Skip to content
OpenAdvisories
High WID-SEC-2025-0698 21 CVEs

Linux Kernel: Mehrere Schwachstellen

Published Apr 2, 2025 · Updated Jul 13, 2026 · Revision 86 · de-DE

Vendor: amazon Vendor: Debian Vendor: Dell Vendor: Google Vendor: Oracle Vendor: Red Hat Vendor: Siemens Vendor: SolarWinds Vendor: SUSE Vendor: Ubuntu Product: Container-Optimized OS Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: Secure Connect Gateway Product: Security Event Manager Product: SIMATIC S7 Platform: Linux

Summary

Ein entfernter anonymer Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen 'Denial of Service'-Zustand zu erzeugen oder andere nicht spezifizierte Angriffe durchzuführen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 21

  • Critical 9.8
    CVE-2025-21988

    fs/netfs/read_collect: add to next->prev_donated

    In the Linux kernel, the following vulnerability has been resolved: fs/netfs/read_collect: add to next->prev_donated If multiple subrequests donate data to the same "next" request (depending on the subrequest completion order), each of them would overwrite th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.6
    CVE-2025-22004

    net: atm: fix use after free in lec_send()

    In the Linux kernel, the following vulnerability has been resolved: net: atm: fix use after free in lec_send() The ->send() operation frees skb so save the length before calling ->send() to avoid a use after free.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-21991

    x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes

    In the Linux kernel, the following vulnerability has been resolved: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes Currently, load_microcode_amd() iterates over all NUMA nodes, retrieves their CPU masks and unconditionally accesses p…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-21999

    proc: fix UAF in proc_get_inode()

    In the Linux kernel, the following vulnerability has been resolved: proc: fix UAF in proc_get_inode() Fix race between rmmod and /proc/XXX's inode instantiation. The bug is that pde->proc_ops don't belong to /proc, it belongs to a module, therefore dereferenc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-22001

    accel/qaic: Fix integer overflow in qaic_validate_req()

    In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Fix integer overflow in qaic_validate_req() These are u64 variables that come from the user via qaic_attach_slice_bo_ioctl(). Use check_add_overflow() to ensure that the math does…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.6
    CVE-2025-21994

    ksmbd: fix incorrect validation for num_aces field of smb_acl

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix incorrect validation for num_aces field of smb_acl parse_dcal() validate num_aces to allocate posix_ace_state_array. if (num_aces > ULONG_MAX / sizeof(struct smb_ace *)) It is an i…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2025-21993

    iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()

    In the Linux kernel, the following vulnerability has been resolved: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() When performing an iSCSI boot using IPv6, iscsistart still reads the /sys/firmware/ibft/ethernetX/subnet-mask entry. …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2025-21989

    drm/amd/display: fix missing .is_two_pixels_per_container

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix missing .is_two_pixels_per_container Starting from 6.11, AMDGPU driver, while being loaded with amdgpu.dc=1, due to lack of .is_two_pixels_per_container function in dce60…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2025-21990

    drm/amdgpu: NULL-check BO's backing store when determining GFX12 PTE flags

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: NULL-check BO's backing store when determining GFX12 PTE flags PRT BOs may not have any backing store, so bo->tbo.resource will be NULL. Check for that before dereferencing. (cher…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2025-21995

    drm/sched: Fix fence reference count leak

    In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix fence reference count leak The last_scheduled fence leaks when an entity is being killed and adding the cleanup callback fails. Decrement the reference count of prev when dma_f…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2025-21996

    drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()

    In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() On the off chance that command stream passed from userspace via ioctl() call to radeon_vce_cs_parse() is weirdly crafted and …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2025-21997

    xsk: fix an integer overflow in xp_create_and_assign_umem()

