kernel: ppp: fix ppp_async_encode() illegal access

A flaw was found in the Linux kernel's Point-to-Point Protocol PPP implementation. A local attacker can exploit this vulnerability by sending a specially crafted message with a zero size to the pppoesendmsg function, which leads to an uninitialized value being used in the pppasyncencode function...

kernel: udf: fix uninit-value use in udf_get_fileshortad

In the Linux kernel, the following vulnerability has been resolved: udf: fix uninit-value use in udfgetfileshortad Check for overflow when computing alen in udfcurrentaext to mitigate later uninit-value use in udfgetfileshortad KMSAN bug1. After applying the patch reproducer did not trigger any...

graphicsmagick:coder_HEIF_fuzzer: Use-of-uninitialized-value in fillIntraPredModeCandidates

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=6008683345805312 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderHEIFfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type: Use-of-uninitialized-value...

SUSE CVE-2022-49790

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - invert valid length check when fetching device IDs syzbot is reporting uninitialized value at iforceinitdevice 1, for commit 6ac0aec6b0a6 "Input: iforce - allow callers supply data buffer when fetching device IDs"...

OSV-2025-352 Use-of-uninitialized-value in JS_FreeRuntime

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=416299802 Crash type: Use-of-uninitialized-value Crash state: JSFreeRuntime fuzzeval.c asyncfuncinit...

PT-2025-21907 · Git +1 · Quickjs

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. affected versions not specified Description: The software suffers from a use-of-uninitialized-value issue. The crash state involves JS FreeRuntime, occurring within fuzz eval.c during async func init...

graphicsmagick:coder_HEIF_fuzzer: Use-of-uninitialized-value in heif_encoding_options_copy

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=5536276067713024 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderHEIFfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type: Use-of-uninitialized-value...

PT-2025-22222

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the version that includes the fix for the uninit-value issue in do output route4 Description A vulnerability has been resolved in the Linux kernel related to an uninit-value issue for the saddr argument in the do...

quickjs:fuzz_eval: Use-of-uninitialized-value in JS_FreeRuntime

Project: https://github.com/horhof/quickjs.git https://github.com/bellard/quickjs.git Detailed Report: https://oss-fuzz.com/testcase?key=6556534329114624 Project: quickjs Fuzzing Engine: libFuzzer Fuzz Target: fuzzeval Job Type: libfuzzermsanquickjs Platform Id: linux Crash Type:...

CBL Mariner 2.0 Security Update: kernel (CVE-2025-21922)

"The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21922 advisory. - In the Linux kernel, the following vulnerability has been resolved: ppp: Fix KMSAN uninit-value warning wit...

matio:matio_fuzzer: Use-of-uninitialized-value in Mat_PrintNumber

Project: git://git.code.sf.net/p/matio/matio https://github.com/tbeu/matio.git Detailed Report: https://oss-fuzz.com/testcase?key=5137924817747968 Project: matio Fuzzing Engine: libFuzzer Fuzz Target: matiofuzzer Job Type: libfuzzermsanmatio Platform Id: linux Crash Type: Use-of-uninitialized-val...

ppp: Fix KMSAN uninit-value warning with bpf

...

llvm:llvm-opt-fuzzer--x86_64-loop_predication: Use-of-uninitialized-value in llvm::SlotTracker::processFunction

Detailed Report: https://oss-fuzz.com/testcase?key=4751128082579456 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: llvm-opt-fuzzer--x8664-looppredication Job Type: libfuzzermsanllvm Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

OSV-2025-321 Use-of-uninitialized-value in JS_DefineProperty

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=415088961 Crash type: Use-of-uninitialized-value Crash state: JSDefineProperty buildbacktrace JSCallInternal...

PT-2025-20242 · Git +1 · Quickjs

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. affected versions not specified Description: The issue involves a use-of-uninitialized-value crash occurring within the JS DefineProperty function, triggered through JS CallInternal and build backtrace...

quickjs:fuzz_compile: Use-of-uninitialized-value in JS_DefineProperty

Project: https://github.com/horhof/quickjs.git https://github.com/bellard/quickjs.git Detailed Report: https://oss-fuzz.com/testcase?key=6133740432850944 Project: quickjs Fuzzing Engine: libFuzzer Fuzz Target: fuzzcompile Job Type: libfuzzermsanquickjs Platform Id: linux Crash Type:...

DEBIAN-CVE-2022-49862

In the Linux kernel, the following vulnerability has been resolved: tipc: fix the msg-req tlv len check in tipcnlcompatnametabledumpheader This is a follow-up for commit 974cb0e3e7c9 "tipc: fix uninit-value in tipcnlcompatnametabledump" where it should have type casted sizeof.. to int to work whe...

DEBIAN-CVE-2022-49790

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - invert valid length check when fetching device IDs syzbot is reporting uninitialized value at iforceinitdevice 1, for commit 6ac0aec6b0a6 "Input: iforce - allow callers supply data buffer when fetching device IDs"...

CVE-2022-49790

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - invert valid length check when fetching device IDs syzbot is reporting uninitialized value at iforceinitdevice 1, for commit 6ac0aec6b0a6 "Input: iforce - allow callers supply data buffer when fetching device IDs"...

UBUNTU-CVE-2022-49790

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - invert valid length check when fetching device IDs syzbot is reporting uninitialized value at iforceinitdevice 1, for commit 6ac0aec6b0a6 "Input: iforce - allow callers supply data buffer when fetching device IDs"...