CVE-2025-66564 Sigstore Timestamp Authority allocates excessive memory during request parsing

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits via a call to strings.Split an optionally-provided OID which is untrusted data on periods. Similarly, function api.getContentType splits the Content-Type heade...

CVE-2025-66479

Anthropic Sandbox Runtime (sandbox-runtime) had a flaw where the network sandbox was not properly enforced if no allowed domains were configured, potentially allowing outbound network access from sandboxed processes prior to v0.0.16. A patch is available in v0.0.16; upgrade to 0.0.16 or later for...

CVE-2025-66479 Anthropic Sandbox Runtime Incorrectly Implemented Network Sandboxing

Anthropic Sandbox Runtime is a lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container. Prior to 0.0.16, due to a bug in sandboxing logic, sandbox-runtime did not properly enforce a network sandbox if the...

CVE-2025-40249

In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: make sure the cdev fd is still active before emitting events With the final call to fput on a file descriptor, the release action may be deferred and scheduled on a work queue. The reference count of that descriptor i...

CVE-2025-40242

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix unlikely race in gdlmputlock In gdlmputlock, there is a small window of time in which the DFLUNMOUNT flag has been set but the lockspace hasn't been released, yet. In that window, dlm may still call gdlmast and gdlmbast...

CVE-2025-40231

In the Linux kernel, the following vulnerability has been resolved: vsock: fix lock inversion in vsockassigntransport Syzbot reported a potential lock inversion deadlock between vsockregistermutex and sklock-AFVSOCK when vsocklinger is called. The issue was introduced by commit 687aa0c5581b "vsoc...

CVE-2025-40223

In the Linux kernel, the following vulnerability has been resolved: most: usb: Fix use-after-free in hdmdisconnect hdmdisconnect calls mostderegisterinterface, which eventually unregisters the MOST interface device with deviceunregisteriface-dev. If that drops the last reference, the device core...

UBUNTU-CVE-2025-40242

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix unlikely race in gdlmputlock In gdlmputlock, there is a small window of time in which the DFLUNMOUNT flag has been set but the lockspace hasn't been released, yet. In that window, dlm may still call gdlmast and gdlmbast...

UBUNTU-CVE-2025-40231

In the Linux kernel, the following vulnerability has been resolved: vsock: fix lock inversion in vsockassigntransport Syzbot reported a potential lock inversion deadlock between vsockregistermutex and sklock-AFVSOCK when vsocklinger is called. The issue was introduced by commit 687aa0c5581b "vsoc...

UBUNTU-CVE-2025-40223

In the Linux kernel, the following vulnerability has been resolved: most: usb: Fix use-after-free in hdmdisconnect hdmdisconnect calls mostderegisterinterface, which eventually unregisters the MOST interface device with deviceunregisteriface-dev. If that drops the last reference, the device core...

CVE-2025-40249

CVE-2025-40249 affects the Linux kernel GPIO cdev path. The issue arises when a GPIO change notification is emitted after the file descriptor’s reference count drops to zero but before the .release() callback is executed from the workqueue, leaving the descriptor potentially in use-after-free. Th...

CVE-2025-40242 gfs2: Fix unlikely race in gdlm_put_lock

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix unlikely race in gdlmputlock In gdlmputlock, there is a small window of time in which the DFLUNMOUNT flag has been set but the lockspace hasn't been released, yet. In that window, dlm may still call gdlmast and gdlmbast...

CVE-2025-40242 gfs2: Fix unlikely race in gdlm_put_lock

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix unlikely race in gdlmputlock In gdlmputlock, there is a small window of time in which the DFLUNMOUNT flag has been set but the lockspace hasn't been released, yet. In that window, dlm may still call gdlmast and gdlmbast...

CVE-2025-40242

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix unlikely race in gdlmputlock In gdlmputlock, there is a small window of time in which the DFLUNMOUNT flag has been set but the lockspace hasn't been released, yet. In that window, dlm may still call gdlmast and gdlmbast...

CVE-2025-40242

The CVE-2025-40242 entry concerns the Linux kernel GFS2 path: gdlm_put_lock() has a small window after DFL_UNMOUNT is set but before the lockspace is released, during which the distributed lock manager (dlm) may still call gdlm_ast()/gdlm_bast(). The consequence could be dereferencing freed glock...

EUVD-2025-201217

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix unlikely race in gdlmputlock In gdlmputlock, there is a small window of time in which the DFLUNMOUNT flag has been set but the lockspace hasn't been released, yet. In that window, dlm may still call gdlmast and gdlmbast...

CVE-2025-40231

CVE-2025-40231 (Linux kernel) relates to a vsock lock inversion in vsock_assign_transport() where vsock_register_mutex is held during a call that may call vsock_linger(). The commit adding vsock_register_mutex around transport->release() around sk_lock can create circular dependency when vsock...

CVE-2025-40231 vsock: fix lock inversion in vsock_assign_transport()

In the Linux kernel, the following vulnerability has been resolved: vsock: fix lock inversion in vsockassigntransport Syzbot reported a potential lock inversion deadlock between vsockregistermutex and sklock-AFVSOCK when vsocklinger is called. The issue was introduced by commit 687aa0c5581b "vsoc...

EUVD-2025-201228

In the Linux kernel, the following vulnerability has been resolved: vsock: fix lock inversion in vsockassigntransport Syzbot reported a potential lock inversion deadlock between vsockregistermutex and sklock-AFVSOCK when vsocklinger is called. The issue was introduced by commit 687aa0c5581b "vsoc...

CVE-2025-40223 most: usb: Fix use-after-free in hdm_disconnect

In the Linux kernel, the following vulnerability has been resolved: most: usb: Fix use-after-free in hdmdisconnect hdmdisconnect calls mostderegisterinterface, which eventually unregisters the MOST interface device with deviceunregisteriface-dev. If that drops the last reference, the device core...