Summary
It was discovered that the CIFS network file system implementation in the
Linux kernel did not properly verify the target namespace when handling
upcalls. An attacker could use this to expose sensitive information.
(CVE-2025-2312)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- PowerPC architecture;
- x86 architecture;
- Compute Acceleration Framework;
- ACPI drivers;
- Ublk userspace block driver;
- Compressed RAM block device driver;
- Bus devices;
- AMD CDX bus driver;
- Clock framework and drivers;
- DMA engine subsystem;
- DPLL subsystem;
- Qualcomm firmware drivers;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- IIO subsystem;
- InfiniBand drivers;
- Multiple devices driver;
- Media drivers;
- MemoryStick subsystem;
- Network drivers;
- Mellanox network drivers;
- NTB driver;
- NVME drivers;
- PCI subsystem;
- Pin controllers subsystem;
- RapidIO drivers;
- Voltage and Current Regulator drivers;
- Remote Processor subsystem;
- SCSI subsystem;
- SLIMbus drivers;
- QCOM SoC drivers;
- VideoCore services drivers;
- Thermal drivers;
- USB DSL drivers;
- USB Host Controller drivers;
- Renesas USBHS Controller drivers;
- USB Type-C Connector System Software Interface driver;
- Virtio Host (VHOST) subsystem;
- Framebuffer layer;
- ACRN Hypervisor Service Module driver;
- W1 Dallas's 1-wire bus driver;
- 9P distributed file system;
- File systems infrastructure;
- Ext4 file system;
- JFS file system;
- Network file systems library;
- Network file system (NFS) client;
- Network file system (NFS) server daemon;
- NTFS3 file system;
- Proc file system;
- SMB network file system;
- Memory Management;
- Key Management;
- Memory management;
- Scheduler infrastructure;
- UProbes tracing;
- RDMA verbs API;
- SoC audio core drivers;
- BPF subsystem;
- Perf events;
- Kernel fork() syscall;
- Tracing infrastructure;
- Watch queue notification mechanism;
- 802.1Q VLAN protocol;
- Asynchronous Transfer Mode (ATM) subsystem;
- Bluetooth subsystem;
- Networking core;
- Devlink API;
- IPv4 networking;
- IPv6 networking;
- Logical Link layer;
- Management Component Transport Protocol (MCTP);
- Netfilter;
- Network traffic control;
- SCTP protocol;
- Switch device API;
- Wireless networking;
- eXpress Data Path;
- Key management;
- ALSA framework;
- SoC Audio for Freescale CPUs drivers;
(CVE-2025-21913, CVE-2025-22070, CVE-2025-21918, CVE-2025-21916,
CVE-2025-22090, CVE-2025-22040, CVE-2025-21972, CVE-2025-21920,
CVE-2025-22071, CVE-2025-21989, CVE-2025-22037, CVE-2025-22068,
CVE-2025-38049, CVE-2025-21980, CVE-2025-21956, CVE-2025-21962,
CVE-2025-21929, CVE-2025-37785, CVE-2025-37889, CVE-2025-21990,
CVE-2025-21966, CVE-2025-38240, CVE-2025-22058, CVE-2025-22072,
CVE-2025-22056, CVE-2025-21963, CVE-2025-23134, CVE-2025-22075,
CVE-2025-22054, CVE-2025-22064, CVE-2025-22027, CVE-2025-21927,
CVE-2025-21943, CVE-2025-22081, CVE-2025-21975, CVE-2025-39735,
CVE-2025-22088, CVE-2025-21996, CVE-2025-22009, CVE-2025-22000,
CVE-2025-21912, CVE-2025-21967, CVE-2025-21995, CVE-2025-21973,
CVE-2025-21908, CVE-2025-22047, CVE-2025-21930, CVE-2025-22078,
CVE-2025-21957, CVE-2025-22021, CVE-2025-22019, CVE-2025-21935,
CVE-2025-21951, CVE-2025-37937, CVE-2025-22043, CVE-2025-22057,
CVE-2025-21922, CVE-2025-22003, CVE-2025-21978, CVE-2025-22010,
CVE-2025-39989, CVE-2025-22034, CVE-2025-21986, CVE-2025-22016,
CVE-2025-21960, CVE-2025-22038, CVE-2025-21924, CVE-2025-22015,
CVE-2025-38152, CVE-2025-21939, CVE-2025-21917, CVE-2025-21974,
CVE-2025-22001, CVE-2025-22025, CVE-2025-22062, CVE-2025-21979,
CVE-2025-21911, CVE-2025-22045, CVE-2025-21914, CVE-2025-21937,
CVE-2025-22095, CVE-2025-21981, CVE-2025-22014, CVE-2025-21947,
CVE-2025-22007, CVE-2025-21925, CVE-2025-22089, CVE-2025-21923,
CVE-2025-38575, CVE-2025-22018, CVE-2025-22073, CVE-2025-21948,
CVE-2025-22080, CVE-2025-22053, CVE-2025-21903, CVE-2025-21969,
CVE-2025-21926, CVE-2025-21941, CVE-2025-40114, CVE-2025-22066,
CVE-2025-22017, CVE-2025-21945, CVE-2025-22065, CVE-2025-22086,
CVE-2025-22032, CVE-2025-22097, CVE-2025-22083, CVE-2025-22044,
CVE-2025-23136, CVE-2025-22046, CVE-2025-22041, CVE-2025-38479,
CVE-2025-21998, CVE-2025-22002, CVE-2025-39688, CVE-2025-22033,
CVE-2025-21970, CVE-2025-22022, CVE-2025-21936, CVE-2025-22050,
CVE-2025-21984, CVE-2025-21928, CVE-2025-38637, CVE-2025-22030,
CVE-2025-21915, CVE-2025-22013, CVE-2025-21997, CVE-2025-22059,
CVE-2025-21961, CVE-2025-21909, CVE-2025-21955, CVE-2025-39778,
CVE-2025-22055, CVE-2023-53034, CVE-2025-39728, CVE-2025-22020,
CVE-2025-22005, CVE-2025-22060, CVE-2025-21902, CVE-2025-22008,
CVE-2025-23138, CVE-2025-21991, CVE-2025-21999, CVE-2025-21982,
CVE-2024-58092, CVE-2025-21992, CVE-2025-22028, CVE-2025-22042,
CVE-2025-22087, CVE-2025-21894, CVE-2025-21934, CVE-2025-21893,
CVE-2025-22079, CVE-2025-22023, CVE-2025-21977, CVE-2024-58093,
CVE-2025-21904, CVE-2025-21910, CVE-2025-22024, CVE-2025-21964,
CVE-2025-21946, CVE-2025-21905, CVE-2025-22084, CVE-2025-21950,
CVE-2025-22011, CVE-2025-21968, CVE-2025-22035, CVE-2025-22004,
CVE-2025-21919, CVE-2025-22039, CVE-2025-22063, CVE-2024-53222,
CVE-2025-21944, CVE-2025-21959, CVE-2025-21994, CVE-2025-21906)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | linux-lowlatency-hwe-6.11 | 6.11.0-1015.16~24.04.2 |
Vulnerabilities 177
-
Critical 10.0
netfilter: socket: Lookup orig tuple for IPv6 SNAT
In the Linux kernel, the following vulnerability has been resolved: netfilter: socket: Lookup orig tuple for IPv6 SNAT nf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to restore the original 5-tuple in case of SNAT, to be able to find the righ…
-
Critical 9.8
nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() nvme_tcp_recv_pdu() doesn't check the validity of the header length. When header digests are enabled, a target might send a pa…
-
Critical 9.8
RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() After the erdma_cep_put(new_cep) being called, new_cep will be freed, and the following dereference will cause a UAF problem. Fix …
-
High 8.8
ksmbd: fix use-after-free in smb2_lock
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb2_lock If smb_lock->zero_len has value, ->llist of smb_lock is not delete and flock is old one. It will cause use-after-free on error handling routine.
