kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy

In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfsmdtdestroy In allocinode, inodeinitalways could return -ENOMEM if securityinodealloc fails, which causes inode-iprivate uninitialized. Then nilfsismetadatafileinode returns true and nilfsfreeinode...

EUVD-2025-124952

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix peer lookup in ath12kdpmonrxdelivermsdu In ath12kdpmonrxdelivermsdu, peer lookup fails because rxcb-peerid is not updated with a valid value. This is expected in monitor mode, where RX frames bypass the regular ...

kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy

In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfsmdtdestroy In allocinode, inodeinitalways could return -ENOMEM if securityinodealloc fails, which causes inode-iprivate uninitialized. Then nilfsismetadatafileinode returns true and nilfsfreeinode...

UBUNTU-CVE-2025-40131

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix peer lookup in ath12kdpmonrxdelivermsdu In ath12kdpmonrxdelivermsdu, peer lookup fails because rxcb-peerid is not updated with a valid value. This is expected in monitor mode, where RX frames bypass the regular ...

CVE-2025-40131 wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix peer lookup in ath12kdpmonrxdelivermsdu In ath12kdpmonrxdelivermsdu, peer lookup fails because rxcb-peerid is not updated with a valid value. This is expected in monitor mode, where RX frames bypass the regular ...

CVE-2025-40119 ext4: fix potential null deref in ext4_mb_init()

In the Linux kernel, the following vulnerability has been resolved: ext4: fix potential null deref in ext4mbinit In ext4mbinit, ext4mbavgfragmentsizedestroy may be called when sbi-smbavgfragmentsize remains uninitialized e.g., if groupinfo slab cache allocation fails. Since...

kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy

In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfsmdtdestroy In allocinode, inodeinitalways could return -ENOMEM if securityinodealloc fails, which causes inode-iprivate uninitialized. Then nilfsismetadatafileinode returns true and nilfsfreeinode...

kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy

In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfsmdtdestroy In allocinode, inodeinitalways could return -ENOMEM if securityinodealloc fails, which causes inode-iprivate uninitialized. Then nilfsismetadatafileinode returns true and nilfsfreeinode...

Malicious code in upgrade-release-it-delphinus-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9723dac1015b770186c13a25fd43bc6378a218746a96c2afb664e0faf6941f72 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in inquirer-tailwindcss-sqlite-sirius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e7d2c4df32fc567b689d9a1bbf8975994a17c7e260c5fa4dcff587b6680ef6e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in neptune-fornax-miranda-mongodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25e546f80e3630052ab9e9536f8ee2827f28cb7a9bfcdf8362f0330a310ed9b4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoebe-webdriver-mocha-dotenv-safe-nebula (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4741cab512695c1c5578f08e6536747101c2e0fff2151fbfe86c9ec962f7f78 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in loop-virgo-impulse-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6f7baa439a7ef55154ee9b9254ab2728fa7346ccf937a84ab806d616b5b3e7f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sass-loader-mongodb-elara-norma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7dacee0b3a1644a413676b09faabee48fa2c7fe4cf97c5d529b7d48e2e12965 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pegasus-rigel-bulma-ceres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e10efe745ce9a8c5335e8fc1b7f9fdee45f7376be426c0b9e9774e91939f7c55 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in publish-process-proxima-geckodriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54b237f192f447599cb3bcd59b42f719076d5e72dbc8333c2cbf1ff799b595a2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in proxima-backend-solis-arcturus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47debd0e472e359f6d7a9c6d07a2396dd62b9eed5f75d70e652ee1aa399ed61a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in config-meteor-start-pino (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5f41c156800172217496004b04bf2c1dfd2ae71f2073b0ed785b6ed6984b299 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in winston-reveal-md-betelgeuse-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5353a675fc71a6f7979ed34bb601e42339f6f0c11956bee5628b60cfcb84881f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in koa-kaus-sirius-draco (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5da38434c856097646612b2314c16d72307a75149247333f78b7090326adf12 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...