Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen Denial of Service Angriff und weitere nicht spezifizierte Angriffe durchzuführen.
Product
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Vulnerabilities 106
-
Critical 9.8
net: use sock_gen_put() when sk_state is TCP_TIME_WAIT
In the Linux kernel, the following vulnerability has been resolved: net: use sock_gen_put() when sk_state is TCP_TIME_WAIT It is possible for a pointer of type struct inet_timewait_sock to be returned from the functions __inet_lookup_established() and __inet6…
-
Critical 9.8CVE-2025-37924 EPSS 25%
ksmbd: fix use-after-free in kerberos authentication
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in kerberos authentication Setting sess->user = NULL was introduced to fix the dangling pointer created by ksmbd_free_user. However, it is possible another thread co…
-
Critical 9.8
net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM If the mtk_poll_rx() function detects the MTK_RESETTING flag, it will jump to release_desc and refill the high word of the SDP on the 4…
-
Critical 9.4
bpf: Scrub packet on bpf_redirect_peer
In the Linux kernel, the following vulnerability has been resolved: bpf: Scrub packet on bpf_redirect_peer When bpf_redirect_peer is used to redirect packets to a device in another network namespace, the skb isn't scrubbed. That can lead skb information from …
-
High 8.8CVE-2025-37899 Public exploit
ksmbd: fix use-after-free in session logoff
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in session logoff The sess->user object can currently be in use by another thread, for example if another connection has sent a session setup request to bind to the …
-
High 8.8
Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() A NULL pointer dereference can occur in skb_dequeue() when processing a QCA firmware crash dump on WCN7851 (0489:e0f3). [ 93.…
-
High 8.8
ksmbd: fix use-after-free in ksmbd_session_rpc_open
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_session_rpc_open A UAF issue can occur due to a race condition between ksmbd_session_rpc_open() and __session_rpc_close(). Add rpc_lock to the session to pr…
-
High 8.8
wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi In certain cases, hardware might provide packets with a length greater than the maximum native Wi-Fi header length. This …
-
High 8.8
wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process Currently, ath12k_dp_mon_srng_process uses ath12k_hal_srng_src_get_next_entry to fetch the next entry from the destination …
-
High 8.8CVE-2025-37947 Public exploit
ksmbd: prevent out-of-bounds stream writes by validating *pos
In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds stream writes by validating *pos ksmbd_vfs_stream_write() did not validate whether the write offset (*pos) was within the bounds of the existing stream data lengt…
-
High 8.8
ksmbd: Fix UAF in __close_file_table_ids
In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix UAF in __close_file_table_ids A use-after-free is possible if one thread destroys the file via __ksmbd_close_fd while another thread holds a reference to it. The existing checks on…
-
High 8.8
ksmbd: prevent rename with empty string
In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent rename with empty string Client can send empty newname string to ksmbd server. It will cause a kernel oops from d_alloc. This patch return the error when attempting to rename a…
-
High 8.8
KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception Previously, commit ed129ec9057f ("KVM: x86: forcibly leave nested mode on vCPU reset") addressed an issue where a triple fault occur…
-
High 8.7
perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value.
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. When generating the MSR_IA32_PEBS_ENABLE value that will be loaded on VM-Entry to a KVM guest, mask the value with th…
-
High 8.1
wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation Currently during the multi-link element defragmentation process, the multi-link element length added to the …
-
High 7.8
tracing: fprobe events: Fix possible UAF on modules
In the Linux kernel, the following vulnerability has been resolved: tracing: fprobe events: Fix possible UAF on modules Commit ac91052f0ae5 ("tracing: tprobe-events: Fix leakage of module refcount") moved try_module_get() from __find_tracepoint_module_cb() to…
-
High 7.8
irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs
In the Linux kernel, the following vulnerability has been resolved: irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs On Qualcomm chipsets not all GPIOs are wakeup capable. Those GPIOs do not have a corresponding MPM pin and should not be h…
-
High 7.8
drm/amd/display: Fix slab-use-after-free in hdcp
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix slab-use-after-free in hdcp The HDCP code in amdgpu_dm_hdcp.c copies pointers to amdgpu_dm_connector objects without incrementing the kref reference counts. When using a …
-
High 7.8
ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd
In the Linux kernel, the following vulnerability has been resolved: ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd ublk_cancel_cmd() calls io_uring_cmd_done() to complete uring_cmd, but we may have scheduled task work via io_uring_cm…
-
High 7.8
mm, slab: clean up slab->obj_exts always
