Skip to content
OpenAdvisories

Summary

Ein Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen oder andere, nicht genauer beschriebene Auswirkungen erzielen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 121

  • Critical 9.8

    Revert "smb: client: fix TCP timers deadlock after rmmod"

    In the Linux kernel, the following vulnerability has been resolved: Revert "smb: client: fix TCP timers deadlock after rmmod" This reverts commit e9f2517a3e18a54a3943c098d2226b245d488801. Commit e9f2517a3e18 ("smb: client: fix TCP timers deadlock after rmmod"…

  • Critical 9.8

    RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()

    In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() After the erdma_cep_put(new_cep) being called, new_cep will be freed, and the following dereference will cause a UAF problem. Fix …

  • Critical 9.8

    netfilter: nfnetlink_queue: Initialize ctx to avoid memory allocation error

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: Initialize ctx to avoid memory allocation error It is possible that ctx in nfqnl_build_packet_message() could be used before it is properly initialize, which is on…

  • High 8.8

    wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode ath11k_hal_srng_* should be used with srng->lock to protect srng data. For ath11k_dp_rx_mon_dest_process() and ath11k_dp_ful…

  • High 8.8

    ksmbd: fix overflow in dacloffset bounds check

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix overflow in dacloffset bounds check The dacloffset field was originally typed as int and used in an unchecked addition, which could overflow and bypass the existing bounds check in…

  • High 8.8

    ksmbd: fix session use-after-free in multichannel connection

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix session use-after-free in multichannel connection There is a race condition between session setup and ksmbd_sessions_deregister. The session can be freed before the connection is a…

  • High 8.8

    ksmbd: fix use-after-free in ksmbd_sessions_deregister()

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_sessions_deregister() In multichannel mode, UAF issue can occur in session_deregister when the second channel sets up a session through the connection of th…

  • High 8.8

    ksmbd: fix r_count dec/increment mismatch

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix r_count dec/increment mismatch r_count is only increased when there is an oplock break wait, so r_count inc/decrement are not paired. This can cause r_count to become negative, whi…

  • High 8.8

    RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow

    In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow When cur_qp isn't NULL, in order to avoid fetching the QP from the radix tree again we check if the next cqe QP is identical to the one we al…

  • High 8.8

    ice: validate queue quanta parameters to prevent OOB access

    In the Linux kernel, the following vulnerability has been resolved: ice: validate queue quanta parameters to prevent OOB access Add queue wraparound prevention in quanta configuration. Ensure end_qid does not overflow by validating start_qid and num_queues.

  • High 8.8

    wifi: ath11k: update channel list in reg notifier instead reg worker

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: update channel list in reg notifier instead reg worker Currently when ath11k gets a new channel list, it will be processed according to the following steps: 1. update new channe…

  • High 8.7

    ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw()

    In the Linux kernel, the following vulnerability has been resolved: ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() Fix using the untrusted value of proto->raw.pkt_len in function ice_vc_fdir_parse_raw() by verifying if it does not exceed…

  • High 8.6

    bnxt_en: Mask the bd_cnt field in the TX BD properly

    In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Mask the bd_cnt field in the TX BD properly The bd_cnt field in the TX BD specifies the total number of BDs for the TX packet. The bd_cnt field has 5 bits and the maximum number supp…

  • High 8.4

    fs/ntfs3: Prevent integer overflow in hdr_first_de()

    In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Prevent integer overflow in hdr_first_de() The "de_off" and "used" variables come from the disk so they both need to check. The problem is that on 32bit systems if they're both grea…

  • High 8.4

    ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()

    In the Linux kernel, the following vulnerability has been resolved: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() There's issue as follows: BUG: KASAN: use-after-free in ext4_xattr_inode_dec_ref_all+0x6ff/0x790 Read of size 4 at addr ffff88807…

  • High 8.3

    ksmbd: validate zero num_subauth before sub_auth is accessed

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate zero num_subauth before sub_auth is accessed Access psid->sub_auth[psid->num_subauth - 1] without checking if num_subauth is non-zero leads to an out-of-bounds read. This patc…

  • High 8.1

    ksmbd: add bounds check for create lease context

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: add bounds check for create lease context Add missing bounds check for create lease context.

  • High 8.1

    ksmbd: add bounds check for durable handle context

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: add bounds check for durable handle context Add missing bounds check for durable handle context.

