UBUNTU-CVE-2022-49371

In the Linux kernel, the following vulnerability has been resolved: driver core: fix deadlock in deviceattach In deviceattach function, The lock holding logic is as follows: ... deviceattach devicelockdev // get lock dev asyncscheduledevdeviceattachasynchelper, dev; // func asyncschedulenode...

CVE-2022-49385 driver: base: fix UAF when driver_attach failed

In the Linux kernel, the following vulnerability has been resolved: driver: base: fix UAF when driverattach failed When driverattachdrv; failed, the driverprivate will be freed. But it has been added to the bus, which caused a UAF. To fix it, we need to delete it from the bus when failed...

CVE-2022-49385

CVE-2022-49385 concerns a Linux kernel UAF in the driver_base path. When driver_attach(drv) fails, the code frees driver_private but had already been added to the bus, allowing a use-after-free condition. The documented fix is to ensure the object is removed from the bus on failure, preventing th...

CVE-2022-49371 driver core: fix deadlock in __device_attach

In the Linux kernel, the following vulnerability has been resolved: driver core: fix deadlock in deviceattach In deviceattach function, The lock holding logic is as follows: ... deviceattach devicelockdev // get lock dev asyncscheduledevdeviceattachasynchelper, dev; // func asyncschedulenode...

CVE-2022-49371 driver core: fix deadlock in __device_attach

In the Linux kernel, the following vulnerability has been resolved: driver core: fix deadlock in deviceattach In deviceattach function, The lock holding logic is as follows: ... deviceattach devicelockdev // get lock dev asyncscheduledevdeviceattachasynchelper, dev; // func asyncschedulenode...

CVE-2022-49371

CVE-2022-49371: In the Linux kernel, driver core: fix deadlock in __device_attach. The deadlock occurs when async_probe is scheduled while holding device_lock(dev); async_helper may also acquire dev, causing A-A deadlock. The fix moves async_schedule_dev outside the device_lock path, leveraging t...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the deviceattach function that can cause an A-A deadlock when executing deviceattachasynchelper synchronousl...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from the failure to remove driverprivate from the bus when driverattach fails, resulting in reuse after release...

PT-2025-25836

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue concerns a vulnerability in the Linux kernel related to the use of IOMMU Input-Output Memory Management Unit translation for MSI Message Signaled Interrupts message addresses...

PT-2025-16760

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.14.0-rc1-next-20250206-xfstests-dirty 726 Description A vulnerability in the Linux kernel has been resolved, which could cause a hung task if ext4 inode attach jinode fails in ext4 setattr. This failure prevent...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Fixed a null pointer dereference in the resolveprogtype function for BPFPROGTYPEEXT. When loading an EXT program without specifying attr-attachprogfd, the prog-aux-dstprog will be null. At this point, calling resolveprogtype...

CVE-2024-23353

Transient DOS while decoding attach reject message received by UE, when IEI is set to ESMIEI...

DEBIAN-CVE-2025-21683

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpfskselectreuseport memory leak As pointed out in the original comment, lookup in sockmap can return a TCP ESTABLISHED socket. Such TCP socket may have had SOATTACHREUSEPORTEBPF set before it was ESTABLISHED. In other...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the attach component of the content edition feature, which allows users to attach files or medias to a page. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects”...

YesWiki 跨站脚本漏洞

YesWiki is a wiki system written in PHP by the French organization YesWiki. It is used to create and manage websites in a collaborative way. A cross-site scripting vulnerability exists in YesWiki 4.4.5 and earlier versions, which stems from improper input validation when the attach component...

PT-2025-5262 · Yeswiki · Yeswiki

Name of the Vulnerable Software and Affected Versions: YesWiki versions up to and including 4.4.5 Description: The vulnerability allows an authenticated user with rights to edit or create a page or comment to trigger a stored XSS attack, which can be reflected on any page where the resource is...

CVE-2025-24018: Improper Neutralization of Input During Web Page Generation

YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for an authenticated user with rights to edit/create a page or comment to trigger a stored XSS which will be reflected on any page where the resource is loaded. The vulnerability makes use of the conten...

WordPress Attach Gallery Posts plugin <= 1.6 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh in WordPress Plugin Attach Gallery Posts versions = 1.6...

AZL-55831 CVE-2024-57887 affecting package kernel for versions less than 6.6.76.1-1

In the Linux kernel, the following vulnerability has been resolved: drm: adv7511: Fix use-after-free in adv7533attachdsi The hostnode pointer was assigned and freed in adv7533parsedt, and later, adv7533attachdsi uses the same. Fix this use-after-free issue by dropping ofnodeput in adv7533parsedt...

AZL-56121 CVE-2024-47809 affecting package kernel for versions less than 6.6.76.1-1

In the Linux kernel, the following vulnerability has been resolved: dlm: fix possible lkbresource null dereference This patch fixes a possible null pointer dereference when this function is called from requestlock as lkb-lkbresource is not assigned yet, only after validatelockargs by calling...