Summary
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- Input Device (Mouse) drivers;
- Multiple devices driver;
- Media drivers;
- Network drivers;
- PCI subsystem;
- S/390 drivers;
- SPI subsystem;
- Trusted Execution Environment drivers;
- UFS subsystem;
- USB Device Class drivers;
- USB core drivers;
- USB Gadget drivers;
- Framebuffer layer;
- Network file system (NFS) client;
- Network file system (NFS) server daemon;
- File systems infrastructure;
- SMB network file system;
- Networking core;
- L3 Master device support module;
- TCP network protocol;
- io_uring subsystem;
- Process Accounting mechanism;
- BPF subsystem;
- Timer subsystem;
- Workqueue subsystem;
- Memory management;
- Amateur Radio drivers;
- B.A.T.M.A.N. meshing protocol;
- IPv4 networking;
- IPv6 networking;
- Multipath TCP;
- Open vSwitch;
- Network traffic control;
- SOF drivers;
(CVE-2025-21776, CVE-2025-21768, CVE-2025-21848, CVE-2025-21855,
CVE-2025-21791, CVE-2025-21838, CVE-2025-21762, CVE-2025-21846,
CVE-2025-21765, CVE-2025-21869, CVE-2025-21783, CVE-2025-21868,
CVE-2025-21857, CVE-2025-21773, CVE-2024-54458, CVE-2025-21871,
CVE-2025-21763, CVE-2024-58088, CVE-2025-21835, CVE-2025-21793,
CVE-2025-21867, CVE-2025-21784, CVE-2025-21839, CVE-2025-21786,
CVE-2025-21764, CVE-2025-21761, CVE-2025-21767, CVE-2024-58020,
CVE-2025-21847, CVE-2025-21792, CVE-2025-21785, CVE-2025-21863,
CVE-2025-21854, CVE-2025-21704, CVE-2024-52559, CVE-2025-21775,
CVE-2025-21758, CVE-2025-21858, CVE-2025-21866, CVE-2025-21870,
CVE-2024-57977, CVE-2024-54456, CVE-2025-21759, CVE-2025-21781,
CVE-2025-21760, CVE-2025-21706, CVE-2024-57834, CVE-2025-21712,
CVE-2025-21864, CVE-2025-21780, CVE-2025-21790, CVE-2025-21856,
CVE-2025-21796, CVE-2025-21859, CVE-2025-21782, CVE-2024-58093,
CVE-2025-21844, CVE-2025-21795, CVE-2025-21823, CVE-2025-21853,
CVE-2025-21772, CVE-2025-21746, CVE-2025-21821, CVE-2024-58086,
CVE-2025-21787, CVE-2025-21836, CVE-2025-21861, CVE-2025-21766,
CVE-2025-21862, CVE-2025-21779)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | linux-hwe-6.8 | 6.8.0-78.78~22.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-nvidia-6.8 | 6.8.0-1035.38~22.04.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | linux-gke | 6.8.0-1032.36 |
| Ubuntu · 24.04 LTS 24.04:LTS | linux-nvidia | 6.8.0-1035.38 |
| Ubuntu · 24.04 LTS 24.04:LTS | linux-nvidia-lowlatency | 6.8.0-1035.38.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | linux-raspi | 6.8.0-1035.39 |
Vulnerabilities 70
-
Critical 9.8
nfsd: clear acl_access/acl_default after releasing them
In the Linux kernel, the following vulnerability has been resolved: nfsd: clear acl_access/acl_default after releasing them If getting acl_default fails, acl_access and acl_default will be released simultaneously. However, acl_access will still retain a point…
-
High 8.6
ibmvnic: Don't reference skb after sending to VIOS
In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Don't reference skb after sending to VIOS Previously, after successfully flushing the xmit buffer to VIOS, the tx_bytes stat was incremented by the length of the skb. It is invalid t…
-
High 8.1CVE-2025-21760 EPSS 38%
ndisc: extend RCU protection in ndisc_send_skb()
In the Linux kernel, the following vulnerability has been resolved: ndisc: extend RCU protection in ndisc_send_skb() ndisc_send_skb() can be called without RTNL or RCU held. Acquire rcu_read_lock() earlier, so that we can use dev_net_rcu() and avoid a potenti…
-
High 8.1
arp: use RCU protection in arp_xmit()
In the Linux kernel, the following vulnerability has been resolved: arp: use RCU protection in arp_xmit() arp_xmit() can be called without RTNL or RCU protection. Use RCU protection to avoid potential UAF.
