Summary
[6.12.0-106.55.4.1]
- netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso) [Orabug: 38712798] {CVE-2025-38678}
[6.12.0-106.55.4]
- ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek) [Orabug: 37844696] {CVE-2025-22117}
[6.12.0-106.55.3]
- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu) [Orabug: 38594966]
- Revert 'mptcp: disable by default' (Harshvardhan Jha) [Orabug: 38277777]
[6.12.0-106.55.2]
- LTS version: v6.12.55 (Jack Vogel)
- dmaengine: Add missing cleanup on module unload (Guenter Roeck)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) [Orabug: 38592024] {CVE-2025-40040}
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601817] {CVE-2025-40087}
- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (Devarsh Thakkar)
- mptcp: reset blackhole on success with non-loopback ifaces (Matthieu Baerts)
- mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). (Kuniyuki Iwashima)
- mptcp: Call dst_release() in mptcp_active_enable(). (Kuniyuki Iwashima)
- net: Add locking to protect skb->dev access in ip_output (Sharath Chandra Vurukala)
- ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] (Eric Dumazet)
- net: dst: add four helpers to annotate data-races around dst->dev (Eric Dumazet)
- tcp: cache RTAX_QUICKACK metric in a hot cache line (Eric Dumazet)
- tcp: convert to dev_net_rcu() (Eric Dumazet)
- ixgbevf: fix mailbox API compatibility by negotiating supported features (Jedrzej Jagielski) [Orabug: 38601914] {CVE-2025-40104}
- ixgbevf: fix getting link speed data for E610 devices (Jedrzej Jagielski)
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601921] {CVE-2025-40105}
- d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier (Al Viro)
- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger)
- x86/resctrl: Refactor resctrl_arch_rmid_read() (Babu Moger)
- md: fix mssing blktrace bio split events (Yu Kuai)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- xfs: use deferred intent items for reaping crosslinked blocks (Darrick J. Wong)
- wifi: rtw89: avoid possible TX wait initialization race (Fedor Pchelkin)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Implement large extent array support in pNFS (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- NFSD: Rework encoding and decoding of nfsd4_deviceid (Sergey Bashirov)
- nfsd: Drop dprintk in blocklayout xdr functions (Sergey Bashirov)
- nfsd: Use correct error code when decoding extents (Sergey Bashirov)
- iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended (Sean Nyekjaer)
- iio: imu: inv_icm42600: Simplify pm_runtime setup (Sean Nyekjaer)
- PM: runtime: Add new devm functions (Csokas Bence)
- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (Devarsh Thakkar)
- phy: cdns-dphy: Store hs_clk_rate and return it (Tomi Valkeinen)
- xfs: fix log CRC mismatches between i386 and other architectures (Christoph Hellwig)
- xfs: rename the old_crc variable in xlog_recover_process (Christoph Hellwig)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- nvme/tcp: handle tls partially sent records in write_space() (Wilfred Mallawa)
- selftests: arg_parsing: Ensure data is flushed to disk before reading. (Xing Guo)
- ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Li Qiang)
- HID: multitouch: fix name of Stylus input devices (Thadeu Lima de Souza Cascardo)
- HID: hid-input: only ignore 0 battery events for digitizers (Dmitry Torokhov)
- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jiaming Zhang) [Orabug: 38597092] {CVE-2025-40085}
- selftests/bpf: make arg_parsing.c more robust to crashes (Andrii Nakryiko)
- accel/qaic: Synchronize access to DBC request queue head & tail pointer (Pranjal Ramajor Asha Kanojiya)
- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (Youssef Samir)
- accel/qaic: Fix bootlog initialization ordering (Jeffrey Hugo)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- drm/rockchip: vop2: use correct destination rectangle height check (Alok Tiwari)
- drm/draw: fix color truncation in drm_draw_fill24 (Francesco Valla)
- drm/amd/powerplay: Fix CIK shutdown temperature (Timur Kristof)
- drm/amdgpu: fix handling of harvesting for ip_discovery firmware (Alex Deucher)
- drm/amdgpu: add support for cyan skillfish without IP discovery (Alex Deucher)
- drm/amdgpu: add ip offset support for cyan skillfish (Alex Deucher)
- drm/i915/guc: Skip communication warning on reset in progress (Zhanjun Dong)
- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Cristian Ciocaltea)
- ASoC: nau8821: Generalize helper to clear IRQ status (Cristian Ciocaltea)
- ASoC: nau8821: Cancel jdet_work before handling jack ejection (Cristian Ciocaltea)
- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Christophe Leroy)
- drm/bridge: lt9211: Drop check for last nibble of version register (Marek Vasut)
- riscv: kprobes: Fix probe address validation (Fabian Vogt)
- nvme-multipath: Skip nr_active increments in RETRY disposition (Amit Chaudhary)
- drm/panthor: Ensure MCU is disabled on suspend (Ketil Johnsen)
- net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset (I Viswanath)
- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (Oleksij Rempel)
- netdevsim: set the carrier when the device goes up (Breno Leitao)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: wait for pending async