In the Linux kernel, the following vulnerability has been resolved: mm, slab: clean up slab->obj_exts always When memory allocation profiling is disabled at runtime or due to an error, shutdown_mem_profiling() is called: slab->obj_exts which previously alloca…
-
High 7.8
bnxt_en: Fix out-of-bound memcpy() during ethtool -w
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix out-of-bound memcpy() during ethtool -w When retrieving the FW coredump using ethtool, it can sometimes cause memory corruption: BUG: KFENCE: memory corruption in __bnxt_get_core…
-
High 7.8
net_sched: qfq: Fix double list add in class with netem as child qdisc
In the Linux kernel, the following vulnerability has been resolved: net_sched: qfq: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue…
-
High 7.8
net_sched: ets: Fix double list add in class with netem as child qdisc
In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue…
-
High 7.8
net_sched: drr: Fix double list add in class with netem as child qdisc
In the Linux kernel, the following vulnerability has been resolved: net_sched: drr: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue…
-
High 7.8
xsk: Fix race condition in AF_XDP generic RX path
In the Linux kernel, the following vulnerability has been resolved: xsk: Fix race condition in AF_XDP generic RX path Move rx_lock from xsk_socket to xsk_buff_pool. Fix synchronization for shared umem mode in generic RX path where multiple sockets share singl…
-
High 7.8
vxlan: vnifilter: Fix unlocked deletion of default FDB entry
In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: Fix unlocked deletion of default FDB entry When a VNI is deleted from a VXLAN device in 'vnifilter' mode, the FDB entry associated with the default remote (assuming one was …
-
High 7.8
tracing: Fix oob write in trace_seq_to_buffer()
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix oob write in trace_seq_to_buffer() syzbot reported this bug: ================================================================== BUG: KASAN: slab-out-of-bounds in trace_seq_to_buf…
-
High 7.8
xenbus: Use kref to track req lifetime
In the Linux kernel, the following vulnerability has been resolved: xenbus: Use kref to track req lifetime Marek reported seeing a NULL pointer fault in the xenbus_thread callstack: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: e030:__w…
-
High 7.8
x86/mm: Eliminate window where TLB flushes may be inadvertently skipped
In the Linux kernel, the following vulnerability has been resolved: x86/mm: Eliminate window where TLB flushes may be inadvertently skipped tl;dr: There is a window in the mm switching code where the new CR3 is set and the CPU should be getting TLB flushes fo…
-
High 7.8
scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set If dma-coherent property isn't set then descriptors are non-cacheable and the iocc shareability bits should be disabled. Wit…
-
High 7.8
ASoC: qcom: Fix sc7280 lpass potential buffer overflow
In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: Fix sc7280 lpass potential buffer overflow Case values introduced in commit 5f78e1fb7a3e ("ASoC: qcom: Add driver support for audioreach solution") cause out of bounds access in a…
-
High 7.8
fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount()
In the Linux kernel, the following vulnerability has been resolved: fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() Normally do_lock_mount(path, _) is locking a mountpoint pinned by *path and at the time when matching unlock_mount() unlo…
-
High 7.5
net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll Use spin_lock_irqsave and spin_unlock_irqrestore instead of spin_lock and spin_unlock in mtk_star_emac driver to avoi…
-
High 7.5
smb: client: Avoid race in open_cached_dir with lease breaks
In the Linux kernel, the following vulnerability has been resolved: smb: client: Avoid race in open_cached_dir with lease breaks A pre-existing valid cfid returned from find_or_create_cached_dir might race with a lease break, meaning open_cached_dir doesn't c…
-
High 7.3
btrfs: adjust subpage bit start based on sectorsize
In the Linux kernel, the following vulnerability has been resolved: btrfs: adjust subpage bit start based on sectorsize When running machines with 64k page size and a 16k nodesize we started seeing tree log corruption in production. This turned out to be beca…
-
High 7.1
tracing: Verify event formats that have "%*p.."
In the Linux kernel, the following vulnerability has been resolved: tracing: Verify event formats that have "%*p.." The trace event verifier checks the formats of trace events to make sure that they do not point at memory that is not in the trace event itself…
-
High 7.0
crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP()
In the Linux kernel, the following vulnerability has been resolved: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() Herbert notes that DIV_ROUND_UP() may overflow unnecessarily if an ecdsa implementation's ->key_size() callback returns an u…
-
Unscored —
mtd: rawnand: brcmnand: fix PM resume warning
In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: brcmnand: fix PM resume warning Fixed warning on PM resume as shown below caused due to uninitialized struct nand_operation that checks chip select field : WARN_ON(op->cs >= nan…
-
Unscored —
pm: cpupower: bench: Prevent NULL dereference on malloc failure
In the Linux kernel, the following vulnerability has been resolved: pm: cpupower: bench: Prevent NULL dereference on malloc failure If malloc returns NULL due to low memory, 'config' pointer can be NULL. Add a check to prevent NULL dereference.
