Common Weakness Enumeration
CWE-617
AllowedReachable Assertion
Abstraction: Base · Status: Draft
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
1150 vulnerabilities reference this CWE, most recent first.
GHSA-JVHC-5HHR-W3V5
Vulnerability from github – Published: 2022-09-16 21:19 – Updated: 2022-09-19 19:06
VLAI
Summary
TensorFlow vulnerable to assertion fail on MLIR empty edge names
Details
Impact
When mlir::tfg::ConvertGenericFunctionToFunctionDef is given empty function attributes, it crashes.
// We pre-allocate the array of operands and populate it using the
// `output_name_to_position` and `control_output_to_position` populated
// previously.
SmallVector<Value> ret_vals(func.ret_size() + func.control_ret_size(),
Value());
for (const auto& ret_val : func.ret()) {
auto position = output_name_to_position.find(ret_val.first);
if (position == output_name_to_position.end())
return InvalidArgument(
"Can't import function, returned value references unknown output "
"argument ",
ret_val.first);
ret_vals[position->second] =
value_manager.GetValueOrCreatePlaceholder(ret_val.second);
}
for (const auto& ret_val : func.control_ret()) {
auto position = control_output_to_position.find(ret_val.first);
if (position == control_output_to_position.end())
return InvalidArgument(
"Can't import function, returned value references unknown output "
"argument ",
ret_val.first);
Value result = value_manager.GetValueOrCreatePlaceholder(
(Twine("^") + ret_val.second).str());
ret_val.second cannot be empty. Neither can input.
// Process every node and create a matching MLIR operation
for (const NodeDef& node : nodes) {
if (node.op().empty()) return InvalidArgument("empty op type");
OperationState state(unknown_loc, absl::StrCat("tfg.", node.op()));
// Fetch the inputs, creating placeholder if an input hasn't been visited.
for (const std::string& input : node.input())
state.operands.push_back(
value_manager.GetValueOrCreatePlaceholder(input));
Patches
We have patched the issue in GitHub commit ad069af92392efee1418c48ff561fd3070a03d7b.
The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Severity
5.9 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow"
},
"ranges": [
{
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow"
},
"ranges": [
{
"events": [
{
"introduced": "2.9.0"
},
{
"fixed": "2.9.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-cpu"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-cpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-cpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.9.0"
},
{
"fixed": "2.9.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-gpu"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-gpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-gpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.9.0"
},
{
"fixed": "2.9.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-36012"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": true,
"github_reviewed_at": "2022-09-16T21:19:48Z",
"nvd_published_at": "2022-09-16T23:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\nWhen [`mlir::tfg::ConvertGenericFunctionToFunctionDef`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/ir/importexport/functiondef_import.cc) is given empty function attributes, it crashes.\n```cpp\n// We pre-allocate the array of operands and populate it using the\n// `output_name_to_position` and `control_output_to_position` populated\n// previously.\nSmallVector\u003cValue\u003e ret_vals(func.ret_size() + func.control_ret_size(),\n Value());\nfor (const auto\u0026 ret_val : func.ret()) {\n auto position = output_name_to_position.find(ret_val.first);\n if (position == output_name_to_position.end())\n return InvalidArgument(\n \"Can\u0027t import function, returned value references unknown output \"\n \"argument \",\n ret_val.first);\n ret_vals[position-\u003esecond] =\n value_manager.GetValueOrCreatePlaceholder(ret_val.second);\n}\nfor (const auto\u0026 ret_val : func.control_ret()) {\n auto position = control_output_to_position.find(ret_val.first);\n if (position == control_output_to_position.end())\n return InvalidArgument(\n \"Can\u0027t import function, returned value references unknown output \"\n \"argument \",\n ret_val.first);\n Value result = value_manager.GetValueOrCreatePlaceholder(\n (Twine(\"^\") + ret_val.second).str());\n```\n`ret_val.second` cannot be empty. Neither can `input`.\n```cpp\n// Process every node and create a matching MLIR operation\nfor (const NodeDef\u0026 node : nodes) {\n if (node.op().empty()) return InvalidArgument(\"empty op type\");\n OperationState state(unknown_loc, absl::StrCat(\"tfg.\", node.op()));\n // Fetch the inputs, creating placeholder if an input hasn\u0027t been visited.\n for (const std::string\u0026 input : node.input())\n state.operands.push_back(\n value_manager.GetValueOrCreatePlaceholder(input));\n```\n\n\n### Patches\nWe have patched the issue in GitHub commit [ad069af92392efee1418c48ff561fd3070a03d7b](https://github.com/tensorflow/tensorflow/commit/ad069af92392efee1418c48ff561fd3070a03d7b).\n\nThe fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.\n\n\n### For more information\nPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.\n",
"id": "GHSA-jvhc-5hhr-w3v5",
"modified": "2022-09-19T19:06:13Z",
"published": "2022-09-16T21:19:48Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-jvhc-5hhr-w3v5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36012"
},
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/commit/ad069af92392efee1418c48ff561fd3070a03d7b"
},
{
"type": "PACKAGE",
"url": "https://github.com/tensorflow/tensorflow"
},
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/ir/importexport/functiondef_import.cc"
},
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/releases/tag/v2.10.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "TensorFlow vulnerable to assertion fail on MLIR empty edge names"
}
GHSA-JW44-XQGM-JXVC
Vulnerability from github – Published: 2025-08-22 18:31 – Updated: 2025-11-26 18:31
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: fix WARN_ON for monitor mode on some devices
On devices without WANT_MONITOR_VIF (and probably without channel context support) we get a WARN_ON for changing the per-link setting of a monitor interface.
