Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-38177: In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: make hfsc_qlen_notify() idempotent CVE-2025-37999: In the Linux kernel, the following vulnerability has been resolved: fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio() CVE-2025-37998: In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix unsafe attribute parsing in output_userspace() CVE-2025-37997: In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix region locking in hash types CVE-2025-37995: In the Linux kernel, the following vulnerability has been resolved: module: ensure that kobject_put() is safe for module type kobjects CVE-2025-37989: In the Linux kernel, the following vulnerability has been resolved: net: phy: leds: fix memory leak CVE-2025-37988: In the Linux kernel, the following vulnerability has been resolved: fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() CVE-2025-37986: In the Linux kernel, the following vulnerability has been resolved: usb: typec: class: Invalidate USB device pointers on partner unregistration CVE-2025-37964: In the Linux kernel, the following vulnerability has been resolved: x86/mm: Eliminate window where TLB flushes may be inadvertently skipped CVE-2025-37963: In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users CVE-2025-37961: In the Linux kernel, the following vulnerability has been resolved: ipvs: fix uninit-value for saddr in do_output_route4 CVE-2025-37960: In the Linux kernel, the following vulnerability has been resolved: memblock: Accept allocated memory before use in memblock_double_array() CVE-2025-37959: In the Linux kernel, the following vulnerability has been resolved: bpf: Scrub packet on bpf_redirect_peer CVE-2025-37958: In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix dereferencing invalid pmd migration entry CVE-2025-37957: In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception CVE-2025-37955: In the Linux kernel, the following vulnerability has been resolved: virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable() CVE-2025-37954: In the Linux kernel, the following vulnerability has been resolved: smb: client: Avoid race in open_cached_dir with lease breaks CVE-2025-37949: In the Linux kernel, the following vulnerability has been resolved: xenbus: Use kref to track req lifetime CVE-2025-37948: In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs CVE-2025-37938: In the Linux kernel, the following vulnerability has been resolved: tracing: Verify event formats that have "%*p.." CVE-2025-37936: In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. CVE-2025-37932: In the Linux kernel, the following vulnerability has been resolved: sch_htb: make htb_qlen_notify() idempotent CVE-2025-37931: In the Linux kernel, the following vulnerability has been resolved: btrfs: adjust subpage bit start based on sectorsize CVE-2025-37929: In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays CVE-2025-37928: In the Linux kernel, the following vulnerability has been resolved: dm-bufio: don't schedule in atomic context CVE-2025-37927: In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid CVE-2025-37923: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix oob write in trace_seq_to_buffer() CVE-2025-37921: In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: Fix unlocked deletion of default FDB entry CVE-2025-37920: In the Linux kernel, the following vulnerability has been resolved: xsk: Fix race condition in AF_XDP generic RX path CVE-2025-37915: In the Linux kernel, the following vulnerability has been resolved: net_sched: drr: Fix double list add in class with netem as child qdisc CVE-2025-37914: In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: Fix double list add in class with netem as child qdisc CVE-2025-37913: In the Linux kernel, the following vulnerability has been resolved: net_sched: qfq: Fix double list add in class with netem as child qdisc CVE-2025-37908: In the Linux kernel, the following vulnerability has been resolved: mm, slab: clean up slab->obj_exts always CVE-2025-37900: In the Linux kernel, the following vulnerability has been resolved: iommu: Fix two issues in iommu_copy_struct_from_user() CVE-2025-37894: In the Linux kernel, the following vulnerability has been resolved: net: use sock_gen_put() when sk_state is TCP_TIME_WAIT CVE-2025-37890: In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc CVE-2025-37888: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() CVE-2025-37885: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Reset IRTE to host control if *new* route isn't postable CVE-2025-37884: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix deadlock between rcu_tasks_trace and event_mutex. CVE-2025-37882: In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix isochronous Ring Underrun/Overrun event handling CVE-2025-37878: In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init CVE-2025-37877: In the Linux
