CVE-2025-39896

CVE-2025-39896 (Linux kernel, open-source) The vulnerability affects the ivpu driver in the kernel’s accel path. It arises from recovery work being queued during device removal, potentially allowing use-after-free if recovery code accesses freed resources. The fix replaces cancel_work_sync() with...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a failure to use a synchronization mechanism when deleting timers in the smpexecutetasksg function, which...

[SECURITY] Fedora 42 Update: nextcloud-31.0.9-1.fc42

NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing rig ht on the web. NextCloud is extendable via a simple but powerful API...

CVE-2025-61792: Concurrent Execution using Shared Resource with Improper Synchronization

Quadient DS-700 iQ devices through 2025-09-30 might have a race condition during the quick clicking of in order the Question Mark button, the Help Button, the About button, and the Help Button, leading to a transition out of kiosk mode into local administrative access. NOTE: the reporter indicate...

Microsoft Windows inconsistent driver blocking

RISK EVALUATION Microsoft Windows Defender Application Control WDAC and the Microsoft vulnerable driver blocklist do not adequately block known-vulnerable drivers. These unexpected behaviors can confuse users about whether or not driver blocking is working and which drivers are being blocked. 2...

CVE-2025-56233

Openindiana, kernel SunOS 5.11 has a denial of service vulnerability. For the processing of TCP packets with RST or SYN flag set, Openindiana has a wide acceptable range of sequence numbers. It does not require the sequence number to exactly match the next expected sequence value, just to be with...

Bluetooth Service Privilege Escalation

The vulnerability of the Bluetooth Service for Windows operating systems is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to gain increased privileges...

Graphics component Windows Privilege Escalation

The vulnerability of the Graphics component in Windows operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2025-9894

The Sync Feedly plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the crsfcronjobfunc function. This makes it possible for unauthenticated attackers to trigger content synchronizati...

Linux net/rose/rose_timer.c Heap Buffer Overflow DoS

The vulnerability of the net/rose/rosetimer.c component in the Linux operating system is related to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and caus...

Linux timer_migration.c Heap Buffer Overflow DoS

The vulnerability of the tmigrsetupgroups function in the timermigration.c component of the Linux operating system’s kernel is related to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause a service failur...

Linux IPv4 Kernel DoS

The vulnerability of IPv4 components of the Linux operating system’s kernel is related to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause service failures...

fs/exfat Kernel Data Compromise

The vulnerability of the fs/exfat component in the Linux operating system’s kernel is related to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and...

Linux kernel tracing osnoise DoS

The vulnerability of the tracing/osnoise component in Linux kernel relates to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux streamzap.c DoS

The vulnerability of the streamzap.c component in the Linux operating system’s kernel is related to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux kernel DoS

The vulnerability of the Linux operating system’s kernel relates to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause service failures...

Linux kernel Synchronization DoS

The vulnerability of the Linux operating system’s kernel is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux arch/loongarch/power/platform.c DoS

The vulnerability in the arch/loongarch/power/platform.c component of the Linux operating system is related to synchronization errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux kernel get_random_u32 Heap Buffer Overflow DoS

The vulnerability of the getrandomu32 function in the time/clocksource.c component of the Linux operating system’s kernel is related to synchronization errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2025-9894 Sync Feedly <= 1.0.1 - Cross-Site Request Forgery to Sync Trigger

The Sync Feedly plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the crsfcronjobfunc function. This makes it possible for unauthenticated attackers to trigger content synchronizati...