CVE-2025-38645

CVE-2025-38645 affects the Linux kernel (net/mlx5). Root cause: a NULL device memory pointer (dev->dm) can be dereferenced in mlx5_init_once() if allocation fails. Fix: add a NULL check before accessing device memory to prevent a crash. Impact in docs: LOCAL attacker could crash the system; re...

CVE-2025-38708

CVE-2025-38708 is a Linux kernel/DRBD issue where, with two-primaries enabled, concurrent writes could trigger a use-after-free due to a missing kref_get in handle_write_conflicts. The root cause is not in regular operation but in the code path for detecting concurrent writes on the DRBD layer, l...

CVE-2025-62599

CVE-2025-62599 affects eProsima Fast DDS prior to versions 2.6.11, 2.14.6, 3.2.4, 3.3.1, and 3.4.1. When security mode is enabled, modifying the DATA Submessage in an SPDP packet (specifically tampering with the length of PID_IDENTITY_TOKEN or PID_PERMISSION_TOKEN as readPropertySeq) can trigger ...

CVE-2025-63261

AWStats 8.0 is vulnerable to Command Injection due to a flaw in the open function . This vulnerability allows an attacker to execute arbitrary commands on the host system. For example, on Debian 11 bullseye , the issue is addressed in version 7.8-2+deb11u2 . While the core cause is identified as ...

CVE-2006-1376

CVE-2006-1376 affects Debian GNU/Linux 3.1r1 network install: /var/log/debian-installer/cdebconf is created with world-writable permissions, enabling local users to trigger a denial of service via disk consumption. The connected documents confirm this behavior across multiple feeds (NVD, OSV, UB,...

CVE-2006-1772

CVE-2006-1772 affects Debian GNU/Linux where, during configuration of mnogosearch in the mnogosearch-common 3.2.31-1 package, the debconf process stores the cleartext database administrator password in a world-readable config.dat instead of the restricted passwords.dat in mnogosearch-common/datab...

CVE-2025-39734

CVE-2025-39734 affects the Linux kernel component fs/ntfs3 in the NTFS file-system path. The issue stems from a revert of the inode_trylock versus inode_lock handling (commit 69505fe98f198ee813898cbcaf6770949636430b). The description notes that previously conditional lock acquisition was removed ...

CVE-2010-3373

Technical details for CVE-2010-3373 are not publicly available in the provided documents; multiple feeds list the issue as paxtest insecure temporary file handling, but no vendor/product/version specifics or fixes are disclosed. Monitor for updates.

CVE-2010-4817

CVE-2010-4817 affects pithos prior to 0.3.5, where a symlink vulnerability allows overwrite of arbitrary files. The issue is documented across multiple feeds (Red Hat, Ubuntu, Debian OSV, NVD/NVD-derived entries) with the core impact: local file overwrite via symlinks. The connected records confi...

CVE-2025-39692

CVE-2025-39692 is a Linux kernel vulnerability related to the SMB ksmbd path where ksmbd_rdma_stop_listening() must be called before stop_sessions() to avoid using the smb_direct_wq pointer after destroy. The issue arises when the order is not respected, allowing existing connections to reference...

CVE-2025-39737

CVE-2025-39737 corresponds to a Linux kernel kmemleak issue where soft lockups occurred during cleanup of a large kmemleak object set (e.g., ~40k objects). The provided Astra Linux bulletin notes the fix: in kmemleak_do_cleanup(), periodically call cond_resched() inside the cleanup loop to avoid ...

CVE-2025-38693

CVE-2025-38693 is a Linux kernel vulnerability affecting media: dvb-frontends, specifically w7090p tuner code. The issue is a NULL pointer dereference in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar when user-controlled msg[0].buf is null and msg[0].len is zero, allowing a crash if msg[...