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 0:6.12.29-33.102.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 0:6.12.29-33.102.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 0:6.12.29-33.102.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 0:6.12.29-33.102.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 0:6.12.29-33.102.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-debuginfo | 0:6.12.29-33.102.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 0:6.12.29-33.102.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 0:6.12.29-33.102.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.12.29-33.102 | 0:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 0:6.12.29-33.102.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 0:6.12.29-33.102.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 0:6.12.29-33.102.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 0:6.12.29-33.102.amzn2023 |
| Amazon Linux · 2023 | kernel6.12 | 0:6.12.29-33.102.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo | 0:6.12.29-33.102.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-aarch64 | 0:6.12.29-33.102.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-x86_64 | 0:6.12.29-33.102.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-modules-extra | 0:6.12.29-33.102.amzn2023 |
| Amazon Linux · 2023 | perf6.12 | 0:6.12.29-33.102.amzn2023 |
| Amazon Linux · 2023 | perf6.12-debuginfo | 0:6.12.29-33.102.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12 | 0:6.12.29-33.102.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12-debuginfo | 0:6.12.29-33.102.amzn2023 |
Vulnerabilities 66
-
Critical 9.8
net: use sock_gen_put() when sk_state is TCP_TIME_WAIT
In the Linux kernel, the following vulnerability has been resolved: net: use sock_gen_put() when sk_state is TCP_TIME_WAIT It is possible for a pointer of type struct inet_timewait_sock to be returned from the functions __inet_lookup_established() and __inet6…
-
Critical 9.4
bpf: Scrub packet on bpf_redirect_peer
In the Linux kernel, the following vulnerability has been resolved: bpf: Scrub packet on bpf_redirect_peer When bpf_redirect_peer is used to redirect packets to a device in another network namespace, the skb isn't scrubbed. That can lead skb information from …
-
High 8.8
KVM: x86: Reset IRTE to host control if *new* route isn't postable
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Reset IRTE to host control if *new* route isn't postable Restore an IRTE back to host control (remapped or posted MSI mode) if the *new* GSI route prevents posting the IRQ directly …
-
High 8.8
KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception Previously, commit ed129ec9057f ("KVM: x86: forcibly leave nested mode on vCPU reset") addressed an issue where a triple fault occur…
-
High 8.7
perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value.
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. When generating the MSR_IA32_PEBS_ENABLE value that will be loaded on VM-Entry to a KVM guest, mask the value with th…
-
High 8.6
bnxt_en: Mask the bd_cnt field in the TX BD properly
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Mask the bd_cnt field in the TX BD properly The bd_cnt field in the TX BD specifies the total number of BDs for the TX packet. The bd_cnt field has 5 bits and the maximum number supp…
-
High 8.6
vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp
In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp vmxnet3 driver's XDP handling is buggy for packet sizes using ring0 (that is, packet sizes between 128 - 3k bytes). We noticed MTU-…
-
High 7.8
btrfs: do proper folio cleanup when cow_file_range() failed
In the Linux kernel, the following vulnerability has been resolved: btrfs: do proper folio cleanup when cow_file_range() failed [BUG] When testing with COW fixup marked as BUG_ON() (this is involved with the new pin_user_pages*() change, which should not resu…
-
High 7.8
kernel: be more careful about dup_mmap() failures and uprobe registering
In the Linux kernel, the following vulnerability has been resolved: kernel: be more careful about dup_mmap() failures and uprobe registering If a memory allocation fails during dup_mmap(), the maple tree can be left in an unsafe state for other iterators besi…
-
High 7.8
net: better track kernel sockets lifetime
In the Linux kernel, the following vulnerability has been resolved: net: better track kernel sockets lifetime While kernel sockets are dismantled during pernet_operations->exit(), their freeing can be delayed by any tx packets still held in qdisc or device qu…
-
High 7.8
net_sched: hfsc: Fix a UAF vulnerability in class handling
In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class handling This patch fixes a Use-After-Free vulnerability in the HFSC qdisc class handling. The issue occurs due to a time-of-check/time-of-us…
-
High 7.8
usb: xhci: Fix invalid pointer dereference in Etron workaround
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix invalid pointer dereference in Etron workaround This check is performed before prepare_transfer() and prepare_ring(), so enqueue can already point at the final link TRB of a se…
-
High 7.8
tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT
In the Linux kernel, the following vulnerability has been resolved: tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT This requirement was overeagerly loosened in commit 2f83e38a095f ("tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN"…
-
High 7.8
net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too Similarly to the previous patch, we need to safe guard hfsc_dequeue() too. But for this one, we don't have a reliable reproducer.
