CVE-2023-53522 cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex

In the Linux kernel, the following vulnerability has been resolved: cgroup,freezer: hold cpuhotpluglock before freezermutex syzbot is reporting circular locking dependency between cpuhotpluglock and freezermutex, for commit f5d39b020809 "freezer,sched: Rewrite core freezer logic" replaced atomici...

CVE-2023-53504

Technical details for CVE-2023-53504 are not publicly available in the provided documents; monitor for updates.

CVE-2023-53504 RDMA/bnxt_re: Properly order ib_device_unalloc() to avoid UAF

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Properly order ibdeviceunalloc to avoid UAF ibdeallocdevice should be called only after device cleanup. Fix the dealloc sequence...

CVE-2023-53504 RDMA/bnxt_re: Properly order ib_device_unalloc() to avoid UAF

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Properly order ibdeviceunalloc to avoid UAF ibdeallocdevice should be called only after device cleanup. Fix the dealloc sequence...

CVE-2025-39899

In the Linux kernel, the following vulnerability has been resolved: mm/userfaultfd: fix kmaplocal LIFO ordering for CONFIGHIGHPTE With CONFIGHIGHPTE on 32-bit ARM, movepagespte maps PTE pages using kmaplocalpage, which requires unmapping in Last-In-First-Out order. The current code maps dstpte...

CVE-2025-39915 net: phy: transfer phy_config_inband() locking responsibility to phylink

In the Linux kernel, the following vulnerability has been resolved: net: phy: transfer phyconfiginband locking responsibility to phylink Problem description =================== Lockdep reports a possible circular locking dependency AB/BA between &pl-statemutex and &phy-lock, as follows...

CVE-2025-39915

Summary: CVE-2025-39915 concerns the Linux kernel: a locking order issue where phy_config_inband() would acquire &pl->phydev->lock while phylink_major_config() had already acquired &pl->state_mutex, creating a potential deadlock when combined with phy_link_up/phy_link_down in the phylink...

CVE-2025-39915 net: phy: transfer phy_config_inband() locking responsibility to phylink

In the Linux kernel, the following vulnerability has been resolved: net: phy: transfer phyconfiginband locking responsibility to phylink Problem description =================== Lockdep reports a possible circular locking dependency AB/BA between &pl-statemutex and &phy-lock, as follows...

CVE-2025-39899 mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE

In the Linux kernel, the following vulnerability has been resolved: mm/userfaultfd: fix kmaplocal LIFO ordering for CONFIGHIGHPTE With CONFIGHIGHPTE on 32-bit ARM, movepagespte maps PTE pages using kmaplocalpage, which requires unmapping in Last-In-First-Out order. The current code maps dstpte...

CVE-2025-39899

In the Linux kernel, the following vulnerability has been resolved: mm/userfaultfd: fix kmaplocal LIFO ordering for CONFIGHIGHPTE With CONFIGHIGHPTE on 32-bit ARM, movepagespte maps PTE pages using kmaplocalpage, which requires unmapping in Last-In-First-Out order. The current code maps dstpte...

CVE-2025-39899 mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE

In the Linux kernel, the following vulnerability has been resolved: mm/userfaultfd: fix kmaplocal LIFO ordering for CONFIGHIGHPTE With CONFIGHIGHPTE on 32-bit ARM, movepagespte maps PTE pages using kmaplocalpage, which requires unmapping in Last-In-First-Out order. The current code maps dstpte...

CVE-2025-39898 e1000e: fix heap overflow in e1000_set_eeprom

In the Linux kernel, the following vulnerability has been resolved: e1000e: fix heap overflow in e1000seteeprom Fix a possible heap overflow in e1000seteeprom function by adding input validation for the requested length of the change in the EEPROM. In addition, change the variable type from int t...

CVE-2025-52040

In Frappe ERPNext 15.57.5, the function getblanketorders at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker can extract all information from databases by injecting a SQL query into the blanketordertype parameter...

CVE-2025-59686

Kazaar 1.25.12 allows /api/v1/org-id/orders/order-id/documents calls with a modified order-id...

PT-2025-40229

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a circular locking dependency between cpu hotplug lock and freezer mutex within the cgroup freezer subsystem. Specifically, the issue arises from the order in...

CVE-2025-59686

Kazaar 1.25.12 allows /api/v1/org-id/orders/order-id/documents calls with a modified order-id...

Frappe Technologies Frappe 安全漏洞

Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. A security vulnerability exists in Frappe Technologies Frappe version 15.57.5, which stems from unvalidated inputs in the blanketordertype parameter,...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an improper locking order that could lead to a deadlock...

CVE-2025-52040

In Frappe ERPNext 15.57.5, the function get_blanket_orders() in erpnext/controllers/queries.py is vulnerable to SQL Injection via the blanket_order_type parameter due to unvalidated inputs, enabling an attacker to extract information from databases. The public documents do not provide exploitatio...

Kazaar 安全漏洞

Kazaar is a print marketing fulfillment platform from Kazaar, Inc. A security vulnerability exists in Kazaar version 1.25.12 that stems from allowing modification of the order-id parameter, which could lead to an insecure direct object reference attack...