Summary
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- RISC-V architecture;
- x86 architecture;
- Buffer Sharing and Synchronization framework;
- DMA engine subsystem;
- GPU drivers;
- HID subsystem;
- IIO ADC drivers;
- IIO subsystem;
- InfiniBand drivers;
- Input Device core drivers;
- Network drivers;
- Mellanox network drivers;
- PHY drivers;
- Voltage and Current Regulator drivers;
- VideoCore services drivers;
- USB Type-C Connector System Software Interface driver;
- Xen hypervisor drivers;
- EROFS file system;
- Network file system (NFS) client;
- File systems infrastructure;
- SMB network file system;
- Network traffic control;
- io_uring subsystem;
- Kernel command line parsing driver;
- Scheduler infrastructure;
- Memory management;
- Networking core;
- MAC80211 subsystem;
- Management Component Transport Protocol (MCTP);
- Netfilter;
- Open vSwitch;
- TLS protocol;
- Wireless networking;
- SOF drivers;
(CVE-2025-38011, CVE-2025-38095, CVE-2025-37967, CVE-2025-38012,
CVE-2025-38019, CVE-2025-37960, CVE-2025-37973, CVE-2025-37958,
CVE-2025-38094, CVE-2025-37963, CVE-2025-37955, CVE-2025-38014,
CVE-2025-38025, CVE-2025-37970, CVE-2025-37947, CVE-2025-37966,
CVE-2025-37948, CVE-2025-38013, CVE-2025-37957, CVE-2025-38028,
CVE-2025-37962, CVE-2025-38002, CVE-2025-37996, CVE-2025-37992,
CVE-2025-37969, CVE-2025-38009, CVE-2025-38027, CVE-2025-38020,
CVE-2025-38023, CVE-2025-38008, CVE-2025-38015, CVE-2025-37954,
CVE-2025-38007, CVE-2025-38005, CVE-2025-37956, CVE-2025-37965,
CVE-2025-37972, CVE-2025-38006, CVE-2025-37971, CVE-2025-38056,
CVE-2025-37968, CVE-2025-38024, CVE-2025-37951, CVE-2025-38016,
CVE-2025-38022, CVE-2025-37964, CVE-2025-37994, CVE-2025-37952,
CVE-2025-37998, CVE-2025-37993, CVE-2025-38018, CVE-2025-38010,
CVE-2025-37995, CVE-2025-38021, CVE-2025-37999, CVE-2025-37961,
CVE-2025-37959, CVE-2025-37950, CVE-2025-37949)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | linux-aws-6.14 | 6.14.0-1011.11~24.04.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | linux-gcp-6.14 | 6.14.0-1014.15~24.04.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | linux-oracle-6.14 | 6.14.0-1011.11~24.04.1 |
Vulnerabilities 59
-
Critical 9.4
bpf: Scrub packet on bpf_redirect_peer
In the Linux kernel, the following vulnerability has been resolved: bpf: Scrub packet on bpf_redirect_peer When bpf_redirect_peer is used to redirect packets to a device in another network namespace, the skb isn't scrubbed. That can lead skb information from …
-
High 8.8CVE-2025-37947 Public exploit
ksmbd: prevent out-of-bounds stream writes by validating *pos
In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds stream writes by validating *pos ksmbd_vfs_stream_write() did not validate whether the write offset (*pos) was within the bounds of the existing stream data lengt…
-
High 8.8
ksmbd: Fix UAF in __close_file_table_ids
In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix UAF in __close_file_table_ids A use-after-free is possible if one thread destroys the file via __ksmbd_close_fd while another thread holds a reference to it. The existing checks on…
-
High 8.8
ksmbd: prevent rename with empty string
In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent rename with empty string Client can send empty newname string to ksmbd server. It will cause a kernel oops from d_alloc. This patch return the error when attempting to rename a…
-
High 8.8
KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception Previously, commit ed129ec9057f ("KVM: x86: forcibly leave nested mode on vCPU reset") addressed an issue where a triple fault occur…
-
High 8.8
KVM: arm64: Fix uninitialized memcache pointer in user_mem_abort()
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix uninitialized memcache pointer in user_mem_abort() Commit fce886a60207 ("KVM: arm64: Plumb the pKVM MMU in KVM") made the initialization of the local memcache variable in user…
-
High 8.8
HID: bpf: abort dispatch if device destroyed
In the Linux kernel, the following vulnerability has been resolved: HID: bpf: abort dispatch if device destroyed The current HID bpf implementation assumes no output report/request will go through it after hid_bpf_destroy_device() has been called. This leads …
-
High 8.1
wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation Currently during the multi-link element defragmentation process, the multi-link element length added to the …
-
High 7.8
xenbus: Use kref to track req lifetime
In the Linux kernel, the following vulnerability has been resolved: xenbus: Use kref to track req lifetime Marek reported seeing a NULL pointer fault in the xenbus_thread callstack: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: e030:__w…
-
High 7.8
x86/mm: Eliminate window where TLB flushes may be inadvertently skipped
In the Linux kernel, the following vulnerability has been resolved: x86/mm: Eliminate window where TLB flushes may be inadvertently skipped tl;dr: There is a window in the mm switching code where the new CR3 is set and the CPU should be getting TLB flushes fo…
-
High 7.8
openvswitch: Fix unsafe attribute parsing in output_userspace()
In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix unsafe attribute parsing in output_userspace() This patch replaces the manual Netlink attribute iteration in output_userspace() with nla_for_each_nested(), which ensures that…
-
High 7.8
io_uring/fdinfo: grab ctx->uring_lock around io_uring_show_fdinfo()
In the Linux kernel, the following vulnerability has been resolved: io_uring/fdinfo: grab ctx->uring_lock around io_uring_show_fdinfo() Not everything requires locking in there, which is why the 'has_lock' variable exists. But enough does that it's a bit unwi…
-
High 7.8
dmaengine: ti: k3-udma: Add missing locking
In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma: Add missing locking Recent kernels complain about a missing lock in k3-udma.c when the lock validator is enabled: [ 4.128073] WARNING: CPU: 0 PID: 746 at drivers/dma/t…
-
High 7.8
sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator
In the Linux kernel, the following vulnerability has been resolved: sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator BPF programs may call next() and destroy() on BPF iterators even after new() returns an error value (e.g. bpf_for_each() ma…
-
High 7.8
RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_addr…
-
High 7.8
RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120 print_address_descri…
-
High 7.8
NFS/localio: Fix a race in nfs_local_open_fh()
In the Linux kernel, the following vulnerability has been resolved: NFS/localio: Fix a race in nfs_local_open_fh() Once the clp->cl_uuid.lock has been dropped, another CPU could come in and free the struct nfsd_file that was just added. To prevent that from h…
-
High 7.8
dma-buf: insert memory barrier before updating num_fences
In the Linux kernel, the following vulnerability has been resolved: dma-buf: insert memory barrier before updating num_fences smp_store_mb() inserts memory barrier after storing operation. It is different with what the comment is originally aiming so Null poi…
-
High 7.5
smb: client: Avoid race in open_cached_dir with lease breaks
In the Linux kernel, the following vulnerability has been resolved: smb: client: Avoid race in open_cached_dir with lease breaks A pre-existing valid cfid returned from find_or_create_cached_dir might race with a lease break, meaning open_cached_dir doesn't c…
-
High 7.5
net/tls: fix kernel panic when alloc_page failed
In the Linux kernel, the following vulnerability has been resolved: net/tls: fix kernel panic when alloc_page failed We cannot set frag_list to NULL pointer when alloc_page failed. It will be used in tls_strp_check_queue_ok when the next time tls_strp_read_so…
-
Unscored —
arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs
In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs A malicious BPF program may manipulate the branch history to influence what the hardware speculates will happen next. On exit …
-
Unscored —
ocfs2: fix panic in failed foilio allocation
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix panic in failed foilio allocation commit 7e119cff9d0a ("ocfs2: convert w_pages to w_folios") and commit 9a5e08652dc4b ("ocfs2: use an array of folios instead of an array of pages")…
-
Unscored —
drm/v3d: Add job to pending list if the reset was skipped
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Add job to pending list if the reset was skipped When a CL/CSD job times out, we check if the GPU has made any progress since the last timeout. If so, instead of resetting the hardwa…