-
High 7.8
usb: xhci: Fix isochronous Ring Underrun/Overrun event handling
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix isochronous Ring Underrun/Overrun event handling The TRB pointer of these events points at enqueue at the time of error occurrence on xHCI 1.1+ HCs or it's NULL on older ones. …
-
High 7.8
net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc
In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report [1], we have a UAF case when an hfsc class has a netem child qdisc. The crux of th…
-
High 7.8
mm, slab: clean up slab->obj_exts always
In the Linux kernel, the following vulnerability has been resolved: mm, slab: clean up slab->obj_exts always When memory allocation profiling is disabled at runtime or due to an error, shutdown_mem_profiling() is called: slab->obj_exts which previously alloca…
-
High 7.8
net_sched: qfq: Fix double list add in class with netem as child qdisc
In the Linux kernel, the following vulnerability has been resolved: net_sched: qfq: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue…
-
High 7.8
net_sched: ets: Fix double list add in class with netem as child qdisc
In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue…
-
High 7.8
net_sched: drr: Fix double list add in class with netem as child qdisc
In the Linux kernel, the following vulnerability has been resolved: net_sched: drr: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue…
-
High 7.8
xsk: Fix race condition in AF_XDP generic RX path
In the Linux kernel, the following vulnerability has been resolved: xsk: Fix race condition in AF_XDP generic RX path Move rx_lock from xsk_socket to xsk_buff_pool. Fix synchronization for shared umem mode in generic RX path where multiple sockets share singl…
-
High 7.8
vxlan: vnifilter: Fix unlocked deletion of default FDB entry
In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: Fix unlocked deletion of default FDB entry When a VNI is deleted from a VXLAN device in 'vnifilter' mode, the FDB entry associated with the default remote (assuming one was …
-
High 7.8
tracing: Fix oob write in trace_seq_to_buffer()
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix oob write in trace_seq_to_buffer() syzbot reported this bug: ================================================================== BUG: KASAN: slab-out-of-bounds in trace_seq_to_buf…
-
High 7.8
xenbus: Use kref to track req lifetime
In the Linux kernel, the following vulnerability has been resolved: xenbus: Use kref to track req lifetime Marek reported seeing a NULL pointer fault in the xenbus_thread callstack: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: e030:__w…
-
High 7.8
x86/mm: Eliminate window where TLB flushes may be inadvertently skipped
In the Linux kernel, the following vulnerability has been resolved: x86/mm: Eliminate window where TLB flushes may be inadvertently skipped tl;dr: There is a window in the mm switching code where the new CR3 is set and the CPU should be getting TLB flushes fo…
-
High 7.8
fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount()
In the Linux kernel, the following vulnerability has been resolved: fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() Normally do_lock_mount(path, _) is locking a mountpoint pinned by *path and at the time when matching unlock_mount() unlo…
-
High 7.8
netfilter: ipset: fix region locking in hash types
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix region locking in hash types Region locking introduced in v5.6-rc4 contained three macros to handle the region locks: ahash_bucket_start(), ahash_bucket_end() which gave…
-
High 7.8
openvswitch: Fix unsafe attribute parsing in output_userspace()
In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix unsafe attribute parsing in output_userspace() This patch replaces the manual Netlink attribute iteration in output_userspace() with nla_for_each_nested(), which ensures that…
-
High 7.8
sch_hfsc: make hfsc_qlen_notify() idempotent
In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: make hfsc_qlen_notify() idempotent hfsc_qlen_notify() is not idempotent either and not friendly to its callers, like fq_codel_dequeue(). Let's make it idempotent to ease qdisc_tree_…
-
High 7.5
xen-netfront: handle NULL returned by xdp_convert_buff_to_frame()
In the Linux kernel, the following vulnerability has been resolved: xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() The function xdp_convert_buff_to_frame() may return NULL if it fails to correctly convert the XDP buffer into an XDP frame du…
-
High 7.5
smb: client: Avoid race in open_cached_dir with lease breaks
In the Linux kernel, the following vulnerability has been resolved: smb: client: Avoid race in open_cached_dir with lease breaks A pre-existing valid cfid returned from find_or_create_cached_dir might race with a lease break, meaning open_cached_dir doesn't c…
-
High 7.3
btrfs: adjust subpage bit start based on sectorsize
In the Linux kernel, the following vulnerability has been resolved: btrfs: adjust subpage bit start based on sectorsize When running machines with 64k page size and a 16k nodesize we started seeing tree log corruption in production. This turned out to be beca…
-
High 7.1
driver core: fix potential NULL pointer dereference in dev_uevent()
In the Linux kernel, the following vulnerability has been resolved: driver core: fix potential NULL pointer dereference in dev_uevent() If userspace reads "uevent" device attribute at the same time as another threads unbinds the device from its driver, change…
-
High 7.1
tracing: Verify event formats that have "%*p.."
