Summary
Chenyuan Yang discovered that the CEC driver driver in the Linux kernel
contained a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2024-23848)
Attila Szász discovered that the HFS+ file system implementation in the
Linux Kernel contained a heap overflow vulnerability. An attacker could use
a specially crafted file system image that, when mounted, could cause a
denial of service (system crash) or possibly execute arbitrary code.
(CVE-2025-0927)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- PowerPC architecture;
- GPIO subsystem;
- GPU drivers;
- Media drivers;
- Network drivers;
- SCSI subsystem;
- Direct Digital Synthesis drivers;
- TTY drivers;
- 9P distributed file system;
- JFS file system;
- NILFS2 file system;
- File systems infrastructure;
- BPF subsystem;
- Netfilter;
- Memory management;
- Amateur Radio drivers;
- B.A.T.M.A.N. meshing protocol;
- Bluetooth subsystem;
- Ethernet bridge;
- Networking core;
- IPv4 networking;
- IPv6 networking;
- Open vSwitch;
- Network traffic control;
- TIPC protocol;
- Wireless networking;
(CVE-2024-50134, CVE-2024-40981, CVE-2022-48772, CVE-2024-43900,
CVE-2023-52488, CVE-2024-49902, CVE-2023-52880, CVE-2024-50229,
CVE-2024-43892, CVE-2024-42068, CVE-2024-40910, CVE-2024-26685,
CVE-2024-43863, CVE-2024-53104, CVE-2024-41064, CVE-2023-52799,
CVE-2024-42070, CVE-2024-35896, CVE-2024-44931, CVE-2024-40943,
CVE-2024-36952, CVE-2024-38558, CVE-2024-50171, CVE-2023-52522,
CVE-2024-36964, CVE-2024-53156, CVE-2024-41063, CVE-2024-50117,
CVE-2023-52818, CVE-2024-43893, CVE-2024-50233, CVE-2024-44938,
CVE-2024-36886, CVE-2024-38567, CVE-2024-53164, CVE-2024-50148,
CVE-2024-40911)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-aws-hwe | 4.15.0-1178.191~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-gcp | 4.15.0-1171.188~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-oracle | 4.15.0-1140.151~16.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-aws | 4.15.0-1178.191 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-gcp-4.15 | 4.15.0-1171.188 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-kvm | 4.15.0-1161.166 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-oracle | 4.15.0-1140.151 |
Vulnerabilities 39
-
High 7.8
media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating …
KEV Feb 5, 2025 -
Critical 10.0
net: openvswitch: fix overwriting ct original tuple for ICMPv6
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix overwriting ct original tuple for ICMPv6 OVS_PACKET_CMD_EXECUTE has 3 main attributes: - OVS_PACKET_ATTR_KEY - Packet metadata in a netlink format. - OVS_PACKET_ATTR_PAC…
-
Critical 9.8CVE-2024-36886 Public exploit
tipc: fix UAF in error path
In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in error path Sam Page (sam4k) working with Trend Micro Zero Day Initiative reported a UAF in the tipc_buf_append() error path: BUG: KASAN: slab-use-after-free in kfree_skb_list…
-
High 8.8
net: fix possible store tearing in neigh_periodic_work()
In the Linux kernel, the following vulnerability has been resolved: net: fix possible store tearing in neigh_periodic_work() While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an …
-
High 8.8
fs/9p: only translate RWX permissions for plain 9P2000
In the Linux kernel, the following vulnerability has been resolved: fs/9p: only translate RWX permissions for plain 9P2000 Garbage in plain 9P2000's perm bits is allowed through, which causes it to be able to set (among others) the suid bit. This was presumab…
-
High 8.8
ax25: Fix refcount imbalance on inbound connections
In the Linux kernel, the following vulnerability has been resolved: ax25: Fix refcount imbalance on inbound connections When releasing a socket in ax25_release(), we call netdev_put() to decrease the refcount on the associated ax.25 device. However, the execu…
-
High 8.8
wifi: cfg80211: Lock wiphy in cfg80211_get_station
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Lock wiphy in cfg80211_get_station Wiphy should be locked before calling rdev_get_station() (see lockdep assert in ieee80211_get_station()). This fixes the following kernel NU…
-
High 7.8
jfs: fix array-index-out-of-bounds in dbFindLeaf
In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds in dbFindLeaf Currently while searching for dmtree_t for sufficient free blocks there is an array out of bounds while getting element in tp->dm_stree. To ad…
-
High 7.8
tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc Any unprivileged user can attach N_GSM0710 ldisc, but it requires CAP_NET_ADMIN to create a GSM network anyway. Require initial nam…
-
High 7.8
ocfs2: fix races between hole punching and AIO+DIO
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix races between hole punching and AIO+DIO After commit "ocfs2: return real error code in ocfs2_dio_wr_get_block", fstests/generic/300 become from always failed to sometimes failed: =…
-
High 7.8
powerpc/eeh: avoid possible crash when edev->pdev changes
In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: avoid possible crash when edev->pdev changes If a PCI device is removed during eeh_pe_report_edev(), edev->pdev will change and can cause a crash, hold the PCI rescan/remove lock…
-
High 7.8
bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()
In the Linux kernel, the following vulnerability has been resolved: bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro() set_memory_ro() can fail, leaving memory unprotected. Check its return and take it into account as an error.