  • High 7.8

    jfs: add check read-only before truncation in jfs_truncate_nolock()

    In the Linux kernel, the following vulnerability has been resolved: jfs: add check read-only before truncation in jfs_truncate_nolock() Added a check for "read-only" mode in the `jfs_truncate_nolock` function to avoid errors related to writing to a read-only …

  • High 7.8

    mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs

    In the Linux kernel, the following vulnerability has been resolved: mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs Patch series "mm: fixes for device-exclusive entries (hmm)", v2. Discussing the PageTail() call in make_device_exclusive_range() with Willy, I …

  • High 7.8

    tracing: Fix use-after-free in print_graph_function_flags during tracer switching

    In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in print_graph_function_flags during tracer switching Kairui reported a UAF issue in print_graph_function_flags() during ftrace stress testing [1]. This issue can …

  • High 7.8

    exfat: fix random stack corruption after get_block

    In the Linux kernel, the following vulnerability has been resolved: exfat: fix random stack corruption after get_block When get_block is called with a buffer_head allocated on the stack, such as do_mpage_readpage, stack corruption due to buffer_head UAF may o…

  • High 7.8

    x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs

    In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs On the following path, flush_tlb_range() can be used for zapping normal PMD entries (PMD entries that point to page tables) tog…

  • High 7.8

    x86/microcode/AMD: Fix __apply_microcode_amd()'s return value

    In the Linux kernel, the following vulnerability has been resolved: x86/microcode/AMD: Fix __apply_microcode_amd()'s return value When verify_sha256_digest() fails, __apply_microcode_amd() should propagate the failure by returning false (and not -1 which is p…

  • High 7.8

    LoongArch: BPF: Don't override subprog's return value

    In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Don't override subprog's return value The verifier test `calls: div by 0 in subprog` triggers a panic at the ld.bu instruction. The ld.bu insn is trying to load byte from memo…

  • High 7.8

    LoongArch: Increase ARCH_DMA_MINALIGN up to 16

    In the Linux kernel, the following vulnerability has been resolved: LoongArch: Increase ARCH_DMA_MINALIGN up to 16 ARCH_DMA_MINALIGN is 1 by default, but some LoongArch-specific devices (such as APBDMA) require 16 bytes alignment. When the data buffer length …

  • High 7.8

    netfilter: nft_tunnel: fix geneve_opt type confusion addition

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix geneve_opt type confusion addition When handling multiple NFTA_TUNNEL_KEY_OPTS_GENEVE attributes, the parsing logic should place every geneve_opt structure one by o…

  • High 7.8

    net: decrease cached dst counters in dst_release

    In the Linux kernel, the following vulnerability has been resolved: net: decrease cached dst counters in dst_release Upstream fix ac888d58869b ("net: do not delay dst_entries_add() in dst_release()") moved decrementing the dst count from dst_destroy to dst_re…

  • High 7.8

    net: airoha: Fix qid report in airoha_tc_get_htb_get_leaf_queue()

    In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix qid report in airoha_tc_get_htb_get_leaf_queue() Fix the following kernel warning deleting HTB offloaded leafs and/or root HTB qdisc in airoha_eth driver properly reporting q…

  • High 7.8

    sctp: add mutual exclusion in proc_sctp_do_udp_port()

    In the Linux kernel, the following vulnerability has been resolved: sctp: add mutual exclusion in proc_sctp_do_udp_port() We must serialize calls to sctp_udp_sock_stop() and sctp_udp_sock_start() or risk a crash as syzbot reported: Oops: general protection fa…

  • High 7.8

    spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock()

    In the Linux kernel, the following vulnerability has been resolved: spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock() If requested_clk > 128, cdns_mrvl_xspi_setup_clock() iterates over the entire cdns_mrvl_xspi_clk_div_list array wi…

  • High 7.8

    ublk: make sure ubq->canceling is set when queue is frozen

    In the Linux kernel, the following vulnerability has been resolved: ublk: make sure ubq->canceling is set when queue is frozen Now ublk driver depends on `ubq->canceling` for deciding if the request can be dispatched via uring_cmd & io_uring_cmd_complete_in_t…

  • High 7.8

    riscv: fgraph: Fix stack layout to match __arch_ftrace_regs argument of ftrace_return_to_handler

    In the Linux kernel, the following vulnerability has been resolved: riscv: fgraph: Fix stack layout to match __arch_ftrace_regs argument of ftrace_return_to_handler Naresh Kamboju reported a "Bad frame pointer" kernel warning while running LTP trace ftrace_st…

