Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-38498: In the Linux kernel, the following vulnerability has been resolved: do_change_type(): refuse to operate on unmounted/not ours mounts CVE-2025-38430: In the Linux kernel, the following vulnerability has been resolved: nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request CVE-2025-38424: In the Linux kernel, the following vulnerability has been resolved: perf: Fix sample vs do_exit() CVE-2025-38415: In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result of sb_min_blocksize CVE-2025-38403: In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: Clear the vmci transport packet properly when initializing it CVE-2025-38400: In the Linux kernel, the following vulnerability has been resolved: nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. CVE-2025-38399: In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() CVE-2025-38393: In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN CVE-2025-38389: In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix timeline left held on VMA alloc error CVE-2025-38387: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert CVE-2025-38386: In the Linux kernel, the following vulnerability has been resolved: ACPICA: Refuse to evaluate a method if arguments are missing CVE-2025-38382: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix iteration of extrefs during log replay CVE-2025-38375: In the Linux kernel, the following vulnerability has been resolved: virtio-net: ensure the received length does not exceed allocated size CVE-2025-38365: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix a race between renames and directory logging CVE-2025-38352: In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() CVE-2025-38350: In the Linux kernel, the following vulnerability has been resolved: net/sched: Always pass notifications when child class becomes empty CVE-2025-38346: In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix UAF when lookup kallsym after ftrace disabled CVE-2025-38345: In the Linux kernel, the following vulnerability has been resolved: ACPICA: fix acpi operand cache leak in dswstate.c CVE-2025-38344: In the Linux kernel, the following vulnerability has been resolved: ACPICA: fix acpi parse and parseext cache leaks CVE-2025-38342: In the Linux kernel, the following vulnerability has been resolved: software node: Correct a OOB check in software_node_get_reference_args() CVE-2025-38337: In the Linux kernel, the following vulnerability has been resolved: jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() CVE-2025-38324: In the Linux kernel, the following vulnerability has been resolved: mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). CVE-2025-38312: In the Linux kernel, the following vulnerability has been resolved: fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() CVE-2025-38310: In the Linux kernel, the following vulnerability has been resolved: seg6: Fix validation of nexthop addresses CVE-2025-38305: In the Linux kernel, the following vulnerability has been resolved: ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() CVE-2025-38298: In the Linux kernel, the following vulnerability has been resolved: EDAC/skx_common: Fix general protection fault CVE-2025-38285: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix WARN() in get_bpf_raw_tp_regs CVE-2025-38282: In the Linux kernel, the following vulnerability has been resolved: kernfs: Relax constraint in draining guard CVE-2025-38280: In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid __bpf_prog_ret0_warn when jit fails CVE-2025-38263: In the Linux kernel, the following vulnerability has been resolved: bcache: fix NULL pointer in cache_set_flush() CVE-2025-38262: In the Linux kernel, the following vulnerability has been resolved: tty: serial: uartlite: register uart driver in init CVE-2025-38260: In the Linux kernel, the following vulnerability has been resolved: btrfs: handle csum tree error with rescue=ibadroots correctly CVE-2025-38236: In the Linux kernel, the following vulnerability has been resolved: af_unix: Don't leave consecutive consumed OOB skbs. CVE-2025-38231: In the Linux kernel, the following vulnerability has been resolved: nfsd: Initialize ssc before laundromat_work to prevent NULL dereference CVE-2025-38222: In the Linux kernel, the following vulnerability has been resolved: ext4: inline: fix len overflow in ext4_prepare_inline_data CVE-2025-38215: In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var CVE-2025-38214: In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var CVE-2025-38213: In the Linux kernel, the following vulnerability has been resolved: vgacon: Add check for vc_origin address range in vgacon_scroll() CVE-2025-38212: In the Linux kernel, the following vulnerability has been resolved: ipc: fix to protect IPCS lookups using RCU CVE-2025-38211: In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction CVE-2025-38202: In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() CVE-2025-38198: In the
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 1:6.1.144-170.251.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 1:6.1.144-170.251.amzn2023 |
| Amazon Linux · 2023 | kernel | 1:6.1.144-170.251.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 1:6.1.144-170.251.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 1:6.1.144-170.251.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 1:6.1.144-170.251.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 1:6.1.144-170.251.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 1:6.1.144-170.251.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 1:6.1.144-170.251.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-debuginfo | 1:6.1.144-170.251.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 1:6.1.144-170.251.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 1:6.1.144-170.251.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.144-170.251 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 1:6.1.144-170.251.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 1:6.1.144-170.251.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 1:6.1.144-170.251.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 1:6.1.144-170.251.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 1:6.1.144-170.251.amzn2023 |
