Skip to content
OpenAdvisories

Summary

Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um nicht spezifizierte Auswirkungen zu erzeugen oder einen Denial-of-Service-Zustand zu verursachen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 56

  • Critical 9.8

    RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]"

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]" The Call Trace is as below: " <TASK> ? show_regs.cold+0x1a/0x1f ? __rxe_cleanup+0x12c/0x170 [rdma_rxe] ? __warn+0x84/0xd0 ? __…

  • High 8.8

    wifi: mac80211: don't flush non-uploaded STAs

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't flush non-uploaded STAs If STA state is pre-moved to AUTHORIZED (such as in IBSS scenarios) and insertion fails, the station is freed. In this case, the driver never kne…

  • High 7.8

    usb: gadget: f_tcm: Don't free command immediately

    In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_tcm: Don't free command immediately Don't prematurely free the command. Wait for the status completion of the sense status. It can be freed then. Otherwise we will double-free …

  • High 7.8

    bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing

    In the Linux kernel, the following vulnerability has been resolved: bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing There is a UAF report in the bpf_struct_ops when CONFIG_MODULES=n. In particular, the report is on tc…

  • High 7.8

    rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read

    In the Linux kernel, the following vulnerability has been resolved: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read The nvmem interface supports variable buffer sizes, while the regmap interface operates with fixed-size storage. If an nvmem clie…

  • High 7.8

    bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT

    In the Linux kernel, the following vulnerability has been resolved: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT In PREEMPT_RT, kmalloc(GFP_ATOMIC) is still not safe in non preemptible context. bpf_mem_alloc must be used in PREEMPT_RT. This …

  • High 7.8

    crypto: tegra - do not transfer req when tegra init fails

    In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - do not transfer req when tegra init fails The tegra_cmac_init or tegra_sha_init function may return an error when memory is exhausted. It should not transfer the request when …

  • High 7.8

    media: uvcvideo: Fix crash during unbind if gpio unit is in use

    In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix crash during unbind if gpio unit is in use We used the wrong device for the device managed functions. We used the usb device, when we should be using the interface device…

  • High 7.8

    KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()

    In the Linux kernel, the following vulnerability has been resolved: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() Explicitly verify the target vCPU is fully online _prior_ to clamping the index in kvm_get_vcpu(). If the index is "bad", the no…

  • High 7.8

    drm/v3d: Stop active perfmon if it is being destroyed

    In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Stop active perfmon if it is being destroyed If the active performance monitor (`v3d->active_perfmon`) is being destroyed, stop it first. Currently, the active perfmon is not stopped…

  • High 7.8

    bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT

    In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT During the update procedure, when overwrite element in a pre-allocated htab, the freeing of old_element is protected by the bu…

  • High 7.8

    netfilter: nf_tables: reject mismatching sum of field_len with set key length

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject mismatching sum of field_len with set key length The field length description provides the length of each separated key field in the concatenation, each field get…

  • High 7.8

    Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface() The documentation for usb_driver_claim_interface() says that "the device lock" is needed when the function is called fro…

  • High 7.8

    block: don't revert iter for -EIOCBQUEUED

    In the Linux kernel, the following vulnerability has been resolved: block: don't revert iter for -EIOCBQUEUED blkdev_read_iter() has a few odd checks, like gating the position and count adjustment on whether or not the result is bigger-than-or-equal to zero (…

  • High 7.8

    io_uring/kbuf: reallocate buf lists on upgrade

    In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: reallocate buf lists on upgrade IORING_REGISTER_PBUF_RING can reuse an old struct io_buffer_list if it was created for legacy selected buffer and has been emptied. It violates …

  • High 7.8

    amdkfd: properly free gang_ctx_bo when failed to init user queue

    In the Linux kernel, the following vulnerability has been resolved: amdkfd: properly free gang_ctx_bo when failed to init user queue The destructor of a gtt bo is declared as void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void **mem_obj); Which t…

  • High 7.5

    rxrpc: Fix handling of received connection abort

    In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix handling of received connection abort Fix the handling of a connection abort that we've received. Though the abort is at the connection level, it needs propagating to the calls on …

  • High 7.3

    landlock: Handle weird files

    In the Linux kernel, the following vulnerability has been resolved: landlock: Handle weird files A corrupted filesystem (e.g. bcachefs) might return weird files. Instead of throwing a warning and allowing access to such file, treat them as regular files.

