Summary
[6.12.0-104.43.4.2.el10uek]
- Revert 'sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails' (Joseph Salisbury) [Orabug: 38517178]
[6.12.0-104.43.4.1.el10uek]
- io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38478874]
[6.12.0-104.43.4.el10uek]
- tls: fix handling of zero-length records on the rx_list (Jakub Kicinski) [Orabug: 38401543,38453832] {CVE-2025-39682}
[6.12.0-104.43.3.el10uek]
- squashfs: fix memory leak in squashfs_fill_super (Phillip Lougher) [Orabug: 38343659]
- drm/mediatek: Add error handling for old state CRTC in atomic_disable (Jason-JH Lin) [Orabug: 38343659]
- net: ipv4: fix regression in local-broadcast routes (Oscar Maes) [Orabug: 38343659]
- net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization (Yuichiro Tsuji) [Orabug: 38401777] {CVE-2025-38736}
- ksmbd: extend the connection limiting mechanism to support IPv6 (Namjae Jeon) [Orabug: 38343659]
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Dan Carpenter) [Orabug: 38343659]
- Revert 'vgacon: Add check for vc_origin address range in vgacon_scroll()' (Helge Deller) [Orabug: 38343659]
- Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() (Sergey Shtylyov) [Orabug: 38343659]
- Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established (Pauli Virtanen) [Orabug: 38343659]
- Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF (Yang Li) [Orabug: 38343659]
- Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown (Jiande Lu) [Orabug: 38343659]
- Bluetooth: hci_sync: Fix scan state after PA Sync has been established (Luiz Augusto von Dentz) [Orabug: 38343659]
- igc: fix disabling L1.2 PCI-E link substate on I226 on init (Valdikss) [Orabug: 38343659]
- drm/amdgpu/discovery: fix fw based ip discovery (Alex Deucher) [Orabug: 38343659]
- Revert 'drm/amdgpu: fix incorrect vm flags to map bo' (Alex Deucher) [Orabug: 38343659]
- Revert 'can: ti_hecc: fix -Woverflow compiler warning' (Greg Kroah-Hartman) [Orabug: 38343659]
- proc: fix missing pde_set_flags() for net proc files (Zijie Wang) [Orabug: 38343659]
- perf symbol-minimal: Fix ehdr reading in filename__read_build_id (Ian Rogers) [Orabug: 38343659]
- vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER (Namhyung Kim) [Orabug: 38343659]
- x86/vmscape: Warn when STIBP is disabled with SMT (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Move cpu_bugs_smt_update() down (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enable the mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Add conditional IBPB mitigation (Pawan Gupta) [Orabug: 38424089]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Josh Poimboeuf) [Orabug: 38424089]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Josh Poimboeuf) [Orabug: 38424089]
- x86/vmscape: Add old Intel CPUs to affected list (Pawan Gupta) [Orabug: 38424089]
- x86/vmscape: Enumerate VMSCAPE bug (Pawan Gupta) [Orabug: 38424089]
- Documentation/hw-vuln: Add VMSCAPE documentation (Pawan Gupta) [Orabug: 38424089]
- uek-rpm: Move ifb module to modules-core (Harshit Mogalapalli) [Orabug: 38435397]
[6.12.0-104.43.2.el10uek]
- vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit (Alok Tiwari) [Orabug: 38324321]
- uek: kabi: update x86_64 kABI files for new symbols (Yifei Liu) [Orabug: 38327135]
- uek-rpm: Add broken-out hsmp platform drivers (Dave Kleikamp) [Orabug: 38332412]
- crypto: ccp - Add support for PCI device 0x17D8 (John Allen) [Orabug: 38332412]
- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (Yazen Ghannam) [Orabug: 38332412]
- x86/cpufeatures: Free up unused feature bits (Sohil Mehta) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make amd_hsmp and hsmp_acpi as mutually exclusive drivers (Suma Hegde) [Orabug: 38332412]
- x86/amd_node, platform/x86/amd/hsmp: Have HSMP use SMN through AMD_NODE (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Use defines for SMN register offsets (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Remove dependency on AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_node: Update __amd_smn_rw() error paths (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Move SMN access code to a new amd_node driver (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb, hwmon: (k10temp): Simplify amd_pci_dev_to_node_id() (Mario Limonciello) [Orabug: 38332412]
- x86/amd_nb: Simplify function 3 search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Use topology info to get AMD node count (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify root device search (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Simplify function 4 search (Yazen Ghannam) [Orabug: 38332412]
- x86: Start moving AMD node functionality out of AMD_NB (Yazen Ghannam) [Orabug: 38332412]
- x86/amd_nb: Clean up early_is_amd_nb() (Yazen Ghannam) [Orabug: 38332412]
- platform/x86/amd/hsmp: mark hsmp_msg_desc_table[] as maybe_unused (Arnd Bergmann) [Orabug: 38332412]
