Summary
Ein lokaler Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen und andere, nicht spezifizierte Auswirkungen zu verursachen.
Product
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Vulnerabilities 81
-
Critical 9.8
net: wwan: t7xx: Fix napi rx poll issue
In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: Fix napi rx poll issue When driver handles the napi rx polling requests, the netdev might have been released by the dellink logic triggered by the disconnect operation on use…
-
Critical 9.8
netfs: Fix oops in write-retry from mis-resetting the subreq iterator
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix oops in write-retry from mis-resetting the subreq iterator Fix the resetting of the subrequest iterator in netfs_retry_write_stream() to use the iterator-reset function as the iter…
-
Critical 9.4
netfilter: nf_set_pipapo_avx2: fix initial map fill
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_set_pipapo_avx2: fix initial map fill If the first field doesn't cover the entire start map, then we must zero out the remainder, else we leak those bits into the next match rou…
-
Critical 9.4
net: openvswitch: Fix the dead loop of MPLS parse
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix the dead loop of MPLS parse The unexpected MPLS packet may not end with the bottom label stack. When there are many stacks, The label count value has wrapped around. A d…
-
High 8.8
ksmbd: use list_first_entry_or_null for opinfo_get_list()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: use list_first_entry_or_null for opinfo_get_list() The list_first_entry() macro never returns NULL. If the list is empty then it returns an invalid pointer. Use list_first_entry_or_nul…
-
High 7.8
dma-buf: insert memory barrier before updating num_fences
In the Linux kernel, the following vulnerability has been resolved: dma-buf: insert memory barrier before updating num_fences smp_store_mb() inserts memory barrier after storing operation. It is different with what the comment is originally aiming so Null poi…
-
High 7.8
espintcp: remove encap socket caching to avoid reference leak
In the Linux kernel, the following vulnerability has been resolved: espintcp: remove encap socket caching to avoid reference leak The current scheme for caching the encap socket can lead to reference leaks when we try to delete the netns. The reference chain …
-
High 7.8
drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink Don't try to operate on a drm_wb_connector as an amdgpu_dm_connector. While dereferencing aconnector->…
-
High 7.8
ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set()
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() Enlarge the critical section in ring_buffer_subbuf_order_set() to ensure that error handling takes place with per-buffer mute…
-
High 7.8
VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify
In the Linux kernel, the following vulnerability has been resolved: VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify During our test, it is found that a warning can be trigger in try_grab_folio as follow: ------------[ cut here ]-------…
-
High 7.8
io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo()
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo() syzbot reports: BUG: KASAN: slab-use-after-free in getrusage+0x1109/0x1a60 Read of size 8 at addr ffff88810de2d2c8 by ta…
-
High 7.8
net_sched: ets: fix a race in ets_qdisc_change()
In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: fix a race in ets_qdisc_change() Gerrard Tai reported a race condition in ETS, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: loc…
-
High 7.8
net_sched: red: fix a race in __red_change()
In the Linux kernel, the following vulnerability has been resolved: net_sched: red: fix a race in __red_change() Gerrard Tai reported a race condition in RED, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock ro…
-
High 7.8
net/mdiobus: Fix potential out-of-bounds clause 45 read/write access
In the Linux kernel, the following vulnerability has been resolved: net/mdiobus: Fix potential out-of-bounds clause 45 read/write access When using publicly available tools like 'mdio-tools' to read/write data from/to network interface and its PHY via C45 (cl…
-
High 7.8
net/mdiobus: Fix potential out-of-bounds read/write access
In the Linux kernel, the following vulnerability has been resolved: net/mdiobus: Fix potential out-of-bounds read/write access When using publicly available tools like 'mdio-tools' to read/write data from/to network interface and its PHY via mdiobus, there is…
-
High 7.8
net_sched: sch_sfq: fix a potential crash on gso_skb handling