  • High 7.3

    KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop

    In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop Move the conditional loading of hardware DR6 with the guest's DR6 value out of the core .vcpu_run() loop to fix a bug…

  • High 7.1

    powerpc/xive/spapr: correct bitmap allocation size

    In the Linux kernel, the following vulnerability has been resolved: powerpc/xive/spapr: correct bitmap allocation size kasan detects access beyond the end of the xibm->bitmap allocation: BUG: KASAN: slab-out-of-bounds in _find_first_zero_bit+0x40/0x140 Read o…

  • Medium 5.5

    drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table The function atomctrl_get_smc_sclk_range_table() does not check the return value of smu_atom_get_data_t…

  • Medium 5.5

    ubifs: skip dumping tnc tree when zroot is null

    In the Linux kernel, the following vulnerability has been resolved: ubifs: skip dumping tnc tree when zroot is null Clearing slab cache will free all znode in memory and make c->zroot.znode = NULL, then dumping tnc tree will access c->zroot.znode which cause …

  • Medium 5.5

    media: uvcvideo: Fix deadlock during uvc_probe

    In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix deadlock during uvc_probe If uvc_probe() fails, it can end up calling uvc_status_unregister() before uvc_status_init() is called. Fix this by checking if dev->status is N…

  • Medium 5.5

    wifi: iwlwifi: mvm: avoid NULL pointer dereference

    In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: avoid NULL pointer dereference When iterating over the links of a vif, we need to make sure that the pointer is valid (in other words - that the link exists) before derefe…

  • Medium 5.5

    wifi: rtlwifi: fix memory leaks and invalid access at probe error path

    In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: fix memory leaks and invalid access at probe error path Deinitialize at reverse order when probe fails. When init_sw_vars fails, rtl_deinit_core should not be called, specially…

  • Medium 5.5

    wifi: cfg80211: tests: Fix potential NULL dereference in test_cfg80211_parse_colocated_ap()

    In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: tests: Fix potential NULL dereference in test_cfg80211_parse_colocated_ap() kunit_kzalloc() may return NULL, dereferencing it without NULL check may lead to NULL dereference. …

  • Medium 5.5

    clk: mmp: pxa1908-apbc: Fix NULL vs IS_ERR() check

    In the Linux kernel, the following vulnerability has been resolved: clk: mmp: pxa1908-apbc: Fix NULL vs IS_ERR() check The devm_kzalloc() function returns NULL on error, not error pointers. Fix the check.

  • Medium 5.5

    clk: mmp: pxa1908-apbcp: Fix a NULL vs IS_ERR() check

    In the Linux kernel, the following vulnerability has been resolved: clk: mmp: pxa1908-apbcp: Fix a NULL vs IS_ERR() check The devm_kzalloc() function doesn't return error pointers, it returns NULL on error. Update the check to match.

  • Medium 5.5

    clk: mmp: pxa1908-mpmu: Fix a NULL vs IS_ERR() check

    In the Linux kernel, the following vulnerability has been resolved: clk: mmp: pxa1908-mpmu: Fix a NULL vs IS_ERR() check The devm_kzalloc() function returns NULL on error, not error pointers. Update the check to match.

  • Medium 5.5

    OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized

    In the Linux kernel, the following vulnerability has been resolved: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized If a driver calls dev_pm_opp_find_bw_ceil/floor() the retrieve bandwidth from the OPP table but the bandwidth table was no…

  • Medium 5.5

    team: prevent adding a device which is already a team device lower

    In the Linux kernel, the following vulnerability has been resolved: team: prevent adding a device which is already a team device lower Prevent adding a device which is already a team device lower, e.g. adding veth0 if vlan1 was already added and veth0 is a lo…

  • Medium 5.5

    drm/msm/dpu: check dpu_plane_atomic_print_state() for valid sspp

    In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: check dpu_plane_atomic_print_state() for valid sspp Similar to the r_pipe sspp protect, add a check to protect the pipe state prints to avoid NULL ptr dereference for cases when …

