Malicious code in icha-5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4175cb59820d68fcaa8fbe49f43bae4ae630f154bbde4a1413a19eb8f5082b85 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rita-57 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c3e0131b137ed8c312a0297b57aeb5ccbc5bfffa337e7ba4847c62489324dbb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-165927 Malicious code in siregar-poke11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4cb653756492e2c793f9e904f28c46598cf277d63799280ee5f229486514bbf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

UBUNTU-CVE-2025-40159

In the Linux kernel, the following vulnerability has been resolved: xsk: Harden userspace-supplied xdpdesc validation Turned out certain clearly invalid values passed in xdpdesc from userspace can pass xp,unalignedvalidatedesc and then lead to UBs or just invalid frames to be queued for xmit...

CVE-2025-40159 xsk: Harden userspace-supplied xdp_desc validation

In the Linux kernel, the following vulnerability has been resolved: xsk: Harden userspace-supplied xdpdesc validation Turned out certain clearly invalid values passed in xdpdesc from userspace can pass xp,unalignedvalidatedesc and then lead to UBs or just invalid frames to be queued for xmit...

CVE-2025-40159

In the Linux kernel, the following vulnerability has been resolved: xsk: Harden userspace-supplied xdpdesc validation Turned out certain clearly invalid values passed in xdpdesc from userspace can pass xp,unalignedvalidatedesc and then lead to UBs or just invalid frames to be queued for xmit...

MAL-2025-142980 Malicious code in got-izar-acamar-google (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03c2fd8fe47fbb26643f2f916acfececa96c9ebe4b2460bb04ff9de46201fd9e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139714 Malicious code in aurora-yildun-karma-xanadu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 002463a9ef23a3781a6864d5ad3a340c5c545b7720c5f79a22a9477e198d67d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990853)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990853 advisory. In the Linux kernel, the following vulnerability has been resolved: HID: cougar: fix slab-out-of-bounds Read in cougarreportfixup reportfixup for the Cougar 500k...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-990775)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990775 advisory. In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL sndbufdesc in smccdctxhandler When performing a stress test on SMC-R by rmmod...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990752)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990752 advisory. In the Linux kernel, the following vulnerability has been resolved: fs: prevent out-of-bounds array speculation when closing a file descriptor Google-Bug-Id: 1141993...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from xsk not adequately validating the user-space provided xdpdesc, which could lead to an integer overflow...

Linux Distros Unpatched Vulnerability : CVE-2025-40159

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xsk: Harden userspace-supplied xdpdesc validation Turned out certain clearly invalid values passed in xdpdesc from userspace can pass xp,unalignedvalidatedesc a...

PT-2025-46634

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the xsk module related to the validation of userspace-supplied xdp desc. Specifically, certain invalid values provided in the xdp desc from userspace...

MAL-2025-137385 Malicious code in tomi-serimuka28-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8bf50ba0c6b51cd319edf309254b8ae0ab3d993e277ab7a84eacc0c6f27e94d2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in upper_toad_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab01551278cbcf6ec1db58adf68c2525628cd5a4b7cf0274e39d977f84a0d471 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hadianto-lontong42-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 572f6814f24bf575cc396ec77062eafe74518e919e484f2ffd5b4107099fb85e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wati-lapis93-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c36161a3db434c074ea261d7a19cf61733dcfb933ffa9dd6b1f2792cd72207f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

kernel: inotify: Avoid reporting event with invalid wd

A race condition was found in the Linux kernel's inotify subsystem. When inotifyfreeingmark races with inotifyhandleinodeevent, the event handler may read imark-wd after it has been reset to -1. This causes an invalid watch descriptor value of -1 to be reported to userspace applications,...

MAL-2025-95204 Malicious code in leading_tuna_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9ece27b27ec080e6834e1ee1a88b1e75cacfec3ec7d0138962faeffb03f0b70 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...