Since we already skip AP_VLAN interfaces and MONITOR with WANT_MONITOR_VIF and/or NO_VIRTUAL_MONITOR should update the settings, catch this in the link change code instead of the warning.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-38642"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-22T16:15:38Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix WARN_ON for monitor mode on some devices\n\nOn devices without WANT_MONITOR_VIF (and probably without\nchannel context support) we get a WARN_ON for changing the\nper-link setting of a monitor interface.\n\nSince we already skip AP_VLAN interfaces and MONITOR with\nWANT_MONITOR_VIF and/or NO_VIRTUAL_MONITOR should update\nthe settings, catch this in the link change code instead\nof the warning.",
"id": "GHSA-jw44-xqgm-jxvc",
"modified": "2025-11-26T18:31:00Z",
"published": "2025-08-22T18:31:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38642"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1e10ded6b0f9b0eeefaacbb6c6c6afff3f702812"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c57e5b9819dfd16d709bcd6cb633301ed0829a66"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ff15498ebaa49c5429a74e70a1951dede60cd14c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JWGC-3G48-RWWR
Vulnerability from github – Published: 2023-03-10 21:30 – Updated: 2023-03-16 15:30
VLAI
Details
Transient DOS due to reachable assertion in Modem while processing SIB1 Message.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2022-33254"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-10T21:15:00Z",
"severity": "HIGH"
},
"details": "Transient DOS due to reachable assertion in Modem while processing SIB1 Message.",
"id": "GHSA-jwgc-3g48-rwwr",
"modified": "2023-03-16T15:30:20Z",
"published": "2023-03-10T21:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-33254"
},
{
"type": "WEB",
"url": "https://www.qualcomm.com/company/product-security/bulletins/march-2023-bulletin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JXC4-R8MV-R847
Vulnerability from github – Published: 2022-05-24 19:07 – Updated: 2026-09-16 21:31
VLAI
Details
Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an assertion failure vulnerability in the /nova/bin/console process. An authenticated remote attacker can cause a Denial of Service due to an assertion failure via a crafted packet.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2020-20211"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-07T14:15:00Z",
"severity": "MODERATE"
},
"details": "Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an assertion failure vulnerability in the /nova/bin/console process. An authenticated remote attacker can cause a Denial of Service due to an assertion failure via a crafted packet.",
"id": "GHSA-jxc4-r8mv-r847",
"modified": "2026-09-16T21:31:31Z",
"published": "2022-05-24T19:07:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-20211"
},
{
"type": "WEB",
"url": "https://mikrotik.com"
},
{
"type": "WEB",
"url": "https://seclists.org/fulldisclosure/2020/Apr/7"
},
{
"type": "WEB",
"url": "https://seclists.org/fulldisclosure/2020/Jan/12"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2021/May/0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M2JR-X4GQ-5RMJ
Vulnerability from github – Published: 2026-06-02 00:31 – Updated: 2026-07-09 13:43
VLAI
Summary
SGLang: Reachable Assertion via lora_path in LoRAManager enables remote Denial of Dervice
Details
A security vulnerability has been detected in SGLang 0.5.10.post1. Impacted is an unknown function of the file python/sglang/srt/lora/lora_manager.py of the component Inference HTTP Endpoint. Such manipulation of the argument lora_path leads to reachable assertion. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "sglang"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.5.10.post1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-10300"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-09T13:43:55Z",
"nvd_published_at": "2026-06-01T23:16:19Z",
"severity": "LOW"
},
"details": "A security vulnerability has been detected in SGLang 0.5.10.post1. Impacted is an unknown function of the file python/sglang/srt/lora/lora_manager.py of the component Inference HTTP Endpoint. Such manipulation of the argument lora_path leads to reachable assertion. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.",
"id": "GHSA-m2jr-x4gq-5rmj",
"modified": "2026-07-09T13:43:55Z",
"published": "2026-06-02T00:31:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10300"