-
Unscored —
virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable()
In the Linux kernel, the following vulnerability has been resolved: virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable() The selftests added to our CI by Bui Quang Minh recently reveals that there is a mem leak on the error path of virtnet_xsk_poo…
-
Unscored —
mm/huge_memory: fix dereferencing invalid pmd migration entry
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix dereferencing invalid pmd migration entry When migrating a THP, concurrent access to the PMD migration entry during a deferred split scan can lead to an invalid address ac…
-
Unscored —
memblock: Accept allocated memory before use in memblock_double_array()
In the Linux kernel, the following vulnerability has been resolved: memblock: Accept allocated memory before use in memblock_double_array() When increasing the array size in memblock_double_array() and the slab is not yet available, a call to memblock_find_in…
-
Unscored —
ipvs: fix uninit-value for saddr in do_output_route4
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix uninit-value for saddr in do_output_route4 syzbot reports for uninit-value for the saddr argument [1]. commit 4754957f04f5 ("ipvs: do not use random local source address for tunnels…
-
Unscored —
ksmbd: fix memory leak in parse_lease_state()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix memory leak in parse_lease_state() The previous patch that added bounds check for create lease context introduced a memory leak. When the bounds check fails, the function returns N…
-
Unscored —
arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users
In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users Support for eBPF programs loaded by unprivileged users is typically disabled. This means only cBPF programs need to be mit…
-
Unscored —
drm/amd/display: Fix invalid context error in dml helper
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix invalid context error in dml helper [Why] "BUG: sleeping function called from invalid context" error. after: "drm/amd/display: Protect FPU in dml2_validate()/dml21_valida…
-
Unscored —
riscv: Fix kernel crash due to PR_SET_TAGGED_ADDR_CTRL
In the Linux kernel, the following vulnerability has been resolved: riscv: Fix kernel crash due to PR_SET_TAGGED_ADDR_CTRL When userspace does PR_SET_TAGGED_ADDR_CTRL, but Supm extension is not available, the kernel crashes: Oops - illegal instruction [#1] [s…
-
Unscored —
usb: typec: ucsi: displayport: Fix deadlock
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix deadlock This patch introduces the ucsi_con_mutex_lock / ucsi_con_mutex_unlock functions to the UCSI driver. ucsi_con_mutex_lock ensures the connector mutex…
-
Unscored —
iio: light: opt3001: fix deadlock due to concurrent flag access
In the Linux kernel, the following vulnerability has been resolved: iio: light: opt3001: fix deadlock due to concurrent flag access The threaded IRQ function in this driver is reading the flag twice: once to lock a mutex and once to unlock it. Even though the…
-
Unscored —
iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo
In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo Prevent st_lsm6dsx_read_tagged_fifo from falling in an infinite loop in case pattern_len is equal to zero and the devi…
-
Unscored —
iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo
In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo Prevent st_lsm6dsx_read_fifo from falling in an infinite loop in case pattern_len is equal to zero and the device FIFO is not…
-
Unscored —
staging: bcm2835-camera: Initialise dev in v4l2_dev
In the Linux kernel, the following vulnerability has been resolved: staging: bcm2835-camera: Initialise dev in v4l2_dev Commit 42a2f6664e18 ("staging: vc04_services: Move global g_state to vchiq_state") changed mmal_init to pass dev->v4l2_dev.dev to vchiq_mma…
-
Unscored —
Input: mtk-pmic-keys - fix possible null pointer dereference
In the Linux kernel, the following vulnerability has been resolved: Input: mtk-pmic-keys - fix possible null pointer dereference In mtk_pmic_keys_probe, the regs parameter is only set if the button is parsed in the device tree. However, on hardware where the …
