Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-68764: In the Linux kernel, the following vulnerability has been resolved: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags CVE-2025-68756: In the Linux kernel, the following vulnerability has been resolved: block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock CVE-2025-68746: In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad: Fix timeout handling CVE-2025-68744: In the Linux kernel, the following vulnerability has been resolved: bpf: Free special fields when update [lru_,]percpu_hash maps CVE-2025-68742: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix invalid prog->stats access when update_effective_progs fails CVE-2025-68740: In the Linux kernel, the following vulnerability has been resolved: ima: Handle error code returned by ima_filter_rule_match() CVE-2025-68728: In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix uninit memory after failed mi_read in mi_format_new CVE-2025-68727: In the Linux kernel, the following vulnerability has been resolved: ntfs3: Fix uninit buffer allocated by __getname() CVE-2025-68724: In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id CVE-2025-68378: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stackmap overflow check in __bpf_get_stackid() CVE-2025-68374: In the Linux kernel, the following vulnerability has been resolved: md: fix rcu protection in md_wakeup_thread CVE-2025-68372: In the Linux kernel, the following vulnerability has been resolved: nbd: defer config put in recv_work CVE-2025-68371: In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix device resources accessed after device removal CVE-2025-68369: In the Linux kernel, the following vulnerability has been resolved: ntfs3: init run lock for extend inode CVE-2025-68366: In the Linux kernel, the following vulnerability has been resolved: nbd: defer config unlock in nbd_genl_connect CVE-2025-68363: In the Linux kernel, the following vulnerability has been resolved: bpf: Check skb->transport_header is set in bpf_skb_check_mtu CVE-2025-68361: In the Linux kernel, the following vulnerability has been resolved: erofs: limit the level of fs stacking for file-backed mounts CVE-2025-68349: In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid CVE-2025-68348: In the Linux kernel, the following vulnerability has been resolved: block: fix memory leak in __blkdev_issue_zero_pages CVE-2025-68341: In the Linux kernel, the following vulnerability has been resolved: veth: reduce XDP no_direct return section to fix race CVE-2025-68340: In the Linux kernel, the following vulnerability has been resolved: team: Move team device type change at the end of team_port_add CVE-2025-68337: In the Linux kernel, the following vulnerability has been resolved: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted CVE-2025-68331: In the Linux kernel, the following vulnerability has been resolved: usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer CVE-2025-68329: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs CVE-2025-68325: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop CVE-2025-68297: In the Linux kernel, the following vulnerability has been resolved: ceph: fix crash in process_v2_sparse_read() for encrypted directories CVE-2025-68296: In the Linux kernel, the following vulnerability has been resolved: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup CVE-2025-68295: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix memory leak in cifs_construct_tcon() CVE-2025-68293: In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix NULL pointer deference when splitting folio CVE-2025-68292: In the Linux kernel, the following vulnerability has been resolved: mm/memfd: fix information leak in hugetlb folios CVE-2025-68288: In the Linux kernel, the following vulnerability has been resolved: usb: storage: Fix memory leak in USB bulk transport CVE-2025-68285: In the Linux kernel, the following vulnerability has been resolved: libceph: fix potential use-after-free in have_mon_and_osd_map() CVE-2025-68284: In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() CVE-2025-68283: In the Linux kernel, the following vulnerability has been resolved: libceph: replace BUG_ON with bounds check for map->max_osd CVE-2025-68265: In the Linux kernel, the following vulnerability has been resolved: nvme: fix admin request_queue lifetime CVE-2025-68264: In the Linux kernel, the following vulnerability has been resolved: ext4: refresh inline data size before write operations CVE-2025-68261: In the Linux kernel, the following vulnerability has been resolved: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() CVE-2025-68259: In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced CVE-2025-68244: In the Linux kernel, the following vulnerability has been resolved: drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD CVE-2025-68242: In the Linux kernel, the following vulnerability has been resolved: NFS: Fix LTP test failures when timestamps are delegated CVE-2025-68241: In the Linux kernel, the following vulnerability has been resolved: ipv4: route: Prevent rt_bind_exception