},
{
"type": "WEB",
"url": "https://github.com/sgl-project/sglang/issues/23141"
},
{
"type": "WEB",
"url": "https://github.com/sgl-project/sglang/pull/25078"
},
{
"type": "WEB",
"url": "https://github.com/sgl-project/sglang"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-10300"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/828086"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/367593"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/367593/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "SGLang: Reachable Assertion via \u00a0lora_path\u00a0 in LoRAManager enables remote Denial of Dervice"
}
GHSA-M2WV-VGV6-F4HV
Vulnerability from github – Published: 2024-12-19 21:31 – Updated: 2025-05-28 15:33
VLAI
Details
Due to an unchecked buffer length, a specially crafted L2CAP packet can cause a buffer overflow. This buffer overflow triggers an assert, which results in a temporary denial of service.
If a watchdog timer is not enabled, a hard reset is required to recover the device.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-7139"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-19T20:15:08Z",
"severity": "MODERATE"
},
"details": "Due to an unchecked buffer length, a specially crafted L2CAP packet can cause a buffer overflow. This buffer overflow triggers an assert, which results in a temporary denial of service.\u00a0\n\nIf a watchdog timer is not enabled, a hard reset is required to recover the device.",
"id": "GHSA-m2wv-vgv6-f4hv",
"modified": "2025-05-28T15:33:57Z",
"published": "2024-12-19T21:31:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7139"
},
{
"type": "WEB",
"url": "https://community.silabs.com/068Vm00000F9zre"
},
{
"type": "WEB",
"url": "https://community.silabs.com/068Vm00000I5mjD"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M3QQ-9RCV-84V8
Vulnerability from github – Published: 2022-05-24 19:07 – Updated: 2022-05-24 19:07
VLAI
Details
Improper handling of received malformed FTMR request frame can lead to reachable assertion while responding with FTM1 frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
{
"affected": [],
"aliases": [
"CVE-2021-1953"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-13T06:15:00Z",
"severity": "HIGH"
},
"details": "Improper handling of received malformed FTMR request frame can lead to reachable assertion while responding with FTM1 frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wired Infrastructure and Networking",
"id": "GHSA-m3qq-9rcv-84v8",
"modified": "2022-05-24T19:07:45Z",
"published": "2022-05-24T19:07:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1953"
},
{
"type": "WEB",
"url": "https://www.qualcomm.com/company/product-security/bulletins/july-2021-bulletin"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-M3R7-HP4V-Q24G
Vulnerability from github – Published: 2025-10-27 15:30 – Updated: 2025-10-29 12:30
VLAI
Details
Reachable Assertion vulnerability in Open5GS up to version 2.7.5 allows attackers with connectivity to the NRF to cause a denial of service. An SBI request that deletes the NRF's own registry causes a check that ends up crashing the NRF process and renders the discovery service unavailable.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-41067"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-27T13:15:44Z",
"severity": "HIGH"
},
"details": "Reachable Assertion vulnerability in Open5GS up to version 2.7.5 allows attackers with connectivity to the NRF to cause a denial of service. An SBI request that deletes the NRF\u0027s own registry causes a check that ends up crashing the NRF process and renders the discovery service unavailable.",
"id": "GHSA-m3r7-hp4v-q24g",
"modified": "2025-10-29T12:30:25Z",
"published": "2025-10-27T15:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41067"
},
{
"type": "WEB",
"url": "https://open5gs.org/open5gs/release/2025/03/30/release-v2.7.5.html"
},
{
"type": "WEB",
"url": "https://open5gs.org/open5gs/release/2025/07/19/release-v2.7.6.html"
},
{
"type": "WEB",
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-newplanes-open5gs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M424-X6WR-WWGW
Vulnerability from github – Published: 2026-05-08 15:31 – Updated: 2026-09-14 12:31
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
perf/x86/intel/uncore: Fix die ID init and look up bugs
In snbep_pci2phy_map_init(), in the nr_node_ids > 8 path, uncore_device_to_die() may return -1 when all CPUs associated with the UBOX device are offline.
