Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-39835: In the Linux kernel, the following vulnerability has been resolved: xfs: do not propagate ENODATA disk errors into xattr code CVE-2025-39825: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix race with concurrent opens in rename(2) CVE-2025-39824: In the Linux kernel, the following vulnerability has been resolved: HID: asus: fix UAF via HID_CLAIMED_INPUT validation CVE-2025-39823: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: use array_index_nospec with indices that come from guest CVE-2025-39819: In the Linux kernel, the following vulnerability has been resolved: fs/smb: Fix inconsistent refcnt update CVE-2025-39817: In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare CVE-2025-39813: In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump CVE-2025-39812: In the Linux kernel, the following vulnerability has been resolved: sctp: initialize more fields in sctp_v6_from_sk() CVE-2025-39806: In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() CVE-2025-39800: In the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() CVE-2025-39798: In the Linux kernel, the following vulnerability has been resolved: NFS: Fix the setting of capabilities when automounting a new filesystem CVE-2025-39795: In the Linux kernel, the following vulnerability has been resolved: block: avoid possible overflow for chunk_sectors check in blk_stack_limits() CVE-2025-39783: In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix configfs group list head handling CVE-2025-39782: In the Linux kernel, the following vulnerability has been resolved: jbd2: prevent softlockup in jbd2_log_do_checkpoint() CVE-2025-39773: In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix soft lockup in br_multicast_query_expired() CVE-2025-39770: In the Linux kernel, the following vulnerability has been resolved: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM CVE-2025-39766: In the Linux kernel, the following vulnerability has been resolved: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit CVE-2025-39760: In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing CVE-2025-39759: In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix race between quota disable and quota rescan ioctl CVE-2025-39756: In the Linux kernel, the following vulnerability has been resolved: fs: Prevent file descriptor table allocations exceeding INT_MAX CVE-2025-39749: In the Linux kernel, the following vulnerability has been resolved: rcu: Protect ->defer_qs_iw_pending from data race CVE-2025-39738: In the Linux kernel, the following vulnerability has been resolved: btrfs: do not allow relocation of partially dropped subvolumes CVE-2025-39736: In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock CVE-2025-39724: In the Linux kernel, the following vulnerability has been resolved: serial: 8250: fix panic due to PSLVERR CVE-2025-39718: In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Validate length in packet header before skb_put() CVE-2025-39702: In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time CVE-2025-39697: In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write CVE-2025-39691: In the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free when call bh_read() helper CVE-2025-39689: In the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy hash for reading of filter files CVE-2025-39683: In the Linux kernel, the following vulnerability has been resolved: tracing: Limit access to parser->buffer when trace_get_user failed CVE-2025-39682: In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list CVE-2025-39681: In the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper CVE-2025-39673: In the Linux kernel, the following vulnerability has been resolved: ppp: fix race conditions in ppp_fill_forward_path CVE-2025-38732: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject: don't leak dst refcount for loopback packets CVE-2025-38728: In the Linux kernel, the following vulnerability has been resolved: smb3: fix for slab out of bounds on mount to ksmbd CVE-2025-38724: In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() CVE-2025-38721: In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refcount leak on table dump CVE-2025-38708: In the Linux kernel, the following vulnerability has been resolved: drbd: add missing kref_get in handle_write_conflicts CVE-2025-38707: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add sanity check for file name CVE-2025-38702: In the Linux kernel, the following vulnerability has been resolved: fbdev: fix potential buffer overflow in do_register_framebuffer() CVE-2025-38701: In the Linux kernel, the following vulnerability has been resolved: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr CVE-
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 1:6.1.150-174.273.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 1:6.1.150-174.273.amzn2023 |
| Amazon Linux · 2023 | kernel | 1:6.1.150-174.273.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 1:6.1.150-174.273.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 1:6.1.150-174.273.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 1:6.1.150-174.273.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 1:6.1.150-174.273.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 1:6.1.150-174.273.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 1:6.1.150-174.273.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-debuginfo | 1:6.1.150-174.273.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 1:6.1.150-174.273.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 1:6.1.150-174.273.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.150-174.273 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 1:6.1.150-174.273.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 1:6.1.150-174.273.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 1:6.1.150-174.273.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 1:6.1.150-174.273.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 1:6.1.150-174.273.amzn2023 |
| Amazon Linux · 2023 | perf | 1:6.1.150-174.273.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 1:6.1.150-174.273.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 1:6.1.150-174.273.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 1:6.1.150-174.273.amzn2023 |
Vulnerabilities 54
-
Critical 9.8
tls: fix handling of zero-length records on the rx_list