  • High 7.8

    spufs: fix gang directory lifetimes

    In the Linux kernel, the following vulnerability has been resolved: spufs: fix gang directory lifetimes prior to "[POWERPC] spufs: Fix gang destroy leaks" we used to have a problem with gang lifetimes - creation of a gang returns opened gang directory, which …

  • High 7.8

    ocfs2: validate l_tree_depth to avoid out-of-bounds access

    In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate l_tree_depth to avoid out-of-bounds access The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is limited to OCFS2_MAX_PATH_DEPTH. Add a check to prevent o…

  • High 7.8

    fs/ntfs3: Fix a couple integer overflows on 32bit systems

    In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix a couple integer overflows on 32bit systems On 32bit systems the "off + sizeof(struct NTFS_DE)" addition can have an integer wrapping issue. Fix it by using size_add().

  • High 7.8

    vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint

    In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint If vhost_scsi_set_endpoint is called multiple times without a vhost_scsi_clear_endpoint between them, we can hit multiple…

  • High 7.8

    RDMA/core: Fix use-after-free when rename device name

    In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix use-after-free when rename device name Syzbot reported a slab-use-after-free with the following call trace: ================================================================== B…

  • High 7.8

    bpf: Fix array bounds error with may_goto

    In the Linux kernel, the following vulnerability has been resolved: bpf: Fix array bounds error with may_goto may_goto uses an additional 8 bytes on the stack, which causes the interpreters[] array to go out of bounds when calculating index by stack_size. 1. …

  • High 7.8

    RDMA/core: Don't expose hw_counters outside of init net namespace

    In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Don't expose hw_counters outside of init net namespace Commit 467f432a521a ("RDMA/core: Split port and device counter sysfs attributes") accidentally almost exposed hw counters to …

  • High 7.8

    drm/vkms: Fix use after free and double free on init error

    In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Fix use after free and double free on init error If the driver initialization fails, the vkms_exit() function might access an uninitialized or freed default_config pointer and it mi…

  • High 7.8

    drm/panthor: Fix race condition when gathering fdinfo group samples

    In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix race condition when gathering fdinfo group samples Commit e16635d88fa0 ("drm/panthor: add DRM fdinfo support") failed to protect access to groups with an xarray lock, which c…

  • High 7.8

    Bluetooth: btnxpuart: Fix kernel panic during FW release

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix kernel panic during FW release This fixes a kernel panic seen during release FW in a stress test scenario where WLAN and BT FW download occurs simultaneously, and du…

  • High 7.8

    ax25: Remove broken autobind

    In the Linux kernel, the following vulnerability has been resolved: ax25: Remove broken autobind Binding AX25 socket by using the autobind feature leads to memory leaks in ax25_connect() and also refcount leaks in ax25_release(). Memory leak was detected with…

  • High 7.8

    btrfs: don't clobber ret in btrfs_validate_super()

    In the Linux kernel, the following vulnerability has been resolved: btrfs: don't clobber ret in btrfs_validate_super() Commit 2a9bb78cfd36 ("btrfs: validate system chunk array at btrfs_validate_super()") introduces a call to validate_sys_chunk_array() in btrf…

  • High 7.8

    btrfs: fix block group refcount race in btrfs_create_pending_block_groups()

    In the Linux kernel, the following vulnerability has been resolved: btrfs: fix block group refcount race in btrfs_create_pending_block_groups() Block group creation is done in two phases, which results in a slightly unintuitive property: a block group can be …

  • High 7.8

    md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb

    In the Linux kernel, the following vulnerability has been resolved: md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb In clustermd, separate write-intent-bitmaps are used for each cluster node: 0 4k 8k 12k --------------------------------------…

  • High 7.5

    nfsd: put dl_stid if fail to queue dl_recall

    In the Linux kernel, the following vulnerability has been resolved: nfsd: put dl_stid if fail to queue dl_recall Before calling nfsd4_run_cb to queue dl_recall to the callback_wq, we increment the reference count of dl_stid. We expect that after the correspon…

  • High 7.5
    CVE-2025-22037 EPSS 69%

    ksmbd: fix null pointer dereference in alloc_preauth_hash()

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in alloc_preauth_hash() The Client send malformed smb2 negotiate request. ksmbd return error response. Subsequently, the client can send smb2 session setup…

  • High 7.5

    udp: Fix multiple wraparounds of sk->sk_rmem_alloc.