In the Linux kernel, the following vulnerability has been resolved: tracing: Verify event formats that have "%*p.." The trace event verifier checks the formats of trace events to make sure that they do not point at memory that is not in the trace event itself…
-
High 7.0
netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS
In the Linux kernel, the following vulnerability has been resolved: netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS When testing a special config: CONFIG_NETFS_SUPPORTS=y CONFIG_PROC_FS=n The system crashes with something like: [ 3.766197] ------------[…
-
Medium 5.5
iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE There is a WARN_ON_ONCE to catch an unlikely situation when domain_remove_dev_pasid can't find the `pasid`. In case it nevertheless happens we…
-
Unscored —
block: fix queue freeze vs limits lock order in sysfs store methods
In the Linux kernel, the following vulnerability has been resolved: block: fix queue freeze vs limits lock order in sysfs store methods queue_attr_store() always freezes a device queue before calling the attribute store operation. For attributes that control …
-
Unscored —
block: mark GFP_NOIO around sysfs ->store()
In the Linux kernel, the following vulnerability has been resolved: block: mark GFP_NOIO around sysfs ->store() sysfs ->store is called with queue freezed, meantime we have several ->store() callbacks(update_nr_requests, wbt, scheduler) to allocate memory wit…
-
Unscored —
ext4: goto right label 'out_mmap_sem' in ext4_setattr()
In the Linux kernel, the following vulnerability has been resolved: ext4: goto right label 'out_mmap_sem' in ext4_setattr() Otherwise, if ext4_inode_attach_jinode() fails, a hung task will happen because filemap_invalidate_unlock() isn't called to unlock mapp…
-
Unscored —
fs/ntfs3: Keep write operations atomic
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Keep write operations atomic syzbot reported a NULL pointer dereference in __generic_file_write_iter. [1] Before the write operation is completed, the user executes ioctl[2] to clea…
-
Unscored —
bpf: Fix kmemleak warning for percpu hashmap
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix kmemleak warning for percpu hashmap Vlad Poenaru reported the following kmemleak issue: unreferenced object 0x606fd7c44ac8 (size 32): backtrace (crc 0): pcpu_alloc_noprof+0x730/0xeb0…
-
Unscored —
crypto: null - Use spin lock instead of mutex
In the Linux kernel, the following vulnerability has been resolved: crypto: null - Use spin lock instead of mutex As the null algorithm may be freed in softirq context through af_alg, use spin locks instead of mutexes to protect the default null algorithm.
-
Unscored —
usb: typec: class: Fix NULL pointer access
In the Linux kernel, the following vulnerability has been resolved: usb: typec: class: Fix NULL pointer access Concurrent calls to typec_partner_unlink_device can lead to a NULL pointer dereference. This patch adds a mutex to protect USB device pointers and p…
-
Unscored —
irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() With ACPI in place, gicv2m_get_fwnode() is registered with the pci subsystem as pci_msi_get_fwnode_cb(), which may get invoked a…
-
Unscored —
sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash
In the Linux kernel, the following vulnerability has been resolved: sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash There is a code path in dequeue_entities() that can set the slice of a sched_entity to U64_MAX, which sometimes results in …
-
Unscored —
btrfs: zoned: return EIO on RAID1 block group write pointer mismatch
In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: return EIO on RAID1 block group write pointer mismatch There was a bug report about a NULL pointer dereference in __btrfs_add_free_space_zoned() that ultimately happens because …
-
Unscored —
mm/vmscan: don't try to reclaim hwpoison folio
In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: don't try to reclaim hwpoison folio Syzkaller reports a bug as follows: Injecting memory failure for pfn 0x18b00e at process virtual address 0x20ffd000 Memory failure: 0x18b00e: di…
-
Unscored —
iommu: Clear iommu-dma ops on cleanup
In the Linux kernel, the following vulnerability has been resolved: iommu: Clear iommu-dma ops on cleanup If iommu_device_register() encounters an error, it can end up tearing down already-configured groups and default domains, however this currently still le…
-
Unscored —
perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init
In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init Move the get_ctx(child_ctx) call and the child_event->ctx assignment to occur immediately after the child event is allocated. E…
-
Unscored —
bpf: Fix deadlock between rcu_tasks_trace and event_mutex.