CVE-2025-38694

In CVE-2025-38694, the Linux kernel media/dvb-frontends: dib7090p driver could dereference a null pointer in dib7090p_rw_on_apb() when msg[0].buf or msg[1].buf lengths are zero or null, because checks on buf were bypassed if buf was null and len was zero. The fix adds sanity checks on msg[0].len ...

CVE-2025-39689

CVE-2025-39689 affects the Linux kernel’s ftrace filter handling. The issue arose because readers (set_ftrace_filter/set_ftrace_notrace) kept a pointer to the global tracer hash, unlike writers who copy the hash. The pointer could remain static across calls that release locks and update the globa...

CVE-2025-39710

CVE-2025-39710: In the Linux kernel, the Venus media driver adds a packet-size validation after reading the header from shared memory to ensure the reported size cannot exceed the number of available words. This fixes potential out-of-bounds memory accesses by firmware-provided sizes. The fix tar...

CVE-2025-39752

CVE-2025-39752: In the Linux kernel (ARM/rockchip), the SMP initialization hang bug was fixed by moving SRAM initialization to after all secondary CPUs are powered down. The root cause involved the trampoline code being written to SRAM while secondary CPUs were powered on, causing potential kerne...

CVE-2025-39759

CVE-2025-39759 affects the Linux kernel’s btrfs quota subsystem. A race between disabling quotas and running btrfs_ioctl_quota_rescan() can lead to a use-after-free of qgroup records in fs_info->qgroup_tree due to Task B freeing qgroups without holding fs_info->qgroup_lock while Task A iter...

CVE-2025-39773

CVE-2025-39773 refers to a Linux kernel issue in the bridge/net subsystem where setting multicast_query_interval to a large value can cause a local time overflow in br_multicast_send_query(), making the timer expire immediately and re-arm in a loop, potentially triggering a soft lockup (as shown ...

CVE-2025-39801

CVE-2025-39801 affects the Linux kernel USB subsystem (dwc3) where device endpoint command timeouts could trigger a kernel panic if WARN_ON is hit during connect/disconnect sequences on Exynos platforms. The root cause is a WARN_ON triggered by device endpoint commands in the privileged path duri...

CVE-2025-39907

Technical details about CVE-2025-39907 are not publicly provided in the supplied connected documents. Monitor for updates from vendors/security advisories; the initial description mentions a Linux kernel fix related to overlapping ECC buffer mappings in stm32_fmc2.

CVE-2025-39911

CVE-2025-39911 : Linux kernel i40e driver fix for IRQ freeing in i40e_vsi_request_irq_msix error path. If request_irq() fails after the first iteration, the error path frees IRQs with the wrong dev_id, causing IRQs to remain freed incorrectly and triggering a WARNING: “Trying to free already-free...

CVE-2025-39923

CVE-2025-39923 concerns the Linux kernel dmaengine/qcom BAM driver. The root cause was missing error handling in DT parsing for required properties (clock and num-channels), which could allow probing to proceed unsafely and read channels from registers, risking early boot crashes across Qualcomm ...

CVE-2025-38696

CVE-2025-38696 (Linux kernel, MIPS) : The issue occurs in stack_top() for tasks without an ABI or vDSO mapping (e.g., kthreads). If such a task calls stack_top(), it can dereference a NULL ABI pointer and crash. Affected area is the MIPS support in the Linux kernel; the advisory notes the crash c...

CVE-2025-38736

Technical details about CVE-2025-38736 are not provided in the connected documents. The initial description notes a Linux kernel MDIO PHY address masking fix (mask with 0x1f) in net: usb: asix_devices to prevent OOB/invalid MDIO addresses. Connected advisories reference the CVE, but do not supply...

CVE-2025-39676

CVE-2025-39676 affects the Linux kernel in the SCSI qla4xxx path. The issue arises because qla4xxx_ep_connect() can return error pointers, while qla4xxx_get_ep_fwdb() is expected to return NULL on error; propagating error pointers leads to an Oops in the caller. The fix changes error pointers to ...