In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: fix a potential crash on gso_skb handling SFQ has an assumption of always being able to queue at least one packet. However, after the blamed commit, sch->q.len can be infl…
-
High 7.8
wifi: ath12k: fix uaf in ath12k_core_init()
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix uaf in ath12k_core_init() When the execution of ath12k_core_hw_group_assign() or ath12k_core_hw_group_create() fails, the registered notifier chain is not unregistered prope…
-
High 7.8
Bluetooth: MGMT: Protect mgmt_pending list with its own lock
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Protect mgmt_pending list with its own lock This uses a mutex to protect from concurrent access of mgmt_pending list which can cause crashes like: ===========================…
-
High 7.8
Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete This reworks MGMT_OP_REMOVE_ADV_MONITOR to not use mgmt_pending_add to avoid crashes like bellow: ================================…
-
High 7.8
ice: fix Tx scheduler error handling in XDP callback
In the Linux kernel, the following vulnerability has been resolved: ice: fix Tx scheduler error handling in XDP callback When the XDP program is loaded, the XDP callback adds new Tx queues. This means that the callback must update the Tx scheduler with the ne…
-
High 7.8
page_pool: Fix use-after-free in page_pool_recycle_in_ring
In the Linux kernel, the following vulnerability has been resolved: page_pool: Fix use-after-free in page_pool_recycle_in_ring syzbot reported a uaf in page_pool_recycle_in_ring: BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 kernel/locking/lockd…
-
High 7.8
iio: adc: ad4851: fix ad4858 chan pointer handling
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad4851: fix ad4858 chan pointer handling The pointer returned from ad4851_parse_channels_common() is incremented internally as each channel is populated. In ad4858_parse_channels(),…
-
High 7.8
dm: fix dm_blk_report_zones
In the Linux kernel, the following vulnerability has been resolved: dm: fix dm_blk_report_zones If dm_get_live_table() returned NULL, dm_put_live_table() was never called. Also, it is possible that md->zone_revalidate_map will change while calling this functi…
-
High 7.8
af_packet: move notifier's packet_dev_mc out of rcu critical section
In the Linux kernel, the following vulnerability has been resolved: af_packet: move notifier's packet_dev_mc out of rcu critical section Syzkaller reports the following issue: BUG: sleeping function called from invalid context at kernel/locking/mutex.c:578 __…
-
High 7.8
bpf, sockmap: Avoid using sk_socket after free when sending
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Avoid using sk_socket after free when sending The sk->sk_socket is not locked or referenced in backlog thread, and during the call to skb_send_sock(), there is a race condition …
-
High 7.8
RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction Upon RQ destruction if the firmware command fails which is the last resource to be destroyed some SW resources were already …
-
High 7.8
netfilter: nft_set_pipapo: prevent overflow in lookup table allocation
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: prevent overflow in lookup table allocation When calculating the lookup table size, ensure the following multiplication does not overflow: - desc->field_len[] maxim…
-
High 7.8
bpf: fix ktls panic with sockmap
In the Linux kernel, the following vulnerability has been resolved: bpf: fix ktls panic with sockmap [ 2172.936997] ------------[ cut here ]------------ [ 2172.936999] kernel BUG at lib/iov_iter.c:629! ...... [ 2172.944996] PKRU: 55555554 [ 2172.945155] Call …
-
High 7.8
perf: arm-ni: Unregister PMUs on probe failure
In the Linux kernel, the following vulnerability has been resolved: perf: arm-ni: Unregister PMUs on probe failure When a resource allocation fails in one clock domain of an NI device, we need to properly roll back all previously registered perf PMUs in other…
-
High 7.8
arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP
In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP On system with SME, a thread's kernel FPSIMD state may be erroneously clobbered during a context switch immediately after that s…
-
High 7.8
erofs: avoid using multiple devices with different type
In the Linux kernel, the following vulnerability has been resolved: erofs: avoid using multiple devices with different type For multiple devices, both primary and extra devices should be the same type. `erofs_init_device` has already guaranteed that if the pr…
-
High 7.8
crypto: marvell/cesa - Handle zero-length skcipher requests
In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/cesa - Handle zero-length skcipher requests Do not access random memory for zero-length skcipher requests. Just return 0.