Fixed packages 35
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | kernel-uek | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek-core | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek-debug | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-core | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-devel | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-core | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-deprecated | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-desktop | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-extra | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-extra-netfilter | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-usb | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-wireless | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek-devel | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek-doc | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek-modules | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-core | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-deprecated | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-desktop | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-extra | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-extra-netfilter | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-usb | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-wireless | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek-tools | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek64k | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek64k-core | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek64k-devel | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-core | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-deprecated | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-desktop | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-extra | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-extra-netfilter | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-usb | 0:6.12.0-106.55.4.1.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-wireless | 0:6.12.0-106.55.4.1.el10uek |
Vulnerabilities 41
-
Critical 9.4
cifs: parse_dfs_referrals: prevent oob on malformed input
In the Linux kernel, the following vulnerability has been resolved: cifs: parse_dfs_referrals: prevent oob on malformed input Malicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS - reply smaller than sizeof(struct get_dfs_referral_rsp) - rep…
-
High 8.8
iommu/vt-d: Disallow dirty tracking if incoherent page walk
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Disallow dirty tracking if incoherent page walk Dirty page tracking relies on the IOMMU atomically updating the dirty bit in the paging-structure entry. For this operation to succ…
-
High 8.7
ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw()
In the Linux kernel, the following vulnerability has been resolved: ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() Fix using the untrusted value of proto->raw.pkt_len in function ice_vc_fdir_parse_raw() by verifying if it does not exceed…
-
High 7.9
KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has …
-
High 7.8CVE-2025-38678 Public exploit
netfilter: nf_tables: reject duplicate device on updates
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject duplicate device on updates A chain/flowtable update with duplicated devices in the same batch is possible. Unfortunately, netdev event path only removes the firs…
-
High 7.8
ipvs: Defer ip_vs_ftp unregister during netns cleanup
In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leadin…
-
High 7.8
net/9p: fix double req put in p9_fd_cancelled
In the Linux kernel, the following vulnerability has been resolved: net/9p: fix double req put in p9_fd_cancelled Syzkaller reports a KASAN issue as below: general protection fault, probably for non-canonical address 0xfbd59c0000000021: 0000 [#1] PREEMPT SMP …
-
High 7.8CVE-2025-40040 Public exploit
mm/ksm: fix flag-dropping behavior in ksm_madvise
In the Linux kernel, the following vulnerability has been resolved: mm/ksm: fix flag-dropping behavior in ksm_madvise syzkaller discovered the following crash: (kernel BUG) [ 44.607039] ------------[ cut here ]------------ [ 44.607422] kernel BUG at mm/userfa…
-
High 7.8
fs: udf: fix OOB read in lengthAllocDescs handling
In the Linux kernel, the following vulnerability has been resolved: fs: udf: fix OOB read in lengthAllocDescs handling When parsing Allocation Extent Descriptor, lengthAllocDescs comes from on-disk data and must be validated against the block size. Crafted or…
-
High 7.8
io_uring/waitid: always prune wait queue entry in io_waitid_wait()
In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: always prune wait queue entry in io_waitid_wait() For a successful return, always remove our entry from the wait queue entry list. Previously this was skipped if a cancelatio…
-
High 7.8
vhost: vringh: Modify the return value check
In the Linux kernel, the following vulnerability has been resolved: vhost: vringh: Modify the return value check The return value of copy_from_iter and copy_to_iter can't be negative, check whether the copied lengths are equal.
