Summary
Ein Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen Denial-of-Service auszulösen und um nicht näher spezifizierte Auswirkungen zu erzielen.
Product
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Vulnerabilities 93
-
Critical 9.8
nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() nvme_tcp_recv_pdu() doesn't check the validity of the header length. When header digests are enabled, a target might send a pa…
-
Critical 9.8
netmem: prevent TX of unreadable skbs
In the Linux kernel, the following vulnerability has been resolved: netmem: prevent TX of unreadable skbs Currently on stable trees we have support for netmem/devmem RX but not TX. It is not safe to forward/redirect an RX unreadable netmem packet into the dev…
-
High 8.8
ksmbd: fix use-after-free in smb2_lock
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb2_lock If smb_lock->zero_len has value, ->llist of smb_lock is not delete and flock is old one. It will cause use-after-free on error handling routine.
-
High 8.8
ksmbd: fix out-of-bounds in parse_sec_desc()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds in parse_sec_desc() If osidoffset, gsidoffset and dacloffset could be greater than smb_ntsd struct size. If it is smaller, It could cause slab-out-of-bounds. And when…
-
High 8.8
ksmbd: prevent connection release during oplock break notification
In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent connection release during oplock break notification ksmbd_work could be freed when after connection release. Increment r_count of ksmbd_conn to indicate that requests are not f…
-
High 8.8
ksmbd: fix use-after-free in ksmbd_free_work_struct
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_free_work_struct ->interim_entry of ksmbd_work could be deleted after oplock is freed. We don't need to manage it with linked list. The interim request coul…
-
High 8.8
Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd After the hci sync command releases l2cap_conn, the hci receive data work queue references the released l2cap_conn when sendin…
-
High 8.8
net: mctp: unshare packets when reassembling
In the Linux kernel, the following vulnerability has been resolved: net: mctp: unshare packets when reassembling Ensure that the frag_list used for reassembly isn't shared with other packets. This avoids incorrect reassembly when packets are cloned, and preve…
-
High 8.1
ksmbd: fix type confusion via race condition when using ipc_msg_send_request
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix type confusion via race condition when using ipc_msg_send_request req->handle is allocated using ksmbd_acquire_id(&ipc_ida), based on ida_alloc. req->handle from ksmbd_ipc_login_re…
-
High 7.8
fuse: revert back to __readahead_folio() for readahead
In the Linux kernel, the following vulnerability has been resolved: fuse: revert back to __readahead_folio() for readahead In commit 3eab9d7bc2f4 ("fuse: convert readahead to use folios"), the logic was converted to using the new folio readahead code, which d…
-
High 7.8
tracing: Fix bad hist from corrupting named_triggers list
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix bad hist from corrupting named_triggers list The following commands causes a crash: ~# cd /sys/kernel/tracing/events/rcu/rcu_callback ~# echo 'hist:name=bad:keys=common_pid:onmax…
-
High 7.8
RDMA/bnxt_re: Add sanity checks on rdev validity
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Add sanity checks on rdev validity There is a possibility that ulp_irq_stop and ulp_irq_start callbacks will be called when the device is in detached state. This can cause a cra…
-
High 7.8
slimbus: messaging: Free transaction ID in delayed interrupt scenario
In the Linux kernel, the following vulnerability has been resolved: slimbus: messaging: Free transaction ID in delayed interrupt scenario In case of interrupt delay for any reason, slim_do_transfer() returns timeout error but the transaction ID (TID) is not f…
-
High 7.8
sched/fair: Fix potential memory corruption in child_cfs_rq_on_list
In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list child_cfs_rq_on_list attempts to convert a 'prev' pointer to a cfs_rq. This 'prev' pointer can originate from struct rq's l…
-
High 7.8
HID: hid-steam: Fix use-after-free when detaching device
In the Linux kernel, the following vulnerability has been resolved: HID: hid-steam: Fix use-after-free when detaching device When a hid-steam device is removed it must clean up the client_hdev used for intercepting hidraw access. This can lead to scheduling d…
-
High 7.8
net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error
In the Linux kernel, the following vulnerability has been resolved: net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error During the initialization of ptp, hclge_ptp_get_cycle might return an error and returned directl…
-
High 7.8
net: gso: fix ownership in __udp_gso_segment
In the Linux kernel, the following vulnerability has been resolved: net: gso: fix ownership in __udp_gso_segment In __udp_gso_segment the skb destructor is removed before segmenting the skb but the socket reference is kept as-is. This is an issue if the origi…
