Skip to content
OpenAdvisories
High WID-SEC-2025-0545 26 CVEs

Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service

Published Mar 11, 2025 · Updated Sep 21, 2026 · Revision 106 · de-DE

Vendor: amazon Vendor: Debian Vendor: Google Vendor: IBM Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: Siemens Vendor: SolarWinds Vendor: SUSE Vendor: Ubuntu Product: Container-Optimized OS Product: DataPower Gateway Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: QRadar SIEM Product: Rocky Linux Product: Security Event Manager Product: SIMATIC S7 Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Zustand herbeizuführen und um nicht näher beschriebene Auswirkungen zu verursachen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 26

  • Critical 9.8
    CVE-2024-58087

    ksmbd: fix racy issue from session lookup and expire

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix racy issue from session lookup and expire Increment the session reference count within the lock for lookup to avoid racy issue with session expire.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2025-21850

    nvmet: Fix crash when a namespace is disabled

    In the Linux kernel, the following vulnerability has been resolved: nvmet: Fix crash when a namespace is disabled The namespace percpu counter protects pending I/O, and we can only safely diable the namespace once the counter drop to zero. Otherwise we end up…

    Linux Linux linux-raspi2 linux-hwe Linux Ubuntu
  • High 8.6
    CVE-2025-21855

    ibmvnic: Don't reference skb after sending to VIOS

    In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Don't reference skb after sending to VIOS Previously, after successfully flushing the xmit buffer to VIOS, the tx_bytes stat was incremented by the length of the skb. It is invalid t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-58089

    btrfs: fix double accounting race when btrfs_run_delalloc_range() failed

    In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double accounting race when btrfs_run_delalloc_range() failed [BUG] When running btrfs with block size (4K) smaller than page size (64K, aarch64), there is a very high chance to cr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-21851

    bpf: Fix softlockup in arena_map_free on 64k page kernel

    In the Linux kernel, the following vulnerability has been resolved: bpf: Fix softlockup in arena_map_free on 64k page kernel On an aarch64 kernel with CONFIG_PAGE_SIZE_64KB=y, arena_htab tests cause a segmentation fault and soft lockup. The same failure is no…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-21856

    s390/ism: add release function for struct device

    In the Linux kernel, the following vulnerability has been resolved: s390/ism: add release function for struct device According to device_release() in /drivers/base/core.c, a device without a release function is a broken device and must be fixed. The current c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-21858

    geneve: Fix use-after-free in geneve_find_dev().

    In the Linux kernel, the following vulnerability has been resolved: geneve: Fix use-after-free in geneve_find_dev(). syzkaller reported a use-after-free in geneve_find_dev() [0] without repro. geneve_configure() links struct geneve_dev.next to net_generic(net…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-21863

    io_uring: prevent opcode speculation

    In the Linux kernel, the following vulnerability has been resolved: io_uring: prevent opcode speculation sqe->opcode is used for different tables, make sure we santitise it against speculations.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-21864

    tcp: drop secpath at the same time as we currently drop dst

    In the Linux kernel, the following vulnerability has been resolved: tcp: drop secpath at the same time as we currently drop dst Xiumei reported hitting the WARN in xfrm6_tunnel_net_exit while running tests that boil down to: - create a pair of netns - run a b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2025-21844

    smb: client: Add check for next_buffer in receive_encrypted_standard()

    In the Linux kernel, the following vulnerability has been resolved: smb: client: Add check for next_buffer in receive_encrypted_standard() Add check for the return value of cifs_buf_get() and cifs_small_buf_get() in receive_encrypted_standard() to prevent nul…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2024-58088

    bpf: Fix deadlock when freeing cgroup storage

    In the Linux kernel, the following vulnerability has been resolved: bpf: Fix deadlock when freeing cgroup storage The following commit bc235cdb423a ("bpf: Prevent deadlock from recursive bpf_task_storage_[get|delete]") first introduced deadlock prevention for…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2025-21845

    mtd: spi-nor: sst: Fix SST write failure

    In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: sst: Fix SST write failure 'commit 18bcb4aa54ea ("mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()`")' introduced a bug where only one byte of data …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2025-21846

    acct: perform last write from workqueue

    In the Linux kernel, the following vulnerability has been resolved: acct: perform last write from workqueue In [1] it was reported that the acct(2) system call can be used to trigger NULL deref in cases where it is set to write to a file that triggers an inte…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2025-21847

    ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data()

    In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() The nullity of sps->cstream should be checked similarly as it is done in sof_set_stream_data_offset() function. Assuming…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2025-21848

    nfp: bpf: Add check for nfp_app_ctrl_msg_alloc()

    In the Linux kernel, the following vulnerability has been resolved: nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() Add check for the return value of nfp_app_ctrl_msg_alloc() in nfp_bpf_cmsg_alloc() to prevent null pointer dereference.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2025-21849

    drm/i915/gt: Use spin_lock_irqsave() in interruptible context

    In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Use spin_lock_irqsave() in interruptible context spin_lock/unlock() functions used in interrupt contexts could result in a deadlock, as seen in GitLab issue #13399, which occurs …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2025-21852

    net: Add rx_skb of kfree_skb to raw_tp_null_args[].