-
High 8.8
ksmbd: fix out-of-bounds in parse_sec_desc()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds in parse_sec_desc() If osidoffset, gsidoffset and dacloffset could be greater than smb_ntsd struct size. If it is smaller, It could cause slab-out-of-bounds. And when…
-
High 8.8
ksmbd: prevent connection release during oplock break notification
In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent connection release during oplock break notification ksmbd_work could be freed when after connection release. Increment r_count of ksmbd_conn to indicate that requests are not f…
-
High 8.8
ksmbd: fix use-after-free in ksmbd_free_work_struct
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_free_work_struct ->interim_entry of ksmbd_work could be deleted after oplock is freed. We don't need to manage it with linked list. The interim request coul…
-
High 8.8
Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd After the hci sync command releases l2cap_conn, the hci receive data work queue references the released l2cap_conn when sendin…
-
High 8.8
net: mctp: unshare packets when reassembling
In the Linux kernel, the following vulnerability has been resolved: net: mctp: unshare packets when reassembling Ensure that the frag_list used for reassembly isn't shared with other packets. This avoids incorrect reassembly when packets are cloned, and preve…
-
High 8.8
ksmbd: fix overflow in dacloffset bounds check
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix overflow in dacloffset bounds check The dacloffset field was originally typed as int and used in an unchecked addition, which could overflow and bypass the existing bounds check in…
-
High 8.8
ksmbd: fix session use-after-free in multichannel connection
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix session use-after-free in multichannel connection There is a race condition between session setup and ksmbd_sessions_deregister. The session can be freed before the connection is a…
-
High 8.8
ksmbd: fix use-after-free in ksmbd_sessions_deregister()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_sessions_deregister() In multichannel mode, UAF issue can occur in session_deregister when the second channel sets up a session through the connection of th…
-
High 8.8
RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow When cur_qp isn't NULL, in order to avoid fetching the QP from the radix tree again we check if the next cqe QP is identical to the one we al…
-
High 8.6
net: atm: fix use after free in lec_send()
In the Linux kernel, the following vulnerability has been resolved: net: atm: fix use after free in lec_send() The ->send() operation frees skb so save the length before calling ->send() to avoid a use after free.
-
High 8.4
fs/ntfs3: Prevent integer overflow in hdr_first_de()
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Prevent integer overflow in hdr_first_de() The "de_off" and "used" variables come from the disk so they both need to check. The problem is that on 32bit systems if they're both grea…
-
High 8.3
ksmbd: validate zero num_subauth before sub_auth is accessed
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate zero num_subauth before sub_auth is accessed Access psid->sub_auth[psid->num_subauth - 1] without checking if num_subauth is non-zero leads to an out-of-bounds read. This patc…
-
High 8.1
ksmbd: fix type confusion via race condition when using ipc_msg_send_request
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix type confusion via race condition when using ipc_msg_send_request req->handle is allocated using ksmbd_acquire_id(&ipc_ida), based on ida_alloc. req->handle from ksmbd_ipc_login_re…
-
High 8.1
ksmbd: add bounds check for create lease context
In the Linux kernel, the following vulnerability has been resolved: ksmbd: add bounds check for create lease context Add missing bounds check for create lease context.
-
High 8.1
ksmbd: add bounds check for durable handle context
In the Linux kernel, the following vulnerability has been resolved: ksmbd: add bounds check for durable handle context Add missing bounds check for durable handle context.
-
High 7.8
keys: Fix UAF in key_put()
In the Linux kernel, the following vulnerability has been resolved: keys: Fix UAF in key_put() Once a key's reference count has been reduced to 0, the garbage collector thread may destroy it at any time and so key_put() is not allowed to touch the key after t…
-
High 7.8
slimbus: messaging: Free transaction ID in delayed interrupt scenario
In the Linux kernel, the following vulnerability has been resolved: slimbus: messaging: Free transaction ID in delayed interrupt scenario In case of interrupt delay for any reason, slim_do_transfer() returns timeout error but the transaction ID (TID) is not f…
-
High 7.8
sched/fair: Fix potential memory corruption in child_cfs_rq_on_list
In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list child_cfs_rq_on_list attempts to convert a 'prev' pointer to a cfs_rq. This 'prev' pointer can originate from struct rq's l…
-
High 7.8
HID: hid-steam: Fix use-after-free when detaching device
In the Linux kernel, the following vulnerability has been resolved: HID: hid-steam: Fix use-after-free when detaching device When a hid-steam device is removed it must clean up the client_hdev used for intercepting hidraw access. This can lead to scheduling d…
-
High 7.8
net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error
In the Linux kernel, the following vulnerability has been resolved: net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error During the initialization of ptp, hclge_ptp_get_cycle might return an error and returned directl…
-
High 7.8
net: gso: fix ownership in __udp_gso_segment
In the Linux kernel, the following vulnerability has been resolved: net: gso: fix ownership in __udp_gso_segment In __udp_gso_segment the skb destructor is removed before segmenting the skb but the socket reference is kept as-is. This is an issue if the origi…
-
High 7.8
HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handli…
-
High 7.8
HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove()
In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() During the `rmmod` operation for the `intel_ishtp_hid` driver, a use-after-free issue can occur in the hid_ishtp_cl_remov…
-
High 7.8
rapidio: fix an API misues when rio_add_net() fails
In the Linux kernel, the following vulnerability has been resolved: rapidio: fix an API misues when rio_add_net() fails rio_add_net() calls device_register() and fails when device_register() fails. Thus, put_device() should be used rather than kfree(). Add "m…
-
High 7.8
drm/xe/hmm: Don't dereference struct page pointers without notifier lock
In the Linux kernel, the following vulnerability has been resolved: drm/xe/hmm: Don't dereference struct page pointers without notifier lock The pnfs that we obtain from hmm_range_fault() point to pages that we don't have a reference on, and the guarantee tha…
-
High 7.8
dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature
In the Linux kernel, the following vulnerability has been resolved: dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature Fix memory corruption due to incorrect parameter being passed to bio_init
-
High 7.8
drm/amd/display: Fix slab-use-after-free on hdcp_work
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix slab-use-after-free on hdcp_work [Why] A slab-use-after-free is reported when HDCP is destroyed but the property_validate_dwork queue is still running. [How] Cancel the d…
-
High 7.8
net/mlx5: Bridge, fix the crash caused by LAG state check
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Bridge, fix the crash caused by LAG state check When removing LAG device from bridge, NETDEV_CHANGEUPPER event is triggered. Driver finds the lower devices (PFs) to flush all the of…
-
High 7.8
wifi: cfg80211: cancel wiphy_work before freeing wiphy
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel wiphy_work before freeing wiphy A wiphy_work can be queued from the moment the wiphy is allocated and initialized (i.e. wiphy_new_nm). When a wiphy_work is queued, the …
-
High 7.8
mm: fix kernel BUG when userfaultfd_move encounters swapcache
In the Linux kernel, the following vulnerability has been resolved: mm: fix kernel BUG when userfaultfd_move encounters swapcache userfaultfd_move() checks whether the PTE entry is present or a swap entry. - If the PTE entry is present, move_present_pte() han…
-
High 7.8
x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes
