CVE-2025-22020

In the Linux kernel, the following vulnerability has been resolved: memstick: rtsxusbms: Fix slab-use-after-free in rtsxusbmsdrvremove This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in rtsxusbmspollcard+0x159/0x20...

CVE-2024-58092 nfsd: fix legacy client tracking initialization

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix legacy client tracking initialization Get rid of the nfsd4legacytrackingops-init call in checkforlegacymethods. That will be handled in the caller nfsd4clienttrackinginit. Otherwise, we'll wind up calling...

CVE-2025-22020

CVE-2025-22020 pertains to the Linux kernel memstick subsystem, fixing a slab-use-after-free in rtsx_usb_ms_drv_remove that could crash via rtsx_usb_ms_poll_card. Affected code path involves memstick host allocation during driver probe and removal, with a use-after-free arising from freeing drive...

CVE-2025-22020 memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove

In the Linux kernel, the following vulnerability has been resolved: memstick: rtsxusbms: Fix slab-use-after-free in rtsxusbmsdrvremove This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in rtsxusbmspollcard+0x159/0x20...

CVE-2025-22019 bcachefs: bch2_ioctl_subvolume_destroy() fixes

In the Linux kernel, the following vulnerability has been resolved: bcachefs: bch2ioctlsubvolumedestroy fixes bch2evictsubvolumeinodes was getting stuck - due to incorrectly pruning the dcache. Also, fix missing permissions checks...

CVE-2025-22018 atm: Fix NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: atm: Fix NULL pointer dereference When MPOAcacheimposrcvd receives the msg, it can trigger Null Pointer Dereference Vulnerability if both entry and holdingtime are NULL. Because there is only for the situation where entry is NULL...

CVE-2025-22018

CVE-2025-22018 affects the Linux kernel ATM MPOA path. A NULL pointer dereference can occur in MPOA_cache_impos_rcvd() when both entry and holding_time are NULL, leading to a crash (KASAN/GPF observed in logs). The issue has been fixed in upstream kernels and is addressed in vendor updates (examp...

kernel: irqchip/gic-v4: Don't allow a VMOVP on a dying VPE

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't allow a VMOVP on a dying VPE Kunkun Jiang reported that there is a small window of opportunity for userspace to force a change of affinity for a VPE while the VPE has already been unmapped, but the...

PT-2025-29011

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A flaw exists in the Linux kernel's wifi subsystem, specifically within the ath12k driver. The issue involves the potential for sending Wireless Management Interface WMI commands to th...

PT-2025-16762 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A issue in the Linux kernel has been resolved, related to adding a folio to a bio. On certain architectures, such as aarch64, where large hugepages are supported e.g., 16GB, the offset...

openSUSE Security Advisory (SUSE-SU-2025:1286-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15 / openSUSE 15 Security Update : apache2-mod_auth_openidc (SUSE-SU-2025:1286-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:1286-1 advisory. - CVE-2025-31492: Fixed a bug where OIDCProviderAuthRequestMethod POSTs can leak protected data. bsc1240893 Tenable has...

PT-2025-16739 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel has been resolved. The issue was related to the zynqmp audio init function, where devm kasprintf calls could return null pointers on failure, but so...

openSUSE Security Advisory (SUSE-SU-2025:1227-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for perl-Data-Entropy (moderate)

openSUSE Security Update: Security update for perl-Data-Entropy Announcement ID: openSUSE-SU-2025:0123-1 Rating: moderate References: 1240395 Cross-References: CVE-2025-1860 Affected Products: openSUSE Backports SLE-15-SP6 An update that fixes one vulnerability is now available. Description: This...

SUSE SLES15: kernel-livepatch-5_14_21-150400_24_133-default / etc (SUSE-SU-2025:1276-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:1276-1 advisory. This update for the Linux Kernel 5.14.21-15040024133 fixes one issue. The following security issue was fixed: - CVE-2024-56600: net: inet6: do not leav...

CVE-2025-32385 EspoCRM allows unrestricted Embedding in Iframe dashlet

EspoCRM is an Open Source Customer Relationship Management software. Prior to 9.0.5, Iframe dashlet allows user to display iframes with arbitrary URLs. As the sandbox attribute is not included in the iframe, the remote page can open popups outside of the iframe, potentially tricking users and...

CVE-2025-32784 conda-forge-webservices has an Unauthorized Artifact Modification Race Condition

conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. In versions prior to 2025.4.10, a race condition vulnerability has been identified in the conda-forge-webservices component used within the shared build infrastructure. This vulnerability, categorized a...

CVE-2025-32445 Users can gain privileged access to the host system and cluster with EventSource and Sensor CR

Argo Events is an event-driven workflow automation framework for Kubernetes. A user with permission to create/modify EventSource and Sensor custom resources can gain privileged access to the host system and cluster, even without having direct administrative privileges. The EventSource and Sensor...

Moderate: Red Hat Security Advisory: expat security update

An update for expat is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...