-
Unscored —
net_sched: Flush gso_skb list too during ->change()
In the Linux kernel, the following vulnerability has been resolved: net_sched: Flush gso_skb list too during ->change() Previously, when reducing a qdisc's limit via the ->change() operation, only the main skb queue was trimmed, potentially leaving packets in…
-
Unscored —
can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe
In the Linux kernel, the following vulnerability has been resolved: can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe The spin lock tx_handling_spinlock in struct m_can_classdev is not being initialized. This leads the following spi…
-
Unscored —
usb: typec: ucsi: displayport: Fix NULL pointer access
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix NULL pointer access This patch ensures that the UCSI driver waits for all pending tasks in the ucsi_displayport_work workqueue to finish executing before pr…
-
Unscored —
module: ensure that kobject_put() is safe for module type kobjects
In the Linux kernel, the following vulnerability has been resolved: module: ensure that kobject_put() is safe for module type kobjects In 'lookup_or_create_module_kobject()', an internal kobject is created using 'module_ktype'. So call to 'kobject_put()' on e…
-
Unscored —
fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio()
In the Linux kernel, the following vulnerability has been resolved: fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio() If bio_add_folio() fails (because it is full), erofs_fileio_scan_folio() needs to submit the I/O request via erofs_fileio…
-
Unscored —
net: mctp: Don't access ifa_index when missing
In the Linux kernel, the following vulnerability has been resolved: net: mctp: Don't access ifa_index when missing In mctp_dump_addrinfo, ifa_index can be used to filter interfaces, but only when the struct ifaddrmsg is provided. Otherwise it will be comparin…
-
Unscored —
HID: uclogic: Add NULL check in uclogic_input_configured()
In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: Add NULL check in uclogic_input_configured() devm_kasprintf() returns NULL when memory allocation fails. Currently, uclogic_input_configured() does not check for this case, whic…
-
Unscored —
mm/page_alloc: fix race condition in unaccepted memory handling
In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: fix race condition in unaccepted memory handling The page allocator tracks the number of zones that have unaccepted memory using static_branch_enc/dec() and uses that static br…
-
Unscored —
wifi: mt76: disable napi on driver removal
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: disable napi on driver removal A warning on driver removal started occurring after commit 9dd05df8403b ("net: warn if NAPI instance wasn't shut down"). Disable tx napi before dele…
-
Unscored —
phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking
In the Linux kernel, the following vulnerability has been resolved: phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking The current implementation uses bias_pad_enable as a reference count to manage the shared bias pad for all UTMI PHYs. However…
-
Unscored —
drm/amdgpu: csa unmap use uninterruptible lock
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: csa unmap use uninterruptible lock After process exit to unmap csa and free GPU vm, if signal is accepted and then waiting to take vm lock is interrupted and return, it causes mem…
-
Unscored —
wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request Make sure that n_channels is set after allocating the struct cfg80211_registered_device::int_scan_req member. Seen…
-
Unscored —
dmaengine: idxd: Refactor remove call with idxd_cleanup() helper
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper The idxd_cleanup() helper cleans up perfmon, interrupts, internals and so on. Refactor remove call with the idxd_cleanup() hel…
-
Unscored —
dmaengine: idxd: fix memory leak in error handling path of idxd_alloc
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc Memory allocated for idxd is not freed if an error occurs during idxd_alloc(). To fix it, free the allocated memory in th…
-
Unscored —
mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices The driver only offloads neighbors that are constructed on top of net devices registered by it or their uppers (which …