- platform/x86/amd/hsmp: Make hsmp_pdev static instead of global (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use dev_groups in the driver structure (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Use name space while exporting module symbols (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create separate ACPI, plat and common drivers (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Change generic plat_dev name to hsmp_pdev (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move ACPI code to acpi.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move platform device specific code to plat.c (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Move structure and macros to header file (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Convert amd_hsmp_rdwr() to a function pointer (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create wrapper function init_acpi() (Suma Hegde) [Orabug: 38332412]
- platform/x86/amd/hsmp: Create hsmp/ directory (Suma Hegde) [Orabug: 38332412]
[6.12.0-104.43.1.el10u
Fixed packages 35
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | kernel-uek | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-core | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-debug | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-core | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-devel | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-core | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-deprecated | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-desktop | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-extra | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-extra-netfilter | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-usb | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-wireless | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-devel | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-doc | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-modules | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-core | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-deprecated | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-desktop | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-extra | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-extra-netfilter | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-usb | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-wireless | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-tools | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek64k | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek64k-core | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek64k-devel | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-core | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-deprecated | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-desktop | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-extra | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-extra-netfilter | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-usb | 0:6.12.0-104.43.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-wireless | 0:6.12.0-104.43.4.2.el10uek |
Vulnerabilities 102
-
Critical 9.8
tls: fix handling of zero-length records on the rx_list
In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record ha…
KEV Sep 18, 2026 -
Critical 9.8
sunrpc: fix handling of server side tls alerts
In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix handling of server side tls alerts Scott Mayhew discovered a security exploit in NFS over TLS in tls_alert_recv() due to its assumption it can read data from the msg iterator's kv…
-
Critical 9.8
[ceph] parse_longname(): strrchr() expects NUL-terminated string
In the Linux kernel, the following vulnerability has been resolved: [ceph] parse_longname(): strrchr() expects NUL-terminated string ... and parse_longname() is not guaranteed that. That's the reason why it uses kmemdup_nul() to build the argument for kstrtou…
-
Critical 9.8
drbd: add missing kref_get in handle_write_conflicts
In the Linux kernel, the following vulnerability has been resolved: drbd: add missing kref_get in handle_write_conflicts With `two-primaries` enabled, DRBD tries to detect "concurrent" writes and handle write conflicts, so that even if you write to the same s…
-
Critical 9.8
nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SE…
-
Critical 9.3
x86/sev: Evict cache lines during SNP memory validation
In the Linux kernel, the following vulnerability has been resolved: x86/sev: Evict cache lines during SNP memory validation An SNP cache coherency vulnerability requires a cache line eviction mitigation when validating memory after a page state change to priv…
-
Critical 9.1
smb3: fix for slab out of bounds on mount to ksmbd
In the Linux kernel, the following vulnerability has been resolved: smb3: fix for slab out of bounds on mount to ksmbd With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parse_server_interfaces() (see …
