CVE-2025-40251
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
W jądrze systemu Linux zidentyfikowano podatność w funkcji devl_rate_nodes_destroy, która nie ustawia wskaźnika rodzica na NULL dla obiektów rate, co prowadzi do pozostawienia wskaźnika w stanie wiszącym. To może powodować błędy związane z licznikiem odniesień w komponentach netdevsim i mlx5.
Risk Assessment
Organizacje mogą napotkać problemy z pamięcią, które mogą prowadzić do awarii systemu lub nieprzewidzianych zachowań aplikacji, co może wpłynąć na stabilność i bezpieczeństwo infrastruktury sieciowej.
Recommendation
Zaleca się aktualizację jądra systemu Linux do wersji zawierającej poprawkę, która ustawia wskaźnik rodzica na NULL po powiadomieniu sterownika, aby uniknąć problemów z pamięcią i błędów licznika odniesień.
Related vulnerabilities
- CVE-2025-12999Critical
A vulnerability in Open VSX allows an unauthenticated attacker to poison the per-extension metadata cache by supplying a crafted X-Forwarded-Host header, replacing download, signature, and public-key URLs with attacker-controlled ones. The cache keys do not include the host, so poisoned entries are served to all clients for the entry's lifetime (1 hour by default, cluster-wide with Redis).
- CVE-2026-94101Critical
A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246. The affected function is vlan_load_form_uci in /usr/bin/routerd, where manipulation of the wan_num argument leads to buffer overflow. The attack can be initiated remotely and the exploit is publicly disclosed.
- CVE-2026-94100Critical
A weakness has been identified in Netcore NBR200V2 1.3.241127.071246. The affected function is wan_config_set_vlan in /usr/bin/routerd, where manipulation of the vlan_wanX.ports argument leads to buffer overflow. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-94099Critical
A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. The issue affects the restore.cgi file in the Backup Restore component, where manipulation of the QUERY_STRING argument results in command injection. The attack can be carried out remotely and the exploit is publicly released.
- CVE-2026-94098Critical
A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. The vulnerability affects the /www/cgi-bin/upgrade file in the Firmware Upgrade CGI Endpoint component, where manipulation of the QUERY_STRING argument leads to command injection. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-94097Critical
A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. The vulnerability affects the /www/cgi-bin/network_tools file in the CGI Diagnostic Endpoint component, where manipulation of the param/key/val arguments causes command injection. Remote exploitation is possible and the exploit has been publicly disclosed.
- CVE-2026-94096Critical
A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. The vulnerability affects the /usr/bin/network_tools file in the LAN IP Configuration Handler component, where manipulation of the ipv4 argument results in command injection. The attack may be launched remotely and the exploit has been made public.
- CVE-2026-94095Critical
A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. The vulnerability affects the /usr/bin/network_tools file in the Traceroute Diagnostic Feature component, where manipulation of the url argument leads to command injection. The attack may be initiated remotely and the exploit has been disclosed publicly.
- CVE-2026-94089Critical
A vulnerability was found in D-Link DIR-868L 2.01b05 in the strcpy function of the file /webfa_authentication.cgi in the Authentication Handler component. Manipulating the id/password arguments leads to a stack-based buffer overflow. The attack can be executed remotely, and the exploit has been publicly disclosed.
- CVE-2026-88857Critical
In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an authenticated privileged remote code execution vulnerability was found. The saveWatermark() function copies an uploaded file to a web-accessible directory using the client-supplied filename exactly as sent, with no extension check, content check, or filename sanitization. An authenticated core.manage user could upload a .php file disguised with an image Content-Type header and execute it directly by requesting the resulting path.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy The function devl_rate_nodes_destroy is documented to "Unset parent for all rate objects". However, it was only calling the driver-specific `rate_leaf_parent_set` or `rate_node_parent_set` ops and decrementing the parent's refcount, without actually setting the `devlink_rate->parent` pointer to NULL. This leaves a dangling pointer in the `devlink_rate` struct, which cause refcount error in netdevsim[1] and mlx5[2]. In addition, this is inconsistent with the behavior of `devlink_nl_rate_parent_node_set`, where the parent pointer is correctly cleared. This patch fixes the issue by explicitly setting `devlink_rate->parent` to NULL after notifying the driver, thus fulfilling the function's documented behavior for all rate objects. [1] repro steps: echo 1 > /sys/bus/netdevsim/new_device devlink dev eswitch set netdevsim/netdevsim1 mode switchdev echo 1 > /sys/bus/netdevsim/devices/netdevsim1/sriov_numvfs devlink port function rate add netdevsim/netdevsim1/test_node devlink port function rate set netdevsim/netdevsim1/128 parent test_node echo 1 > /sys/bus/netdevsim/del_device dmesg: refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 8 PID: 1530 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0 CPU: 8 UID: 0 PID: 1530 Comm: bash Not tainted 6.18.0-rc4+ #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:refcount_warn_saturate+0x42/0xe0 Call Trace: <TASK> devl_rate_leaf_destroy+0x8d/0x90 __nsim_dev_port_del+0x6c/0x70 [netdevsim] nsim_dev_reload_destroy+0x11c/0x140 [netdevsim] nsim_drv_remove+0x2b/0xb0 [netdevsim] device_release_driver_internal+0x194/0x1f0 bus_remove_device+0xc6/0x130 device_del+0x159/0x3c0 device_unregister+0x1a/0x60 del_device_store+0x111/0x170 [netdevsim] kernfs_fop_write_iter+0x12e/0x1e0 vfs_write+0x215/0x3d0 ksys_write+0x5f/0xd0 do_syscall_64+0x55/0x10f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [2] devlink dev eswitch set pci/0000:08:00.0 mode switchdev devlink port add pci/0000:08:00.0 flavour pcisf pfnum 0 sfnum 1000 devlink port function rate add pci/0000:08:00.0/group1 devlink port function rate set pci/0000:08:00.0/32768 parent group1 modprobe -r mlx5_ib mlx5_fwctl mlx5_core dmesg: refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 7 PID: 16151 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0 CPU: 7 UID: 0 PID: 16151 Comm: bash Not tainted 6.17.0-rc7_for_upstream_min_debug_2025_10_02_12_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:refcount_warn_saturate+0x42/0xe0 Call Trace: <TASK> devl_rate_leaf_destroy+0x8d/0x90 mlx5_esw_offloads_devlink_port_unregister+0x33/0x60 [mlx5_core] mlx5_esw_offloads_unload_rep+0x3f/0x50 [mlx5_core] mlx5_eswitch_unload_sf_vport+0x40/0x90 [mlx5_core] mlx5_sf_esw_event+0xc4/0x120 [mlx5_core] notifier_call_chain+0x33/0xa0 blocking_notifier_call_chain+0x3b/0x50 mlx5_eswitch_disable_locked+0x50/0x110 [mlx5_core] mlx5_eswitch_disable+0x63/0x90 [mlx5_core] mlx5_unload+0x1d/0x170 [mlx5_core] mlx5_uninit_one+0xa2/0x130 [mlx5_core] remove_one+0x78/0xd0 [mlx5_core] pci_device_remove+0x39/0xa0 device_release_driver_internal+0x194/0x1f0 unbind_store+0x99/0xa0 kernfs_fop_write_iter+0x12e/0x1e0 vfs_write+0x215/0x3d0 ksys_write+0x5f/0xd0 do_syscall_64+0x53/0x1f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53