-
Unscored —
spi: fsl-qspi: use devm function instead of driver remove
In the Linux kernel, the following vulnerability has been resolved: spi: fsl-qspi: use devm function instead of driver remove Driver use devm APIs to manage clk/irq/resources and register the spi controller, but the legacy remove function will be called first…
-
Unscored —
PCI: pciehp: Avoid unnecessary device replacement check
In the Linux kernel, the following vulnerability has been resolved: PCI: pciehp: Avoid unnecessary device replacement check Hot-removal of nested PCI hotplug ports suffers from a long-standing race condition which can lead to a deadlock: A parent hotplug port…
-
Unscored —
cifs: avoid NULL pointer dereference in dbg call
In the Linux kernel, the following vulnerability has been resolved: cifs: avoid NULL pointer dereference in dbg call cifs_server_dbg() implies server to be non-NULL so move call under condition to avoid NULL pointer dereference. Found by Linux Verification Ce…
-
Unscored —
arm64: mops: Do not dereference src reg for a set operation
In the Linux kernel, the following vulnerability has been resolved: arm64: mops: Do not dereference src reg for a set operation The source register is not used for SET* and reading it can result in a UBSAN out-of-bounds array access error, specifically when t…
-
Unscored —
HID: pidff: Fix null pointer dereference in pidff_find_fields
In the Linux kernel, the following vulnerability has been resolved: HID: pidff: Fix null pointer dereference in pidff_find_fields This function triggered a null pointer dereference if used to search for a report that isn't implemented on the device. This happ…
-
Unscored —
net: dsa: clean up FDB, MDB, VLAN entries on unbind
In the Linux kernel, the following vulnerability has been resolved: net: dsa: clean up FDB, MDB, VLAN entries on unbind As explained in many places such as commit b117e1e8a86d ("net: dsa: delete dsa_legacy_fdb_add and dsa_legacy_fdb_del"), DSA is written give…
-
Unscored —
bnxt_en: Fix error handling path in bnxt_init_chip()
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix error handling path in bnxt_init_chip() WARN_ON() is triggered in __flush_work() if bnxt_init_chip() fails because we call cancel_work_sync() on dim work that has not been initia…
-
Unscored —
spi: spi-mem: Add fix to avoid divide error
In the Linux kernel, the following vulnerability has been resolved: spi: spi-mem: Add fix to avoid divide error For some SPI flash memory operations, dummy bytes are not mandatory. For example, in Winbond SPINAND flash memory devices, the `write_cache` and `u…
-
Unscored —
wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release
In the Linux kernel, the following vulnerability has been resolved: wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release plfxlc_mac_release() asserts that mac->lock is held. This assertion is incorrect, because even if it was possible, it would not be …
-
Unscored —
powerpc64/ftrace: fix module loading without patchable function entries
In the Linux kernel, the following vulnerability has been resolved: powerpc64/ftrace: fix module loading without patchable function entries get_stubs_size assumes that there must always be at least one patchable function entry, which is not always the case (m…
-
Unscored —
iommu: Fix two issues in iommu_copy_struct_from_user()
In the Linux kernel, the following vulnerability has been resolved: iommu: Fix two issues in iommu_copy_struct_from_user() In the review for iommu_copy_struct_to_user() helper, Matt pointed out that a NULL pointer should be rejected prior to dereferencing it:…
-
Unscored —CVE-2025-37902 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
btrfs: fix the inode leak in btrfs_iget()
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix the inode leak in btrfs_iget() [BUG] There is a bug report that a syzbot reproducer can lead to the following busy inode at unmount time: BTRFS info (device loop1): last unmount of…
-
Unscored —
firmware: arm_scmi: Balance device refcount when destroying devices
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Balance device refcount when destroying devices Using device_find_child() to lookup the proper SCMI device to destroy causes an unbalance in device refcount, since device_…
-
Unscored —
accel/ivpu: Fix locking order in ivpu_job_submit
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix locking order in ivpu_job_submit Fix deadlock in job submission and abort handling. When a thread aborts currently executing jobs due to a fault, it first locks the global loc…
-
Unscored —
net: lan743x: Fix memleak issue when GSO enabled
In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Fix memleak issue when GSO enabled Always map the `skb` to the LS descriptor. Previously skb was mapped to EXT descriptor when the number of fragments is zero with GSO enabled. …
-
Unscored —
ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations
In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations On Adva boards, SMA sysfs store/get operations can call __handle_signal_outputs() or __handle_signal_inputs() while the `irig…
-
Unscored —
ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr()
In the Linux kernel, the following vulnerability has been resolved: ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() As mentioned in the commit baeb705fd6a7 ("ice: always check VF VSI pointer values"), we need to perform a null pointer check on the r…
-
Unscored —
pds_core: remove write-after-free of client_id
In the Linux kernel, the following vulnerability has been resolved: pds_core: remove write-after-free of client_id A use-after-free error popped up in stress testing: [Mon Apr 21 21:21:33 2025] BUG: KFENCE: use-after-free write in pdsc_auxbus_dev_del+0xef/0x1…
-
Unscored —
ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot
In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot Update chip data using dev_get_drvdata(dev->parent) to fix NULL pointer deref in acp_i2s_set_tdm_slot.
