay out the order of the subbuffers in how the ring buffer link list is to be created.  The validator currently makes sure that all the entries are within the range of 0 and nr_subbufs. But it does not check if there are any duplicates.  While working on the ring buffer, I corrupted this array, where I added duplicates. The validator did not catch it and created the ring buffer link list on top of it. Luckily, the corruption was only that the reader page was also in the writer path and only presented corrupted data but did not crash the kernel. But if there were duplicates in the writer side, then it could corrupt the ring buffer link list and cause a crash.  Create a bitmask array with the size of the number of subbuffers. Then clear it. When walking through the subbuf array checking to see if the entries are within the range, test if its bit is already set in the subbuf_mask. If it is, then there is duplicates and fail the validation. If not, set the corresponding bit and continue.
published:2025-02-27T03:15:18.377


Instruction: Please provide detailed information about CVE-2025-21778

CVE:CVE-2025-21778
Description:In the Linux kernel, the following vulnerability has been resolved:  tracing: Do not allow mmap() of persistent ring buffer  When trying to mmap a trace instance buffer that is attached to reserve_mem, it would crash:   BUG: unable to handle page fault for address: ffffe97bd00025c8  #PF: supervisor read access in kernel mode  #PF: error_code(0x0000) - not-present page  PGD 2862f3067 P4D 2862f3067 PUD 0  Oops: Oops: 0000 [#1] PREEMPT_RT SMP PTI  CPU: 4 UID: 0 PID: 981 Comm: mmap-rb Not tainted 6.14.0-rc2-test-00003-g7f1a5e3fbf9e-dirty #233  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014  RIP: 0010:validate_page_before_insert+0x5/0xb0  Code: e2 01 89 d0 c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 <48> 8b 46 08 a8 01 75 67 66 90 48 89 f0 8b 50 34 85 d2 74 76 48 89  RSP: 0018:ffffb148c2f3f968 EFLAGS: 00010246  RAX: ffff9fa5d3322000 RBX: ffff9fa5ccff9c08 RCX: 00000000b879ed29  RDX: ffffe97bd00025c0 RSI: ffffe97bd00025c0 RDI: ffff9fa5ccff9c08  RBP: ffffb148c2f3f9f0 R08: 0000000000000004 R09: 0000000000000004  R10: 0000000000000000 R11: 0000000000000200 R12: 0000000000000000  R13: 00007f16a18d5000 R14: ffff9fa5c48db6a8 R15: 0000000000000000  FS:  00007f16a1b54740(0000) GS:ffff9fa73df00000(0000) knlGS:0000000000000000  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  CR2: ffffe97bd00025c8 CR3: 00000001048c6006 CR4: 0000000000172ef0  Call Trace:   <TASK>   ? __die_body.cold+0x19/0x1f   ? __die+0x2e/0x40   ? page_fault_oops+0x157/0x2b0   ? search_module_extables+0x53/0x80   ? validate_page_before_insert+0x5/0xb0   ? kernelmode_fixup_or_oops.isra.0+0x5f/0x70   ? __bad_area_nosemaphore+0x16e/0x1b0   ? bad_area_nosemaphore+0x16/0x20   ? do_kern_addr_fault+0x77/0x90   ? exc_page_fault+0x22b/0x230   ? asm_exc_page_fault+0x2b/0x30   ? validate_page_before_insert+0x5/0xb0   ? vm_insert_pages+0x151/0x400   __rb_map_vma+0x21f/0x3f0   ring_buffer_map+0x21b/0x2f0   tracing_buffers_mmap+0x70/0xd0   __mmap_region+0x6f0/0xbd0   mmap_region+0x7f/0x130   do_mmap+0x475/0x610   vm_mmap_pgoff+0xf2/0x1d0   ksys_mmap_pgoff+0x166/0x200   __x64_sys_mmap+0x37/0x50   x64_sys_call+0x1670/0x1d70   do_syscall_64+0xbb/0x1d0   entry_SYSCALL_64_after_hwframe+0x77/0x7f  The reason was that the code that maps the ring buffer pages to user space has:  	page = virt_to_page((void *)cpu_buffer->subbuf_ids[s]);  And uses that in:  	vm_insert_pages(vma, vma->vm_start, pages, &nr_pages);  But virt_to_page() does not work with vmap()'d memory which is what the persistent ring buffer has. It is rather trivial to allow this, but for now just disable mmap() of instances that have their ring buffer from the reserve_mem option.  If an mmap() is performed on a persistent buffer it will return -ENODEV just like it would if the .mmap field wasn't defined in the file_operations structure.
published:2025-02-27T03:15:18.533


Instruction: Please provide detailed information about CVE-2025-21779

CVE:CVE-2025-21779
Description:In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel  Advertise support for Hyper-V's SEND_IPI and SEND_IPI_EX hypercalls if and only if the local API is emulated/virtualized by KVM, and explicitly reject said hypercalls if the local APIC is emulated in userspace, i.e. don't rely on userspace to opt-in to KVM_CAP_HYPERV_ENFORCE_CPUID.  Rejecting SEND_IPI and SEND_IPI_EX fixes a NULL-pointer dereference if Hyper-V enlightenments are exposed to the guest without an in-kernel local APIC:    dump_stack+0xbe/0xfd   __kasan_report.cold+0x34/0x84   kasan_report+0x3a/0x50   __apic_accept_irq+0x3a/0x5c0   kvm_hv_send_ipi.isra.0+0x34e/0x820   kvm_hv_hypercall+0x8d9/0x9d0   kvm_emulate_hypercall+0x506/0x7e0   __vmx_handle_exit+0x283/0xb60   vmx_handle_exit+0x1d/0xd0   vcpu_enter_guest+0x16b0/0x24c0   vcpu_run+0xc0/0x550   kvm_arch_vcpu_ioctl_run+0x170/0x6d0   kvm_vcpu_ioctl+0x413/0xb20   __se_sys_ioctl+0x111/0x160   do_syscal1_64+0x30/0x40   entry_SYSCALL_64_after_hwframe+0x67/0xd1  Note, checking the sending vCPU is sufficient, as the per-VM irqchip_mode can't be modified after vCPUs are created, i.e. if one vCPU has an in-kernel local APIC, then all vCPUs have an in-kernel local APIC.
published:2025-02-27T03:15:18.690


