Skip to content
OpenAdvisories

Summary

Ein Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder andere nicht spezifizierte Angriffe durchzuführen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 61

  • Critical 9.8
    CVE-2025-38561 Public exploit

    ksmbd: fix Preauh_HashValue race condition

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix Preauh_HashValue race condition If client send multiple session setup requests to ksmbd, Preauh_HashValue race condition could happen. There is no need to free sess->Preauh_HashVal…

  • Critical 9.8

    sunrpc: fix handling of server side tls alerts

    In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix handling of server side tls alerts Scott Mayhew discovered a security exploit in NFS over TLS in tls_alert_recv() due to its assumption it can read data from the msg iterator's kv…

  • Critical 9.3

    x86/sev: Evict cache lines during SNP memory validation

    In the Linux kernel, the following vulnerability has been resolved: x86/sev: Evict cache lines during SNP memory validation An SNP cache coherency vulnerability requires a cache line eviction mitigation when validating memory after a page state change to priv…

  • High 8.8

    Bluetooth: hci_devcd_dump: fix out-of-bounds via dev_coredumpv

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_devcd_dump: fix out-of-bounds via dev_coredumpv Currently both dev_coredumpv and skb_put_data in hci_devcd_dump use hdev->dump.head. However, dev_coredumpv can free the buffer.…

  • High 8.8

    wifi: mt76: mt7996: Fix possible OOB access in mt7996_tx()

    In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible OOB access in mt7996_tx() Fis possible Out-Of-Boundary access in mt7996_tx routine if link_id is set to IEEE80211_LINK_UNSPECIFIED

  • High 8.8

    wifi: mt76: mt7925: fix off by one in mt7925_mcu_hw_scan()

    In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix off by one in mt7925_mcu_hw_scan() The ssid->ssids[] and sreq->ssids[] arrays have MT7925_RNR_SCAN_MAX_BSSIDS elements so this >= needs to be > to prevent an out of bo…

  • High 8.8

    wifi: ath11k: clear initialized flag for deinit-ed srng lists

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: clear initialized flag for deinit-ed srng lists In a number of cases we see kernel panics on resume due to ath11k kernel page fault, which happens under the following circumstan…

  • High 8.6

    pptp: ensure minimal skb length in pptp_xmit()

    In the Linux kernel, the following vulnerability has been resolved: pptp: ensure minimal skb length in pptp_xmit() Commit aabc6596ffb3 ("net: ppp: Add bound checking for skb data on ppp_sync_txmung") fixed ppp_sync_txmunge() We need a similar fix in pptp_xmit…

  • High 8.6

    bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls

    In the Linux kernel, the following vulnerability has been resolved: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls When sending plaintext data, we initially calculated the corresponding ciphertext length. However, if we later reduced the…

  • High 8.2

    sunrpc: fix client side handling of tls alerts

    In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix client side handling of tls alerts A security exploit was discovered in NFS over TLS in tls_alert_recv due to its assumption that there is valid data in the msghdr's iterator's kv…

  • High 7.8

    mm: fix a UAF when vma->mm is freed after vma->vm_refcnt got dropped

    In the Linux kernel, the following vulnerability has been resolved: mm: fix a UAF when vma->mm is freed after vma->vm_refcnt got dropped By inducing delays in the right places, Jann Horn created a reproducer for a hard to hit UAF issue that became possible af…

  • High 7.8

    usb: gadget : fix use-after-free in composite_dev_cleanup()

    In the Linux kernel, the following vulnerability has been resolved: usb: gadget : fix use-after-free in composite_dev_cleanup() 1. In func configfs_composite_bind() -> composite_os_desc_req_prepare(): if kmalloc fails, the pointer cdev->os_desc_req will be fr…

  • High 7.8

    net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

    In the Linux kernel, the following vulnerability has been resolved: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing TCA_MQPRIO_TC_ENTRY_INDEX is validated using NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value TC_QOPT_MA…

  • High 7.8

    eth: fbnic: unlink NAPIs from queues on error to open

    In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: unlink NAPIs from queues on error to open CI hit a UaF in fbnic in the AF_XDP portion of the queues.py test. The UaF is in the __sk_mark_napi_id_once() call in xsk_bind(), NAPI ha…

  • High 7.8

    ipv6: reject malicious packets in ipv6_gso_segment()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: reject malicious packets in ipv6_gso_segment() syzbot was able to craft a packet with very long IPv6 extension headers leading to an overflow of skb->transport_header. This 16bit field …