    In the Linux kernel, the following vulnerability has been resolved: udp: Fix multiple wraparounds of sk->sk_rmem_alloc. __udp_enqueue_schedule_skb() has the following condition: if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf) goto drop; sk->sk_rcvbuf is …

  • High 7.3

    x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()

    In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() If track_pfn_copy() fails, we already added the dst VMA to the maple tree. As fork() fails, we'll cleanup the maple tree…

  • High 7.3

    powerpc/perf: Fix ref-counting on the PMU 'vpa_pmu'

    In the Linux kernel, the following vulnerability has been resolved: powerpc/perf: Fix ref-counting on the PMU 'vpa_pmu' Commit 176cda0619b6 ("powerpc/perf: Add perf interface to expose vpa counters") introduced 'vpa_pmu' to expose Book3s-HV nested APIv2 provi…

  • High 7.1

    ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans

    In the Linux kernel, the following vulnerability has been resolved: ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative. [ 23…

  • High 7.1

    acpi: nfit: fix narrowing conversion in acpi_nfit_ctl

    In the Linux kernel, the following vulnerability has been resolved: acpi: nfit: fix narrowing conversion in acpi_nfit_ctl Syzkaller has reported a warning in to_nfit_bus_uuid(): "only secondary bus families can be translated". This warning is emited if the ar…

  • High 7.1

    net: fix geneve_opt length integer overflow

    In the Linux kernel, the following vulnerability has been resolved: net: fix geneve_opt length integer overflow struct geneve_opt uses 5 bit length for each single option, which means every vary size option should be smaller than 128 bytes. However, all curre…

  • High 7.0

    f2fs: quota: fix to avoid warning in dquot_writeback_dquots()

    In the Linux kernel, the following vulnerability has been resolved: f2fs: quota: fix to avoid warning in dquot_writeback_dquots() F2FS-fs (dm-59): checkpoint=enable has some unwritten data. ------------[ cut here ]------------ WARNING: CPU: 6 PID: 8013 at fs/…

  • Medium 5.5

    wifi: ath11k: fix RCU stall while reaping monitor destination ring

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix RCU stall while reaping monitor destination ring While processing the monitor destination ring, MSDUs are reaped from the link descriptor based on the corresponding buf_id. …

  • Medium 5.5

    nfsd: fix management of listener transports

    In the Linux kernel, the following vulnerability has been resolved: nfsd: fix management of listener transports Currently, when no active threads are running, a root user using nfsdctl command can try to remove a particular listener from the list of previousl…

  • Medium 5.5

    PCI/bwctrl: Fix NULL pointer dereference on bus number exhaustion

    In the Linux kernel, the following vulnerability has been resolved: PCI/bwctrl: Fix NULL pointer dereference on bus number exhaustion When BIOS neglects to assign bus numbers to PCI bridges, the kernel attempts to correct that during PCI device enumeration. I…

  • Medium 5.5

    wifi: mt76: mt7921: fix kernel panic due to null pointer dereference

    In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix kernel panic due to null pointer dereference Address a kernel panic caused by a null pointer dereference in the `mt792x_rx_get_wcid` function. The issue arises because…

  • Medium 5.5

    arm64: Don't call NULL in do_compat_alignment_fixup()

    In the Linux kernel, the following vulnerability has been resolved: arm64: Don't call NULL in do_compat_alignment_fixup() do_alignment_t32_to_handler() only fixes up alignment faults for specific instructions; it returns NULL otherwise (e.g. LDREX). When that…

  • Medium 5.5

    staging: gpib: Fix Oops after disconnect in agilent usb

    In the Linux kernel, the following vulnerability has been resolved: staging: gpib: Fix Oops after disconnect in agilent usb If the agilent usb dongle is disconnected subsequent calls to the driver cause a NULL dereference Oops as the bus_interface is set to N…

  • Medium 5.5

    staging: gpib: Fix Oops after disconnect in ni_usb

    In the Linux kernel, the following vulnerability has been resolved: staging: gpib: Fix Oops after disconnect in ni_usb If the usb dongle is disconnected subsequent calls to the driver cause a NULL dereference Oops as the bus_interface is set to NULL on discon…

  • Medium 5.5

    arcnet: Add NULL check in com20020pci_probe()

    In the Linux kernel, the following vulnerability has been resolved: arcnet: Add NULL check in com20020pci_probe() devm_kasprintf() returns NULL when memory allocation fails. Currently, com20020pci_probe() does not check for this case, which results in a NULL …