-
Unscored —
book3s64/radix : Align section vmemmap start address to PAGE_SIZE
In the Linux kernel, the following vulnerability has been resolved: book3s64/radix : Align section vmemmap start address to PAGE_SIZE A vmemmap altmap is a device-provided region used to provide backing storage for struct pages. For each namespace, the altmap…
-
Unscored —
iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid There is a string parsing logic error which can lead to an overflow of hid or uid buffers. Comparing ACPIID_LEN against a total …
-
Unscored —CVE-2025-37928 Public exploit
dm-bufio: don't schedule in atomic context
In the Linux kernel, the following vulnerability has been resolved: dm-bufio: don't schedule in atomic context A BUG was reported as below when CONFIG_DEBUG_ATOMIC_SLEEP and try_verify_in_tasklet are enabled. [ 129.444685][ T934] BUG: sleeping function called…
-
Unscored —
arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays
In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays Commit a5951389e58d ("arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists") added some additional CPUs …
-
Unscored —
drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill()
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() Nouveau is mostly designed in a way that it's expected that fences only ever get signaled through nouveau_fence_signal(). However, in …
-
Unscored —
sch_htb: make htb_qlen_notify() idempotent
In the Linux kernel, the following vulnerability has been resolved: sch_htb: make htb_qlen_notify() idempotent htb_qlen_notify() always deactivates the HTB class and in fact could trigger a warning if it is already deactivated. Therefore, it is not idempotent…
-
Unscored —
octeon_ep: Fix host hang issue during device reboot
In the Linux kernel, the following vulnerability has been resolved: octeon_ep: Fix host hang issue during device reboot When the host loses heartbeat messages from the device, the driver calls the device-specific ndo_stop function, which frees the resources. …
-
Unscored —
ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction
In the Linux kernel, the following vulnerability has been resolved: ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction Actually check if the passed pointers are valid, before writing to them. This also fixes a USBAN warning: UBSAN: …
-
Unscored —
objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
In the Linux kernel, the following vulnerability has been resolved: objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() If dib8000_set_dds()'s call to dib8000_read32() returns zero, the result is a divide-by-zero. Prevent that from happening.…
-
Unscored —
libbpf: Fix accessing BTF.ext core_relo header
In the Linux kernel, the following vulnerability has been resolved: libbpf: Fix accessing BTF.ext core_relo header Update btf_ext_parse_info() to ensure the core_relo header is present before reading its fields. This avoids a potential buffer read overflow re…
-
Unscored —
ftrace: Add cond_resched() to ftrace_graph_set_hash()
In the Linux kernel, the following vulnerability has been resolved: ftrace: Add cond_resched() to ftrace_graph_set_hash() When the kernel contains a large number of functions that can be traced, the loop in ftrace_graph_set_hash() may take a lot of time to ex…
-
Unscored —
ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe()
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe() When snd_soc_dapm_new_controls() or snd_soc_dapm_add_routes() fails, wcd937x_soc_codec_probe() returns without …
-
Unscored —CVE-2025-37942 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY
In the Linux kernel, the following vulnerability has been resolved: net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY DSA has 2 kinds of drivers: 1. Those who call dsa_switch_suspend() and dsa_switch_resume() from their de…
-
Unscored —
s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs
In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs With commit bcb5d6c76903 ("s390/pci: introduce lock to synchronize state of zpci_dev's") the code to ignore power…
-
Unscored —
arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs
In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs A malicious BPF program may manipulate the branch history to influence what the hardware speculates will happen next. On exit …
-
Unscored —
ocfs2: fix panic in failed foilio allocation
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix panic in failed foilio allocation commit 7e119cff9d0a ("ocfs2: convert w_pages to w_folios") and commit 9a5e08652dc4b ("ocfs2: use an array of folios instead of an array of pages")…
-
Unscored —
drm/v3d: Add job to pending list if the reset was skipped
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Add job to pending list if the reset was skipped When a CL/CSD job times out, we check if the GPU has made any progress since the last timeout. If so, instead of resetting the hardwa…
-
Unscored —
sch_htb: make htb_deactivate() idempotent