-
High 7.8
HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handli…
-
High 7.8
HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove()
In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() During the `rmmod` operation for the `intel_ishtp_hid` driver, a use-after-free issue can occur in the hid_ishtp_cl_remov…
-
High 7.8
rapidio: fix an API misues when rio_add_net() fails
In the Linux kernel, the following vulnerability has been resolved: rapidio: fix an API misues when rio_add_net() fails rio_add_net() calls device_register() and fails when device_register() fails. Thus, put_device() should be used rather than kfree(). Add "m…
-
High 7.8
drm/xe/hmm: Don't dereference struct page pointers without notifier lock
In the Linux kernel, the following vulnerability has been resolved: drm/xe/hmm: Don't dereference struct page pointers without notifier lock The pnfs that we obtain from hmm_range_fault() point to pages that we don't have a reference on, and the guarantee tha…
-
High 7.8
LoongArch: Set hugetlb mmap base address aligned with pmd size
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Set hugetlb mmap base address aligned with pmd size With ltp test case "testcases/bin/hugefork02", there is a dmesg error report message such as: kernel BUG at mm/hugetlb.c:5550! O…
-
High 7.8
Revert "openvswitch: switch to per-action label counting in conntrack"
In the Linux kernel, the following vulnerability has been resolved: Revert "openvswitch: switch to per-action label counting in conntrack" Currently, ovs_ct_set_labels() is only called for confirmed conntrack entries (ct) within ovs_ct_commit(). However, if t…
-
High 7.8
sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl()
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl() If a BPF scheduler provides an invalid CPU (outside the nr_cpu_ids range) as prev_cpu to scx_bpf_select_cpu_dfl() it can cause a kerne…
-
High 7.8
dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature
In the Linux kernel, the following vulnerability has been resolved: dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature Fix memory corruption due to incorrect parameter being passed to bio_init
-
High 7.8
drm/amd/display: Fix slab-use-after-free on hdcp_work
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix slab-use-after-free on hdcp_work [Why] A slab-use-after-free is reported when HDCP is destroyed but the property_validate_dwork queue is still running. [How] Cancel the d…
-
High 7.8
net/mlx5: Bridge, fix the crash caused by LAG state check
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Bridge, fix the crash caused by LAG state check When removing LAG device from bridge, NETDEV_CHANGEUPPER event is triggered. Driver finds the lower devices (PFs) to flush all the of…
-
High 7.8
net_sched: Prevent creation of classes with TC_H_ROOT
In the Linux kernel, the following vulnerability has been resolved: net_sched: Prevent creation of classes with TC_H_ROOT The function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination condition when traversing up the qdisc tree to update parent bac…
-
High 7.8
fbdev: hyperv_fb: Allow graceful removal of framebuffer
In the Linux kernel, the following vulnerability has been resolved: fbdev: hyperv_fb: Allow graceful removal of framebuffer When a Hyper-V framebuffer device is unbind, hyperv_fb driver tries to release the framebuffer forcefully. If this framebuffer is in us…
-
High 7.8
wifi: cfg80211: cancel wiphy_work before freeing wiphy
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel wiphy_work before freeing wiphy A wiphy_work can be queued from the moment the wiphy is allocated and initialized (i.e. wiphy_new_nm). When a wiphy_work is queued, the …
-
High 7.8
mm: fix kernel BUG when userfaultfd_move encounters swapcache
In the Linux kernel, the following vulnerability has been resolved: mm: fix kernel BUG when userfaultfd_move encounters swapcache userfaultfd_move() checks whether the PTE entry is present or a swap entry. - If the PTE entry is present, move_present_pte() han…
-
High 7.8
drm/amd/display: Fix out-of-bound accesses
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bound accesses [WHAT & HOW] hpo_stream_to_link_encoder_mapping has size MAX_HPO_DP2_ENCODERS(=4), but location can have size up to 6. As a result, it is necessary …
-
High 7.6
wifi: iwlwifi: mvm: clean up ROC on failure
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: clean up ROC on failure If the firmware fails to start the session protection, then we do call iwl_mvm_roc_finished() here, but that won't do anything at all because IWL_M…
-
High 7.5
NFSv4: Fix a deadlock when recovering state on a sillyrenamed file
In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix a deadlock when recovering state on a sillyrenamed file If the file is sillyrenamed, and slated for delete on close, it is possible for a server reboot to triggeer an open reclaim,…
-
High 7.5
mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr If multiple connection requests attempt to create an implicit mptcp endpoint in parallel, more than one caller may en…