  • Medium 5.5

    netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets

    In the Linux kernel, the following vulnerability has been resolved: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets When calling netlbl_conn_setattr(), addr->sa_family is used to determine the function behavior. If sk is an IPv4 socket,…

  • Medium 5.5

    idpf: fix adapter NULL pointer dereference on reboot

    In the Linux kernel, the following vulnerability has been resolved: idpf: fix adapter NULL pointer dereference on reboot With SRIOV enabled, idpf ends up calling into idpf_remove() twice. First via idpf_shutdown() and then again when idpf_remove() calls into …

  • Medium 5.5

    ASoC: imx-card: Add NULL check in imx_card_probe()

    In the Linux kernel, the following vulnerability has been resolved: ASoC: imx-card: Add NULL check in imx_card_probe() devm_kasprintf() returns NULL when memory allocation fails. Currently, imx_card_probe() does not check for this case, which results in a NUL…

  • Medium 5.5

    fs/9p: fix NULL pointer dereference on mkdir

    In the Linux kernel, the following vulnerability has been resolved: fs/9p: fix NULL pointer dereference on mkdir When a 9p tree was mounted with option 'posixacl', parent directory had a default ACL set for its subdirectories, e.g.: setfacl -m default:group:s…

  • Medium 5.5
    CVE-2025-23134 Public exploit

    ALSA: timer: Don't take register_mutex with copy_from/to_user()

    In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Don't take register_mutex with copy_from/to_user() The infamous mmap_lock taken in copy_from/to_user() can be often problematic when it's called inside another mutex, as they mig…

  • Medium 5.5

    thermal: int340x: Add NULL check for adev

    In the Linux kernel, the following vulnerability has been resolved: thermal: int340x: Add NULL check for adev Not all devices have an ACPI companion fwnode, so adev might be NULL. This is similar to the commit cd2fd6eab480 ("platform/x86: int3472: Check for a…

  • Medium 4.7

    media: streamzap: fix race between device disconnection and urb callback

    In the Linux kernel, the following vulnerability has been resolved: media: streamzap: fix race between device disconnection and urb callback Syzkaller has reported a general protection fault at function ir_raw_event_store_with_filter(). This crash is caused b…

  • Unscored —

    PCI/ASPM: Fix link state exit during switch upstream function removal

    In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix link state exit during switch upstream function removal Before 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free"), we would free the ASPM li…

  • Unscored —

    jfs: add check read-only before txBeginAnon() call

    In the Linux kernel, the following vulnerability has been resolved: jfs: add check read-only before txBeginAnon() call Added a read-only check before calling `txBeginAnon` in `extAlloc` and `extRecord`. This prevents modification attempts on a read-only mount…

  • Unscored —

    nfsd: don't ignore the return code of svc_proc_register()

    In the Linux kernel, the following vulnerability has been resolved: nfsd: don't ignore the return code of svc_proc_register() Currently, nfsd_proc_stat_init() ignores the return value of svc_proc_register(). If the procfile creation fails, then the kernel wil…

  • Unscored —

    media: vimc: skip .s_stream() for stopped entities

    In the Linux kernel, the following vulnerability has been resolved: media: vimc: skip .s_stream() for stopped entities Syzbot reported [1] a warning prompted by a check in call_s_stream() that checks whether .s_stream() operation is warranted for unstarted or…

  • Unscored —
    CVE-2025-22029 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead()

    In the Linux kernel, the following vulnerability has been resolved: mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() Currently, zswap_cpu_comp_dead() calls crypto_free_acomp() while holding the per-CPU acomp_ctx mutex. crypto_free_acomp() …

  • Unscored —

    uprobes/x86: Harden uretprobe syscall trampoline check

    In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Harden uretprobe syscall trampoline check Jann reported a possible issue when trampoline_check_ip returns address near the bottom of the address space that is allowed to call int…

  • Unscored —

    usbnet:fix NPE during rx_complete

    In the Linux kernel, the following vulnerability has been resolved: usbnet:fix NPE during rx_complete Missing usbnet_going_away Check in Critical Path. The usb_submit_urb function lacks a usbnet_going_away validation, whereas __usbnet_queue_skb includes this …

  • Unscored —

    net: ibmveth: make veth_pool_store stop hanging

    In the Linux kernel, the following vulnerability has been resolved: net: ibmveth: make veth_pool_store stop hanging v2: - Created a single error handling unlock and exit in veth_pool_store - Greatly expanded commit message with previous explanatory-only text …

  • Unscored —

    udp: Fix memory accounting leak.