In the Linux kernel, the following vulnerability has been resolved: sch_htb: make htb_deactivate() idempotent Alan reported a NULL pointer dereference in htb_next_rb_node() after we made htb_qlen_notify() idempotent. It turns out in the following case it intr…
-
Unscored —
virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable()
In the Linux kernel, the following vulnerability has been resolved: virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable() The selftests added to our CI by Bui Quang Minh recently reveals that there is a mem leak on the error path of virtnet_xsk_poo…
-
Unscored —
mm/huge_memory: fix dereferencing invalid pmd migration entry
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix dereferencing invalid pmd migration entry When migrating a THP, concurrent access to the PMD migration entry during a deferred split scan can lead to an invalid address ac…
-
Unscored —
memblock: Accept allocated memory before use in memblock_double_array()
In the Linux kernel, the following vulnerability has been resolved: memblock: Accept allocated memory before use in memblock_double_array() When increasing the array size in memblock_double_array() and the slab is not yet available, a call to memblock_find_in…
-
Unscored —
ipvs: fix uninit-value for saddr in do_output_route4
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix uninit-value for saddr in do_output_route4 syzbot reports for uninit-value for the saddr argument [1]. commit 4754957f04f5 ("ipvs: do not use random local source address for tunnels…
-
Unscored —
ksmbd: fix memory leak in parse_lease_state()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix memory leak in parse_lease_state() The previous patch that added bounds check for create lease context introduced a memory leak. When the bounds check fails, the function returns N…
-
Unscored —
arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users
In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users Support for eBPF programs loaded by unprivileged users is typically disabled. This means only cBPF programs need to be mit…
-
Unscored —
drm/amd/display: Fix invalid context error in dml helper
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix invalid context error in dml helper [Why] "BUG: sleeping function called from invalid context" error. after: "drm/amd/display: Protect FPU in dml2_validate()/dml21_valida…
-
Unscored —
riscv: Fix kernel crash due to PR_SET_TAGGED_ADDR_CTRL
In the Linux kernel, the following vulnerability has been resolved: riscv: Fix kernel crash due to PR_SET_TAGGED_ADDR_CTRL When userspace does PR_SET_TAGGED_ADDR_CTRL, but Supm extension is not available, the kernel crashes: Oops - illegal instruction [#1] [s…
-
Unscored —
usb: typec: ucsi: displayport: Fix deadlock
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix deadlock This patch introduces the ucsi_con_mutex_lock / ucsi_con_mutex_unlock functions to the UCSI driver. ucsi_con_mutex_lock ensures the connector mutex…
-
Unscored —
iio: light: opt3001: fix deadlock due to concurrent flag access
In the Linux kernel, the following vulnerability has been resolved: iio: light: opt3001: fix deadlock due to concurrent flag access The threaded IRQ function in this driver is reading the flag twice: once to lock a mutex and once to unlock it. Even though the…
-
Unscored —
iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo
In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo Prevent st_lsm6dsx_read_tagged_fifo from falling in an infinite loop in case pattern_len is equal to zero and the devi…
-
Unscored —
iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo
In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo Prevent st_lsm6dsx_read_fifo from falling in an infinite loop in case pattern_len is equal to zero and the device FIFO is not…
-
Unscored —
staging: bcm2835-camera: Initialise dev in v4l2_dev
In the Linux kernel, the following vulnerability has been resolved: staging: bcm2835-camera: Initialise dev in v4l2_dev Commit 42a2f6664e18 ("staging: vc04_services: Move global g_state to vchiq_state") changed mmal_init to pass dev->v4l2_dev.dev to vchiq_mma…
-
Unscored —
Input: mtk-pmic-keys - fix possible null pointer dereference
In the Linux kernel, the following vulnerability has been resolved: Input: mtk-pmic-keys - fix possible null pointer dereference In mtk_pmic_keys_probe, the regs parameter is only set if the button is parsed in the device tree. However, on hardware where the …
-
Unscored —
s390/pci: Fix missing check for zpci_create_device() error return
In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix missing check for zpci_create_device() error return The zpci_create_device() function returns an error pointer that needs to be checked before dereferencing it as a struct zpci_…
-
Unscored —
riscv: module: Fix out-of-bounds relocation access
In the Linux kernel, the following vulnerability has been resolved: riscv: module: Fix out-of-bounds relocation access The current code allows rel[j] to access one element past the end of the relocation section. Simplify to num_relocations which is equivalent…
-