-
High 7.5
eth: bnxt: do not update checksum in bnxt_xdp_build_skb()
In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: do not update checksum in bnxt_xdp_build_skb() The bnxt_rx_pkt() updates ip_summed value at the end if checksum offload is enabled. When the XDP-MB program is attached and it retur…
-
High 7.5
eth: bnxt: fix truesize for mb-xdp-pass case
In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix truesize for mb-xdp-pass case When mb-xdp is set and return is XDP_PASS, packet is converted from xdp_buff to sk_buff with xdp_update_skb_shared_info() in bnxt_xdp_build_skb().…
-
High 7.3
netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() Since commit b36e4523d4d5 ("netfilter: nf_conncount: fix garbage collection confirm race"), `cpu` and `jif…
-
High 7.1
wifi: iwlwifi: limit printed string from FW file
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: limit printed string from FW file There's no guarantee here that the file is always with a NUL-termination, so reading the string may read beyond the end of the TLV. If that's …
-
High 7.1
vlan: enforce underlying device type
In the Linux kernel, the following vulnerability has been resolved: vlan: enforce underlying device type Currently, VLAN devices can be created on top of non-ethernet devices. Besides the fact that it doesn't make much sense, this also causes a bug which leak…
-
High 7.0
cdx: Fix possible UAF error in driver_override_show()
In the Linux kernel, the following vulnerability has been resolved: cdx: Fix possible UAF error in driver_override_show() Fixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c This function driver_override_show() is part of DEVICE_ATTR_R…
-
High 7.0
mm: abort vma_modify() on merge out of memory failure
In the Linux kernel, the following vulnerability has been resolved: mm: abort vma_modify() on merge out of memory failure The remainder of vma_modify() relies upon the vmg state remaining pristine after a merge attempt. Usually this is the case, however in th…
-
Medium 5.5
ftrace: Avoid potential division by zero in function_stat_show()
In the Linux kernel, the following vulnerability has been resolved: ftrace: Avoid potential division by zero in function_stat_show() Check whether denominator expression x * (x - 1) * 1000 mod {2^32, 2^64} produce zero and skip stddev computation in that case…
-
Medium 5.5
caif_virtio: fix wrong pointer check in cfv_probe()
In the Linux kernel, the following vulnerability has been resolved: caif_virtio: fix wrong pointer check in cfv_probe() del_vqs() frees virtqueues, therefore cfv->vq_tx pointer should be checked for NULL before calling it, not cfv->vdev. Also the current impl…
-
Medium 5.5
NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback
In the Linux kernel, the following vulnerability has been resolved: NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback Add PF_KCOMPACTD flag and current_is_kcompactd() helper to check for it so nfs_release_folio() can skip calling nfs_wb_fol…
-
Medium 5.5
drm/imagination: avoid deadlock on fence release
In the Linux kernel, the following vulnerability has been resolved: drm/imagination: avoid deadlock on fence release Do scheduler queue fence release processing on a workqueue, rather than in the release function itself. Fixes deadlock issues such as the foll…
-
Medium 5.5
usb: renesas_usbhs: Flush the notify_hotplug_work
In the Linux kernel, the following vulnerability has been resolved: usb: renesas_usbhs: Flush the notify_hotplug_work When performing continuous unbind/bind operations on the USB drivers available on the Renesas RZ/G2L SoC, a kernel crash with the message "Un…
-
Medium 5.5
usb: typec: ucsi: Fix NULL pointer access
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Fix NULL pointer access Resources should be released only after all threads that utilize them have been destroyed. This commit ensures that resources are not released premat…
-
Medium 5.5
ppp: Fix KMSAN uninit-value warning with bpf
In the Linux kernel, the following vulnerability has been resolved: ppp: Fix KMSAN uninit-value warning with bpf Syzbot caught an "KMSAN: uninit-value" warning [1], which is caused by the ppp driver not initializing a 2-byte header when using socket filter. T…
-
Medium 5.5
wifi: iwlwifi: mvm: don't try to talk to a dead firmware
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't try to talk to a dead firmware This fixes: bad state = 0 WARNING: CPU: 10 PID: 702 at drivers/net/wireless/inel/iwlwifi/iwl-trans.c:178 iwl_trans_send_cmd+0xba/0xe0 …
-
Medium 5.5
arm: pgtable: fix NULL pointer dereference issue
In the Linux kernel, the following vulnerability has been resolved: arm: pgtable: fix NULL pointer dereference issue When update_mmu_cache_range() is called by update_mmu_cache(), the vmf parameter is NULL, which will cause a NULL pointer dereference issue in…
-
Medium 5.5
Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected() Add check for the return value of mgmt_alloc_skb() in mgmt_device_connected() to prevent null pointer dereference.