CVE-2025-39731

CVE-2025-39731 concerns the Linux kernel, specifically the F2FS file system, where vm_unmap_ram() may be invoked from an invalid context. The connected documents confirm a patch that changes the in_task() check inside f2fs_read_end_io() to also verify that interrupts are disabled, ensuring pages ...

CVE-2025-39738

CVE-2025-39738 affects the Linux kernel (btrfs) and is triggered during relocation of partially dropped subvolumes. The root cause is a missing orphan item for a subvolume, causing a delayed-ref transaction abort when relocating, with an offender inside a dropped subvolume. Upstream fixes exist (...

CVE-2025-39812

CVE-2025-39812: In the Linux kernel SCTP implementation, the vulnerability stems from not initializing sin6_scope_id in sctp_v6_from_sk(), which can cause undefined behavior. The fix clears sin6_scope_id and sin6_flowinfo to prevent use of uninitialized data in the IPv6 SCTP path. Affected contex...

CVE-2025-39842

CVE-2025-39842 : In the Linux kernel, the ocfs2 path could dereference a NULL journal pointer when releasing an inode during journal shutdown. The root cause was calling jbd2_journal_release_jbd_inode() with osb->journal potentially NULL after ocfs2_journal_shutdown(). The fix is to add explic...

CVE-2025-39847

CVE-2025-39847: In the Linux kernel, pad_compress_skb() can leak memory if alloc_skb() fails, as the old skb reference may be freed incorrectly at the caller. The fix aligns pad_compress_skb() semantics with realloc: free the old skb only after successful allocation and compression, and at the ca...

CVE-2012-4385

CVE-2012-4385 affects letodms 3.3.6. The connected documents identify a CSRF vulnerability in the change password flow, enabling an attacker to induce password changes without user intent. Root cause is CSRF in the authentication workflow, with impact limited to confidentiality/ integrity of the ...

CVE-2025-38677

CVE-2025-38677 is a Linux kernel vulnerability related to F2FS. The issue arises from a corrupted image where a dnode shares the same node id as its inode, causing f2fs_get_dnode_of_data() to compute an invalid data block address and potentially access memory out of bounds. The root cause is trac...

CVE-2025-38729

CVE-2025-38729 relates to the Linux kernel ALSA USB-audio driver and a validation issue with UAC3 power domain descriptors. The root cause is insufficient verification of the descriptor length (bLength), which could allow out-of-bounds accesses via malicious firmware. The vulnerability affects th...

CVE-2025-39790

CVE-2025-39790 : In the Linux kernel, the bus: mhi: host implementation could mis-handle completion events when a device points a TRE pointer ahead of the host’s ring read pointer, enabling a window where a stale TRE is read and its buffer freed twice. The published description documents that thi...

CVE-2025-39687

CVE-2025-39687 affects the Linux kernel subsystem for the iio: light driver, specifically the as73211 component. The root cause described is that buffer holes were not zeroed when the buffer was copied into a kfifo that user space can read. The documented remediation in the initial description is...

CVE-2025-39839

CVE-2025-39839 (Linux kernel) : In batman-adv network-coding decode, batman-adv NC code decodes skb data by XORing with coded_len without verifying the source skb length, only checking payload against destination skb length. This can produce a local out-of-bounds read and a small out-of-bounds wr...

CVE-2026-1940

CVE-2026-1940 describes an out-of-bounds read in gst_wavparse_adtl_chunk() due to improper handling of lsize and GST_ROUND_UP_2(lsize) in the WAV parser. Connected advisories confirm affected package family: gstreamer1-plugins-good (AL2/ALAS2 and AL2023 lines). Patches and updated packages are pr...

CVE-2022-50327

CVE-2022-50327 in the Linux kernel concerns ACPI: processor: idle where acpi_fetch_acpi_dev() could return NULL, causing a NULL pointer dereference in acpi_device_hid(). The connected Nessus/SUSE advisories confirm this CVE is addressed in kernel live patches for SUSE SLES15 SP5 (multiple patches...

