Skip to content
OpenAdvisories
High WID-SEC-2025-0861 28 CVEs

Linux Kernel: Mehrere Schwachstellen

Published Apr 21, 2025 · Updated Nov 12, 2026 · Revision 110 · de

Vendor: amazon Vendor: Debian Vendor: Dell Vendor: Google Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: Siemens Vendor: SolarWinds Vendor: SUSE Vendor: Ubuntu Product: Cloud Platform Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: openSUSE Product: Rocky Linux Product: Secure Connect Gateway Product: Security Event Manager Product: SIMATIC S7 Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Zustand oder nicht näher spezifizierte Auswirkungen zu verursachen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 28

  • High 8.8
    CVE-2021-47668

    can: dev: can_restart: fix use after free bug

    In the Linux kernel, the following vulnerability has been resolved: can: dev: can_restart: fix use after free bug After calling netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the netif_rx…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2021-47670

    can: peak_usb: fix use after free bugs

    In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: fix use after free bugs After calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the peak_u…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.4
    CVE-2025-39930

    ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai()

    In the Linux kernel, the following vulnerability has been resolved: ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai() commit 419d1918105e ("ASoC: simple-card-utils: use __free(device_node) for device node") uses __free(device_no…

    Linux Linux linux-raspi2 linux-hwe Linux Ubuntu
  • High 7.8
    CVE-2021-47669

    can: vxcan: vxcan_xmit: fix use after free bug

    In the Linux kernel, the following vulnerability has been resolved: can: vxcan: vxcan_xmit: fix use after free bug After calling netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the canfd_frame cfd which aliases skb memory is accessed after the neti…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-37785

    ext4: fix OOB read when checking dotdot dir

    In the Linux kernel, the following vulnerability has been resolved: ext4: fix OOB read when checking dotdot dir Mounting a corrupted filesystem with directory which contains '.' dir entry with rec_len == block size results in out-of-bounds read (later on, whe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-37838

    HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition

    In the Linux kernel, the following vulnerability has been resolved: HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition In the ssi_protocol_probe() function, &ssi->work is bound with ssip_xmit_work(), In ssip_pn_se…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-37893

    LoongArch: BPF: Fix off-by-one error in build_prologue()

    In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix off-by-one error in build_prologue() Vincent reported that running BPF progs with tailcalls on LoongArch causes kernel hard lockup. Debugging the issues shows that the JIT…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40014

    objtool, spi: amd: Fix out-of-bounds stack access in amd_set_spi_freq()

    In the Linux kernel, the following vulnerability has been resolved: objtool, spi: amd: Fix out-of-bounds stack access in amd_set_spi_freq() If speed_hz < AMD_SPI_MIN_HZ, amd_set_spi_freq() iterates over the entire amd_spi_freq array without breaking out early…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40114

    iio: light: Add check for array bounds in veml6075_read_int_time_ms

    In the Linux kernel, the following vulnerability has been resolved: iio: light: Add check for array bounds in veml6075_read_int_time_ms The array contains only 5 elements, but the index calculated by veml6075_read_int_time_index can range from 0 to 7, which c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40364

    io_uring: fix io_req_prep_async with provided buffers

    In the Linux kernel, the following vulnerability has been resolved: io_uring: fix io_req_prep_async with provided buffers io_req_prep_async() can import provided buffers, commit the ring state by giving up on that before, it'll be reimported later if needed.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2025-39688

    nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid()

    In the Linux kernel, the following vulnerability has been resolved: nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() The pynfs DELEG8 test fails when run against nfsd. It acquires a delegation and then lets the lease time out. It then t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2025-39735

    jfs: fix slab-out-of-bounds read in ea_get()

    In the Linux kernel, the following vulnerability has been resolved: jfs: fix slab-out-of-bounds read in ea_get() During the "size_check" label in ea_get(), the code checks if the extended attribute list (xattr) size matches ea_size. If not, it logs "ea_get: i…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2025-39778

    objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show()

    In the Linux kernel, the following vulnerability has been resolved: objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show() The csts_state_names[] array only has six sparse entries, but the iteration code in nvmet_ctrl_state_show() iterates …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2020-36789

    can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context

    In the Linux kernel, the following vulnerability has been resolved: can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context If a driver calls can_get_echo_skb() during a hardware IRQ (which is often, but not always, the case), the 'WARN_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2025-37860

    sfc: fix NULL dereferences in ef100_process_design_param()

    In the Linux kernel, the following vulnerability has been resolved: sfc: fix NULL dereferences in ef100_process_design_param() Since cited commit, ef100_probe_main() and hence also ef100_check_design_params() run before efx->net_dev is created; consequently, …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2025-38049

    x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors

    In the Linux kernel, the following vulnerability has been resolved: x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors Commit 6eac36bb9eb0 ("x86/resctrl: Allocate the cleanest CLOSID by searching closid_num_dirty_rmid") added logic t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2025-38152

    remoteproc: core: Clear table_sz when rproc_shutdown

    In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Clear table_sz when rproc_shutdown There is case as below could trigger kernel dump: Use U-Boot to start remote processor(rproc) with resource table published to a fixed add…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2025-39728

    clk: samsung: Fix UBSAN panic in samsung_clk_init()

