CVE-2025-37836 PCI: Fix reference leak in pci_register_host_bridge()

In the Linux kernel, the following vulnerability has been resolved: PCI: Fix reference leak in pciregisterhostbridge If deviceregister fails, call putdevice to give up the reference to avoid a memory leak, per the comment at deviceregister. Found by code review. bhelgaas: squash Dan Carpenter's...

SUSE CVE-2022-49836

In the Linux kernel, the following vulnerability has been resolved: siox: fix possible memory leak in sioxdeviceadd If deviceregister returns error in sioxdeviceadd, the name allocated by devsetname need be freed. As comment of deviceregister says, it should use putdevice to give up the reference...

SUSE CVE-2022-49907

In the Linux kernel, the following vulnerability has been resolved: net: mdio: fix undefined behavior in bit shift for mdiobusregister Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds ...

SUSE CVE-2022-49926

In the Linux kernel, the following vulnerability has been resolved: net: dsa: Fix possible memory leaks in dsaloopinit kmemleak reported memory leaks in dsaloopinit: kmemleak: 12 new suspected memory leaks unreferenced object 0xffff8880138ce000 size 2048: comm "modprobe", pid 390, jiffies...

CVE-2025-37870: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: prevent hang on link training fail Why When link training fails, the phy clock will be disabled. However, in enablestreams, it is assumed that link training succeeded and the mux selects the phy clock, causing a...

SUSE CVE-2025-37817

In the Linux kernel, the following vulnerability has been resolved: mcb: fix a double free bug in chameleonparsegdd In chameleonparsegdd, if mcbdeviceregister fails, 'mdev' would be released in mcbdeviceregister via putdevice. Thus, goto 'err' label and free 'mdev' again causes a double free. Jus...

DEBIAN-CVE-2025-37817

In the Linux kernel, the following vulnerability has been resolved: mcb: fix a double free bug in chameleonparsegdd In chameleonparsegdd, if mcbdeviceregister fails, 'mdev' would be released in mcbdeviceregister via putdevice. Thus, goto 'err' label and free 'mdev' again causes a double free. Jus...

CVE-2025-37817 mcb: fix a double free bug in chameleon_parse_gdd()

In the Linux kernel, the following vulnerability has been resolved: mcb: fix a double free bug in chameleonparsegdd In chameleonparsegdd, if mcbdeviceregister fails, 'mdev' would be released in mcbdeviceregister via putdevice. Thus, goto 'err' label and free 'mdev' again causes a double free. Jus...

Improper Input Validation

Overview alextselegidis/easyappointments is a powerful Open Source Appointment Scheduler that can be installed on your server. Affected versions of this package are vulnerable to Improper Input Validation via register function, an attacker has the ability to schedule appointments with exceptional...

SUSE CVE-2022-49818

In the Linux kernel, the following vulnerability has been resolved: mISDN: fix misuse of putdevice in mISDNregisterdevice We should not release reference by putdevice before calling deviceinitialize...

SUSE CVE-2022-49860

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: fix memory leak when register device fail If deviceregister fails, it should call putdevice to give up reference, the name allocated in devsetname can be freed in callback function kobjectcleanup...

SUSE CVE-2022-49867

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: fix memory leak in ipcwwandellink IOSM driver registers network device without setting the needsfreenetdev flag, and does NOT call freenetdev when unregisters network device, which causes a memory leak. This patc...

SUSE CVE-2022-49794

In the Linux kernel, the following vulnerability has been resolved: iio: adc: at91adc: fix possible memory leak in at91adcallocatetrigger If iiotriggerregister returns error, it should call iiotriggerfree to give up the reference that hold in iiotriggeralloc, so that it can call iiotrigrelease to...

CBL Mariner 2.0 Security Update: kernel (CVE-2025-21934)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21934 advisory. - In the Linux kernel, the following vulnerability has been resolved: rapidio: fix an API misues when rioaddne...

Azure Linux 3.0 Security Update: kernel (CVE-2025-21912)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21912 advisory. - In the Linux kernel, the following vulnerability has been resolved: gpio: rcar: Use rawspinlock to protect...

CBL Mariner 2.0 Security Update: kernel (CVE-2025-21912)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21912 advisory. - In the Linux kernel, the following vulnerability has been resolved: gpio: rcar: Use rawspinlock to protect...

SUSE CVE-2022-49799

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix wild-memory-access in registersynthevent In registersynthevent, if setsyntheventprintfmt failed, then both traceremoveeventcall and unregistertraceevent will be called, which means the traceeventcall will call...

gpio: rcar: Use raw_spinlock to protect register access

...

CVE-2025-3918 Job Listings 0.1 - 0.1.1 - Unauthenticated Privilege Escalation via register_action Function

The Job Listings plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the registeraction function in versions 0.1 to 0.1.1. The plugin’s registration handler reads the client-supplied $POST'userrole' and passes it directly to wpinsertuser without...

CVE-2025-3918 Job Listings 0.1 - 0.1.1 - Unauthenticated Privilege Escalation via register_action Function

The Job Listings plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the registeraction function in versions 0.1 to 0.1.1. The plugin’s registration handler reads the client-supplied $POST'userrole' and passes it directly to wpinsertuser without...