-
High 8.8
wifi: ath11k: clear initialized flag for deinit-ed srng lists
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: clear initialized flag for deinit-ed srng lists In a number of cases we see kernel panics on resume due to ath11k kernel page fault, which happens under the following circumstan…
-
High 8.8
iommufd: Prevent ALIGN() overflow
In the Linux kernel, the following vulnerability has been resolved: iommufd: Prevent ALIGN() overflow When allocating IOVA the candidate range gets aligned to the target alignment. If the range is close to ULONG_MAX then the ALIGN() can wrap resulting in a co…
-
High 8.6
pptp: ensure minimal skb length in pptp_xmit()
In the Linux kernel, the following vulnerability has been resolved: pptp: ensure minimal skb length in pptp_xmit() Commit aabc6596ffb3 ("net: ppp: Add bound checking for skb data on ppp_sync_txmung") fixed ppp_sync_txmunge() We need a similar fix in pptp_xmit…
-
High 8.6
bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
In the Linux kernel, the following vulnerability has been resolved: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls When sending plaintext data, we initially calculated the corresponding ciphertext length. However, if we later reduced the…
-
High 8.2
sunrpc: fix client side handling of tls alerts
In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix client side handling of tls alerts A security exploit was discovered in NFS over TLS in tls_alert_recv due to its assumption that there is valid data in the msghdr's iterator's kv…
-
High 7.8
net: better track kernel sockets lifetime
In the Linux kernel, the following vulnerability has been resolved: net: better track kernel sockets lifetime While kernel sockets are dismantled during pernet_operations->exit(), their freeing can be delayed by any tx packets still held in qdisc or device qu…
-
High 7.8
xfrm: interface: fix use-after-free after changing collect_md xfrm interface
In the Linux kernel, the following vulnerability has been resolved: xfrm: interface: fix use-after-free after changing collect_md xfrm interface collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail whe…
-
High 7.8
net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
In the Linux kernel, the following vulnerability has been resolved: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing TCA_MQPRIO_TC_ENTRY_INDEX is validated using NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value TC_QOPT_MA…
-
High 7.8
ipv6: reject malicious packets in ipv6_gso_segment()
In the Linux kernel, the following vulnerability has been resolved: ipv6: reject malicious packets in ipv6_gso_segment() syzbot was able to craft a packet with very long IPv6 extension headers leading to an overflow of skb->transport_header. This 16bit field …
-
High 7.8
bpf, arm64: Fix fp initialization for exception boundary
In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix fp initialization for exception boundary In the ARM64 BPF JIT when prog->aux->exception_boundary is set for a BPF program, find_used_callee_regs() is not called because for a …
-
High 7.8
Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' Function 'hci_discovery_filter_clear()' frees 'uuids' array and then sets it to NULL. There is a tiny chance of the foll…
-
High 7.8
wifi: rtl818x: Kill URBs before clearing tx status queue
In the Linux kernel, the following vulnerability has been resolved: wifi: rtl818x: Kill URBs before clearing tx status queue In rtl8187_stop() move the call of usb_kill_anchored_urbs() before clearing b_tx_status.queue. This change prevents callbacks from usi…
-
High 7.8
eventpoll: Fix semi-unbounded recursion
In the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded recursion Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links. Currently, ep_loop_check_proc() ensures that the graph is loop-fre…
-
High 7.8
tls: handle data disappearing from under the TLS ULP
In the Linux kernel, the following vulnerability has been resolved: tls: handle data disappearing from under the TLS ULP TLS expects that it owns the receive queue of the TCP socket. This cannot be guaranteed in case the reader of the TCP socket entered befor…
-
High 7.8
net/packet: fix a race in packet_set_ring() and packet_notifier()
In the Linux kernel, the following vulnerability has been resolved: net/packet: fix a race in packet_set_ring() and packet_notifier() When packet_set_ring() releases po->bind_lock, another thread can run packet_notifier() and process an NETDEV_UP event. This …
-
High 7.8
vsock: Do not allow binding to VMADDR_PORT_ANY
In the Linux kernel, the following vulnerability has been resolved: vsock: Do not allow binding to VMADDR_PORT_ANY It is possible for a vsock to autobind to VMADDR_PORT_ANY. This can cause a use-after-free when a connection is made to the bound socket. The so…
-
High 7.8
bpf: Disable migration in nf_hook_run_bpf().