-
High 8.1
ipv6: use RCU protection in ip6_default_advmss()
In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU protection in ip6_default_advmss() ip6_default_advmss() needs rcu protection to make sure the net structure it reads does not disappear.
-
High 8.1
ipv4: use RCU protection in __ip_rt_update_pmtu()
In the Linux kernel, the following vulnerability has been resolved: ipv4: use RCU protection in __ip_rt_update_pmtu() __ip_rt_update_pmtu() must use RCU protection to make sure the net structure it reads does not disappear.
-
High 7.8
drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()
In the Linux kernel, the following vulnerability has been resolved: drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit() The "submit->cmd[i].size" and "submit->cmd[i].offset" variables are u32 values that come from the user via the submit_lookup_cm…
-
High 7.8
NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() name is char[64] where the size of clnt->cl_program->name remains unknown. Invoking strcat() directly will also lead to potent…
-
High 7.8
scsi: ufs: bsg: Set bsg_queue to NULL after removal
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: bsg: Set bsg_queue to NULL after removal Currently, this does not cause any issues, but I believe it is necessary to set bsg_queue to NULL after removing it to prevent potential us…
-
High 7.8
drm/v3d: Stop active perfmon if it is being destroyed
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Stop active perfmon if it is being destroyed If the active performance monitor (`v3d->active_perfmon`) is being destroyed, stop it first. Currently, the active perfmon is not stopped…
-
High 7.8
md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime
In the Linux kernel, the following vulnerability has been resolved: md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime After commit ec6bb299c7c3 ("md/md-bitmap: add 'sync_size' into struct md_bitmap_stats"), following panic is reported: Oops: g…
-
High 7.8CVE-2025-21758 EPSS 17%
ipv6: mcast: add RCU protection to mld_newpack()
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: add RCU protection to mld_newpack() mld_newpack() can be called without RTNL or RCU being held. Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses GFP…
-
High 7.8
ipv6: mcast: extend RCU protection in igmp6_send()
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: extend RCU protection in igmp6_send() igmp6_send() can be called without RTNL or RCU being held. Extend RCU protection so that we can safely fetch the net pointer and avoid a pot…
-
High 7.8
openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
In the Linux kernel, the following vulnerability has been resolved: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() ovs_vport_cmd_fill_info() can be called without RTNL or RCU. Use RCU protection and dev_net_rcu() to avoid potential UAF.
-
High 7.8
neighbour: use RCU protection in __neigh_notify()
In the Linux kernel, the following vulnerability has been resolved: neighbour: use RCU protection in __neigh_notify() __neigh_notify() can be called without RTNL or RCU protection. Use RCU protection to avoid potential UAF.
-
High 7.8
ndisc: use RCU protection in ndisc_alloc_skb()
In the Linux kernel, the following vulnerability has been resolved: ndisc: use RCU protection in ndisc_alloc_skb() ndisc_alloc_skb() can be called without RTNL or RCU being held. Add RCU protection to avoid possible UAF.