  • High 7.8

    f2fs: fix to avoid panic in f2fs_evict_inode

    In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid panic in f2fs_evict_inode As syzbot [1] reported as below: R10: 0000000000000100 R11: 0000000000000206 R12: 00007ffe17473450 R13: 00007f28b1c10854 R14: 000000000000dae5 R15…

  • High 7.8

    f2fs: fix to avoid UAF in f2fs_sync_inode_meta()

    In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid UAF in f2fs_sync_inode_meta() syzbot reported an UAF issue as below: [1] [2] [1] https://syzkaller.appspot.com/text?tag=CrashReport&x=16594c60580000 =======================…

  • High 7.8

    f2fs: fix KMSAN uninit-value in extent_info usage

    In the Linux kernel, the following vulnerability has been resolved: f2fs: fix KMSAN uninit-value in extent_info usage KMSAN reported a use of uninitialized value in `__is_extent_mergeable()` and `__is_back_mergeable()` via the read extent tree path. The root …

  • High 7.8

    ext4: fix inode use after free in ext4_end_io_rsv_work()

    In the Linux kernel, the following vulnerability has been resolved: ext4: fix inode use after free in ext4_end_io_rsv_work() In ext4_io_end_defer_completion(), check if io_end->list_vec is empty to avoid adding an io_end that requires no conversion to the i_r…

  • High 7.8

    RDMA/hns: Fix double destruction of rsv_qp

    In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix double destruction of rsv_qp rsv_qp may be double destroyed in error flow, first in free_mr_init(), and then in hns_roce_exit(). Fix it by moving the free_mr_init() call into hn…

  • High 7.8

    bpf, arm64: Fix fp initialization for exception boundary

    In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix fp initialization for exception boundary In the ARM64 BPF JIT when prog->aux->exception_boundary is set for a BPF program, find_used_callee_regs() is not called because for a …

  • High 7.8

    Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' Function 'hci_discovery_filter_clear()' frees 'uuids' array and then sets it to NULL. There is a tiny chance of the foll…

  • High 7.8

    iommu/vt-d: Fix UAF on sva unbind with pending IOPFs

    In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix UAF on sva unbind with pending IOPFs Commit 17fce9d2336d ("iommu/vt-d: Put iopf enablement in domain attach path") disables IOPF on device by removing the device from its IOMM…

  • High 7.8

    xen: fix UAF in dmabuf_exp_from_pages()

    In the Linux kernel, the following vulnerability has been resolved: xen: fix UAF in dmabuf_exp_from_pages() [dma_buf_fd() fixes; no preferences regarding the tree it goes through - up to xen folks] As soon as we'd inserted a file reference into descriptor tab…

  • High 7.8

    drm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code

    In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code The object is potentially already gone after the drm_gem_object_put(). In general the object should be fully constructed …

  • High 7.8

    drm/amdgpu: fix use-after-free in amdgpu_userq_suspend+0x51a/0x5a0

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix use-after-free in amdgpu_userq_suspend+0x51a/0x5a0 [ +0.000020] BUG: KASAN: slab-use-after-free in amdgpu_userq_suspend+0x51a/0x5a0 [amdgpu] [ +0.000817] Read of size 8 at add…

  • High 7.8

    wifi: rtl818x: Kill URBs before clearing tx status queue

    In the Linux kernel, the following vulnerability has been resolved: wifi: rtl818x: Kill URBs before clearing tx status queue In rtl8187_stop() move the call of usb_kill_anchored_urbs() before clearing b_tx_status.queue. This change prevents callbacks from usi…

  • High 7.8

    bpf: handle jset (if a & b ...) as a jump in CFG computation

    In the Linux kernel, the following vulnerability has been resolved: bpf: handle jset (if a & b ...) as a jump in CFG computation BPF_JSET is a conditional jump and currently verifier.c:can_jump() does not know about that. This can lead to incorrect live regis…

  • High 7.8

    eventpoll: Fix semi-unbounded recursion

    In the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded recursion Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links. Currently, ep_loop_check_proc() ensures that the graph is loop-fre…

  • High 7.8

    fs/ntfs3: cancle set bad inode after removing name fails

    In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: cancle set bad inode after removing name fails The reproducer uses a file0 on a ntfs3 file system with a corrupted i_link. When renaming, the file0's inode is marked as a bad inode …

  • High 7.5

    net/mlx5e: Remove skb secpath if xfrm state is not found

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Remove skb secpath if xfrm state is not found Hardware returns a unique identifier for a decrypted packet's xfrm state, this state is looked up in an xarray. However, the state mig…

  • High 7.3

    spi: cs42l43: Property entry should be a null-terminated array

    In the Linux kernel, the following vulnerability has been resolved: spi: cs42l43: Property entry should be a null-terminated array The software node does not specify a count of property entries, so the array must be null-terminated. When unterminated, this ca…

