Summary
Qualys discovered that several vulnerabilities existed in the AppArmor
Linux kernel Security Module (LSM). An unprivileged local attacker could
use these issues to load, replace, and remove arbitrary AppArmor profiles
causing denial of service, exposure of sensitive information (kernel
memory), local privilege escalation, or possibly escape a container.
(LP: #2143853)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacker could
possibly use this issue to influence the values returned by the RDSEED
instruction causing loss of confidentiality and integrity. (CVE-2025-62626)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ATM drivers;
- Network block device driver;
- Bluetooth drivers;
- Data acquisition framework and drivers;
- Hardware crypto device drivers;
- Device frequency scaling framework;
- Intel Stratix 10 firmware drivers;
- GPIO subsystem;
- GPU drivers;
- Microsoft Hyper-V drivers;
- CoreSight HW tracing drivers;
- IIO subsystem;
- InfiniBand drivers;
- Input Device core drivers;
- Input Device (Tablet) drivers;
- IOMMU subsystem;
- IRQ chip drivers;
- Macintosh device drivers;
- Multiple devices driver;
- MOST (Media Oriented Systems Transport) drivers;
- MTD block device drivers;
- Network drivers;
- Mellanox network drivers;
- Texas Instruments network drivers;
- Ethernet team driver;
- MediaTek network drivers;
- NVME drivers;
- Pin controllers subsystem;
- x86 platform drivers;
- Voltage and Current Regulator drivers;
- Real Time Clock drivers;
- S/390 drivers;
- SCSI subsystem;
- Texas Instruments SoC drivers;
- SPI subsystem;
- Media Oriented Systems Transport (MOST) driver;
- Realtek RTL8723BS SDIO drivers;
- TCM subsystem;
- UFS subsystem;
- DesignWare USB3 driver;
- USB Gadget drivers;
- Renesas USBHS Controller drivers;
- USB Mass Storage drivers;
- USB Type-C Connector System Software Interface driver;
- Backlight driver;
- Framebuffer layer;
- AFS file system;
- BFS file system;
- BTRFS file system;
- EROFS file system;
- Ext4 file system;
- FAT file system;
- GFS2 file system;
- Journaling layer for block devices (JBD2);
- File systems infrastructure;
- Network file system (NFS) client;
- NTFS3 file system;
- OCFS2 file system;
- SMB network file system;
- XFS file system;
- BPF subsystem;
- MediaTek SoC drivers;
- Bluetooth subsystem;
- io_uring subsystem;
- Locking primitives;
- Scheduler infrastructure;
- Timer subsystem;
- Tracing infrastructure;
- Kexec HandOver (KHO);
- Memory management;
- Ceph Core library;
- Networking core;
- Devlink API;
- IPv4 networking;
- IPv6 networking;
- Multipath TCP;
- Open vSwitch;
- Network traffic control;
- VMware vSockets driver;
- eXpress Data Path;
- Integrity Measurement Architecture(IMA) framework;
- Simplified Mandatory Access Control Kernel framework;
- FireWire sound drivers;
- HD-audio driver;
- Turtle Beach Wavefront ALSA driver;
- SoundWire (SDCA) ASoC drivers;
(CVE-2025-40246, CVE-2025-40247, CVE-2025-40248, CVE-2025-40249,
CVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253,
CVE-2025-40254, CVE-2025-40255, CVE-2025-40257, CVE-2025-40258,
CVE-2025-40259, CVE-2025-40260, CVE-2025-40261, CVE-2025-40262,
CVE-2025-40263, CVE-2025-40264, CVE-2025-40265, CVE-2025-40266,
CVE-2025-40290, CVE-2025-40345, CVE-2025-68212, CVE-2025-68213,
CVE-2025-68214, CVE-2025-68215, CVE-2025-68217, CVE-2025-68218,
CVE-2025-68219, CVE-2025-68220, CVE-2025-68221, CVE-2025-68222,
CVE-2025-68223, CVE-2025-68225, CVE-2025-68227, CVE-2025-68228,
CVE-2025-68229, CVE-2025-68230, CVE-2025-68231, CVE-2025-68232,
CVE-2025-68233, CVE-2025-68234, CVE-2025-68235, CVE-2025-68236,
CVE-2025-68237, CVE-2025-68238, CVE-2025-68254, CVE-2025-68255,
CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259,
CVE-2025-68261, CVE-2025-68262, CVE-2025-68263, CVE-2025-68264,
CVE-2025-68265, CVE-2025-68266, CVE-2025-68281, CVE-2025-68282,
CVE-2025-68283, CVE-2025-68284, CVE-2025-68285, CVE-2025-68286,
CVE-2025-68287, CVE-2025-68288, CVE-2025-68289, CVE-2025-68290,
CVE-2025-68292, CVE-2025-68293, CVE-2025-68294, CVE-2025-68295,
CVE-2025-68296, CVE-2025-68297, CVE-2025-68298, CVE-2025-68299,
CVE-2025-68300, CVE-2025-68301, CVE-2025-68302, CVE-2025-68303,
CVE-2025-68304, CVE-2025-68305, CVE-2025-68306, CVE-2025-68307,
CVE-2025-68308, CVE-2025-68323, CVE-2025-68324, CVE-2025-68325,
CVE-2025-68326, CVE-2025-68327, CVE-2025-68328, CVE-2025-68329,
CVE-2025-68330, CVE-2025-68331, CVE-2025-68332, CVE-2025-68333,
CVE-2025-68334, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337,
CVE-2025-68338, CVE-2025-68339, CVE-2025-68340, CVE-2025-68341,
CVE-2025-68342, CVE-2025-68343, CVE-2025-68344, CVE-2025-68345,
CVE-2025-68346, CVE-2025-68347, CVE-2025-68348, CVE-2025-68349,
CVE-2025-68352, CVE-2025-68354, CVE-2025-68356, CVE-2025-68358,
CVE-2025-68359, CVE-2025-68360, CVE-2025-68361, CVE-2025-68362,
CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367,
CVE-2025-68369, CVE-2025-68370, CVE-2025-68371, CVE-2025-68372,
CVE-2025-68373, CVE-2025-68374, CVE-2025-68375, CVE-2025-68376,
CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724,
CVE-2025-68726, CVE-2025-68727, CVE-2025-68728, CVE-2025-68729,
CVE-2025-68730, CVE-2025-68732, CVE-2025-68733, CVE-2025-68735,
CVE-2025-68738, CVE-2025-68739, CVE-2025-68740, CVE-2025-68741,
CVE-2025-68742, CVE-2025-68743, CVE-2025-68744, CVE-2025-68746,
CVE-2025-68747, CVE-2025-68748, CVE-2025-68749, CVE-2025-68751,
CVE-2
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | linux-gcp-6.17 | 6.17.0-1009.9~24.04.3 |
| Ubuntu · 25.10 | linux-realtime | 6.17.0-1008.9 |
Vulnerabilities 172
-
Critical 9.8
net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()
In the Linux kernel, the following vulnerability has been resolved: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() The loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate over 'cqe->len_list[]' using only a zero-…
-
Critical 9.8
mptcp: fix a race in mptcp_pm_del_add_timer()
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix a race in mptcp_pm_del_add_timer() mptcp_pm_del_add_timer() can call sk_stop_timer_sync(sk, &entry->add_timer) while another might have free entry already, as reported by syzbot. A…
-
Critical 9.8
mptcp: fix race condition in mptcp_schedule_work()
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount …
-
Critical 9.8
nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
In the Linux kernel, the following vulnerability has been resolved: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() nvme_fc_delete_assocation() waits for pending I/O to complete before returning, and an error can cause ->ioerr_work to…
-
Critical 9.8
ksmbd: ipc: fix use-after-free in ipc_msg_send_request
In the Linux kernel, the following vulnerability has been resolved: ksmbd: ipc: fix use-after-free in ipc_msg_send_request ipc_msg_send_request() waits for a generic netlink reply using an ipc_msg_table_entry on the stack. The generic netlink handler (handle_…
