CVE-2025-39705

The CVE-2025-39705 entry concerns a NULL pointer dereference in the AMD display driver (DC module) for the Linux kernel. Root cause: during cleanup in dc_destruct(), if dc->ctx construction failed, dc->ctx is NULL but code dereferenced dc->ctx->perf_trace. The fix added a NULL check f...

CVE-2025-39683 tracing: Limit access to parser->buffer when trace_get_user failed

In the Linux kernel, the following vulnerability has been resolved: tracing: Limit access to parser-buffer when tracegetuser failed When the length of the string written to setftracefilter exceeds FTRACEBUFFMAX, the following KASAN alarm will be triggered: BUG: KASAN: slab-out-of-bounds in...

CVE-2025-39683

CVE-2025-39683 (Linux kernel tracing vulnerability) The issue occurs when processing long strings in ftrace filters: trace_get_user may fail, but parser->buffer end is not zeroed, leading to a slab-out-of-bounds read in strsep/ftrace_process_regex and related release paths. The result is a loc...

CVE-2025-39683 tracing: Limit access to parser->buffer when trace_get_user failed

In the Linux kernel, the following vulnerability has been resolved: tracing: Limit access to parser-buffer when tracegetuser failed When the length of the string written to setftracefilter exceeds FTRACEBUFFMAX, the following KASAN alarm will be triggered: BUG: KASAN: slab-out-of-bounds in...

IBM MQ 9.2 < 9.2.0.37 LTS / 9.3 < 9.3.0.31 LTS / 9.3 < 9.4.3.1 CD / 9.4 < 9.4.0.15 LTS / 9.4.3.1 (7243544)

The version of IBM MQ Server running on the remote host is affected by a vulnerability as referenced in the 7243544 advisory. - IBM MQ Java and JMS stores a password in client configuration files when trace is enabled which can be read by a local user. CWE: CWE-260: Password in Configuration File...

CVE-2025-39695: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Flush delayed SKBs while releasing RXE resources When skb packets are sent out, these skb packets still depends on the rxe resources, for example, QP, sk, when these packets are destroyed. If these rxe resources are...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from the tracing module not restricting access to parser-buffer when tracegetuser fails...

Linux RCU Read Lock DoS

The vulnerability of the rcureadlockTraceheld function in Linux kernel is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Security Bulletin: IBM MQ is vulnerable to a password disclosure vulnerability.

Summary IBM MQ has addressed a password disclosure vulnerability CVE-2025-36100 Vulnerability Details CVEID:CVE-2025-36100 DESCRIPTION: IBM MQ Java and JMS stores a password in client configuration files when trace is enabled which can be read by a local user. CWE:CWE-260: Password in Configurati...

tracing: Add down_write(trace_event_sem) when adding trace event

...

nfs: pass explicit offset/count to trace events

...

Linux Distros Unpatched Vulnerability : CVE-2025-38649

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: qcs615: fix a crash issue caused by infinite loop for Coresight An infinit...

Linux Distros Unpatched Vulnerability : CVE-2023-0594

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view...

Linux Distros Unpatched Vulnerability : CVE-2025-38539

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Red Hat Enterprise Linux - kernel: tracing: Add downwritetraceeventsem when adding trace event Ubuntu Linux - tracing: Add downwritetraceeventsem when adding...

CVE-2025-1501

An access control vulnerability was discovered in the Request Trace and Download Trace functionalities of CMC before 25.1.0 due to a specific access restriction not being properly enforced for users with limited privileges. An authenticated user with limited privileges can request and download...

Linux Distros Unpatched Vulnerability : CVE-2023-2856

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - VMS TCPIPtrace file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file CVE-2023-2856 Note that Nessu...

Linux Distros Unpatched Vulnerability : CVE-2023-35057

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An integer overflow vulnerability exists in the LXT2 lxt2rdtrace value elements allocation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can...

Linux Distros Unpatched Vulnerability : CVE-2021-39947

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In specific circumstances, trace file buffers in GitLab Runner versions up to 14.3.4, 14.4 to 14.4.2, and 14.5 to 14.5.2 would re-use the file descriptor 0 for...

Picklescan has a missing detection when calling built-in python trace.Trace.runctx

Summary Using trace.Trace.runctx, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to trace.Trace.runctx function in reduce method Then when the victim after...

GHSA-G344-HCPH-8VGG Picklescan has a missing detection when calling built-in python trace.Trace.runctx

Summary Using trace.Trace.runctx, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to trace.Trace.runctx function in reduce method Then when the victim after...