A potential NULL pointer dereference vulnerability exists in the driver core function dev_uevent() in certain Linux kernel versions. This issue is identified as CVE-2025-37800 and is classified as a low severity vulnerability. The flaw could lead to system instability or crashes if triggered. Multiple affected Linux kernel versions are listed, and a patch is available to address the issue. The vulnerability is part of a broader set of Linux kernel security fixes released in June 2025.
Multiple security issues, including a vulnerability in the AMDGPU driver related to error handling in amdgpu_cgs_create_device() within amd_powerplay_create(), were discovered in the Linux kernel. These issues affect various architectures and subsystems and could potentially allow an attacker to compromise the system. A patch addressing these vulnerabilities is available.
Multiple security issues, including a vulnerability in the drm/amdkfd GPU driver subsystem, were discovered in the Linux kernel versions specified. These issues could potentially allow an attacker to compromise the system. The vendor has released patches addressing these flaws as part of a broader Linux kernel security update.
Multiple security issues were identified and fixed in the Linux kernel, including a fix for a warning condition in the perf/core subsystem related to partial initialization. These vulnerabilities affect various architectures and subsystems, potentially allowing attackers to compromise affected systems. A patch is available addressing these issues.
A vulnerability in Helm allows a specially crafted JSON schema to cause a stack overflow. This issue affects specific versions of the product and is identified as CVE-2025-32387. No CVSS score or detailed technical exploitation information is currently available. No patch or remediation guidance has been provided yet by the vendor.
CVE-2025-23167 is a vulnerability in Node.js 20's HTTP parser where HTTP/1 headers can be improperly terminated using '\r\n\rX' instead of the required '\r\n\r\n'. This inconsistency enables HTTP request smuggling, potentially allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The vulnerability affects certain Microsoft products including Azure Linux versions 2.0 and 3.0. No CVSS score or patch information is currently available, and there are no known exploits in the wild at this time.
CVE-2025-1149 is a memory leak vulnerability in GNU Binutils ld related to the xmalloc.c xstrdup function. The vulnerability is categorized under CWE-401 (Improper Release of Memory). There is no CVSS score available, no known exploits in the wild, and no patch or remediation information provided. The affected products include Microsoft and Azure Linux versions 2.0 and 3.0. The vendor advisory does not provide specific remediation guidance or confirm patch availability. Due to the lack of detailed impact or exploitation information, the severity is assessed as medium.
CVE-2024-45159 is a vulnerability in Mbed TLS versions 3.x prior to 3.6.1 related to TLS 1.3 client certificate authentication. When a server enables optional client authentication, the client certificate's keyUsage or extKeyUsage extensions may not be properly validated, potentially leading to incorrect authentication decisions. The issue affects Microsoft products including Azure Linux and CBL Mariner 2.0. No CVSS score is provided, and no known exploits are reported in the wild. Patch status is not confirmed due to lack of vendor advisory details.
CVE-2024-23744 is a vulnerability in Mbed TLS version 3.5.1 where a client sending a TLS 1.3 ClientHello message without extensions can cause a persistent handshake denial. This issue affects Microsoft products including Azure Linux and CBL Mariner 2.0. No CVSS score is provided, and no known exploits are reported in the wild. The vendor advisory does not specify patch availability or mitigation steps.
CVE-2024-28960 is a vulnerability in Mbed TLS versions 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, as well as Mbed Crypto. The issue involves the PSA Crypto API mishandling shared memory, which could lead to improper access control. No CVSS score or detailed impact information is provided. There are no known exploits in the wild and no patch links explicitly stated in the input data. The affected software includes specific versions of Mbed TLS and Mbed Crypto.