Summary
In the Linux kernel, the following vulnerability has been
resolved: e100: Fix possible use after free in e100_xmit_prepare In
e100_xmit_prepare(), if we can't map the skb, then return -ENOMEM, so
e100_xmit_frame() will return NETDEV_TX_BUSY and the upper layer will
resend the skb.
In the Linux kernel, the following vulnerability has been
resolved: macsec: fix UAF bug for real_dev Create a new macsec device but
not get reference to real_dev.
In the Linux kernel, the following vulnerability has been
resolved: wifi: ath12k: fix firmware crash due to invalid peer nss
Currently, if the access point receives an association request containing
an Extended HE Capabilities Information Element with an invalid MCS-NSS, it
triggers a firmware crash.
In the Linux kernel, the following vulnerability has been
resolved: drm/xe/oa: Fix overflow in oa batch buffer By default
xe_bb_create_job() appends a MI_BATCH_BUFFER_END to batch buffer, this is
not a problem if batch buffer is only used once but oa reuses the batch
buffer for the same metric and at each call it appends a
MI_BATCH_BUFFER_END, printing the warning below and then overflowing.
In the Linux kernel, the following vulnerability has been
resolved: NFSD: Prevent NULL dereference in nfsd4_process_cb_update() @ses
is initialized to NULL.
In the Linux kernel, the following vulnerability has been
resolved: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
Explicitly verify the target vCPU is fully online _prior_ to clamping the
index in kvm_get_vcpu().
In the Linux kernel, the following vulnerability has been
resolved: sched: sch_cake: add bounds checks to host bulk flow fairness
counts Even though we fixed a logic error in the commit cited below, syzbot
still managed to trigger an underflow of the per-host bulk flow counters,
leading to an out of bounds memory access.
In the Linux kernel, the following vulnerability has been
resolved: net: sched: fix ets qdisc OOB Indexing Haowei Yan
<g1042620637@gmail.com> found that ets_class_from_arg() can index an Out-
Of-Bound class in ets_class_from_arg() when passed clid of 0.
In the Linux kernel, the following vulnerability has been
resolved: usb: cdc-acm: Check control transfer buffer size before access If
the first fragment is shorter than struct usb_cdc_notification, we can't
calculate an expected_size.
In the Linux kernel, the following vulnerability has been
resolved: net: davicom: fix UAF in dm9000_drv_remove dm is netdev private
data and it cannot be used after free_netdev() call.
In the Linux kernel, the following vulnerability has been
resolved: exfat: fix random stack corruption after get_block When get_block
is called with a buffer_head allocated on the stack, such as
do_mpage_readpage, stack corruption due to buffer_head UAF may occur in the
following race condition situation.
Fixed packages 26
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux | 4.15.0-247.259 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-aws | 4.15.0-1189.202 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-azure-4.15 | 4.15.0-1197.212 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-gcp-4.15 | 4.15.0-1182.199 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-hwe-5.4 | 5.4.0-224.244~18.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-oracle | 4.15.0-1151.162 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux | 5.4.0-224.244 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-aws | 5.4.0-1153.163 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-aws-5.15 | 5.15.0-1098.105~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-azure-5.15 | 5.15.0-1102.111~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gcp-5.15 | 5.15.0-1098.107~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-hwe-5.15 | 5.15.0-164.174~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-ibm-5.15 | 5.15.0-1092.95~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-lowlatency-hwe-5.15 | 5.15.0-164.174~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-oracle-5.15 | 5.15.0-1095.101~20.04.1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux | 5.15.0-164.174 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-aws | 5.15.0-1098.105 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-azure | 5.15.0-1102.111 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-gcp | 5.15.0-1098.107 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-oracle | 5.15.0-1095.101 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | linux | 6.8.0-86.87 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | linux-aws | 6.8.0-1041.43 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | linux-azure | 6.8.0-1041.47 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | linux-gcp | 6.8.0-1042.45 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | linux-ibm | 6.8.0-1039.39 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | linux-oracle | 6.8.0-1038.39 |
Vulnerabilities 11
-
High 7.8
e100: Fix possible use after free in e100_xmit_prepare
In the Linux kernel, the following vulnerability has been resolved: e100: Fix possible use after free in e100_xmit_prepare In e100_xmit_prepare(), if we can't map the skb, then return -ENOMEM, so e100_xmit_frame() will return NETDEV_TX_BUSY and the upper laye…
-
High 7.8
macsec: fix UAF bug for real_dev
In the Linux kernel, the following vulnerability has been resolved: macsec: fix UAF bug for real_dev Create a new macsec device but not get reference to real_dev. That can not ensure that real_dev is freed after macsec. That will trigger the UAF bug for real_…
-
High 7.8
drm/xe/oa: Fix overflow in oa batch buffer
In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix overflow in oa batch buffer By default xe_bb_create_job() appends a MI_BATCH_BUFFER_END to batch buffer, this is not a problem if batch buffer is only used once but oa reuses t…
-
High 7.8
KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
In the Linux kernel, the following vulnerability has been resolved: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() Explicitly verify the target vCPU is fully online _prior_ to clamping the index in kvm_get_vcpu(). If the index is "bad", the no…
-
High 7.8CVE-2025-21692 Public exploit
net: sched: fix ets qdisc OOB Indexing
In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ets qdisc OOB Indexing Haowei Yan <g1042620637@gmail.com> found that ets_class_from_arg() can index an Out-Of-Bound class in ets_class_from_arg() when passed clid of 0. The ov…
-
High 7.8
net: davicom: fix UAF in dm9000_drv_remove
In the Linux kernel, the following vulnerability has been resolved: net: davicom: fix UAF in dm9000_drv_remove dm is netdev private data and it cannot be used after free_netdev() call. Using dm after free_netdev() can cause UAF bug. Fix it by moving free_netd…
-
High 7.8
exfat: fix random stack corruption after get_block
In the Linux kernel, the following vulnerability has been resolved: exfat: fix random stack corruption after get_block When get_block is called with a buffer_head allocated on the stack, such as do_mpage_readpage, stack corruption due to buffer_head UAF may o…
-
High 7.5
NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent NULL dereference in nfsd4_process_cb_update() @ses is initialized to NULL. If __nfsd4_find_backchannel() finds no available backchannel session, setup_callback_client() will try…
-
High 7.3
sched: sch_cake: add bounds checks to host bulk flow fairness counts
In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: add bounds checks to host bulk flow fairness counts Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host…
-
Unscored —
wifi: ath12k: fix firmware crash due to invalid peer nss
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix firmware crash due to invalid peer nss Currently, if the access point receives an association request containing an Extended HE Capabilities Information Element with an inva…
-
Unscored —
usb: cdc-acm: Check control transfer buffer size before access
In the Linux kernel, the following vulnerability has been resolved: usb: cdc-acm: Check control transfer buffer size before access If the first fragment is shorter than struct usb_cdc_notification, we can't calculate an expected_size. Log an error and discard…
References
-
report
https://ubuntu.com/security/CVE-2022-49026
-
report
https://ubuntu.com/security/CVE-2022-49390
-
report
https://ubuntu.com/security/CVE-2024-46827
-
report
https://ubuntu.com/security/CVE-2024-50090
-
report
https://ubuntu.com/security/CVE-2024-53217
-
report
https://ubuntu.com/security/CVE-2024-58083
-
report
https://ubuntu.com/security/CVE-2025-21647
-
report
https://ubuntu.com/security/CVE-2025-21692
-
report
https://ubuntu.com/security/CVE-2025-21704
-
report
https://ubuntu.com/security/CVE-2025-21715
-
report
https://ubuntu.com/security/CVE-2025-22036