| Amazon Linux · 2023 | perf | 1:6.1.144-170.251.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 1:6.1.144-170.251.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 1:6.1.144-170.251.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 1:6.1.144-170.251.amzn2023 |
Vulnerabilities 70
-
High 7.8
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() …
KEV Sep 4, 2025 -
Critical 9.8
RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction The commit 59c68ac31e15 ("iw_cm: free cm_id resources on the last deref") simplified cm_id resource management by freeing…
-
Critical 9.8
nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
In the Linux kernel, the following vulnerability has been resolved: nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request If the request being processed is not a v4 compound request, then examining the cstate can have undefined results. This p…
-
Critical 9.4
netfilter: nf_set_pipapo_avx2: fix initial map fill
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_set_pipapo_avx2: fix initial map fill If the first field doesn't cover the entire start map, then we must zero out the remainder, else we leak those bits into the next match rou…
-
Critical 9.4
net: openvswitch: Fix the dead loop of MPLS parse
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix the dead loop of MPLS parse The unexpected MPLS packet may not end with the bottom label stack. When there are many stacks, The label count value has wrapped around. A d…
-
Critical 9.3
Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an…
-
Critical 9.1
btrfs: fix a race between renames and directory logging
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix a race between renames and directory logging We have a race between a rename and directory inode logging that if it happens and we crash/power fail before the rename completes, the…
-
High 8.4
virtio-net: ensure the received length does not exceed allocated size
In the Linux kernel, the following vulnerability has been resolved: virtio-net: ensure the received length does not exceed allocated size In xdp_linearize_page, when reading the following buffers from the ring, we forget to check the received length with the …
-
High 7.8
mm: hugetlb: independent PMD page table shared count
In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: independent PMD page table shared count The folio refcount may be increased unexpectly through try_get_folio() by caller such as split_huge_pages. In huge_pmd_unshare(), we use r…
-
High 7.8
net_sched: prio: fix a race in prio_tune()
In the Linux kernel, the following vulnerability has been resolved: net_sched: prio: fix a race in prio_tune() Gerrard Tai reported a race condition in PRIO, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock roo…
-
High 7.8
mm/hugetlb: unshare page tables during VMA split, not before
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: unshare page tables during VMA split, not before Currently, __split_vma() triggers hugetlb page table unsharing through vm_ops->may_split(). This happens before the VMA lock and r…
-
High 7.8
mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a n…
-
High 7.8
VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify
In the Linux kernel, the following vulnerability has been resolved: VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify During our test, it is found that a warning can be trigger in try_grab_folio as follow: ------------[ cut here ]-------…
-
High 7.8
net_sched: red: fix a race in __red_change()
In the Linux kernel, the following vulnerability has been resolved: net_sched: red: fix a race in __red_change() Gerrard Tai reported a race condition in RED, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock ro…
-
High 7.8
net/mdiobus: Fix potential out-of-bounds read/write access
In the Linux kernel, the following vulnerability has been resolved: net/mdiobus: Fix potential out-of-bounds read/write access When using publicly available tools like 'mdio-tools' to read/write data from/to network interface and its PHY via mdiobus, there is…
-
High 7.8
net_sched: sch_sfq: fix a potential crash on gso_skb handling
In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: fix a potential crash on gso_skb handling SFQ has an assumption of always being able to queue at least one packet. However, after the blamed commit, sch->q.len can be infl…
-
High 7.8
bpf, sockmap: Avoid using sk_socket after free when sending
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Avoid using sk_socket after free when sending The sk->sk_socket is not locked or referenced in backlog thread, and during the call to skb_send_sock(), there is a race condition …
-
High 7.8
RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction Upon RQ destruction if the firmware command fails which is the last resource to be destroyed some SW resources were already …
-
High 7.8
bpf: fix ktls panic with sockmap
In the Linux kernel, the following vulnerability has been resolved: bpf: fix ktls panic with sockmap [ 2172.936997] ------------[ cut here ]------------ [ 2172.936999] kernel BUG at lib/iov_iter.c:629! ...... [ 2172.944996] PKRU: 55555554 [ 2172.945155] Call …
-
High 7.8
net_sched: sch_sfq: reject invalid perturb period
In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: reject invalid perturb period Gerrard Tai reported that SFQ perturb_period has no range check yet, and this can be used to trigger a race condition fixed in a separate pat…
-
High 7.8
ipc: fix to protect IPCS lookups using RCU
In the Linux kernel, the following vulnerability has been resolved: ipc: fix to protect IPCS lookups using RCU syzbot reported that it discovered a use-after-free vulnerability, [0] [0]: https://lore.kernel.org/all/67af13f8.050a0220.21dd3.0038.GAE@google.com/…
-
High 7.8
af_unix: Don't leave consecutive consumed OOB skbs.
