Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-38177: In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: make hfsc_qlen_notify() idempotent CVE-2025-38095: In the Linux kernel, the following vulnerability has been resolved: dma-buf: insert memory barrier before updating num_fences CVE-2025-38023: In the Linux kernel, the following vulnerability has been resolved: nfs: handle failure of nfs_get_lock_context in unlock path CVE-2025-38020: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Disable MACsec offload for uplink representor profile CVE-2025-38018: In the Linux kernel, the following vulnerability has been resolved: net/tls: fix kernel panic when alloc_page failed CVE-2025-37998: In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix unsafe attribute parsing in output_userspace() CVE-2025-37997: In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix region locking in hash types CVE-2025-37995: In the Linux kernel, the following vulnerability has been resolved: module: ensure that kobject_put() is safe for module type kobjects CVE-2025-37992: In the Linux kernel, the following vulnerability has been resolved: net_sched: Flush gso_skb list too during ->change() CVE-2025-37989: In the Linux kernel, the following vulnerability has been resolved: net: phy: leds: fix memory leak CVE-2025-37964: In the Linux kernel, the following vulnerability has been resolved: x86/mm: Eliminate window where TLB flushes may be inadvertently skipped CVE-2025-37963: In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users CVE-2025-37961: In the Linux kernel, the following vulnerability has been resolved: ipvs: fix uninit-value for saddr in do_output_route4 CVE-2025-37959: In the Linux kernel, the following vulnerability has been resolved: bpf: Scrub packet on bpf_redirect_peer CVE-2025-37949: In the Linux kernel, the following vulnerability has been resolved: xenbus: Use kref to track req lifetime CVE-2025-37948: In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs CVE-2025-37940: In the Linux kernel, the following vulnerability has been resolved: ftrace: Add cond_resched() to ftrace_graph_set_hash() CVE-2025-37938: In the Linux kernel, the following vulnerability has been resolved: tracing: Verify event formats that have "%*p.." CVE-2025-37936: In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. CVE-2025-37932: In the Linux kernel, the following vulnerability has been resolved: sch_htb: make htb_qlen_notify() idempotent CVE-2025-37928: In the Linux kernel, the following vulnerability has been resolved: dm-bufio: don't schedule in atomic context CVE-2025-37927: In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid CVE-2025-37923: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix oob write in trace_seq_to_buffer() CVE-2025-37921: In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: Fix unlocked deletion of default FDB entry CVE-2025-37915: In the Linux kernel, the following vulnerability has been resolved: net_sched: drr: Fix double list add in class with netem as child qdisc CVE-2025-37913: In the Linux kernel, the following vulnerability has been resolved: net_sched: qfq: Fix double list add in class with netem as child qdisc CVE-2025-37890: In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc CVE-2025-37885: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Reset IRTE to host control if *new* route isn't postable CVE-2025-37884: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix deadlock between rcu_tasks_trace and event_mutex. CVE-2025-37875: In the Linux kernel, the following vulnerability has been resolved: igc: fix PTM cycle trigger logic CVE-2025-37871: In the Linux kernel, the following vulnerability has been resolved: nfsd: decrease sc_count directly if fail to queue dl_recall CVE-2025-37867: In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Silence oversized kvmalloc() warning CVE-2025-37859: In the Linux kernel, the following vulnerability has been resolved: page_pool: avoid infinite loop to schedule delayed worker CVE-2025-37857: In the Linux kernel, the following vulnerability has been resolved: scsi: st: Fix array overflow in st_setup() CVE-2025-37849: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Tear down vGIC on failed vCPU creation CVE-2025-37844: In the Linux kernel, the following vulnerability has been resolved: cifs: avoid NULL pointer dereference in dbg call CVE-2025-37839: In the Linux kernel, the following vulnerability has been resolved: jbd2: remove wrong sb->s_sequence check CVE-2025-37836: In the Linux kernel, the following vulnerability has been resolved: PCI: Fix reference leak in pci_register_host_bridge() CVE-2025-37823: In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too CVE-2025-37820: In the Linux kernel, the following vulnerability has been resolved: xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() CVE-2025-37819: In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() CVE-2025-37808: In the Linux kernel, the following vulnerability has been resolved: crypto: null - Use spin lock instead of mutex CVE-2025-37798: In the Linux kernel, the following vu