-
Medium 5.5
Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name() Add check for the return value of mgmt_alloc_skb() in mgmt_remote_name() to prevent null pointer dereference.
-
Medium 5.5
drm/amdkfd: Fix NULL Pointer Dereference in KFD queue
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix NULL Pointer Dereference in KFD queue Through KFD IOCTL Fuzzing we encountered a NULL pointer derefrence when calling kfd_queue_acquire_buffers. (cherry picked from commit 049…
-
Medium 5.5
drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params Null pointer dereference issue could occur when pipe_ctx->plane_state is null. The fix adds a check …
-
Medium 5.5
HID: appleir: Fix potential NULL dereference at raw event handle
In the Linux kernel, the following vulnerability has been resolved: HID: appleir: Fix potential NULL dereference at raw event handle Syzkaller reports a NULL pointer dereference issue in input_event(). BUG: KASAN: null-ptr-deref in instrument_atomic_read incl…
-
Medium 5.5
bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock
In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock There are multiple places from where the recovery work gets scheduled asynchronously. Also, there are multiple plac…
-
Medium 5.5
net: mana: cleanup mana struct after debugfs_remove()
In the Linux kernel, the following vulnerability has been resolved: net: mana: cleanup mana struct after debugfs_remove() When on a MANA VM hibernation is triggered, as part of hibernate_snapshot(), mana_gd_suspend() and mana_gd_resume() are called. If during…
-
Medium 5.5
scsi: qla1280: Fix kernel oops when debug level > 2
In the Linux kernel, the following vulnerability has been resolved: scsi: qla1280: Fix kernel oops when debug level > 2 A null dereference or oops exception will eventually occur when qla1280.c driver is compiled with DEBUG_QLA1280 enabled and ql_debug_level …
-
Medium 5.5
cifs: Fix integer overflow while processing closetimeo mount option
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix integer overflow while processing closetimeo mount option User-provided mount parameter closetimeo of type u32 is intended to have an upper limit, but before it is validated, the va…
-
Medium 5.5
cifs: Fix integer overflow while processing acdirmax mount option
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix integer overflow while processing acdirmax mount option User-provided mount parameter acdirmax of type u32 is intended to have an upper limit, but before it is validated, the value …
-
Medium 5.5
cifs: Fix integer overflow while processing acregmax mount option
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix integer overflow while processing acregmax mount option User-provided mount parameter acregmax of type u32 is intended to have an upper limit, but before it is validated, the value …
-
Medium 5.5
sched: address a potential NULL pointer dereference in the GRED scheduler.
In the Linux kernel, the following vulnerability has been resolved: sched: address a potential NULL pointer dereference in the GRED scheduler. If kzalloc in gred_init returns a NULL pointer, the code follows the error handling path, invoking gred_destroy. Thi…
-
Medium 5.5
ice: fix memory leak in aRFS after reset
In the Linux kernel, the following vulnerability has been resolved: ice: fix memory leak in aRFS after reset Fix aRFS (accelerated Receive Flow Steering) structures memory leak by adding a checker to verify if aRFS memory is already allocated while configurin…
-
Medium 5.5
pinctrl: nuvoton: npcm8xx: Add NULL check in npcm8xx_gpio_fw
In the Linux kernel, the following vulnerability has been resolved: pinctrl: nuvoton: npcm8xx: Add NULL check in npcm8xx_gpio_fw devm_kasprintf() calls can return null pointers on failure. But the return values were not checked in npcm8xx_gpio_fw(). Add NULL …
-
Medium 4.7
gpio: aggregator: protect driver attr handlers against module unload
In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: protect driver attr handlers against module unload Both new_device_store and delete_device_store touch module global resources (e.g. gpio_aggregator_lock). To prevent race c…
-
Unscored —
net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC
In the Linux kernel, the following vulnerability has been resolved: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC Actually ENETC VFs do not support HWTSTAMP_TX_ONESTEP_SYNC because only ENETC PF can access PMa_SINGLE_STEP registers. And there will b…
-
Unscored —
perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list
In the Linux kernel, the following vulnerability has been resolved: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list Syskaller triggers a warning due to prev_epc->pmu != next_epc->pmu in perf_event_swap_task_ctx_data(). vmcore shows t…
-
Unscored —
sched_ext: Fix pick_task_scx() picking non-queued tasks when it's called without balance()