-
High 7.8
RDMA/rxe: Fix race in do_task() when draining
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix race in do_task() when draining When do_task() exhausts its iteration budget (!ret), it sets the state to TASK_STATE_IDLE to reschedule, without a secondary check on the current…
-
High 7.8
perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
In the Linux kernel, the following vulnerability has been resolved: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() Cast nr_pages to unsigned long to avoid overflow when handling large AUX buffer sizes (>= 2 GiB).
-
High 7.8
drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies
In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies When adding dependencies with drm_sched_job_add_dependency(), that function consumes the fence reference both on su…
-
High 7.8
ixgbevf: fix mailbox API compatibility by negotiating supported features
In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix mailbox API compatibility by negotiating supported features There was backward compatibility in the terms of mailbox API. Various drivers from various OSes supporting 10G adapter…
-
High 7.8
vfs: Don't leak disconnected dentries on umount
In the Linux kernel, the following vulnerability has been resolved: vfs: Don't leak disconnected dentries on umount When user calls open_by_handle_at() on some inode that is not cached, we will create disconnected dentry for it. If such dentry is a directory,…
-
High 7.5
uio_hv_generic: Let userspace take care of interrupt mask
In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Let userspace take care of interrupt mask Remove the logic to set interrupt mask by default in uio_hv_generic driver as the interrupt mask value is supposed to be controlled c…
-
High 7.5
net: dlink: handle copy_thresh allocation failure
In the Linux kernel, the following vulnerability has been resolved: net: dlink: handle copy_thresh allocation failure The driver did not handle failure of `netdev_alloc_skb_ip_align()`. If the allocation failed, dereferencing `skb->protocol` could lead to a N…
-
High 7.5
NFSD: Define a proc_layoutcommit for the FlexFiles layout type
In the Linux kernel, the following vulnerability has been resolved: NFSD: Define a proc_layoutcommit for the FlexFiles layout type Avoid a crash if a pNFS client should happen to send a LAYOUTCOMMIT operation on a FlexFiles layout.
-
High 7.1
KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid Skip the WRMSR and HLT fastpaths in SVM's VM-Exit handler if the next RIP isn't valid, e.g. because KVM is running with nr…
-
Unscored —
ALSA: usb-audio: Kill timer properly at removal
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill timer properly at removal The USB-audio MIDI code initializes the timer, but in a rare case, the driver might be freed without the disconnect call. This leaves the timer…
-
Unscored —
scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
In the Linux kernel, the following vulnerability has been resolved: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue During the detaching of Marvell's SAS/SATA controller, the original code calls cancel_delayed_work() in mvs_free() to cancel the delayed…
-
Unscored —CVE-2025-40019 Public exploit
crypto: essiv - Check ssize for decryption and in-place encryption
In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption.