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.1.140-154.222.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.1.140-154.222.amzn2023 |
| Amazon Linux · 2023 | kernel | 0:6.1.140-154.222.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 0:6.1.140-154.222.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 0:6.1.140-154.222.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 0:6.1.140-154.222.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.1.140-154.222.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.1.140-154.222.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.1.140-154.222.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-debuginfo | 0:6.1.140-154.222.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.1.140-154.222.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.1.140-154.222.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.140-154.222 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 0:6.1.140-154.222.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 0:6.1.140-154.222.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.1.140-154.222.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.1.140-154.222.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.1.140-154.222.amzn2023 |
| Amazon Linux · 2023 | perf | 0:6.1.140-154.222.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 0:6.1.140-154.222.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 0:6.1.140-154.222.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 0:6.1.140-154.222.amzn2023 |
Vulnerabilities 72
-
Critical 9.4
bpf: Scrub packet on bpf_redirect_peer
In the Linux kernel, the following vulnerability has been resolved: bpf: Scrub packet on bpf_redirect_peer When bpf_redirect_peer is used to redirect packets to a device in another network namespace, the skb isn't scrubbed. That can lead skb information from …
-
High 8.8
KVM: arm64: Tear down vGIC on failed vCPU creation
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Tear down vGIC on failed vCPU creation If kvm_arch_vcpu_create() fails to share the vCPU page with the hypervisor, we propagate the error back to the ioctl but leave the vGIC vCPU…
-
High 8.8
KVM: x86: Reset IRTE to host control if *new* route isn't postable
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Reset IRTE to host control if *new* route isn't postable Restore an IRTE back to host control (remapped or posted MSI mode) if the *new* GSI route prevents posting the IRQ directly …
-
High 8.7
perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value.
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. When generating the MSR_IA32_PEBS_ENABLE value that will be loaded on VM-Entry to a KVM guest, mask the value with th…
-
High 7.8
net/sched: act_mirred: don't override retval if we already lost the skb
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mirred: don't override retval if we already lost the skb If we're redirecting the skb, and haven't called tcf_mirred_forward(), yet, we need to tell the core to drop the skb by…
-
High 7.8
of: module: add buffer overflow check in of_modalias()
In the Linux kernel, the following vulnerability has been resolved: of: module: add buffer overflow check in of_modalias() In of_modalias(), if the buffer happens to be too small even for the 1st snprintf() call, the len parameter will become negative and str…
-
High 7.8
bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG
In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG When BPF_TRAMP_F_CALL_ORIG is set, the trampoline calls __bpf_tramp_enter() and __bpf_tramp_exit() functions, passing them the struct bpf_…
-
High 7.8
btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info()
In the Linux kernel, the following vulnerability has been resolved: btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info() Instead of doing a BUG_ON() handle the error by returning -EUCLEAN, aborting the transaction and logging an error me…
-
High 7.8
bpf: Prevent tail call between progs attached to different hooks
In the Linux kernel, the following vulnerability has been resolved: bpf: Prevent tail call between progs attached to different hooks bpf progs can be attached to kernel functions, and the attached functions can take different parameters or return different re…
-
High 7.8
sctp: add mutual exclusion in proc_sctp_do_udp_port()
In the Linux kernel, the following vulnerability has been resolved: sctp: add mutual exclusion in proc_sctp_do_udp_port() We must serialize calls to sctp_udp_sock_stop() and sctp_udp_sock_start() or risk a crash as syzbot reported: Oops: general protection fa…