-
Critical 9.8
libceph: prevent potential out-of-bounds writes in handle_auth_session_key()
In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() The len field originates from untrusted network packets. Boundary checks have been added to prevent potential out-…
-
Critical 9.8
libceph: fix potential use-after-free in have_mon_and_osd_map()
In the Linux kernel, the following vulnerability has been resolved: libceph: fix potential use-after-free in have_mon_and_osd_map() The wait loop in __ceph_open_session() can race with the client receiving a new monmap or osdmap shortly after the initial map …
-
Critical 9.8
net: atlantic: fix fragment overflow handling in RX path
In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix fragment overflow handling in RX path The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17) fragments when handling large multi-descriptor packets. This…
-
Critical 9.8
veth: reduce XDP no_direct return section to fix race
In the Linux kernel, the following vulnerability has been resolved: veth: reduce XDP no_direct return section to fix race As explain in commit fa349e396e48 ("veth: Fix race with AF_XDP exposing old or uninitialized descriptors") for veth there is a chance aft…
-
Critical 9.8
btrfs: fix double free of qgroup record after failure to add delayed ref head
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free of qgroup record after failure to add delayed ref head In the previous code it was possible to incur into a double kfree() scenario when calling add_delayed_ref_head().…
-
Critical 9.8
crypto: aead - Fix reqsize handling
In the Linux kernel, the following vulnerability has been resolved: crypto: aead - Fix reqsize handling Commit afddce13ce81d ("crypto: api - Add reqsize to crypto_alg") introduced cra_reqsize field in crypto_alg struct to replace type specific reqsize fields.…
-
Critical 9.8
scsi: qla2xxx: Fix improper freeing of purex item
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix improper freeing of purex item In qla2xxx_process_purls_iocb(), an item is allocated via qla27xx_copy_multiple_pkt(), which internally calls qla24xx_alloc_purex_item(). The…
-
High 8.8
s390/ctcm: Fix double-kfree
In the Linux kernel, the following vulnerability has been resolved: s390/ctcm: Fix double-kfree The function 'mpc_rcvd_sweep_req(mpcginfo)' is called conditionally from function 'ctcmpc_unpack_skb'. It frees passed mpcginfo. After that a call to function 'kfr…
-
High 8.8
staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing The Supported Rates IE length from an incoming Association Request frame was used directly as the memcpy() length when c…
-
High 8.8
staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser The Information Element (IE) parser rtw_get_ie() trusted the length byte of each IE without validating that the IE body (len …
-
High 8.8
Bluetooth: hci_core: lookup hci_conn on RX path on protocol side
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: lookup hci_conn on RX path on protocol side The hdev lock/lookup/unlock/use pattern in the packet RX path doesn't ensure hci_conn* is not concurrently modified/deleted. T…
-
High 8.2
KVM: arm64: Check the untrusted offset in FF-A memory share
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Check the untrusted offset in FF-A memory share Verify the offset to prevent OOB access in the hypervisor FF-A buffer in case an untrusted large enough value [U32_MAX - sizeof(str…
-
High 8.2
wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks MT7996 driver can use both wed and wed_hif2 devices to offload traffic from/to the wireless NIC. In the current codebas…
-
High 7.8
vsock: Ignore signal/timeout on connect() if already established
In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if already established During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues: 1. connec…
-
High 7.8
gpio: cdev: make sure the cdev fd is still active before emitting events
In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: make sure the cdev fd is still active before emitting events With the final call to fput() on a file descriptor, the release action may be deferred and scheduled on a work queue. …
-
High 7.8
net/mlx5: Clean up only new IRQ glue on request_irq() failure
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Clean up only new IRQ glue on request_irq() failure The mlx5_irq_alloc() function can inadvertently free the entire rmap and end up in a crash[1] when the other threads tries to acc…
-
High 7.8
devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
In the Linux kernel, the following vulnerability has been resolved: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy The function devl_rate_nodes_destroy is documented to "Unset parent for all rate objects". However, it was only calling the driv…
-
High 7.8
Input: imx_sc_key - fix memory corruption on unload
In the Linux kernel, the following vulnerability has been resolved: Input: imx_sc_key - fix memory corruption on unload This is supposed to be "priv" but we accidentally pass "&priv" which is an address in the stack and so it will lead to memory corruption wh…
-
High 7.8
xsk: avoid data corruption on cq descriptor number
In the Linux kernel, the following vulnerability has been resolved: xsk: avoid data corruption on cq descriptor number Since commit 30f241fcf52a ("xsk: Fix immature cq descriptor production"), the descriptor number is stored in skb control block and xsk_cq_su…
-
High 7.8
fs: Fix uninitialized 'offp' in statmount_string()
In the Linux kernel, the following vulnerability has been resolved: fs: Fix uninitialized 'offp' in statmount_string() In statmount_string(), most flags assign an output offset pointer (offp) which is later updated with the string offset. However, the STATMOU…
-
High 7.8
io_uring/cmd_net: fix wrong argument types for skb_queue_splice()
In the Linux kernel, the following vulnerability has been resolved: io_uring/cmd_net: fix wrong argument types for skb_queue_splice() If timestamp retriving needs to be retried and the local list of SKB's already has entries, then it's spliced back into the s…
-
High 7.8
nvme: fix admin request_queue lifetime
In the Linux kernel, the following vulnerability has been resolved: nvme: fix admin request_queue lifetime The namespaces can access the controller's admin request_queue, and stale references on the namespaces may exist after tearing down the controller. Ensu…
-
High 7.8
drm/amd/display: Check NULL before accessing
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check NULL before accessing [WHAT] IGT kms_cursor_legacy's long-nonblocking-modeset-vs-cursor-atomic fails with NULL pointer dereference. This can be reproduced with both an …
-
High 7.8
io_uring/net: ensure vectored buffer node import is tied to notification