In the Linux kernel, the following vulnerability has been resolved: bpf: Disable migration in nf_hook_run_bpf(). syzbot reported that the netfilter bpf prog can be called without migration disabled in xmit path. Then the assertion in __bpf_prog_run() fails, t…
-
High 7.8
proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al
In the Linux kernel, the following vulnerability has been resolved: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al Check pde->proc_ops->proc_lseek directly may cause UAF in rmmod scenario. It's a gap in proc_reg_open() after…
-
High 7.8
gfs2: No more self recovery
In the Linux kernel, the following vulnerability has been resolved: gfs2: No more self recovery When a node withdraws and it turns out that it is the only node that has the filesystem mounted, gfs2 currently tries to replay the local journal to bring the file…
-
High 7.8
arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()
In the Linux kernel, the following vulnerability has been resolved: arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() `cpu_switch_to()` and `call_on_irq_stack()` manipulate SP to change to different stacks along with the Shadow Call Stack if it i…
-
High 7.8
xfrm: state: initialize state_ptrs earlier in xfrm_state_find
In the Linux kernel, the following vulnerability has been resolved: xfrm: state: initialize state_ptrs earlier in xfrm_state_find In case of preemption, xfrm_state_look_at will find a different pcpu_id and look up states for that other CPU. If we matched a st…
-
High 7.8
fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit This issue triggers when a userspace program does an ioctl FBIOPUT_CON2FBMAP by passing console number and frame buffer number. Ideall…
-
High 7.8
gfs2: Validate i_depth for exhash directories
In the Linux kernel, the following vulnerability has been resolved: gfs2: Validate i_depth for exhash directories A fuzzer test introduced corruption that ends up with a depth of 0 in dir_e_read(), causing an undefined shift by 32 at: index = hash >> (32 - di…
-
High 7.8
sctp: linearize cloned gso packets in sctp_rcv
In the Linux kernel, the following vulnerability has been resolved: sctp: linearize cloned gso packets in sctp_rcv A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs. syzbot reported …
-
High 7.8
wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() ath11k_mac_disable_peer_fixed_rate() is passed as the iterator to ieee80211_iterate_stations_atomic(). Note in this ca…
-
High 7.8
dm: Always split write BIOs to zoned device limits
In the Linux kernel, the following vulnerability has been resolved: dm: Always split write BIOs to zoned device limits Any zoned DM target that requires zone append emulation will use the block layer zone write plugging. In such case, DM target drivers must n…
-
High 7.5
net/mlx5e: Remove skb secpath if xfrm state is not found
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Remove skb secpath if xfrm state is not found Hardware returns a unique identifier for a decrypted packet's xfrm state, this state is looked up in an xarray. However, the state mig…
-
High 7.3
btrfs: do not allow relocation of partially dropped subvolumes
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not allow relocation of partially dropped subvolumes [BUG] There is an internal report that balance triggered transaction abort, with the following call trace: item 85 key (59450982…
-
High 7.3
NFS: Fix the setting of capabilities when automounting a new filesystem
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix the setting of capabilities when automounting a new filesystem Capabilities cannot be inherited when we cross into a new filesystem. They need to be reset to the minimal defaults, an…
