kernel: x86/ioapic: Handle allocation failures gracefully

A flaw was found in the Linux kernel's x86 IO-APIC Input/Output Advanced Programmable Interrupt Controller component. A local attacker with low privileges could trigger an interrupt allocation failure under specific runtime conditions. This failure would lead to a kernel panic, resulting in a...

kernel: block, bfq: fix bfqq uaf in bfq_limit_depth()

In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix bfqq uaf in bfqlimitdepth Set new allocated bfqq to bic or remove freed bfqq from bic are both protected by bfqd-lock, however bfqlimitdepth is deferencing bfqq from bic without the lock, this can lead to UAF if t...

kernel: Secure Boot does not automatically enable kernel lockdown

The Linux Kernel lockdown mode for kernel versions starting on 6.12 and above for Fedora Linux has the lockdown mode disabled without any warning. This may allow an attacker to gain access to sensitive information such kernel memory mappings, I/O ports, BPF and kprobes. Additionally unsigned...

kernel: iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count

This CVE has been marked as Rejected by the assigning CNA...

Medium: javapackages-bootstrap

Issue Overview: Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before 2.14.0. Users are...

Medium: javapackages-bootstrap

Issue Overview: Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before 2.14.0. Users are...

Amazon Linux 2023 : javapackages-bootstrap (ALAS2023-2025-970)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-970 advisory. Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted inpu...

[SECURITY] Fedora 42 Update: golang-github-nats-io-nkeys-0.4.11-2.fc42

A public-key signature system based on Ed25519 for the NATS ecosystem...

[SECURITY] Fedora 41 Update: perl-Compress-Raw-Lzma-2.212-6.fc41

This module provides a Perl interface to the lzma compression library. It is used by IO::Compress::Lzma...

DEBIAN-CVE-2025-37861

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue When the task management thread processes reply queues while the reset thread resets them, the task management thread accesses an invalid queue ID 0xFFFF, s...

CVE-2025-32402

An Out-of-bounds Write in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the library by sending a malicious RPC packet...

CVE-2025-32398

A NULL Pointer Dereference in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the library by sending a malicious RPC packet...

CVE-2025-32400

An Heap-based Buffer Overflow in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the library by sending a malicious RPC packet...

CVE-2025-32397

An Heap-based Buffer Overflow in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the library by sending a malicious RPC packet...

CVE-2025-32405

An Out-of-bounds Write in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the library by sending a malicious RPC packet...

CVE-2025-32396

An Heap-based Buffer Overflow in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the library by sending a malicious RPC packet...

CVE-2025-37861

The CVE 2025-37861 pertains to the Linux kernel SCSI MPI3MR driver where the TM thread could process reply queues while the reset thread reinitializes them, causing an access to an invalid queue ID (0xFFFF) and a crash. The fix adds a synchronization flag io_admin_reset_sync. Before a reset, the ...

CVE-2024-45570

Memory corruption may occur during IO configuration processing when the IO port count is invalid...

CVE-2025-37804

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

PT-2025-20333

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A data-race issue has been identified in the Linux kernel related to io uring. The issue arises when the request owner changes other flag bits, causing KCSAN to complain. The problem...