In the Linux kernel, the following vulnerability has been resolved: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes Currently, load_microcode_amd() iterates over all NUMA nodes, retrieves their CPU masks and unconditionally accesses p…
-
High 7.8
proc: fix UAF in proc_get_inode()
In the Linux kernel, the following vulnerability has been resolved: proc: fix UAF in proc_get_inode() Fix race between rmmod and /proc/XXX's inode instantiation. The bug is that pde->proc_ops don't belong to /proc, it belongs to a module, therefore dereferenc…
-
High 7.8
accel/qaic: Fix integer overflow in qaic_validate_req()
In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Fix integer overflow in qaic_validate_req() These are u64 variables that come from the user via qaic_attach_slice_bo_ioctl(). Use check_add_overflow() to ensure that the math does…
-
High 7.8
mm/migrate: fix shmem xarray update during migration
In the Linux kernel, the following vulnerability has been resolved: mm/migrate: fix shmem xarray update during migration A shmem folio can be either in page cache or in swap cache, but not at the same time. Namely, once it is in swap cache, folio->mapping sho…
-
High 7.8
memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove This fixes the following crash: ================================================================== BUG: KASAN: slab-us…
-
High 7.8
usb: xhci: Apply the link chain quirk on NEC isoc endpoints
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Apply the link chain quirk on NEC isoc endpoints Two clearly different specimens of NEC uPD720200 (one with start/stop bug, one without) were seen to cause IOMMU faults after some …
-
High 7.8
mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs
In the Linux kernel, the following vulnerability has been resolved: mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs Patch series "mm: fixes for device-exclusive entries (hmm)", v2. Discussing the PageTail() call in make_device_exclusive_range() with Willy, I …
-
High 7.8
tracing: Fix use-after-free in print_graph_function_flags during tracer switching
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in print_graph_function_flags during tracer switching Kairui reported a UAF issue in print_graph_function_flags() during ftrace stress testing [1]. This issue can …
-
High 7.8
x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs On the following path, flush_tlb_range() can be used for zapping normal PMD entries (PMD entries that point to page tables) tog…
-
High 7.8
x86/microcode/AMD: Fix __apply_microcode_amd()'s return value
In the Linux kernel, the following vulnerability has been resolved: x86/microcode/AMD: Fix __apply_microcode_amd()'s return value When verify_sha256_digest() fails, __apply_microcode_amd() should propagate the failure by returning false (and not -1 which is p…
-
High 7.8
netfilter: nft_tunnel: fix geneve_opt type confusion addition
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix geneve_opt type confusion addition When handling multiple NFTA_TUNNEL_KEY_OPTS_GENEVE attributes, the parsing logic should place every geneve_opt structure one by o…
-
High 7.8
net: decrease cached dst counters in dst_release
In the Linux kernel, the following vulnerability has been resolved: net: decrease cached dst counters in dst_release Upstream fix ac888d58869b ("net: do not delay dst_entries_add() in dst_release()") moved decrementing the dst count from dst_destroy to dst_re…
-
High 7.8
sctp: add mutual exclusion in proc_sctp_do_udp_port()
In the Linux kernel, the following vulnerability has been resolved: sctp: add mutual exclusion in proc_sctp_do_udp_port() We must serialize calls to sctp_udp_sock_stop() and sctp_udp_sock_start() or risk a crash as syzbot reported: Oops: general protection fa…
-
High 7.8
ublk: make sure ubq->canceling is set when queue is frozen
In the Linux kernel, the following vulnerability has been resolved: ublk: make sure ubq->canceling is set when queue is frozen Now ublk driver depends on `ubq->canceling` for deciding if the request can be dispatched via uring_cmd & io_uring_cmd_complete_in_t…
-
High 7.8
spufs: fix gang directory lifetimes
In the Linux kernel, the following vulnerability has been resolved: spufs: fix gang directory lifetimes prior to "[POWERPC] spufs: Fix gang destroy leaks" we used to have a problem with gang lifetimes - creation of a gang returns opened gang directory, which …
-
High 7.8
ocfs2: validate l_tree_depth to avoid out-of-bounds access
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate l_tree_depth to avoid out-of-bounds access The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is limited to OCFS2_MAX_PATH_DEPTH. Add a check to prevent o…
-
High 7.8
fs/ntfs3: Fix a couple integer overflows on 32bit systems
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix a couple integer overflows on 32bit systems On 32bit systems the "off + sizeof(struct NTFS_DE)" addition can have an integer wrapping issue. Fix it by using size_add().
-
High 7.8
vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint If vhost_scsi_set_endpoint is called multiple times without a vhost_scsi_clear_endpoint between them, we can hit multiple…
-
High 7.8
bpf: Fix array bounds error with may_goto
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix array bounds error with may_goto may_goto uses an additional 8 bytes on the stack, which causes the interpreters[] array to go out of bounds when calculating index by stack_size. 1. …
-
High 7.8
RDMA/core: Don't expose hw_counters outside of init net namespace
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Don't expose hw_counters outside of init net namespace Commit 467f432a521a ("RDMA/core: Split port and device counter sysfs attributes") accidentally almost exposed hw counters to …
-
High 7.8
drm/vkms: Fix use after free and double free on init error
In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Fix use after free and double free on init error If the driver initialization fails, the vkms_exit() function might access an uninitialized or freed default_config pointer and it mi…
-
High 7.8
ext4: fix OOB read when checking dotdot dir
In the Linux kernel, the following vulnerability has been resolved: ext4: fix OOB read when checking dotdot dir Mounting a corrupted filesystem with directory which contains '.' dir entry with rec_len == block size results in out-of-bounds read (later on, whe…
-
High 7.8
iio: light: Add check for array bounds in veml6075_read_int_time_ms
In the Linux kernel, the following vulnerability has been resolved: iio: light: Add check for array bounds in veml6075_read_int_time_ms The array contains only 5 elements, but the index calculated by veml6075_read_int_time_index can range from 0 to 7, which c…
-
High 7.6
wifi: iwlwifi: mvm: clean up ROC on failure
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: clean up ROC on failure If the firmware fails to start the session protection, then we do call iwl_mvm_roc_finished() here, but that won't do anything at all because IWL_M…
-
High 7.6
ksmbd: fix incorrect validation for num_aces field of smb_acl
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix incorrect validation for num_aces field of smb_acl parse_dcal() validate num_aces to allocate posix_ace_state_array. if (num_aces > ULONG_MAX / sizeof(struct smb_ace *)) It is an i…
-
High 7.5
eth: bnxt: do not update checksum in bnxt_xdp_build_skb()
In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: do not update checksum in bnxt_xdp_build_skb() The bnxt_rx_pkt() updates ip_summed value at the end if checksum offload is enabled. When the XDP-MB program is attached and it retur…
-
High 7.5
eth: bnxt: fix truesize for mb-xdp-pass case
In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix truesize for mb-xdp-pass case When mb-xdp is set and return is XDP_PASS, packet is converted from xdp_buff to sk_buff with xdp_update_skb_shared_info() in bnxt_xdp_build_skb().…
-
High 7.5
nfsd: put dl_stid if fail to queue dl_recall
In the Linux kernel, the following vulnerability has been resolved: nfsd: put dl_stid if fail to queue dl_recall Before calling nfsd4_run_cb to queue dl_recall to the callback_wq, we increment the reference count of dl_stid. We expect that after the correspon…
-
High 7.5CVE-2025-22037 EPSS 69%
ksmbd: fix null pointer dereference in alloc_preauth_hash()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in alloc_preauth_hash() The Client send malformed smb2 negotiate request. ksmbd return error response. Subsequently, the client can send smb2 session setup…
-
High 7.5
udp: Fix multiple wraparounds of sk->sk_rmem_alloc.