    In the Linux kernel, the following vulnerability has been resolved: udp: Fix memory accounting leak. Matt Dowling reported a weird UDP memory usage issue. Under normal operation, the UDP memory usage reported in /proc/net/sockstat remains close to zero. Howev…

  • Unscored —

    net: mvpp2: Prevent parser TCAM memory corruption

    In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: Prevent parser TCAM memory corruption Protect the parser TCAM/SRAM memory, and the cached (shadow) SRAM information, from concurrent modifications. Both the TCAM and SRAM tables a…

  • Unscored —

    netfilter: nf_tables: don't unregister hook when table is dormant

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't unregister hook when table is dormant When nf_tables_updchain encounters an error, hook registration needs to be rolled back. This should only be done if the hook …

  • Unscored —

    spufs: fix a leak in spufs_create_context()

    In the Linux kernel, the following vulnerability has been resolved: spufs: fix a leak in spufs_create_context() Leak fixes back in 2008 missed one case - if we are trying to set affinity and spufs_mkdir() fails, we need to drop the reference to neighbor.

  • Unscored —

    spufs: fix a leak on spufs_new_file() failure

    In the Linux kernel, the following vulnerability has been resolved: spufs: fix a leak on spufs_new_file() failure It's called from spufs_fill_dir(), and caller of that will do spufs_rmdir() in case of failure. That does remove everything we'd managed to creat…

  • Unscored —

    rtnetlink: Allocate vfinfo size for VF GUIDs when supported

    In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Allocate vfinfo size for VF GUIDs when supported Commit 30aad41721e0 ("net/core: Add support for getting VF GUIDs") added support for getting VF port and node GUIDs in netlink ifin…

  • Unscored —

    exfat: fix missing shutdown check

    In the Linux kernel, the following vulnerability has been resolved: exfat: fix missing shutdown check xfstests generic/730 test failed because after deleting the device that still had dirty data, the file could still be read without returning an error. The re…

  • Unscored —

    staging: vchiq_arm: Fix possible NPR of keep-alive thread

    In the Linux kernel, the following vulnerability has been resolved: staging: vchiq_arm: Fix possible NPR of keep-alive thread In case vchiq_platform_conn_state_changed() is never called or fails before driver removal, ka_thread won't be a valid pointer to a t…

  • Unscored —

    iio: backend: make sure to NULL terminate stack buffer

    In the Linux kernel, the following vulnerability has been resolved: iio: backend: make sure to NULL terminate stack buffer Make sure to NULL terminate the buffer in iio_backend_debugfs_write_reg() before passing it to sscanf(). It is a stack variable so we sh…

  • Unscored —

    w1: fix NULL pointer dereference in probe

    In the Linux kernel, the following vulnerability has been resolved: w1: fix NULL pointer dereference in probe The w1_uart_probe() function calls w1_uart_serdev_open() (which includes devm_serdev_device_open()) before setting the client ops via serdev_device_s…

  • Unscored —

    RDMA/mlx5: Fix page_size variable overflow

    In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix page_size variable overflow Change all variables storing mlx5_umem_mkc_find_best_pgsz() result to unsigned long to support values larger than 31 and avoid overflow. For example…

  • Unscored —

    PCI: Fix NULL dereference in SR-IOV VF creation error path

    In the Linux kernel, the following vulnerability has been resolved: PCI: Fix NULL dereference in SR-IOV VF creation error path Clean up when virtfn setup fails to prevent NULL pointer dereference during device removal. The kernel oops below occurred due to in…

  • Unscored —

    drm/amd/display: avoid NPD when ASIC does not support DMUB

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: avoid NPD when ASIC does not support DMUB ctx->dmub_srv will de NULL if the ASIC does not support DMUB, which is tested in dm_dmub_sw_init. However, it will be dereferenced i…

  • Unscored —

    PCI: brcmstb: Fix error path after a call to regulator_bulk_get()

    In the Linux kernel, the following vulnerability has been resolved: PCI: brcmstb: Fix error path after a call to regulator_bulk_get() If the regulator_bulk_get() returns an error and no regulators are created, we need to set their number to zero. If we don't …

  • Unscored —

    drm/msm/gem: Fix error code msm_parse_deps()

    In the Linux kernel, the following vulnerability has been resolved: drm/msm/gem: Fix error code msm_parse_deps() The SUBMIT_ERROR() macro turns the error code negative. This extra '-' operation turns it back to positive EINVAL again. The error code is passed …

  • Unscored —

    drm: zynqmp_dp: Fix a deadlock in zynqmp_dp_ignore_hpd_set()

    In the Linux kernel, the following vulnerability has been resolved: drm: zynqmp_dp: Fix a deadlock in zynqmp_dp_ignore_hpd_set() Instead of attempting the same mutex twice, lock and unlock it. This bug has been detected by the Clang thread-safety analyzer.

