Skip to content
OpenAdvisories

Summary

Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen oder nicht näher spezifizierte Auswirkungen zu erzielen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 59

  • Critical 9.8

    nvme-tcp: remove tag set when second admin queue config fails

    In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: remove tag set when second admin queue config fails Commit 104d0e2f6222 ("nvme-fabrics: reset admin connection for secure concatenation") modified nvme_tcp_setup_ctrl() to call nvme…

  • Critical 9.8

    RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction

    In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction The commit 59c68ac31e15 ("iw_cm: free cm_id resources on the last deref") simplified cm_id resource management by freeing…

  • High 8.8

    iommu/vt-d: Restore context entry setup order for aliased devices

    In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Restore context entry setup order for aliased devices Commit 2031c469f816 ("iommu/vt-d: Add support for static identity domain") changed the context entry setup during domain atta…

  • High 7.8

    sch_hfsc: make hfsc_qlen_notify() idempotent

    In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: make hfsc_qlen_notify() idempotent hfsc_qlen_notify() is not idempotent either and not friendly to its callers, like fq_codel_dequeue(). Let's make it idempotent to ease qdisc_tree_…

  • High 7.8

    smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() This fixes the following problem: [ 749.901015] [ T8673] run fstests cifs/001 at 2025-06-17 09:40:30 [ 750.346409] [ T9870] =…

  • High 7.8

    net: atm: fix /proc/net/atm/lec handling

    In the Linux kernel, the following vulnerability has been resolved: net: atm: fix /proc/net/atm/lec handling /proc/net/atm/lec must ensure safety against dev_lec[] changes. It appears it had dev_put() calls without prior dev_hold(), leading to imbalance and U…

  • High 7.8

    tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer

    In the Linux kernel, the following vulnerability has been resolved: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer The reproduction steps: 1. create a tun interface 2. enable l2 bearer 3. TIPC_NL_UDP_GET_REMOTEIP with media name set to t…

  • High 7.8

    drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()

    In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() The RPC container is released after being passed to r535_gsp_rpc_send(). When sending the initial fragment of a large RPC and passing …

  • High 7.8

    drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`

    In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` The following kernel Oops was recently reported by Mesa CI: [ 800.139824] Unable to handle kernel NULL pointer dereference …

  • High 7.8

    net: clear the dst when changing skb protocol

    In the Linux kernel, the following vulnerability has been resolved: net: clear the dst when changing skb protocol A not-so-careful NAT46 BPF program can crash the kernel if it indiscriminately flips ingress packets from v4 to v6: BUG: kernel NULL pointer dere…

  • High 7.8

    net_sched: sch_sfq: reject invalid perturb period

    In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: reject invalid perturb period Gerrard Tai reported that SFQ perturb_period has no range check yet, and this can be used to trigger a race condition fixed in a separate pat…

  • High 7.8

    jfs: fix array-index-out-of-bounds read in add_missing_indices

    In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds read in add_missing_indices stbl is s8 but it must contain offsets into slot which can go from 0 to 127. Added a bound check for that error and return -EIO …

  • High 7.8

    exfat: fix double free in delayed_free

    In the Linux kernel, the following vulnerability has been resolved: exfat: fix double free in delayed_free The double free could happen in the following path. exfat_create_upcase_table() exfat_create_upcase_table() : return error exfat_free_upcase_table() : f…

  • High 7.8

    ipc: fix to protect IPCS lookups using RCU

    In the Linux kernel, the following vulnerability has been resolved: ipc: fix to protect IPCS lookups using RCU syzbot reported that it discovered a use-after-free vulnerability, [0] [0]: https://lore.kernel.org/all/67af13f8.050a0220.21dd3.0038.GAE@google.com/…

  • High 7.8

    f2fs: fix to do sanity check on sit_bitmap_size

    In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on sit_bitmap_size w/ below testcase, resize will generate a corrupted image which contains inconsistent metadata, so when mounting such image, it will trigger ke…

  • High 7.8

    can: kvaser_pciefd: refine error prone echo_skb_max handling logic

    In the Linux kernel, the following vulnerability has been resolved: can: kvaser_pciefd: refine error prone echo_skb_max handling logic echo_skb_max should define the supported upper limit of echo_skb[] allocated inside the netdevice's priv. The corresponding …

