MAL-2025-21006 Malicious code in fs-extar (npm)

The package fs-extar was found to contain malicious code...

Malicious code in fs-etxra (npm)

The package fs-etxra was found to contain malicious code...

@uni-cli/cli (>=1.0.6, <=1.0.12), @uni-cli/init (1.0.12) +1 more potentially affected by unknown CVE via fs-extar (0.0.1-security)

fs-extar NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on fs-extar and may be impacted: - @uni-cli/cli =1.0.6, =1.0.12 - @uni-cli/init 1.0.12 - hwsz-tools 1.0.0 Source cves: unknown CVE Source advisory: OSV:MAL-2025-21006...

MAL-2025-21007 Malicious code in fs-filter (npm)

The package fs-filter was found to contain malicious code...

Linux Distros Unpatched Vulnerability : CVE-2025-48387

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified di...

Linux Distros Unpatched Vulnerability : CVE-2024-12905

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An Improper Link Resolution Before File Access Link Following and Improper Limitation of a Pathname to a Restricted Directory Path Traversal. This vulnerability...

Linux Distros Unpatched Vulnerability : CVE-2024-26764

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/aio: Restrict kiocbsetcancelfn to I/O submitted via libaio If kiocbsetcancelfn is called for I/O submitted via iouring, the following kernel warning appears:...

CVE-2025-38415

In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result of sbminblocksize Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfsbioread" bug. Syzkaller forks multiple processes which after mounting the Squashfs filesystem, issues an ioctl"/dev/loop0...

CVE-2025-38415: Out-of-bounds Write

In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result of sbminblocksize Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfsbioread" bug. Syzkaller forks multiple processes which after mounting the Squashfs filesystem, issues an ioctl"/dev/loop0...

CBL Mariner 2.0 Security Update: reaper (CVE-2025-48387)

The version of reaper installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-48387 advisory. - tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue...

UBUNTU-CVE-2025-38306

In the Linux kernel, the following vulnerability has been resolved: fs/fhandle.c: fix a race in call of haslockedchildren maydecodefh is calling haslockedchildren while holding no locks. That's an oopsable race... The rest of the callers are safe since they are holding namespacesem and are...

CVE-2025-38276

In CVE-2025-38276, the issue comes from fs/dax after the commit 6be3e21d25ca, which introduced wait_entry_unlocked_exclusive() that waits for an entry to unlock without advancing the XArray iterator state. Dropping the XArray lock requires xas_pause(), which advances the iterator state to the nex...

CVE-2025-38306: Concurrent Execution using Shared Resource with Improper Synchronization

In the Linux kernel, the following vulnerability has been resolved: fs/fhandle.c: fix a race in call of haslockedchildren maydecodefh is calling haslockedchildren while holding no locks. That's an oopsable race... The rest of the callers are safe since they are holding namespacesem and are...

CVE-2025-38276: Improper Locking

In the Linux kernel, the following vulnerability has been resolved: fs/dax: Fix "don't skip locked entries when scanning entries" Commit 6be3e21d25ca "fs/dax: don't skip locked entries when scanning entries" introduced a new function, waitentryunlockedexclusive, which waits for the current entry ...

CVE-2025-38337: NULL Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: jbd2: fix data-race and null-ptr-deref in jbd2journaldirtymetadata Since handle-htransaction may be a NULL pointer, so we should change it to call ishandleabortedhandle first before dereferencing it. And the following data-race w...

PT-2025-27978

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.13.0-rc6 Description: A concurrency bug in the fs/jfs module results in a null pointer dereference. The issue is closely related to a previously fixed problem, but the accepted patch is still susceptible to a...

UBUNTU-CVE-2025-38164

In the Linux kernel, the following vulnerability has been resolved: f2fs: zone: fix to avoid inconsistence in between SIT and SSA w/ below testcase, it will cause inconsistence in between SIT and SSA. createnullblk 512 2 1024 1024 mkfs.f2fs -m /dev/nullb0 mount /dev/nullb0 /mnt/f2fs/ touch...

The vulnerability of the ocfs2 function: The remove() component in the fs/ocfs2/xattr.c kernel module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the ocfs2 function: The remove component in the fs/ocfs2/xattr.c file of the Linux kernel is associated with pointer dereferencing errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2025-38167: NULL Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle hdrfirstde return value The hdrfirstde function returns a pointer to a struct NTFSDE. This pointer may be NULL. To handle the NULL error effectively, it is important to implement an error handler. This will help...

Kernel: use-after-free in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c

A use-after-free flaw was found in nfsd4sscsetupdul in fs/nfsd/nfs4proc.c in the NFS filesystem in the Linux Kernel. This issue could allow a local attacker to crash the system or it may lead to a kernel information leak problem...