  • High 7.0

    padata: Fix pd UAF once and for all

    In the Linux kernel, the following vulnerability has been resolved: padata: Fix pd UAF once and for all There is a race condition/UAF in padata_reorder that goes back to the initial commit. A reference count is taken at the start of the process in padata_do_p…

  • Unscored —

    HID: core: Harden s32ton() against conversion to 0 bits

    In the Linux kernel, the following vulnerability has been resolved: HID: core: Harden s32ton() against conversion to 0 bits Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity t…

  • Unscored —

    HID: apple: validate feature-report field count to prevent NULL pointer dereference

    In the Linux kernel, the following vulnerability has been resolved: HID: apple: validate feature-report field count to prevent NULL pointer dereference A malicious HID device with quirk APPLE_MAGIC_BACKLIGHT can trigger a NULL pointer dereference whilst the p…

  • Unscored —

    usb: gadget: uvc: Initialize frame-based format color matching descriptor

    In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Initialize frame-based format color matching descriptor Fix NULL pointer crash in uvcg_framebased_make due to uninitialized color matching descriptor for frame-based format …

  • Unscored —

    platform/x86/intel/pmt: fix a crashlog NULL pointer access

    In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/pmt: fix a crashlog NULL pointer access Usage of the intel_pmt_read() for binary sysfs, requires a pcidev. The current use of the endpoint value is only valid for telemetry…

  • Unscored —
    CVE-2025-38562 EPSS 15%

    ksmbd: fix null pointer dereference error in generate_encryptionkey

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference error in generate_encryptionkey If client send two session setups with krb5 authenticate to ksmbd, null pointer dereference error in generate_encryptionkey…

  • Unscored —

    perf/core: Prevent VMA split of buffer mappings

    In the Linux kernel, the following vulnerability has been resolved: perf/core: Prevent VMA split of buffer mappings The perf mmap code is careful about mmap()'ing the user page with the ringbuffer and additionally the auxiliary buffer, when the event supports…

  • Unscored —

    perf/core: Handle buffer mapping fail correctly in perf_mmap()

    In the Linux kernel, the following vulnerability has been resolved: perf/core: Handle buffer mapping fail correctly in perf_mmap() After successful allocation of a buffer or a successful attachment to an existing buffer perf_mmap() tries to map the buffer rea…

  • Unscored —

    perf/core: Exit early on perf_mmap() fail

    In the Linux kernel, the following vulnerability has been resolved: perf/core: Exit early on perf_mmap() fail When perf_mmap() fails to allocate a buffer, it still invokes the event_mapped() callback of the related event. On X86 this might increase the perf_r…

  • Unscored —

    nfsd: avoid ref leak in nfsd_open_local_fh()

    In the Linux kernel, the following vulnerability has been resolved: nfsd: avoid ref leak in nfsd_open_local_fh() If two calls to nfsd_open_local_fh() race and both successfully call nfsd_file_acquire_local(), they will both get an extra reference to the net t…

  • Unscored —

    benet: fix BUG when creating VFs

    In the Linux kernel, the following vulnerability has been resolved: benet: fix BUG when creating VFs benet crashes as soon as SRIOV VFs are created: kernel BUG at mm/vmalloc.c:3457! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 4 UID: 0 PID: 7408 Comm:…

  • Unscored —

    powerpc/eeh: Make EEH driver device hotplug safe

    In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: Make EEH driver device hotplug safe Multiple race conditions existed between the PCIe hotplug driver and the EEH driver, leading to a variety of kernel oopses of the same general…

  • Unscored —

    crypto: ccp - Fix crash when rebind ccp device for ccp.ko

    In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix crash when rebind ccp device for ccp.ko When CONFIG_CRYPTO_DEV_CCP_DEBUGFS is enabled, rebinding the ccp device causes the following crash: $ echo '0000:0a:00.2' > /sys/bus/…

  • Unscored —

    clk: xilinx: vcu: unregister pll_post only if registered correctly

    In the Linux kernel, the following vulnerability has been resolved: clk: xilinx: vcu: unregister pll_post only if registered correctly If registration of pll_post is failed, it will be set to NULL or ERR, unregistering same will fail with following call trace…

  • Unscored —

    staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int()

    In the Linux kernel, the following vulnerability has been resolved: staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() When gmin_get_config_var() calls efi.get_variable() and the EFI variable is larger than the expected buffer size, two …

  • Unscored —

    ipv6: fix possible infinite loop in fib6_info_uses_dev()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in fib6_info_uses_dev() fib6_info_uses_dev() seems to rely on RCU without an explicit protection. Like the prior fix in rt6_nlmsg_size(), we need to make sure…

  • Unscored —

    ipv6: prevent infinite loop in rt6_nlmsg_size()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent infinite loop in rt6_nlmsg_size() While testing prior patch, I was able to trigger an infinite loop in rt6_nlmsg_size() in the following place: list_for_each_entry_rcu(sibling, …

  • Unscored —

    neighbour: Fix null-ptr-deref in neigh_flush_dev().