    In the Linux kernel, the following vulnerability has been resolved: net: Add rx_skb of kfree_skb to raw_tp_null_args[]. Yan Zhai reported a BPF prog could trigger a null-ptr-deref [0] in trace_kfree_skb if the prog does not check if rx_sk is NULL. Commit c537…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2025-21854

    sockmap, vsock: For connectible sockets allow only connected

    In the Linux kernel, the following vulnerability has been resolved: sockmap, vsock: For connectible sockets allow only connected sockmap expects all vsocks to have a transport assigned, which is expressed in vsock_proto::psock_update_sk_prot(). However, there…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2025-21857

    net/sched: cls_api: fix error handling causing NULL dereference

    In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: fix error handling causing NULL dereference tcf_exts_miss_cookie_base_alloc() calls xa_alloc_cyclic() which can return 1 if the allocation succeeded after wrapping. This w…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2025-21859

    USB: gadget: f_midi: f_midi_complete to call queue_work

    In the Linux kernel, the following vulnerability has been resolved: USB: gadget: f_midi: f_midi_complete to call queue_work When using USB MIDI, a lock is attempted to be acquired twice through a re-entrant call to f_midi_transmit, causing a deadlock. Fix it …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2025-21861

    mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()

    In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() If migration succeeded, we called folio_migrate_flags()->mem_cgroup_migrate() to migrate the memcg from the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2025-21862

    drop_monitor: fix incorrect initialization order

    In the Linux kernel, the following vulnerability has been resolved: drop_monitor: fix incorrect initialization order Syzkaller reports the following bug: BUG: spinlock bad magic on CPU#1, syz-executor.0/7995 lock: 0xffff88805303f3e0, .magic: 00000000, .owner:…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2025-21865

    gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().

    In the Linux kernel, the following vulnerability has been resolved: gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl(). Brad Spengler reported the list_del() corruption splat in gtp_net_exit_batch_rtnl(). [0] Commit eb28fd76c0a0 ("gtp: Destroy d…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2025-21866

    powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC

    In the Linux kernel, the following vulnerability has been resolved: powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC Erhard reported the following KASAN hit while booting his PowerMac G4 with a KASAN-enabled kernel 6.13-rc6:…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-21853

    bpf: avoid holding freeze_mutex during mmap operation

    In the Linux kernel, the following vulnerability has been resolved: bpf: avoid holding freeze_mutex during mmap operation We use map->freeze_mutex to prevent races between map_freeze() and memory mapping BPF map contents with writable permissions. The way we …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-21860

    mm/zswap: fix inconsistency when zswap_store_page() fails

    In the Linux kernel, the following vulnerability has been resolved: mm/zswap: fix inconsistency when zswap_store_page() fails Commit b7c0ccdfbafd ("mm: zswap: support large folios in zswap_store()") skips charging any zswap entries when it failed to zswap the…

    Linux Linux linux-raspi2 linux-hwe Linux Ubuntu

Revision history

  1. #106

    Neue Updates von Ubuntu aufgenommen

  2. #105

    Neue Updates von Ubuntu aufgenommen

  3. #104

    Neue Updates von SUSE aufgenommen

  4. #103

    Neue Updates von SUSE aufgenommen

  5. #102

    Neue Updates von SUSE aufgenommen

  6. #101

    Neue Updates von Ubuntu aufgenommen

  7. #100

    Neue Updates von IBM aufgenommen

  8. #99

    Neue Updates von Ubuntu aufgenommen

  9. #98

    Neue Updates von Ubuntu aufgenommen

  10. #97

    Neue Updates von Ubuntu aufgenommen

  11. #96

    Neue Updates von Ubuntu aufgenommen

  12. #95

    Neue Updates von Ubuntu aufgenommen

  13. #94

    Neue Updates von Ubuntu aufgenommen

  14. #93

    Neue Updates von IBM aufgenommen

  15. #92

    Neue Updates von Ubuntu aufgenommen

  16. #91

    Neue Updates von Siemens aufgenommen

  17. #90

    Neue Updates von Debian aufgenommen

  18. #89

    Neue Updates von Red Hat aufgenommen

  19. #88

    Neue Updates von Red Hat aufgenommen

  20. #87

    Neue Updates von Red Hat aufgenommen

  21. #86

    Neue Updates von Oracle Linux aufgenommen

  22. #85

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  23. #84

    Neue Updates von Red Hat aufgenommen

  24. #83

    Neue Updates von Oracle Linux aufgenommen

  25. #82

    Neue Updates von Oracle Linux aufgenommen

References