-
Unscored —
pinctrl: check the return value of pinmux_ops::get_function_name()
In the Linux kernel, the following vulnerability has been resolved: pinctrl: check the return value of pinmux_ops::get_function_name() While the API contract in docs doesn't specify it explicitly, the generic implementation of the get_function_name() callback…
-
Unscored —
tee: fix register_shm_helper()
In the Linux kernel, the following vulnerability has been resolved: tee: fix register_shm_helper() In register_shm_helper(), fix incorrect error handling for a call to iov_iter_extract_pages(). A case is missing for when iov_iter_extract_pages() only got some…
-
Unscored —
Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
In the Linux kernel, the following vulnerability has been resolved: Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak Struct ff_effect_compat is embedded twice inside uinput_ff_upload_compat, contains internal padding. In particular, …
-
Unscored —
fbdev: simplefb: Fix use after free in simplefb_detach_genpds()
In the Linux kernel, the following vulnerability has been resolved: fbdev: simplefb: Fix use after free in simplefb_detach_genpds() The pm_domain cleanup can not be devres managed as it uses struct simplefb_par which is allocated within struct fb_info by fram…
-
Unscored —
tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference There is a critical race condition in kprobe initialization that can lead to NULL pointer dereference and…
-
Unscored —
Squashfs: fix uninit-value in squashfs_get_parent
In the Linux kernel, the following vulnerability has been resolved: Squashfs: fix uninit-value in squashfs_get_parent Syzkaller reports a "KMSAN: uninit-value in squashfs_get_parent" bug. This is caused by open_by_handle_at() being called with a file handle c…
-
Unscored —
smb: client: fix crypto buffers in non-linear memory
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix crypto buffers in non-linear memory The crypto API, through the scatterlist API, expects input buffers to be in linear memory. We handle this with the cifs_sg_set_buf() helpe…
-
Unscored —
ocfs2: fix double free in user_cluster_connect()
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix double free in user_cluster_connect() user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then the error handling frees "lc" a second time. Set "lc" to NULL on thi…
-
Unscored —
vhost: vringh: Fix copy_to_iter return value check
In the Linux kernel, the following vulnerability has been resolved: vhost: vringh: Fix copy_to_iter return value check The return value of copy_to_iter can't be negative, check whether the copied length is equal to the requested length instead of checking for…
-
Unscored —
ptp: Add a upper bound on max_vclocks
In the Linux kernel, the following vulnerability has been resolved: ptp: Add a upper bound on max_vclocks syzbot reported WARNING in max_vclocks_store. This occurs when the argument max is too large for kcalloc to handle. Extend the guard to guard against val…
-
Unscored —
pps: fix warning in pps_register_cdev when register device fail
In the Linux kernel, the following vulnerability has been resolved: pps: fix warning in pps_register_cdev when register device fail Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error handling in __video_register_device()"), the release hook …
-
Unscored —
tty: n_gsm: Don't block input queue by waiting MSC
In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: Don't block input queue by waiting MSC Currently gsm_queue() processes incoming frames and when opening a DLC channel it calls gsm_dlci_open() which calls gsm_modem_update(). If b…
-
Unscored —
bpf: Explicitly check accesses to bpf_sock_addr
In the Linux kernel, the following vulnerability has been resolved: bpf: Explicitly check accesses to bpf_sock_addr Syzkaller found a kernel warning on the following sock_addr program: 0: r0 = 0 1: r2 = *(u32 *)(r1 +60) 2: exit which triggers: verifier bug: e…
-
Unscored —
nbd: restrict sockets to TCP and UDP
In the Linux kernel, the following vulnerability has been resolved: nbd: restrict sockets to TCP and UDP Recently, syzbot started to abuse NBD with all kinds of sockets. Commit cf1b2326b734 ("nbd: verify socket is supported during setup") made sure the socket…
-
Unscored —
ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card In try_to_register_card(), the return value of usb_ifnum_to_if() is passed directly to usb_interface_claimed() without a NU…
-
Unscored —
btrfs: do not assert we found block group item when creating free space tree
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not assert we found block group item when creating free space tree Currently, when building a free space tree at populate_free_space_tree(), if we are not using the block group tree…
-
Unscored —
btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST At the end of btrfs_load_block_group_zone_info() the first thing we do is to ensure that if the mapping type is…
-
Unscored —
smb: client: Fix refcount leak for cifs_sb_tlink
In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix refcount leak for cifs_sb_tlink Fix three refcount inconsistency issues related to `cifs_sb_tlink`. Comments for `cifs_sb_tlink` state that `cifs_put_tlink()` needs to be cal…