-
High 7.8
KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses Acquire a lock on kvm->srcu when userspace is getting MP state to handle a rather extreme edge case where "acceptin…
-
High 7.8
sctp: detect and prevent references to a freed transport in sendmsg
In the Linux kernel, the following vulnerability has been resolved: sctp: detect and prevent references to a freed transport in sendmsg sctp_sendmsg() re-uses associations and transports when possible by doing a lookup based on the socket endpoint and the mes…
-
High 7.8
ext4: fix off-by-one error in do_split
In the Linux kernel, the following vulnerability has been resolved: ext4: fix off-by-one error in do_split Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split. BUG: KAS…
-
High 7.8
ext4: ignore xattrs past end
In the Linux kernel, the following vulnerability has been resolved: ext4: ignore xattrs past end Once inside 'ext4_xattr_inode_dec_ref_all' we should ignore xattrs entries past the 'end' entry. This fixes the following KASAN reported issue: ==================…
-
High 7.8
net_sched: sch_sfq: move the limit validation
In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: move the limit validation It is not sufficient to directly validate the limit on the data that the user passes as it can be updated based on how the other parameters are c…
-
High 7.8
net: tls: explicitly disallow disconnect
In the Linux kernel, the following vulnerability has been resolved: net: tls: explicitly disallow disconnect syzbot discovered that it can disconnect a TLS socket and then run into all sort of unexpected corner cases. I have a vague recollection of Eric point…
-
High 7.8
net: openvswitch: fix nested key length validation in the set() action
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix nested key length validation in the set() action It's not safe to access nla_len(ovs_key) if the data is smaller than the netlink header. Check that the attribute is OK …
-
High 7.8
net_sched: hfsc: Fix a UAF vulnerability in class handling
In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class handling This patch fixes a Use-After-Free vulnerability in the HFSC qdisc class handling. The issue occurs due to a time-of-check/time-of-us…
-
High 7.8
codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
In the Linux kernel, the following vulnerability has been resolved: codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() After making all ->qlen_notify() callbacks idempotent, now it is safe to remove the check of qlen!=0 from both fq_codel_dequ…
-
High 7.8
net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too Similarly to the previous patch, we need to safe guard hfsc_dequeue() too. But for this one, we don't have a reliable reproducer.
-
High 7.8
net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc
In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report [1], we have a UAF case when an hfsc class has a netem child qdisc. The crux of th…
-
High 7.8
net_sched: qfq: Fix double list add in class with netem as child qdisc
In the Linux kernel, the following vulnerability has been resolved: net_sched: qfq: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue…
-
High 7.8
net_sched: drr: Fix double list add in class with netem as child qdisc
In the Linux kernel, the following vulnerability has been resolved: net_sched: drr: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue…
-
High 7.8
vxlan: vnifilter: Fix unlocked deletion of default FDB entry
In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: Fix unlocked deletion of default FDB entry When a VNI is deleted from a VXLAN device in 'vnifilter' mode, the FDB entry associated with the default remote (assuming one was …
-
High 7.8
tracing: Fix oob write in trace_seq_to_buffer()
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix oob write in trace_seq_to_buffer() syzbot reported this bug: ================================================================== BUG: KASAN: slab-out-of-bounds in trace_seq_to_buf…
-
High 7.8
xenbus: Use kref to track req lifetime
In the Linux kernel, the following vulnerability has been resolved: xenbus: Use kref to track req lifetime Marek reported seeing a NULL pointer fault in the xenbus_thread callstack: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: e030:__w…
-
High 7.8
x86/mm: Eliminate window where TLB flushes may be inadvertently skipped
In the Linux kernel, the following vulnerability has been resolved: x86/mm: Eliminate window where TLB flushes may be inadvertently skipped tl;dr: There is a window in the mm switching code where the new CR3 is set and the CPU should be getting TLB flushes fo…
-
High 7.8
netfilter: ipset: fix region locking in hash types
