CVE-2025-40159

In the Linux kernel, the following vulnerability has been resolved: xsk: Harden userspace-supplied xdpdesc validation Turned out certain clearly invalid values passed in xdpdesc from userspace can pass xp,unalignedvalidatedesc and then lead to UBs or just invalid frames to be queued for xmit...

CVE-2025-40159 xsk: Harden userspace-supplied xdp_desc validation

In the Linux kernel, the following vulnerability has been resolved: xsk: Harden userspace-supplied xdpdesc validation Turned out certain clearly invalid values passed in xdpdesc from userspace can pass xp,unalignedvalidatedesc and then lead to UBs or just invalid frames to be queued for xmit...

MAL-2025-142980 Malicious code in got-izar-acamar-google (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03c2fd8fe47fbb26643f2f916acfececa96c9ebe4b2460bb04ff9de46201fd9e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139714 Malicious code in aurora-yildun-karma-xanadu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 002463a9ef23a3781a6864d5ad3a340c5c545b7720c5f79a22a9477e198d67d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990775)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990775 advisory. In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL sndbufdesc in smccdctxhandler When performing a stress test on SMC-R by rmmod...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990752)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990752 advisory. In the Linux kernel, the following vulnerability has been resolved: fs: prevent out-of-bounds array speculation when closing a file descriptor Google-Bug-Id: 1141993...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990853)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990853 advisory. In the Linux kernel, the following vulnerability has been resolved: HID: cougar: fix slab-out-of-bounds Read in cougarreportfixup reportfixup for the Cougar 500k...

Linux Distros Unpatched Vulnerability : CVE-2025-40159

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xsk: Harden userspace-supplied xdpdesc validation Turned out certain clearly invalid values passed in xdpdesc from userspace can pass xp,unalignedvalidatedesc a...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from xsk not adequately validating the user-space provided xdpdesc, which could lead to an integer overflow...

PT-2025-46634

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the xsk module related to the validation of userspace-supplied xdp desc. Specifically, certain invalid values provided in the xdp desc from userspace...

MAL-2025-137385 Malicious code in tomi-serimuka28-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8bf50ba0c6b51cd319edf309254b8ae0ab3d993e277ab7a84eacc0c6f27e94d2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in upper_toad_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab01551278cbcf6ec1db58adf68c2525628cd5a4b7cf0274e39d977f84a0d471 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hadianto-lontong42-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 572f6814f24bf575cc396ec77062eafe74518e919e484f2ffd5b4107099fb85e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wati-lapis93-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c36161a3db434c074ea261d7a19cf61733dcfb933ffa9dd6b1f2792cd72207f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

kernel: inotify: Avoid reporting event with invalid wd

A race condition was found in the Linux kernel's inotify subsystem. When inotifyfreeingmark races with inotifyhandleinodeevent, the event handler may read imark-wd after it has been reset to -1. This causes an invalid watch descriptor value of -1 to be reported to userspace applications,...

MAL-2025-95204 Malicious code in leading_tuna_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9ece27b27ec080e6834e1ee1a88b1e75cacfec3ec7d0138962faeffb03f0b70 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-86443 Malicious code in hendra-tahutek83-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ac7fdede68d1499144ec48923cd331211447febb90dd124f0e7a0cd0cd38f22 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yanti-sego83-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ba24748840b55eedbc6bcbdbd6ed872e4ae32108688b5560995c3bdbbfa50fc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-71281 Malicious code in unfortunate-lime-junglefowl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e2f295d39e2e2caf5747d61b6a9b95c88d1ef7c0d66bd1a173d25f4c314ff9d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in maya-klipo57-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f51861a077e383a7f7b52388a0106bb2bd4c8b1509928028ed3378bcf9316c1f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...