Instruction: Please provide detailed information about CVE-2025-21780

CVE:CVE-2025-21780
Description:In the Linux kernel, the following vulnerability has been resolved:  drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()  It malicious user provides a small pptable through sysfs and then a bigger pptable, it may cause buffer overflow attack in function smu_sys_set_pp_table().
published:2025-02-27T03:15:18.827


Instruction: Please provide detailed information about CVE-2025-21781

CVE:CVE-2025-21781
Description:In the Linux kernel, the following vulnerability has been resolved:  batman-adv: fix panic during interface removal  Reference counting is used to ensure that batadv_hardif_neigh_node and batadv_hard_iface are not freed before/during batadv_v_elp_throughput_metric_update work is finished.  But there isn't a guarantee that the hard if will remain associated with a soft interface up until the work is finished.  This fixes a crash triggered by reboot that looks like this:  Call trace:  batadv_v_mesh_free+0xd0/0x4dc [batman_adv]  batadv_v_elp_throughput_metric_update+0x1c/0xa4  process_one_work+0x178/0x398  worker_thread+0x2e8/0x4d0  kthread+0xd8/0xdc  ret_from_fork+0x10/0x20  (the batadv_v_mesh_free call is misleading, and does not actually happen)  I was able to make the issue happen more reliably by changing hardif_neigh->bat_v.metric_work work to be delayed work. This allowed me to track down and confirm the fix.  [sven@narfation.org: prevent entering batadv_v_elp_get_throughput without  soft_iface]
published:2025-02-27T03:15:18.947


Instruction: Please provide detailed information about CVE-2025-21782

CVE:CVE-2025-21782
Description:In the Linux kernel, the following vulnerability has been resolved:  orangefs: fix a oob in orangefs_debug_write  I got a syzbot report: slab-out-of-bounds Read in orangefs_debug_write... several people suggested fixes, I tested Al Viro's suggestion and made this patch.
published:2025-02-27T03:15:19.050


Instruction: Please provide detailed information about CVE-2025-21783

CVE:CVE-2025-21783
Description:In the Linux kernel, the following vulnerability has been resolved:  gpiolib: Fix crash on error in gpiochip_get_ngpios()  The gpiochip_get_ngpios() uses chip_*() macros to print messages. However these macros rely on gpiodev to be initialised and set, which is not the case when called via bgpio_init(). In such a case the printing messages will crash on NULL pointer dereference. Replace chip_*() macros by the respective dev_*() ones to avoid such crash.
published:2025-02-27T03:15:19.150


Instruction: Please provide detailed information about CVE-2025-21784

CVE:CVE-2025-21784
Description:In the Linux kernel, the following vulnerability has been resolved:  drm/amdgpu: bail out when failed to load fw in psp_init_cap_microcode()  In function psp_init_cap_microcode(), it should bail out when failed to load firmware, otherwise it may cause invalid memory access.
published:2025-02-27T03:15:19.247


Instruction: Please provide detailed information about CVE-2025-21785

CVE:CVE-2025-21785
Description:In the Linux kernel, the following vulnerability has been resolved:  arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array  The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels with separate data/instructions cache. Fix this by incrementing the index for any populated leaf (instead of any populated level).
published:2025-02-27T03:15:19.350


Instruction: Please provide detailed information about CVE-2025-21786

CVE:CVE-2025-21786
Description:In the Linux kernel, the following vulnerability has been resolved:  workqueue: Put the pwq after detaching the rescuer from the pool  The commit 68f83057b913("workqueue: Reap workers via kthread_stop() and remove detach_completion") adds code to reap the normal workers but mistakenly does not handle the rescuer and also removes the code waiting for the rescuer in put_unbound_pool(), which caused a use-after-free bug reported by Cheung Wall.  To avoid the use-after-free bug, the pool’s reference must be held until the detachment is complete. Therefore, move the code that puts the pwq after detaching the rescuer from the pool.
published:2025-02-27T03:15:19.450