In the Linux kernel, the following vulnerability has been resolved: af_unix: Don't leave consecutive consumed OOB skbs. Jann Horn reported a use-after-free in unix_stream_read_generic(). The following sequences reproduce the issue: $ python3 from socket impor…
-
High 7.8
tty: serial: uartlite: register uart driver in init
In the Linux kernel, the following vulnerability has been resolved: tty: serial: uartlite: register uart driver in init When two instances of uart devices are probing, a concurrency race can occur. If one thread calls uart_register_driver function, which firs…
-
High 7.8
ftrace: Fix UAF when lookup kallsym after ftrace disabled
In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix UAF when lookup kallsym after ftrace disabled The following issue happens with a buggy module: BUG: unable to handle page fault for address: ffffffffc05d0218 PGD 1bd66f067 P4D 1bd…
-
High 7.8
net/sched: Always pass notifications when child class becomes empty
In the Linux kernel, the following vulnerability has been resolved: net/sched: Always pass notifications when child class becomes empty Certain classful qdiscs may invoke their classes' dequeue handler on an enqueue operation. This may unexpectedly empty the …
-
High 7.8
btrfs: fix iteration of extrefs during log replay
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix iteration of extrefs during log replay At __inode_add_ref() when processing extrefs, if we jump into the next label we have an undefined value of victim_name.len, since we haven't …
-
High 7.8
ACPICA: Refuse to evaluate a method if arguments are missing
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Refuse to evaluate a method if arguments are missing As reported in [1], a platform firmware update that increased the number of method parameters and forgot to update a least one of …
-
High 7.8
perf: Fix sample vs do_exit()
In the Linux kernel, the following vulnerability has been resolved: perf: Fix sample vs do_exit() Baisheng Gao reported an ARM64 crash, which Mark decoded as being a synchronous external abort -- most likely due to trying to access MMIO in bad ways. The crash…
-
High 7.8
do_change_type(): refuse to operate on unmounted/not ours mounts
In the Linux kernel, the following vulnerability has been resolved: do_change_type(): refuse to operate on unmounted/not ours mounts Ensure that propagation settings can only be changed for mounts located in the caller's mount namespace. This change aligns pe…
-
High 7.5
net: fix udp gso skb_segment after pull from frag_list
In the Linux kernel, the following vulnerability has been resolved: net: fix udp gso skb_segment after pull from frag_list Commit a1e40ac5b5e9 ("net: gso: fix udp gso fraglist segmentation after pull from frag_list") detected invalid geometry in frag_list skb…
-
High 7.5
bpf, sockmap: Fix panic when calling skb_linearize
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix panic when calling skb_linearize The panic can be reproduced by executing the command: ./bench sockmap -c 2 -p 1 -a --rx-verdict-ingress --rx-strp 100000 Then a kernel panic…
-
High 7.5
calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
In the Linux kernel, the following vulnerability has been resolved: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). syzkaller reported a null-ptr-deref in sock_omalloc() while allocating a CALIPSO option. [0] The NULL is of struct sock, which was …
-
High 7.5
NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN We found a few different systems hung up in writeback waiting on the same page lock, and one task waiting on the NFS_LAYOUT_DRAIN bit in pnf…
-
High 7.5
scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() The function core_scsi3_decode_spec_i_port(), in its error code path, unconditionally calls core_scsi3_lunacl_und…
-
High 7.0
software node: Correct a OOB check in software_node_get_reference_args()
In the Linux kernel, the following vulnerability has been resolved: software node: Correct a OOB check in software_node_get_reference_args() software_node_get_reference_args() wants to get @index-th element, so the property value requires at least '(index + 1…
-
Unscored —
xfs: don't walk off the end of a directory data block
In the Linux kernel, the following vulnerability has been resolved: xfs: don't walk off the end of a directory data block This adds sanity checks for xfs_dir2_data_unused and xfs_dir2_data_entry to make sure don't stray beyond valid memory region. Before patc…
-
Unscored —
bpf: Fix kmemleak warning for percpu hashmap
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix kmemleak warning for percpu hashmap Vlad Poenaru reported the following kmemleak issue: unreferenced object 0x606fd7c44ac8 (size 32): backtrace (crc 0): pcpu_alloc_noprof+0x730/0xeb0…
-
Unscored —
net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY
In the Linux kernel, the following vulnerability has been resolved: net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY DSA has 2 kinds of drivers: 1. Those who call dsa_switch_suspend() and dsa_switch_resume() from their de…
-
Unscored —
mm/huge_memory: fix dereferencing invalid pmd migration entry
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix dereferencing invalid pmd migration entry When migrating a THP, concurrent access to the PMD migration entry during a deferred split scan can lead to an invalid address ac…