In the Linux kernel, the following vulnerability has been resolved: io_uring/net: ensure vectored buffer node import is tied to notification When support for vectored registered buffers was added, the import itself is using 'req' rather than the notification …
-
High 7.8
platform/x86: intel: punit_ipc: fix memory corruption
In the Linux kernel, the following vulnerability has been resolved: platform/x86: intel: punit_ipc: fix memory corruption This passes the address of the pointer "&punit_ipcdev" when the intent was to pass the pointer itself "punit_ipcdev" (without the ampersa…
-
High 7.8
team: Move team device type change at the end of team_port_add
In the Linux kernel, the following vulnerability has been resolved: team: Move team device type change at the end of team_port_add Attempting to add a port device that is already up will expectedly fail, but not before modifying the team device header_ops. In…
-
High 7.8
ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events
In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events The DSP event handling code in hwdep_read() could write more bytes to the user buffer than requested, when a user provide…
-
High 7.8
spi: ch341: fix out-of-bounds memory access in ch341_transfer_one
In the Linux kernel, the following vulnerability has been resolved: spi: ch341: fix out-of-bounds memory access in ch341_transfer_one Discovered by Atuin - Automated Vulnerability Discovery Engine. The 'len' variable is calculated as 'min(32, trans->len + 1)'…
-
High 7.8
coresight: tmc: add the handle of the event to the path
In the Linux kernel, the following vulnerability has been resolved: coresight: tmc: add the handle of the event to the path The handle is essential for retrieving the AUX_EVENT of each CPU and is required in perf mode. It has been added to the coresight_path …
-
High 7.8
RDMA/rxe: Fix null deref on srq->rq.queue after resize failure
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure A NULL pointer dereference can occur in rxe_srq_chk_attr() when ibv_modify_srq() is invoked twice in succession under certain er…
-
High 7.8
crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id Use check_add_overflow() to guard against potential integer overflows when adding the binary blob lengths and the size…
-
High 7.8
accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context()
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() Don't add BO to the vdev->bo_list in ivpu_gem_create_object(). When failure happens inside drm_gem_shmem_create(), the BO i…
-
High 7.8
drm/panthor: Prevent potential UAF in group creation
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Prevent potential UAF in group creation This commit prevents the possibility of a use after free issue in the GROUP_CREATE ioctl function, which arose as pointer to the group is …
-
High 7.8
spi: tegra210-quad: Fix timeout handling
In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad: Fix timeout handling When the CPU that the QSPI interrupt handler runs on (typically CPU 0) is excessively busy, it can lead to rare cases of the IRQ thread not running be…
-
High 7.8
drm/panthor: Fix UAF on kernel BO VA nodes
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix UAF on kernel BO VA nodes If the MMU is down, panthor_vm_unmap_range() might return an error. We expect the page table to be updated still, and if the MMU is blocked, the res…
-
High 7.8
drm/panthor: Fix UAF race between device unplug and FW event processing
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix UAF race between device unplug and FW event processing The function panthor_fw_unplug() will free the FW memory sections. The problem is that there could still be pending FW …
-
High 7.8
accel/ivpu: Fix race condition when unbinding BOs
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix race condition when unbinding BOs Fix 'Memory manager not clean during takedown' warning that occurs when ivpu_gem_bo_free() removes the BO from the BOs list before it gets un…
-
High 7.8
NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
In the Linux kernel, the following vulnerability has been resolved: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags When a filesystem is being automounted, it needs to preserve the user-set superblock mount options, such as the "ro" fla…
-
High 7.5
nvme-multipath: fix lockdep WARN due to partition scan work
In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix lockdep WARN due to partition scan work Blktests test cases nvme/014, 057 and 058 fail occasionally due to a lockdep WARN. As reported in the Closes tag URL, the WARN indi…
-
High 7.5
veth: more robust handing of race to avoid txq getting stuck
In the Linux kernel, the following vulnerability has been resolved: veth: more robust handing of race to avoid txq getting stuck Commit dc82a33297fc ("veth: apply qdisc backpressure on full ptr_ring to reduce TX drops") introduced a race condition that can le…
-
High 7.5
ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()
In the Linux kernel, the following vulnerability has been resolved: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() Fix a race between inline data destruction and block mapping. The function ext4_destroy_inline_data_nolock() changes the i…
-
High 7.5
libceph: replace BUG_ON with bounds check for map->max_osd
In the Linux kernel, the following vulnerability has been resolved: libceph: replace BUG_ON with bounds check for map->max_osd OSD indexes come from untrusted network packets. Boundary checks are added to validate these against map->max_osd. [ idryomov: drop …
-
High 7.5
net: sxgbe: fix potential NULL dereference in sxgbe_rx()
In the Linux kernel, the following vulnerability has been resolved: net: sxgbe: fix potential NULL dereference in sxgbe_rx() Currently, when skb is null, the driver prints an error and then dereferences skb on the next line. To fix this, let's add a 'break' a…
-
High 7.5
locking/spinlock/debug: Fix data-race in do_raw_write_lock
In the Linux kernel, the following vulnerability has been resolved: locking/spinlock/debug: Fix data-race in do_raw_write_lock KCSAN reports: BUG: KCSAN: data-race in do_raw_write_lock / do_raw_write_lock write (marked) to 0xffff800009cf504c of 4 bytes by tas…
-
High 7.5
jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted
In the Linux kernel, the following vulnerability has been resolved: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted There's issue when file system corrupted: ------------[ cut here ]------------ kernel BUG at fs/jbd2/transact…
-
High 7.5
NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode…
-
High 7.5
ntfs3: init run lock for extend inode
In the Linux kernel, the following vulnerability has been resolved: ntfs3: init run lock for extend inode After setting the inode mode of $Extend to a regular file, executing the truncate system call will enter the do_truncate() routine, causing the run_lock …
-
High 7.5
erspan: Initialize options_len before referencing options.