    In the Linux kernel, the following vulnerability has been resolved: clk: samsung: Fix UBSAN panic in samsung_clk_init() With UBSAN_ARRAY_BOUNDS=y, I'm hitting the below panic due to dereferencing `ctx->clk_data.hws` before setting `ctx->clk_data.num = nr_clks…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2025-39755

    staging: gpib: Fix cb7210 pcmcia Oops

    In the Linux kernel, the following vulnerability has been resolved: staging: gpib: Fix cb7210 pcmcia Oops The pcmcia_driver struct was still only using the old .name initialization in the drv field. This led to a NULL pointer deref Oops in strcmp called from …

    Linux Linux linux-raspi2 linux-hwe Linux Ubuntu
  • Low 3.3
    CVE-2021-47671

    can: etas_es58x: es58x_rx_err_msg(): fix memory leak in error path

    In the Linux kernel, the following vulnerability has been resolved: can: etas_es58x: es58x_rx_err_msg(): fix memory leak in error path In es58x_rx_err_msg(), if can->do_set_mode() fails, the function directly returns without calling netif_rx(skb). This means …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-37925

    jfs: reject on-disk inodes of an unsupported type

    In the Linux kernel, the following vulnerability has been resolved: jfs: reject on-disk inodes of an unsupported type Syzbot has reported the following BUG: kernel BUG at fs/inode.c:668! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 3 UID: 0 PID:…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38104

    drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV RLCG Register Access is a way for virtual functions to safely access GPU registers in a v…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38240

    drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr

    In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr The function mtk_dp_wait_hpd_asserted() may be called before the `mtk_dp->drm_dev` pointer is assigned in mtk_dp_bridge_atta…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38479

    dmaengine: fsl-edma: free irq correctly in remove path

    In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-edma: free irq correctly in remove path Add fsl_edma->txirq/errirq check to avoid below warning because no errirq at i.MX9 platform. Otherwise there will be kernel dump: WARNIN…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38575

    ksmbd: use aead_request_free to match aead_request_alloc

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: use aead_request_free to match aead_request_alloc Use aead_request_free() instead of kfree() to properly free memory allocated by aead_request_alloc(). This ensures sensitive crypto da…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38637

    net_sched: skbprio: Remove overly strict queue assertions

    In the Linux kernel, the following vulnerability has been resolved: net_sched: skbprio: Remove overly strict queue assertions In the current implementation, skbprio enqueue/dequeue contains an assertion that fails under certain conditions when SKBPRIO is used…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-39989

    x86/mce: use is_copy_from_user() to determine copy-from-user context

    In the Linux kernel, the following vulnerability has been resolved: x86/mce: use is_copy_from_user() to determine copy-from-user context Patch series "mm/hwpoison: Fix regressions in memory failure handling", v4. ## 1. What am I trying to do: This patchset re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-40325

    md/raid10: wait barrier before returning discard request with REQ_NOWAIT

    In the Linux kernel, the following vulnerability has been resolved: md/raid10: wait barrier before returning discard request with REQ_NOWAIT raid10_handle_discard should wait barrier before returning a discard bio which has REQ_NOWAIT. And there is no need to…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

Revision history

  1. #110

    Neue Updates von Ubuntu aufgenommen

  2. #109

    Neue Updates von Ubuntu aufgenommen

  3. #108

    Neue Updates von Ubuntu aufgenommen

  4. #107

    Neue Updates von Ubuntu aufgenommen

  5. #106

    Neue Updates von Siemens aufgenommen

  6. #105

    Neue Updates von Oracle Linux aufgenommen

  7. #104

    Neue Updates von Ubuntu aufgenommen

  8. #103

    Neue Updates von Ubuntu aufgenommen

  9. #102

    Neue Updates von Ubuntu aufgenommen

  10. #101

    Neue Updates von Ubuntu aufgenommen

  11. #100

    Neue Updates von Ubuntu aufgenommen

  12. #99

    Neue Updates von Ubuntu aufgenommen

  13. #98

    Neue Updates von Ubuntu aufgenommen

  14. #97

    Neue Updates von Oracle Linux aufgenommen

  15. #96

    Neue Updates von Ubuntu aufgenommen

  16. #95

    Neue Updates von Ubuntu aufgenommen

  17. #94

    Neue Updates von Ubuntu aufgenommen

  18. #93

    Neue Updates von Ubuntu aufgenommen

  19. #92

    Neue Updates von Oracle Linux aufgenommen

  20. #91

    Neue Updates von SUSE aufgenommen

  21. #90

    Neue Updates von Ubuntu aufgenommen

  22. #89

    Neue Updates von Ubuntu aufgenommen

  23. #88

    Neue Updates von Oracle Linux aufgenommen

  24. #87

    Neue Updates von Ubuntu aufgenommen

  25. #86

    Neue Updates von Ubuntu aufgenommen

References