Instruction: Please provide detailed information about CVE-2025-21787

CVE:CVE-2025-21787
Description:In the Linux kernel, the following vulnerability has been resolved:  team: better TEAM_OPTION_TYPE_STRING validation  syzbot reported following splat [1]  Make sure user-provided data contains one nul byte.  [1]  BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:633 [inline]  BUG: KMSAN: uninit-value in string+0x3ec/0x5f0 lib/vsprintf.c:714   string_nocheck lib/vsprintf.c:633 [inline]   string+0x3ec/0x5f0 lib/vsprintf.c:714   vsnprintf+0xa5d/0x1960 lib/vsprintf.c:2843   __request_module+0x252/0x9f0 kernel/module/kmod.c:149   team_mode_get drivers/net/team/team_core.c:480 [inline]   team_change_mode drivers/net/team/team_core.c:607 [inline]   team_mode_option_set+0x437/0x970 drivers/net/team/team_core.c:1401   team_option_set drivers/net/team/team_core.c:375 [inline]   team_nl_options_set_doit+0x1339/0x1f90 drivers/net/team/team_core.c:2662   genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline]   genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]   genl_rcv_msg+0x1214/0x12c0 net/netlink/genetlink.c:1210   netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2543   genl_rcv+0x40/0x60 net/netlink/genetlink.c:1219   netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline]   netlink_unicast+0xf52/0x1260 net/netlink/af_netlink.c:1348   netlink_sendmsg+0x10da/0x11e0 net/netlink/af_netlink.c:1892   sock_sendmsg_nosec net/socket.c:718 [inline]   __sock_sendmsg+0x30f/0x380 net/socket.c:733   ____sys_sendmsg+0x877/0xb60 net/socket.c:2573   ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2627   __sys_sendmsg net/socket.c:2659 [inline]   __do_sys_sendmsg net/socket.c:2664 [inline]   __se_sys_sendmsg net/socket.c:2662 [inline]   __x64_sys_sendmsg+0x212/0x3c0 net/socket.c:2662   x64_sys_call+0x2ed6/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:47   do_syscall_x64 arch/x86/entry/common.c:52 [inline]   do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83  entry_SYSCALL_64_after_hwframe+0x77/0x7f
published:2025-02-27T03:15:19.553


Instruction: Please provide detailed information about CVE-2025-21788

CVE:CVE-2025-21788
Description:In the Linux kernel, the following vulnerability has been resolved:  net: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases  If the XDP program doesn't result in XDP_PASS then we leak the memory allocated by am65_cpsw_build_skb().  It is pointless to allocate SKB memory before running the XDP program as we would be wasting CPU cycles for cases other than XDP_PASS. Move the SKB allocation after evaluating the XDP program result.  This fixes the memleak. A performance boost is seen for XDP_DROP test.  XDP_DROP test: Before: 460256 rx/s                  0 err/s After:  784130 rx/s                  0 err/s
published:2025-02-27T03:15:19.663


Instruction: Please provide detailed information about CVE-2025-21789

CVE:CVE-2025-21789
Description:In the Linux kernel, the following vulnerability has been resolved:  LoongArch: csum: Fix OoB access in IP checksum code for negative lengths  Commit 69e3a6aa6be2 ("LoongArch: Add checksum optimization for 64-bit system") would cause an undefined shift and an out-of-bounds read.  Commit 8bd795fedb84 ("arm64: csum: Fix OoB access in IP checksum code for negative lengths") fixes the same issue on ARM64.
published:2025-02-27T03:15:19.763


Instruction: Please provide detailed information about CVE-2025-21790


Instruction: Please provide detailed information about CVE-2025-21791

CVE:CVE-2025-21791
Description:In the Linux kernel, the following vulnerability has been resolved:  vrf: use RCU protection in l3mdev_l3_out()  l3mdev_l3_out() can be called without RCU being held:  raw_sendmsg()  ip_push_pending_frames()   ip_send_skb()    ip_local_out()     __ip_local_out()      l3mdev_ip_out()  Add rcu_read_lock() / rcu_read_unlock() pair to avoid a potential UAF.
published:2025-02-27T03:15:19.970


Instruction: Please provide detailed information about CVE-2025-21792

CVE:CVE-2025-21792
Description:In the Linux kernel, the following vulnerability has been resolved:  ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt  If an AX25 device is bound to a socket by setting the SO_BINDTODEVICE socket option, a refcount leak will occur in ax25_release().  Commit 9fd75b66b8f6 ("ax25: Fix refcount leaks caused by ax25_cb_del()") added decrement of device refcounts in ax25_release(). In order for that to work correctly the refcounts must already be incremented when the device is bound to the socket. An AX25 device can be bound to a socket by either calling ax25_bind() or setting SO_BINDTODEVICE socket option. In both cases the refcounts should be incremented, but in fact it is done only in ax25_bind().  This bug leads to the following issue reported by Syzkaller:  ================================================================ refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 1 PID: 5932 at lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31 Modules linked in: CPU: 1 UID: 0 PID: 5932 Comm: syz-executor424 Not tainted 6.13.0-rc4-syzkaller-00110-g4099a71718b0 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:refcount_warn_saturate+0x1ed/0x210 lib/refcount.c:31 Call Trace:  <TASK>  __refcount_dec include/linux/refcount.h:336 [inline]  refcount_dec include/linux/refcount.h:351 [inline]  ref_tracker_free+0x710/0x820 lib/ref_tracker.c:236  netdev_tracker_free include/linux/netdevice.h:4156 [inline]  netdev_put include/linux/netdevice.h:4173 [inline]  netdev_put include/linux/netdevice.h:4169 [inline]  ax25_release+0x33f/0xa10 net/ax25/af_ax25.c:1069  __sock_release+0xb0/0x270 net/socket.c:640  sock_close+0x1c/0x30 net/socket.c:1408  ...  do_syscall_x64 arch/x86/entry/common.c:52 [inline]  do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83  entry_SYSCALL_64_after_hwframe+0x77/0x7f  ...  </TASK> ================================================================  Fix the implementation of ax25_setsockopt() by adding increment of refcounts for the new device bound, and decrement of refcounts for the old unbound device.
published:2025-02-27T03:15:20.080


Instruction: Please provide detailed information about CVE-2025-21793

CVE:CVE-2025-21793
Description:In the Linux kernel, the following vulnerability has been resolved:  spi: sn-f-ospi: Fix division by zero  When there is no dummy cycle in the spi-nor commands, both dummy bus cycle bytes and width are zero. Because of the cpu's warning when divided by zero, the warning should be avoided. Return just zero to avoid such calculations.
published:2025-02-27T03:15:20.190