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool6.12 | 1:6.12.63-84.121.amzn2023 |
| Amazon Linux · 2023 | bpftool6.12-debuginfo | 1:6.12.63-84.121.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.12.63-84.121 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel6.12 | 1:6.12.63-84.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo | 1:6.12.63-84.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-aarch64 | 1:6.12.63-84.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-x86_64 | 1:6.12.63-84.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-devel | 1:6.12.63-84.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-headers | 1:6.12.63-84.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf | 1:6.12.63-84.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf-debuginfo | 1:6.12.63-84.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf-devel | 1:6.12.63-84.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf-static | 1:6.12.63-84.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-modules-extra | 1:6.12.63-84.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-modules-extra-common | 1:6.12.63-84.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools | 1:6.12.63-84.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools-debuginfo | 1:6.12.63-84.121.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools-devel | 1:6.12.63-84.121.amzn2023 |
| Amazon Linux · 2023 | perf6.12 | 1:6.12.63-84.121.amzn2023 |
| Amazon Linux · 2023 | perf6.12-debuginfo | 1:6.12.63-84.121.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12 | 1:6.12.63-84.121.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12-debuginfo | 1:6.12.63-84.121.amzn2023 |
Vulnerabilities 76
-
Critical 9.8
nfsd: fix refcount leak in nfsd_set_fh_dentry()
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix refcount leak in nfsd_set_fh_dentry() nfsd exports a "pseudo root filesystem" which is used by NFSv4 to find the various exported filesystems using LOOKUP requests from a known root…
-
Critical 9.8
mptcp: fix a race in mptcp_pm_del_add_timer()
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix a race in mptcp_pm_del_add_timer() mptcp_pm_del_add_timer() can call sk_stop_timer_sync(sk, &entry->add_timer) while another might have free entry already, as reported by syzbot. A…
-
Critical 9.8
mptcp: fix race condition in mptcp_schedule_work()
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount …
-
Critical 9.8
libceph: prevent potential out-of-bounds writes in handle_auth_session_key()
In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() The len field originates from untrusted network packets. Boundary checks have been added to prevent potential out-…
-
Critical 9.8
libceph: fix potential use-after-free in have_mon_and_osd_map()
In the Linux kernel, the following vulnerability has been resolved: libceph: fix potential use-after-free in have_mon_and_osd_map() The wait loop in __ceph_open_session() can race with the client receiving a new monmap or osdmap shortly after the initial map …
-
Critical 9.8
veth: reduce XDP no_direct return section to fix race
In the Linux kernel, the following vulnerability has been resolved: veth: reduce XDP no_direct return section to fix race As explain in commit fa349e396e48 ("veth: Fix race with AF_XDP exposing old or uninitialized descriptors") for veth there is a chance aft…
-
High 8.8
NFSD: free copynotify stateid in nfs4_free_ol_stateid()
In the Linux kernel, the following vulnerability has been resolved: NFSD: free copynotify stateid in nfs4_free_ol_stateid() Typically copynotify stateid is freed either when parent's stateid is being close/freed or in nfsd4_laundromat if the stateid hasn't be…
-
High 8.8
smb: client: fix incomplete backport in cfids_invalidation_worker()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix incomplete backport in cfids_invalidation_worker() The previous commit bdb596ceb4b7 ("smb: client: fix potential UAF in smb2_close_cached_fid()") was an incomplete backport a…
-
High 8.2
KVM: arm64: Check the untrusted offset in FF-A memory share
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Check the untrusted offset in FF-A memory share Verify the offset to prevent OOB access in the hypervisor FF-A buffer in case an untrusted large enough value [U32_MAX - sizeof(str…
-
High 8.1
tcp_metrics: use dst_dev_net_rcu()
In the Linux kernel, the following vulnerability has been resolved: tcp_metrics: use dst_dev_net_rcu() Replace three dst_dev() with a lockdep enabled helper.
-
High 7.8CVE-2025-38678 Public exploit
netfilter: nf_tables: reject duplicate device on updates
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject duplicate device on updates A chain/flowtable update with duplicated devices in the same batch is possible. Unfortunately, netdev event path only removes the firs…
-
High 7.8
af_unix: Initialise scc_index in unix_add_edge().
