CVE-2025-39783

CVE-2025-39783: Linux kernel PCI endpoint. The configfs group handling in pci_epf_remove_cfs() incorrectly called list_del() on epf_group, which is a list head, causing a slab-use-after-free (KASAN) when tearing down endpoint function drivers with a configfs attribute group. The connected Astra L...

CVE-2025-39779

In the Linux kernel, the following vulnerability has been resolved: btrfs: subpage: keep TOWRITE tag until folio is cleaned btrfssubpagesetwriteback calls foliostartwriteback the first time a folio is written back, and it also clears the PAGECACHETAGTOWRITE tag even if there are still dirty block...

CVE-2025-39779 btrfs: subpage: keep TOWRITE tag until folio is cleaned

In the Linux kernel, the following vulnerability has been resolved: btrfs: subpage: keep TOWRITE tag until folio is cleaned btrfssubpagesetwriteback calls foliostartwriteback the first time a folio is written back, and it also clears the PAGECACHETAGTOWRITE tag even if there are still dirty block...

CVE-2025-39779 btrfs: subpage: keep TOWRITE tag until folio is cleaned

In the Linux kernel, the following vulnerability has been resolved: btrfs: subpage: keep TOWRITE tag until folio is cleaned btrfssubpagesetwriteback calls foliostartwriteback the first time a folio is written back, and it also clears the PAGECACHETAGTOWRITE tag even if there are still dirty block...

CVE-2025-39761 wifi: ath12k: Decrement TID on RX peer frag setup error handling

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Decrement TID on RX peer frag setup error handling Currently, TID is not decremented before peer cleanup, during error handling path of ath12kdprxpeerfragsetup. This could lead to out-of-bounds access in peer-rxtid...

CVE-2025-39761 wifi: ath12k: Decrement TID on RX peer frag setup error handling

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Decrement TID on RX peer frag setup error handling Currently, TID is not decremented before peer cleanup, during error handling path of ath12kdprxpeerfragsetup. This could lead to out-of-bounds access in peer-rxtid...

CVE-2025-39761

CVE-2025-39761 pertains to the Linux kernel wifi driver ath12k. The issue arises when RX peer frag setup errors occur: TID is not decremented before cleaning up peer state, risking an out-of-bounds access in peer->rx_tid[]. The advisory states that a decrement operation on TID before peer clea...

CVE-2025-39753 gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops

In the Linux kernel, the following vulnerability has been resolved: gfs2: Set .migratefolio in gfs2rgrp,metaaops Clears up the warning added in 7ee3647243e5 "migrate: Remove call to -writepage" that occurs in various xfstests, causing "something found in dmesg" failures. 341.136573 gfs2metaaops...

CVE-2025-39750 wifi: ath12k: Correct tid cleanup when tid setup fails

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Correct tid cleanup when tid setup fails Currently, if any error occurs during ath12kdprxpeertidsetup, the tid value is already incremented, even though the corresponding TID is not actually allocated. Proceed to...

CVE-2025-39750

Technical details for CVE-2025-39750 are not provided in the supplied documents. No affected products, root cause, or fixes are disclosed here. Monitor for updates in forthcoming advisories or vendor bulletins.

CVE-2025-39750 wifi: ath12k: Correct tid cleanup when tid setup fails

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Correct tid cleanup when tid setup fails Currently, if any error occurs during ath12kdprxpeertidsetup, the tid value is already incremented, even though the corresponding TID is not actually allocated. Proceed to...

CVE-2025-39737 mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()

In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup in kmemleakdocleanup A soft lockup warning was observed on a relative small system x86-64 system with 16 GB of memory when running a debug kernel with kmemleak enabled. watchdog: BUG: soft lockup -...

CVE-2025-39737 mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()

In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup in kmemleakdocleanup A soft lockup warning was observed on a relative small system x86-64 system with 16 GB of memory when running a debug kernel with kmemleak enabled. watchdog: BUG: soft lockup -...

CVE-2025-39737

CVE-2025-39737 corresponds to a Linux kernel kmemleak issue where soft lockups occurred during cleanup of a large kmemleak object set (e.g., ~40k objects). The provided Astra Linux bulletin notes the fix: in kmemleak_do_cleanup(), periodically call cond_resched() inside the cleanup loop to avoid ...

MAL-2025-47085 Malicious code in secured-ssh (npm)

The package secured-ssh was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2646cfd359028f95d25b02993d148c26f9a4f910b6ee2b382f6e5a38e30ca9a0 Any computer that has this package installed or running should be considered fully...

MAL-2025-47058 Malicious code in epxressoo (npm)

The package epxressoo was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3319818dc603ffa75f3f426cb1533fc4b8e27f64161f4a3b71c268fa36d36503 Any computer that has this package installed or running should be considered fully compromised...

Malicious code in @liquid-web/utils (npm)

The package @liquid-web/utils was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02e29a386f30eacfd4a3e7023262f0bb759557fb0a41790632720ff54b920a8d Any computer that has this package installed or running should be considered fully...

kernel: netfilter: flowtable: fix stuck flows on cleanup due to pending work

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix stuck flows on cleanup due to pending work To clear the flow table on flow table free, the following sequence normally happens in order: 1 gcstep work is stopped to disable any further stats/del requests...

WordPress plugin Jobify 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

WordPress plugin Elements Plus 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...