-
High 7.5
net: fix udp gso skb_segment after pull from frag_list
In the Linux kernel, the following vulnerability has been resolved: net: fix udp gso skb_segment after pull from frag_list Commit a1e40ac5b5e9 ("net: gso: fix udp gso fraglist segmentation after pull from frag_list") detected invalid geometry in frag_list skb…
-
High 7.5
bpf, sockmap: Fix panic when calling skb_linearize
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix panic when calling skb_linearize The panic can be reproduced by executing the command: ./bench sockmap -c 2 -p 1 -a --rx-verdict-ingress --rx-strp 100000 Then a kernel panic…
-
High 7.1
f2fs: zone: fix to avoid inconsistence in between SIT and SSA
In the Linux kernel, the following vulnerability has been resolved: f2fs: zone: fix to avoid inconsistence in between SIT and SSA w/ below testcase, it will cause inconsistence in between SIT and SSA. create_null_blk 512 2 1024 1024 mkfs.f2fs -m /dev/nullb0 m…
-
Unscored —
drm/amd/display: check stream id dml21 wrapper to get plane_id
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check stream id dml21 wrapper to get plane_id [Why & How] Fix a false positive warning which occurs due to lack of correct checks when querying plane_id in DML21. This fixes …
-
Unscored —
arm64: dts: qcom: x1e80100: Add GPU cooling
In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: x1e80100: Add GPU cooling Unlike the CPU, the GPU does not throttle its speed automatically when it reaches high temperatures. With certain high GPU loads it is possible to …
-
Unscored —
net: cadence: macb: Fix a possible deadlock in macb_halt_tx.
In the Linux kernel, the following vulnerability has been resolved: net: cadence: macb: Fix a possible deadlock in macb_halt_tx. There is a situation where after THALT is set high, TGO stays high as well. Because jiffies are never updated, as we are in a cont…
-
Unscored —
wifi: iwlwifi: don't warn when if there is a FW error
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: don't warn when if there is a FW error iwl_trans_reclaim is warning if it is called when the FW is not alive. But if it is called when there is a pending restart, i.e. after a …
-
Unscored —
Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken A SCO connection without the proper voice_setting can cause the controller to lock up.
-
Unscored —
x86/iopl: Cure TIF_IO_BITMAP inconsistencies
In the Linux kernel, the following vulnerability has been resolved: x86/iopl: Cure TIF_IO_BITMAP inconsistencies io_bitmap_exit() is invoked from exit_thread() when a task exists or when a fork fails. In the latter case the exit_thread() cleans up resources w…
-
Unscored —
HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() Update struct hid_descriptor to better reflect the mandatory and optional parts of the HID Descriptor as per USB HID 1.11 …
-
Unscored —
ALSA: usb-audio: Kill timer properly at removal
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill timer properly at removal The USB-audio MIDI code initializes the timer, but in a rare case, the driver might be freed without the disconnect call. This leaves the timer…
-
Unscored —
net/mlx5: Fix ECVF vports unload on shutdown flow
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix ECVF vports unload on shutdown flow Fix shutdown flow UAF when a virtual function is created on the embedded chip (ECVF) of a BlueField device. In such case the vport acl ingres…
-
Unscored —
net: Fix TOCTOU issue in sk_is_readable()
In the Linux kernel, the following vulnerability has been resolved: net: Fix TOCTOU issue in sk_is_readable() sk->sk_prot->sock_is_readable is a valid function pointer when sk resides in a sockmap. After the last sk_psock_put() (which usually happens when soc…
-
Unscored —
ACPI: CPPC: Fix NULL pointer dereference when nosmp is used
In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Fix NULL pointer dereference when nosmp is used With nosmp in cmdline, other CPUs are not brought up, leaving their cpc_desc_ptr NULL. CPU0's iteration via for_each_possible_cpu()…
-
Unscored —
e1000: Move cancel_work_sync to avoid deadlock
In the Linux kernel, the following vulnerability has been resolved: e1000: Move cancel_work_sync to avoid deadlock Previously, e1000_down called cancel_work_sync for the e1000 reset task (via e1000_down_and_stop), which takes RTNL. As reported by users and sy…
-
Unscored —