Unscored —CVE-2025-37976 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
block: integrity: Do not call set_page_dirty_lock()
In the Linux kernel, the following vulnerability has been resolved: block: integrity: Do not call set_page_dirty_lock() Placing multiple protection information buffers inside the same page can lead to oopses because set_page_dirty_lock() can't be called from …
-
Unscored —
block: fix resource leak in blk_register_queue() error path
In the Linux kernel, the following vulnerability has been resolved: block: fix resource leak in blk_register_queue() error path When registering a queue fails after blk_mq_sysfs_register() is successful but the function later encounters an error, we need to c…
-
Unscored —
scsi: smartpqi: Use is_kdump_kernel() to check for kdump
In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Use is_kdump_kernel() to check for kdump The smartpqi driver checks the reset_devices variable to determine whether special adjustments need to be made for kdump. This has the…
-
Unscored —
wifi: wl1251: fix memory leak in wl1251_tx_work
In the Linux kernel, the following vulnerability has been resolved: wifi: wl1251: fix memory leak in wl1251_tx_work The skb dequeued from tx_queue is lost when wl1251_ps_elp_wakeup fails with a -ETIMEDOUT error. Fix that by queueing the skb back to tx_queue.
-
Unscored —
qibfs: fix _another_ leak
In the Linux kernel, the following vulnerability has been resolved: qibfs: fix _another_ leak failure to allocate inode => leaked dentry... this one had been there since the initial merge; to be fair, if we are that far OOM, the odds of failing at that partic…
-
Unscored —
USB: wdm: close race between wdm_open and wdm_wwan_port_stop
In the Linux kernel, the following vulnerability has been resolved: USB: wdm: close race between wdm_open and wdm_wwan_port_stop Clearing WDM_WWAN_IN_USE must be the last action or we can open a chardev whose URBs are still poisoned
-
Unscored —
usb: typec: class: Invalidate USB device pointers on partner unregistration
In the Linux kernel, the following vulnerability has been resolved: usb: typec: class: Invalidate USB device pointers on partner unregistration To avoid using invalid USB device pointers after a Type-C partner disconnects, this patch clears the pointers upon …
-
Unscored —
pds_core: Prevent possible adminq overflow/stuck condition
In the Linux kernel, the following vulnerability has been resolved: pds_core: Prevent possible adminq overflow/stuck condition The pds_core's adminq is protected by the adminq_lock, which prevents more than 1 command to be posted onto it at any one time. This…
-
Unscored —
net: phy: leds: fix memory leak
In the Linux kernel, the following vulnerability has been resolved: net: phy: leds: fix memory leak A network restart test on a router led to an out-of-memory condition, which was traced to a memory leak in the PHY LED trigger code. The root cause is misuse o…
-
Unscored —
wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage()
In the Linux kernel, the following vulnerability has been resolved: wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() The function brcmf_usb_dl_writeimage() calls the function brcmf_usb_dl_cmd() but dose not check its return value. The '…
-
Unscored —
parisc: Fix double SIGFPE crash
In the Linux kernel, the following vulnerability has been resolved: parisc: Fix double SIGFPE crash Camm noticed that on parisc a SIGFPE exception will crash an application with a second SIGFPE in the signal handler. Dave analyzed it, and it happens because g…
Revision history
-
#146
Neue Updates von Debian aufgenommen
-
#145
Neue Updates von Ubuntu aufgenommen
-
#144
Neue Updates von Debian aufgenommen
-
#143
Neue Updates von Ubuntu aufgenommen
-
#142
Neue Updates von Dell aufgenommen
-
#141
Neue Updates von Amazon aufgenommen
-
#140
Neue Updates von Ubuntu aufgenommen
-
#139
Neue Updates von Oracle Linux aufgenommen
-
#138
Neue Updates von Ubuntu aufgenommen
-
#137
Neue Updates von Siemens aufgenommen
-
#136
Neue Updates von Ubuntu aufgenommen
-
#135
Neue Updates von Debian aufgenommen
-
#134
Neue Updates von Ubuntu aufgenommen
-
#133
Neue Updates von Ubuntu aufgenommen
-
#132
Neue Updates von Oracle Linux aufgenommen
-
#131
Neue Updates von Ubuntu aufgenommen
-
#130
Neue Updates von Ubuntu aufgenommen
-
#129
Neue Updates von Ubuntu und Red Hat aufgenommen
-
#128
Neue Updates von Red Hat aufgenommen
-
#127
Neue Updates von Dell aufgenommen
-
#126
Neue Updates von Debian aufgenommen
-
#125
Neue Updates von Oracle Linux aufgenommen
-
#124
Neue Updates von Ubuntu aufgenommen
-
#123
Neue Updates von Ubuntu aufgenommen
-
#122
Neue Updates von Debian aufgenommen
References
-
Kernel CVE Announce Mailingliste
https://lore.kernel.org/linux-cve-announce/
-
Linux Kernel CVE Announcement CVE-2025-37840
https://lore.kernel.org/linux-cve-announce/2025050915-CVE-2025-37840-2e44@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37841
https://lore.kernel.org/linux-cve-announce/2025050915-CVE-2025-37841-1954@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37842
