CVE-2025-68304 Bluetooth: hci_core: lookup hci_conn on RX path on protocol side

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: lookup hciconn on RX path on protocol side The hdev lock/lookup/unlock/use pattern in the packet RX path doesn't ensure hciconn is not concurrently modified/deleted. This locking appears to be leftover from...

CVE-2025-68299

The CVE-2025-68299 entry relates to Linux kernel afs: the delayed allocation of a cell’s anonymous key. A background thread allocated the anonymous key during cell setup, and a bug could trigger oops when afs_parse_source() passes a cell name to afs_lookup_cell() and a key reference is not yet se...

CVE-2025-68300 fs/namespace: fix reference leak in grab_requested_mnt_ns

In the Linux kernel, the following vulnerability has been resolved: fs/namespace: fix reference leak in grabrequestedmntns lookupmntns already takes a reference on mntns. grabrequestedmntns doesn't need to take an extra reference...

CVE-2025-68252 misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix dmabuf object leak in fastrpcmaplookup In fastrpcmaplookup, dmabufget is called to obtain a reference to the dmabuf for comparison purposes. However, this reference is never released when the function returns,...

CVE-2025-68252 misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix dmabuf object leak in fastrpcmaplookup In fastrpcmaplookup, dmabufget is called to obtain a reference to the dmabuf for comparison purposes. However, this reference is never released when the function returns,...

CVE-2025-68173

The CVE-2025-68173 entry concerns the Linux kernel, where ftrace_module_enable could cause a soft lockup when loading the amdgpu module. The root cause is multiple kallsyms_lookup calls spending excessive time in the RCU critical section with preemption disabled, potentially leading to a kernel p...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel, which stems from a dmabuf object leak in the fastrpcmaplookup function in fastrpc...

PT-2025-51704

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference leak exists in the grab requested mnt ns function within the fs/namespace component of the Linux kernel. The lookup mnt ns function already acquires a reference to mnt ns,...

PT-2025-51708

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Bluetooth implementation within the Linux kernel, specifically in the hci core component. The issue relates to improper locking mechanisms when handling Bluetooth...

PT-2025-51665

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists in the fastrpc map lookup function. The function acquires a reference to a dma buf object using dma buf get for comparison, but this reference is not released,...

Windows Exploitation Techniques: Winning Race Conditions with Path Lookups

Posted by James Forshaw This post was originally written in 2016 for the Project Zero blog. However, in the end it was published separately in the journal PoC||GTFOissue 13 as well as in the second volume of the printed version. In honor of our new blog we’re republishing it on this blog and...

TorchGeo Remote Code Execution Vulnerability

Impact TorchGeo 0.4–0.6.0 used an ""eval"" https://docs.python.org/3/library/functions.htmleval statement in its model weight API that could allow an unauthenticated, remote attacker to execute arbitrary commands. All platforms that expose ""torchgeo.models.getweight""...

SUSE CVE-2025-65111

SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following characteristics: permission defined in terms of a union + and that union references the same relation on both sides but one si...

EulerOS 2.0 SP11 : golang (EulerOS-SA-2025-2481)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.CVE-2025-4673 If...

Unity Linux 20.1050e Security Update: kernel (UTSA-2025-991194)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991194 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: do not allow SETID to refer to another table When doing lookups for sets on...

EUVD-2025-202631

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. This issue is fixed in...

EUVD-2025-202450

Jenkins HashiCorp Vault Plugin exposes system-scoped Vault credentials...

GHSA-3FM2-HX3H-XM4V Jenkins HashiCorp Vault Plugin exposes system-scoped Vault credentials

Jenkins HashiCorp Vault Plugin 371.v884a4dd60fb6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to...

CVE-2025-67642

Jenkins HashiCorp Vault Plugin 371.v884a4dd60fb6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to...

CVE-2025-67642

Jenkins HashiCorp Vault Plugin 371.v884a4dd60fb6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to...