scsi: core: ufs: Fix a hang in the error handler
In the Linux kernel, the following vulnerability has been resolved: scsi: core: ufs: Fix a hang in the error handler ufshcd_err_handling_prepare() calls ufshcd_rpm_get_sync(). The latter function can only succeed if UFSHCD_EH_IN_PROGRESS is not set because re…
-
Unscored —
wifi: iwlwifi: mld: avoid panic on init failure
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: avoid panic on init failure In case of an error during init, in_hw_restart will be set, but it will never get cleared. Instead, we will retry to init again, and then we wi…
-
Unscored —
gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO
In the Linux kernel, the following vulnerability has been resolved: gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO gve_alloc_pending_packet() can return NULL, but gve_tx_add_skb_dqo() did not check for this case before dereferencing the …
-
Unscored —
net: stmmac: make sure that ptp_rate is not 0 before configuring EST
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: make sure that ptp_rate is not 0 before configuring EST If the ptp_rate recorded earlier in the driver happens to be 0, this bogus value will propagate up to EST configuration, w…
-
Unscored —
net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping The stmmac platform drivers that do not open-code the clk_ptp_rate value after having retrieved the default one f…
-
Unscored —
Bluetooth: MGMT: reject malformed HCI_CMD_SYNC commands
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject malformed HCI_CMD_SYNC commands In 'mgmt_hci_cmd_sync()', check whether the size of parameters passed in 'struct mgmt_cp_hci_cmd_sync' matches the total size of the da…
-
Unscored —
drm/connector: only call HDMI audio helper plugged cb if non-null
In the Linux kernel, the following vulnerability has been resolved: drm/connector: only call HDMI audio helper plugged cb if non-null On driver remove, sound/soc/codecs/hdmi-codec.c calls the plugged_cb with NULL as the callback function and codec_dev, as see…
-
Unscored —
coresight: prevent deactivate active config while enabling the config
In the Linux kernel, the following vulnerability has been resolved: coresight: prevent deactivate active config while enabling the config While enable active config via cscfg_csdev_enable_active_config(), active config could be deactivated via configfs' sysfs…
-
Unscored —
coresight: holding cscfg_csdev_lock while removing cscfg from csdev
In the Linux kernel, the following vulnerability has been resolved: coresight: holding cscfg_csdev_lock while removing cscfg from csdev There'll be possible race scenario for coresight config: CPU0 CPU1 (perf enable) load module cscfg_load_config_sets() activ…
-
Unscored —
usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink()
In the Linux kernel, the following vulnerability has been resolved: usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() As demonstrated by the fix for update_port_device_state, commit 12783c0b9e2c ("usb: core: Prevent null pointer deref…
-
Unscored —
serial: Fix potential null-ptr-deref in mlb_usio_probe()
In the Linux kernel, the following vulnerability has been resolved: serial: Fix potential null-ptr-deref in mlb_usio_probe() devm_ioremap() can return NULL on error. Currently, mlb_usio_probe() does not check for this case, which could result in a NULL pointe…
-
Unscored —
usb: renesas_usbhs: Reorder clock handling and power management in probe
In the Linux kernel, the following vulnerability has been resolved: usb: renesas_usbhs: Reorder clock handling and power management in probe Reorder the initialization sequence in `usbhs_probe()` to enable runtime PM before accessing registers, preventing pot…
-
Unscored —
PCI/pwrctrl: Cancel outstanding rescan work when unregistering
In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: Cancel outstanding rescan work when unregistering It's possible to trigger use-after-free here by: (a) forcing rescan_work_func() to take a long time and (b) utilizing a pwrctrl …
-
Unscored —
dmaengine: ti: Add NULL check in udma_probe()
In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: Add NULL check in udma_probe() devm_kasprintf() returns NULL when memory allocation fails. Currently, udma_probe() does not check for this case, which results in a NULL pointer…
-
Unscored —
dm: limit swapping tables for devices with zone write plugs