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix region locking in hash types Region locking introduced in v5.6-rc4 contained three macros to handle the region locks: ahash_bucket_start(), ahash_bucket_end() which gave…
-
High 7.8
openvswitch: Fix unsafe attribute parsing in output_userspace()
In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix unsafe attribute parsing in output_userspace() This patch replaces the manual Netlink attribute iteration in output_userspace() with nla_for_each_nested(), which ensures that…
-
High 7.8
dma-buf: insert memory barrier before updating num_fences
In the Linux kernel, the following vulnerability has been resolved: dma-buf: insert memory barrier before updating num_fences smp_store_mb() inserts memory barrier after storing operation. It is different with what the comment is originally aiming so Null poi…
-
High 7.8
sch_hfsc: make hfsc_qlen_notify() idempotent
In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: make hfsc_qlen_notify() idempotent hfsc_qlen_notify() is not idempotent either and not friendly to its callers, like fq_codel_dequeue(). Let's make it idempotent to ease qdisc_tree_…
-
High 7.5
mptcp: fix NULL pointer in can_accept_new_subflow
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix NULL pointer in can_accept_new_subflow When testing valkey benchmark tool with MPTCP, the kernel panics in 'mptcp_can_accept_new_subflow' because subflow_req->msk is NULL. Call tra…
-
High 7.5
xen-netfront: handle NULL returned by xdp_convert_buff_to_frame()
In the Linux kernel, the following vulnerability has been resolved: xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() The function xdp_convert_buff_to_frame() may return NULL if it fails to correctly convert the XDP buffer into an XDP frame du…
-
High 7.5
nfsd: decrease sc_count directly if fail to queue dl_recall
In the Linux kernel, the following vulnerability has been resolved: nfsd: decrease sc_count directly if fail to queue dl_recall A deadlock warning occurred when invoking nfs4_put_stid following a failed dl_recall queue operation: T1 T2 nfs4_laundromat nfs4_ge…
-
High 7.5
net/tls: fix kernel panic when alloc_page failed
In the Linux kernel, the following vulnerability has been resolved: net/tls: fix kernel panic when alloc_page failed We cannot set frag_list to NULL pointer when alloc_page failed. It will be used in tls_strp_check_queue_ok when the next time tls_strp_read_so…
-
High 7.3
KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state There are several problems with the way hyp code lazily saves the host's FPSIMD/SVE state, including: * Host SVE being discard…
-
High 7.1
blk-iocost: do not WARN if iocg was already offlined
In the Linux kernel, the following vulnerability has been resolved: blk-iocost: do not WARN if iocg was already offlined In iocg_pay_debt(), warn is triggered if 'active_list' is empty, which is intended to confirm iocg is active when it has debt. However, wa…
-
High 7.1
tracing: Verify event formats that have "%*p.."
In the Linux kernel, the following vulnerability has been resolved: tracing: Verify event formats that have "%*p.." The trace event verifier checks the formats of trace events to make sure that they do not point at memory that is not in the trace event itself…
-
Unscored —
mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index
In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index With numa balancing on, when a numa system is running where a numa node doesn't have its local memory so it has no managed…
-
Unscored —
ipv6: Fix potential uninit-value access in __ip6_make_skb()
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix potential uninit-value access in __ip6_make_skb() As it was done in commit fc1092f51567 ("ipv4: Fix uninit-value access in __ip_make_skb()") for IPv4, check FLOWI_FLAG_KNOWN_NH on f…
-
Unscored —
ipv4: Fix uninit-value access in __ip_make_skb()
In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix uninit-value access in __ip_make_skb() KMSAN reported uninit-value access in __ip_make_skb() [1]. __ip_make_skb() tests HDRINCL to know if the skb has icmphdr. However, HDRINCL can …
-
Unscored —
btrfs: fix qgroup reserve leaks in cow_file_range
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix qgroup reserve leaks in cow_file_range In the buffered write path, the dirty page owns the qgroup reserve until it creates an ordered_extent. Therefore, any errors that occur befor…
-
Unscored —
bpf: avoid holding freeze_mutex during mmap operation
In the Linux kernel, the following vulnerability has been resolved: bpf: avoid holding freeze_mutex during mmap operation We use map->freeze_mutex to prevent races between map_freeze() and memory mapping BPF map contents with writable permissions. The way we …
-
Unscored —
hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio
In the Linux kernel, the following vulnerability has been resolved: hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio Commit b15c87263a69 ("hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined) add page poison checks in do_migrate_…
-
Unscored —
md: fix mddev uaf while iterating all_mddevs list
In the Linux kernel, the following vulnerability has been resolved: md: fix mddev uaf while iterating all_mddevs list While iterating all_mddevs list from md_notify_reboot() and md_exit(), list_for_each_entry_safe is used, and this can race with deletint the …
-
Unscored —
i3c: Add NULL pointer check in i3c_master_queue_ibi()
In the Linux kernel, the following vulnerability has been resolved: i3c: Add NULL pointer check in i3c_master_queue_ibi() The I3C master driver may receive an IBI from a target device that has not been probed yet. In such cases, the master calls `i3c_master_q…
-
Unscored —
net: vlan: don't propagate flags on open
In the Linux kernel, the following vulnerability has been resolved: net: vlan: don't propagate flags on open With the device instance lock, there is now a possibility of a deadlock: [ 1.211455] ============================================ [ 1.211571] WARNING:…
-
Unscored —
RDMA/cma: Fix workqueue crash in cma_netevent_work_handler
In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix workqueue crash in cma_netevent_work_handler struct rdma_cm_id has member "struct work_struct net_work" that is reused for enqueuing cma_netevent_work_handler()s onto cma_wq. Be…
-
Unscored —
virtiofs: add filesystem context source name check
In the Linux kernel, the following vulnerability has been resolved: virtiofs: add filesystem context source name check In certain scenarios, for example, during fuzz testing, the source name may be NULL, which could lead to a kernel panic. Therefore, an extra…
-
Unscored —
isofs: Prevent the use of too small fid
In the Linux kernel, the following vulnerability has been resolved: isofs: Prevent the use of too small fid syzbot reported a slab-out-of-bounds Read in isofs_fh_to_parent. [1] The handle_bytes value passed in by the reproducing program is equal to 12. In han…
-
Unscored —
crypto: null - Use spin lock instead of mutex
In the Linux kernel, the following vulnerability has been resolved: crypto: null - Use spin lock instead of mutex As the null algorithm may be freed in softirq context through af_alg, use spin locks instead of mutexes to protect the default null algorithm.
-
Unscored —
irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() With ACPI in place, gicv2m_get_fwnode() is registered with the pci subsystem as pci_msi_get_fwnode_cb(), which may get invoked a…
-
Unscored —
PCI: Fix reference leak in pci_register_host_bridge()
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix reference leak in pci_register_host_bridge() If device_register() fails, call put_device() to give up the reference to avoid a memory leak, per the comment at device_register(). Foun…
-
Unscored —
jbd2: remove wrong sb->s_sequence check
In the Linux kernel, the following vulnerability has been resolved: jbd2: remove wrong sb->s_sequence check Journal emptiness is not determined by sb->s_sequence == 0 but rather by sb->s_start == 0 (which is set a few lines above). Furthermore 0 is a valid tr…
-
Unscored —
cifs: avoid NULL pointer dereference in dbg call
In the Linux kernel, the following vulnerability has been resolved: cifs: avoid NULL pointer dereference in dbg call cifs_server_dbg() implies server to be non-NULL so move call under condition to avoid NULL pointer dereference. Found by Linux Verification Ce…
-
Unscored —
scsi: st: Fix array overflow in st_setup()
In the Linux kernel, the following vulnerability has been resolved: scsi: st: Fix array overflow in st_setup() Change the array size to follow parms size instead of a fixed value.
-
Unscored —
page_pool: avoid infinite loop to schedule delayed worker
In the Linux kernel, the following vulnerability has been resolved: page_pool: avoid infinite loop to schedule delayed worker We noticed the kworker in page_pool_release_retry() was waken up repeatedly and infinitely in production because of the buggy driver …
-
Unscored —
RDMA/core: Silence oversized kvmalloc() warning
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Silence oversized kvmalloc() warning syzkaller triggered an oversized kvmalloc() warning. Silence it by adding __GFP_NOWARN. syzkaller log: WARNING: CPU: 7 PID: 518 at mm/util.c:66…
-
Unscored —
igc: fix PTM cycle trigger logic
In the Linux kernel, the following vulnerability has been resolved: igc: fix PTM cycle trigger logic Writing to clear the PTM status 'valid' bit while the PTM cycle is triggered results in unreliable PTM operation. To fix this, clear the PTM 'trigger' and sta…
-
Unscored —
bpf: Fix deadlock between rcu_tasks_trace and event_mutex.