In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record ha…
KEV Sep 18, 2026 -
Critical 9.8
tls: separate no-async decryption request handling from async
In the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, the handling is much simpler. There's no reference counting, we just need to wait for the completion to…
-
Critical 9.8
smb: client: fix UAF in decryption with multichannel
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in decryption with multichannel After commit f7025d861694 ("smb: client: allocate crypto only for primary server") and commit b0abcd65ec54 ("smb: client: fix UAF in async…
-
Critical 9.8
drbd: add missing kref_get in handle_write_conflicts
In the Linux kernel, the following vulnerability has been resolved: drbd: add missing kref_get in handle_write_conflicts With `two-primaries` enabled, DRBD tries to detect "concurrent" writes and handle write conflicts, so that even if you write to the same s…
-
Critical 9.8
nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SE…
-
Critical 9.8
ppp: fix race conditions in ppp_fill_forward_path
In the Linux kernel, the following vulnerability has been resolved: ppp: fix race conditions in ppp_fill_forward_path ppp_fill_forward_path() has two race conditions: 1. The ppp->channels list can change between list_empty() and list_first_entry(), as ppp_loc…
-
Critical 9.8
ipv6: sr: Fix MAC comparison to be constant-time
In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.
-
Critical 9.4
mptcp: plug races between subflow fail and subflow creation
In the Linux kernel, the following vulnerability has been resolved: mptcp: plug races between subflow fail and subflow creation We have races similar to the one addressed by the previous patch between subflow failing and additional subflow creation. They are …
-
Critical 9.1
smb3: fix for slab out of bounds on mount to ksmbd
In the Linux kernel, the following vulnerability has been resolved: smb3: fix for slab out of bounds on mount to ksmbd With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parse_server_interfaces() (see …
-
High 8.8
HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() A malicious HID device can trigger a slab out-of-bounds during mt_report_fixup() by passing in report descriptor smaller th…
-
High 8.4
vsock/virtio: Validate length in packet header before skb_put()
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Validate length in packet header before skb_put() When receiving a vsock packet in the guest, only the virtqueue buffer size is validated prior to virtio_vsock_skb_rx_put(). Unf…
-
High 8.2
mptcp: make fallback action and fallback decision atomic
In the Linux kernel, the following vulnerability has been resolved: mptcp: make fallback action and fallback decision atomic Syzkaller reported the following splat: WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 __mptcp_do_fallback net/mptcp/protocol.…
-
High 7.8
eventpoll: Fix semi-unbounded recursion
In the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded recursion Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links. Currently, ep_loop_check_proc() ensures that the graph is loop-fre…
-
High 7.8
arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()
In the Linux kernel, the following vulnerability has been resolved: arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() `cpu_switch_to()` and `call_on_irq_stack()` manipulate SP to change to different stacks along with the Shadow Call Stack if it i…
-
High 7.8
fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit This issue triggers when a userspace program does an ioctl FBIOPUT_CON2FBMAP by passing console number and frame buffer number. Ideall…
-
High 7.8
tracing: Limit access to parser->buffer when trace_get_user failed
In the Linux kernel, the following vulnerability has been resolved: tracing: Limit access to parser->buffer when trace_get_user failed When the length of the string written to set_ftrace_filter exceeds FTRACE_BUFF_MAX, the following KASAN alarm will be trigge…
-
High 7.8
ftrace: Also allocate and copy hash for reading of filter files
In the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy hash for reading of filter files Currently the reader of set_ftrace_filter and set_ftrace_notrace just adds the pointer to the global tracer hash to its iterato…
-
High 7.8
fs/buffer: fix use-after-free when call bh_read() helper
In the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free when call bh_read() helper There's issue as follows: BUG: KASAN: stack-out-of-bounds in end_buffer_read_sync+0xe3/0x110 Read of size 8 at addr ffffc9000168f7f8 b…
-
High 7.8
NFS: Fix a race when updating an existing write
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothing prevents a call to nfs_inode_remove_…
-
High 7.8
btrfs: abort transaction on unexpected eb generation at btrfs_copy_root()
In the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() If we find an unexpected generation for the extent buffer we are cloning at btrfs_copy_root(), we just WARN_ON() and …
-
High 7.8
smb: client: fix race with concurrent opens in rename(2)
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix race with concurrent opens in rename(2) Besides sending the rename request to the server, the rename process also involves closing any deferred close, waiting for outstanding…
-
High 7.5
net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
In the Linux kernel, the following vulnerability has been resolved: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM When performing Generic Segmentation Offload (GSO) on an IPv6 packet that contains extension headers, the kernel incor…
-
High 7.3
btrfs: do not allow relocation of partially dropped subvolumes
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not allow relocation of partially dropped subvolumes [BUG] There is an internal report that balance triggered transaction abort, with the following call trace: item 85 key (59450982…
-
High 7.3
NFS: Fix the setting of capabilities when automounting a new filesystem
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix the setting of capabilities when automounting a new filesystem Capabilities cannot be inherited when we cross into a new filesystem. They need to be reset to the minimal defaults, an…
-
High 7.1
fs/ntfs3: Add sanity check for file name
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add sanity check for file name The length of the file name should be smaller than the directory entry size.