Remove the WARN_ON_ONCE(die_id == -1) check for two reasons:
-
The current code breaks out of the loop. This is incorrect because pci_get_device() does not guarantee iteration in domain or bus order, so additional UBOX devices may be skipped during the scan.
-
Returning -EINVAL is incorrect, since marking offline buses with die_id == -1 is expected and should not be treated as an error.
Separately, when NUMA is disabled on a NUMA-capable platform, pcibus_to_node() returns NUMA_NO_NODE, causing uncore_device_to_die() to return -1 for all PCI devices. As a result, spr_update_device_location(), used on Intel SPR and EMR, ignores the corresponding PMON units and does not add them to the RB tree.
Fix this by using uncore_pcibus_to_dieid(), which retrieves topology from the UBOX GIDNIDMAP register and works regardless of whether NUMA is enabled in Linux. This requires snbep_pci2phy_map_init() to be added in spr_uncore_pci_init().
Keep uncore_device_to_die() only for the nr_node_ids > 8 case, where NUMA is expected to be enabled.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-43344"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-08T14:16:44Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel/uncore: Fix die ID init and look up bugs\n\nIn snbep_pci2phy_map_init(), in the nr_node_ids \u003e 8 path,\nuncore_device_to_die() may return -1 when all CPUs associated\nwith the UBOX device are offline.\n\nRemove the WARN_ON_ONCE(die_id == -1) check for two reasons:\n\n- The current code breaks out of the loop. This is incorrect because\n pci_get_device() does not guarantee iteration in domain or bus order,\n so additional UBOX devices may be skipped during the scan.\n\n- Returning -EINVAL is incorrect, since marking offline buses with\n die_id == -1 is expected and should not be treated as an error.\n\nSeparately, when NUMA is disabled on a NUMA-capable platform,\npcibus_to_node() returns NUMA_NO_NODE, causing uncore_device_to_die()\nto return -1 for all PCI devices. As a result,\nspr_update_device_location(), used on Intel SPR and EMR, ignores the\ncorresponding PMON units and does not add them to the RB tree.\n\nFix this by using uncore_pcibus_to_dieid(), which retrieves topology\nfrom the UBOX GIDNIDMAP register and works regardless of whether NUMA\nis enabled in Linux. This requires snbep_pci2phy_map_init() to be\nadded in spr_uncore_pci_init().\n\nKeep uncore_device_to_die() only for the nr_node_ids \u003e 8 case, where\nNUMA is expected to be enabled.",
"id": "GHSA-m424-x6wr-wwgw",
"modified": "2026-09-14T12:31:28Z",
"published": "2026-05-08T15:31:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43344"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/184870af0e73f8ea2577c751fa098681465249f2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6a5dc3ee97581da2907fc7acd62853f07184de67"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a16d1ec4dd0cdcf689f324adde6067083bce9099"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/bdb35811ff41a1678620a407056b6372f350028a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c79ef3342632e71ac8612a2a1cc17ac84dd258b4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M427-5J3M-C367
Vulnerability from github – Published: 2026-02-13 06:30 – Updated: 2026-03-02 18:31
VLAI
Details
A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected product receives maliciously crafted packets, Vnet/IP software stack process may be terminated. The affected products and versions are as follows: Vnet/IP Interface Package (for CENTUM VP R6 VP6C3300, CENTUM VP R7 VP7C3300) R1.07.00 or earlier
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-48019"
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-13T05:16:09Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation.\nIf affected product receives maliciously crafted packets, Vnet/IP software stack process may be terminated.\nThe affected products and versions are as follows: Vnet/IP Interface Package (for CENTUM VP R6 VP6C3300, CENTUM VP R7 VP7C3300) R1.07.00 or earlier",
"id": "GHSA-m427-5j3m-c367",
"modified": "2026-03-02T18:31:38Z",
"published": "2026-02-13T06:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48019"
},
{
"type": "WEB",
"url": "https://web-material3.yokogawa.com/1/39281/files/YSAR-26-0002-E.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Implementation
Make sensitive open/close operation non reachable by directly user-controlled data (e.g. open/close resources)
Mitigation
Implementation
Strategy: Input Validation
Perform input validation on user data.
No CAPEC attack patterns related to this CWE.