    In the Linux kernel, the following vulnerability has been resolved: neighbour: Fix null-ptr-deref in neigh_flush_dev(). kernel test robot reported null-ptr-deref in neigh_flush_dev(). [0] The cited commit introduced per-netdev neighbour list and converted nei…

  • Unscored —

    bpf: Reject narrower access to pointer ctx fields

    In the Linux kernel, the following vulnerability has been resolved: bpf: Reject narrower access to pointer ctx fields The following BPF program, simplified from a syzkaller repro, causes a kernel warning: r0 = *(u8 *)(r1 + 169); exit; With pointer field sk be…

  • Unscored —

    drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port

    In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port Each window of a vop2 is usable by a specific set of video ports, so while binding the vop2, we look through the l…

  • Unscored —

    iwlwifi: Add missing check for alloc_ordered_workqueue

    In the Linux kernel, the following vulnerability has been resolved: iwlwifi: Add missing check for alloc_ordered_workqueue Add check for the return value of alloc_ordered_workqueue since it may return NULL pointer.

  • Unscored —
    CVE-2025-38603 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() In ath12k_dp_tx_get_encap_type(), the arvif parameter is only used to retrieve the ab pointer. In vdev delete sequence …

  • Unscored —

    wifi: ath12k: Avoid accessing uninitialized arvif->ar during beacon miss

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Avoid accessing uninitialized arvif->ar during beacon miss During beacon miss handling, ath12k driver iterates over active virtual interfaces (vifs) and attempts to access the r…

  • Unscored —

    PM / devfreq: Check governor before using governor->name

    In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Check governor before using governor->name Commit 96ffcdf239de ("PM / devfreq: Remove redundant governor_name from struct devfreq") removes governor_name and uses governor->name…

  • Unscored —

    powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()

    In the Linux kernel, the following vulnerability has been resolved: powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() The get_pd_power_uw() function can crash with a NULL pointer dereference when em_cpu_get() returns NULL. This occurs when…

  • Unscored —
    CVE-2025-38611 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()

    In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() In the error paths after fb_info structure is successfully allocated, the memory allocated in fb_deferred_io_init() for …

  • Unscored —

    staging: gpib: fix unset padding field copy back to userspace

    In the Linux kernel, the following vulnerability has been resolved: staging: gpib: fix unset padding field copy back to userspace The introduction of a padding field in the gpib_board_info_ioctl is showing up as initialized data on the stack frame being copyi…

Revision history

  1. #130

    Neue Updates von SUSE aufgenommen

  2. #129

    Neue Updates von SUSE aufgenommen

  3. #128

    Neue Updates von Ubuntu aufgenommen

  4. #127

    Neue Updates von Ubuntu aufgenommen

  5. #126

    Neue Updates von SUSE aufgenommen

  6. #125

    Neue Updates von SUSE aufgenommen

  7. #124

    Neue Updates von Debian aufgenommen

  8. #123

    Neue Updates von Ubuntu aufgenommen

  9. #122

    Neue Updates von Ubuntu aufgenommen

  10. #121

    Neue Updates von Ubuntu aufgenommen

  11. #120

    Neue Updates von Oracle Linux aufgenommen

  12. #119

    Neue Updates von Dell aufgenommen

  13. #118

    Neue Updates von Ubuntu aufgenommen

  14. #117

    Neue Updates von Oracle Linux aufgenommen

  15. #116

    Neue Updates von Oracle Linux aufgenommen

  16. #115

    Neue Updates von Oracle Linux aufgenommen

  17. #114

    Neue Updates von Oracle Linux aufgenommen

  18. #113

    Neue Updates von Oracle Linux aufgenommen

  19. #112

    Neue Updates von Oracle Linux aufgenommen

  20. #111

    Neue Updates von Oracle Linux aufgenommen

  21. #110

    Neue Updates von Ubuntu aufgenommen

  22. #109

    Neue Updates von Ubuntu aufgenommen

  23. #108

    Neue Updates von Oracle Linux und Ubuntu aufgenommen

  24. #107

    Neue Updates von Ubuntu aufgenommen

  25. #106

    Neue Updates von Ubuntu aufgenommen

References