CVE-2025-25610

TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the staticgw parameter in the formIpv6Setup interface of /bin/boa...

CVE-2025-25609

The TOTOlink A3002R wireless router, specifically version V1.1.1-B20200824.0128 , is vulnerable to a buffer overflow vulnerability. The root cause is improper input validation of the static_ipv6 parameter within the formIpv6Setup interface of the /bin/boa API endpoint, where the system fails to c...

CVE-2025-27157

Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on "/auth/setup". Without those rate limits, an attacker can craft requests that will send an email to an arbitrary addresses. Versions 4.2.16...

SUSE CVE-2022-49395

In the Linux kernel, the following vulnerability has been resolved: um: Fix out-of-bounds read in LDT setup syscallstubdata expects the datacount parameter to be the number of longs, not bytes. ================================================================== BUG: KASAN: stack-out-of-bounds in...

SUSE CVE-2022-49412

In the Linux kernel, the following vulnerability has been resolved: bfq: Avoid merging queues with different parents It can happen that the parent of a bfqq changes between the moment we decide two queues are worth to merge and set bic-stablemergebfqq and the moment bfqsetupmerge is called. This...

SUSE CVE-2022-49492

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix a NULL pointer dereference in nvmeallocadmintags In nvmeallocadmintags, the adminq can be set to an error typically -ENOMEM if the blkmqinitqueue call fails to set up the queue, which is checked immediately after th...

SUSE CVE-2022-49549

In the Linux kernel, the following vulnerability has been resolved: x86/MCE/AMD: Fix memory leak when thresholdcreatebank fails In mcethresholdcreatedevice, if thresholdcreatebank fails, the previously allocated threshold banks array @bp will be leaked because the call to mcethresholdremovedevice...

SUSE CVE-2022-49725

In the Linux kernel, the following vulnerability has been resolved: i40e: Fix call trace in setuptxdescriptors After PF reset and ethtool -t there was call trace in dmesg sometimes leading to panic. When there was some time, around 5 seconds, between reset and test there were no errors. Problem w...

AZL-57982 CVE-2025-21723 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix possible crash when setting up bsg fails If bsgsetupqueue fails, the bsgqueue is assigned a non-NULL value. Consequently, in mpi3mrbsgexit, the condition "if!mrioc-bsgqueue" will not be satisfied, preventing...

DEBIAN-CVE-2025-21723

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix possible crash when setting up bsg fails If bsgsetupqueue fails, the bsgqueue is assigned a non-NULL value. Consequently, in mpi3mrbsgexit, the condition "if!mrioc-bsgqueue" will not be satisfied, preventing...

DEBIAN-CVE-2024-57987

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: check for NULL in btrtlsetuprealtek If insert an USB dongle which chip is not maintained in icidtable, it will hit the NULL point accessed. Add a null point check to avoid the Kernel Oops...

UBUNTU-CVE-2024-57987

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: check for NULL in btrtlsetuprealtek If insert an USB dongle which chip is not maintained in icidtable, it will hit the NULL point accessed. Add a null point check to avoid the Kernel Oops...

CVE-2025-21723

Summary (CVE-2025-21723) In the Linux kernel, mpi3mr/scsi code was fixed to prevent a crash when BSG setup fails. If bsg_setup_queue() fails, bsg_queue may be non-NULL, causing mpi3mr_bsg_exit() to skip bsg_remove_queue() and trigger a NULL pointer dereference (kernel crash) as shown in the entry...

CVE-2025-21723 scsi: mpi3mr: Fix possible crash when setting up bsg fails

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix possible crash when setting up bsg fails If bsgsetupqueue fails, the bsgqueue is assigned a non-NULL value. Consequently, in mpi3mrbsgexit, the condition "if!mrioc-bsgqueue" will not be satisfied, preventing...

CVE-2025-21723

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix possible crash when setting up bsg fails If bsgsetupqueue fails, the bsgqueue is assigned a non-NULL value. Consequently, in mpi3mrbsgexit, the condition "if!mrioc-bsgqueue" will not be satisfied, preventing...

CVE-2024-57987 Bluetooth: btrtl: check for NULL in btrtl_setup_realtek()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: check for NULL in btrtlsetuprealtek If insert an USB dongle which chip is not maintained in icidtable, it will hit the NULL point accessed. Add a null point check to avoid the Kernel Oops...

Mastodon security vulnerabilities

Mastodon is an open source social networking server based on ActivityPub by Mastodon Open Source. A security vulnerability exists in Mastodon that stems from a lack of rate limiting in /auth/setup, which could result in sending emails to arbitrary addresses...

PT-2025-8976

Name of the Vulnerable Software and Affected Versions Mastodon versions 4.2.0 through 4.2.15 Mastodon versions 4.3.0 through 4.3.3 Description The issue concerns missing rate limits on the "/auth/setup" API endpoint, allowing an attacker to send emails to arbitrary addresses by crafting specific...

Linux Kernel ksmbd Session Setup Race Condition Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability. However, only systems with ksmbd enabled are vulnerable. The specific flaw exists within the implementation of session setu...

CVE-2025-27157: Allocation of Resources Without Limits or Throttling

Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on /auth/setup. Without those rate limits, an attacker can craft requests that will send an email to an arbitrary addresses. Versions 4.2.16 a...