-
High 7.8
partitions: mac: fix handling of bogus partition table
In the Linux kernel, the following vulnerability has been resolved: partitions: mac: fix handling of bogus partition table Fix several issues in partition probing: - The bailout for a bad partoffset must use put_dev_sector(), since the preceding read_part_sec…
-
High 7.8
drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() It malicious user provides a small pptable through sysfs and then a bigger pptable, it may cause buffer overflow attack in f…
-
High 7.8
arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
In the Linux kernel, the following vulnerability has been resolved: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache le…
-
High 7.8
workqueue: Put the pwq after detaching the rescuer from the pool
In the Linux kernel, the following vulnerability has been resolved: workqueue: Put the pwq after detaching the rescuer from the pool The commit 68f83057b913("workqueue: Reap workers via kthread_stop() and remove detach_completion") adds code to reap the norma…
-
High 7.8
vrf: use RCU protection in l3mdev_l3_out()
In the Linux kernel, the following vulnerability has been resolved: vrf: use RCU protection in l3mdev_l3_out() l3mdev_l3_out() can be called without RCU being held: raw_sendmsg() ip_push_pending_frames() ip_send_skb() ip_local_out() __ip_local_out() l3mdev_ip…
-
High 7.8
ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt
In the Linux kernel, the following vulnerability has been resolved: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt If an AX25 device is bound to a socket by setting the SO_BINDTODEVICE socket option, a refcount leak will occur in ax25_relea…
-
High 7.8
batman-adv: Drop unmanaged ELP metric worker
In the Linux kernel, the following vulnerability has been resolved: batman-adv: Drop unmanaged ELP metric worker The ELP worker needs to calculate new metric values for all neighbors "reachable" over an interface. Some of the used metric sources require locks…
-
High 7.8
io_uring/kbuf: reallocate buf lists on upgrade
In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: reallocate buf lists on upgrade IORING_REGISTER_PBUF_RING can reuse an old struct io_buffer_list if it was created for legacy selected buffer and has been emptied. It violates …
-
High 7.8
s390/ism: add release function for struct device
In the Linux kernel, the following vulnerability has been resolved: s390/ism: add release function for struct device According to device_release() in /drivers/base/core.c, a device without a release function is a broken device and must be fixed. The current c…
-
High 7.8
geneve: Fix use-after-free in geneve_find_dev().
In the Linux kernel, the following vulnerability has been resolved: geneve: Fix use-after-free in geneve_find_dev(). syzkaller reported a use-after-free in geneve_find_dev() [0] without repro. geneve_configure() links struct geneve_dev.next to net_generic(net…
-
High 7.8
io_uring: prevent opcode speculation
In the Linux kernel, the following vulnerability has been resolved: io_uring: prevent opcode speculation sqe->opcode is used for different tables, make sure we santitise it against speculations.
-
High 7.8
tcp: drop secpath at the same time as we currently drop dst
In the Linux kernel, the following vulnerability has been resolved: tcp: drop secpath at the same time as we currently drop dst Xiumei reported hitting the WARN in xfrm6_tunnel_net_exit while running tests that boil down to: - create a pair of netns - run a b…
-
High 7.8
bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()
In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() KMSAN reported a use-after-free issue in eth_skb_pkt_type()[1]. The cause of the issue was that eth_skb_pkt_type() accessed skb's…
-
High 7.8
ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers Other, non DAI copier widgets could have the same stream name (sname) as the ALH copier and in that case the copier->data is …
-
High 7.5
NFSD: fix hang in nfsd4_shutdown_callback
In the Linux kernel, the following vulnerability has been resolved: NFSD: fix hang in nfsd4_shutdown_callback If nfs4_client is in courtesy state then there is no point to send the callback. This causes nfsd4_shutdown_callback to hang since cl_cb_inflight is …
-
High 7.5
smb: client: Add check for next_buffer in receive_encrypted_standard()
In the Linux kernel, the following vulnerability has been resolved: smb: client: Add check for next_buffer in receive_encrypted_standard() Add check for the return value of cifs_buf_get() and cifs_small_buf_get() in receive_encrypted_standard() to prevent nul…
