CVE-2025-37885

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Reset IRTE to host control if new route isn't postable Restore an IRTE back to host control remapped or posted MSI mode if the new GSI route prevents posting the IRQ directly to a vCPU, regardless of the GSI routing typ...

CVE-2025-37843

In the Linux kernel, the following vulnerability has been resolved: PCI: pciehp: Avoid unnecessary device replacement check Hot-removal of nested PCI hotplug ports suffers from a long-standing race condition which can lead to a deadlock: A parent hotplug port acquires pcilockrescanremove, then...

CVE-2025-37889

In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Consistently treat platformmax as control value This reverts commit 9bdd10d57a88 "ASoC: ops: Shift tested values in sndsocputvolsw by +min", and makes some additional related updates. There are two ways the platformmax...

CVE-2025-37884

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix deadlock between rcutaskstrace and eventmutex. Fix the following deadlock: CPU A freeevent perfkprobedestroy mutexlock&eventmutex perftraceeventunreg synchronizercutaskstrace There are several paths where freeevent grabs...

CVE-2025-37887 pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result

In the Linux kernel, the following vulnerability has been resolved: pdscore: handle unsupported PDSCORECMDFWCONTROL result If the FW doesn't support the PDSCORECMDFWCONTROL command the driver might at the least print garbage and at the worst crash when the user runs the "devlink dev info" devlink...

CVE-2025-37869 drm/xe: Use local fence in error path of xe_migrate_clear

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Use local fence in error path of xemigrateclear The intent of the error path in xemigrateclear is to wait on locally generated fence and then return. The code is waiting on m-fence which could be the local fence but this ...

CVE-2025-37858

The CVE-2025-37858 issue affects the Linux kernel’s JFS filesystem. Root cause: AG size calculation in dbExtendFS() uses a 1 < 31 on 32-bit systems, this causes undefined behavior and invalid AG sizes (sbi->bmap->db_agsize). Impact: potential filesystem corruption during extend operation...

CVE-2025-37857 scsi: st: Fix array overflow in st_setup()

In the Linux kernel, the following vulnerability has been resolved: scsi: st: Fix array overflow in stsetup Change the array size to follow parms size instead of a fixed value...

CVE-2025-37855 drm/amd/display: Guard Possible Null Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Guard Possible Null Pointer Dereference WHY In some situations, dc-respool may be null. HOW Check if pointer is null before dereference...

CVE-2025-37848

The CVE-2025-37848 fix applies to the Linux kernel accel/ivpu MS IOCTLs path. It resolves a PM-related deadlock where runtime resume/suspend can be blocked while MS IOCTLs are in progress; a failed suspend would trigger ivpu_ms_cleanup() which attempts to acquire file_priv->ms_lock that is alr...

CVE-2025-37836 PCI: Fix reference leak in pci_register_host_bridge()

In the Linux kernel, the following vulnerability has been resolved: PCI: Fix reference leak in pciregisterhostbridge If deviceregister fails, call putdevice to give up the reference to avoid a memory leak, per the comment at deviceregister. Found by code review. bhelgaas: squash Dan Carpenter's...

CVE-2025-3712

creationtimestamp| type| source ---|---|--- 2025-05-09 04:24:53+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/15663 2025-05-09 07:01:38+00:00| published-proof-of-concept| Telegram/LmF-oJVU7SiGeaAkGTq-PJOHK6kdysB5ZubzAPJONfATA 2025-05-09 08:41:18+00:00| seen| https://t.me/cvedetector/24915...

CVE-2025-4460

A vulnerability classified as problematic has been found in TOTOLINK N150RT 3.4.0-B20190525. This affects an unknown part of the component URL Filtering Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the publ...

CVE-2025-46712

Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 for OTP-27, OTP-26.2.5.12 for OTP-26, and OTP-25.3.2.21 for OTP-25, Erlang/OTP SSH fails to enforce strict KEX handshake hardening measures by allowing optional messages to be exchanged. This...

CVE-2025-0505

creationtimestamp| type| source ---|---|--- 2025-05-08 19:37:56+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114473898879191172 2025-05-08 19:48:26+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3looojsl7l3y2 2025-05-08...

CVE-2024-8100

On affected versions of the Arista CloudVision Portal CVP on-prem, the time-bound device onboarding token can be used to gain admin privileges on CloudVision...

CVE-2025-45845

TOTOLINK NR1800X V9.1.0u.6681B20230703 was discovered to contain an authenticated stack overflow via the ssid5g parameter in the setWiFiEasyGuestCfg function...

CVE-2025-37827

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: return EIO on RAID1 block group write pointer mismatch There was a bug report about a NULL pointer dereference in btrfsaddfreespacezoned that ultimately happens because a conversion from the default metadata profile...

CVE-2024-49845

Memory corruption during the FRS UDS generation process...

CVE-2025-3759

CVE-2025-3759 affects WF2220. The documented vulnerability is that the endpoint /cgi-bin-igd/netcore_set.cgi, used to change device configuration, is accessible without authentication due to a missing access control check. Root cause: lack of authentication enforcement on configuration changes. R...