-
Unscored —
HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() Update struct hid_descriptor to better reflect the mandatory and optional parts of the HID Descriptor as per USB HID 1.11 …
-
Unscored —
net: Fix TOCTOU issue in sk_is_readable()
In the Linux kernel, the following vulnerability has been resolved: net: Fix TOCTOU issue in sk_is_readable() sk->sk_prot->sock_is_readable is a valid function pointer when sk resides in a sockmap. After the last sk_psock_put() (which usually happens when soc…
-
Unscored —
ACPI: CPPC: Fix NULL pointer dereference when nosmp is used
In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Fix NULL pointer dereference when nosmp is used With nosmp in cmdline, other CPUs are not brought up, leaving their cpc_desc_ptr NULL. CPU0's iteration via for_each_possible_cpu()…
-
Unscored —
calipso: Don't call calipso functions for AF_INET sk.
In the Linux kernel, the following vulnerability has been resolved: calipso: Don't call calipso functions for AF_INET sk. syzkaller reported a null-ptr-deref in txopt_get(). [0] The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6…
-
Unscored —
RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work
In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work The cited commit fixed a crash when cma_netevent_callback was called for a cma_id while work on that id from a previous call …
-
Unscored —
fs/ntfs3: handle hdr_first_de() return value
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle hdr_first_de() return value The hdr_first_de() function returns a pointer to a struct NTFS_DE. This pointer may be NULL. To handle the NULL error effectively, it is important…
-
Unscored —
fbcon: Make sure modelist not set on unregistered console
In the Linux kernel, the following vulnerability has been resolved: fbcon: Make sure modelist not set on unregistered console It looks like attempting to write to the "store_modes" sysfs node will run afoul of unregistered consoles: UBSAN: array-index-out-of-…
-
Unscored —
bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() bpf_map_lookup_percpu_elem() helper is also available for sleepable bpf program. When BPF JIT is disabled or under 32-bit…
-
Unscored —CVE-2025-38213 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var If fb_add_videomode() in fb_set_var() fails to allocate memory for fb_videomode, later it may lead to a null-ptr derefer…
-
Unscored —
fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var
In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var If fb_add_videomode() in do_register_framebuffer() fails to allocate memory for fb_videomode, it will later…
-
Unscored —
ext4: inline: fix len overflow in ext4_prepare_inline_data
In the Linux kernel, the following vulnerability has been resolved: ext4: inline: fix len overflow in ext4_prepare_inline_data When running the following code on an ext4 filesystem with inline_data feature enabled, it will lead to the bug below. fd = open("fi…
-
Unscored —
nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
In the Linux kernel, the following vulnerability has been resolved: nfsd: Initialize ssc before laundromat_work to prevent NULL dereference In nfs4_state_start_net(), laundromat_work may access nfsd_ssc through nfs4_laundromat -> nfsd4_ssc_expire_umount. If n…
-
Unscored —
btrfs: handle csum tree error with rescue=ibadroots correctly
In the Linux kernel, the following vulnerability has been resolved: btrfs: handle csum tree error with rescue=ibadroots correctly [BUG] There is syzbot based reproducer that can crash the kernel, with the following call trace: (With some debug output added) D…
-
Unscored —
bcache: fix NULL pointer in cache_set_flush()
In the Linux kernel, the following vulnerability has been resolved: bcache: fix NULL pointer in cache_set_flush() 1. LINE#1794 - LINE#1887 is some codes about function of bch_cache_set_alloc(). 2. LINE#2078 - LINE#2142 is some codes about function of register…
-
Unscored —
bpf: Avoid __bpf_prog_ret0_warn when jit fails
In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid __bpf_prog_ret0_warn when jit fails syzkaller reported an issue: WARNING: CPU: 3 PID: 217 at kernel/bpf/core.c:2357 __bpf_prog_ret0_warn+0xa/0x20 kernel/bpf/core.c:2357 Modules lin…
-
Unscored —
kernfs: Relax constraint in draining guard
In the Linux kernel, the following vulnerability has been resolved: kernfs: Relax constraint in draining guard The active reference lifecycle provides the break/unbreak mechanism but the active reference is not truly active after unbreak -- callers don't use …
-
Unscored —
bpf: Fix WARN() in get_bpf_raw_tp_regs
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix WARN() in get_bpf_raw_tp_regs syzkaller reported an issue: WARNING: CPU: 3 PID: 5971 at kernel/trace/bpf_trace.c:1861 get_bpf_raw_tp_regs+0xa4/0x100 kernel/trace/bpf_trace.c:1861 Mod…
-
Unscored —
EDAC/skx_common: Fix general protection fault
In the Linux kernel, the following vulnerability has been resolved: EDAC/skx_common: Fix general protection fault After loading i10nm_edac (which automatically loads skx_edac_common), if unload only i10nm_edac, then reload it and perform error injection testi…
-
Unscored —
ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use()