In the Linux kernel, the following vulnerability has been resolved: udp: Fix multiple wraparounds of sk->sk_rmem_alloc. __udp_enqueue_schedule_skb() has the following condition: if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf) goto drop; sk->sk_rcvbuf is …
-
High 7.5
nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid()
In the Linux kernel, the following vulnerability has been resolved: nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() The pynfs DELEG8 test fails when run against nfsd. It acquires a delegation and then lets the lease time out. It then t…
-
High 7.3
netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() Since commit b36e4523d4d5 ("netfilter: nf_conncount: fix garbage collection confirm race"), `cpu` and `jif…
-
High 7.3
KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state There are several problems with the way hyp code lazily saves the host's FPSIMD/SVE state, including: * Host SVE being discard…
-
High 7.3
bcachefs: bch2_ioctl_subvolume_destroy() fixes
In the Linux kernel, the following vulnerability has been resolved: bcachefs: bch2_ioctl_subvolume_destroy() fixes bch2_evict_subvolume_inodes() was getting stuck - due to incorrectly pruning the dcache. Also, fix missing permissions checks.
-
High 7.3
x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()
In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() If track_pfn_copy() fails, we already added the dst VMA to the maple tree. As fork() fails, we'll cleanup the maple tree…
-
High 7.1
ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans
In the Linux kernel, the following vulnerability has been resolved: ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative. [ 23…
-
High 7.1
wifi: iwlwifi: limit printed string from FW file
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: limit printed string from FW file There's no guarantee here that the file is always with a NUL-termination, so reading the string may read beyond the end of the TLV. If that's …
-
High 7.1
vlan: enforce underlying device type
In the Linux kernel, the following vulnerability has been resolved: vlan: enforce underlying device type Currently, VLAN devices can be created on top of non-ethernet devices. Besides the fact that it doesn't make much sense, this also causes a bug which leak…
-
High 7.1
acpi: nfit: fix narrowing conversion in acpi_nfit_ctl
In the Linux kernel, the following vulnerability has been resolved: acpi: nfit: fix narrowing conversion in acpi_nfit_ctl Syzkaller has reported a warning in to_nfit_bus_uuid(): "only secondary bus families can be translated". This warning is emited if the ar…
-
High 7.1
net: fix geneve_opt length integer overflow
In the Linux kernel, the following vulnerability has been resolved: net: fix geneve_opt length integer overflow struct geneve_opt uses 5 bit length for each single option, which means every vary size option should be smaller than 128 bytes. However, all curre…
-
High 7.1
jfs: fix slab-out-of-bounds read in ea_get()
In the Linux kernel, the following vulnerability has been resolved: jfs: fix slab-out-of-bounds read in ea_get() During the "size_check" label in ea_get(), the code checks if the extended attribute list (xattr) size matches ea_size. If not, it logs "ea_get: i…
-
High 7.1
objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show()
In the Linux kernel, the following vulnerability has been resolved: objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show() The csts_state_names[] array only has six sparse entries, but the iteration code in nvmet_ctrl_state_show() iterates …
-
High 7.0
cdx: Fix possible UAF error in driver_override_show()
In the Linux kernel, the following vulnerability has been resolved: cdx: Fix possible UAF error in driver_override_show() Fixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c This function driver_override_show() is part of DEVICE_ATTR_R…
-
Medium 5.9
cifs.upcall makes an upcall to the wrong namespace in containerized environments
A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the hos…
-
Medium 5.5
caif_virtio: fix wrong pointer check in cfv_probe()
In the Linux kernel, the following vulnerability has been resolved: caif_virtio: fix wrong pointer check in cfv_probe() del_vqs() frees virtqueues, therefore cfv->vq_tx pointer should be checked for NULL before calling it, not cfv->vdev. Also the current impl…
-
Medium 5.5
NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback
In the Linux kernel, the following vulnerability has been resolved: NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback Add PF_KCOMPACTD flag and current_is_kcompactd() helper to check for it so nfs_release_folio() can skip calling nfs_wb_fol…
-
Medium 5.5
drm/imagination: avoid deadlock on fence release
In the Linux kernel, the following vulnerability has been resolved: drm/imagination: avoid deadlock on fence release Do scheduler queue fence release processing on a workqueue, rather than in the release function itself. Fixes deadlock issues such as the foll…
-
Medium 5.5
usb: renesas_usbhs: Flush the notify_hotplug_work
In the Linux kernel, the following vulnerability has been resolved: usb: renesas_usbhs: Flush the notify_hotplug_work When performing continuous unbind/bind operations on the USB drivers available on the Renesas RZ/G2L SoC, a kernel crash with the message "Un…
-
Medium 5.5
usb: typec: ucsi: Fix NULL pointer access
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Fix NULL pointer access Resources should be released only after all threads that utilize them have been destroyed. This commit ensures that resources are not released premat…
-
Medium 5.5
ppp: Fix KMSAN uninit-value warning with bpf
In the Linux kernel, the following vulnerability has been resolved: ppp: Fix KMSAN uninit-value warning with bpf Syzbot caught an "KMSAN: uninit-value" warning [1], which is caused by the ppp driver not initializing a 2-byte header when using socket filter. T…
-
Medium 5.5
wifi: iwlwifi: mvm: don't try to talk to a dead firmware
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't try to talk to a dead firmware This fixes: bad state = 0 WARNING: CPU: 10 PID: 702 at drivers/net/wireless/inel/iwlwifi/iwl-trans.c:178 iwl_trans_send_cmd+0xba/0xe0 …
-
Medium 5.5
Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected() Add check for the return value of mgmt_alloc_skb() in mgmt_device_connected() to prevent null pointer dereference.
