AZL-70430 CVE-2025-38234 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: sched/rt: Fix race in pushrttask Overview ======== When a CPU chooses to call pushrttask and picks a task to push to another CPU's runqueue then it will call findlocklowestrq method which would take a double lock on both CPUs'...

CVE-2025-38230

In the Linux kernel, the following vulnerability has been resolved: jfs: validate AG parameters in dbMount to prevent crashes Validate dbagheight, dbagwidth, and dbagstart in dbMount to catch corrupted metadata early and avoid undefined behavior in dbAllocAG. Limits are derived from L2LPERCTL,...

CVE-2025-38234 sched/rt: Fix race in push_rt_task

In the Linux kernel, the following vulnerability has been resolved: sched/rt: Fix race in pushrttask Overview ======== When a CPU chooses to call pushrttask and picks a task to push to another CPU's runqueue then it will call findlocklowestrq method which would take a double lock on both CPUs'...

CVE-2025-38232 NFSD: fix race between nfsd registration and exports_proc

In the Linux kernel, the following vulnerability has been resolved: NFSD: fix race between nfsd registration and exportsproc As of now nfsd calls createprocexportsentry at start of initnfsd and cleanup by removeprocentry at last of exitnfsd. Which causes kernel OOPs if there is race between below...

CVE-2025-38230

In the Linux kernel, the following vulnerability has been resolved: jfs: validate AG parameters in dbMount to prevent crashes Validate dbagheight, dbagwidth, and dbagstart in dbMount to catch corrupted metadata early and avoid undefined behavior in dbAllocAG. Limits are derived from L2LPERCTL,...

CVE-2025-38230 jfs: validate AG parameters in dbMount() to prevent crashes

In the Linux kernel, the following vulnerability has been resolved: jfs: validate AG parameters in dbMount to prevent crashes Validate dbagheight, dbagwidth, and dbagstart in dbMount to catch corrupted metadata early and avoid undefined behavior in dbAllocAG. Limits are derived from L2LPERCTL,...

AZL-64647 CVE-2025-38174 affecting package kernel for versions less than 6.6.96.1-1

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Do not double dequeue a configuration request Some of our devices crash in tbcfgrequestdequeue: general protection fault, probably for non-canonical address 0xdead000000000122 CPU: 6 PID: 91007 Comm: kworker/6:2...

DEBIAN-CVE-2025-38136

In the Linux kernel, the following vulnerability has been resolved: usb: renesasusbhs: Reorder clock handling and power management in probe Reorder the initialization sequence in usbhsprobe to enable runtime PM before accessing registers, preventing potential crashes due to uninitialized clocks...

CVE-2025-38118

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF on mgmtremoveadvmonitorcomplete This reworks MGMTOPREMOVEADVMONITOR to not use mgmtpendingadd to avoid crashes like bellow: ================================================================== BUG: KASAN:...

Fedora 42 : webkitgtk (2025-5427adc3f4)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-5427adc3f4 advisory. Limit the data stored in session state. Remove the empty area below the title bar in Web Inspector when not docked. Fix various crashes and renderin...

kernel: blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx

A use-after-free vulnerability was found in the blkmqgetsqhctx function in the Linux kernel's block multiqueue blk-mq subsystem. This issue occurs when the function accesses the tagset pointer to determine the current default hardware context through mapping. If this access occurs after the tagse...

The vulnerability of the authentication protocol implementation of the MongoDB database management system’s OIDC server allows a perpetrator to induce a service failure.

The vulnerability of the OIDC authentication protocol implementation in MongoDB database management systems is related to deficiencies in the mechanism for verifying input data. Exploiting this vulnerability allows a malicious actor to cause service failures by sending a specially crafted JSON fi...

Fedora 42 : webkitgtk (2025-40aeebe6d2)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-40aeebe6d2 advisory. Enable CSS Overscroll Behavior by default. Change threaded rendering implementation to use Skia API instead of WebCore display list that is not thre...

GStreamer < 1.26.2 Multiple Vulnerabilities (macOS)

The version of GStreamer installed on the remote host is prior to 1.26.2. It is, therefore, is affected by multiple vulnerabilities, as follows: - A NULL-pointer dereference in the SubRip subtitle parser that can cause crashes for certain input files. CVE-2025-47807 - A NULL-pointer dereference i...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the process handling HTTP header fields. An attacker can cause excessive memory consumption and potentially crash or render the server unresponsive by sending a large number of HTTP headers. Details Denial of...

CVE-2025-45333

berkeley-abc abc 1.1 contains a Null Pointer Dereference NPD vulnerability in the AbcNtkCecFraigPart function of its data processing module, leading to unpredictable program behavior, causing segmentation faults, and program crashes...

UBUNTU-CVE-2025-45333

berkeley-abc abc 1.1 contains a Null Pointer Dereference NPD vulnerability in the AbcNtkCecFraigPart function of its data processing module, leading to unpredictable program behavior, causing segmentation faults, and program crashes...

CVE-2025-45332

vkoskiv c-ray 1.1 contains a Null Pointer Dereference NPD vulnerability in the parsemtllib function of its data processing module, leading to unpredictable program behavior, causing segmentation faults, and program crashes...

CVE-2024-51983

An unauthenticated attacker who can connect to the Web Services feature HTTP TCP port 80 can issue a WS-Scan SOAP request containing an unexpected JobToken value which will crash the target device. The device will reboot, after which the attacker can reissue the command to repeatedly crash the...

PT-2025-26869 · Cray · C-Ray

Name of the Vulnerable Software and Affected Versions: vkoskiv c-ray version 1.1 Description: The issue is related to a Null Pointer Dereference NPD in the parse mtllib function of the data processing module. This leads to unpredictable program behavior, causing segmentation faults and program...