Skip to content
OpenAdvisories
High WID-SEC-2025-1517 25 CVEs

Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service

Published Jul 8, 2025 · Updated Nov 12, 2026 · Revision 101 · de

Vendor: Debian Vendor: Dell Vendor: Google Vendor: IBM Vendor: NETAPP Vendor: Oracle Vendor: Red Hat Vendor: SUSE Vendor: Ubuntu Product: ActiveIQ Unified Manager Product: Avamar Product: Cloud Platform Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: NetWorker Product: openSUSE Product: QRadar SIEM Product: Secure Connect Gateway Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen oder nicht näher spezifizierte Auswirkungen zu erzielen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 25

  • Critical 9.8
    CVE-2025-38246

    bnxt: properly flush XDP redirect lists

    In the Linux kernel, the following vulnerability has been resolved: bnxt: properly flush XDP redirect lists We encountered following crash when testing a XDP_REDIRECT feature in production: [56251.579676] list_add corruption. next->prev should be prev (ffff93…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-38264

    nvme-tcp: sanitize request list handling

    In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: sanitize request list handling Validate the request in nvme_tcp_handle_r2t() to ensure it's not part of any list, otherwise a malicious R2T PDU might inject a loop in request list p…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2025-38238

    scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out

    In the Linux kernel, the following vulnerability has been resolved: scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out When both the RHBA and RPA FDMI requests time out, fnic reuses a frame to send ABTS for each of them. On send completion, thi…

    Linux Linux linux-raspi2 linux-hwe Linux Ubuntu
  • High 8.8
    CVE-2025-38253

    HID: wacom: fix crash in wacom_aes_battery_handler()

    In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix crash in wacom_aes_battery_handler() Commit fd2a9b29dc9c ("HID: wacom: Remove AES power_supply after extended inactivity") introduced wacom_aes_battery_handler() which is sche…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38242

    mm: userfaultfd: fix race of userfaultfd_move and swap cache

    In the Linux kernel, the following vulnerability has been resolved: mm: userfaultfd: fix race of userfaultfd_move and swap cache This commit fixes two kinds of races, they may have different results: Barry reported a BUG_ON in commit c50f8e6053b0, we may see …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38248 Public exploit

    bridge: mcast: Fix use-after-free during router port configuration

    In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix use-after-free during router port configuration The bridge maintains a global list of ports behind which a multicast router resides. The list is consulted during forwarding…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38250

    Bluetooth: hci_core: Fix use-after-free in vhci_flush()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix use-after-free in vhci_flush() syzbot reported use-after-free in vhci_flush() without repro. [0] From the splat, a thread close()d a vhci file descriptor while its de…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38252

    cxl/ras: Fix CPER handler device confusion

    In the Linux kernel, the following vulnerability has been resolved: cxl/ras: Fix CPER handler device confusion By inspection, cxl_cper_handle_prot_err() is making a series of fragile assumptions that can lead to crashes: 1/ It assumes that endpoints identifie…

    Linux Linux linux-raspi2 linux-hwe Linux Ubuntu
  • High 7.8
    CVE-2025-38261

    riscv: save the SR_SUM status over switches

    In the Linux kernel, the following vulnerability has been resolved: riscv: save the SR_SUM status over switches When threads/tasks are switched we need to ensure the old execution's SR_SUM state is saved and the new thread has the old SR_SUM state restored. T…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38262

    tty: serial: uartlite: register uart driver in init

    In the Linux kernel, the following vulnerability has been resolved: tty: serial: uartlite: register uart driver in init When two instances of uart devices are probing, a concurrency race can occur. If one thread calls uart_register_driver function, which firs…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2025-38244

    smb: client: fix potential deadlock when reconnecting channels

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential deadlock when reconnecting channels Fix cifs_signal_cifsd_for_reconnect() to take the correct lock order and prevent the following deadlock from happening =========…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.3
    CVE-2025-38257

    s390/pkey: Prevent overflow in size calculation for memdup_user()

    In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Prevent overflow in size calculation for memdup_user() Number of apqn target list entries contained in 'nr_apqns' variable is determined by userspace via an ioctl call so the resul…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38241

    mm/shmem, swap: fix softlockup with mTHP swapin

    In the Linux kernel, the following vulnerability has been resolved: mm/shmem, swap: fix softlockup with mTHP swapin Following softlockup can be easily reproduced on my test machine with: echo always > /sys/kernel/mm/transparent_hugepage/hugepages-64kB/enabled…

    Linux Linux linux-raspi2 linux-hwe Linux Ubuntu
  • Unscored —
    CVE-2025-38243

    btrfs: fix invalid inode pointer dereferences during log replay

    In the Linux kernel, the following vulnerability has been resolved: btrfs: fix invalid inode pointer dereferences during log replay In a few places where we call read_one_inode(), if we get a NULL pointer we end up jumping into an error path, or fallthrough i…

    Linux Linux linux-raspi2 linux-hwe Linux Ubuntu
  • Unscored —
    CVE-2025-38245

    atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().