In the Linux kernel, the following vulnerability has been resolved: dm: limit swapping tables for devices with zone write plugs dm_revalidate_zones() only allowed new or previously unzoned devices to call blk_revalidate_disk_zones(). If the device was already…
-
Unscored —
hwmon: (asus-ec-sensors) check sensor index in read_string()
In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus-ec-sensors) check sensor index in read_string() Prevent a potential invalid memory access when the requested sensor is not found. find_ec_sensor_index() may return a negative val…
-
Unscored —
backlight: pm8941: Add NULL check in wled_configure()
In the Linux kernel, the following vulnerability has been resolved: backlight: pm8941: Add NULL check in wled_configure() devm_kasprintf() returns NULL when memory allocation fails. Currently, wled_configure() does not check for this case, which results in a …
-
Unscored —
watchdog: lenovo_se30_wdt: Fix possible devm_ioremap() NULL pointer dereference in lenovo_se30_wdt_probe()
In the Linux kernel, the following vulnerability has been resolved: watchdog: lenovo_se30_wdt: Fix possible devm_ioremap() NULL pointer dereference in lenovo_se30_wdt_probe() devm_ioremap() returns NULL on error. Currently, lenovo_se30_wdt_probe() does not ch…
-
Unscored —
soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() devm_kasprintf() returns NULL when memory allocation fails. Currently, aspeed_lpc_enable_snoop() does not check for this case, which r…
-
Unscored —
calipso: Don't call calipso functions for AF_INET sk.
In the Linux kernel, the following vulnerability has been resolved: calipso: Don't call calipso functions for AF_INET sk. syzkaller reported a null-ptr-deref in txopt_get(). [0] The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6…
-
Unscored —
net: phy: mscc: Fix memory leak when using one step timestamping
In the Linux kernel, the following vulnerability has been resolved: net: phy: mscc: Fix memory leak when using one step timestamping Fix memory leak when running one-step timestamping. When running one-step sync timestamping, the HW is configured to insert th…
-
Unscored —
net: phy: clear phydev->devlink when the link is deleted
In the Linux kernel, the following vulnerability has been resolved: net: phy: clear phydev->devlink when the link is deleted There is a potential crash issue when disabling and re-enabling the network port. When disabling the network port, phy_detach() calls …
-
Unscored —
RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work
In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work The cited commit fixed a crash when cma_netevent_callback was called for a cma_id while work on that id from a previous call …
-
Unscored —
net: usb: aqc111: fix error handling of usbnet read calls
In the Linux kernel, the following vulnerability has been resolved: net: usb: aqc111: fix error handling of usbnet read calls Syzkaller, courtesy of syzbot, identified an error (see report [1]) in aqc111 driver, caused by incomplete sanitation of usb read cal…
-
Unscored —
wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init()
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() devm_ioremap() returns NULL on error. Currently, mt7915_mmio_wed_init() does not check for this case, which results in a NULL …
-
Unscored —
wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init()
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() devm_ioremap() returns NULL on error. Currently, mt7996_mmio_wed_init() does not check for this case, which results in a NULL …
-
Unscored —
wifi: ath9k_htc: Abort software beacon handling if disabled
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: Abort software beacon handling if disabled A malicious USB device can send a WMI_SWBA_EVENTID event from an ath9k_htc-managed device before beaconing has been enabled. This c…
-
Unscored —
hisi_acc_vfio_pci: fix XQE dma address error
In the Linux kernel, the following vulnerability has been resolved: hisi_acc_vfio_pci: fix XQE dma address error The dma addresses of EQE and AEQE are wrong after migration and results in guest kernel-mode encryption services failure. Comparing the definition…
-
Unscored —
wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6 instead of 2, since 'para' array is passed to 'rtw_fw_bt_wifi_control(rtwdev, para[0], ¶[1])', whi…
-
Unscored —
clk: bcm: rpi: Add NULL check in raspberrypi_clk_register()
