CVE-2025-40189

In the Linux kernel, the following vulnerability has been resolved: net: usb: lan78xx: Fix lost EEPROM read timeout error-ETIMEDOUT in lan78xxreadraweeprom Syzbot reported read of uninitialized variable BUG with following call stack. lan78xx 8-1:1.0 unnamed netdevice uninitialized: EEPROM read...

DEBIAN-CVE-2025-40189

In the Linux kernel, the following vulnerability has been resolved: net: usb: lan78xx: Fix lost EEPROM read timeout error-ETIMEDOUT in lan78xxreadraweeprom Syzbot reported read of uninitialized variable BUG with following call stack. lan78xx 8-1:1.0 unnamed netdevice uninitialized: EEPROM read...

UBUNTU-CVE-2025-40189

In the Linux kernel, the following vulnerability has been resolved: net: usb: lan78xx: Fix lost EEPROM read timeout error-ETIMEDOUT in lan78xxreadraweeprom Syzbot reported read of uninitialized variable BUG with following call stack. lan78xx 8-1:1.0 unnamed netdevice uninitialized: EEPROM read...

CVE-2025-40189 net: usb: lan78xx: Fix lost EEPROM read timeout error(-ETIMEDOUT) in lan78xx_read_raw_eeprom

In the Linux kernel, the following vulnerability has been resolved: net: usb: lan78xx: Fix lost EEPROM read timeout error-ETIMEDOUT in lan78xxreadraweeprom Syzbot reported read of uninitialized variable BUG with following call stack. lan78xx 8-1:1.0 unnamed netdevice uninitialized: EEPROM read...

MAL-2025-163040 Malicious code in nokire-nakala83 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 498f4601f094da14334f6c5c60a738dd43a0540e6873256721862655017cf80e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-159269 Malicious code in makani-aiba-ufa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6941b61ec26caa37cee08426c28b59ba4ec5cb6d893cad83bb41aba66079fdb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

kernel: do_change_type(): refuse to operate on unmounted/not ours mounts

In the Linux kernel, the following vulnerability has been resolved: dochangetype: refuse to operate on unmounted/not ours mounts Ensure that propagation settings can only be changed for mounts located in the caller's mount namespace. This change aligns permission checking with the rest of mount2...

CVE-2025-40160

CVE-2025-40160: In the Linux kernel Xen event handling, find_virq() now returns -EEXIST when a VIRQ bound to a different CPU, replacing the previous BUG_ON() path. This affects per-domain/global VIRQs (which must be bound to CPU0 before migration). A second bind for per-domain/global VIRQs is tre...

WhatsApp Malware 'Maverick' Hijacks Browser Sessions to Target Brazil's Biggest Banks

Threat hunters have uncovered similarities between a banking malware called Coyote and a newly disclosed malicious program dubbed Maverick that has been propagated via WhatsApp. According to a report from CyberProof, both malware strains are written in .NET, target Brazilian users and banks, and...

MAL-2025-98132 Malicious code in maya-pisang71-tititugel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab19c6c5a97b2ff9b1356db0b8f85fb5a776a4bf698632a418cdd1b9b537950c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Chasing One-Day Vulnerabilities across Open Source Forks

Tracking vulnerabilities inherited from third-party open-source components is a well-known challenge, often addressed by tracing the threads of dependency information. However, vulnerabilities can also propagate through forking: a repository forked after the introduction of a vulnerability, but...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990622)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990622 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/msm/mdp5: Return error code in mdp5mixerrelease when deadlock is detected There is a...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990479)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990479 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/msm/mdp5: Return error code in mdp5piperelease when deadlock is detected mdp5getglobalstate...

Google Uncovers PROMPTFLUX Malware That Uses Gemini AI to Rewrite Its Code Hourly

Google on Wednesday said it discovered an unknown threat actor using an experimental Visual Basic Script VB Script malware dubbed PROMPTFLUX that interacts with its Gemini artificial intelligence AI model API to write its own source code for improved obfuscation and evasion. "PROMPTFLUX is writte...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989581)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989581 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: Fix insufficient bounds propagation from adjustscalarminmaxvals Kuee reported a corner case...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989479)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989479 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/msm/mdp5: Return error code in mdp5mixerrelease when deadlock is detected There is a...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: dochangetype: refusal to operate on unmounted/not-of-our-mounts mounts. It is ensured that propagation settings can only be changed for mounts located within the caller’s mount namespace. This change aligns permission checks with...

SUSE CVE-2025-40029

In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: Check return value of platformgetresource platformgetresource returns NULL in case of failure, so check its return value and propagate the error in order to prevent NULL pointer dereference...

CVE-2025-40029

The CVE-2025-40029 issue affects the Linux kernel, specifically the bus: fsl-mc component. The root cause is that platform_get_resource() may return NULL on failure and was not properly checked, risking a NULL pointer dereference. The published fixes add a check of the return value and propagate ...

EUVD-2022-54574

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix insufficient bounds propagation from adjustscalarminmaxvals Kuee reported a corner case where the tnum becomes constant after the call to regboundoffset, but the register's bounds are not, that is, its min bounds are sti...