In the Linux kernel, the following vulnerability has been resolved: erspan: Initialize options_len before referencing options. The struct ip_tunnel_info has a flexible array member named options that is protected by a counted_by(options_len) attribute. The co…
-
High 7.2
Improper handling of insufficient entropy in the AMD CPUs could allow a local attacker to influence the values returned…
-
High 7.1
staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing The Extended Supported Rates (ESR) IE handling in OnBeacon accessed *(p + 1 + ielen) and *(p + 2 + ielen) without verifyi…
-
High 7.1
ALSA: firewire-motu: add bounds check in put_user loop for DSP events
In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-motu: add bounds check in put_user loop for DSP events In the DSP event handling code, a put_user() loop copies event data. When the user buffer size is not aligned to 4 bytes,…
-
High 7.0
ice: fix PTP cleanup on driver removal in error path
In the Linux kernel, the following vulnerability has been resolved: ice: fix PTP cleanup on driver removal in error path Improve the cleanup on releasing PTP resources in error path. The error case might happen either at the driver probe and PTP feature initi…
-
Unscored —
xfs: fix out of bounds memory read error in symlink repair
In the Linux kernel, the following vulnerability has been resolved: xfs: fix out of bounds memory read error in symlink repair xfs/286 produced this report on my test fleet: ================================================================== BUG: KFENCE: out-o…
-
Unscored —
drm/msm: Fix pgtable prealloc error path
In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix pgtable prealloc error path The following splat was reported: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 Mem abort info: ESR = 0x0000000…
-
Unscored —
net: openvswitch: remove never-working support for setting nsh fields
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: remove never-working support for setting nsh fields The validation of the set(nsh(...)) action is completely wrong. It runs through the nsh_key_put_from_nlattr() function th…
-
Unscored —
net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower()
In the Linux kernel, the following vulnerability has been resolved: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() The ethtool tsconfig Netlink path can trigger a null pointer dereference. A call chain such as: tsconfig_prepare_data() -> dev_…
-
Unscored —
scsi: sg: Do not sleep in atomic context
In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Do not sleep in atomic context sg_finish_rem_req() calls blk_rq_unmap_user(). The latter function may sleep. Hence, call sg_finish_rem_req() with interrupts enabled instead of disab…
-
Unscored —
sched_ext: Fix scx_enable() crash on helper kthread creation failure
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix scx_enable() crash on helper kthread creation failure A crash was observed when the sched_ext selftests runner was terminated with Ctrl+\ while test 15 was running: NIP [c00000…
-
Unscored —
Input: cros_ec_keyb - fix an invalid memory access
In the Linux kernel, the following vulnerability has been resolved: Input: cros_ec_keyb - fix an invalid memory access If cros_ec_keyb_register_matrix() isn't called (due to `buttons_switches_only`) in cros_ec_keyb_probe(), `ckdev->idev` remains NULL. An inva…
-
Unscored —
be2net: pass wrb_params in case of OS2BMC
In the Linux kernel, the following vulnerability has been resolved: be2net: pass wrb_params in case of OS2BMC be_insert_vlan_in_pkt() is called with the wrb_params argument being NULL at be_send_pkt_to_bmc() call site. This may lead to dereferencing a NULL p…
-
Unscored —
vfat: fix missing sb_min_blocksize() return value checks
In the Linux kernel, the following vulnerability has been resolved: vfat: fix missing sb_min_blocksize() return value checks When emulating an nvme device on qemu with both logical_block_size and physical_block_size set to 8 KiB, but without format, a kernel …
-
Unscored —
usb: storage: sddr55: Reject out-of-bound new_pba
In the Linux kernel, the following vulnerability has been resolved: usb: storage: sddr55: Reject out-of-bound new_pba Discovered by Atuin - Automated Vulnerability Discovery Engine. new_pba comes from the status packet returned after each write. A bogus devic…
-
Unscored —
idpf: fix possible vport_config NULL pointer deref in remove
In the Linux kernel, the following vulnerability has been resolved: idpf: fix possible vport_config NULL pointer deref in remove Attempting to remove the driver will cause a crash in cases where the vport failed to initialize. Following trace is from an insta…
-
Unscored —
timers: Fix NULL function pointer race in timer_shutdown_sync()
In the Linux kernel, the following vulnerability has been resolved: timers: Fix NULL function pointer race in timer_shutdown_sync() There is a race condition between timer_shutdown_sync() and timer expiration that can lead to hitting a WARN_ON in expire_timer…
-
Unscored —
Input: pegasus-notetaker - fix potential out-of-bounds access
In the Linux kernel, the following vulnerability has been resolved: Input: pegasus-notetaker - fix potential out-of-bounds access In the pegasus_notetaker driver, the pegasus_probe() function allocates the URB transfer buffer using the wMaxPacketSize value fr…
-
Unscored —
cifs: fix memory leak in smb3_fs_context_parse_param error path
In the Linux kernel, the following vulnerability has been resolved: cifs: fix memory leak in smb3_fs_context_parse_param error path Add proper cleanup of ctx->source and fc->source to the cifs_parse_mount_err error handler. This ensures that memory allocated …
-
Unscored —
net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error Make knav_dma_open_channel consistently return NULL on error instead of ERR_PTR. Currently the header inclu…
-
Unscored —
mptcp: fix address removal logic in mptcp_pm_nl_rm_addr
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix address removal logic in mptcp_pm_nl_rm_addr Fix inverted WARN_ON_ONCE condition that prevented normal address removal counter updates. The current code only executes decrement log…
-
Unscored —
pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc
In the Linux kernel, the following vulnerability has been resolved: pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc s32_pinctrl_desc is allocated with devm_kmalloc(), but not all of its fields are initialized. Notably, num_custom_params is used i…
-
Unscored —
drm/radeon: delete radeon_fence_process in is_signaled, no deadlock
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: delete radeon_fence_process in is_signaled, no deadlock Delete the attempt to progress the queue when checking if fence is signaled. This avoids deadlock. dma-fence_ops::signaled …
-
Unscored —
lib/test_kho: check if KHO is enabled
In the Linux kernel, the following vulnerability has been resolved: lib/test_kho: check if KHO is enabled We must check whether KHO is enabled prior to issuing KHO commands, otherwise KHO internal data structures are not initialized.
-
Unscored —
mptcp: Fix proto fallback detection with BPF
In the Linux kernel, the following vulnerability has been resolved: mptcp: Fix proto fallback detection with BPF The sockmap feature allows bpf syscall from userspace, or based on bpf sockops, replacing the sk_prot of sockets during protocol stack processing …
-
Unscored —
drm/plane: Fix create_in_format_blob() return value
In the Linux kernel, the following vulnerability has been resolved: drm/plane: Fix create_in_format_blob() return value create_in_format_blob() is either supposed to return a valid pointer or an error, but never NULL. The caller will dereference the blob when…
-
Unscored —
scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
In the Linux kernel, the following vulnerability has been resolved: scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() If the allocation of tl_hba->sh fails in tcm_loop_driver_probe() and we attempt to dereference it in tcm_loop_tpg_address_s…
-
Unscored —
drm/amdgpu: fix gpu page fault after hibernation on PF passthrough
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix gpu page fault after hibernation on PF passthrough On PF passthrough environment, after hibernate and then resume, coralgemm will cause gpu page fault. Mode1 reset happens dur…
-
Unscored —
mm/mempool: fix poisoning order>0 pages with HIGHMEM
In the Linux kernel, the following vulnerability has been resolved: mm/mempool: fix poisoning order>0 pages with HIGHMEM The kernel test has reported: BUG: unable to handle page fault for address: fffba000 #PF: supervisor write access in kernel mode #PF: erro…
-
Unscored —
drm/tegra: Add call to put_pid()
In the Linux kernel, the following vulnerability has been resolved: drm/tegra: Add call to put_pid() Add a call to put_pid() corresponding to get_task_pid(). host1x_memory_context_alloc() does not take ownership of the PID so we need to free it here to avoid …
-
Unscored —
nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot
In the Linux kernel, the following vulnerability has been resolved: nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot nvkm_falcon_fw::boot is allocated, but no one frees it. This causes a kmemleak warning. Make sure this data is deallocated.