In the Linux kernel, the following vulnerability has been resolved: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() devm_kasprintf() returns NULL when memory allocation fails. Currently, raspberrypi_clk_register() does not check for this case, whi…
-
Unscored —
f2fs: fix to do sanity check on sbi->total_valid_block_count
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on sbi->total_valid_block_count syzbot reported a f2fs bug as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/f2fs.h:2521! RIP: 0010:dec_valid_b…
-
Unscored —
fs/ntfs3: handle hdr_first_de() return value
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle hdr_first_de() return value The hdr_first_de() function returns a pointer to a struct NTFS_DE. This pointer may be NULL. To handle the NULL error effectively, it is important…
-
Unscored —
arm64/fpsimd: Discard stale CPU state when handling SME traps
In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: Discard stale CPU state when handling SME traps The logic for handling SME traps manipulates saved FPSIMD/SVE/SME state incorrectly, and a race with preemption can result in a t…
-
Unscored —
power: supply: max77705: Fix workqueue error handling in probe
In the Linux kernel, the following vulnerability has been resolved: power: supply: max77705: Fix workqueue error handling in probe The create_singlethread_workqueue() doesn't return error pointers, it returns NULL. Also cleanup the workqueue on the error path…
Revision history
-
#156
Neue Updates von Debian aufgenommen
-
#155
Neue Updates von Red Hat aufgenommen
-
#154
Neue Updates von Red Hat aufgenommen
-
#153
Neue Updates von Ubuntu aufgenommen
-
#152
Neue Updates von SUSE aufgenommen
-
#151
Neue Updates von Debian aufgenommen
-
#150
Neue Updates von Oracle Linux aufgenommen
-
#149
Neue Updates von Rocky Enterprise Software Foundation aufgenommen
-
#148
Neue Updates von Red Hat aufgenommen
-
#147
Neue Updates von Oracle Linux aufgenommen
-
#146
Neue Updates von Oracle Linux aufgenommen
-
#145
Neue Updates von IBM aufgenommen
-
#144
Neue Updates von Oracle Linux aufgenommen
-
#143
Neue Updates von Ubuntu aufgenommen
-
#142
Neue Updates von Debian aufgenommen
-
#141
Neue Updates von Ubuntu aufgenommen
-
#140
Neue Updates von Ubuntu aufgenommen
-
#139
Neue Updates von Ubuntu aufgenommen
-
#138
Neue Updates von Ubuntu aufgenommen
-
#137
Neue Updates von Ubuntu aufgenommen
-
#136
Neue Updates von Ubuntu aufgenommen
-
#135
Neue Updates von Ubuntu aufgenommen
-
#134
Neue Updates von IBM aufgenommen
-
#133
Neue Updates von Ubuntu aufgenommen
-
#132
Neue Updates von Siemens aufgenommen
References
-
Kernel CVE Announce Mailingliste
https://lore.kernel.org/linux-cve-announce/
-
Linux Kernel CVE Announcement CVE-2025-38091
https://lore.kernel.org/linux-cve-announce/2025070235-CVE-2025-38091-cb97@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38092
https://lore.kernel.org/linux-cve-announce/2025070237-CVE-2025-38092-70a8@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38093
https://lore.kernel.org/linux-cve-announce/2025070237-CVE-2025-38093-a615@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38094
https://lore.kernel.org/linux-cve-announce/2025070324-CVE-2025-38094-1b5c@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38095
https://lore.kernel.org/linux-cve-announce/2025070340-CVE-2025-38095-6596@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38096
https://lore.kernel.org/linux-cve-announce/2025070303-CVE-2025-38096-ae58@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38097
https://lore.kernel.org/linux-cve-announce/2025070305-CVE-2025-38097-287c@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38098
https://lore.kernel.org/linux-cve-announce/2025070305-CVE-2025-38098-2802@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38099
https://lore.kernel.org/linux-cve-announce/2025070306-CVE-2025-38099-dffb@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38100
https://lore.kernel.org/linux-cve-announce/2025070319-CVE-2025-38100-5040@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38101
https://lore.kernel.org/linux-cve-announce/2025070321-CVE-2025-38101-56c1@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38102
https://lore.kernel.org/linux-cve-announce/2025070321-CVE-2025-38102-d592@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38103