-
High 7.8
memcg: protect concurrent access to mem_cgroup_idr
In the Linux kernel, the following vulnerability has been resolved: memcg: protect concurrent access to mem_cgroup_idr Commit 73f576c04b94 ("mm: memcontrol: fix cgroup creation failure after many small jobs") decoupled the memcg IDs from the CSS ID space to f…
-
High 7.8
jfs: check if leafidx greater than num leaves per dmap tree
In the Linux kernel, the following vulnerability has been resolved: jfs: check if leafidx greater than num leaves per dmap tree syzbot report a out of bounds in dbSplit, it because dmt_leafidx greater than num leaves per dmap tree, add a checking for dmt_leaf…
-
High 7.8
wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() I found the following bug in my fuzzer: UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26…
-
High 7.8
net: sched: fix ordering of qlen adjustment
In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ordering of qlen adjustment Changes to sch->q.qlen around qdisc_tree_reduce_backlog() need to happen _before_ a call to said function because otherwise it may fail to notify p…
-
High 7.3
drm/amd: Guard against bad data for ATIF ACPI method
In the Linux kernel, the following vulnerability has been resolved: drm/amd: Guard against bad data for ATIF ACPI method If a BIOS provides bad data in response to an ATIF method call this causes a NULL pointer dereference in the caller. ``` ? show_regs (arch…
-
High 7.1
netfilter: validate user input for expected length
In the Linux kernel, the following vulnerability has been resolved: netfilter: validate user input for expected length I got multiple syzbot reports showing old bugs exposed by BPF after commit 20f2505fb436 ("bpf: Try to avoid kzalloc in cgroup/{s,g}etsockopt…
-
Medium 5.5
In the Linux kernel through 6.7.1, there is a use-after-free in cec_queue_msg_fh, related to drivers/media/cec/core/cec…
-
Medium 5.5
nilfs2: fix potential bug in end_buffer_async_write
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential bug in end_buffer_async_write According to a syzbot report, end_buffer_async_write(), which handles the completion of block device writes, may detect abnormal condition …
-
Medium 5.5
Bluetooth: bnep: fix wild-memory-access in proto_unregister
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix wild-memory-access in proto_unregister There's issue as follows: KASAN: maybe wild-memory-access in range [0xdead...108-0xdead...10f] CPU: 3 UID: 0 PID: 2805 Comm: rmmod …
-
Medium 5.5
net: systemport: fix potential memory leak in bcm_sysport_xmit()
In the Linux kernel, the following vulnerability has been resolved: net: systemport: fix potential memory leak in bcm_sysport_xmit() The bcm_sysport_xmit() returns NETDEV_TX_OK without freeing skb in case of dma_map_single() fails, add dev_kfree_skb() to fix …
-
Medium 5.5
nilfs2: fix potential deadlock with newly created symlinks
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential deadlock with newly created symlinks Syzbot reported that page_symlink(), called by nilfs_symlink(), triggers memory reclamation involving the filesystem layer, which ca…
-
Medium 5.5
staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()
In the Linux kernel, the following vulnerability has been resolved: staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg() In the ad9832_write_frequency() function, clk_get_rate() might return 0. This can lead to a division by zero whe…
-
Unscored —
media: lgdt3306a: Add a check against null-pointer-def
In the Linux kernel, the following vulnerability has been resolved: media: lgdt3306a: Add a check against null-pointer-def The driver should check whether the client provides the platform_data. The following log reveals it: [ 29.610324] BUG: KASAN: null-ptr-d…
-
Unscored —
serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO
In the Linux kernel, the following vulnerability has been resolved: serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO The SC16IS7XX IC supports a burst mode to access the FIFOs where the initial register address is sent ($00), followe…
-
Unscored —
drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
In the Linux kernel, the following vulnerability has been resolved: drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 For pptable structs that use flexible array sizes, use flexible arrays.