-
Unscored —
scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3) According to UFS specifications, the power-off sequence for a UFS device includes: - Sending an SSU command with Power_Cond…
-
Unscored —
mtdchar: fix integer overflow in read/write ioctls
In the Linux kernel, the following vulnerability has been resolved: mtdchar: fix integer overflow in read/write ioctls The "req.start" and "req.len" variables are u64 values that come from the user at the start of the function. We mask away the high 32 bits o…
-
Unscored —
mtd: rawnand: cadence: fix DMA device NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: cadence: fix DMA device NULL pointer dereference The DMA device pointer `dma_dev` was being dereferenced before ensuring that `cdns_ctrl->dmac` is properly initialized. Move the…
-
Unscored —
comedi: check device's attached status in compat ioctls
In the Linux kernel, the following vulnerability has been resolved: comedi: check device's attached status in compat ioctls Syzbot identified an issue [1] that crashes kernel, seemingly due to unexistent callback dev->get_valid_routes(). By all means, this sh…
-
Unscored —
comedi: multiq3: sanitize config options in multiq3_attach()
In the Linux kernel, the following vulnerability has been resolved: comedi: multiq3: sanitize config options in multiq3_attach() Syzbot identified an issue [1] in multiq3_attach() that induces a task timeout due to open() or COMEDI_DEVCONFIG ioctl operations,…
-
Unscored —
KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced When re-injecting a soft interrupt from an INT3, INT0, or (select) INTn instruction, discard the exception and retry the in…
-
Unscored —
crypto: zstd - fix double-free in per-CPU stream cleanup
In the Linux kernel, the following vulnerability has been resolved: crypto: zstd - fix double-free in per-CPU stream cleanup The crypto/zstd module has a double-free bug that occurs when multiple tfms are allocated and freed. The issue happens because zstd_st…
-
Unscored —
ext4: refresh inline data size before write operations
In the Linux kernel, the following vulnerability has been resolved: ext4: refresh inline data size before write operations The cached ei->i_inline_size can become stale between the initial size check and when ext4_update_inline_data()/ext4_create_inline_data(…
-
Unscored —
bfs: Reconstruct file type when loading from disk
In the Linux kernel, the following vulnerability has been resolved: bfs: Reconstruct file type when loading from disk syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 32bits "mode" field loaded from disk are c…
-
Unscored —
ASoC: SDCA: bug fix while parsing mipi-sdca-control-cn-list
In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: bug fix while parsing mipi-sdca-control-cn-list "struct sdca_control" declares "values" field as integer array. But the memory allocated to it is of char array. This causes crash …
-
Unscored —
usb: gadget: udc: fix use-after-free in usb_gadget_state_work
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: fix use-after-free in usb_gadget_state_work A race condition during gadget teardown can lead to a use-after-free in usb_gadget_state_work(), as reported by KASAN: BUG: KASAN…
-
Unscored —
usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths This patch addresses a race condition caused by unsynchronized execution of multiple call paths invoking `dw…
-
Unscored —
usb: storage: Fix memory leak in USB bulk transport
In the Linux kernel, the following vulnerability has been resolved: usb: storage: Fix memory leak in USB bulk transport A kernel memory leak was identified by the 'ioctl_sg01' test from Linux Test Project (LTP). The following bytes were mainly observed: 0x534…
-
Unscored —
usb: gadget: f_eem: Fix memory leak in eem_unwrap
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_eem: Fix memory leak in eem_unwrap The existing code did not handle the failure case of usb_ep_queue in the command path, potentially leading to memory leaks. Improve error han…
-
Unscored —
most: usb: fix double free on late probe failure
In the Linux kernel, the following vulnerability has been resolved: most: usb: fix double free on late probe failure The MOST subsystem has a non-standard registration function which frees the interface on registration failures and on deregistration. This uns…
-
Unscored —
mm/memfd: fix information leak in hugetlb folios
In the Linux kernel, the following vulnerability has been resolved: mm/memfd: fix information leak in hugetlb folios When allocating hugetlb folios for memfd, three initialization steps are missing: 1. Folios are not zeroed, leading to kernel memory disclosur…
-
Unscored —
mm/huge_memory: fix NULL pointer deference when splitting folio
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix NULL pointer deference when splitting folio Commit c010d47f107f ("mm: thp: split huge page to any lower order pages") introduced an early check on the folio's order via ma…
-
Unscored —
smb: client: fix memory leak in cifs_construct_tcon()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix memory leak in cifs_construct_tcon() When having a multiuser mount with domain= specified and using cifscreds, cifs_set_cifscreds() will end up setting @ctx->domainname, so i…
-
Unscored —
drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup
In the Linux kernel, the following vulnerability has been resolved: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup Protect vga_switcheroo_client_fb_set() with console lock. Avoids OOB access in fbcon_remap_all(). Without holding the console l…
-
Unscored —
ceph: fix crash in process_v2_sparse_read() for encrypted directories
In the Linux kernel, the following vulnerability has been resolved: ceph: fix crash in process_v2_sparse_read() for encrypted directories The crash in process_v2_sparse_read() for fscrypt-encrypted directories has been reported. Issue takes place for Ceph msg…
-
Unscored —
Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref In btusb_mtk_setup(), we set `btmtk_data->isopkt_intf` to: usb_ifnum_to_if(data->udev, MTK_ISO_IFNUM) That function can…
-
Unscored —
afs: Fix delayed allocation of a cell's anonymous key
In the Linux kernel, the following vulnerability has been resolved: afs: Fix delayed allocation of a cell's anonymous key The allocation of a cell's anonymous key is done in a background thread along with other cell setup such as doing a DNS upcall. In the re…
-
Unscored —
fs/namespace: fix reference leak in grab_requested_mnt_ns
In the Linux kernel, the following vulnerability has been resolved: fs/namespace: fix reference leak in grab_requested_mnt_ns lookup_mnt_ns() already takes a reference on mnt_ns. grab_requested_mnt_ns() doesn't need to take an extra reference.