-
High 7.5
net: allow small head cache usage with large MAX_SKB_FRAGS values
In the Linux kernel, the following vulnerability has been resolved: net: allow small head cache usage with large MAX_SKB_FRAGS values Sabrina reported the following splat: WARNING: CPU: 0 PID: 1 at net/core/dev.c:6935 netif_napi_add_weight_locked+0x8f2/0xba0 …
-
High 7.3
KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop Move the conditional loading of hardware DR6 with the guest's DR6 value out of the core .vcpu_run() loop to fix a bug…
-
Medium 5.5
bpf: Fix deadlock when freeing cgroup storage
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix deadlock when freeing cgroup storage The following commit bc235cdb423a ("bpf: Prevent deadlock from recursive bpf_task_storage_[get|delete]") first introduced deadlock prevention for…
-
Medium 5.5
can: etas_es58x: fix potential NULL pointer dereference on udev->serial
In the Linux kernel, the following vulnerability has been resolved: can: etas_es58x: fix potential NULL pointer dereference on udev->serial The driver assumed that es58x_dev->udev->serial could never be NULL. While this is true on commercially available devic…
-
Medium 5.5
can: ctucanfd: handle skb allocation failure
In the Linux kernel, the following vulnerability has been resolved: can: ctucanfd: handle skb allocation failure If skb allocation fails, the pointer to struct can_frame is NULL. This is actually handled everywhere inside ctucan_err_interrupt() except for the…
-
Medium 5.5
gpiolib: Fix crash on error in gpiochip_get_ngpios()
In the Linux kernel, the following vulnerability has been resolved: gpiolib: Fix crash on error in gpiochip_get_ngpios() The gpiochip_get_ngpios() uses chip_*() macros to print messages. However these macros rely on gpiodev to be initialised and set, which is…
-
Medium 5.5
vxlan: check vxlan_vnigroup_init() return value
In the Linux kernel, the following vulnerability has been resolved: vxlan: check vxlan_vnigroup_init() return value vxlan_init() must check vxlan_vnigroup_init() success otherwise a crash happens later, spotted by syzbot. Oops: general protection fault, proba…
-
Medium 5.5
spi: sn-f-ospi: Fix division by zero
In the Linux kernel, the following vulnerability has been resolved: spi: sn-f-ospi: Fix division by zero When there is no dummy cycle in the spi-nor commands, both dummy bus cycle bytes and width are zero. Because of the cpu's warning when divided by zero, th…
-
Medium 5.5
acct: perform last write from workqueue
In the Linux kernel, the following vulnerability has been resolved: acct: perform last write from workqueue In [1] it was reported that the acct(2) system call can be used to trigger NULL deref in cases where it is set to write to a file that triggers an inte…
-
Medium 5.5
ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data()
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() The nullity of sps->cstream should be checked similarly as it is done in sof_set_stream_data_offset() function. Assuming…
-
Medium 5.5
nfp: bpf: Add check for nfp_app_ctrl_msg_alloc()
In the Linux kernel, the following vulnerability has been resolved: nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() Add check for the return value of nfp_app_ctrl_msg_alloc() in nfp_bpf_cmsg_alloc() to prevent null pointer dereference.
-
Medium 5.5
sockmap, vsock: For connectible sockets allow only connected
In the Linux kernel, the following vulnerability has been resolved: sockmap, vsock: For connectible sockets allow only connected sockmap expects all vsocks to have a transport assigned, which is expressed in vsock_proto::psock_update_sk_prot(). However, there…
-
Medium 5.5
net/sched: cls_api: fix error handling causing NULL dereference
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: fix error handling causing NULL dereference tcf_exts_miss_cookie_base_alloc() calls xa_alloc_cyclic() which can return 1 if the allocation succeeded after wrapping. This w…
-
Medium 5.5
USB: gadget: f_midi: f_midi_complete to call queue_work
In the Linux kernel, the following vulnerability has been resolved: USB: gadget: f_midi: f_midi_complete to call queue_work When using USB MIDI, a lock is attempted to be acquired twice through a re-entrant call to f_midi_transmit, causing a deadlock. Fix it …
-
Medium 5.5
mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()
In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() If migration succeeded, we called folio_migrate_flags()->mem_cgroup_migrate() to migrate the memcg from the …
