Threat database

CVE-2024-24784 is a vulnerability in the net/mail component where comments in display names are incorrectly handled. The available information does not provide technical details beyond this description or the impact of the vulnerability. No CVSS score or exploit details are provided. No patch or remediation information is available from the vendor advisory. The affected versions include specific versions 2.0 and 3.0, as well as references to Microsoft and Azure Linux products, but exact versioning details are unclear.

CVE-2025-22105 is a medium severity vulnerability affecting specific versions of the Linux kernel related to the bonding driver, specifically involving checks for XDP programs when setting bond mode. This vulnerability is part of a broader set of security issues fixed in the Linux kernel as detailed in the Ubuntu security advisory USN-7594-1. The flaw could potentially be exploited to compromise the system. Multiple Linux kernel versions are affected, and patches have been released to address these issues.

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Multiple security issues were discovered in the Linux kernel, including a vulnerability related to iommu-dma operations cleanup. These flaws affect various kernel subsystems and architectures and could potentially be exploited to compromise the system. A patch addressing these issues is available.

CVE-2025-38643 is a medium severity vulnerability involving a missing lock in the cfg80211_check_and_end_cac() function of the Linux kernel's WiFi subsystem. This flaw relates to improper synchronization that could lead to concurrency issues. The vulnerability affects specific Linux kernel versions as listed. A patch is available to address this issue.

A vulnerability identified as CVE-2025-37834 affects specific versions of the Linux kernel, related to the memory management subsystem's handling of hardware poisoned (hwpoison) folios. This issue has been addressed in a security update. The vulnerability is rated medium severity and no known exploits are currently in the wild. The fix is available through official vendor updates.

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

A vulnerability identified as CVE-2025-38665 involves a NULL pointer dereference in the can_changelink() function related to the struct can_priv::do_set_mode in the Linux kernel. This issue affects specific Linux kernel versions and could potentially be exploited to cause system instability or crashes. The vulnerability has been addressed with an official patch. The severity is assessed as medium based on the available information.

Multiple security issues, including a vulnerability in the ext4 filesystem related to journaling superblock updates on error conditions, were discovered in the Linux kernel. These issues affect various kernel subsystems and architectures. Updates have been released to address these flaws.

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

CVE-2025-38644 is a vulnerability in the mac80211 wireless subsystem that rejects TDLS operations when a station is not associated. The issue affects specific Microsoft-related versions of the software. A patch is available to address this vulnerability. The severity is assessed as medium based on the impact description. There are no known exploits in the wild. The vendor advisory does not indicate any cloud service involvement or specific geographic targeting.

Multiple security issues were discovered in the Linux kernel, including a vulnerability identified as CVE-2025-22109 related to the ax25 subsystem's broken autobind feature. These issues affect various kernel subsystems and architectures. An update has been released to address these flaws. The severity of this specific vulnerability is assessed as medium.

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Multiple security issues were discovered in the Linux kernel, including a vulnerability related to md/raid1 and raid10 IO flags handling. These flaws affect various kernel subsystems and architectures. The issues could potentially allow an attacker to compromise the system. A patch addressing these vulnerabilities is available.

A NULL pointer dereference vulnerability exists in the Linux kernel function l3mdev_l3_rcv, identified as CVE-2025-22103. This vulnerability is classified under CWE-476 and affects multiple specific Linux kernel versions. The issue was addressed in a security update that fixes several kernel subsystems. The vulnerability has medium severity and no known exploits in the wild have been reported. A patch is available to remediate the issue.

CVE-2024-34158 is a vulnerability involving stack exhaustion in the Parse function within the go/build/constraint package. The issue is categorized under CWE-674, which relates to uncontrolled recursion leading to resource exhaustion. The vulnerability affects certain versions of Microsoft-related software including versions 2.0 and 3.0, as well as Azure Linux and CBL Mariner 2.0. No CVSS score or detailed impact information is provided, and there are no known exploits in the wild. No patch or remediation guidance is currently available from the vendor.

CVE-2024-24787 is a vulnerability involving arbitrary code execution during the build process on Darwin systems in the cmd/go tool. The information provided is limited and does not include technical details or exploitation methods. No CVSS score is available, and there are no known exploits in the wild. The affected versions are ambiguously listed and include references to Microsoft products and versions 2.0 and 3.0, but the exact affected software versions are unclear. No patch or remediation information is provided.

CVE-2025-25199 is a memory leak vulnerability related to the BCryptGenerateSymmetricKey function in Microsoft software. The vulnerability is categorized under CWE-401, indicating improper release of memory. No CVSS score or detailed technical exploitation information is provided. There is no indication of known exploits in the wild or an official patch available at this time.

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle