CVE-2025-38302

Technical details about CVE-2025-38302 are not publicly provided in the connected documents. The Linux kernel fix is described at a high level; no vendor/product/version mappings or exploit details are included here. Monitor for updates from vendors/security advisories.

CVE-2025-38302 block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work

In the Linux kernel, the following vulnerability has been resolved: block: don't use submitbionoacctnocheck in blkzonewplugbiowork Bios queued up in the zone write plug have already gone through all all preparation in the submitbio path, including the freeze protection. Submitting them through...

Important: kernel6.12

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix out-of-range access of vnicinfo array CVE-2025-22112 In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: init wiphywork before allocating rfkill fails CVE-2025-22119 ...

PT-2025-39425

Name of the Vulnerable Software and Affected Versions glib-networking affected versions not specified Description The OpenSSL backend in glib-networking does not correctly validate the return value from the BIO write function call, which can lead to an out-of-bounds read. Recommendations At the...

PT-2025-30805

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a memory leak in the nvmet subsystem related to bio integrity. When nvmet receives commands with metadata, a continuous memory leak occurs within the kmalloc-12...

CVE-2025-38063

In the Linux kernel, the following vulnerability has been resolved: dm: fix unconditional IO throttle caused by REQPREFLUSH When a bio with REQPREFLUSH is submitted to dm, sendemptyflush generates a flushbio with REQOPWRITE | REQPREFLUSH | REQSYNC, which causes the flushbio to be throttled by...

DEBIAN-CVE-2025-38063

In the Linux kernel, the following vulnerability has been resolved: dm: fix unconditional IO throttle caused by REQPREFLUSH When a bio with REQPREFLUSH is submitted to dm, sendemptyflush generates a flushbio with REQOPWRITE | REQPREFLUSH | REQSYNC, which causes the flushbio to be throttled by...

CVE-2025-38063 dm: fix unconditional IO throttle caused by REQ_PREFLUSH

In the Linux kernel, the following vulnerability has been resolved: dm: fix unconditional IO throttle caused by REQPREFLUSH When a bio with REQPREFLUSH is submitted to dm, sendemptyflush generates a flushbio with REQOPWRITE | REQPREFLUSH | REQSYNC, which causes the flushbio to be throttled by...

CVE-2025-38063

The CVE-2025-38063 entry concerns a Linux kernel vulnerability in the Linux DM (device-mapper) path where a bio submitted with REQ_PREFLUSH causes an unconditional IO throttle via wbt_wait, throttling the flush_bio that includes REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC. The root cause is throttling...

CVE-2025-38063 dm: fix unconditional IO throttle caused by REQ_PREFLUSH

In the Linux kernel, the following vulnerability has been resolved: dm: fix unconditional IO throttle caused by REQPREFLUSH When a bio with REQPREFLUSH is submitted to dm, sendemptyflush generates a flushbio with REQOPWRITE | REQPREFLUSH | REQSYNC, which causes the flushbio to be throttled by...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: In the blkzonewplugbiowork function, do not use submitbionoacctnocheck. Queues of zone write operations have already gone through all preparations in the submitbio path, including freeze protection. Submitting these operations...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Block: Integrity – Do not call setpagedirtylock Placing multiple protection information buffers within the same page can lead to errors, as setpagedirtylock cannot be called from an interrupt context. Since a protection informati...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: dm-flakey: Fixed memory corruption in the optional corruptbiobyte feature. Fixed memory corruption caused by incorrect parameters being passed to bioinit...

📄 ERPNext 15.53.1 Cross Site Scripting

ERPNext version 15.53.1 suffers from multiple persistent cross site scripting vulnerabilities. An authenticated user can inject malicious JavaScript into the userimage field of the profile page using an XSS payload within the file path or HTML context. This field is rendered without sufficient...

SUSE CVE-2025-37999

In the Linux kernel, the following vulnerability has been resolved: fs/erofs/fileio: call erofsonlinefoliosplit after bioaddfolio If bioaddfolio fails because it is full, erofsfileioscanfolio needs to submit the I/O request via erofsfileiorqsubmit and allocate a new I/O request with an empty stru...

UBUNTU-CVE-2025-37999

In the Linux kernel, the following vulnerability has been resolved: fs/erofs/fileio: call erofsonlinefoliosplit after bioaddfolio If bioaddfolio fails because it is full, erofsfileioscanfolio needs to submit the I/O request via erofsfileiorqsubmit and allocate a new I/O request with an empty stru...

CVE-2021-24545

The WP HTML Author Bio WordPress plugin through 1.2.0 does not sanitise the HTML allowed in the Bio of users, allowing them to use malicious JavaScript code, which will be executed when anyone visit a post in the frontend made by such user. As a result, user with a role as low as author could...

CVE-2021-24128

Unvalidated input and lack of output encoding in the Team Members WordPress plugin, versions before 5.0.4, lead to Cross-site scripting vulnerabilities allowing medium-privileged authenticated attacker contributor+ to inject arbitrary web script or HTML via the 'Description/biography' of a member...

SUSE CVE-2025-37978

In the Linux kernel, the following vulnerability has been resolved: block: integrity: Do not call setpagedirtylock Placing multiple protection information buffers inside the same page can lead to oopses because setpagedirtylock can't be called from interrupt context. Since a protection informatio...

UBUNTU-CVE-2025-37978

In the Linux kernel, the following vulnerability has been resolved: block: integrity: Do not call setpagedirtylock Placing multiple protection information buffers inside the same page can lead to oopses because setpagedirtylock can't be called from interrupt context. Since a protection informatio...