-
Medium 5.5
Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name() Add check for the return value of mgmt_alloc_skb() in mgmt_remote_name() to prevent null pointer dereference.
-
Medium 5.5
drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params Null pointer dereference issue could occur when pipe_ctx->plane_state is null. The fix adds a check …
-
Medium 5.5
HID: appleir: Fix potential NULL dereference at raw event handle
In the Linux kernel, the following vulnerability has been resolved: HID: appleir: Fix potential NULL dereference at raw event handle Syzkaller reports a NULL pointer dereference issue in input_event(). BUG: KASAN: null-ptr-deref in instrument_atomic_read incl…
-
Medium 5.5
bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock
In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock There are multiple places from where the recovery work gets scheduled asynchronously. Also, there are multiple plac…
-
Medium 5.5
scsi: qla1280: Fix kernel oops when debug level > 2
In the Linux kernel, the following vulnerability has been resolved: scsi: qla1280: Fix kernel oops when debug level > 2 A null dereference or oops exception will eventually occur when qla1280.c driver is compiled with DEBUG_QLA1280 enabled and ql_debug_level …
-
Medium 5.5
cifs: Fix integer overflow while processing closetimeo mount option
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix integer overflow while processing closetimeo mount option User-provided mount parameter closetimeo of type u32 is intended to have an upper limit, but before it is validated, the va…
-
Medium 5.5
cifs: Fix integer overflow while processing acdirmax mount option
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix integer overflow while processing acdirmax mount option User-provided mount parameter acdirmax of type u32 is intended to have an upper limit, but before it is validated, the value …
-
Medium 5.5
cifs: Fix integer overflow while processing acregmax mount option
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix integer overflow while processing acregmax mount option User-provided mount parameter acregmax of type u32 is intended to have an upper limit, but before it is validated, the value …
-
Medium 5.5
sched: address a potential NULL pointer dereference in the GRED scheduler.
In the Linux kernel, the following vulnerability has been resolved: sched: address a potential NULL pointer dereference in the GRED scheduler. If kzalloc in gred_init returns a NULL pointer, the code follows the error handling path, invoking gred_destroy. Thi…
-
Medium 5.5
ice: fix memory leak in aRFS after reset
In the Linux kernel, the following vulnerability has been resolved: ice: fix memory leak in aRFS after reset Fix aRFS (accelerated Receive Flow Steering) structures memory leak by adding a checker to verify if aRFS memory is already allocated while configurin…
-
Medium 5.5
pinctrl: nuvoton: npcm8xx: Add NULL check in npcm8xx_gpio_fw
In the Linux kernel, the following vulnerability has been resolved: pinctrl: nuvoton: npcm8xx: Add NULL check in npcm8xx_gpio_fw devm_kasprintf() calls can return null pointers on failure. But the return values were not checked in npcm8xx_gpio_fw(). Add NULL …
-
Medium 5.5
drm/amd/display: fix missing .is_two_pixels_per_container
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix missing .is_two_pixels_per_container Starting from 6.11, AMDGPU driver, while being loaded with amdgpu.dc=1, due to lack of .is_two_pixels_per_container function in dce60…
-
Medium 5.5
drm/amdgpu: NULL-check BO's backing store when determining GFX12 PTE flags
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: NULL-check BO's backing store when determining GFX12 PTE flags PRT BOs may not have any backing store, so bo->tbo.resource will be NULL. Check for that before dereferencing. (cher…
-
Medium 5.5
drm/sched: Fix fence reference count leak
In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix fence reference count leak The last_scheduled fence leaks when an entity is being killed and adding the cleanup callback fails. Decrement the reference count of prev when dma_f…
-
Medium 5.5
drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() On the off chance that command stream passed from userspace via ioctl() call to radeon_vce_cs_parse() is weirdly crafted and …
-
Medium 5.5
xsk: fix an integer overflow in xp_create_and_assign_umem()
In the Linux kernel, the following vulnerability has been resolved: xsk: fix an integer overflow in xp_create_and_assign_umem() Since the i and pool->chunk_size variables are of type 'u32', their product can wrap around and then be cast to 'u64'. This can lea…
-
Medium 5.5
mm/huge_memory: drop beyond-EOF folios with the right number of refs
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: drop beyond-EOF folios with the right number of refs When an after-split folio is large and needs to be dropped due to EOF, folio_put_refs(folio, folio_nr_pages(folio)) should…
-
Medium 5.5
netfs: Call `invalidate_cache` only if implemented
In the Linux kernel, the following vulnerability has been resolved: netfs: Call `invalidate_cache` only if implemented Many filesystems such as NFS and Ceph do not implement the `invalidate_cache` method. On those filesystems, if writing to the cache (`NETFS_…
-
Medium 5.5
can: ucan: fix out of bound read in strscpy() source
In the Linux kernel, the following vulnerability has been resolved: can: ucan: fix out of bound read in strscpy() source Commit 7fdaf8966aae ("can: ucan: use strscpy() to instead of strncpy()") unintentionally introduced a one byte out of bound read on strscp…
-
Medium 5.5
ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). fib_check_nh_v6_gw() expects that fib6_nh_init() cleans up everything when it fails. Commit 7dd73168e273 ("ipv6: Always alloc…
-
Medium 5.5
Bluetooth: Fix error code in chan_alloc_skb_cb()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix error code in chan_alloc_skb_cb() The chan_alloc_skb_cb() function is supposed to return error pointers on error. Returning NULL will lead to a NULL dereference.