-
Unscored —
net/mlx5e: Disable MACsec offload for uplink representor profile
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Disable MACsec offload for uplink representor profile MACsec offload is not supported in switchdev mode for uplink representors. When switching to the uplink representor profile, t…
-
Unscored —
drm/amd/display: Fix null check of pipe_ctx->plane_state for update_dchubp_dpp
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix null check of pipe_ctx->plane_state for update_dchubp_dpp Similar to commit 6a057072ddd1 ("drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe…
-
Unscored —
nfs: handle failure of nfs_get_lock_context in unlock path
In the Linux kernel, the following vulnerability has been resolved: nfs: handle failure of nfs_get_lock_context in unlock path When memory is insufficient, the allocation of nfs_lock_context in nfs_get_lock_context() fails and returns -ENOMEM. If we mistakenl…
-
Unscored —
iio: adc: ad7606: check for NULL before calling sw_mode_config()
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad7606: check for NULL before calling sw_mode_config() Check that the sw_mode_config function pointer is not NULL before calling it. Not all buses define this callback, which result…
-
Unscored —
regulator: max20086: fix invalid memory access
In the Linux kernel, the following vulnerability has been resolved: regulator: max20086: fix invalid memory access max20086_parse_regulators_dt() calls of_regulator_match() using an array of struct of_regulator_match allocated on the stack for the matches arg…
-
Unscored —
ASoC: SOF: Intel: hda: Fix UAF when reloading module
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Fix UAF when reloading module hda_generic_machine_select() appends -idisp to the tplg filename by allocating a new string with devm_kasprintf(), then stores the string …
-
Unscored —
net: cadence: macb: Fix a possible deadlock in macb_halt_tx.
In the Linux kernel, the following vulnerability has been resolved: net: cadence: macb: Fix a possible deadlock in macb_halt_tx. There is a situation where after THALT is set high, TGO stays high as well. Because jiffies are never updated, as we are in a cont…
References
-
report
https://ubuntu.com/security/CVE-2025-37947
-
report
https://ubuntu.com/security/CVE-2025-37948
-
report
https://ubuntu.com/security/CVE-2025-37949
-
report
https://ubuntu.com/security/CVE-2025-37950
-
report
https://ubuntu.com/security/CVE-2025-37951
-
report
https://ubuntu.com/security/CVE-2025-37952
-
report
https://ubuntu.com/security/CVE-2025-37954
-
report
https://ubuntu.com/security/CVE-2025-37955
-
report
https://ubuntu.com/security/CVE-2025-37956
-
report
https://ubuntu.com/security/CVE-2025-37957
-
report
https://ubuntu.com/security/CVE-2025-37958
-
report
https://ubuntu.com/security/CVE-2025-37959
-
report
https://ubuntu.com/security/CVE-2025-37960
-
report
https://ubuntu.com/security/CVE-2025-37961
-
report
https://ubuntu.com/security/CVE-2025-37962
-
report
https://ubuntu.com/security/CVE-2025-37963
-
report
https://ubuntu.com/security/CVE-2025-37964
-
report
https://ubuntu.com/security/CVE-2025-37965
-
report
https://ubuntu.com/security/CVE-2025-37966
-
report
https://ubuntu.com/security/CVE-2025-37967
-
report
https://ubuntu.com/security/CVE-2025-37968
-
report
https://ubuntu.com/security/CVE-2025-37969
-
report
https://ubuntu.com/security/CVE-2025-37970
-
report
https://ubuntu.com/security/CVE-2025-37971
-
report
https://ubuntu.com/security/CVE-2025-37972
-
report
https://ubuntu.com/security/CVE-2025-37973
-
report
https://ubuntu.com/security/CVE-2025-37992
-
report
https://ubuntu.com/security/CVE-2025-37993
-
report
https://ubuntu.com/security/CVE-2025-37994
-
report
https://ubuntu.com/security/CVE-2025-37995
-
report
https://ubuntu.com/security/CVE-2025-37996
-
report
https://ubuntu.com/security/CVE-2025-37998
-
report
https://ubuntu.com/security/CVE-2025-37999
-
report
https://ubuntu.com/security/CVE-2025-38002
-
report
https://ubuntu.com/security/CVE-2025-38005
-
report
https://ubuntu.com/security/CVE-2025-38006
-
report
https://ubuntu.com/security/CVE-2025-38007
-
report
https://ubuntu.com/security/CVE-2025-38008
-
report
https://ubuntu.com/security/CVE-2025-38009