https://lore.kernel.org/linux-cve-announce/2025050916-CVE-2025-37842-8da3@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37843
https://lore.kernel.org/linux-cve-announce/2025050916-CVE-2025-37843-6b22@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37844
https://lore.kernel.org/linux-cve-announce/2025050917-CVE-2025-37844-f733@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37845
https://lore.kernel.org/linux-cve-announce/2025050917-CVE-2025-37845-c06f@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37846
https://lore.kernel.org/linux-cve-announce/2025050917-CVE-2025-37846-9afa@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37862
https://lore.kernel.org/linux-cve-announce/2025050923-CVE-2025-37862-73e0@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37864
https://lore.kernel.org/linux-cve-announce/2025050957-CVE-2025-37864-ffd5@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37894
https://lore.kernel.org/linux-cve-announce/2025052051-CVE-2025-37894-8210@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37895
https://lore.kernel.org/linux-cve-announce/2025052053-CVE-2025-37895-7dfb@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37896
https://lore.kernel.org/linux-cve-announce/2025052053-CVE-2025-37896-d623@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37897
https://lore.kernel.org/linux-cve-announce/2025052054-CVE-2025-37897-3146@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37898
https://lore.kernel.org/linux-cve-announce/2025052054-CVE-2025-37898-a5ea@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37899
https://lore.kernel.org/linux-cve-announce/2025052055-CVE-2025-37899-7366@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37900
https://lore.kernel.org/linux-cve-announce/2025052055-CVE-2025-37900-717c@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37901
https://lore.kernel.org/linux-cve-announce/2025052055-CVE-2025-37901-1498@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37902
https://lore.kernel.org/linux-cve-announce/2025052056-CVE-2025-37902-40c3@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37903
https://lore.kernel.org/linux-cve-announce/2025052056-CVE-2025-37903-7d1f@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37904
https://lore.kernel.org/linux-cve-announce/2025052056-CVE-2025-37904-f401@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37905
https://lore.kernel.org/linux-cve-announce/2025052057-CVE-2025-37905-ed8c@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37906
https://lore.kernel.org/linux-cve-announce/2025052057-CVE-2025-37906-0bd6@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37907
https://lore.kernel.org/linux-cve-announce/2025052057-CVE-2025-37907-7b62@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37908
https://lore.kernel.org/linux-cve-announce/2025052058-CVE-2025-37908-5e14@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37909
https://lore.kernel.org/linux-cve-announce/2025052058-CVE-2025-37909-f6da@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37910
https://lore.kernel.org/linux-cve-announce/2025052058-CVE-2025-37910-bf5d@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37911
https://lore.kernel.org/linux-cve-announce/2025052059-CVE-2025-37911-3da7@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37912
https://lore.kernel.org/linux-cve-announce/2025052059-CVE-2025-37912-2b82@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37913
https://lore.kernel.org/linux-cve-announce/2025052000-CVE-2025-37913-95be@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37914
https://lore.kernel.org/linux-cve-announce/2025052000-CVE-2025-37914-1a4f@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37915
https://lore.kernel.org/linux-cve-announce/2025052000-CVE-2025-37915-83e3@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37916
https://lore.kernel.org/linux-cve-announce/2025052001-CVE-2025-37916-55c4@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37917
https://lore.kernel.org/linux-cve-announce/2025052001-CVE-2025-37917-d12e@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37918
https://lore.kernel.org/linux-cve-announce/2025052001-CVE-2025-37918-db24@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37919
https://lore.kernel.org/linux-cve-announce/2025052002-CVE-2025-37919-d839@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37920
https://lore.kernel.org/linux-cve-announce/2025052002-CVE-2025-37920-304d@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37921
https://lore.kernel.org/linux-cve-announce/2025052002-CVE-2025-37921-bee5@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37922
https://lore.kernel.org/linux-cve-announce/2025052003-CVE-2025-37922-7cb7@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37923
https://lore.kernel.org/linux-cve-announce/2025052003-CVE-2025-37923-1bbf@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37924
https://lore.kernel.org/linux-cve-announce/2025052004-CVE-2025-37924-ec7d@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37926