-
Medium 5.5
regulator: dummy: force synchronous probing
In the Linux kernel, the following vulnerability has been resolved: regulator: dummy: force synchronous probing Sometimes I get a NULL pointer dereference at boot time in kobject_get() with the following call stack: anatop_regulator_probe() devm_regulator_reg…
-
Medium 5.5
ARM: dts: bcm2711: Fix xHCI power-domain
In the Linux kernel, the following vulnerability has been resolved: ARM: dts: bcm2711: Fix xHCI power-domain During s2idle tests on the Raspberry CM4 the VPU firmware always crashes on xHCI power-domain resume: root@raspberrypi:/sys/power# echo freeze > state…
-
Medium 5.5
atm: Fix NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: atm: Fix NULL pointer dereference When MPOA_cache_impos_rcvd() receives the msg, it can trigger Null Pointer Dereference Vulnerability if both entry and holding_time are NULL. Because there i…
-
Medium 5.5
nfsd: fix management of listener transports
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix management of listener transports Currently, when no active threads are running, a root user using nfsdctl command can try to remove a particular listener from the list of previousl…
-
Medium 5.5
wifi: mt76: mt7921: fix kernel panic due to null pointer dereference
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix kernel panic due to null pointer dereference Address a kernel panic caused by a null pointer dereference in the `mt792x_rx_get_wcid` function. The issue arises because…
-
Medium 5.5
arm64: Don't call NULL in do_compat_alignment_fixup()
In the Linux kernel, the following vulnerability has been resolved: arm64: Don't call NULL in do_compat_alignment_fixup() do_alignment_t32_to_handler() only fixes up alignment faults for specific instructions; it returns NULL otherwise (e.g. LDREX). When that…
-
Medium 5.5
arcnet: Add NULL check in com20020pci_probe()
In the Linux kernel, the following vulnerability has been resolved: arcnet: Add NULL check in com20020pci_probe() devm_kasprintf() returns NULL when memory allocation fails. Currently, com20020pci_probe() does not check for this case, which results in a NULL …
-
Medium 5.5
netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
In the Linux kernel, the following vulnerability has been resolved: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets When calling netlbl_conn_setattr(), addr->sa_family is used to determine the function behavior. If sk is an IPv4 socket,…
-
Medium 5.5
idpf: fix adapter NULL pointer dereference on reboot
In the Linux kernel, the following vulnerability has been resolved: idpf: fix adapter NULL pointer dereference on reboot With SRIOV enabled, idpf ends up calling into idpf_remove() twice. First via idpf_shutdown() and then again when idpf_remove() calls into …
-
Medium 5.5
ASoC: imx-card: Add NULL check in imx_card_probe()
In the Linux kernel, the following vulnerability has been resolved: ASoC: imx-card: Add NULL check in imx_card_probe() devm_kasprintf() returns NULL when memory allocation fails. Currently, imx_card_probe() does not check for this case, which results in a NUL…
-
Medium 5.5
fs/9p: fix NULL pointer dereference on mkdir
In the Linux kernel, the following vulnerability has been resolved: fs/9p: fix NULL pointer dereference on mkdir When a 9p tree was mounted with option 'posixacl', parent directory had a default ACL set for its subdirectories, e.g.: setfacl -m default:group:s…
-
Medium 5.5CVE-2025-23134 Public exploit
ALSA: timer: Don't take register_mutex with copy_from/to_user()
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Don't take register_mutex with copy_from/to_user() The infamous mmap_lock taken in copy_from/to_user() can be often problematic when it's called inside another mutex, as they mig…
-
Medium 5.5
thermal: int340x: Add NULL check for adev
In the Linux kernel, the following vulnerability has been resolved: thermal: int340x: Add NULL check for adev Not all devices have an ACPI companion fwnode, so adev might be NULL. This is similar to the commit cd2fd6eab480 ("platform/x86: int3472: Check for a…
-
Medium 5.5
x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors
In the Linux kernel, the following vulnerability has been resolved: x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors Commit 6eac36bb9eb0 ("x86/resctrl: Allocate the cleanest CLOSID by searching closid_num_dirty_rmid") added logic t…
-
Medium 5.5
remoteproc: core: Clear table_sz when rproc_shutdown
In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Clear table_sz when rproc_shutdown There is case as below could trigger kernel dump: Use U-Boot to start remote processor(rproc) with resource table published to a fixed add…
-
Medium 5.5
clk: samsung: Fix UBSAN panic in samsung_clk_init()
In the Linux kernel, the following vulnerability has been resolved: clk: samsung: Fix UBSAN panic in samsung_clk_init() With UBSAN_ARRAY_BOUNDS=y, I'm hitting the below panic due to dereferencing `ctx->clk_data.hws` before setting `ctx->clk_data.num = nr_clks…
-
Medium 4.7
gpio: aggregator: protect driver attr handlers against module unload
In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: protect driver attr handlers against module unload Both new_device_store and delete_device_store touch module global resources (e.g. gpio_aggregator_lock). To prevent race c…
-
Medium 4.7
firmware: qcom: uefisecapp: fix efivars registration race
In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: uefisecapp: fix efivars registration race Since the conversion to using the TZ allocator, the efivars service is registered before the memory pool has been allocated, somethin…
-
Medium 4.7
media: streamzap: fix race between device disconnection and urb callback
In the Linux kernel, the following vulnerability has been resolved: media: streamzap: fix race between device disconnection and urb callback Syzkaller has reported a general protection fault at function ir_raw_event_store_with_filter(). This crash is caused b…
-
Unscored —
zram: fix NULL pointer in comp_algorithm_show()
In the Linux kernel, the following vulnerability has been resolved: zram: fix NULL pointer in comp_algorithm_show() LTP reported a NULL pointer dereference as followed: CPU: 7 UID: 0 PID: 5995 Comm: cat Kdump: loaded Not tainted 6.12.0-rc6+ #3 Hardware name: …
-
Unscored —
nfsd: fix legacy client tracking initialization
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix legacy client tracking initialization Get rid of the nfsd4_legacy_tracking_ops->init() call in check_for_legacy_methods(). That will be handled in the caller (nfsd4_client_tracking_…
-
Unscored —
PCI/ASPM: Fix link state exit during switch upstream function removal
In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix link state exit during switch upstream function removal Before 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free"), we would free the ASPM li…
-
Unscored —
net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC
In the Linux kernel, the following vulnerability has been resolved: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC Actually ENETC VFs do not support HWTSTAMP_TX_ONESTEP_SYNC because only ENETC PF can access PMa_SINGLE_STEP registers. And there will b…
-
Unscored —
acpi: typec: ucsi: Introduce a ->poll_cci method
In the Linux kernel, the following vulnerability has been resolved: acpi: typec: ucsi: Introduce a ->poll_cci method For the ACPI backend of UCSI the UCSI "registers" are just a memory copy of the register values in an opregion. The ACPI implementation in the…
-
Unscored —
mctp i3c: handle NULL header address
In the Linux kernel, the following vulnerability has been resolved: mctp i3c: handle NULL header address daddr can be NULL if there is no neighbour table entry present, in that case the tx packet should be dropped. saddr will usually be set by MCTP core, but …
-
Unscored —
wifi: nl80211: reject cooked mode if it is set along with other flags
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject cooked mode if it is set along with other flags It is possible to set both MONITOR_FLAG_COOK_FRAMES and MONITOR_FLAG_ACTIVE flags simultaneously on the same monitor inte…
-
Unscored —
wifi: cfg80211: regulatory: improve invalid hints checking
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: regulatory: improve invalid hints checking Syzbot keeps reporting an issue [1] that occurs when erroneous symbols sent from userspace get through into user_alpha2[] via regula…