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix deadlock between rcu_tasks_trace and event_mutex. Fix the following deadlock: CPU A _free_event() perf_kprobe_destroy() mutex_lock(&event_mutex) perf_trace_event_unreg() synchronize_…
-
Unscored —
iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid There is a string parsing logic error which can lead to an overflow of hid or uid buffers. Comparing ACPIID_LEN against a total …
-
Unscored —CVE-2025-37928 Public exploit
dm-bufio: don't schedule in atomic context
In the Linux kernel, the following vulnerability has been resolved: dm-bufio: don't schedule in atomic context A BUG was reported as below when CONFIG_DEBUG_ATOMIC_SLEEP and try_verify_in_tasklet are enabled. [ 129.444685][ T934] BUG: sleeping function called…
-
Unscored —
sch_htb: make htb_qlen_notify() idempotent
In the Linux kernel, the following vulnerability has been resolved: sch_htb: make htb_qlen_notify() idempotent htb_qlen_notify() always deactivates the HTB class and in fact could trigger a warning if it is already deactivated. Therefore, it is not idempotent…
-
Unscored —
ftrace: Add cond_resched() to ftrace_graph_set_hash()
In the Linux kernel, the following vulnerability has been resolved: ftrace: Add cond_resched() to ftrace_graph_set_hash() When the kernel contains a large number of functions that can be traced, the loop in ftrace_graph_set_hash() may take a lot of time to ex…
-
Unscored —
arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs
In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs A malicious BPF program may manipulate the branch history to influence what the hardware speculates will happen next. On exit …
-
Unscored —
ipvs: fix uninit-value for saddr in do_output_route4
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix uninit-value for saddr in do_output_route4 syzbot reports for uninit-value for the saddr argument [1]. commit 4754957f04f5 ("ipvs: do not use random local source address for tunnels…
-
Unscored —
arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users
In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users Support for eBPF programs loaded by unprivileged users is typically disabled. This means only cBPF programs need to be mit…
-
Unscored —
net: phy: leds: fix memory leak
In the Linux kernel, the following vulnerability has been resolved: net: phy: leds: fix memory leak A network restart test on a router led to an out-of-memory condition, which was traced to a memory leak in the PHY LED trigger code. The root cause is misuse o…
-
Unscored —
net_sched: Flush gso_skb list too during ->change()
In the Linux kernel, the following vulnerability has been resolved: net_sched: Flush gso_skb list too during ->change() Previously, when reducing a qdisc's limit via the ->change() operation, only the main skb queue was trimmed, potentially leaving packets in…
-
Unscored —
module: ensure that kobject_put() is safe for module type kobjects
In the Linux kernel, the following vulnerability has been resolved: module: ensure that kobject_put() is safe for module type kobjects In 'lookup_or_create_module_kobject()', an internal kobject is created using 'module_ktype'. So call to 'kobject_put()' on e…
-
Unscored —
net/mlx5e: Disable MACsec offload for uplink representor profile
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Disable MACsec offload for uplink representor profile MACsec offload is not supported in switchdev mode for uplink representors. When switching to the uplink representor profile, t…
-
Unscored —
nfs: handle failure of nfs_get_lock_context in unlock path
In the Linux kernel, the following vulnerability has been resolved: nfs: handle failure of nfs_get_lock_context in unlock path When memory is insufficient, the allocation of nfs_lock_context in nfs_get_lock_context() fails and returns -ENOMEM. If we mistakenl…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26739.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-26783.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36903.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36908.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36927.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-38541.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-43840.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46733.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46751.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-50063.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21853.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21931.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22013.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22062.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22126.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-23141.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-23142.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-23145.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-23147.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-23150.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-23163.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37738.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37752.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37756.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37772.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37773.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37780.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37789.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37797.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37798.html