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix pick_task_scx() picking non-queued tasks when it's called without balance() a6250aa251ea ("sched_ext: Handle cases where pick_task_scx() is called without preceding balance_scx…
-
Unscored —
acpi: typec: ucsi: Introduce a ->poll_cci method
In the Linux kernel, the following vulnerability has been resolved: acpi: typec: ucsi: Introduce a ->poll_cci method For the ACPI backend of UCSI the UCSI "registers" are just a memory copy of the register values in an opregion. The ACPI implementation in the…
-
Unscored —
mctp i3c: handle NULL header address
In the Linux kernel, the following vulnerability has been resolved: mctp i3c: handle NULL header address daddr can be NULL if there is no neighbour table entry present, in that case the tx packet should be dropped. saddr will usually be set by MCTP core, but …
-
Unscored —
mm: memory-failure: update ttu flag inside unmap_poisoned_folio
In the Linux kernel, the following vulnerability has been resolved: mm: memory-failure: update ttu flag inside unmap_poisoned_folio Patch series "mm: memory_failure: unmap poisoned folio during migrate properly", v3. Fix two bugs during folio migration if the…
-
Unscored —
wifi: nl80211: reject cooked mode if it is set along with other flags
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject cooked mode if it is set along with other flags It is possible to set both MONITOR_FLAG_COOK_FRAMES and MONITOR_FLAG_ACTIVE flags simultaneously on the same monitor inte…
-
Unscored —
wifi: cfg80211: regulatory: improve invalid hints checking
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: regulatory: improve invalid hints checking Syzbot keeps reporting an issue [1] that occurs when erroneous symbols sent from userspace get through into user_alpha2[] via regula…
-
Unscored —
gpio: rcar: Use raw_spinlock to protect register access
In the Linux kernel, the following vulnerability has been resolved: gpio: rcar: Use raw_spinlock to protect register access Use raw_spinlock in order to fix spurious messages about invalid context when spinlock debugging is enabled. The lock is only used to s…
-
Unscored —
x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range()
In the Linux kernel, the following vulnerability has been resolved: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() Xen doesn't offer MSR_FAM10H_MMIO_CONF_BASE to all guests. This results in the following warning: unchecked MSR access error: RDMSR fr…
-
Unscored —
usb: atm: cxacru: fix a flaw in existing endpoint checks
In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: fix a flaw in existing endpoint checks Syzbot once again identified a flaw in usb endpoint checking, see [1]. This time the issue stems from a commit authored by me (2eabb65…
-
Unscored —
net: ethtool: netlink: Allow NULL nlattrs when getting a phy_device
In the Linux kernel, the following vulnerability has been resolved: net: ethtool: netlink: Allow NULL nlattrs when getting a phy_device ethnl_req_get_phydev() is used to lookup a phy_device, in the case an ethtool netlink command targets a specific phydev wit…
-
Unscored —
llc: do not use skb_get() before dev_queue_xmit()
In the Linux kernel, the following vulnerability has been resolved: llc: do not use skb_get() before dev_queue_xmit() syzbot is able to crash hosts [1], using llc and devices not supporting IFF_TX_SKB_SHARING. In this case, e1000 driver calls eth_skb_pad(), w…
-
Unscored —
hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio
In the Linux kernel, the following vulnerability has been resolved: hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio Commit b15c87263a69 ("hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined) add page poison checks in do_migrate_…
-
Unscored —
rapidio: add check for rio_add_net() in rio_scan_alloc_net()
In the Linux kernel, the following vulnerability has been resolved: rapidio: add check for rio_add_net() in rio_scan_alloc_net() The return value of rio_add_net() should be checked. If it fails, put_device() should be called to free the memory and give up the…
-
Unscored —
btrfs: zoned: fix extent range end unlock in cow_file_range()
In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix extent range end unlock in cow_file_range() Running generic/751 on the for-next branch often results in a hang like below. They are both stack by locking an extent. This sug…
-
Unscored —
ksmbd: fix bug on trap in smb2_lock
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix bug on trap in smb2_lock If lock count is greater than 1, flags could be old value. It should be checked with flags of smb_lock, not flags. It will cause bug-on trap from locks_fre…
-
Unscored —
drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl
In the Linux kernel, the following vulnerability has been resolved: drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl In the "pmcmd_ioctl" function, three memory objects allocated by kmalloc are initialized by "hcall_get_cpu_state", whic…
