MAL-2025-33084 Malicious code in shell-uglify-refactor-compile-cold (npm)

The package shell-uglify-refactor-compile-cold was found to contain malicious code...

Malicious code in reject-sun-wind-refactor-compress (npm)

The package reject-sun-wind-refactor-compress was found to contain malicious code...

MAL-2025-26217 Malicious code in meta-error-secure-encode-refactor (npm)

The package meta-error-secure-encode-refactor was found to contain malicious code...

MAL-2025-37244 Malicious code in try-refactor-yaml-decompress-phi (npm)

The package try-refactor-yaml-decompress-phi was found to contain malicious code...

Malicious code in uglify-debug-key-query-refactor (npm)

The package uglify-debug-key-query-refactor was found to contain malicious code...

Malicious code in nu-refactor-load-boolean-log (npm)

The package nu-refactor-load-boolean-log was found to contain malicious code...

MAL-2025-27877 Malicious code in nu-refactor-load-boolean-log (npm)

The package nu-refactor-load-boolean-log was found to contain malicious code...

LLM Coding Integrity Breach

Here's an interesting story about a failure being introduced by LLM-written code. Specifically, the LLM was doing some code refactoring, and when it moved a chunk of code from one file to another it changed a "break" to a "continue." That turned an error logging statement into an infinite loop,...

octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback

...

CVE-2025-38306

In the Linux kernel, the following vulnerability has been resolved: fs/fhandle.c: fix a race in call of haslockedchildren maydecodefh is calling haslockedchildren while holding no locks. That's an oopsable race... The rest of the callers are safe since they are holding namespacesem and are...

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues: Update to version 20250416.02 bsc1244304, bsc1244503 defaultSleeper: tolerate 10% difference to reduce test flakiness Add output of some packagemanagers to the testdata from version 20250416.01 Refactor OS Info package from version...

CVE-2025-38014

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Refactor remove call with idxdcleanup helper The idxdcleanup helper cleans up perfmon, interrupts, internals and so on. Refactor remove call with the idxdcleanup helper to avoid code duplication. Note, this also...

DEBIAN-CVE-2025-38014

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Refactor remove call with idxdcleanup helper The idxdcleanup helper cleans up perfmon, interrupts, internals and so on. Refactor remove call with the idxdcleanup helper to avoid code duplication. Note, this also...

CVE-2025-38014

CVE-2025-38014 : In the Linux kernel’s dmaengine idxd subsystem, a removal path was refactored to use an idxd_cleanup() helper, which fixes code duplication and also corrects a missing put_device() for idxd groups, engines, and work queues. The vulnerability is described as a local-access issue w...

CVE-2025-38014 dmaengine: idxd: Refactor remove call with idxd_cleanup() helper

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Refactor remove call with idxdcleanup helper The idxdcleanup helper cleans up perfmon, interrupts, internals and so on. Refactor remove call with the idxdcleanup helper to avoid code duplication. Note, this also...

MAL-2025-3652 Malicious code in vim-refactor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b68d05cbbe21dcfb11bb65a968508b32daf65b9e59fd898e3ee64f54c67de6c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vim-refactor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b68d05cbbe21dcfb11bb65a968508b32daf65b9e59fd898e3ee64f54c67de6c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-23156

In the Linux kernel, the following vulnerability has been resolved: media: venus: hfiparser: refactor hfi packet parsing logic wordscount denotes the number of words in total payload, while data points to payload of various property within it. When wordscount reaches last word, data can access...

CVE-2025-22003 can: ucan: fix out of bound read in strscpy() source

In the Linux kernel, the following vulnerability has been resolved: can: ucan: fix out of bound read in strscpy source Commit 7fdaf8966aae "can: ucan: use strscpy to instead of strncpy" unintentionally introduced a one byte out of bound read on strscpy's source argument which is kind of ironic...

CVE-2025-22003

CVE-2025-22003 (Linux kernel, can: ucan): A one-byte out-of-bounds read was introduced in the can: ucan path due to a mismatch when using strscpy() with a length of len+1. The issue arises because strscpy() reads len+1 bytes from the source to detect truncation, even when the source is not NULL-t...