-
High 7.1
efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on master as well): BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe…
-
Unscored —CVE-2025-38676 Public exploit
iommu/amd: Avoid stack buffer overflow from kernel cmdline
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Avoid stack buffer overflow from kernel cmdline While the kernel command line is considered trusted in most environments, avoid writing 1 byte past the end of "acpiid" if the "str"…
-
Unscored —
mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd()
In the Linux kernel, the following vulnerability has been resolved: mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() Memory hot remove unmaps and tears down various kernel page table regions as required. The ptdump code can race with concurren…
-
Unscored —
hv_netvsc: Fix panic during namespace deletion with VF
In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix panic during namespace deletion with VF The existing code move the VF NIC to new namespace when NETDEV_REGISTER is received on netvsc NIC. During deletion of the namespace, def…
-
Unscored —
net/sched: ets: use old 'nbands' while purging unused classes
In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: use old 'nbands' while purging unused classes Shuang reported sch_ets test-case [1] crashing in ets_class_qlen_notify() after recent changes from Lion [2]. The problem is: in …
-
Unscored —
pNFS: Fix uninited ptr deref in block/scsi layout
In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix uninited ptr deref in block/scsi layout The error occurs on the third attempt to encode extents. When function ext_tree_prepare_commit() reallocates a larger buffer to retry encodin…
-
Unscored —
scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated In case of an ib_fast_reg_mr allocation failure during iSER setup, the machine hits a panic because iscsi_conn->dd_d…
-
Unscored —
ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
In the Linux kernel, the following vulnerability has been resolved: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr A syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data() when an inode had the INLINE_DATA_FL flag set but was missin…
-
Unscored —
fbdev: fix potential buffer overflow in do_register_framebuffer()
In the Linux kernel, the following vulnerability has been resolved: fbdev: fix potential buffer overflow in do_register_framebuffer() The current implementation may lead to buffer overflow when: 1. Unregistration creates NULL gaps in registered_fb[] 2. All ar…
-
Unscored —
netfilter: ctnetlink: fix refcount leak on table dump
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refcount leak on table dump There is a reference count leak in ctnetlink_dump_table(): if (res < 0) { nf_conntrack_get(&ct->ct_general); // HERE cb->args[1] = (unsig…
-
Unscored —
netfilter: nf_reject: don't leak dst refcount for loopback packets
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject: don't leak dst refcount for loopback packets recent patches to add a WARN() when replacing skb dst entry found an old bug: WARNING: include/linux/skbuff.h:1165 skb_dst_c…
-
Unscored —
x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper
In the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper Since 923f3a2b48bd ("x86/resctrl: Query LLC monitoring properties once during boot") resctrl_cpu_detect() has been moved fro…
-
Unscored —
serial: 8250: fix panic due to PSLVERR
In the Linux kernel, the following vulnerability has been resolved: serial: 8250: fix panic due to PSLVERR When the PSLVERR_RESP_EN parameter is set to 1, the device generates an error response if an attempt is made to read an empty RBR (Receive Buffer Regist…
-
Unscored —
mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock When netpoll is enabled, calling pr_warn_once() while holding kmemleak_lock in mem_pool_alloc() can cause a deadlock due …
-
Unscored —
rcu: Protect ->defer_qs_iw_pending from data race
In the Linux kernel, the following vulnerability has been resolved: rcu: Protect ->defer_qs_iw_pending from data race On kernels built with CONFIG_IRQ_WORK=y, when rcu_read_unlock() is invoked within an interrupts-disabled region of code [1], it will invoke r…
-
Unscored —
fs: Prevent file descriptor table allocations exceeding INT_MAX
In the Linux kernel, the following vulnerability has been resolved: fs: Prevent file descriptor table allocations exceeding INT_MAX When sysctl_nr_open is set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file d…
-
Unscored —
btrfs: qgroup: fix race between quota disable and quota rescan ioctl
In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix race between quota disable and quota rescan ioctl There's a race between a task disabling quotas and another running the rescan ioctl that can result in a use-after-free of…
-
Unscored —
usb: core: config: Prevent OOB read in SS endpoint companion parsing
In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buf…
-
Unscored —
net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