-
Unscored —
gpio: rcar: Use raw_spinlock to protect register access
In the Linux kernel, the following vulnerability has been resolved: gpio: rcar: Use raw_spinlock to protect register access Use raw_spinlock in order to fix spurious messages about invalid context when spinlock debugging is enabled. The lock is only used to s…
-
Unscored —
x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range()
In the Linux kernel, the following vulnerability has been resolved: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() Xen doesn't offer MSR_FAM10H_MMIO_CONF_BASE to all guests. This results in the following warning: unchecked MSR access error: RDMSR fr…
-
Unscored —
usb: atm: cxacru: fix a flaw in existing endpoint checks
In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: fix a flaw in existing endpoint checks Syzbot once again identified a flaw in usb endpoint checking, see [1]. This time the issue stems from a commit authored by me (2eabb65…
-
Unscored —
llc: do not use skb_get() before dev_queue_xmit()
In the Linux kernel, the following vulnerability has been resolved: llc: do not use skb_get() before dev_queue_xmit() syzbot is able to crash hosts [1], using llc and devices not supporting IFF_TX_SKB_SHARING. In this case, e1000 driver calls eth_skb_pad(), w…
-
Unscored —
rapidio: add check for rio_add_net() in rio_scan_alloc_net()
In the Linux kernel, the following vulnerability has been resolved: rapidio: add check for rio_add_net() in rio_scan_alloc_net() The return value of rio_add_net() should be checked. If it fails, put_device() should be called to free the memory and give up the…
-
Unscored —
ksmbd: fix bug on trap in smb2_lock
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix bug on trap in smb2_lock If lock count is greater than 1, flags could be old value. It should be checked with flags of smb_lock, not flags. It will cause bug-on trap from locks_fre…
-
Unscored —
drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl
In the Linux kernel, the following vulnerability has been resolved: drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl In the "pmcmd_ioctl" function, three memory objects allocated by kmalloc are initialized by "hcall_get_cpu_state", whic…
-
Unscored —
drm/amd/display: Assign normalized_pix_clk when color depth = 14
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Assign normalized_pix_clk when color depth = 14 [WHY & HOW] A warning message "WARNING: CPU: 4 PID: 459 at ... /dc_resource.c:3397 calculate_phy_pix_clks+0xef/0x100 [amdgpu]"…
-
Unscored —
eth: bnxt: fix kernel panic in the bnxt_get_queue_stats{rx | tx}
In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix kernel panic in the bnxt_get_queue_stats{rx | tx} When qstats-get operation is executed, callbacks of netdev_stats_ops are called. The bnxt_get_queue_stats{rx | tx} collect per…
-
Unscored —
eth: bnxt: return fail if interface is down in bnxt_queue_mem_alloc()
In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: return fail if interface is down in bnxt_queue_mem_alloc() The bnxt_queue_mem_alloc() is called to allocate new queue memory when a queue is restarted. It internally accesses rx bu…
-
Unscored —
net/mlx5: handle errors in mlx5_chains_create_table()
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: handle errors in mlx5_chains_create_table() In mlx5_chains_create_table(), the return value of mlx5_get_fdb_sub_ns() and mlx5_get_flow_namespace() must be checked to prevent NULL po…
-
Unscored —
fbdev: hyperv_fb: Fix hang in kdump kernel when on Hyper-V Gen 2 VMs
In the Linux kernel, the following vulnerability has been resolved: fbdev: hyperv_fb: Fix hang in kdump kernel when on Hyper-V Gen 2 VMs Gen 2 Hyper-V VMs boot via EFI and have a standard EFI framebuffer device. When the kdump kernel runs in such a VM, loadin…
-
Unscored —
drm/hyperv: Fix address space leak when Hyper-V DRM device is removed
In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: Fix address space leak when Hyper-V DRM device is removed When a Hyper-V DRM device is probed, the driver allocates MMIO space for the vram, and maps it cacheable. If the device r…
-
Unscored —
net: switchdev: Convert blocking notification chain to a raw one
In the Linux kernel, the following vulnerability has been resolved: net: switchdev: Convert blocking notification chain to a raw one A blocking notification chain uses a read-write semaphore to protect the integrity of the chain. The semaphore is acquired for…
-
Unscored —
HID: ignore non-functional sensor in HP 5MP Camera
In the Linux kernel, the following vulnerability has been resolved: HID: ignore non-functional sensor in HP 5MP Camera The HP 5MP Camera (USB ID 0408:5473) reports a HID sensor interface that is not actually implemented. Attempting to access this non-function…
-
Unscored —
regulator: check that dummy regulator has been probed before using it
In the Linux kernel, the following vulnerability has been resolved: regulator: check that dummy regulator has been probed before using it Due to asynchronous driver probing there is a chance that the dummy regulator hasn't already been probed when first acces…
-
Unscored —
RDMA/hns: Fix soft lockup during bt pages loop
In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix soft lockup during bt pages loop Driver runs a for-loop when allocating bt pages and mapping them with buffer pages. When a large buffer (e.g. MR over 100GB) is being allocated,…
-
Unscored —
soc: qcom: pdr: Fix the potential deadlock
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pdr: Fix the potential deadlock When some client process A call pdr_add_lookup() to add the look up for the service and does schedule locator work, later a process B got a new serv…
-
Unscored —
dpll: fix xa_alloc_cyclic() error handling
In the Linux kernel, the following vulnerability has been resolved: dpll: fix xa_alloc_cyclic() error handling In case of returning 1 from xa_alloc_cyclic() (wrapping) ERR_PTR(1) will be returned, which will cause IS_ERR() to be false. Which can lead to deref…
-
Unscored —
devlink: fix xa_alloc_cyclic() error handling
In the Linux kernel, the following vulnerability has been resolved: devlink: fix xa_alloc_cyclic() error handling In case of returning 1 from xa_alloc_cyclic() (wrapping) ERR_PTR(1) will be returned, which will cause IS_ERR() to be false. Which can lead to de…
-
Unscored —
usb: xhci: Don't skip on Stopped - Length Invalid
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Don't skip on Stopped - Length Invalid Up until commit d56b0b2ab142 ("usb: xhci: ensure skipped isoc TDs are returned when isoc ring is stopped") in v6.11, the driver didn't skip m…
-
Unscored —
media: vimc: skip .s_stream() for stopped entities
In the Linux kernel, the following vulnerability has been resolved: media: vimc: skip .s_stream() for stopped entities Syzbot reported [1] a warning prompted by a check in call_s_stream() that checks whether .s_stream() operation is warranted for unstarted or…
-
Unscored —
mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead()
In the Linux kernel, the following vulnerability has been resolved: mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() Currently, zswap_cpu_comp_dead() calls crypto_free_acomp() while holding the per-CPU acomp_ctx mutex. crypto_free_acomp() …
-
Unscored —
uprobes/x86: Harden uretprobe syscall trampoline check
In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Harden uretprobe syscall trampoline check Jann reported a possible issue when trampoline_check_ip returns address near the bottom of the address space that is allowed to call int…
-
Unscored —
usbnet:fix NPE during rx_complete
In the Linux kernel, the following vulnerability has been resolved: usbnet:fix NPE during rx_complete Missing usbnet_going_away Check in Critical Path. The usb_submit_urb function lacks a usbnet_going_away validation, whereas __usbnet_queue_skb includes this …
-
Unscored —
net: ibmveth: make veth_pool_store stop hanging
In the Linux kernel, the following vulnerability has been resolved: net: ibmveth: make veth_pool_store stop hanging v2: - Created a single error handling unlock and exit in veth_pool_store - Greatly expanded commit message with previous explanatory-only text …
-
Unscored —
udp: Fix memory accounting leak.