Instruction: Please provide detailed information about CVE-2025-21794

CVE:CVE-2025-21794
Description:In the Linux kernel, the following vulnerability has been resolved:  HID: hid-thrustmaster: fix stack-out-of-bounds read in usb_check_int_endpoints()  Syzbot[1] has detected a stack-out-of-bounds read of the ep_addr array from hid-thrustmaster driver. This array is passed to usb_check_int_endpoints function from usb.c core driver, which executes a for loop that iterates over the elements of the passed array. Not finding a null element at the end of the array, it tries to read the next, non-existent element, crashing the kernel.  To fix this, a 0 element was added at the end of the array to break the for loop.  [1] https://syzkaller.appspot.com/bug?extid=9c9179ac46169c56c1ad
published:2025-02-27T03:15:20.293


Instruction: Please provide detailed information about CVE-2025-21795

CVE:CVE-2025-21795
Description:In the Linux kernel, the following vulnerability has been resolved:  NFSD: fix hang in nfsd4_shutdown_callback  If nfs4_client is in courtesy state then there is no point to send the callback. This causes nfsd4_shutdown_callback to hang since cl_cb_inflight is not 0. This hang lasts about 15 minutes until TCP notifies NFSD that the connection was dropped.  This patch modifies nfsd4_run_cb_work to skip the RPC call if nfs4_client is in courtesy state.
published:2025-02-27T03:15:20.390


Instruction: Please provide detailed information about CVE-2025-21796

CVE:CVE-2025-21796
Description:In the Linux kernel, the following vulnerability has been resolved:  nfsd: clear acl_access/acl_default after releasing them  If getting acl_default fails, acl_access and acl_default will be released simultaneously. However, acl_access will still retain a pointer pointing to the released posix_acl, which will trigger a WARNING in nfs3svc_release_getacl like this:  ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 26 PID: 3199 at lib/refcount.c:28 refcount_warn_saturate+0xb5/0x170 Modules linked in: CPU: 26 UID: 0 PID: 3199 Comm: nfsd Not tainted 6.12.0-rc6-00079-g04ae226af01f-dirty #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:refcount_warn_saturate+0xb5/0x170 Code: cc cc 0f b6 1d b3 20 a5 03 80 fb 01 0f 87 65 48 d8 00 83 e3 01 75 e4 48 c7 c7 c0 3b 9b 85 c6 05 97 20 a5 03 01 e8 fb 3e 30 ff <0f> 0b eb cd 0f b6 1d 8a3 RSP: 0018:ffffc90008637cd8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff83904fde RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88871ed36380 RBP: ffff888158beeb40 R08: 0000000000000001 R09: fffff520010c6f56 R10: ffffc90008637ab7 R11: 0000000000000001 R12: 0000000000000001 R13: ffff888140e77400 R14: ffff888140e77408 R15: ffffffff858b42c0 FS:  0000000000000000(0000) GS:ffff88871ed00000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000562384d32158 CR3: 000000055cc6a000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace:  <TASK>  ? refcount_warn_saturate+0xb5/0x170  ? __warn+0xa5/0x140  ? refcount_warn_saturate+0xb5/0x170  ? report_bug+0x1b1/0x1e0  ? handle_bug+0x53/0xa0  ? exc_invalid_op+0x17/0x40  ? asm_exc_invalid_op+0x1a/0x20  ? tick_nohz_tick_stopped+0x1e/0x40  ? refcount_warn_saturate+0xb5/0x170  ? refcount_warn_saturate+0xb5/0x170  nfs3svc_release_getacl+0xc9/0xe0  svc_process_common+0x5db/0xb60  ? __pfx_svc_process_common+0x10/0x10  ? __rcu_read_unlock+0x69/0xa0  ? __pfx_nfsd_dispatch+0x10/0x10  ? svc_xprt_received+0xa1/0x120  ? xdr_init_decode+0x11d/0x190  svc_process+0x2a7/0x330  svc_handle_xprt+0x69d/0x940  svc_recv+0x180/0x2d0  nfsd+0x168/0x200  ? __pfx_nfsd+0x10/0x10  kthread+0x1a2/0x1e0  ? kthread+0xf4/0x1e0  ? __pfx_kthread+0x10/0x10  ret_from_fork+0x34/0x60  ? __pfx_kthread+0x10/0x10  ret_from_fork_asm+0x1a/0x30  </TASK> Kernel panic - not syncing: kernel: panic_on_warn set ...  Clear acl_access/acl_default after posix_acl_release is called to prevent UAF from being triggered.
published:2025-02-27T03:15:20.497


Instruction: Please provide detailed information about CVE-2025-21797

CVE:CVE-2025-21797
Description:In the Linux kernel, the following vulnerability has been resolved:  HID: corsair-void: Add missing delayed work cancel for headset status  The cancel_delayed_work_sync() call was missed, causing a use-after-free in corsair_void_remove().
published:2025-02-27T03:15:20.607


Instruction: Please provide detailed information about CVE-2025-0469

CVE:CVE-2025-0469
Description:The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider template data in all versions up to, and including, 1.39.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-02-27T05:15:13.950


Instruction: Please provide detailed information about CVE-2025-1686

CVE:CVE-2025-1686
Description:All versions of the package io.pebbletemplates:pebble are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates that leverage this tag to include files like /etc/passwd or /proc/1/environ.