In the Linux kernel, the following vulnerability has been resolved: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit The following setup can trigger a WARNING in htb_activate due to the condition: !cl->leaf.q->q.qlen tc qdisc del dev lo …
-
Unscored —
net: bridge: fix soft lockup in br_multicast_query_expired()
In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix soft lockup in br_multicast_query_expired() When set multicast_query_interval to a large value, the local variable 'time' in br_multicast_send_query() may overflow. If the ti…
-
Unscored —
jbd2: prevent softlockup in jbd2_log_do_checkpoint()
In the Linux kernel, the following vulnerability has been resolved: jbd2: prevent softlockup in jbd2_log_do_checkpoint() Both jbd2_log_do_checkpoint() and jbd2_journal_shrink_checkpoint_list() periodically release j_list_lock after processing a batch of buffe…
-
Unscored —
PCI: endpoint: Fix configfs group list head handling
In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix configfs group list head handling Doing a list_del() on the epf_group field of struct pci_epf_driver in pci_epf_remove_cfs() is not correct as this field is a list head, no…
-
Unscored —
block: avoid possible overflow for chunk_sectors check in blk_stack_limits()
In the Linux kernel, the following vulnerability has been resolved: block: avoid possible overflow for chunk_sectors check in blk_stack_limits() In blk_stack_limits(), we check that the t->chunk_sectors value is a multiple of the t->physical_block_size value.…
-
Unscored —
sctp: initialize more fields in sctp_v6_from_sk()
In the Linux kernel, the following vulnerability has been resolved: sctp: initialize more fields in sctp_v6_from_sk() syzbot found that sin6_scope_id was not properly initialized, leading to undefined behavior. Clear sin6_scope_id and sin6_flowinfo. BUG: KMSA…
-
Unscored —
ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump When calling ftrace_dump_one() concurrently with reading trace_pipe, a WARN_ON_ONCE() in trace_printk_seq() can be trigger…
-
Unscored —
fs/smb: Fix inconsistent refcnt update
In the Linux kernel, the following vulnerability has been resolved: fs/smb: Fix inconsistent refcnt update A possible inconsistent update of refcount was identified in `smb2_compound_op`. Such inconsistent update could lead to possible resource leaks. Why it …
-
Unscored —
KVM: x86: use array_index_nospec with indices that come from guest
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: use array_index_nospec with indices that come from guest min and dest_id are guest-controlled indices. Using array_index_nospec() after the bounds checks clamps these values to miti…
-
Unscored —
HID: asus: fix UAF via HID_CLAIMED_INPUT validation
In the Linux kernel, the following vulnerability has been resolved: HID: asus: fix UAF via HID_CLAIMED_INPUT validation After hid_hw_start() is called hidinput_connect() will eventually be called to set up the device with the input layer since the HID_CONNECT…
-
Unscored —
xfs: do not propagate ENODATA disk errors into xattr code
In the Linux kernel, the following vulnerability has been resolved: xfs: do not propagate ENODATA disk errors into xattr code ENODATA (aka ENOATTR) has a very specific meaning in the xfs xattr code; namely, that the requested attribute name could not be found…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-58240.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37750.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38491.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38552.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38614.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38670.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38676.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38681.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38683.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38684.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38685.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38691.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38700.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38701.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38702.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38707.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38708.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38721.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38724.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38728.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38732.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39673.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39681.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39682.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39683.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39689.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39691.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39697.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39702.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39718.html