  • High 7.8

    media: vivid: Change the siize of the composing

    In the Linux kernel, the following vulnerability has been resolved: media: vivid: Change the siize of the composing syzkaller found a bug: BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_pattern drivers/media/common/v4l2-tpg/v4l2-tpg-core.c:2608 [inline] …

  • High 7.8

    media: vidtv: Terminating the subsequent process of initialization failure

    In the Linux kernel, the following vulnerability has been resolved: media: vidtv: Terminating the subsequent process of initialization failure syzbot reported a slab-use-after-free Read in vidtv_mux_init. [1] After PSI initialization fails, the si member is a…

  • High 7.8

    jfs: validate AG parameters in dbMount() to prevent crashes

    In the Linux kernel, the following vulnerability has been resolved: jfs: validate AG parameters in dbMount() to prevent crashes Validate db_agheight, db_agwidth, and db_agstart in dbMount to catch corrupted metadata early and avoid undefined behavior in dbAll…

  • High 7.8

    NFSD: fix race between nfsd registration and exports_proc

    In the Linux kernel, the following vulnerability has been resolved: NFSD: fix race between nfsd registration and exports_proc As of now nfsd calls create_proc_exports_entry() at start of init_nfsd and cleanup by remove_proc_entry() at last of exit_nfsd. Which…

  • High 7.8

    powerpc64/ftrace: fix clobbered r15 during livepatching

    In the Linux kernel, the following vulnerability has been resolved: powerpc64/ftrace: fix clobbered r15 during livepatching While r15 is clobbered always with PPC_FTRACE_OUT_OF_LINE, it is not restored in livepatch sequence leading to not so obvious fails lik…

  • High 7.8

    sched/rt: Fix race in push_rt_task

    In the Linux kernel, the following vulnerability has been resolved: sched/rt: Fix race in push_rt_task Overview ======== When a CPU chooses to call push_rt_task and picks a task to push to another CPU's runqueue then it will call find_lock_lowest_rq method wh…

  • High 7.5

    calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().

    In the Linux kernel, the following vulnerability has been resolved: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). syzkaller reported a null-ptr-deref in sock_omalloc() while allocating a CALIPSO option. [0] The NULL is of struct sock, which was …

  • High 7.5

    ksmbd: fix null pointer dereference in destroy_previous_session

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in destroy_previous_session If client set ->PreviousSessionId on kerberos session setup stage, NULL pointer dereference error will happen. Since sess->user…

  • High 7.3

    platform/x86: dell_rbu: Fix list usage

    In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell_rbu: Fix list usage Pass the correct list head to list_for_each_entry*() when looping through the packet list. Without this patch, reading the packet data via sysfs will sh…

  • Unscored —
    CVE-2025-38178 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    ublk: santizize the arguments from userspace when adding a device

    In the Linux kernel, the following vulnerability has been resolved: ublk: santizize the arguments from userspace when adding a device Sanity check the values for queue depth and number of queues we get from userspace when adding a device.

  • Unscored —

    net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()

    In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() Before calling lan743x_ptp_io_event_clock_get(), the 'channel' value is checked against the maximum value o…

  • Unscored —

    atm: atmtcp: Free invalid length skb in atmtcp_c_send().

    In the Linux kernel, the following vulnerability has been resolved: atm: atmtcp: Free invalid length skb in atmtcp_c_send(). syzbot reported the splat below. [0] vcc_sendmsg() copies data passed from userspace to skb and passes it to vcc->dev->ops->send(). at…

  • Unscored —

    bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start()

    In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() Before the commit under the Fixes tag below, bnxt_ulp_stop() and bnxt_ulp_start() were always invoked in pairs. After that c…

  • Unscored —

    drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE

    In the Linux kernel, the following vulnerability has been resolved: drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE Calling this packet is necessary when we switch contexts because there are various pieces of state used by userspace to synchronize between BR and BV…

  • Unscored —

    atm: Revert atm_account_tx() if copy_from_iter_full() fails.