-
Medium 5.5
drop_monitor: fix incorrect initialization order
In the Linux kernel, the following vulnerability has been resolved: drop_monitor: fix incorrect initialization order Syzkaller reports the following bug: BUG: spinlock bad magic on CPU#1, syz-executor.0/7995 lock: 0xffff88805303f3e0, .magic: 00000000, .owner:…
-
Medium 5.5
powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC
In the Linux kernel, the following vulnerability has been resolved: powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC Erhard reported the following KASAN hit while booting his PowerMac G4 with a KASAN-enabled kernel 6.13-rc6:…
-
Unscored —
media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread
In the Linux kernel, the following vulnerability has been resolved: media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread syzbot report a null-ptr-deref in vidtv_mux_stop_thread. [1] If dvb->mux is not initialized successfully by vidtv_mux_init() in the…
-
Unscored —
memcg: fix soft lockup in the OOM process
In the Linux kernel, the following vulnerability has been resolved: memcg: fix soft lockup in the OOM process A soft lockup issue was found in the product with about 56,000 tasks were in the OOM cgroup, it was traversing them when the soft lockup was triggere…
-
Unscored —
HID: multitouch: Add NULL check in mt_input_configured
In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Add NULL check in mt_input_configured devm_kasprintf() can return a NULL pointer on failure,but this returned value in mt_input_configured() is not checked. Add NULL check in…
-
Unscored —
PCI/ASPM: Fix link state exit during switch upstream function removal
In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix link state exit during switch upstream function removal Before 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free"), we would free the ASPM li…
-
Unscored —
usb: cdc-acm: Check control transfer buffer size before access
In the Linux kernel, the following vulnerability has been resolved: usb: cdc-acm: Check control transfer buffer size before access If the first fragment is shorter than struct usb_cdc_notification, we can't calculate an expected_size. Log an error and discard…
-
Unscored —
mptcp: pm: only set fullmesh for subflow endp
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: only set fullmesh for subflow endp With the in-kernel path-manager, it is possible to change the 'fullmesh' flag. The code in mptcp_pm_nl_fullmesh() expects to change it only on 's…
-
Unscored —
Input: synaptics - fix crash when enabling pass-through port
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics - fix crash when enabling pass-through port When enabling a pass-through port an interrupt might come before psmouse driver binds to the pass-through port. However synaptics …
-
Unscored —
clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context
In the Linux kernel, the following vulnerability has been resolved: clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context The following bug report happened with a PREEMPT_RT kernel: BUG: sleeping function called from invalid c…
-
Unscored —
net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels Some lwtunnels have a dst cache for post-transformation dst. If the packet destination did not change we may end up recording a r…
-
Unscored —
USB: hub: Ignore non-compliant devices with too many configs or interfaces
In the Linux kernel, the following vulnerability has been resolved: USB: hub: Ignore non-compliant devices with too many configs or interfaces Robert Morris created a test program which can cause usb_hub_to_struct_hub() to dereference a NULL or inappropriate …
-
Unscored —
KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel Advertise support for Hyper-V's SEND_IPI and SEND_IPI_EX hypercalls if and only if the local API is emulated/virtu…
-
Unscored —
batman-adv: fix panic during interface removal
In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix panic during interface removal Reference counting is used to ensure that batadv_hardif_neigh_node and batadv_hard_iface are not freed before/during batadv_v_elp_throughput_met…
-
Unscored —
orangefs: fix a oob in orangefs_debug_write
In the Linux kernel, the following vulnerability has been resolved: orangefs: fix a oob in orangefs_debug_write I got a syzbot report: slab-out-of-bounds Read in orangefs_debug_write... several people suggested fixes, I tested Al Viro's suggestion and made th…
-
Unscored —