  • Medium 5.5

    clk: qcom: gcc-sm6350: Add missing parent_map for two clocks

    In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-sm6350: Add missing parent_map for two clocks If a clk_rcg2 has a parent, it should also have parent_map defined, otherwise we'll get a NULL pointer dereference when calling cl…

  • Medium 5.5

    clk: qcom: dispcc-sm6350: Add missing parent_map for a clock

    In the Linux kernel, the following vulnerability has been resolved: clk: qcom: dispcc-sm6350: Add missing parent_map for a clock If a clk_rcg2 has a parent, it should also have parent_map defined, otherwise we'll get a NULL pointer dereference when calling cl…

  • Medium 5.5

    clk: mmp2: call pm_genpd_init() only after genpd.name is set

    In the Linux kernel, the following vulnerability has been resolved: clk: mmp2: call pm_genpd_init() only after genpd.name is set Setting the genpd's struct device's name with dev_set_name() is happening within pm_genpd_init(). If it remains NULL, things can b…

  • Medium 5.5

    firmware: qcom: scm: Fix missing read barrier in qcom_scm_get_tzmem_pool()

    In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: Fix missing read barrier in qcom_scm_get_tzmem_pool() Commit 2e4955167ec5 ("firmware: qcom: scm: Fix __scm and waitq completion variable initialization") introduced a wri…

  • Medium 5.5

    iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE

    In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE There is a WARN_ON_ONCE to catch an unlikely situation when domain_remove_dev_pasid can't find the `pasid`. In case it nevertheless happens we…

  • Medium 5.5

    drm/panthor: avoid garbage value in panthor_ioctl_dev_query()

    In the Linux kernel, the following vulnerability has been resolved: drm/panthor: avoid garbage value in panthor_ioctl_dev_query() 'priorities_info' is uninitialized, and the uninitialized value is copied to user object when calling PANTHOR_UOBJ_SET(). Using m…

  • Unscored —

    ipmi: ipmb: Add check devm_kasprintf() returned value

    In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: Add check devm_kasprintf() returned value devm_kasprintf() can return a NULL pointer on failure but this returned value is not checked.

  • Unscored —

    staging: media: max96712: fix kernel oops when removing module

    In the Linux kernel, the following vulnerability has been resolved: staging: media: max96712: fix kernel oops when removing module The following kernel oops is thrown when trying to remove the max96712 module: Unable to handle kernel paging request at virtual…

  • Unscored —

    remoteproc: core: Fix ida_free call while not allocated

    In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Fix ida_free call while not allocated In the rproc_alloc() function, on error, put_device(&rproc->dev) is called, leading to the call of the rproc_type_release() function. A…

  • Unscored —

    idpf: convert workqueues to unbound

    In the Linux kernel, the following vulnerability has been resolved: idpf: convert workqueues to unbound When a workqueue is created with `WQ_UNBOUND`, its work items are served by special worker-pools, whose host workers are not bound to any specific CPU. In …

  • Unscored —

    wifi: mac80211: prohibit deactivating all links

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: prohibit deactivating all links In the internal API this calls this is a WARN_ON, but that should remain since internally we want to know about bugs that may cause this. Preve…

  • Unscored —

    wifi: rtlwifi: remove unused check_buddy_priv

    In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: remove unused check_buddy_priv Commit 2461c7d60f9f ("rtlwifi: Update header file") introduced a global list of private data structures. Later on, commit 26634c4b1868 ("rtlwifi …

  • Unscored —

    drm/i915: Grab intel_display from the encoder to avoid potential oopsies

    In the Linux kernel, the following vulnerability has been resolved: drm/i915: Grab intel_display from the encoder to avoid potential oopsies Grab the intel_display from 'encoder' rather than 'state' in the encoder hooks to avoid the massive footgun that is in…

  • Unscored —

    ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback

    In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback commit 1f5664351410 ("ASoC: lower "no backend DAIs enabled for ... Port" log severity") ignores -EINVAL error message on common soc…

  • Unscored —

    misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors

    In the Linux kernel, the following vulnerability has been resolved: misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors misc_minor_alloc was allocating id using ida for minor only in case of MISC_DYNAMIC_MINOR but misc_minor_free was always …