    In the Linux kernel, the following vulnerability has been resolved: atm: Revert atm_account_tx() if copy_from_iter_full() fails. In vcc_sendmsg(), we account skb->truesize to sk->sk_wmem_alloc by atm_account_tx(). It is expected to be reverted by atm_pop_raw(…

  • Unscored —

    jffs2: check that raw node were preallocated before writing summary

    In the Linux kernel, the following vulnerability has been resolved: jffs2: check that raw node were preallocated before writing summary Syzkaller detected a kernel bug in jffs2_link_node_ref, caused by fault injection in jffs2_prealloc_raw_node_refs. jffs2_su…

  • Unscored —

    LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()

    In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() ERROR INFO: CPU 25 Unable to handle kernel paging request at virtual address 0x0 ... Call Trace: [<900000000023c30c>] huge_pte_off…

  • Unscored —

    io_uring/rsrc: validate buffer count with offset for cloning

    In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: validate buffer count with offset for cloning syzbot reports that it can trigger a WARN_ON() for kmalloc() attempt that's too big: WARNING: CPU: 0 PID: 6488 at mm/slub.c:5024 _…

  • Unscored —

    fbcon: Make sure modelist not set on unregistered console

    In the Linux kernel, the following vulnerability has been resolved: fbcon: Make sure modelist not set on unregistered console It looks like attempting to write to the "store_modes" sysfs node will run afoul of unregistered consoles: UBSAN: array-index-out-of-…

  • Unscored —

    wifi: ath12k: Fix memory leak due to multiple rx_stats allocation

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix memory leak due to multiple rx_stats allocation rx_stats for each arsta is allocated when adding a station. arsta->rx_stats will be freed when a station is removed. Redundan…

  • Unscored —

    i40e: fix MMIO write access to an invalid page in i40e_clear_hw

    In the Linux kernel, the following vulnerability has been resolved: i40e: fix MMIO write access to an invalid page in i40e_clear_hw When the device sends a specific input, an integer underflow can occur, leading to MMIO write access to an invalid page. Preven…

  • Unscored —

    netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is u…

  • Unscored —

    bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()

    In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() bpf_map_lookup_percpu_elem() helper is also available for sleepable bpf program. When BPF JIT is disabled or under 32-bit…

  • Unscored —

    jfs: Fix null-ptr-deref in jfs_ioc_trim

    In the Linux kernel, the following vulnerability has been resolved: jfs: Fix null-ptr-deref in jfs_ioc_trim [ Syzkaller Report ] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000087: 0000 [#1 KASAN: null-ptr-deref in range [0x…

  • Unscored —

    drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 [Why] If the dummy values in `populate_dummy_dml_surface_cfg()` aren't updated then they can lead to a divide by zero in…

  • Unscored —

    mm: fix uprobe pte be overwritten when expanding vma

    In the Linux kernel, the following vulnerability has been resolved: mm: fix uprobe pte be overwritten when expanding vma Patch series "Fix uprobe pte be overwritten when expanding vma". This patch (of 4): We encountered a BUG alert triggered by Syzkaller as f…

  • Unscored —

    smb: client: add NULL check in automount_fullpath

    In the Linux kernel, the following vulnerability has been resolved: smb: client: add NULL check in automount_fullpath page is checked for null in __build_path_from_dentry_optional_prefix when tcon->origin_fullpath is not set. However, the check is missing whe…

  • Unscored —

    configfs-tsm-report: Fix NULL dereference of tsm_ops

    In the Linux kernel, the following vulnerability has been resolved: configfs-tsm-report: Fix NULL dereference of tsm_ops Unlike sysfs, the lifetime of configfs objects is controlled by userspace. There is no mechanism for the kernel to find and delete all cre…

  • Unscored —
    CVE-2025-38213 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var

    In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var If fb_add_videomode() in fb_set_var() fails to allocate memory for fb_videomode, later it may lead to a null-ptr derefer…

  • Unscored —

    fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var

    In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var If fb_add_videomode() in do_register_framebuffer() fails to allocate memory for fb_videomode, it will later…

  • Unscored —

    hwmon: (ftsteutates) Fix TOCTOU race in fts_read()

    In the Linux kernel, the following vulnerability has been resolved: hwmon: (ftsteutates) Fix TOCTOU race in fts_read() In the fts_read() function, when handling hwmon_pwm_auto_channels_temp, the code accesses the shared variable data->fan_source[channel] twic…

  • Unscored —

    f2fs: prevent kernel warning due to negative i_nlink from corrupted image

    In the Linux kernel, the following vulnerability has been resolved: f2fs: prevent kernel warning due to negative i_nlink from corrupted image WARNING: CPU: 1 PID: 9426 at fs/inode.c:417 drop_nlink+0xac/0xd0 home/cc/linux/fs/inode.c:417 Modules linked in: CPU:…