https://lore.kernel.org/linux-cve-announce/2025070322-CVE-2025-38103-dd1b@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38105
https://lore.kernel.org/linux-cve-announce/2025070322-CVE-2025-38105-dfcf@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38106
https://lore.kernel.org/linux-cve-announce/2025070322-CVE-2025-38106-8de3@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38107
https://lore.kernel.org/linux-cve-announce/2025070323-CVE-2025-38107-9344@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38108
https://lore.kernel.org/linux-cve-announce/2025070323-CVE-2025-38108-9c8c@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38109
https://lore.kernel.org/linux-cve-announce/2025070323-CVE-2025-38109-f925@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38110
https://lore.kernel.org/linux-cve-announce/2025070324-CVE-2025-38110-a9c0@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38111
https://lore.kernel.org/linux-cve-announce/2025070324-CVE-2025-38111-8e9a@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38112
https://lore.kernel.org/linux-cve-announce/2025070324-CVE-2025-38112-57a2@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38113
https://lore.kernel.org/linux-cve-announce/2025070325-CVE-2025-38113-d080@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38114
https://lore.kernel.org/linux-cve-announce/2025070325-CVE-2025-38114-c603@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38115
https://lore.kernel.org/linux-cve-announce/2025070325-CVE-2025-38115-cce2@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38116
https://lore.kernel.org/linux-cve-announce/2025070325-CVE-2025-38116-1d80@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38117
https://lore.kernel.org/linux-cve-announce/2025070326-CVE-2025-38117-3424@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38118
https://lore.kernel.org/linux-cve-announce/2025070326-CVE-2025-38118-f9ca@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38119
https://lore.kernel.org/linux-cve-announce/2025070326-CVE-2025-38119-9bbe@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38120
https://lore.kernel.org/linux-cve-announce/2025070327-CVE-2025-38120-4498@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38121
https://lore.kernel.org/linux-cve-announce/2025070327-CVE-2025-38121-5390@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38122
https://lore.kernel.org/linux-cve-announce/2025070327-CVE-2025-38122-cd8d@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38123
https://lore.kernel.org/linux-cve-announce/2025070328-CVE-2025-38123-3e20@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38124
https://lore.kernel.org/linux-cve-announce/2025070328-CVE-2025-38124-bc19@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38125
https://lore.kernel.org/linux-cve-announce/2025070328-CVE-2025-38125-8a6b@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38126
https://lore.kernel.org/linux-cve-announce/2025070329-CVE-2025-38126-3c9b@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38127
https://lore.kernel.org/linux-cve-announce/2025070329-CVE-2025-38127-686d@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38128
https://lore.kernel.org/linux-cve-announce/2025070329-CVE-2025-38128-5b44@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38129
https://lore.kernel.org/linux-cve-announce/2025070330-CVE-2025-38129-3c0e@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38130
https://lore.kernel.org/linux-cve-announce/2025070330-CVE-2025-38130-3371@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38131
https://lore.kernel.org/linux-cve-announce/2025070330-CVE-2025-38131-2350@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38132
https://lore.kernel.org/linux-cve-announce/2025070331-CVE-2025-38132-bfc9@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38133
https://lore.kernel.org/linux-cve-announce/2025070331-CVE-2025-38133-5976@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38134
https://lore.kernel.org/linux-cve-announce/2025070331-CVE-2025-38134-cbff@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38135
https://lore.kernel.org/linux-cve-announce/2025070331-CVE-2025-38135-20aa@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38136
https://lore.kernel.org/linux-cve-announce/2025070332-CVE-2025-38136-1489@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38137