In the Linux kernel, the following vulnerability has been resolved: ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() There is no disagreement that we should check both ptp->is_virtual_clock and ptp->n_vclocks to check if the ptp virtual clock is …
-
Unscored —
seg6: Fix validation of nexthop addresses
In the Linux kernel, the following vulnerability has been resolved: seg6: Fix validation of nexthop addresses The kernel currently validates that the length of the provided nexthop address does not exceed the specified length. This can lead to the kernel read…
-
Unscored —
fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
In the Linux kernel, the following vulnerability has been resolved: fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() In fb_find_mode_cvt(), iff mode->refresh somehow happens to be 0x80000000, cvt.f_refresh will become 0 when multiplying it by 2 due…
-
Unscored —
mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
In the Linux kernel, the following vulnerability has been resolved: mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). As syzbot reported [0], mpls_route_input_rcu() can be called from mpls_getroute(), where is under RTNL. net->mpls.platform_label is…
-
Unscored —
jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
In the Linux kernel, the following vulnerability has been resolved: jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() Since handle->h_transaction may be a NULL pointer, so we should change it to call is_handle_aborted(handle) first befor…
-
Unscored —
ACPICA: fix acpi parse and parseext cache leaks
In the Linux kernel, the following vulnerability has been resolved: ACPICA: fix acpi parse and parseext cache leaks ACPICA commit 8829e70e1360c81e7a5a901b5d4f48330e021ea5 I'm Seunghun Han, and I work for National Security Research Institute of South Korea. I …
-
Unscored —
ACPICA: fix acpi operand cache leak in dswstate.c
In the Linux kernel, the following vulnerability has been resolved: ACPICA: fix acpi operand cache leak in dswstate.c ACPICA commit 987a3b5cf7175916e2a4b6ea5b8e70f830dfe732 I found an ACPI cache leak in ACPI early termination and boot continuing case. When ea…
-
Unscored —
RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert The obj_event may be loaded immediately after inserted, then if the list_head is not initialized then we may get a poisonous poi…
-
Unscored —
drm/i915/gt: Fix timeline left held on VMA alloc error
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix timeline left held on VMA alloc error The following error has been reported sporadically by CI when a test unbinds the i915 driver on a ring submission platform: <4> [239.330…
-
Unscored —
nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
In the Linux kernel, the following vulnerability has been resolved: nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. syzbot reported a warning below [1] following a fault injection in nfs_fs_proc_net_init(). [0] When nfs_fs_proc_net_init() f…
-
Unscored —
vsock/vmci: Clear the vmci transport packet properly when initializing it
In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: Clear the vmci transport packet properly when initializing it In vmci_transport_packet_init memset the vmci_transport_packet before populating the fields to avoid any uninitialise…
-
Unscored —
Squashfs: check return result of sb_min_blocksize
In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result of sb_min_blocksize Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug. Syzkaller forks multiple processes which after mounting the Squas…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-36913.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-41013.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-57883.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37807.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37945.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37958.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38083.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38084.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38085.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38102.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38103.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38108.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38111.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38112.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38113.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38115.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38120.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38124.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38146.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38147.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38151.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38154.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38161.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38165.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38166.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38167.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38181.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38193.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38198.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38202.html