-
High 7.1
netfilter: xt_nfacct: don't assume acct name is null-terminated
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_nfacct: don't assume acct name is null-terminated BUG: KASAN: slab-out-of-bounds in .. lib/vsprintf.c:721 Read of size 1 at addr ffff88801eac95c8 by task syz-executor183/5851 [.…
-
Unscored —
ext4: fix out of bounds punch offset
In the Linux kernel, the following vulnerability has been resolved: ext4: fix out of bounds punch offset Punching a hole with a start offset that exceeds max_end is not permitted and will result in a negative length in the truncate_inode_partial_folio() funct…
-
Unscored —
Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT
In the Linux kernel, the following vulnerability has been resolved: Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT When enabling PREEMPT_RT, the gpio_keys_irq_timer() callback runs in hard irq context, but the input_event() takes a spin_lock, whi…
-
Unscored —
KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush In KVM guests with Hyper-V hypercalls enabled, the hypercalls HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST and HVCALL_FLUSH_VIRTUAL_ADD…
-
Unscored —CVE-2025-38553 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
HID: apple: validate feature-report field count to prevent NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: HID: apple: validate feature-report field count to prevent NULL pointer dereference A malicious HID device with quirk APPLE_MAGIC_BACKLIGHT can trigger a NULL pointer dereference whilst the p…
-
Unscored —
platform/x86/intel/pmt: fix a crashlog NULL pointer access
In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/pmt: fix a crashlog NULL pointer access Usage of the intel_pmt_read() for binary sysfs, requires a pcidev. The current use of the endpoint value is only valid for telemetry…
-
Unscored —
perf/core: Prevent VMA split of buffer mappings
In the Linux kernel, the following vulnerability has been resolved: perf/core: Prevent VMA split of buffer mappings The perf mmap code is careful about mmap()'ing the user page with the ringbuffer and additionally the auxiliary buffer, when the event supports…
-
Unscored —
perf/core: Exit early on perf_mmap() fail
In the Linux kernel, the following vulnerability has been resolved: perf/core: Exit early on perf_mmap() fail When perf_mmap() fails to allocate a buffer, it still invokes the event_mapped() callback of the related event. On X86 this might increase the perf_r…
-
Unscored —
benet: fix BUG when creating VFs
In the Linux kernel, the following vulnerability has been resolved: benet: fix BUG when creating VFs benet crashes as soon as SRIOV VFs are created: kernel BUG at mm/vmalloc.c:3457! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 4 UID: 0 PID: 7408 Comm:…
-
Unscored —
ipv6: fix possible infinite loop in fib6_info_uses_dev()
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in fib6_info_uses_dev() fib6_info_uses_dev() seems to rely on RCU without an explicit protection. Like the prior fix in rt6_nlmsg_size(), we need to make sure…
-
Unscored —
ipv6: prevent infinite loop in rt6_nlmsg_size()
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent infinite loop in rt6_nlmsg_size() While testing prior patch, I was able to trigger an infinite loop in rt6_nlmsg_size() in the following place: list_for_each_entry_rcu(sibling, …
-
Unscored —
iwlwifi: Add missing check for alloc_ordered_workqueue
In the Linux kernel, the following vulnerability has been resolved: iwlwifi: Add missing check for alloc_ordered_workqueue Add check for the return value of alloc_ordered_workqueue since it may return NULL pointer.