-
Unscored —
HID: corsair-void: Update power supply values with a unified work handler
In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Update power supply values with a unified work handler corsair_void_process_receiver can be called from an interrupt context, locking battery_mutex in it was causing a kern…
-
Unscored —
drm/amd/display: Assign normalized_pix_clk when color depth = 14
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Assign normalized_pix_clk when color depth = 14 [WHY & HOW] A warning message "WARNING: CPU: 4 PID: 459 at ... /dc_resource.c:3397 calculate_phy_pix_clks+0xef/0x100 [amdgpu]"…
-
Unscored —
eth: bnxt: fix kernel panic in the bnxt_get_queue_stats{rx | tx}
In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix kernel panic in the bnxt_get_queue_stats{rx | tx} When qstats-get operation is executed, callbacks of netdev_stats_ops are called. The bnxt_get_queue_stats{rx | tx} collect per…
-
Unscored —
eth: bnxt: return fail if interface is down in bnxt_queue_mem_alloc()
In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: return fail if interface is down in bnxt_queue_mem_alloc() The bnxt_queue_mem_alloc() is called to allocate new queue memory when a queue is restarted. It internally accesses rx bu…
-
Unscored —
net/mlx5: handle errors in mlx5_chains_create_table()
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: handle errors in mlx5_chains_create_table() In mlx5_chains_create_table(), the return value of mlx5_get_fdb_sub_ns() and mlx5_get_flow_namespace() must be checked to prevent NULL po…
-
Unscored —
fbdev: hyperv_fb: Fix hang in kdump kernel when on Hyper-V Gen 2 VMs
In the Linux kernel, the following vulnerability has been resolved: fbdev: hyperv_fb: Fix hang in kdump kernel when on Hyper-V Gen 2 VMs Gen 2 Hyper-V VMs boot via EFI and have a standard EFI framebuffer device. When the kdump kernel runs in such a VM, loadin…
-
Unscored —
drm/hyperv: Fix address space leak when Hyper-V DRM device is removed
In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: Fix address space leak when Hyper-V DRM device is removed When a Hyper-V DRM device is probed, the driver allocates MMIO space for the vram, and maps it cacheable. If the device r…
-
Unscored —
mm/slab/kvfree_rcu: Switch to WQ_MEM_RECLAIM wq
In the Linux kernel, the following vulnerability has been resolved: mm/slab/kvfree_rcu: Switch to WQ_MEM_RECLAIM wq Currently kvfree_rcu() APIs use a system workqueue which is "system_unbound_wq" to driver RCU machinery to reclaim a memory. Recently, it has b…
-
Unscored —
net: switchdev: Convert blocking notification chain to a raw one
In the Linux kernel, the following vulnerability has been resolved: net: switchdev: Convert blocking notification chain to a raw one A blocking notification chain uses a read-write semaphore to protect the integrity of the chain. The semaphore is acquired for…
Revision history
-
#114
Neue Updates von Ubuntu aufgenommen
-
#113
Neue Updates von Ubuntu aufgenommen
-
#112
Neue Updates von Ubuntu aufgenommen
-
#111
Neue Updates von Ubuntu aufgenommen
-
#110
Neue Updates von Ubuntu aufgenommen
-
#109
Neue Updates von SUSE aufgenommen
-
#108
Neue Updates von SUSE aufgenommen
-
#107
Neue Updates von IBM aufgenommen
-
#106
Neue Updates von Siemens aufgenommen
-
#105
Neue Updates von Oracle Linux aufgenommen
-
#104
Neue Updates von Oracle Linux aufgenommen
-
#103
Neue Updates von Ubuntu aufgenommen
-
#102
Neue Updates von Oracle Linux aufgenommen
-
#101
Neue Updates von Oracle Linux aufgenommen
-
#100
Neue Updates von Ubuntu und Oracle Linux aufgenommen
-
#99
Neue Updates von Ubuntu aufgenommen
-
#98
Neue Updates von Ubuntu aufgenommen
-
#97
Neue Updates von Ubuntu und Oracle Linux aufgenommen
-
#96
Neue Updates von Ubuntu aufgenommen
-
#95
Neue Updates von SUSE aufgenommen
-
#94
Neue Updates von SUSE aufgenommen
-
#93
Neue Updates von Debian und Ubuntu aufgenommen
-
#92
Neue Updates von Debian aufgenommen
-
#91
Neue Updates von Oracle Linux aufgenommen
-
#90
Neue Updates von Oracle Linux aufgenommen
References
-
Kernel CVE Announce Mailingliste
https://lore.kernel.org/linux-cve-announce/
-
Linux Kernel CVE Announcement CVE-2025-21894
https://lore.kernel.org/linux-cve-announce/2025040130-CVE-2025-21894-60f0@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21895
https://lore.kernel.org/linux-cve-announce/2025040132-CVE-2025-21895-5c1a@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21896
https://lore.kernel.org/linux-cve-announce/2025040132-CVE-2025-21896-395c@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21897
https://lore.kernel.org/linux-cve-announce/2025040132-CVE-2025-21897-241f@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21898
https://lore.kernel.org/linux-cve-announce/2025040132-CVE-2025-21898-22dd@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21899