-
Unscored —
scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up There are cases after NPIV deletion where the fabric switch still believes the NPIV is logged into the fabric. This…
-
Unscored —
wifi: carl9170: add a proper sanity check for endpoints
In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: add a proper sanity check for endpoints Syzkaller reports [1] hitting a warning which is caused by presence of a wrong endpoint type at the URB sumbitting stage. While there w…
-
Unscored —
batman-adv: bypass empty buckets in batadv_purge_orig_ref()
In the Linux kernel, the following vulnerability has been resolved: batman-adv: bypass empty buckets in batadv_purge_orig_ref() Many syzbot reports are pointing to soft lockups in batadv_purge_orig_ref() [1] Root cause is unknown, but we can avoid spending to…
-
Unscored —
Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: cancel all works upon hci_unregister_dev() syzbot is reporting that calling hci_release_dev() from hci_error_reset() due to hci_dev_put() from hci_error_reset() can cause…
-
Unscored —
netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers register store validation for NFT_DATA_VALUE is conditional, however, the datatype is always either NFT_DATA_VAL…
-
Unscored —
drm/vmwgfx: Fix a deadlock in dma buf fence polling
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix a deadlock in dma buf fence polling Introduce a version of the fence ops that on release doesn't remove the fence from the pending list, and thus doesn't require a lock to fix…
-
Unscored —
serial: core: check uartclk for zero to avoid divide by zero
In the Linux kernel, the following vulnerability has been resolved: serial: core: check uartclk for zero to avoid divide by zero Calling ioctl TIOCSSERIAL with an invalid baud_base can result in uartclk being zero, which will result in a divide by zero error …
-
Unscored —
media: xc2028: avoid use-after-free in load_firmware_cb()
In the Linux kernel, the following vulnerability has been resolved: media: xc2028: avoid use-after-free in load_firmware_cb() syzkaller reported use-after-free in load_firmware_cb() [1]. The reason is because the module allocated a struct tuner in tuner_probe…
-
Unscored —
gpio: prevent potential speculation leaks in gpio_device_get_desc()
In the Linux kernel, the following vulnerability has been resolved: gpio: prevent potential speculation leaks in gpio_device_get_desc() Userspace may trigger a speculative read of an address outside the gpio descriptor array. Users can do that by calling gpio…
-
Unscored —
jfs: Fix shift-out-of-bounds in dbDiscardAG
In the Linux kernel, the following vulnerability has been resolved: jfs: Fix shift-out-of-bounds in dbDiscardAG When searching for the next smaller log2 block, BLKSTOL2() returned 0, causing shift exponent -1 to be negative. This patch fixes the issue by exit…
-
Unscored —
drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA
In the Linux kernel, the following vulnerability has been resolved: drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA Replace the fake VLA at end of the vbva_mouse_pointer_shape shape with a real VLA to fix a "memcpy: detected f…
-
Unscored —CVE-2025-0927 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Filesystem bugs due to corrupt images are no…
References
-
report
https://ubuntu.com/security/CVE-2022-48772
-
report
https://ubuntu.com/security/CVE-2023-52488
-
report
https://ubuntu.com/security/CVE-2023-52522
-
report
https://ubuntu.com/security/CVE-2023-52799
-
report
https://ubuntu.com/security/CVE-2023-52818
-
report
https://ubuntu.com/security/CVE-2023-52880
-
report
https://ubuntu.com/security/CVE-2024-23848
-
report
https://ubuntu.com/security/CVE-2024-26685
-
report
https://ubuntu.com/security/CVE-2024-35896
-
report
https://ubuntu.com/security/CVE-2024-36886
-
report
https://ubuntu.com/security/CVE-2024-36952
-
report
https://ubuntu.com/security/CVE-2024-36964
-
report
https://ubuntu.com/security/CVE-2024-38558
-
report
https://ubuntu.com/security/CVE-2024-38567
-
report
https://ubuntu.com/security/CVE-2024-40910
-
report
https://ubuntu.com/security/CVE-2024-40911
-
report
https://ubuntu.com/security/CVE-2024-40943
-
report
https://ubuntu.com/security/CVE-2024-40981
-
report
https://ubuntu.com/security/CVE-2024-41063
-
report
https://ubuntu.com/security/CVE-2024-41064
-
report
https://ubuntu.com/security/CVE-2024-42068
-
report
https://ubuntu.com/security/CVE-2024-42070
-
report
https://ubuntu.com/security/CVE-2024-43863
-
report
https://ubuntu.com/security/CVE-2024-43892
-
report
https://ubuntu.com/security/CVE-2024-43893
-
report
https://ubuntu.com/security/CVE-2024-43900
-
report
https://ubuntu.com/security/CVE-2024-44931
-
report
https://ubuntu.com/security/CVE-2024-44938
-
report
https://ubuntu.com/security/CVE-2024-49902
-
report
https://ubuntu.com/security/CVE-2024-50117
-
report
https://ubuntu.com/security/CVE-2024-50134
-
report
https://ubuntu.com/security/CVE-2024-50148
-
report
https://ubuntu.com/security/CVE-2024-50171
-
report
https://ubuntu.com/security/CVE-2024-50229
-
report
https://ubuntu.com/security/CVE-2024-50233
-
report
https://ubuntu.com/security/CVE-2024-53104
-
report
https://ubuntu.com/security/CVE-2024-53156
-
report
https://ubuntu.com/security/CVE-2024-53164
-
report
https://ubuntu.com/security/CVE-2025-0927