kernel: bpf, sockmap: Fix race between element replace and close()

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix race between element replace and close Element replace with a socket different from the one stored may race with socket's close link popping & unlinking. sockmapdelete unconditionally unrefs the wrong element: /...

kernel: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcommsockalloc btsockalloc attaches allocated sk object to the provided sock object. If rfcommdlcalloc fails, we release the sk object, but leave the dangling pointer in th...

kernel: tipc: Fix use-after-free of kernel socket in cleanup_bearer().

In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free of kernel socket in cleanupbearer. syzkaller reported a use-after-free of UDP kernel socket in cleanupbearer without repro. 01 When bearerdisable calls tipcudpdisable, cleanup of the UDP kernel socket is...

kernel: sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport

In the Linux kernel, the following vulnerability has been resolved: sunrpc: clear XPRTSOCKUPDTIMEOUT when reset transport Since transport-sock has been set to NULL during reset transport, XPRTSOCKUPDTIMEOUT also needs to be cleared. Otherwise, the xstcpsetsockettimeouts may be triggered in...

kernel: Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: handle NULL sock pointer in l2capsockalloc A NULL sock pointer is passed into l2capsockalloc when it is called from l2capsocknewconnectioncb and the error handling paths should also be aware of it. Seemingly a...

kernel: net: inet6: do not leave a dangling sk pointer in inet6_create()

In the Linux kernel, the following vulnerability has been resolved: net: inet6: do not leave a dangling sk pointer in inet6create sockinitdata attaches the allocated sk pointer to the provided sock object. If inet6create fails later, the sk object is released, but the sock object retains the...

kernel: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet

A use-after-free vulnerability was found in the Linux kernel. The Bluetooth firmware isn't checked if skb contains an ACL header, otherwise the code may attempt to access some uninitialized or invalid memory past the valid skb-data...

kernel: mptcp: init: protect sched with rcu_read_lock

In the Linux kernel, the following vulnerability has been resolved: mptcp: init: protect sched with rcureadlock Enabling CONFIGPROVERCULIST with its dependence CONFIGRCUEXPERT creates this splat when an MPTCP socket is created: ============================= WARNING: suspicious RCU usage 6.12.0-rc...

kernel: wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()

A flaw was found in the Linux kernel's mac80211 wireless subsystem. A local attacker with low privileges could trigger a condition where the system attempts to transmit data with interrupts disabled during the ieee80211dostop function. This incorrect handling of network packet buffers SKBs can le...

kernel: ppp: do not assume bh is held in ppp_channel_bridge_input()

In the Linux kernel, the following vulnerability has been resolved: ppp: do not assume bh is held in pppchannelbridgeinput Networking receive path is usually handled from BH handler. However, some protocols need to acquire the socket lock, and packets might be stored in the socket backlog is the...

kernel: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: FIX possible deadlock in rfcommskstatechange rfcommskstatechange attempts to use socklock so it must never be called with it locked but rfcommsockioctl always attempt to lock it causing the following trace:...

kernel: netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsocket: remove WARNONONCE on maximum cgroup level cgroup maximum depth is INTMAX by default, there is a cgroup toggle to restrict this maximum depth to a more reasonable value not to harm performance. Remove...

kernel: net: fix data-races around sk->sk_forward_alloc

A flaw was found in the Linux kernel. This vulnerability may allow a local user to cause a denial of service DoS through a system crash. A race condition occurs when concurrent threads process incoming IPv6 network traffic on a listening socket without adequate locking, leading to corrupted socke...

kernel: smb: client: Fix use-after-free of network namespace.

A flaw was found in the Linux kernel's Server Message Block SMB client. Improper reference counting allows kernel sockets to persist after their associated network namespace has been released. A local attacker with permission to create and destroy network namespaces—such as in containerized...

kernel: Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout

A flaw was found in the Linux kernel's Bluetooth subsystem. When closing a Synchronous Connection-Oriented SCO socket, a race condition between socket cleanup and a delayed timeout worker can cause the kernel to reference memory that has already been released. A local user could exploit this...

Remote Code Execution (RCE)

vllm is vulnerable to Remote Code Execution RCE. The vulnerability is due to the use of Python’s pickle module on untrusted data received over a ZeroMQ SUB socket in multi-node deployments using the V0 engine, which allows an attacker to execute arbitrary code on the target machine and potentiall...

PT-2025-20858 · Unknown · Iec 3Ph 22Kw Child Socket/ Shutter +29

Name of the Vulnerable Software and Affected Versions: IEC 1Ph 7.4kW Child socket versions prior to V2.135 IEC 1Ph 7.4kW Child socket/ shutter versions prior to V2.135 IEC 1Ph 7.4kW Parent cable 7m versions prior to V2.135 IEC 1Ph 7.4kW Parent cable 7m incl. SIM versions prior to V2.135 IEC 1Ph...

CVE-2025-31929: Missing Immutable Root of Trust in Hardware

A vulnerability has been identified in IEC 1Ph 7.4kW Child socket 8EM1310-2EH04-0GA0 All versions, IEC 1Ph 7.4kW Child socket/ shutter 8EM1310-2EN04-0GA0 All versions, IEC 1Ph 7.4kW Parent cable 7m 8EM1310-2EJ04-3GA1 All versions, IEC 1Ph 7.4kW Parent cable 7m incl. SIM 8EM1310-2EJ04-3GA2 All...

PT-2025-20857 · Unknown · Iec 1Ph 7.4Kw Parent Socket Incl. Sim +31

Name of the Vulnerable Software and Affected Versions: IEC 1Ph 7.4kW Child socket 8EM1310-2EH04-0GA0 All versions IEC 1Ph 7.4kW Child socket/ shutter 8EM1310-2EN04-0GA0 All versions IEC 1Ph 7.4kW Parent cable 7m 8EM1310-2EJ04-3GA1 All versions IEC 1Ph 7.4kW Parent cable 7m incl. SIM...

OESA-2025-1475 fcgi security update

FastCGI is a language independent, scalable, open extension to CGI that provides high performance without the limitations of server specific APIs. Security Fixes: FastCGI fcgi2 aka fcgi 2.x through 2.4.4 has an integer overflow and resultant heap-based buffer overflow via crafted nameLen or...