MAL-2025-162652 Malicious code in nokire-kilua60 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ad65b23420de0a4f31f1ef043e05341aa84ceb3a52c4248120aea729b02ac1d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-170074 Malicious code in uinsu-technical-portalsia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38d771770e00a156377e3a8ca0600bf10502540763201fae51f085db2e808178 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-156318 Malicious code in inagi-vma-anbi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 928643de204bc58925491ba97f627db8e6ba6ac3804c2f130243dcbc38b7a8cc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-165981 Malicious code in siregar-poke60 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8cae9829d64ebc5e5eccfe7964b4664a942461d395ae16624540cc1ad6339a2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-167021 Malicious code in teagood-lokina55 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c23b263e656c5643c50aeb1ba6243cdce8606ecf4a1dcfc1b85325345bcdc04f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-153261 Malicious code in avminasah-agaga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a176609799de4183d419674a06221b012f3fd982aba2092c296a100731a0e3d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-168801 Malicious code in tealoveness70 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a53dbb021fac99d60749a62bbf74d08b2a1fdc6a75aa37f52bb2158335e33d4f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

kernel: iomap: iomap: fix memory corruption when recording errors during writeback

In the Linux kernel, the following vulnerability has been resolved: iomap: iomap: fix memory corruption when recording errors during writeback Every now and then I see this crash on arm64: Unable to handle kernel NULL pointer dereference at virtual address 00000000000000f8 Buffer I/O error on dev...

kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy

In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfsmdtdestroy In allocinode, inodeinitalways could return -ENOMEM if securityinodealloc fails, which causes inode-iprivate uninitialized. Then nilfsismetadatafileinode returns true and nilfsfreeinode...

EUVD-2025-124952

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix peer lookup in ath12kdpmonrxdelivermsdu In ath12kdpmonrxdelivermsdu, peer lookup fails because rxcb-peerid is not updated with a valid value. This is expected in monitor mode, where RX frames bypass the regular ...

kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy

In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfsmdtdestroy In allocinode, inodeinitalways could return -ENOMEM if securityinodealloc fails, which causes inode-iprivate uninitialized. Then nilfsismetadatafileinode returns true and nilfsfreeinode...

UBUNTU-CVE-2025-40131

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix peer lookup in ath12kdpmonrxdelivermsdu In ath12kdpmonrxdelivermsdu, peer lookup fails because rxcb-peerid is not updated with a valid value. This is expected in monitor mode, where RX frames bypass the regular ...

CVE-2025-40131 wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix peer lookup in ath12kdpmonrxdelivermsdu In ath12kdpmonrxdelivermsdu, peer lookup fails because rxcb-peerid is not updated with a valid value. This is expected in monitor mode, where RX frames bypass the regular ...

CVE-2025-40119 ext4: fix potential null deref in ext4_mb_init()

In the Linux kernel, the following vulnerability has been resolved: ext4: fix potential null deref in ext4mbinit In ext4mbinit, ext4mbavgfragmentsizedestroy may be called when sbi-smbavgfragmentsize remains uninitialized e.g., if groupinfo slab cache allocation fails. Since...

kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy

In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfsmdtdestroy In allocinode, inodeinitalways could return -ENOMEM if securityinodealloc fails, which causes inode-iprivate uninitialized. Then nilfsismetadatafileinode returns true and nilfsfreeinode...

kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy

In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfsmdtdestroy In allocinode, inodeinitalways could return -ENOMEM if securityinodealloc fails, which causes inode-iprivate uninitialized. Then nilfsismetadatafileinode returns true and nilfsfreeinode...

MAL-2025-148250 Malicious code in standard-bootstrap-restart-orbit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d44fef6ebb0b24d6d2f1ebf6c0af401ad84e3fad782b5e15cb6dd526dc9cfed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in juno-hyperion-fornax-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e03baf6447776f6d27d28c510f76e3b0afd0f980a31042f178907116c3963b5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in upgrade-release-it-delphinus-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9723dac1015b770186c13a25fd43bc6378a218746a96c2afb664e0faf6941f72 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in neptune-fornax-miranda-mongodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25e546f80e3630052ab9e9536f8ee2827f28cb7a9bfcdf8362f0330a310ed9b4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...