-
Unscored —
PM / devfreq: Check governor before using governor->name
In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Check governor before using governor->name Commit 96ffcdf239de ("PM / devfreq: Remove redundant governor_name from struct devfreq") removes governor_name and uses governor->name…
-
Unscored —CVE-2025-38611 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
net: drop UFO packets in udp_rcv_segment()
In the Linux kernel, the following vulnerability has been resolved: net: drop UFO packets in udp_rcv_segment() When sending a packet with virtio_net_hdr to tun device, if the gso_type in virtio_net_hdr is SKB_GSO_UDP and the gso_size is less than udphdr size,…
-
Unscored —
vfio/pds: Fix missing detach_ioas op
In the Linux kernel, the following vulnerability has been resolved: vfio/pds: Fix missing detach_ioas op When CONFIG_IOMMUFD is enabled and a device is bound to the pds_vfio_pci driver, the following WARN_ON() trace is seen and probe fails: WARNING: CPU: 0 PI…
-
Unscored —
vdpa/mlx5: Fix release of uninitialized resources on error path
In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix release of uninitialized resources on error path The commit in the fixes tag made sure that mlx5_vdpa_free() is the single entrypoint for removing the vdpa device resources add…
-
Unscored —
pinmux: fix race causing mux_owner NULL with active mux_usecount
In the Linux kernel, the following vulnerability has been resolved: pinmux: fix race causing mux_owner NULL with active mux_usecount commit 5a3e85c3c397 ("pinmux: Use sequential access to access desc->pinmux data") tried to address the issue when two client o…
-
Unscored —
wifi: mac80211: reject TDLS operations when station is not associated
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject TDLS operations when station is not associated syzbot triggered a WARN in ieee80211_tdls_oper() by sending NL80211_TDLS_ENABLE_LINK immediately after NL80211_CMD_CONNEC…
-
Unscored —
net/mlx5: Check device memory pointer before usage
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Check device memory pointer before usage Add a NULL check before accessing device memory to prevent a crash if dev->dm allocation in mlx5_init_once() fails.
-
Unscored —
ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
In the Linux kernel, the following vulnerability has been resolved: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() Add check for the return value of devm_kmemdup() to prevent potential null pointer dereference.
-
Unscored —
can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode
In the Linux kernel, the following vulnerability has been resolved: can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode Andrei Lalaev reported a NULL pointer deref when a CAN device is restarted from Bus Off and the driver d…
-
Unscored —
regulator: core: fix NULL dereference on unbind due to stale coupling data
In the Linux kernel, the following vulnerability has been resolved: regulator: core: fix NULL dereference on unbind due to stale coupling data Failing to reset coupling_desc.n_coupled after freeing coupled_rdevs can lead to NULL pointer dereference when regul…
-
Unscored —
i2c: qup: jump out of the loop in case of timeout
In the Linux kernel, the following vulnerability has been resolved: i2c: qup: jump out of the loop in case of timeout Original logic only sets the return value but doesn't jump out of the loop if the bus is kept active by a client. This is not expected. A mal…
-
Unscored —
media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() The buffer length check before calling uvc_parse_format() only ensured that the buffer has at least 3 bytes (buflen > 2), …
-
Unscored —
hv_netvsc: Fix panic during namespace deletion with VF
In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix panic during namespace deletion with VF The existing code move the VF NIC to new namespace when NETDEV_REGISTER is received on netvsc NIC. During deletion of the namespace, def…
-
Unscored —
net/sched: ets: use old 'nbands' while purging unused classes
In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: use old 'nbands' while purging unused classes Shuang reported sch_ets test-case [1] crashing in ets_class_qlen_notify() after recent changes from Lion [2]. The problem is: in …
-
Unscored —
userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry
In the Linux kernel, the following vulnerability has been resolved: userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry When UFFDIO_MOVE encounters a migration PMD entry, it proceeds with obtaining a folio and accessing it even though the en…
-
Unscored —
pNFS: Fix uninited ptr deref in block/scsi layout
In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix uninited ptr deref in block/scsi layout The error occurs on the third attempt to encode extents. When function ext_tree_prepare_commit() reallocates a larger buffer to retry encodin…
-
Unscored —
exfat: add cluster chain loop check for dir
In the Linux kernel, the following vulnerability has been resolved: exfat: add cluster chain loop check for dir An infinite loop may occur if the following conditions occur due to file system corruption. (1) Condition for exfat_count_dir_entries() to loop inf…