https://lore.kernel.org/linux-cve-announce/2025040132-CVE-2025-21899-bf75@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21900
https://lore.kernel.org/linux-cve-announce/2025040133-CVE-2025-21900-8d31@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21901
https://lore.kernel.org/linux-cve-announce/2025040133-CVE-2025-21901-8898@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21902
https://lore.kernel.org/linux-cve-announce/2025040126-CVE-2025-21902-ce66@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21903
https://lore.kernel.org/linux-cve-announce/2025040128-CVE-2025-21903-4dbf@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21904
https://lore.kernel.org/linux-cve-announce/2025040129-CVE-2025-21904-cd79@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21905
https://lore.kernel.org/linux-cve-announce/2025040129-CVE-2025-21905-348b@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21906
https://lore.kernel.org/linux-cve-announce/2025040129-CVE-2025-21906-de63@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21907
https://lore.kernel.org/linux-cve-announce/2025040129-CVE-2025-21907-5379@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21908
https://lore.kernel.org/linux-cve-announce/2025040129-CVE-2025-21908-b8ce@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21909
https://lore.kernel.org/linux-cve-announce/2025040129-CVE-2025-21909-90df@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21910
https://lore.kernel.org/linux-cve-announce/2025040130-CVE-2025-21910-1f2f@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21911
https://lore.kernel.org/linux-cve-announce/2025040130-CVE-2025-21911-8a57@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21912
https://lore.kernel.org/linux-cve-announce/2025040130-CVE-2025-21912-5b97@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21913
https://lore.kernel.org/linux-cve-announce/2025040130-CVE-2025-21913-b942@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21914
https://lore.kernel.org/linux-cve-announce/2025040130-CVE-2025-21914-83dd@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21915
https://lore.kernel.org/linux-cve-announce/2025040130-CVE-2025-21915-b56c@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21916
https://lore.kernel.org/linux-cve-announce/2025040131-CVE-2025-21916-28b9@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21917
https://lore.kernel.org/linux-cve-announce/2025040131-CVE-2025-21917-8a54@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21918
https://lore.kernel.org/linux-cve-announce/2025040131-CVE-2025-21918-dc4c@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21919
https://lore.kernel.org/linux-cve-announce/2025040131-CVE-2025-21919-5f2a@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21920
https://lore.kernel.org/linux-cve-announce/2025040131-CVE-2025-21920-08ff@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21921
https://lore.kernel.org/linux-cve-announce/2025040131-CVE-2025-21921-9deb@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21922
https://lore.kernel.org/linux-cve-announce/2025040132-CVE-2025-21922-8c36@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21923
https://lore.kernel.org/linux-cve-announce/2025040132-CVE-2025-21923-5c6e@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21924
https://lore.kernel.org/linux-cve-announce/2025040132-CVE-2025-21924-3a08@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21925
https://lore.kernel.org/linux-cve-announce/2025040132-CVE-2025-21925-89e0@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21926
https://lore.kernel.org/linux-cve-announce/2025040132-CVE-2025-21926-fd40@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21927
https://lore.kernel.org/linux-cve-announce/2025040133-CVE-2025-21927-36d6@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21928
https://lore.kernel.org/linux-cve-announce/2025040133-CVE-2025-21928-e444@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21929
https://lore.kernel.org/linux-cve-announce/2025040133-CVE-2025-21929-bf29@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21930
https://lore.kernel.org/linux-cve-announce/2025040133-CVE-2025-21930-cc02@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21931
https://lore.kernel.org/linux-cve-announce/2025040133-CVE-2025-21931-3d56@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21932
https://lore.kernel.org/linux-cve-announce/2025040133-CVE-2025-21932-98f8@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21933
https://lore.kernel.org/linux-cve-announce/2025040134-CVE-2025-21933-2f5b@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21934
https://lore.kernel.org/linux-cve-announce/2025040134-CVE-2025-21934-1a8d@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21935
https://lore.kernel.org/linux-cve-announce/2025040134-CVE-2025-21935-4288@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21936