  • Unscored —

    drm: xlnx: zynqmp_dpsub: Add NULL check in zynqmp_audio_init

    In the Linux kernel, the following vulnerability has been resolved: drm: xlnx: zynqmp_dpsub: Add NULL check in zynqmp_audio_init devm_kasprintf() calls can return null pointers on failure. But some return values were not checked in zynqmp_audio_init(). Add NU…

  • Unscored —

    net: libwx: fix Tx L4 checksum

    In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix Tx L4 checksum The hardware only supports L4 checksum offload for TCP/UDP/SCTP protocol. There was a bug to set Tx checksum flag for the other protocol that results in Tx ring…

  • Unscored —

    net: fix NULL pointer dereference in l3mdev_l3_rcv

    In the Linux kernel, the following vulnerability has been resolved: net: fix NULL pointer dereference in l3mdev_l3_rcv When delete l3s ipvlan: ip link del link eth0 ipvlan1 type ipvlan mode l3s This may cause a null pointer dereference: Call trace: ip_rcv_fin…

  • Unscored —

    ibmvnic: Use kernel helpers for hex dumps

    In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Use kernel helpers for hex dumps Previously, when the driver was printing hex dumps, the buffer was cast to an 8 byte long and printed using string formatters. If the buffer size was…

  • Unscored —

    bonding: check xdp prog when set bond mode

    In the Linux kernel, the following vulnerability has been resolved: bonding: check xdp prog when set bond mode Following operations can trigger a warning[1]: ip netns add ns1 ip netns exec ns1 ip link add bond0 type bond mode balance-rr ip netns exec ns1 ip l…

  • Unscored —

    vmxnet3: unregister xdp rxq info in the reset path

    In the Linux kernel, the following vulnerability has been resolved: vmxnet3: unregister xdp rxq info in the reset path vmxnet3 does not unregister xdp rxq info in the vmxnet3_reset_work() code path as vmxnet3_rq_destroy() is not invoked in this code path. So,…

  • Unscored —

    net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry()

    In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() There are actually 2 problems: - deleting the last element doesn't require the memmove of elements [i + 1, e…

  • Unscored —

    net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.

    In the Linux kernel, the following vulnerability has been resolved: net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. SIOCBRDELIF is passed to dev_ioctl() first and later forwarded to br_ioctl_call(), which causes unnecessary RTNL dance and the splat be…

  • Unscored —

    eth: bnxt: fix out-of-range access of vnic_info array

    In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix out-of-range access of vnic_info array The bnxt_queue_{start | stop}() access vnic_info as much as allocated, which indicates bp->nr_vnics. So, it should not reach bp->vnic_inf…

  • Unscored —

    ext4: avoid journaling sb update on error if journal is destroying

    In the Linux kernel, the following vulnerability has been resolved: ext4: avoid journaling sb update on error if journal is destroying Presently we always BUG_ON if trying to start a transaction on a journal marked with JBD2_UNMOUNT, since this should never h…

  • Unscored —

    idpf: check error for register_netdev() on init

    In the Linux kernel, the following vulnerability has been resolved: idpf: check error for register_netdev() on init Current init logic ignores the error code from register_netdev(), which will cause WARN_ON() on attempt to unregister it, if there was one, and…

  • Unscored —

    wifi: cfg80211: init wiphy_work before allocating rfkill fails

    In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: init wiphy_work before allocating rfkill fails syzbort reported a uninitialize wiphy_work_lock in cfg80211_dev_free. [1] After rfkill allocation fails, the wiphy release proce…

  • Unscored —

    ext4: goto right label 'out_mmap_sem' in ext4_setattr()

    In the Linux kernel, the following vulnerability has been resolved: ext4: goto right label 'out_mmap_sem' in ext4_setattr() Otherwise, if ext4_inode_attach_jinode() fails, a hung task will happen because filemap_invalidate_unlock() isn't called to unlock mapp…

  • Unscored —

    block: fix adding folio to bio

    In the Linux kernel, the following vulnerability has been resolved: block: fix adding folio to bio >4GB folio is possible on some ARCHs, such as aarch64, 16GB hugepage is supported, then 'offset' of folio can't be held in 'unsigned int', cause warning in bio_…