-
Unscored —
Bluetooth: hci_sock: Prevent race in socket write iter and sock bind
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind There is a potential race condition between sock bind and socket write iter. bind may free the same cmd via mgmt_pending b…
-
Unscored —
Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso interface
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso interface When performing reset tests and encountering abnormal card drop issues that lead to a kernel crash, it is necessa…
-
Unscored —
can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs
In the Linux kernel, the following vulnerability has been resolved: can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs The driver lacks the cleanup of failed transfers of URBs. This reduces the number of available URBs per error by 1…
-
Unscored —
can: kvaser_usb: leaf: Fix potential infinite loop in command parsers
In the Linux kernel, the following vulnerability has been resolved: can: kvaser_usb: leaf: Fix potential infinite loop in command parsers The `kvaser_usb_leaf_wait_cmd()` and `kvaser_usb_leaf_read_bulk_callback` functions contain logic to zero-length commands…
-
Unscored —
usb: typec: ucsi: fix use-after-free caused by uec->work
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: fix use-after-free caused by uec->work The delayed work uec->work is scheduled in gaokun_ucsi_probe() but never properly canceled in gaokun_ucsi_remove(). This creates use-a…
-
Unscored —
scsi: imm: Fix use-after-free bug caused by unfinished delayed work
In the Linux kernel, the following vulnerability has been resolved: scsi: imm: Fix use-after-free bug caused by unfinished delayed work The delayed work item 'imm_tq' is initialized in imm_attach() and scheduled via imm_queuecommand() for processing SCSI comm…
-
Unscored —CVE-2025-68325 Public exploit
net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop In cake_drop(), qdisc_tree_reduce_backlog() is used to update the qlen and backlog of the qdisc hierarchy. Its caller, cake_enqu…
-
Unscored —
drm/xe/guc: Fix stack_depot usage
In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Fix stack_depot usage Add missing stack_depot_init() call when CONFIG_DRM_XE_DEBUG_GUC is enabled to fix the following call stack: [] BUG: kernel NULL pointer dereference, address…
-
Unscored —
usb: renesas_usbhs: Fix synchronous external abort on unbind
In the Linux kernel, the following vulnerability has been resolved: usb: renesas_usbhs: Fix synchronous external abort on unbind A synchronous external abort occurs on the Renesas RZ/G3S SoC if unbind is executed after the configuration sequence described abo…
-
Unscored —
firmware: stratix10-svc: fix bug in saving controller data
In the Linux kernel, the following vulnerability has been resolved: firmware: stratix10-svc: fix bug in saving controller data Fix the incorrect usage of platform_set_drvdata and dev_set_drvdata. They both are of the same data and overrides each other. This r…
-
Unscored —
tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs When a VMA is split (e.g., by partial munmap or MAP_FIXED), the kernel calls vm_ops->close on each portion. For trace buffer …
-
Unscored —
iio: accel: bmc150: Fix irq assumption regression
In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: Fix irq assumption regression The code in bmc150-accel-core.c unconditionally calls bmc150_accel_set_interrupt() in the iio_buffer_setup_ops, such as on the runtime PM res…
-
Unscored —
usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer
In the Linux kernel, the following vulnerability has been resolved: usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer When a UAS device is unplugged during data transfer, there is a probability of a system panic occu…
-
Unscored —
comedi: c6xdigio: Fix invalid PNP driver unregistration
In the Linux kernel, the following vulnerability has been resolved: comedi: c6xdigio: Fix invalid PNP driver unregistration The Comedi low-level driver "c6xdigio" seems to be for a parallel port connected device. When the Comedi core calls the driver's Comedi…
-
Unscored —
sched_ext: Fix possible deadlock in the deferred_irq_workfn()
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix possible deadlock in the deferred_irq_workfn() For PREEMPT_RT=y kernels, the deferred_irq_workfn() is executed in the per-cpu irq_work/* task context and not disable-irq, if th…
-
Unscored —
platform/x86/amd/pmc: Add support for Van Gogh SoC
In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Add support for Van Gogh SoC The ROG Xbox Ally (non-X) SoC features a similar architecture to the Steam Deck. While the Steam Deck supports S3 (s2idle causes a crash), t…
-
Unscored —
comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel()
In the Linux kernel, the following vulnerability has been resolved: comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() Syzbot identified an issue [1] in pcl818_ai_cancel(), which stems from the fact that in case of early device detach via pcl818_detach(…
-
Unscored —
net: dsa: microchip: Don't free uninitialized ksz_irq
In the Linux kernel, the following vulnerability has been resolved: net: dsa: microchip: Don't free uninitialized ksz_irq If something goes wrong at setup, ksz_irq_free() can be called on uninitialized ksz_irq (for example when ksz_ptp_irq_setup() fails). It …
-
Unscored —
atm/fore200e: Fix possible data race in fore200e_open()
In the Linux kernel, the following vulnerability has been resolved: atm/fore200e: Fix possible data race in fore200e_open() Protect access to fore200e->available_cell_rate with rate_mtx lock in the error handling path of fore200e_open() to prevent a data race…
-
Unscored —
can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data
In the Linux kernel, the following vulnerability has been resolved: can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data The URB received in gs_usb_receive_bulk_callback() contains a struct gs_host_frame. The length of the da…
-
Unscored —
can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header
In the Linux kernel, the following vulnerability has been resolved: can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header The driver expects to receive a struct gs_host_frame in gs_usb_receive_bulk_callback(). Use struct_gro…
-
Unscored —
ALSA: wavefront: Fix integer overflow in sample size validation
In the Linux kernel, the following vulnerability has been resolved: ALSA: wavefront: Fix integer overflow in sample size validation The wavefront_send_sample() function has an integer overflow issue when validating sample size. The header->size field is u32 b…
-
Unscored —
ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi()
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() The acpi_get_first_physical_node() function can return NULL, in which case the get_device() function also returns N…
-
Unscored —
ALSA: dice: fix buffer overflow in detect_stream_formats()
In the Linux kernel, the following vulnerability has been resolved: ALSA: dice: fix buffer overflow in detect_stream_formats() The function detect_stream_formats() reads the stream_count value directly from a FireWire device without validating it. This can le…
-
Unscored —
block: fix memory leak in __blkdev_issue_zero_pages
In the Linux kernel, the following vulnerability has been resolved: block: fix memory leak in __blkdev_issue_zero_pages Move the fatal signal check before bio_alloc() to prevent a memory leak when BLKDEV_ZERO_KILLABLE is set and a fatal signal is pending. Pre…
-
Unscored —
regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex
In the Linux kernel, the following vulnerability has been resolved: regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex regulator_supply_alias_list was accessed without any locking in regulator_supply_alias(), regulator_register_sup…
-
Unscored —
gfs2: Prevent recursive memory reclaim
In the Linux kernel, the following vulnerability has been resolved: gfs2: Prevent recursive memory reclaim Function new_inode() returns a new inode with inode->i_mapping->gfp_mask set to GFP_HIGHUSER_MOVABLE. This value includes the __GFP_FS flag, so allocati…
-
Unscored —
btrfs: fix racy bitfield write in btrfs_clear_space_info_full()
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() From the memory-barriers.txt document regarding memory barrier ordering guarantees: (*) These guarantees do not apply to bitfie…
-
Unscored —
erofs: limit the level of fs stacking for file-backed mounts
In the Linux kernel, the following vulnerability has been resolved: erofs: limit the level of fs stacking for file-backed mounts Otherwise, it could cause potential kernel stack overflow (e.g., EROFS mounting itself).