In the Linux kernel, the following vulnerability has been resolved: udp: Fix memory accounting leak. Matt Dowling reported a weird UDP memory usage issue. Under normal operation, the UDP memory usage reported in /proc/net/sockstat remains close to zero. Howev…
-
Unscored —
net: mvpp2: Prevent parser TCAM memory corruption
In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: Prevent parser TCAM memory corruption Protect the parser TCAM/SRAM memory, and the cached (shadow) SRAM information, from concurrent modifications. Both the TCAM and SRAM tables a…
-
Unscored —
netfilter: nf_tables: don't unregister hook when table is dormant
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't unregister hook when table is dormant When nf_tables_updchain encounters an error, hook registration needs to be rolled back. This should only be done if the hook …
-
Unscored —
spufs: fix a leak in spufs_create_context()
In the Linux kernel, the following vulnerability has been resolved: spufs: fix a leak in spufs_create_context() Leak fixes back in 2008 missed one case - if we are trying to set affinity and spufs_mkdir() fails, we need to drop the reference to neighbor.
-
Unscored —
spufs: fix a leak on spufs_new_file() failure
In the Linux kernel, the following vulnerability has been resolved: spufs: fix a leak on spufs_new_file() failure It's called from spufs_fill_dir(), and caller of that will do spufs_rmdir() in case of failure. That does remove everything we'd managed to creat…
-
Unscored —
rtnetlink: Allocate vfinfo size for VF GUIDs when supported
In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Allocate vfinfo size for VF GUIDs when supported Commit 30aad41721e0 ("net/core: Add support for getting VF GUIDs") added support for getting VF port and node GUIDs in netlink ifin…
-
Unscored —
staging: vchiq_arm: Fix possible NPR of keep-alive thread
In the Linux kernel, the following vulnerability has been resolved: staging: vchiq_arm: Fix possible NPR of keep-alive thread In case vchiq_platform_conn_state_changed() is never called or fails before driver removal, ka_thread won't be a valid pointer to a t…
-
Unscored —
w1: fix NULL pointer dereference in probe
In the Linux kernel, the following vulnerability has been resolved: w1: fix NULL pointer dereference in probe The w1_uart_probe() function calls w1_uart_serdev_open() (which includes devm_serdev_device_open()) before setting the client ops via serdev_device_s…
-
Unscored —
PCI: brcmstb: Fix error path after a call to regulator_bulk_get()
In the Linux kernel, the following vulnerability has been resolved: PCI: brcmstb: Fix error path after a call to regulator_bulk_get() If the regulator_bulk_get() returns an error and no regulators are created, we need to set their number to zero. If we don't …
-
Unscored —
watch_queue: fix pipe accounting mismatch
In the Linux kernel, the following vulnerability has been resolved: watch_queue: fix pipe accounting mismatch Currently, watch_queue_set_size() modifies the pipe buffers charged to user->pipe_bufs without updating the pipe->nr_accounted on the pipe itself, du…
-
Unscored —
ASoC: ops: Consistently treat platform_max as control value
In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Consistently treat platform_max as control value This reverts commit 9bdd10d57a88 ("ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min"), and makes some additional relat…
-
Unscored —
objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
In the Linux kernel, the following vulnerability has been resolved: objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() If dib8000_set_dds()'s call to dib8000_read32() returns zero, the result is a divide-by-zero. Prevent that from happening.…
-
Unscored —
drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr
In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr The function mtk_dp_wait_hpd_asserted() may be called before the `mtk_dp->drm_dev` pointer is assigned in mtk_dp_bridge_atta…
-
Unscored —
dmaengine: fsl-edma: free irq correctly in remove path
In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-edma: free irq correctly in remove path Add fsl_edma->txirq/errirq check to avoid below warning because no errirq at i.MX9 platform. Otherwise there will be kernel dump: WARNIN…
-
Unscored —
ksmbd: use aead_request_free to match aead_request_alloc
In the Linux kernel, the following vulnerability has been resolved: ksmbd: use aead_request_free to match aead_request_alloc Use aead_request_free() instead of kfree() to properly free memory allocated by aead_request_alloc(). This ensures sensitive crypto da…
-
Unscored —
net_sched: skbprio: Remove overly strict queue assertions
In the Linux kernel, the following vulnerability has been resolved: net_sched: skbprio: Remove overly strict queue assertions In the current implementation, skbprio enqueue/dequeue contains an assertion that fails under certain conditions when SKBPRIO is used…
-
Unscored —
x86/mce: use is_copy_from_user() to determine copy-from-user context
In the Linux kernel, the following vulnerability has been resolved: x86/mce: use is_copy_from_user() to determine copy-from-user context Patch series "mm/hwpoison: Fix regressions in memory failure handling", v4. ## 1. What am I trying to do: This patchset re…
References
-
report
https://ubuntu.com/security/CVE-2023-53034
-
report
https://ubuntu.com/security/CVE-2024-53222
-
report
https://ubuntu.com/security/CVE-2024-58092
-
report
https://ubuntu.com/security/CVE-2024-58093
-
report
https://ubuntu.com/security/CVE-2025-2312
-
report
https://ubuntu.com/security/CVE-2025-21893
-
report
https://ubuntu.com/security/CVE-2025-21894
-
report
https://ubuntu.com/security/CVE-2025-21902
-
report
https://ubuntu.com/security/CVE-2025-21903
-
report
https://ubuntu.com/security/CVE-2025-21904
-
report
https://ubuntu.com/security/CVE-2025-21905
-
report
https://ubuntu.com/security/CVE-2025-21906
-
report
https://ubuntu.com/security/CVE-2025-21908
-
report
https://ubuntu.com/security/CVE-2025-21909
-
report
https://ubuntu.com/security/CVE-2025-21910
-
report
https://ubuntu.com/security/CVE-2025-21911
-
report
https://ubuntu.com/security/CVE-2025-21912
-
report
https://ubuntu.com/security/CVE-2025-21913
-
report
https://ubuntu.com/security/CVE-2025-21914
-
report
https://ubuntu.com/security/CVE-2025-21915
-
report
https://ubuntu.com/security/CVE-2025-21916
-
report
https://ubuntu.com/security/CVE-2025-21917
-
report
https://ubuntu.com/security/CVE-2025-21918
-
report
https://ubuntu.com/security/CVE-2025-21919
-
report
https://ubuntu.com/security/CVE-2025-21920
-
report
https://ubuntu.com/security/CVE-2025-21922
-
report
https://ubuntu.com/security/CVE-2025-21923
-
report
https://ubuntu.com/security/CVE-2025-21924
-
report
https://ubuntu.com/security/CVE-2025-21925
-
report
https://ubuntu.com/security/CVE-2025-21926
-
report
https://ubuntu.com/security/CVE-2025-21927
-
report
https://ubuntu.com/security/CVE-2025-21928
-
report
https://ubuntu.com/security/CVE-2025-21929
-
report
https://ubuntu.com/security/CVE-2025-21930
-
report
https://ubuntu.com/security/CVE-2025-21934
-
report
https://ubuntu.com/security/CVE-2025-21935
-
report
https://ubuntu.com/security/CVE-2025-21936
-
report
https://ubuntu.com/security/CVE-2025-21937
-
report
https://ubuntu.com/security/CVE-2025-21939