In the Linux kernel, the following vulnerability has been resolved: af_unix: Initialise scc_index in unix_add_edge(). Quang Le reported that the AF_UNIX GC could garbage-collect a receive queue of an alive in-flight socket, with a nice repro. The repro consis…
-
High 7.8
xfrm: delete x->tunnel as we delete x
In the Linux kernel, the following vulnerability has been resolved: xfrm: delete x->tunnel as we delete x The ipcomp fallback tunnels currently get deleted (from the various lists and hashtables) as the last user state that needed that fallback is destroyed (…
-
High 7.8
vsock: Ignore signal/timeout on connect() if already established
In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if already established During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues: 1. connec…
-
High 7.8
net/mlx5: Clean up only new IRQ glue on request_irq() failure
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Clean up only new IRQ glue on request_irq() failure The mlx5_irq_alloc() function can inadvertently free the entire rmap and end up in a crash[1] when the other threads tries to acc…
-
High 7.8
devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
In the Linux kernel, the following vulnerability has been resolved: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy The function devl_rate_nodes_destroy is documented to "Unset parent for all rate objects". However, it was only calling the driv…
-
High 7.8CVE-2025-40271 Public exploit
fs/proc: fix uaf in proc_readdir_de()
In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the…
-
High 7.8
mm/secretmem: fix use-after-free race in fault handler
In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: fix use-after-free race in fault handler When a page fault occurs in a secret memory file created with `memfd_secret(2)`, the kernel will allocate a new folio for it, mark the u…
-
High 7.8
KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying
In the Linux kernel, the following vulnerability has been resolved: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying When unbinding a memslot from a guest_memfd instance, remove the bindings even if the guest_memfd file is dying, i.e. …
-
High 7.8
drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE This data originates from userspace and is used in buffer offset calculations which could potentially overflow causing a…
-
High 7.8
bpf: account for current allocated stack depth in widen_imprecise_scalars()
In the Linux kernel, the following vulnerability has been resolved: bpf: account for current allocated stack depth in widen_imprecise_scalars() The usage pattern for widen_imprecise_scalars() looks as follows: prev_st = find_prev_entry(env, ...); queued_st = …
-
High 7.8
nvme: fix admin request_queue lifetime
In the Linux kernel, the following vulnerability has been resolved: nvme: fix admin request_queue lifetime The namespaces can access the controller's admin request_queue, and stale references on the namespaces may exist after tearing down the controller. Ensu…
-
High 7.8
team: Move team device type change at the end of team_port_add
In the Linux kernel, the following vulnerability has been resolved: team: Move team device type change at the end of team_port_add Attempting to add a port device that is already up will expectedly fail, but not before modifying the team device header_ops. In…
-
High 7.8
crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id Use check_add_overflow() to guard against potential integer overflows when adding the binary blob lengths and the size…
-
High 7.8
spi: tegra210-quad: Fix timeout handling
In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad: Fix timeout handling When the CPU that the QSPI interrupt handler runs on (typically CPU 0) is excessively busy, it can lead to rare cases of the IRQ thread not running be…
-
High 7.8
NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
In the Linux kernel, the following vulnerability has been resolved: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags When a filesystem is being automounted, it needs to preserve the user-set superblock mount options, such as the "ro" fla…
-
High 7.5
ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
In the Linux kernel, the following vulnerability has been resolved: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe The sit driver's packet transmission path calls: sit_tunnel_xmit() -> update_or_create_fnhe(), which lead to fnhe_remove_old…
-
High 7.5
ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()
In the Linux kernel, the following vulnerability has been resolved: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() Fix a race between inline data destruction and block mapping. The function ext4_destroy_inline_data_nolock() changes the i…
-
High 7.5
libceph: replace BUG_ON with bounds check for map->max_osd
In the Linux kernel, the following vulnerability has been resolved: libceph: replace BUG_ON with bounds check for map->max_osd OSD indexes come from untrusted network packets. Boundary checks are added to validate these against map->max_osd. [ idryomov: drop …
-
High 7.5
jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted
In the Linux kernel, the following vulnerability has been resolved: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted There's issue when file system corrupted: ------------[ cut here ]------------ kernel BUG at fs/jbd2/transact…
-
High 7.5
NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode…
-
High 7.5
ntfs3: init run lock for extend inode
In the Linux kernel, the following vulnerability has been resolved: ntfs3: init run lock for extend inode After setting the inode mode of $Extend to a regular file, executing the truncate system call will enter the do_truncate() routine, causing the run_lock …
-
Unscored —
net: openvswitch: remove never-working support for setting nsh fields
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: remove never-working support for setting nsh fields The validation of the set(nsh(...)) action is completely wrong. It runs through the nsh_key_put_from_nlattr() function th…
-
Unscored —
scsi: sg: Do not sleep in atomic context
In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Do not sleep in atomic context sg_finish_rem_req() calls blk_rq_unmap_user(). The latter function may sleep. Hence, call sg_finish_rem_req() with interrupts enabled instead of disab…
-
Unscored —
cifs: client: fix memory leak in smb3_fs_context_parse_param
In the Linux kernel, the following vulnerability has been resolved: cifs: client: fix memory leak in smb3_fs_context_parse_param The user calls fsconfig twice, but when the program exits, free() only frees ctx->source for the second fsconfig, not the first. R…
-
Unscored —
net: sched: act_connmark: initialize struct tc_ife to fix kernel leak
In the Linux kernel, the following vulnerability has been resolved: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak In tcf_connmark_dump(), the variable 'opt' was partially initialized using a designatied initializer. While the padding b…
-
Unscored —
sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
In the Linux kernel, the following vulnerability has been resolved: sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto syzbot reported a possible shift-out-of-bounds [1] Blamed commit added rto_alpha_max and rto_beta_max set to 1000. It i…
-
Unscored —
exfat: fix improper check of dentry.stream.valid_size
In the Linux kernel, the following vulnerability has been resolved: exfat: fix improper check of dentry.stream.valid_size We found an infinite loop bug in the exFAT file system that can lead to a Denial-of-Service (DoS) condition. When a dentry in an exFAT fi…
-
Unscored —
crash: fix crashkernel resource shrink
In the Linux kernel, the following vulnerability has been resolved: crash: fix crashkernel resource shrink When crashkernel is configured with a high reservation, shrinking its value below the low crashkernel reservation causes two issues: 1. Invalid crashker…
-
Unscored —
codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext
In the Linux kernel, the following vulnerability has been resolved: codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext When alloc_slab_obj_exts() fails and then later succeeds in allocating a slab extension vector, it calls ha…
-
Unscored —
bpf: Add bpf_prog_run_data_pointers()
In the Linux kernel, the following vulnerability has been resolved: bpf: Add bpf_prog_run_data_pointers() syzbot found that cls_bpf_classify() is able to change tc_skb_cb(skb)->drop_reason triggering a warning in sk_skb_reason_drop(). WARNING: CPU: 0 PID: 596…
-
Unscored —
sched_ext: Fix unsafe locking in the scx_dump_state()
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix unsafe locking in the scx_dump_state() For built with CONFIG_PREEMPT_RT=y kernels, the dump_lock will be converted sleepable spinlock and not disable-irq, so the following scen…
-
Unscored —
erofs: avoid infinite loop due to incomplete zstd-compressed data
In the Linux kernel, the following vulnerability has been resolved: erofs: avoid infinite loop due to incomplete zstd-compressed data Currently, the decompression logic incorrectly spins if compressed data is truncated in crafted (deliberately corrupted) imag…
-
Unscored —
timers: Fix NULL function pointer race in timer_shutdown_sync()
In the Linux kernel, the following vulnerability has been resolved: timers: Fix NULL function pointer race in timer_shutdown_sync() There is a race condition between timer_shutdown_sync() and timer expiration that can lead to hitting a WARN_ON in expire_timer…
-
Unscored —
cifs: fix memory leak in smb3_fs_context_parse_param error path
In the Linux kernel, the following vulnerability has been resolved: cifs: fix memory leak in smb3_fs_context_parse_param error path Add proper cleanup of ctx->source and fc->source to the cifs_parse_mount_err error handler. This ensures that memory allocated …
-
Unscored —
mptcp: Fix proto fallback detection with BPF
In the Linux kernel, the following vulnerability has been resolved: mptcp: Fix proto fallback detection with BPF The sockmap feature allows bpf syscall from userspace, or based on bpf sockops, replacing the sk_prot of sockets during protocol stack processing …
-
Unscored —
scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