 Workaround

This vulnerability can be mitigated by disabling the include macro in Pebble Templates:

java
new PebbleEngine.Builder()
            .registerExtensionCustomizer(new DisallowExtensionCustomizerBuilder()
                    .disallowedTokenParserTags(List.of("include"))
                    .build())
            .build();
published:2025-02-27T05:15:14.143


Instruction: Please provide detailed information about CVE-2025-1295

CVE:CVE-2025-1295
Description:The Templines Elementor Helper Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.7. This is due to allowing arbitrary user meta updates. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to Administrator. The vulnerability can only be exploited when the BuddyPress plugin is also installed and activated.
published:2025-02-27T06:15:21.990


Instruction: Please provide detailed information about CVE-2025-1689

CVE:CVE-2025-1689
Description:The ThemeMakers PayPal Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'paypal' shortcode in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-02-27T07:15:35.400


Instruction: Please provide detailed information about CVE-2025-1717

CVE:CVE-2025-1717
Description:The Login Me Now plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.2. This is due to insecure authentication based on an arbitrary transient name in the 'AutoLogin::listen()' function. This makes it possible for unauthenticated attackers to log in an existing user on the site, even an administrator. Note: this vulnerability requires using a transient name and value from another software, so the plugin is not inherently vulnerable on it's own.
published:2025-02-27T08:15:31.130


Instruction: Please provide detailed information about CVE-2025-1282

CVE:CVE-2025-1282
Description:The Car Dealer Automotive WordPress Theme – Responsive theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_post_photo() and add_car() functions in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The add_car() function may also make it possible to read arbitrary files.
published:2025-02-27T09:15:10.160


Instruction: Please provide detailed information about CVE-2025-1690

CVE:CVE-2025-1690
Description:The ThemeMakers Stripe Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stripe' shortcode in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-02-27T09:15:10.697


Instruction: Please provide detailed information about CVE-2025-1450

CVE:CVE-2025-1450
Description:The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp – Chaty plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-hover’ parameter in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-02-27T10:15:10.677


Instruction: Please provide detailed information about CVE-2025-1751

CVE:CVE-2025-1751
Description:A SQL Injection vulnerability has been found in Ciges 2.15.5 from ATISoluciones. This vulnerability allows an attacker to retrieve, create, update and delete database via $idServicio parameter in /modules/ajaxBloqueaCita.php endpoint.
published:2025-02-27T12:15:35.030


Instruction: Please provide detailed information about CVE-2025-1691

CVE:CVE-2025-1691
Description:The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mongosh autocomplete feature, can use the autocompletion feature to input and run obfuscated malicious text. This requires user interaction in the form of the user using ‘tab’ to autocomplete text that is a prefix of the attacker’s prepared autocompletion. This issue affects mongosh versions prior to 2.3.9.    The vulnerability is exploitable only when mongosh is connected to a cluster that is partially or fully controlled by an attacker.
published:2025-02-27T13:15:11.253


Instruction: Please provide detailed information about CVE-2025-1692

CVE:CVE-2025-1692
Description:The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9
published:2025-02-27T13:15:11.413


Instruction: Please provide detailed information about CVE-2025-1693

CVE:CVE-2025-1693
Description:The MongoDB Shell may be susceptible to control character injection where an attacker with control over the database cluster contents can inject control characters into the shell output. This may result in the display of falsified messages that appear to originate from mongosh or the underlying operating system, potentially misleading users into executing unsafe actions.   The vulnerability is exploitable only when mongosh is connected to a cluster that is partially or fully controlled by an attacker.   This issue affects mongosh versions prior to 2.3.9
published:2025-02-27T13:15:11.563


Instruction: Please provide detailed information about CVE-2025-1738

CVE:CVE-2025-1738
Description:A Password Transmitted over Query String vulnerability has been found in Trivision Camera NC227WF v5.8.0 from TrivisionSecurity, exposing this sensitive information to a third party.
published:2025-02-27T13:15:11.720


Instruction: Please provide detailed information about CVE-2025-1739

CVE:CVE-2025-1739
Description:An Authentication Bypass vulnerability has been found in Trivision Camera NC227WF v5.8.0 from TrivisionSecurity. This vulnerability allows an attacker to retrieve administrator's credentials in cleartext by sending a request against the server using curl with random credentials to "/en/player/activex_pal.asp" and successfully authenticating the application.
published:2025-02-27T13:15:11.883


Instruction: Please provide detailed information about CVE-2025-22280

CVE:CVE-2025-22280
Description:Missing Authorization vulnerability in revmakx DefendWP Firewall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DefendWP Firewall: from n/a through 1.1.0.
published:2025-02-27T14:15:36.033


Instruction: Please provide detailed information about CVE-2025-27154

CVE:CVE-2025-27154
Description:Spotipy is a lightweight Python library for the Spotify Web API. The `CacheHandler` class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has `rw-r--r--` (644) permissions by default, when it could be locked down to `rw-------` (600) permissions. This leads to overly broad exposure of the spotify auth token. If this token can be read by an attacker (another user on the machine, or a process running as another user), it can be used to perform administrative actions on the Spotify account, depending on the scope granted to the token. Version 2.25.1 tightens the cache file permissions.
published:2025-02-27T14:15:36.180


Instruction: Please provide detailed information about CVE-2025-0759

CVE:CVE-2025-0759
Description:IBM EntireX 11.1 could allow a local user to unintentionally modify data timestamp integrity due to improper shared resource synchronization.
published:2025-02-27T15:15:40.603


Instruction: Please provide detailed information about CVE-2025-25759

CVE:CVE-2025-25759
Description:An issue in the component admin_template.php of SUCMS v1.0 allows attackers to execute a directory traversal and arbitrary file deletion via a crafted GET request.
published:2025-02-27T15:15:41.570


Instruction: Please provide detailed information about CVE-2025-25760

CVE:CVE-2025-25760
Description:A Server-Side Request Forgery (SSRF) in the component admin_webgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET request.
published:2025-02-27T15:15:41.670