https://lore.kernel.org/linux-cve-announce/2025070332-CVE-2025-38137-d4bf@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38138
https://lore.kernel.org/linux-cve-announce/2025070332-CVE-2025-38138-e28b@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38139
https://lore.kernel.org/linux-cve-announce/2025070333-CVE-2025-38139-5152@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38140
https://lore.kernel.org/linux-cve-announce/2025070333-CVE-2025-38140-0ba9@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38141
https://lore.kernel.org/linux-cve-announce/2025070333-CVE-2025-38141-560e@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38142
https://lore.kernel.org/linux-cve-announce/2025070334-CVE-2025-38142-a038@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38143
https://lore.kernel.org/linux-cve-announce/2025070334-CVE-2025-38143-09c4@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38144
https://lore.kernel.org/linux-cve-announce/2025070334-CVE-2025-38144-036b@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38145
https://lore.kernel.org/linux-cve-announce/2025070335-CVE-2025-38145-548b@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38146
https://lore.kernel.org/linux-cve-announce/2025070335-CVE-2025-38146-4390@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38147
https://lore.kernel.org/linux-cve-announce/2025070335-CVE-2025-38147-52a6@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38148
https://lore.kernel.org/linux-cve-announce/2025070336-CVE-2025-38148-76a4@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38149
https://lore.kernel.org/linux-cve-announce/2025070336-CVE-2025-38149-0dad@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38150
https://lore.kernel.org/linux-cve-announce/2025070336-CVE-2025-38150-3ce8@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38151
https://lore.kernel.org/linux-cve-announce/2025070336-CVE-2025-38151-6483@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38153
https://lore.kernel.org/linux-cve-announce/2025070337-CVE-2025-38153-5735@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38154
https://lore.kernel.org/linux-cve-announce/2025070337-CVE-2025-38154-8353@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38155
https://lore.kernel.org/linux-cve-announce/2025070337-CVE-2025-38155-9967@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38156
https://lore.kernel.org/linux-cve-announce/2025070338-CVE-2025-38156-d23e@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38157
https://lore.kernel.org/linux-cve-announce/2025070338-CVE-2025-38157-bc8c@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38158
https://lore.kernel.org/linux-cve-announce/2025070338-CVE-2025-38158-d5f0@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38159
https://lore.kernel.org/linux-cve-announce/2025070339-CVE-2025-38159-0c95@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38160
https://lore.kernel.org/linux-cve-announce/2025070339-CVE-2025-38160-04ed@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38161
https://lore.kernel.org/linux-cve-announce/2025070339-CVE-2025-38161-0949@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38162
https://lore.kernel.org/linux-cve-announce/2025070340-CVE-2025-38162-cd74@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38163
https://lore.kernel.org/linux-cve-announce/2025070340-CVE-2025-38163-273b@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38164
https://lore.kernel.org/linux-cve-announce/2025070340-CVE-2025-38164-2a23@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38165
https://lore.kernel.org/linux-cve-announce/2025070341-CVE-2025-38165-0d70@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38166
https://lore.kernel.org/linux-cve-announce/2025070341-CVE-2025-38166-3dc8@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38167
https://lore.kernel.org/linux-cve-announce/2025070341-CVE-2025-38167-535f@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38168
https://lore.kernel.org/linux-cve-announce/2025070341-CVE-2025-38168-da4f@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38169
https://lore.kernel.org/linux-cve-announce/2025070342-CVE-2025-38169-11b6@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38170
https://lore.kernel.org/linux-cve-announce/2025070342-CVE-2025-38170-0f47@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-38171
https://lore.kernel.org/linux-cve-announce/2025070342-CVE-2025-38171-a380@gregkh/