    In the Linux kernel, the following vulnerability has been resolved: atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). syzbot reported a warning below during atm_dev_register(). [0] Before creating a new device and procfs/sysfs for it, …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38247

    userns and mnt_idmap leak in open_tree_attr(2)

    In the Linux kernel, the following vulnerability has been resolved: userns and mnt_idmap leak in open_tree_attr(2) Once want_mount_setattr() has returned a positive, it does require finish_mount_kattr() to release ->mnt_userns. Failing do_mount_setattr() does…

    Linux Linux linux-raspi2 linux-hwe Linux Ubuntu
  • Unscored —
    CVE-2025-38249

    ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()

    In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() In snd_usb_get_audioformat_uac3(), the length value returned from snd_usb_ctl_msg() is used directly for memory alloc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38251

    atm: clip: prevent NULL deref in clip_push()

    In the Linux kernel, the following vulnerability has been resolved: atm: clip: prevent NULL deref in clip_push() Blamed commit missed that vcc_destroy_socket() calls clip_push() with a NULL skb. If clip_devs is NULL, clip_push() then crashes when reading skb-…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38254

    drm/amd/display: Add sanity checks for drm_edid_raw()

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add sanity checks for drm_edid_raw() When EDID is retrieved via drm_edid_raw(), it doesn't guarantee to return proper EDID bytes the caller wants: it may be either NULL (that…

    Linux Linux linux-raspi2 linux-hwe Linux Ubuntu
  • Unscored —
    CVE-2025-38255

    lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()

    In the Linux kernel, the following vulnerability has been resolved: lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() While testing null_blk with configfs, echo 0 > poll_queues will trigger following panic: BUG: kernel NULL pointer derefer…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38256

    io_uring/rsrc: fix folio unpinning

    In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: fix folio unpinning syzbot complains about an unmapping failure: [ 108.070381][ T14] kernel BUG at mm/gup.c:71! [ 108.070502][ T14] Internal error: Oops - BUG: 00000000f2000800…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38258

    mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write

    In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write memcg_path_store() assigns a newly allocated memory buffer to filter->memcg_path, without deallocating the prev…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38259

    ASoC: codecs: wcd9335: Fix missing free of regulator supplies

    In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd9335: Fix missing free of regulator supplies Driver gets and enables all regulator supplies in probe path (wcd9335_parse_dt() and wcd9335_power_on_reset()), but does not clea…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38260

    btrfs: handle csum tree error with rescue=ibadroots correctly

    In the Linux kernel, the following vulnerability has been resolved: btrfs: handle csum tree error with rescue=ibadroots correctly [BUG] There is syzbot based reproducer that can crash the kernel, with the following call trace: (With some debug output added) D…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38263

    bcache: fix NULL pointer in cache_set_flush()

    In the Linux kernel, the following vulnerability has been resolved: bcache: fix NULL pointer in cache_set_flush() 1. LINE#1794 - LINE#1887 is some codes about function of bch_cache_set_alloc(). 2. LINE#2078 - LINE#2142 is some codes about function of register…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

Revision history

  1. #101

    Neue Updates von Debian aufgenommen

  2. #100

    Neue Updates von Ubuntu aufgenommen

  3. #99

    Neue Updates von Ubuntu aufgenommen

  4. #98

    Neue Updates von Debian aufgenommen

  5. #97

    Neue Updates von Ubuntu aufgenommen

  6. #96

    Neue Updates von Ubuntu aufgenommen

  7. #95

    Neue Updates von SUSE aufgenommen

  8. #94

    Neue Updates von SUSE aufgenommen

  9. #93

    Neue Updates von SUSE aufgenommen

  10. #92

    Neue Updates von Ubuntu aufgenommen

  11. #91

    Neue Updates von SUSE aufgenommen

  12. #90

    Neue Updates von SUSE aufgenommen

  13. #89

    Neue Updates von Ubuntu aufgenommen

  14. #88

    Neue Updates von Ubuntu aufgenommen

  15. #87

    Neue Updates von Ubuntu aufgenommen

  16. #86

    Neue Updates von Ubuntu aufgenommen

  17. #85

    Neue Updates von Ubuntu aufgenommen

  18. #84

    Neue Updates von Ubuntu aufgenommen

  19. #83

    Neue Updates von Ubuntu aufgenommen

  20. #82

    Neue Updates von Debian aufgenommen

  21. #81

    Neue Updates von Oracle Linux aufgenommen

  22. #80

    Neue Updates von Oracle Linux aufgenommen

  23. #79

    Neue Updates von Oracle Linux aufgenommen

  24. #78

    Neue Updates von Ubuntu aufgenommen

  25. #77

    Neue Updates von Debian aufgenommen

References