https://lore.kernel.org/linux-cve-announce/2025040134-CVE-2025-21936-fe95@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21937
https://lore.kernel.org/linux-cve-announce/2025040134-CVE-2025-21937-90a8@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21938
https://lore.kernel.org/linux-cve-announce/2025040134-CVE-2025-21938-3b75@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21939
https://lore.kernel.org/linux-cve-announce/2025040135-CVE-2025-21939-b7d7@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21940
https://lore.kernel.org/linux-cve-announce/2025040135-CVE-2025-21940-f9e9@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21941
https://lore.kernel.org/linux-cve-announce/2025040135-CVE-2025-21941-8240@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21942
https://lore.kernel.org/linux-cve-announce/2025040135-CVE-2025-21942-2957@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21943
https://lore.kernel.org/linux-cve-announce/2025040135-CVE-2025-21943-2255@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21944
https://lore.kernel.org/linux-cve-announce/2025040135-CVE-2025-21944-d6eb@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21945
https://lore.kernel.org/linux-cve-announce/2025040136-CVE-2025-21945-d791@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21946
https://lore.kernel.org/linux-cve-announce/2025040136-CVE-2025-21946-63a2@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21947
https://lore.kernel.org/linux-cve-announce/2025040136-CVE-2025-21947-fcc5@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21948
https://lore.kernel.org/linux-cve-announce/2025040136-CVE-2025-21948-cbbb@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21949
https://lore.kernel.org/linux-cve-announce/2025040136-CVE-2025-21949-e05a@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21950
https://lore.kernel.org/linux-cve-announce/2025040136-CVE-2025-21950-11d2@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21951
https://lore.kernel.org/linux-cve-announce/2025040137-CVE-2025-21951-5e0f@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21952
https://lore.kernel.org/linux-cve-announce/2025040137-CVE-2025-21952-16cb@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21953
https://lore.kernel.org/linux-cve-announce/2025040143-CVE-2025-21953-57ef@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21954
https://lore.kernel.org/linux-cve-announce/2025040143-CVE-2025-21954-8f0d@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21955
https://lore.kernel.org/linux-cve-announce/2025040143-CVE-2025-21955-c393@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21956
https://lore.kernel.org/linux-cve-announce/2025040144-CVE-2025-21956-483d@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21957
https://lore.kernel.org/linux-cve-announce/2025040144-CVE-2025-21957-5d2c@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21958
https://lore.kernel.org/linux-cve-announce/2025040144-CVE-2025-21958-c94c@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21959
https://lore.kernel.org/linux-cve-announce/2025040144-CVE-2025-21959-a643@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21960
https://lore.kernel.org/linux-cve-announce/2025040144-CVE-2025-21960-14ae@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21961
https://lore.kernel.org/linux-cve-announce/2025040144-CVE-2025-21961-5759@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21962
https://lore.kernel.org/linux-cve-announce/2025040145-CVE-2025-21962-9f86@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21963
https://lore.kernel.org/linux-cve-announce/2025040145-CVE-2025-21963-6e21@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21964
https://lore.kernel.org/linux-cve-announce/2025040145-CVE-2025-21964-e2c1@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21965
https://lore.kernel.org/linux-cve-announce/2025040145-CVE-2025-21965-34d8@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21966
https://lore.kernel.org/linux-cve-announce/2025040145-CVE-2025-21966-afc6@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21967
https://lore.kernel.org/linux-cve-announce/2025040146-CVE-2025-21967-114e@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21968
https://lore.kernel.org/linux-cve-announce/2025040146-CVE-2025-21968-c3f2@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21969
https://lore.kernel.org/linux-cve-announce/2025040146-CVE-2025-21969-d4f2@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21970
https://lore.kernel.org/linux-cve-announce/2025040146-CVE-2025-21970-fbac@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21971
https://lore.kernel.org/linux-cve-announce/2025040146-CVE-2025-21971-d17c@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-21972
https://lore.kernel.org/linux-cve-announce/2025040146-CVE-2025-21972-1415@gregkh/