-
Unscored —
media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar In w7090p_tuner_write_serpar, msg is controlled by user. When msg[0].buf is null and…
-
Unscored —
media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()
In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() In dib7090p_rw_on_apb, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on m…
-
Unscored —
scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure If a call to lpfc_sli4_read_rev() from lpfc_sli4_hba_setup() fails, the resultant cleanup routine lpfc_sli4_vport_del…
-
Unscored —
scsi: bfa: Double-free fix
In the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Double-free fix When the bfad_im_probe() function fails during initialization, the memory pointed to by bfad->im is freed without setting bfad->im to NULL. Subsequently, during dri…
-
Unscored —
scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated In case of an ib_fast_reg_mr allocation failure during iSER setup, the machine hits a panic because iscsi_conn->dd_d…
-
Unscored —
ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
In the Linux kernel, the following vulnerability has been resolved: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr A syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data() when an inode had the INLINE_DATA_FL flag set but was missin…
-
Unscored —
fbdev: fix potential buffer overflow in do_register_framebuffer()
In the Linux kernel, the following vulnerability has been resolved: fbdev: fix potential buffer overflow in do_register_framebuffer() The current implementation may lead to buffer overflow when: 1. Unregistration creates NULL gaps in registered_fb[] 2. All ar…
-
Unscored —
rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access
In the Linux kernel, the following vulnerability has been resolved: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access In the preparation stage of CPU online, if the corresponding the rdp's->nocb_cb_kthread does not exist, will be created, t…
-
Unscored —
drm/amd/pm: fix null pointer access
In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix null pointer access Writing a string without delimiters (' ', '\n', '\0') to the under gpu_od/fan_ctrl sysfs or pp_power_profile_mode for the CUSTOM profile will result in a n…
-
Unscored —
ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime()
In the Linux kernel, the following vulnerability has been resolved: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() snd_soc_remove_pcm_runtime() might be called with rtd == NULL which will leads to null pointer dereference. This was reproduc…
-
Unscored —
loop: Avoid updating block size under exclusive owner
In the Linux kernel, the following vulnerability has been resolved: loop: Avoid updating block size under exclusive owner Syzbot came up with a reproducer where a loop device block size is changed underneath a mounted filesystem. This causes a mismatch betwee…
-
Unscored —
netfilter: ctnetlink: fix refcount leak on table dump
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refcount leak on table dump There is a reference count leak in ctnetlink_dump_table(): if (res < 0) { nf_conntrack_get(&ct->ct_general); // HERE cb->args[1] = (unsig…
-
Unscored —
net: usb: asix_devices: add phy_mask for ax88772 mdio bus
In the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: add phy_mask for ax88772 mdio bus Without setting phy_mask for ax88772 mdio bus, current driver may create at most 32 mdio phy devices with phy address range from 0x00…
-
Unscored —
netlink: avoid infinite retry looping in netlink_unicast()
In the Linux kernel, the following vulnerability has been resolved: netlink: avoid infinite retry looping in netlink_unicast() netlink_attachskb() checks for the socket's read memory allocation constraints. Firstly, it has: rmem < READ_ONCE(sk->sk_rcvbuf) to …
-
Unscored —
ALSA: usb-audio: Validate UAC3 power domain descriptors, too
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious …
-
Unscored —
net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization
In the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization Syzbot reported shift-out-of-bounds exception on MDIO bus initialization. The PHY address should be masked to 5 bits (0…
-
Unscored —
mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list
In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list In shrink_folio_list(), the hwpoisoned folio may be large folio, which can't be handled by unmap_poisoned_folio(). For THP,…
-
Unscored —
mm: swap: fix potential buffer overflow in setup_clusters()
In the Linux kernel, the following vulnerability has been resolved: mm: swap: fix potential buffer overflow in setup_clusters() In setup_swap_map(), we only ensure badpages are in range (0, last_page]. As maxpages might be < last_page, setup_clusters() will e…
-
Unscored —
NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() The function needs to check the minimal filehandle length before it can access the embedded filehandle.