Instruction: Please provide detailed information about CVE-2025-25761

CVE:CVE-2025-25761
Description:HkCms v2.3.2.240702 was discovered to contain an arbitrary file write vulnerability in the component Appcenter.php.
published:2025-02-27T15:15:41.777


Instruction: Please provide detailed information about CVE-2025-0914

CVE:CVE-2025-0914
Description:An improper access control issue in the VQL shell feature in Velociraptor Versions < 0.73.4 allowed authenticated users to execute the execve() plugin in deployments where this was explicitly forbidden by configuring the prevent_execve flag in the configuration file. This setting is not usually recommended and is uncommonly used, so this issue will only affect users who do set it. This issue is fixed in release 0.73.4.
published:2025-02-27T16:15:38.237


Instruction: Please provide detailed information about CVE-2025-1741

CVE:CVE-2025-1741
Description:A vulnerability classified as problematic was found in b1gMail up to 7.4.1-pl1. Affected by this vulnerability is an unknown functionality of the file src/admin/users.php of the component Admin Page. The manipulation of the argument query/q leads to deserialization. The attack can be launched remotely. Upgrading to version 7.4.1-pl2 is able to address this issue. The identifier of the patch is 4816c8b748f6a5b965c8994e2cf10861bf6e68aa. It is recommended to upgrade the affected component. The vendor acted highly professional and even fixed this issue in the discontinued commercial edition as b1gMail 7.4.0-pl3.
published:2025-02-27T16:15:38.930


Instruction: Please provide detailed information about CVE-2025-1755

CVE:CVE-2025-1755
Description:MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privileges, when a crafted file is stored in C:\node_modules\. This issue affects MongoDB Compass prior to 1.42.1
published:2025-02-27T16:15:39.137


Instruction: Please provide detailed information about CVE-2025-1756

CVE:CVE-2025-1756
Description:mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\node_modules\. This issue affects mongosh prior to 2.3.0
published:2025-02-27T16:15:39.287


Instruction: Please provide detailed information about CVE-2025-25323

CVE:CVE-2025-25323
Description:An issue in Qianjin Network Information Technology (Shanghai) Co., Ltd 51Job iOS 14.22.0 allows attackers to access sensitive user information via supplying a crafted link.
published:2025-02-27T16:15:39.637


Instruction: Please provide detailed information about CVE-2025-25324

CVE:CVE-2025-25324
Description:An issue in Shandong Provincial Big Data Center AiShanDong iOS 5.0.0 allows attackers to access sensitive user information via supplying a crafted link.
published:2025-02-27T16:15:39.760


Instruction: Please provide detailed information about CVE-2025-25325

CVE:CVE-2025-25325
Description:An issue in Yibin Fengguan Network Technology Co., Ltd YuPao DirectHire iOS 8.8.0 allows attackers to access sensitive user information via supplying a crafted link.
published:2025-02-27T16:15:39.870


Instruction: Please provide detailed information about CVE-2025-25326

CVE:CVE-2025-25326
Description:An issue in Merchants Union Consumer Finance Company Limited Merchants Union Finance iOS 6.19.0 allows attackers to access sensitive user information via supplying a crafted link.
published:2025-02-27T16:15:39.987


Instruction: Please provide detailed information about CVE-2025-25330

CVE:CVE-2025-25330
Description:An issue in Boohee Technology Boohee Health iOS 13.0.13 allows attackers to access sensitive user information via supplying a crafted link.
published:2025-02-27T16:15:40.103


Instruction: Please provide detailed information about CVE-2025-25331

CVE:CVE-2025-25331
Description:An issue in Beitatong Technology LianJia iOS 9.83.50 allows attackers to access sensitive user information via supplying a crafted link.
published:2025-02-27T16:15:40.217


Instruction: Please provide detailed information about CVE-2025-25333

CVE:CVE-2025-25333
Description:An issue in IKEA CN iOS 4.13.0 allows attackers to access sensitive user information via supplying a crafted link.
published:2025-02-27T16:15:40.350


Instruction: Please provide detailed information about CVE-2025-25334

CVE:CVE-2025-25334
Description:An issue in Suning Commerce Group Suning EMall iOS 9.5.198 allows attackers to access sensitive user information via supplying a crafted link.
published:2025-02-27T16:15:40.463


Instruction: Please provide detailed information about CVE-2025-1742

CVE:CVE-2025-1742
Description:A vulnerability, which was classified as problematic, has been found in pihome-shc PiHome 2.0. Affected by this issue is some unknown functionality of the file /home.php. The manipulation of the argument page_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-02-27T17:15:16.460


Instruction: Please provide detailed information about CVE-2025-23687

CVE:CVE-2025-23687
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in simonhunter Woo Store Mode allows Reflected XSS. This issue affects Woo Store Mode: from n/a through 1.0.1.
published:2025-02-27T17:15:16.623


Instruction: Please provide detailed information about CVE-2025-25329

CVE:CVE-2025-25329
Description:An issue in Tencent Technology (Beijing) Company Limited Tencent MicroVision iOS 8.137.0 allows attackers to access sensitive user information via supplying a crafted link.
published:2025-02-27T17:15:16.773


Instruction: Please provide detailed information about CVE-2025-27157

CVE:CVE-2025-27157
Description:Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on `/auth/setup`. Without those rate limits, an attacker can craft requests that will send an email to an arbitrary addresses. Versions 4.2.16 and 4.3.4 fix the issue.
published:2025-02-27T17:15:16.867