  • Unscored —

    ext4: only dirty folios when data journaling regular files

    In the Linux kernel, the following vulnerability has been resolved: ext4: only dirty folios when data journaling regular files fstest generic/388 occasionally reproduces a crash that looks as follows: BUG: kernel NULL pointer dereference, address: 00000000000…

  • Unscored —

    ext4: fix out of bounds punch offset

    In the Linux kernel, the following vulnerability has been resolved: ext4: fix out of bounds punch offset Punching a hole with a start offset that exceeds max_end is not permitted and will result in a negative length in the truncate_inode_partial_folio() funct…

  • Unscored —

    ext4: inline: fix len overflow in ext4_prepare_inline_data

    In the Linux kernel, the following vulnerability has been resolved: ext4: inline: fix len overflow in ext4_prepare_inline_data When running the following code on an ext4 filesystem with inline_data feature enabled, it will lead to the bug below. fd = open("fi…

  • Unscored —

    ceph: avoid kernel BUG for encrypted inode with unaligned file size

    In the Linux kernel, the following vulnerability has been resolved: ceph: avoid kernel BUG for encrypted inode with unaligned file size The generic/397 test hits a BUG_ON for the case of encrypted inode with unaligned file size (for example, 33K or 1K): [ 877…

  • Unscored —

    media: imx-jpeg: Cleanup after an allocation error

    In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Cleanup after an allocation error When allocation failures are not cleaned up by the driver, further allocation errors will be false-positives, which will cause buffers to re…

  • Unscored —

    media: imagination: fix a potential memory leak in e5010_probe()

    In the Linux kernel, the following vulnerability has been resolved: media: imagination: fix a potential memory leak in e5010_probe() Add video_device_release() to release the memory allocated by video_device_alloc() if something goes wrong.

  • Unscored —

    media: cxusb: no longer judge rbuf when the write fails

    In the Linux kernel, the following vulnerability has been resolved: media: cxusb: no longer judge rbuf when the write fails syzbot reported a uninit-value in cxusb_i2c_xfer. [1] Only when the write operation of usb_bulk_msg() in dvb_usb_generic_rw() succeeds …

  • Unscored —

    nfsd: Initialize ssc before laundromat_work to prevent NULL dereference

    In the Linux kernel, the following vulnerability has been resolved: nfsd: Initialize ssc before laundromat_work to prevent NULL dereference In nfs4_state_start_net(), laundromat_work may access nfsd_ssc through nfs4_laundromat -> nfsd4_ssc_expire_umount. If n…

  • Unscored —

    HID: appletb-kbd: fix "appletb_backlight" backlight device reference counting

    In the Linux kernel, the following vulnerability has been resolved: HID: appletb-kbd: fix "appletb_backlight" backlight device reference counting During appletb_kbd_probe, probe attempts to get the backlight device by name. When this happens backlight_device_…

Revision history

  1. #152

    Neue Updates von Ubuntu aufgenommen

  2. #151

    Neue Updates von Ubuntu aufgenommen

  3. #150

    Neue Updates von Ubuntu aufgenommen

  4. #149

    Neue Updates von Debian aufgenommen

  5. #148

    Neue Updates von Debian aufgenommen

  6. #147

    Neue Updates von Debian aufgenommen

  7. #146

    Neue Updates von Ubuntu aufgenommen

  8. #145

    Neue Updates von Oracle Linux aufgenommen

  9. #144

    Neue Updates von Debian aufgenommen

  10. #143

    Neue Updates von Debian aufgenommen

  11. #142

    Neue Updates von Oracle Linux aufgenommen

  12. #141

    Neue Updates von Ubuntu aufgenommen

  13. #140

    Neue Updates von Ubuntu aufgenommen

  14. #139

    Neue Updates von Debian aufgenommen

  15. #138

    Neue Updates von Dell aufgenommen

  16. #137

    Neue Updates von Ubuntu aufgenommen

  17. #136

    Neue Updates von Ubuntu aufgenommen

  18. #135

    Neue Updates von Ubuntu aufgenommen

  19. #134

    Neue Updates von Ubuntu aufgenommen

  20. #133

    Neue Updates von Ubuntu aufgenommen

  21. #132

    Neue Updates von Ubuntu aufgenommen

  22. #131

    Neue Updates von Ubuntu aufgenommen

  23. #130

    Neue Updates von IBM aufgenommen

  24. #129

    Neue Updates von Ubuntu aufgenommen

  25. #128

    Neue Updates von Ubuntu aufgenommen

References