-
Unscored —
iommu/arm-smmu-qcom: Add SM6115 MDSS compatible
In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-qcom: Add SM6115 MDSS compatible Add the SM6115 MDSS compatible to clients compatible list, as it also needs that workaround. Without this workaround, for example, QRB4210 RB2 …
-
Unscored —
RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()
In the Linux kernel, the following vulnerability has been resolved: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() The function divides number of online CPUs by num_core_siblings, and later checks the divider by zero. This implies a possibil…
-
Unscored —
rcu: Fix rcu_read_unlock() deadloop due to IRQ work
In the Linux kernel, the following vulnerability has been resolved: rcu: Fix rcu_read_unlock() deadloop due to IRQ work During rcu_read_unlock_special(), if this happens during irq_exit(), we can lockup if an IPI is issued. This is because the IPI itself trig…
-
Unscored —
wifi: ath10k: shutdown driver when hardware is unreliable
In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: shutdown driver when hardware is unreliable In rare cases, ath10k may lose connection with the PCIe bus due to some unknown reasons, which could further lead to system crashes d…
-
Unscored —
drm/msm: Add error handling for krealloc in metadata setup
In the Linux kernel, the following vulnerability has been resolved: drm/msm: Add error handling for krealloc in metadata setup Function msm_ioctl_gem_info_set_metadata() now checks for krealloc failure and returns -ENOMEM, avoiding potential NULL pointer dere…
-
Unscored —
bpf: Forget ranges when refining tnum after JSET
In the Linux kernel, the following vulnerability has been resolved: bpf: Forget ranges when refining tnum after JSET Syzbot reported a kernel warning due to a range invariant violation on the following BPF program. 0: call bpf_get_netns_cookie 1: if r0 == 0 g…
-
Unscored —
rcu: Protect ->defer_qs_iw_pending from data race
In the Linux kernel, the following vulnerability has been resolved: rcu: Protect ->defer_qs_iw_pending from data race On kernels built with CONFIG_IRQ_WORK=y, when rcu_read_unlock() is invoked within an interrupts-disabled region of code [1], it will invoke r…
-
Unscored —
gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops
In the Linux kernel, the following vulnerability has been resolved: gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops Clears up the warning added in 7ee3647243e5 ("migrate: Remove call to ->writepage") that occurs in various xfstests, causing "something found…
-
Unscored —
mm/smaps: fix race between smaps_hugetlb_range and migration
In the Linux kernel, the following vulnerability has been resolved: mm/smaps: fix race between smaps_hugetlb_range and migration smaps_hugetlb_range() handles the pte without holdling ptl, and may be concurrenct with migration, leaing to BUG_ON in pfn_swap_en…
-
Unscored —
fs: Prevent file descriptor table allocations exceeding INT_MAX
In the Linux kernel, the following vulnerability has been resolved: fs: Prevent file descriptor table allocations exceeding INT_MAX When sysctl_nr_open is set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file d…
-
Unscored —
ALSA: usb-audio: Validate UAC3 cluster segment descriptors
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the…
-
Unscored —
usb: core: config: Prevent OOB read in SS endpoint companion parsing
In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buf…
-
Unscored —
ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered
In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered If a synchronous error is detected as a result of user-space process triggering a 2-bit uncorrected error, th…
-
Unscored —
block: avoid possible overflow for chunk_sectors check in blk_stack_limits()
In the Linux kernel, the following vulnerability has been resolved: block: avoid possible overflow for chunk_sectors check in blk_stack_limits() In blk_stack_limits(), we check that the t->chunk_sectors value is a multiple of the t->physical_block_size value.…
-
Unscored —
xfrm: Duplicate SPI Handling
In the Linux kernel, the following vulnerability has been resolved: xfrm: Duplicate SPI Handling The issue originates when Strongswan initiates an XFRM_MSG_ALLOCSPI Netlink message, which triggers the kernel function xfrm_alloc_spi(). This function is expecte…
-
Unscored —CVE-2025-39799 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.