  • Unscored —

    f2fs: fix to avoid accessing uninitialized curseg

    In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid accessing uninitialized curseg syzbot reports a f2fs bug as below: F2FS-fs (loop3): Stopped filesystem due to reason: 7 kworker/u8:7: attempt to access beyond end of device…

  • Unscored —

    md/raid1,raid10: don't ignore IO flags

    In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: don't ignore IO flags If blk-wbt is enabled by default, it's found that raid write performance is quite bad because all IO are throttled by wbt of underlying disks, due to fl…

  • Unscored —

    md: fix mddev uaf while iterating all_mddevs list

    In the Linux kernel, the following vulnerability has been resolved: md: fix mddev uaf while iterating all_mddevs list While iterating all_mddevs list from md_notify_reboot() and md_exit(), list_for_each_entry_safe is used, and this can race with deletint the …

  • Unscored —

    f2fs: fix potential deadloop in prepare_compress_overwrite()

    In the Linux kernel, the following vulnerability has been resolved: f2fs: fix potential deadloop in prepare_compress_overwrite() Jan Prusakowski reported a kernel hang issue as below: When running xfstests on linux-next kernel (6.14.0-rc3, 6.12) I encountered…

  • Unscored —

    wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path If a shared IRQ is used by the driver due to platform limitation, then the IRQ affinity hint is set right …

  • Unscored —

    wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path If a shared IRQ is used by the driver due to platform limitation, then the IRQ affinity hint is set right…

  • Unscored —

    f2fs: fix to avoid panic once fallocation fails for pinfile

    In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid panic once fallocation fails for pinfile syzbot reports a f2fs bug as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:2746! CPU: 0 UID: 0 PID: 5…

  • Unscored —

    dlm: prevent NPD when writing a positive value to event_done

    In the Linux kernel, the following vulnerability has been resolved: dlm: prevent NPD when writing a positive value to event_done do_uevent returns the value written to event_done. In case it is a positive value, new_lockspace would undo all the work, and lock…

  • Unscored —

    RISC-V: KVM: Teardown riscv specific bits after kvm_exit

    In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Teardown riscv specific bits after kvm_exit During a module removal, kvm_exit invokes arch specific disable call which disables AIA. However, we invoke aia_exit before kvm_exit r…

  • Unscored —

    cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update

    In the Linux kernel, the following vulnerability has been resolved: cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update Check if policy is NULL before dereferencing it in amd_pstate_update.

  • Unscored —

    watch_queue: fix pipe accounting mismatch

    In the Linux kernel, the following vulnerability has been resolved: watch_queue: fix pipe accounting mismatch Currently, watch_queue_set_size() modifies the pipe buffers charged to user->pipe_bufs without updating the pipe->nr_accounted on the pipe itself, du…

Revision history

  1. #200

    Neue Updates von Ubuntu aufgenommen

  2. #199

    Neue Updates von Ubuntu und Red Hat aufgenommen

  3. #198

    Neue Updates von Ubuntu aufgenommen

  4. #197

    Neue Updates von Debian aufgenommen

  5. #196

    Neue Updates von Oracle Linux aufgenommen

  6. #195

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  7. #194

    Neue Updates von Red Hat aufgenommen

  8. #193

    Neue Updates von Debian und Oracle Linux aufgenommen

  9. #192

    Neue Updates von Oracle Linux aufgenommen

  10. #191

    Neue Updates von Ubuntu aufgenommen

  11. #190

    Neue Updates von Ubuntu aufgenommen

  12. #189

    Neue Updates von Oracle Linux aufgenommen

  13. #188

    Neue Updates von Ubuntu aufgenommen

  14. #187

    Neue Updates von Debian aufgenommen

  15. #186

    Neue Updates von Debian aufgenommen

  16. #185

    Neue Updates von Ubuntu aufgenommen

  17. #184

    Neue Updates von SUSE aufgenommen

  18. #183

    Neue Updates von SUSE aufgenommen

  19. #182

    Neue Updates von Debian aufgenommen

  20. #181

    Neue Updates von Oracle Linux aufgenommen

  21. #180

    Neue Updates von Dell aufgenommen

  22. #179

    Neue Updates von Ubuntu aufgenommen

  23. #178

    Neue Updates von Ubuntu aufgenommen

  24. #177

    Neue Updates von Debian aufgenommen

  25. #176

    Neue Updates von Ubuntu aufgenommen

References