  • Unscored —

    media: nuvoton: Fix an error check in npcm_video_ece_init()

    In the Linux kernel, the following vulnerability has been resolved: media: nuvoton: Fix an error check in npcm_video_ece_init() When function of_find_device_by_node() fails, it returns NULL instead of an error code. So the corresponding error check logic shou…

  • Unscored —

    tomoyo: don't emit warning in tomoyo_write_control()

    In the Linux kernel, the following vulnerability has been resolved: tomoyo: don't emit warning in tomoyo_write_control() syzbot is reporting too large allocation warning at tomoyo_write_control(), for one can write a very very long line without new line chara…

  • Unscored —

    PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1

    In the Linux kernel, the following vulnerability has been resolved: PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 commit 9d26d3a8f1b0 ("PCI: Put PCIe ports into D3 during suspend") sets the policy that all PCIe ports are allowed to use D3. …

  • Unscored —

    seccomp: passthrough uretprobe systemcall without filtering

    In the Linux kernel, the following vulnerability has been resolved: seccomp: passthrough uretprobe systemcall without filtering When attaching uretprobes to processes running inside docker, the attached process is segfaulted when encountering the retprobe. Th…

  • Unscored —

    usb: gadget: f_midi: fix MIDI Streaming descriptor lengths

    In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi: fix MIDI Streaming descriptor lengths While the MIDI jacks are configured correctly, and the MIDIStreaming endpoint descriptors are filled with the correct information, b…

  • Unscored —
    CVE-2025-21837 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    usb: gadget: core: flush gadget workqueue after device removal

    In the Linux kernel, the following vulnerability has been resolved: usb: gadget: core: flush gadget workqueue after device removal device_del() can lead to new work being scheduled in gadget->work workqueue. This is observed, for example, with the dwc3 driver…

  • Unscored —

    thermal/netlink: Prevent userspace segmentation fault by adjusting UAPI header

    In the Linux kernel, the following vulnerability has been resolved: thermal/netlink: Prevent userspace segmentation fault by adjusting UAPI header The intel-lpmd tool [1], which uses the THERMAL_GENL_ATTR_CPU_CAPABILITY attribute to receive HFI events from ke…

  • Unscored —

    cpufreq/amd-pstate: Fix cpufreq_policy ref counting

    In the Linux kernel, the following vulnerability has been resolved: cpufreq/amd-pstate: Fix cpufreq_policy ref counting amd_pstate_update_limits() takes a cpufreq_policy reference but doesn't decrement the refcount in one of the exit paths, fix that.

Revision history

  1. #93

    Neue Updates von Debian aufgenommen

  2. #92

    Neue Updates von Debian aufgenommen

  3. #91

    Neue Updates von Red Hat aufgenommen

  4. #90

    Neue Updates von Oracle Linux aufgenommen

  5. #89

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  6. #88

    Neue Updates von Red Hat aufgenommen

  7. #87

    Neue Updates von IBM aufgenommen

  8. #86

    Neue Updates von Oracle Linux aufgenommen

  9. #85

    Neue Updates von Siemens aufgenommen

  10. #84

    Neue Updates von Oracle Linux aufgenommen

  11. #83

    Neue Updates von Oracle Linux aufgenommen

  12. #82

    Neue Updates von Red Hat aufgenommen

  13. #81

    Neue Updates von Oracle Linux aufgenommen

  14. #80

    Neue Updates von Ubuntu aufgenommen

  15. #79

    Neue Updates von Ubuntu aufgenommen

  16. #78

    Neue Updates von Ubuntu aufgenommen

  17. #77

    Neue Updates von Ubuntu aufgenommen

  18. #76

    Neue Updates von Ubuntu aufgenommen

  19. #75

    Neue Updates von Ubuntu aufgenommen

  20. #74

    Neue Updates von SUSE aufgenommen

  21. #73

    Neue Updates von SUSE aufgenommen

  22. #72

    Neue Updates von Ubuntu aufgenommen

  23. #71

    Neue Updates von Ubuntu aufgenommen

  24. #70

    Neue Updates von Ubuntu aufgenommen

  25. #69

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

References