https://lore.kernel.org/linux-cve-announce/2025052004-CVE-2025-37926-cf39@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37927
https://lore.kernel.org/linux-cve-announce/2025052004-CVE-2025-37927-5e21@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37928
https://lore.kernel.org/linux-cve-announce/2025052005-CVE-2025-37928-66d3@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37929
https://lore.kernel.org/linux-cve-announce/2025052005-CVE-2025-37929-2511@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37930
https://lore.kernel.org/linux-cve-announce/2025052005-CVE-2025-37930-24fe@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37931
https://lore.kernel.org/linux-cve-announce/2025052006-CVE-2025-37931-e247@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37932
https://lore.kernel.org/linux-cve-announce/2025052006-CVE-2025-37932-0842@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37933
https://lore.kernel.org/linux-cve-announce/2025052006-CVE-2025-37933-55f4@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37934
https://lore.kernel.org/linux-cve-announce/2025052007-CVE-2025-37934-9436@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37935
https://lore.kernel.org/linux-cve-announce/2025052007-CVE-2025-37935-4320@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37936
https://lore.kernel.org/linux-cve-announce/2025052008-CVE-2025-37936-a210@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37937
https://lore.kernel.org/linux-cve-announce/2025052044-CVE-2025-37937-3de0@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37938
https://lore.kernel.org/linux-cve-announce/2025052047-CVE-2025-37938-30a4@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37939
https://lore.kernel.org/linux-cve-announce/2025052047-CVE-2025-37939-8398@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37940
https://lore.kernel.org/linux-cve-announce/2025052028-CVE-2025-37940-37d1@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37941
https://lore.kernel.org/linux-cve-announce/2025052038-CVE-2025-37941-1802@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37942
https://lore.kernel.org/linux-cve-announce/2025052043-CVE-2025-37942-fbca@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37943
https://lore.kernel.org/linux-cve-announce/2025052043-CVE-2025-37943-9cf8@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37944
https://lore.kernel.org/linux-cve-announce/2025052044-CVE-2025-37944-5e94@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37945
https://lore.kernel.org/linux-cve-announce/2025052044-CVE-2025-37945-7849@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37946
https://lore.kernel.org/linux-cve-announce/2025052059-CVE-2025-37946-e1e3@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37947
https://lore.kernel.org/linux-cve-announce/2025052059-CVE-2025-37947-8c07@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37948
https://lore.kernel.org/linux-cve-announce/2025052000-CVE-2025-37948-2f8d@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37949
https://lore.kernel.org/linux-cve-announce/2025052000-CVE-2025-37949-c272@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37950
https://lore.kernel.org/linux-cve-announce/2025052000-CVE-2025-37950-2a1f@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37951
https://lore.kernel.org/linux-cve-announce/2025052001-CVE-2025-37951-1e36@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37952
https://lore.kernel.org/linux-cve-announce/2025052001-CVE-2025-37952-299d@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37953
https://lore.kernel.org/linux-cve-announce/2025052001-CVE-2025-37953-d825@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37954
https://lore.kernel.org/linux-cve-announce/2025052002-CVE-2025-37954-6751@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37955
https://lore.kernel.org/linux-cve-announce/2025052002-CVE-2025-37955-5733@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37956
https://lore.kernel.org/linux-cve-announce/2025052002-CVE-2025-37956-a6aa@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37957
https://lore.kernel.org/linux-cve-announce/2025052003-CVE-2025-37957-e23c@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37958
https://lore.kernel.org/linux-cve-announce/2025052003-CVE-2025-37958-02de@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37959
https://lore.kernel.org/linux-cve-announce/2025052004-CVE-2025-37959-1d15@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37960
https://lore.kernel.org/linux-cve-announce/2025052004-CVE-2025-37960-97de@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37961
https://lore.kernel.org/linux-cve-announce/2025052004-CVE-2025-37961-e39b@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37962
https://lore.kernel.org/linux-cve-announce/2025052005-CVE-2025-37962-9f38@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37963
https://lore.kernel.org/linux-cve-announce/2025052005-CVE-2025-37963-60f2@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-37964
https://lore.kernel.org/linux-cve-announce/2025052005-CVE-2025-37964-6372@gregkh/