Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990860)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990860 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: pass u64 to ocfs2truncateinline maybe overflow Syzbot reported a kernel BUG in...

Linux Distros Unpatched Vulnerability : CVE-2025-40121

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: Intel: bytcrrt5651: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcrrt5640 driver just ignores and leaves...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from a peer lookup failure in monitor mode that could result in an invalid link ID...

Linux Distros Unpatched Vulnerability : CVE-2025-40159

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xsk: Harden userspace-supplied xdpdesc validation Turned out certain clearly invalid values passed in xdpdesc from userspace can pass xp,unalignedvalidatedesc a...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990771)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990771 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: fix BUGON when directory entry has invalid reclen The reclen field in the directory entry h...

Malicious code in fitri-lontong55-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efdccb204598adff6449d5d3ee3e642eb44b71fe995f54c250d69ad4a355aa3a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-114249 Malicious code in gita-empal5-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4ea213bedf40152f7c5e20fa30ed8c3a073308b85764fac1ac1919aead8d783 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

kernel: posix-clock: Fix missing timespec64 check in pc_clock_settime()

In the Linux kernel, the following vulnerability has been resolved: posix-clock: Fix missing timespec64 check in pcclocksettime As Andrew pointed out, it will make sense that the PTP core checked timespec64 struct's tvsec and tvnsec range before calling ptp-info-settime64. As the man manual of...

kernel: inotify: Avoid reporting event with invalid wd

A race condition was found in the Linux kernel's inotify subsystem. When inotifyfreeingmark races with inotifyhandleinodeevent, the event handler may read imark-wd after it has been reset to -1. This causes an invalid watch descriptor value of -1 to be reported to userspace applications,...

kernel: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback

In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-pcm: don't use socpcmret on .prepare callback commit 1f5664351410 "ASoC: lower "no backend DAIs enabled for ... Port" log severity" ignores -EINVAL error message on common socpcmret. It is used from many functions,...

kernel: exfat: fix out-of-bounds access of directory entries

In the Linux kernel, the following vulnerability has been resolved: exfat: fix out-of-bounds access of directory entries In the case of the directory size is greater than or equal to the cluster size, if startclu becomes an EOF clusteran invalid cluster due to file system corruption, then the...

kernel: igb: Fix potential invalid memory access in igb_init_module()

In the Linux kernel, the following vulnerability has been resolved: igb: Fix potential invalid memory access in igbinitmodule The pciregisterdriver can fail and when this happened, the dcanotifier needs to be unregistered, otherwise the dcanotifier can be called when igb fails to install, resulti...

kernel: i40e: fix MMIO write access to an invalid page in i40e_clear_hw

In the Linux kernel, the following vulnerability has been resolved: i40e: fix MMIO write access to an invalid page in i40eclearhw When the device sends a specific input, an integer underflow can occur, leading to MMIO write access to an invalid page. Prevent the integer underflow by changing the...

kernel: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback

In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-pcm: don't use socpcmret on .prepare callback commit 1f5664351410 "ASoC: lower "no backend DAIs enabled for ... Port" log severity" ignores -EINVAL error message on common socpcmret. It is used from many functions,...

MAL-2025-111688 Malicious code in balanced_capybara_moccasin-12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bb532397b8991ba2299dd7aa45f7c02d5c541a0de36c8e726f5760e675fdecc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-107761 Malicious code in ready_tick-silentdev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8a78cddaf9a193d4581d8ae4f94ab148563c482e6d9f247a7c0143cd41b3647 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12657

The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later reads of this object can result in read access violations...

Malicious code in agreeable-magenta-marten (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3cbbe43cb2baeea5965e26d2a22c285a62491851a10698c44b7f40ea4092be65 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

BIT-GOLANG-2025-61723 Quadratic complexity when parsing some invalid inputs in encoding/pem

The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990588)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990588 advisory. In the Linux kernel, the following vulnerability has been resolved: dlm: fix plock invalid read This patch fixes an invalid read showed by KASAN. A unlock will...