Instruction: Please provide detailed information about CVE-2025-1743

CVE:CVE-2025-1743
Description:A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-27T18:15:27.650


Instruction: Please provide detailed information about CVE-2025-1745

CVE:CVE-2025-1745
Description:A vulnerability has been found in LinZhaoguan pb-cms 2.0 and classified as problematic. This vulnerability affects unknown code of the component Logout. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-02-27T18:15:27.923


Instruction: Please provide detailed information about CVE-2025-27399

CVE:CVE-2025-27399
Description:Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is set to "users" (localized English string: "To logged-in users"), users that are not yet approved can view the block reasons. Instance admins that do not want their domain blocks to be public are impacted. Versions 4.1.23, 4.2.16, and 4.3.4 fix the issue.
published:2025-02-27T18:15:30.380


Instruction: Please provide detailed information about CVE-2025-0767

CVE:CVE-2025-0767
Description:WP Activity Log 5.3.2 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/classes/Writers/class-csv-writer.php.
published:2025-02-27T19:15:49.350


Instruction: Please provide detailed information about CVE-2025-22624

CVE:CVE-2025-22624
Description:FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry and Carousel 2.4.29 was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/extensions/albums/admin/class-meta boxes.php.
published:2025-02-27T19:15:50.940


Instruction: Please provide detailed information about CVE-2025-21798

CVE:CVE-2025-21798
Description:In the Linux kernel, the following vulnerability has been resolved:  firewire: test: Fix potential null dereference in firewire kunit test  kunit_kzalloc() may return a NULL pointer, dereferencing it without NULL check may lead to NULL dereference. Add a NULL check for test_state.
published:2025-02-27T20:16:02.477


Instruction: Please provide detailed information about CVE-2025-21799

CVE:CVE-2025-21799
Description:In the Linux kernel, the following vulnerability has been resolved:  net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns()  When getting the IRQ we use k3_udma_glue_tx_get_irq() which returns negative error value on error. So not NULL check is not sufficient to deteremine if IRQ is valid. Check that IRQ is greater then zero to ensure it is valid.  There is no issue at probe time but at runtime user can invoke .set_channels which results in the following call chain. am65_cpsw_set_channels()  am65_cpsw_nuss_update_tx_rx_chns()   am65_cpsw_nuss_remove_tx_chns()   am65_cpsw_nuss_init_tx_chns()  At this point if am65_cpsw_nuss_init_tx_chns() fails due to k3_udma_glue_tx_get_irq() then tx_chn->irq will be set to a negative value.  Then, at subsequent .set_channels with higher channel count we will attempt to free an invalid IRQ in am65_cpsw_nuss_remove_tx_chns() leading to a kernel warning.  The issue is present in the original commit that introduced this driver, although there, am65_cpsw_nuss_update_tx_rx_chns() existed as am65_cpsw_nuss_update_tx_chns().
published:2025-02-27T20:16:02.563


Instruction: Please provide detailed information about CVE-2025-21800

CVE:CVE-2025-21800
Description:In the Linux kernel, the following vulnerability has been resolved:  net/mlx5: HWS, fix definer's HWS_SET32 macro for negative offset  When bit offset for HWS_SET32 macro is negative, UBSAN complains about the shift-out-of-bounds:    UBSAN: shift-out-of-bounds in   drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c:177:2   shift exponent -8 is negative
published:2025-02-27T20:16:02.660


Instruction: Please provide detailed information about CVE-2025-21801

CVE:CVE-2025-21801
Description:In the Linux kernel, the following vulnerability has been resolved:  net: ravb: Fix missing rtnl lock in suspend/resume path  Fix the suspend/resume path by ensuring the rtnl lock is held where required. Calls to ravb_open, ravb_close and wol operations must be performed under the rtnl lock to prevent conflicts with ongoing ndo operations.  Without this fix, the following warning is triggered: [   39.032969] ============================= [   39.032983] WARNING: suspicious RCU usage [   39.033019] ----------------------------- [   39.033033] drivers/net/phy/phy_device.c:2004 suspicious rcu_dereference_protected() usage! ... [   39.033597] stack backtrace: [   39.033613] CPU: 0 UID: 0 PID: 174 Comm: python3 Not tainted 6.13.0-rc7-next-20250116-arm64-renesas-00002-g35245dfdc62c #7 [   39.033623] Hardware name: Renesas SMARC EVK version 2 based on r9a08g045s33 (DT) [   39.033628] Call trace: [   39.033633]  show_stack+0x14/0x1c (C) [   39.033652]  dump_stack_lvl+0xb4/0xc4 [   39.033664]  dump_stack+0x14/0x1c [   39.033671]  lockdep_rcu_suspicious+0x16c/0x22c [   39.033682]  phy_detach+0x160/0x190 [   39.033694]  phy_disconnect+0x40/0x54 [   39.033703]  ravb_close+0x6c/0x1cc [   39.033714]  ravb_suspend+0x48/0x120 [   39.033721]  dpm_run_callback+0x4c/0x14c [   39.033731]  device_suspend+0x11c/0x4dc [   39.033740]  dpm_suspend+0xdc/0x214 [   39.033748]  dpm_suspend_start+0x48/0x60 [   39.033758]  suspend_devices_and_enter+0x124/0x574 [   39.033769]  pm_suspend+0x1ac/0x274 [   39.033778]  state_store+0x88/0x124 [   39.033788]  kobj_attr_store+0x14/0x24 [   39.033798]  sysfs_kf_write+0x48/0x6c [   39.033808]  kernfs_fop_write_iter+0x118/0x1a8 [   39.033817]  vfs_write+0x27c/0x378 [   39.033825]  ksys_write+0x64/0xf4 [   39.033833]  __arm64_sys_write+0x18/0x20 [   39.033841]  invoke_syscall+0x44/0x104 [   39.033852]  el0_svc_common.constprop.0+0xb4/0xd4 [   39.033862]  do_el0_svc+0x18/0x20 [   39.033870]  el0_svc+0x3c/0xf0 [   39.033880]  el0t_64_sync_handler+0xc0/0xc4 [   39.033888]  el0t_64_sync+0x154/0x158 [   39.041274] ravb 11c30000.ethernet eth0: Link is Down
published:2025-02-27T20:16:02.753