drm/amdgpu: bail out when failed to load fw in psp_init_cap_microcode()
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: bail out when failed to load fw in psp_init_cap_microcode() In function psp_init_cap_microcode(), it should bail out when failed to load firmware, otherwise it may cause invalid m…
-
Unscored —
team: better TEAM_OPTION_TYPE_STRING validation
In the Linux kernel, the following vulnerability has been resolved: team: better TEAM_OPTION_TYPE_STRING validation syzbot reported following splat [1] Make sure user-provided data contains one nul byte. [1] BUG: KMSAN: uninit-value in string_nocheck lib/vspr…
-
Unscored —
fbdev: omap: use threaded IRQ for LCD DMA
In the Linux kernel, the following vulnerability has been resolved: fbdev: omap: use threaded IRQ for LCD DMA When using touchscreen and framebuffer, Nokia 770 crashes easily with: BUG: scheduling while atomic: irq/144-ads7846/82/0x00010000 Modules linked in:…
-
Unscored —
usb: gadget: f_midi: fix MIDI Streaming descriptor lengths
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi: fix MIDI Streaming descriptor lengths While the MIDI jacks are configured correctly, and the MIDIStreaming endpoint descriptors are filled with the correct information, b…
-
Unscored —
usb: gadget: core: flush gadget workqueue after device removal
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: core: flush gadget workqueue after device removal device_del() can lead to new work being scheduled in gadget->work workqueue. This is observed, for example, with the dwc3 driver…
-
Unscored —
bpf: avoid holding freeze_mutex during mmap operation
In the Linux kernel, the following vulnerability has been resolved: bpf: avoid holding freeze_mutex during mmap operation We use map->freeze_mutex to prevent races between map_freeze() and memory mapping BPF map contents with writable permissions. The way we …
-
Unscored —
powerpc/code-patching: Disable KASAN report during patching via temporary mm
In the Linux kernel, the following vulnerability has been resolved: powerpc/code-patching: Disable KASAN report during patching via temporary mm Erhard reports the following KASAN hit on Talos II (power9) with kernel 6.13: [ 12.028126] =======================…
-
Unscored —
tee: optee: Fix supplicant wait loop
In the Linux kernel, the following vulnerability has been resolved: tee: optee: Fix supplicant wait loop OP-TEE supplicant is a user-space daemon and it's possible for it be hung or crashed or killed in the middle of processing an OP-TEE RPC call. It becomes …
References
-
report
https://ubuntu.com/security/CVE-2024-52559
-
report
https://ubuntu.com/security/CVE-2024-54456
-
report
https://ubuntu.com/security/CVE-2024-54458
-
report
https://ubuntu.com/security/CVE-2024-57834
-
report
https://ubuntu.com/security/CVE-2024-57977
-
report
https://ubuntu.com/security/CVE-2024-58020
-
report
https://ubuntu.com/security/CVE-2024-58086
-
report
https://ubuntu.com/security/CVE-2024-58088
-
report
https://ubuntu.com/security/CVE-2024-58093
-
report
https://ubuntu.com/security/CVE-2025-21704
-
report
https://ubuntu.com/security/CVE-2025-21706
-
report
https://ubuntu.com/security/CVE-2025-21712
-
report
https://ubuntu.com/security/CVE-2025-21746
-
report
https://ubuntu.com/security/CVE-2025-21758
-
report
https://ubuntu.com/security/CVE-2025-21759
-
report
https://ubuntu.com/security/CVE-2025-21760
-
report
https://ubuntu.com/security/CVE-2025-21761
-
report
https://ubuntu.com/security/CVE-2025-21762
-
report
https://ubuntu.com/security/CVE-2025-21763
-
report
https://ubuntu.com/security/CVE-2025-21764
-
report
https://ubuntu.com/security/CVE-2025-21765
-
report
https://ubuntu.com/security/CVE-2025-21766
-
report
https://ubuntu.com/security/CVE-2025-21767
-
report
https://ubuntu.com/security/CVE-2025-21768
-
report
https://ubuntu.com/security/CVE-2025-21772
-
report
https://ubuntu.com/security/CVE-2025-21773
-
report
https://ubuntu.com/security/CVE-2025-21775
-
report
https://ubuntu.com/security/CVE-2025-21776
-
report
https://ubuntu.com/security/CVE-2025-21779
-
report
https://ubuntu.com/security/CVE-2025-21780
-
report
https://ubuntu.com/security/CVE-2025-21781
-
report
https://ubuntu.com/security/CVE-2025-21782
-
report
https://ubuntu.com/security/CVE-2025-21783
-
report
https://ubuntu.com/security/CVE-2025-21784
-
report
https://ubuntu.com/security/CVE-2025-21785
-
report
https://ubuntu.com/security/CVE-2025-21786
-
report
https://ubuntu.com/security/CVE-2025-21787
-
report
https://ubuntu.com/security/CVE-2025-21790
-
report
https://ubuntu.com/security/CVE-2025-21791