CVE-2025-39894

The CVE-2025-39894 issue is in the Linux kernel netfilter br_netfilter path: br_nf_local_in() confirms conntrack during handling of a broadcast to a tap device added to a bridge. If another conntrack with the same hash is added, a warning can be emitted. The root cause is br_nf_local_in() using t...

CVE-2025-6966

CVE-2025-6966 is a vulnerability in Python-apt on APT-based Linux systems caused by a NULL pointer dereference in TagSection.keys() when processing deb822 files with malformed non-UTF-8 keys. It can lead to a local denial of service (process crash). The issue is reported across multiple distribut...

CVE-2025-38723

CVE-2025-38723 concerns the Linux kernel, specifically LoongArch BPF tailcall handling. The issue arises in the tailcall jump offset calculation when bpf_int_jit_compile() fails to initialize the JIT context, leaving out_offset = -1. Consequently, the computed jmp_offset = (out_offset - cur_offse...

CVE-2025-39693

CVE-2025-39693: In the Linux kernel, the vuln affects the DRM AMD display path (drm/amd/display) where NULL pointers could be dereferenced via drm_atomic_get_new_connector_state() or drm_atomic_get_old_connector_state(). The description states the root cause is that these functions can return NUL...

CVE-2025-39736

CVE-2025-39736 : In the Linux kernel, a deadlock can occur in kmemleak when netpoll is enabled because pr_warn_once() may be called while holding kmemleak_lock, potentially triggering netpoll and reacquiring the lock. The fix moves the pr_warn_once() call out of the locked region by setting a fla...

CVE-2025-39749

The CVE-2025-39749 issue is in the Linux kernel’s RCU read-side handling: when IRQ work is used (CONFIG_IRQ_WORK=y) and rcu_read_unlock() runs in an interrupts-disabled region, irq-work can interrupt rcu_read_unlock_special(), creating a data race on the per-CPU defer_qs_iw_pending field. The fix...

CVE-2025-39794

CVE-2025-39794 affects the Linux kernel on ARM Tegra platforms. The root cause is an incorrect use of memcpy when writing to IRAM, causing Kasan to crash due to boundary checks failing under normal memcpy. The vulnerability is local with a high impact on availability, and the description notes th...

CVE-2025-39846

CVE-2025-39846 : In the Linux kernel, a NULL pointer dereference could occur in PCMCIΑ code during resource allocation. Specifically, __iodyn_find_io_region() assigns pcmcia_make_resource() to res and uses it in pci_bus_alloc_resource(); if pcmcia_make_resource() fails, a dereference of res could...

CVE-2025-63498

The Alinto SOGo groupware server is vulnerable to a Cross-Site Scripting (XSS) flaw in versions prior to 5.12.4 . The root cause is the lack of proper sanitization of the "userName" parameter during a POST request to the /SOGo/connect endpoint. When the "Recordar nombre de usuario" (Remember user...

CVE-2026-25061

tcpflow is affected by a TIM element handling bug in wifipcap: a crafted 802.11 frame with a large TIM length can cause a 1‑byte out‑of‑bounds write at tim.bitmap[251], due to a faulty length check. The overflow is on a stack‑allocated structure in handle_beacon; impact is DoS with potential (but...

CVE-2025-39709

CVE-2025-39709 : In the Linux kernel, the Venus media driver risked a NULL dereference if an IRQ fired before the interrupt handler was fully initialized. The fix ensures the interrupt handler is initialized before the IRQ is registered, preventing spurious interrupts during probe (noted on Rb3Ge...

CVE-2025-39909

CVE-2025-39909 concerns the Linux kernel’s DAMON module (mm/damon/lru_sort). The issue arises during the calculation of hot_thres and cold_thres when either sample_interval or aggr_interval is used as a divisor, risking division-by-zero. The fix adds validation and directly returns -EINVAL in suc...