Instruction: Please provide detailed information about CVE-2025-21802

CVE:CVE-2025-21802
Description:In the Linux kernel, the following vulnerability has been resolved:  net: hns3: fix oops when unload drivers paralleling  When unload hclge driver, it tries to disable sriov first for each ae_dev node from hnae3_ae_dev_list. If user unloads hns3 driver at the time, because it removes all the ae_dev nodes, and it may cause oops.  But we can't simply use hnae3_common_lock for this. Because in the process flow of pci_disable_sriov(), it will trigger the remove flow of VF, which will also take hnae3_common_lock.  To fixes it, introduce a new mutex to protect the unload process.
published:2025-02-27T20:16:02.847


Instruction: Please provide detailed information about CVE-2025-21803

CVE:CVE-2025-21803
Description:In the Linux kernel, the following vulnerability has been resolved:  LoongArch: Fix warnings during S3 suspend  The enable_gpe_wakeup() function calls acpi_enable_all_wakeup_gpes(), and the later one may call the preempt_schedule_common() function, resulting in a thread switch and causing the CPU to be in an interrupt enabled state after the enable_gpe_wakeup() function returns, leading to the warnings as follow.  [ C0] WARNING: ... at kernel/time/timekeeping.c:845 ktime_get+0xbc/0xc8 [ C0]          ... [ C0] Call Trace: [ C0] [<90000000002243b4>] show_stack+0x64/0x188 [ C0] [<900000000164673c>] dump_stack_lvl+0x60/0x88 [ C0] [<90000000002687e4>] __warn+0x8c/0x148 [ C0] [<90000000015e9978>] report_bug+0x1c0/0x2b0 [ C0] [<90000000016478e4>] do_bp+0x204/0x3b8 [ C0] [<90000000025b1924>] exception_handlers+0x1924/0x10000 [ C0] [<9000000000343bbc>] ktime_get+0xbc/0xc8 [ C0] [<9000000000354c08>] tick_sched_timer+0x30/0xb0 [ C0] [<90000000003408e0>] __hrtimer_run_queues+0x160/0x378 [ C0] [<9000000000341f14>] hrtimer_interrupt+0x144/0x388 [ C0] [<9000000000228348>] constant_timer_interrupt+0x38/0x48 [ C0] [<90000000002feba4>] __handle_irq_event_percpu+0x64/0x1e8 [ C0] [<90000000002fed48>] handle_irq_event_percpu+0x20/0x80 [ C0] [<9000000000306b9c>] handle_percpu_irq+0x5c/0x98 [ C0] [<90000000002fd4a0>] generic_handle_domain_irq+0x30/0x48 [ C0] [<9000000000d0c7b0>] handle_cpu_irq+0x70/0xa8 [ C0] [<9000000001646b30>] handle_loongarch_irq+0x30/0x48 [ C0] [<9000000001646bc8>] do_vint+0x80/0xe0 [ C0] [<90000000002aea1c>] finish_task_switch.isra.0+0x8c/0x2a8 [ C0] [<900000000164e34c>] __schedule+0x314/0xa48 [ C0] [<900000000164ead8>] schedule+0x58/0xf0 [ C0] [<9000000000294a2c>] worker_thread+0x224/0x498 [ C0] [<900000000029d2f0>] kthread+0xf8/0x108 [ C0] [<9000000000221f28>] ret_from_kernel_thread+0xc/0xa4 [ C0] [ C0] ---[ end trace 0000000000000000 ]---  The root cause is acpi_enable_all_wakeup_gpes() uses a mutex to protect acpi_hw_enable_all_wakeup_gpes(), and acpi_ut_acquire_mutex() may cause a thread switch. Since there is no longer concurrent execution during loongarch_acpi_suspend(), we can call acpi_hw_enable_all_wakeup_gpes() directly in enable_gpe_wakeup().  The solution is similar to commit 22db06337f590d01 ("ACPI: sleep: Avoid breaking S3 wakeup due to might_sleep()").
published:2025-02-27T20:16:02.937


Instruction: Please provide detailed information about CVE-2025-21804

CVE:CVE-2025-21804
Description:In the Linux kernel, the following vulnerability has been resolved:  PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region()  The rcar_pcie_parse_outbound_ranges() uses the devm_request_mem_region() macro to request a needed resource. A string variable that lives on the stack is then used to store a dynamically computed resource name, which is then passed on as one of the macro arguments. This can lead to undefined behavior.  Depending on the current contents of the memory, the manifestations of errors may vary. One possible output may be as follows:    $ cat /proc/iomem   30000000-37ffffff :   38000000-3fffffff :  Sometimes, garbage may appear after the colon.  In very rare cases, if no NULL-terminator is found in memory, the system might crash because the string iterator will overrun which can lead to access of unmapped memory above the stack.  Thus, fix this by replacing outbound_name with the name of the previously requested resource. With the changes applied, the output will be as follows:    $ cat /proc/iomem   30000000-37ffffff : memory2   38000000-3fffffff : memory3  [kwilczynski: commit log]
published:2025-02-27T20:16:03.030