Skip to content
OpenAdvisories
High WID-SEC-2025-1665 30 CVEs

Linux Kernel: Mehrere Schwachstellen

Published Jul 28, 2025 · Updated Oct 7, 2026 · Revision 108 · de-DE

Vendor: amazon Vendor: Debian Vendor: Dell Vendor: Google Vendor: IBM Vendor: NETAPP Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: SUSE Vendor: Ubuntu Product: ActiveIQ Unified Manager Product: Avamar Product: Container-Optimized OS Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: NetWorker Product: openSUSE Product: PowerProtect Data Domain Product: QRadar SIEM Product: Rocky Linux Product: Secure Connect Gateway Product: Security Verify Access Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen oder andere nicht spezifizierte Angriffe durchzuführen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 30

  • Critical 9.8
    CVE-2024-50047

    smb: client: fix UAF in async decryption

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in async decryption Doing an async decryption (large read) crashes with a slab-use-after-free way down in the crypto API. Reproducer: # mount.cifs -o ...,seal,esize=1 //s…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-38471

    tls: always refresh the queue when reading sock

    In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock After recent changes in net-next TCP compacts skbs much more aggressively. This unearthed a bug in TLS where we may try to operate on an old sk…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-38472

    netfilter: nf_conntrack: fix crash due to removal of uninitialised entry

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry A crash in conntrack was reported while trying to unlink the conntrack entry from the hash bucket list: [exception RIP…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-38476

    rpl: Fix use-after-free in rpl_do_srh_inline().

    In the Linux kernel, the following vulnerability has been resolved: rpl: Fix use-after-free in rpl_do_srh_inline(). Running lwt_dst_cache_ref_loop.sh in selftest with KASAN triggers the splat below [0]. rpl_do_srh_inline() fetches ipv6_hdr(skb) and accesses i…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2025-38488

    smb: client: fix use-after-free in crypt_message when using async crypto

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in crypt_message when using async crypto The CVE-2024-50047 fix removed asynchronous crypto handling from crypt_message(), assuming all crypto operations are s…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-38490

    net: libwx: remove duplicate page_pool_put_full_page()

    In the Linux kernel, the following vulnerability has been resolved: net: libwx: remove duplicate page_pool_put_full_page() page_pool_put_full_page() should only be invoked when freeing Rx buffers or building a skb if the size is too short. At other times, the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2025-38495

    HID: core: ensure the allocated report buffer can contain the reserved report ID

    In the Linux kernel, the following vulnerability has been resolved: HID: core: ensure the allocated report buffer can contain the reserved report ID When the report ID is not used, the low level transport drivers expect the first byte to be 0. However, curren…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.2
    CVE-2025-38491

    mptcp: make fallback action and fallback decision atomic

    In the Linux kernel, the following vulnerability has been resolved: mptcp: make fallback action and fallback decision atomic Syzkaller reported the following splat: WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 __mptcp_do_fallback net/mptcp/protocol.…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38470

    net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime

    In the Linux kernel, the following vulnerability has been resolved: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime Assuming the "rx-vlan-filter" feature is enabled on a net device, the 8021q module will automatically add or remo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38475

    smc: Fix various oops due to inet_sock type confusion.

    In the Linux kernel, the following vulnerability has been resolved: smc: Fix various oops due to inet_sock type confusion. syzbot reported weird splats [0][1] in cipso_v4_sock_setattr() while freeing inet_sk(sk)->inet_opt. The address was freed multiple times…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38477

    net/sched: sch_qfq: Fix race condition on qfq_aggregate

    In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix race condition on qfq_aggregate A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurren…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38478

    comedi: Fix initialization of data for instructions that write to subdevice

    In the Linux kernel, the following vulnerability has been resolved: comedi: Fix initialization of data for instructions that write to subdevice Some Comedi subdevice instruction handlers are known to access instruction data elements beyond the first `insn->n`…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38484

    iio: backend: fix out-of-bound write

    In the Linux kernel, the following vulnerability has been resolved: iio: backend: fix out-of-bound write The buffer is set to 80 character. If a caller write more characters, count is truncated to the max available space in "simple_write_to_buffer". But after…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38485

    iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush

    In the Linux kernel, the following vulnerability has been resolved: iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush fxls8962af_fifo_flush() uses indio_dev->active_scan_mask (with iio_for_each_active_channel()) without making sure the indio…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38486

    soundwire: Revert "soundwire: qcom: Add set_channel_map api support"

    In the Linux kernel, the following vulnerability has been resolved: soundwire: Revert "soundwire: qcom: Add set_channel_map api support" This reverts commit 7796c97df6b1b2206681a07f3c80f6023a6593d5. This patch broke Dragonboard 845c (sdm845). I see: Unexpecte…

    Linux Linux linux-raspi2 linux-hwe Linux Ubuntu
  • High 7.8
    CVE-2025-38494

    HID: core: do not bypass hid_hw_raw_request

    In the Linux kernel, the following vulnerability has been resolved: HID: core: do not bypass hid_hw_raw_request hid_hw_raw_request() is actually useful to ensure the provided buffer and length are valid. Directly calling in the low level transport driver func…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38468

    net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree

    In the Linux kernel, the following vulnerability has been resolved: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree htb_lookup_leaf has a BUG_ON that can trigger with the following: tc qdisc del dev lo root tc qdisc add dev lo root hand…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38469

    KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls

    In the Linux kernel, the following vulnerability has been resolved: KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls kvm_xen_schedop_poll does a kmalloc_array() when a VM polls the host for more than one event channel potr (nr_ports…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38473

    Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() syzbot reported null-ptr-deref in l2cap_sock_resume_cb(). [0] l2cap_sock_resume_cb() has a similar problem that was fixed by commit 1bf…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38474

    usb: net: sierra: check for no status endpoint

    In the Linux kernel, the following vulnerability has been resolved: usb: net: sierra: check for no status endpoint The driver checks for having three endpoints and having bulk in and out endpoints, but not that the third endpoint is interrupt input. Rectify t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38480

    comedi: Fix use of uninitialized data in insn_rw_emulate_bits()

    In the Linux kernel, the following vulnerability has been resolved: comedi: Fix use of uninitialized data in insn_rw_emulate_bits() For Comedi `INSN_READ` and `INSN_WRITE` instructions on "digital" subdevices (subdevice types `COMEDI_SUBD_DI`, `COMEDI_SUBD_DO…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38481

    comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large

    In the Linux kernel, the following vulnerability has been resolved: comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large The handling of the `COMEDI_INSNLIST` ioctl allocates a kernel buffer to hold the array of `struct comedi_insn`, getting the length …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38482

    comedi: das6402: Fix bit shift out of bounds

    In the Linux kernel, the following vulnerability has been resolved: comedi: das6402: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: /* IRQs 2,3,5,6,7, 10,11,15 are valid for "enhanced" mode */ if ((1 << it->o…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38483

    comedi: das16m1: Fix bit shift out of bounds

    In the Linux kernel, the following vulnerability has been resolved: comedi: das16m1: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: /* only irqs 2, 3, 4, 5, 6, 7, 10, 11, 12, 14, and 15 are valid */ if ((1 <<…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38487

    soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled

    In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled Mitigate e.g. the following: # echo 1e789080.lpc-snoop > /sys/bus/platform/drivers/aspeed-lpc-snoop/unbind ... [ 120.363594]…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38489

    s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again

    In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again Commit 7ded842b356d ("s390/bpf: Fix bpf_plt pointer arithmetic") has accidentally removed the critical piece of commit c730fce7c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38492

    netfs: Fix race between cache write completion and ALL_QUEUED being set

    In the Linux kernel, the following vulnerability has been resolved: netfs: Fix race between cache write completion and ALL_QUEUED being set When netfslib is issuing subrequests, the subrequests start processing immediately and may complete before we reach the…

    Linux Linux linux-raspi2 linux-hwe Linux Ubuntu
  • Unscored —
    CVE-2025-38493

    tracing/osnoise: Fix crash in timerlat_dump_stack()

    In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Fix crash in timerlat_dump_stack() We have observed kernel panics when using timerlat with stack saving, with the following dmesg output: memcpy: detected buffer overflow: 88…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38496

    dm-bufio: fix sched in atomic context

    In the Linux kernel, the following vulnerability has been resolved: dm-bufio: fix sched in atomic context If "try_verify_in_tasklet" is set for dm-verity, DM_BUFIO_CLIENT_NO_SLEEP is enabled for dm-bufio. However, when bufio tries to evict buffers, there is a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38497

    usb: gadget: configfs: Fix OOB read on empty string write

    In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Fix OOB read on empty string write When writing an empty string to either 'qw_sign' or 'landingPage' sysfs attributes, the store functions attempt to access page[l - 1]…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Revision history

  1. #108

    Neue Updates von Ubuntu aufgenommen

  2. #107

    Neue Updates von IBM aufgenommen

  3. #106

    Neue Updates von SUSE aufgenommen

  4. #105

    Neue Updates von SUSE aufgenommen

  5. #104

    Neue Updates von SUSE aufgenommen

  6. #103

    Neue Updates von SUSE aufgenommen

  7. #102

    Neue Updates von SUSE aufgenommen

  8. #101

    Neue Updates von SUSE aufgenommen

  9. #100

    Neue Updates von SUSE aufgenommen

  10. #99

    Neue Updates von SUSE aufgenommen

  11. #98

    Neue Updates von SUSE aufgenommen

  12. #97

    Neue Updates von Oracle Linux aufgenommen

  13. #96

    Neue Updates von Oracle Linux aufgenommen

  14. #95

    Neue Updates von Red Hat aufgenommen

  15. #94

    Neue Updates von Red Hat aufgenommen

  16. #93

    Neue Updates von SUSE aufgenommen

  17. #92

    Neue Updates von SUSE aufgenommen

  18. #91

    Neue Updates von SUSE aufgenommen

  19. #90

    Neue Updates von SUSE aufgenommen

  20. #89

    Neue Updates von Ubuntu und SUSE aufgenommen

  21. #88

    Neue Updates von SUSE und Oracle Linux aufgenommen

  22. #87

    Neue Updates von SUSE aufgenommen

  23. #86

    Neue Updates von SUSE aufgenommen

  24. #85

    Neue Updates von SUSE aufgenommen

  25. #84

    Neue Updates von Ubuntu und Oracle Linux aufgenommen

References