CVE-2025-37755 net: libwx: handle page_pool_dev_alloc_pages error

In the Linux kernel, the following vulnerability has been resolved: net: libwx: handle pagepooldevallocpages error pagepooldevallocpages could return NULL. There was a WARNON!page but it would still proceed to use the NULL pointer and then crash. This is similar to commit 001ba0902046 "net: fec:...

CVE-2025-37755 net: libwx: handle page_pool_dev_alloc_pages error

In the Linux kernel, the following vulnerability has been resolved: net: libwx: handle pagepooldevallocpages error pagepooldevallocpages could return NULL. There was a WARNON!page but it would still proceed to use the NULL pointer and then crash. This is similar to commit 001ba0902046 "net: fec:...

CVE-2025-37755

CVE-2025-37755 is described in the Azure Linux 3.0 security advisory as a Linux kernel vulnerability in net: libwx related to page_pool_dev_alloc_pages returning NULL. The WARN_ON(!page) path could continue to dereference a NULL pointer, causing a crash. The Azure Nessus note confirms the affecte...

CVE-2025-23148

The CVE-2025-23148 issue applies to the Linux kernel: the Samsung Exynos chipid driver (exynos_chipid_probe) now checks soc_dev_attr->revision for NULL to prevent NULL-pointer dereference. This fixes a potential local dereference vulnerability. The fix mirrors a prior NULL-pointer dereference ...

CVE-2025-23148 soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe()

In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-chipid: Add NULL pointer check in exynoschipidprobe socdevattr-revision could be NULL, thus, a pointer check is added to prevent potential NULL pointer dereference. This is similar to the fix in commit...

CVE-2025-23148 soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe()

In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-chipid: Add NULL pointer check in exynoschipidprobe socdevattr-revision could be NULL, thus, a pointer check is added to prevent potential NULL pointer dereference. This is similar to the fix in commit...

CVE-2025-23146

The CVE-2025-23146 issue affects the Linux kernel mfd: ene-kb3930 driver, where a NULL pointer dereference could occur because off_gpios may be NULL. The kb3930_probe() lacked a NULL check, fixed in the resolved update (similar to backlight: hx8357 NULL pointer fix). Impact is local, with potenti...

CVE-2025-23146 mfd: ene-kb3930: Fix a potential NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: mfd: ene-kb3930: Fix a potential NULL pointer dereference The offgpios could be NULL. Add missing check in the kb3930probe. This is similar to the issue fixed in commit b1ba8bcb2d1f "backlight: hx8357: Fix potential NULL pointer...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the path parameters in the /demo/static/ endpoint. An attacker can exploit this vulnerability to read arbitrary files from the server’s filesystem by manipulating the request path, potentially exposing sensitive...

CVE-2025-46635

An issue was discovered on Tenda RX2 Pro 16.03.30.14 devices. Improper network isolation between the guest Wi-Fi network and other network interfaces on the router allows an attacker who is authenticated to the guest Wi-Fi to access resources on the router and/or resources and devices on other...

CVE-2025-46635

An issue was discovered on Tenda RX2 Pro 16.03.30.14 devices. Improper network isolation between the guest Wi-Fi network and other network interfaces on the router allows an attacker who is authenticated to the guest Wi-Fi to access resources on the router and/or resources and devices on other...

PT-2025-18709 · Tenda · Tenda Rx2 Pro

Name of the Vulnerable Software and Affected Versions: Tenda RX2 Pro version 16.03.30.14 Description: An issue was discovered that allows an attacker, who is authenticated to the guest Wi-Fi network, to access resources on the router and/or resources and devices on other networks hosted by the...

CVE-2025-46635

CVE-2025-46635 relates to Tenda RX2 Pro (firmware 16.03.30.14). The issue is improper network isolation between the guest Wi‑Fi network and other router interfaces, enabling an authenticated guest to access router resources and other networks by configuring a static IP in the non‑guest subnet on ...

LASHED: LLMs and Static Hardware Analysis for Early Detection of RTL Bugs

While static analysis is useful in detecting early-stage hardware security bugs, its efficacy is limited because it requires information to form checks and is often unable to explain the security impact of a detected vulnerability. Large Language Models can be useful in filling these gaps by...

From Ahead-of- to Just-in-Time and Back Again: Static Analysis for Unix Shell Programs

Shell programming is as prevalent as ever. It is also quite complex, due to the structure of shell programs, their use of opaque software components, and their complex interactions with the broader environment. As a result, even when exercising an abundance of care, shell developers discover...

Security-By-Design at the Telco Edge with OSS: Challenges and Lessons Learned

This paper presents our experience, in the context of an industrial R&D project, on securing GENIO, a platform for edge computing on Passive Optical Network PON infrastructures, and based on Open-Source Software OSS. We identify threats and related mitigations through hardening, vulnerability...

Secure Coding with AI, from Creation to Inspection

While prior studies have explored security in code generated by ChatGPT and other Large Language Models, they were conducted in controlled experimental settings and did not use code generated or provided from actual developer interactions. This paper not only examines the security of code generat...

An Algebraic Approach to Asymmetric Delegation and Polymorphic Label Inference (Technical Report)

Language-based information flow control IFC enables reasoning about and enforcing security policies in decentralized applications. While information flow properties are relatively extensional and compositional, designing expressive systems that enforce such properties remains challenging. In...

TOTOLINK N150RT 代码注入漏洞

The TOTOLINK N150RT is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK N150RT version 3.4.0-B20190525 suffers from a cross-site scripting vulnerability that originates from the lack of effective filtering and escaping of user-supplied data by the parameter Hostname in the...

Prefill-Based Jailbreak: a Novel Approach of Bypassing LLM Safety Boundary

Large Language Models LLMs are designed to generate helpful and safe content. However, adversarial attacks, commonly referred to as jailbreak, can bypass their safety protocols, prompting LLMs to generate harmful content or reveal sensitive data. Consequently, investigating jailbreak methodologie...