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix deadlock between rcu_tasks_trace and event_mutex. Fix the following deadlock: CPU A _free_event() perf_kprobe_destroy() mutex_lock(&event_mutex) perf_trace_event_unreg() synchronize_…
-
Unscored —
net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table()
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() Add NULL check for mlx5_get_flow_namespace() returns in mlx5_create_inner_ttc_table() and mlx5_create_ttc_table() to prevent N…
-
Unscored —
iommu: Fix two issues in iommu_copy_struct_from_user()
In the Linux kernel, the following vulnerability has been resolved: iommu: Fix two issues in iommu_copy_struct_from_user() In the review for iommu_copy_struct_to_user() helper, Matt pointed out that a NULL pointer should be rejected prior to dereferencing it:…
-
Unscored —
iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid There is a string parsing logic error which can lead to an overflow of hid or uid buffers. Comparing ACPIID_LEN against a total …
-
Unscored —CVE-2025-37928 Public exploit
dm-bufio: don't schedule in atomic context
In the Linux kernel, the following vulnerability has been resolved: dm-bufio: don't schedule in atomic context A BUG was reported as below when CONFIG_DEBUG_ATOMIC_SLEEP and try_verify_in_tasklet are enabled. [ 129.444685][ T934] BUG: sleeping function called…
-
Unscored —
arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays
In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays Commit a5951389e58d ("arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists") added some additional CPUs …
-
Unscored —
sch_htb: make htb_qlen_notify() idempotent
In the Linux kernel, the following vulnerability has been resolved: sch_htb: make htb_qlen_notify() idempotent htb_qlen_notify() always deactivates the HTB class and in fact could trigger a warning if it is already deactivated. Therefore, it is not idempotent…
-
Unscored —
arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs
In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs A malicious BPF program may manipulate the branch history to influence what the hardware speculates will happen next. On exit …
-
Unscored —
virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable()
In the Linux kernel, the following vulnerability has been resolved: virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable() The selftests added to our CI by Bui Quang Minh recently reveals that there is a mem leak on the error path of virtnet_xsk_poo…
-
Unscored —
mm/huge_memory: fix dereferencing invalid pmd migration entry
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix dereferencing invalid pmd migration entry When migrating a THP, concurrent access to the PMD migration entry during a deferred split scan can lead to an invalid address ac…
-
Unscored —
memblock: Accept allocated memory before use in memblock_double_array()
In the Linux kernel, the following vulnerability has been resolved: memblock: Accept allocated memory before use in memblock_double_array() When increasing the array size in memblock_double_array() and the slab is not yet available, a call to memblock_find_in…
-
Unscored —
ipvs: fix uninit-value for saddr in do_output_route4
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix uninit-value for saddr in do_output_route4 syzbot reports for uninit-value for the saddr argument [1]. commit 4754957f04f5 ("ipvs: do not use random local source address for tunnels…
-
Unscored —
arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users
In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users Support for eBPF programs loaded by unprivileged users is typically disabled. This means only cBPF programs need to be mit…
-
Unscored —
usb: typec: class: Invalidate USB device pointers on partner unregistration
In the Linux kernel, the following vulnerability has been resolved: usb: typec: class: Invalidate USB device pointers on partner unregistration To avoid using invalid USB device pointers after a Type-C partner disconnects, this patch clears the pointers upon …
-
Unscored —
net: phy: leds: fix memory leak
In the Linux kernel, the following vulnerability has been resolved: net: phy: leds: fix memory leak A network restart test on a router led to an out-of-memory condition, which was traced to a memory leak in the PHY LED trigger code. The root cause is misuse o…
-
Unscored —
module: ensure that kobject_put() is safe for module type kobjects
In the Linux kernel, the following vulnerability has been resolved: module: ensure that kobject_put() is safe for module type kobjects In 'lookup_or_create_module_kobject()', an internal kobject is created using 'module_ktype'. So call to 'kobject_put()' on e…
-
Unscored —
fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio()
In the Linux kernel, the following vulnerability has been resolved: fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio() If bio_add_folio() fails (because it is full), erofs_fileio_scan_folio() needs to submit the I/O request via erofs_fileio…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-57976.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21709.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21807.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21817.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21833.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-21884.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22108.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-22120.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37797.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37799.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37800.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37806.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37807.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37808.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37809.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37813.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37814.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37819.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37820.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37821.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37823.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37827.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37834.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37876.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37877.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37878.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37882.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37884.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37885.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-37888.html