CVE-2025-40175 idpf: cleanup remaining SKBs in PTP flows

In the Linux kernel, the following vulnerability has been resolved: idpf: cleanup remaining SKBs in PTP flows When the driver requests Tx timestamp value, one of the first steps is to clone SKB using skbget. It increases the reference counter for that SKB to prevent unexpected freeing by another...

CVE-2025-40175 idpf: cleanup remaining SKBs in PTP flows

In the Linux kernel, the following vulnerability has been resolved: idpf: cleanup remaining SKBs in PTP flows When the driver requests Tx timestamp value, one of the first steps is to clone SKB using skbget. It increases the reference counter for that SKB to prevent unexpected freeing by another...

CVE-2025-40166 drm/xe/guc: Check GuC running state before deregistering exec queue

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Check GuC running state before deregistering exec queue In normal operation, a registered exec queue is disabled and deregistered through the GuC, and freed only after the GuC confirms completion. However, if the driv...

CVE-2025-40166 drm/xe/guc: Check GuC running state before deregistering exec queue

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Check GuC running state before deregistering exec queue In normal operation, a registered exec queue is disabled and deregistered through the GuC, and freed only after the GuC confirms completion. However, if the driv...

CVE-2025-40165

In CVE-2025-40165, the Linux kernel media/nxp/imx8-isi m2m path had a cleanup/streaming cleanup bug causing ISI channels to stay allocated if streamon/streamoff are imbalanced (and WARN_ON if input width > 2K). The Astra Linux bulletin confirms the fix: move streaming preparation and cleanup t...

CVE-2025-40165 media: nxp: imx8-isi: m2m: Fix streaming cleanup on release

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: m2m: Fix streaming cleanup on release If streamon/streamoff calls are imbalanced, such as when exiting an application with Ctrl+C when streaming, the m2m usagecount will never reach zero and the ISI channel...

kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path

A use-after-free vulnerability exists in the linux kernel such that the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock...

kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path

A use-after-free vulnerability exists in the linux kernel such that the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock...

EUVD-2025-122706

Malicious code in release-it-apollo-cypress-oberon npm...

EUVD-2025-120787

Malicious code in version-mongoose-cors-semantic-release npm...

EUVD-2025-122690

Malicious code in release-it-quantum-delphinus-readable npm...

EUVD-2025-111456

Malicious code in magellan-reveal-md-release-it-mocha npm...

EUVD-2025-124779

Malicious code in mongodb-semantic-release-elektra-delphinus npm...

EUVD-2025-112535

Malicious code in indus-standard-semantic-release-prompts npm...

EUVD-2025-122084

Malicious code in semantic-release-update-kronos-rest npm...

EUVD-2025-122688

Malicious code in release-it-release-it-semantic-ui-vortex npm...

EUVD-2025-111120

Malicious code in mini-css-extract-plugin-semantic-release-rimraf-hermes npm...

EUVD-2025-113469

Malicious code in fornax-phoebe-release-it-ganymede npm...

Malicious code in taurus-semantic-release-auth0-castor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db365d771623ac2eeca3feb11fa72a57fee360a9c36f83b1448c1f5b9ce4dca5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147836 Malicious code in semantic-release-sails-webdriver-mocha-npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ced23e9d6990208bad63cf4763ab6e387ae390922047846eb57c6b9cfe68bc7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...