In the Linux kernel, the following vulnerability has been resolved: scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() If the allocation of tl_hba->sh fails in tcm_loop_driver_probe() and we attempt to dereference it in tcm_loop_tpg_address_s…
-
Unscored —
mm/mempool: fix poisoning order>0 pages with HIGHMEM
In the Linux kernel, the following vulnerability has been resolved: mm/mempool: fix poisoning order>0 pages with HIGHMEM The kernel test has reported: BUG: unable to handle page fault for address: fffba000 #PF: supervisor write access in kernel mode #PF: erro…
-
Unscored —
mtdchar: fix integer overflow in read/write ioctls
In the Linux kernel, the following vulnerability has been resolved: mtdchar: fix integer overflow in read/write ioctls The "req.start" and "req.len" variables are u64 values that come from the user at the start of the function. We mask away the high 32 bits o…
-
Unscored —
NFS: Fix LTP test failures when timestamps are delegated
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix LTP test failures when timestamps are delegated The utimes01 and utime06 tests fail when delegated timestamps are enabled, specifically in subtests that modify the atime and mtime fi…
-
Unscored —
drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD On completion of i915_vma_pin_ww(), a synchronous variant of dma_fence_work_commit() is called. When pinning a VMA to GGTT a…
-
Unscored —
KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced When re-injecting a soft interrupt from an INT3, INT0, or (select) INTn instruction, discard the exception and retry the in…
-
Unscored —
ext4: refresh inline data size before write operations
In the Linux kernel, the following vulnerability has been resolved: ext4: refresh inline data size before write operations The cached ei->i_inline_size can become stale between the initial size check and when ext4_update_inline_data()/ext4_create_inline_data(…
-
Unscored —
usb: storage: Fix memory leak in USB bulk transport
In the Linux kernel, the following vulnerability has been resolved: usb: storage: Fix memory leak in USB bulk transport A kernel memory leak was identified by the 'ioctl_sg01' test from Linux Test Project (LTP). The following bytes were mainly observed: 0x534…
-
Unscored —
mm/memfd: fix information leak in hugetlb folios
In the Linux kernel, the following vulnerability has been resolved: mm/memfd: fix information leak in hugetlb folios When allocating hugetlb folios for memfd, three initialization steps are missing: 1. Folios are not zeroed, leading to kernel memory disclosur…
-
Unscored —
mm/huge_memory: fix NULL pointer deference when splitting folio
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix NULL pointer deference when splitting folio Commit c010d47f107f ("mm: thp: split huge page to any lower order pages") introduced an early check on the folio's order via ma…
-
Unscored —
smb: client: fix memory leak in cifs_construct_tcon()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix memory leak in cifs_construct_tcon() When having a multiuser mount with domain= specified and using cifscreds, cifs_set_cifscreds() will end up setting @ctx->domainname, so i…
-
Unscored —
drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup
In the Linux kernel, the following vulnerability has been resolved: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup Protect vga_switcheroo_client_fb_set() with console lock. Avoids OOB access in fbcon_remap_all(). Without holding the console l…
-
Unscored —
ceph: fix crash in process_v2_sparse_read() for encrypted directories
In the Linux kernel, the following vulnerability has been resolved: ceph: fix crash in process_v2_sparse_read() for encrypted directories The crash in process_v2_sparse_read() for fscrypt-encrypted directories has been reported. Issue takes place for Ceph msg…
-
Unscored —CVE-2025-68325 Public exploit
net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop In cake_drop(), qdisc_tree_reduce_backlog() is used to update the qlen and backlog of the qdisc hierarchy. Its caller, cake_enqu…
-
Unscored —
tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs When a VMA is split (e.g., by partial munmap or MAP_FIXED), the kernel calls vm_ops->close on each portion. For trace buffer …
-
Unscored —
usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer
In the Linux kernel, the following vulnerability has been resolved: usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer When a UAS device is unplugged during data transfer, there is a probability of a system panic occu…
-
Unscored —
block: fix memory leak in __blkdev_issue_zero_pages
In the Linux kernel, the following vulnerability has been resolved: block: fix memory leak in __blkdev_issue_zero_pages Move the fatal signal check before bio_alloc() to prevent a memory leak when BLKDEV_ZERO_KILLABLE is set and a fatal signal is pending. Pre…
-
Unscored —
erofs: limit the level of fs stacking for file-backed mounts
In the Linux kernel, the following vulnerability has been resolved: erofs: limit the level of fs stacking for file-backed mounts Otherwise, it could cause potential kernel stack overflow (e.g., EROFS mounting itself).