-
Unscored —
wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
In the Linux kernel, the following vulnerability has been resolved: wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() The rtl8187_rx_cb() calculates the rx descriptor header address by subtracting its size from the skb tail pointer. Ho…
-
Unscored —
bpf: Check skb->transport_header is set in bpf_skb_check_mtu
In the Linux kernel, the following vulnerability has been resolved: bpf: Check skb->transport_header is set in bpf_skb_check_mtu The bpf_skb_check_mtu helper needs to use skb->transport_header when the BPF_MTU_CHK_SEGS flag is used: bpf_skb_check_mtu(skb, ifi…
-
Unscored —
ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()
In the Linux kernel, the following vulnerability has been resolved: ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() In '__ocfs2_move_extent()', relax 'BUG()' to 'ocfs2_error()' just to avoid crashing the whole kernel due to a filesystem corruptio…
-
Unscored —
nbd: defer config unlock in nbd_genl_connect
In the Linux kernel, the following vulnerability has been resolved: nbd: defer config unlock in nbd_genl_connect There is one use-after-free warning when running NBD_CMD_CONNECT and NBD_CLEAR_SOCK: nbd_genl_connect nbd_alloc_and_init_config // config_refs=1 n…
-
Unscored —
macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse
In the Linux kernel, the following vulnerability has been resolved: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse The following warning appears when running syzkaller, and this issue also exists in the mainline code. ------------[ cut here …
-
Unscored —
scsi: smartpqi: Fix device resources accessed after device removal
In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix device resources accessed after device removal Correct possible race conditions during device removal. Previously, a scheduled work item to reset a LUN could still execute…
-
Unscored —
nbd: defer config put in recv_work
In the Linux kernel, the following vulnerability has been resolved: nbd: defer config put in recv_work There is one uaf issue in recv_work when running NBD_CLEAR_SOCK and NBD_CMD_RECONFIGURE: nbd_genl_connect // conf_ref=2 (connect and recv_work A) nbd_open /…
-
Unscored —
md: avoid repeated calls to del_gendisk
In the Linux kernel, the following vulnerability has been resolved: md: avoid repeated calls to del_gendisk There is a uaf problem which is found by case 23rdev-lifetime: Oops: general protection fault, probably for non-canonical address 0xdead000000000122 RI…
-
Unscored —
md: fix rcu protection in md_wakeup_thread
In the Linux kernel, the following vulnerability has been resolved: md: fix rcu protection in md_wakeup_thread We attempted to use RCU to protect the pointer 'thread', but directly passed the value when calling md_wakeup_thread(). This means that the RCU poin…
-
Unscored —
perf/x86: Fix NULL event access and potential PEBS record loss
In the Linux kernel, the following vulnerability has been resolved: perf/x86: Fix NULL event access and potential PEBS record loss When intel_pmu_drain_pebs_icl() is called to drain PEBS records, the perf_event_overflow() could be called to process the last P…
-
Unscored —
coresight: ETR: Fix ETR buffer use-after-free issue
In the Linux kernel, the following vulnerability has been resolved: coresight: ETR: Fix ETR buffer use-after-free issue When ETR is enabled as CS_MODE_SYSFS, if the buffer size is changed and enabled again, currently sysfs_buf will point to the newly allocate…
-
Unscored —
bpf: Fix stackmap overflow check in __bpf_get_stackid()
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stackmap overflow check in __bpf_get_stackid() Syzkaller reported a KASAN slab-out-of-bounds write in __bpf_get_stackid() when copying stack trace data. The issue occurs when the per…
-
Unscored —
wifi: ath11k: fix peer HE MCS assignment
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix peer HE MCS assignment In ath11k_wmi_send_peer_assoc_cmd(), peer's transmit MCS is sent to firmware as receive MCS while peer's receive MCS sent as transmit MCS, which goes …
-
Unscored —
ntfs3: Fix uninit buffer allocated by __getname()
In the Linux kernel, the following vulnerability has been resolved: ntfs3: Fix uninit buffer allocated by __getname() Fix uninit errors caused after buffer allocation given to 'de'; by initializing the buffer with zeroes. The fix was found by using KMSAN.
-
Unscored —
ntfs3: fix uninit memory after failed mi_read in mi_format_new
In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix uninit memory after failed mi_read in mi_format_new Fix a KMSAN un-init bug found by syzkaller. ntfs_get_bh() expects a buffer from sb_getblk(), that buffer may not be uptodate. We…
-
Unscored —
wifi: ath12k: Fix MSDU buffer types handling in RX error path
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix MSDU buffer types handling in RX error path Currently, packets received on the REO exception ring from unassociated peers are of MSDU buffer type, while the driver expects l…
-
Unscored —
gpu: host1x: Fix race in syncpt alloc/free
In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix race in syncpt alloc/free Fix race condition between host1x_syncpt_alloc() and host1x_syncpt_put() by using kref_put_mutex() instead of kref_put() + manual mutex locking. Thi…
-
Unscored —
smack: fix bug: unprivileged task can create labels
In the Linux kernel, the following vulnerability has been resolved: smack: fix bug: unprivileged task can create labels If an unprivileged task is allowed to relabel itself (/smack/relabel-self is not empty), it can freely create new labels by writing their n…
-
Unscored —
wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx()
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx() If a link does not have an assigned channel yet, mt7996_vif_link returns NULL. We still need to store the updated queue settings…
-
Unscored —
PM / devfreq: hisi: Fix potential UAF in OPP handling
In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: hisi: Fix potential UAF in OPP handling Ensure all required data is acquired before calling dev_pm_opp_put(opp) to maintain correct resource acquisition and release order.