    In the Linux kernel, the following vulnerability has been resolved: xsk: fix an integer overflow in xp_create_and_assign_umem() Since the i and pool->chunk_size variables are of type 'u32', their product can wrap around and then be cast to 'u64'. This can lea…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2025-22000

    mm/huge_memory: drop beyond-EOF folios with the right number of refs

    In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: drop beyond-EOF folios with the right number of refs When an after-split folio is large and needs to be dropped due to EOF, folio_put_refs(folio, folio_nr_pages(folio)) should…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2025-22002

    netfs: Call `invalidate_cache` only if implemented

    In the Linux kernel, the following vulnerability has been resolved: netfs: Call `invalidate_cache` only if implemented Many filesystems such as NFS and Ceph do not implement the `invalidate_cache` method. On those filesystems, if writing to the cache (`NETFS_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2025-22003

    can: ucan: fix out of bound read in strscpy() source

    In the Linux kernel, the following vulnerability has been resolved: can: ucan: fix out of bound read in strscpy() source Commit 7fdaf8966aae ("can: ucan: use strscpy() to instead of strncpy()") unintentionally introduced a one byte out of bound read on strscp…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2025-22005

    ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().

    In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). fib_check_nh_v6_gw() expects that fib6_nh_init() cleans up everything when it fails. Commit 7dd73168e273 ("ipv6: Always alloc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2025-22006

    net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence

    In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence Registering the interrupts for TX or RX DMA Channels prior to registering their respective NAPI callbacks can result in a NULL poi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2025-22007

    Bluetooth: Fix error code in chan_alloc_skb_cb()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix error code in chan_alloc_skb_cb() The chan_alloc_skb_cb() function is supposed to return error pointers on error. Returning NULL will lead to a NULL dereference.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 4.7
    CVE-2025-21998

    firmware: qcom: uefisecapp: fix efivars registration race

    In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: uefisecapp: fix efivars registration race Since the conversion to using the TZ allocator, the efivars service is registered before the memory pool has been allocated, somethin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-21987

    drm/amdgpu: init return value in amdgpu_ttm_clear_buffer

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: init return value in amdgpu_ttm_clear_buffer Otherwise an uninitialized value can be returned if amdgpu_res_cleared returns true for all regions. Possibly closes: https://gitlab.f…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-21992

    HID: ignore non-functional sensor in HP 5MP Camera

    In the Linux kernel, the following vulnerability has been resolved: HID: ignore non-functional sensor in HP 5MP Camera The HP 5MP Camera (USB ID 0408:5473) reports a HID sensor interface that is not actually implemented. Attempting to access this non-function…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Revision history

  1. #86

    Neue Updates von Siemens aufgenommen

  2. #85

    Neue Updates von Oracle Linux aufgenommen

  3. #84

    Neue Updates von Red Hat aufgenommen

  4. #83

    Neue Updates von Red Hat aufgenommen

  5. #82

    Neue Updates von Oracle Linux aufgenommen

  6. #81

    Neue Updates von Red Hat aufgenommen

  7. #80

    Neue Updates von Oracle Linux aufgenommen

  8. #79

    Neue Updates von Oracle Linux aufgenommen

  9. #78

    Neue Updates von Oracle Linux aufgenommen

  10. #77

    Neue Updates von Oracle Linux aufgenommen

  11. #76

    Neue Updates von SUSE aufgenommen

  12. #75

    Neue Updates von SUSE aufgenommen

  13. #74

    Neue Updates von Oracle Linux aufgenommen

  14. #73

    Neue Updates von Oracle Linux aufgenommen

  15. #72

    Neue Updates von SUSE aufgenommen

  16. #71

    Neue Updates von Oracle Linux aufgenommen

  17. #70

    Neue Updates von SUSE aufgenommen

  18. #69

    Neue Updates von Dell aufgenommen

  19. #68

    Neue Updates von Oracle Linux aufgenommen

  20. #67

    Neue Updates von Ubuntu aufgenommen

  21. #66

    Neue Updates von Ubuntu aufgenommen

  22. #65

    Neue Updates von Ubuntu aufgenommen

  23. #64

    Neue Updates von Ubuntu aufgenommen

  24. #63

    Neue Updates von Ubuntu aufgenommen

  25. #62

    Neue Updates von SUSE aufgenommen

References