-
Unscored —
bpf: Check skb->transport_header is set in bpf_skb_check_mtu
In the Linux kernel, the following vulnerability has been resolved: bpf: Check skb->transport_header is set in bpf_skb_check_mtu The bpf_skb_check_mtu helper needs to use skb->transport_header when the BPF_MTU_CHK_SEGS flag is used: bpf_skb_check_mtu(skb, ifi…
-
Unscored —
nbd: defer config unlock in nbd_genl_connect
In the Linux kernel, the following vulnerability has been resolved: nbd: defer config unlock in nbd_genl_connect There is one use-after-free warning when running NBD_CMD_CONNECT and NBD_CLEAR_SOCK: nbd_genl_connect nbd_alloc_and_init_config // config_refs=1 n…
-
Unscored —
scsi: smartpqi: Fix device resources accessed after device removal
In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix device resources accessed after device removal Correct possible race conditions during device removal. Previously, a scheduled work item to reset a LUN could still execute…
-
Unscored —
nbd: defer config put in recv_work
In the Linux kernel, the following vulnerability has been resolved: nbd: defer config put in recv_work There is one uaf issue in recv_work when running NBD_CLEAR_SOCK and NBD_CMD_RECONFIGURE: nbd_genl_connect // conf_ref=2 (connect and recv_work A) nbd_open /…
-
Unscored —
md: fix rcu protection in md_wakeup_thread
In the Linux kernel, the following vulnerability has been resolved: md: fix rcu protection in md_wakeup_thread We attempted to use RCU to protect the pointer 'thread', but directly passed the value when calling md_wakeup_thread(). This means that the RCU poin…
-
Unscored —
bpf: Fix stackmap overflow check in __bpf_get_stackid()
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stackmap overflow check in __bpf_get_stackid() Syzkaller reported a KASAN slab-out-of-bounds write in __bpf_get_stackid() when copying stack trace data. The issue occurs when the per…
-
Unscored —
ntfs3: Fix uninit buffer allocated by __getname()
In the Linux kernel, the following vulnerability has been resolved: ntfs3: Fix uninit buffer allocated by __getname() Fix uninit errors caused after buffer allocation given to 'de'; by initializing the buffer with zeroes. The fix was found by using KMSAN.
-
Unscored —
ntfs3: fix uninit memory after failed mi_read in mi_format_new
In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix uninit memory after failed mi_read in mi_format_new Fix a KMSAN un-init bug found by syzkaller. ntfs_get_bh() expects a buffer from sb_getblk(), that buffer may not be uptodate. We…
-
Unscored —
ima: Handle error code returned by ima_filter_rule_match()
In the Linux kernel, the following vulnerability has been resolved: ima: Handle error code returned by ima_filter_rule_match() In ima_match_rules(), if ima_filter_rule_match() returns -ENOENT due to the rule being NULL, the function incorrectly skips the 'if …
-
Unscored —
bpf: Fix invalid prog->stats access when update_effective_progs fails
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix invalid prog->stats access when update_effective_progs fails Syzkaller triggers an invalid memory access issue following fault injection in update_effective_progs. The issue can be d…
-
Unscored —
bpf: Free special fields when update [lru_,]percpu_hash maps
In the Linux kernel, the following vulnerability has been resolved: bpf: Free special fields when update [lru_,]percpu_hash maps As [lru_,]percpu_hash maps support BPF_KPTR_{REF,PERCPU}, missing calls to 'bpf_obj_free_fields()' in 'pcpu_copy_value()' could ca…
-
Unscored —
block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock
In the Linux kernel, the following vulnerability has been resolved: block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock blk_mq_{add,del}_queue_tag_set() functions add and remove queues from tagset, the functions make sure that tagset a…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38678.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40075.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40212.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40214.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40215.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40248.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40250.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40251.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40254.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40257.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40258.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40259.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40266.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40268.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40271.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40272.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40273.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40274.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40277.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40279.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40281.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40287.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-68198.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-68199.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-68200.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-68202.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-68208.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-68210.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-68214.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-68219.html