-
Unscored —
ima: Handle error code returned by ima_filter_rule_match()
In the Linux kernel, the following vulnerability has been resolved: ima: Handle error code returned by ima_filter_rule_match() In ima_match_rules(), if ima_filter_rule_match() returns -ENOENT due to the rule being NULL, the function incorrectly skips the 'if …
-
Unscored —
bpf: Fix invalid prog->stats access when update_effective_progs fails
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix invalid prog->stats access when update_effective_progs fails Syzkaller triggers an invalid memory access issue following fault injection in update_effective_progs. The issue can be d…
-
Unscored —
mshv: Fix create memory region overlap check
In the Linux kernel, the following vulnerability has been resolved: mshv: Fix create memory region overlap check The current check is incorrect; it only checks if the beginning or end of a region is within an existing region. This doesn't account for userspac…
-
Unscored —
bpf: Free special fields when update [lru_,]percpu_hash maps
In the Linux kernel, the following vulnerability has been resolved: bpf: Free special fields when update [lru_,]percpu_hash maps As [lru_,]percpu_hash maps support BPF_KPTR_{REF,PERCPU}, missing calls to 'bpf_obj_free_fields()' in 'pcpu_copy_value()' could ca…
-
Unscored —
s390/fpu: Fix false-positive kmsan report in fpu_vstl()
In the Linux kernel, the following vulnerability has been resolved: s390/fpu: Fix false-positive kmsan report in fpu_vstl() A false-positive kmsan report is detected when running ping command. An inline assembly instruction 'vstl' can write varied amount of b…
-
Unscored —
iavf: Implement settime64 with -EOPNOTSUPP
In the Linux kernel, the following vulnerability has been resolved: iavf: Implement settime64 with -EOPNOTSUPP ptp_clock_settime() assumes every ptp_clock has implemented settime64(). Stub it with -EOPNOTSUPP to prevent a NULL dereference. The fix is similar …
-
Unscored —
rtc: amlogic-a4: fix double free caused by devm
In the Linux kernel, the following vulnerability has been resolved: rtc: amlogic-a4: fix double free caused by devm The clock obtained via devm_clk_get_enabled() is automatically managed by devres and will be disabled and freed on driver detach. Manually call…
-
Unscored —
staging: most: remove broken i2c driver
In the Linux kernel, the following vulnerability has been resolved: staging: most: remove broken i2c driver The MOST I2C driver has been completely broken for five years without anyone noticing so remove the driver from staging. Specifically, commit 723de0f91…
-
Unscored —
block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock
In the Linux kernel, the following vulnerability has been resolved: block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock blk_mq_{add,del}_queue_tag_set() functions add and remove queues from tagset, the functions make sure that tagset a…
-
Unscored —
drm/vgem-fence: Fix potential deadlock on release
In the Linux kernel, the following vulnerability has been resolved: drm/vgem-fence: Fix potential deadlock on release A timer that expires a vgem fence automatically in 10 seconds is now released with timer_delete_sync() from fence->ops.release() called on la…
-
Unscored —
backlight: led-bl: Add devlink to supplier LEDs
In the Linux kernel, the following vulnerability has been resolved: backlight: led-bl: Add devlink to supplier LEDs LED Backlight is a consumer of one or multiple LED class devices, but devlink is currently unable to create correct supplier-producer links whe…
-
Unscored —
wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
In the Linux kernel, the following vulnerability has been resolved: wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() In rtl8180_init_rx_ring(), memory is allocated for skb packets and DMA allocations in a loop. When an allocation fails, the…
-
Unscored —
iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show In iommu_mmio_write(), it validates the user-provided offset with the check: `iommu->dbg_mmio_offset > iommu->mmio_phys_end - 4`…
-
Unscored —
net: netpoll: initialize work queue before error checks
In the Linux kernel, the following vulnerability has been resolved: net: netpoll: initialize work queue before error checks Prevent a kernel warning when netconsole setup fails on devices with IFF_DISABLE_NETPOLL flag. The warning (at kernel/workqueue.c:4242 …
-
Unscored —
crypto: starfive - Correctly handle return of sg_nents_for_len
In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Correctly handle return of sg_nents_for_len The return value of sg_nents_for_len was assigned to an unsigned long in starfive_hash_digest, causing negative error codes to b…
-
Unscored —
mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()
In the Linux kernel, the following vulnerability has been resolved: mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() In mt7615_mcu_wtbl_sta_add(), an skb sskb is allocated. If the subsequent call to mt76_connac_mcu_alloc_wtbl_req() fails, the functi…
-
Unscored —
irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()
In the Linux kernel, the following vulnerability has been resolved: irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() If irq_domain_translate_twocell() sets "hwirq" to >= MCHP_EIC_NIRQ (2) then it results in an out of bounds access. The code checks …
References
-
report
https://ubuntu.com/security/CVE-2025-40246
-
report
https://ubuntu.com/security/CVE-2025-40247
-
report
https://ubuntu.com/security/CVE-2025-40248
-
report
https://ubuntu.com/security/CVE-2025-40249
-
report
https://ubuntu.com/security/CVE-2025-40250
-
report
https://ubuntu.com/security/CVE-2025-40251
-
report
https://ubuntu.com/security/CVE-2025-40252
-
report
https://ubuntu.com/security/CVE-2025-40253
-
report
https://ubuntu.com/security/CVE-2025-40254
-
report
https://ubuntu.com/security/CVE-2025-40255
-
report
https://ubuntu.com/security/CVE-2025-40257
-
report
https://ubuntu.com/security/CVE-2025-40258
-
report
https://ubuntu.com/security/CVE-2025-40259
-
report
https://ubuntu.com/security/CVE-2025-40260
-
report
https://ubuntu.com/security/CVE-2025-40261
-
report
https://ubuntu.com/security/CVE-2025-40262
-
report
https://ubuntu.com/security/CVE-2025-40263
-
report
https://ubuntu.com/security/CVE-2025-40264
-
report
https://ubuntu.com/security/CVE-2025-40265
-
report
https://ubuntu.com/security/CVE-2025-40266
-
report
https://ubuntu.com/security/CVE-2025-40290
-
report
https://ubuntu.com/security/CVE-2025-40345
-
report
https://ubuntu.com/security/CVE-2025-62626
-
report
https://ubuntu.com/security/CVE-2025-68212
-
report
https://ubuntu.com/security/CVE-2025-68213
-
report
https://ubuntu.com/security/CVE-2025-68214
-
report
https://ubuntu.com/security/CVE-2025-68215
-
report
https://ubuntu.com/security/CVE-2025-68217
-
report
https://ubuntu.com/security/CVE-2025-68218
-
report
https://ubuntu.com/security/CVE-2025-68219
-
report
https://ubuntu.com/security/CVE-2025-68220
-
report
https://ubuntu.com/security/CVE-2025-68221
-
report
https://ubuntu.com/security/CVE-2025-68222
-
report
https://ubuntu.com/security/CVE-2025-68223
-
report
https://ubuntu.com/security/CVE-2025-68225
-
report
https://ubuntu.com/security/CVE-2025-68227
-
report
https://ubuntu.com/security/CVE-2025-68228
-
report
https://ubuntu.com/security/CVE-2025-68229
-
report
https://ubuntu.com/security/CVE-2025-68230