Skip to content
OpenAdvisories

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um Sicherheitsmechanismen zu umgehen, sowie einen Denial of Service Angriff oder andere nicht spezifizierte Angriffe durchzuführen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 55

  • Critical 9.8

    RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages

    In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages Ever since commit c2ff29e99a76 ("siw: Inline do_tcp_sendpages()"), we have been doing this: static int siw_tcp_sendpages(struct socke…

  • High 8.8

    wifi: ath12k: Correct tid cleanup when tid setup fails

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Correct tid cleanup when tid setup fails Currently, if any error occurs during ath12k_dp_rx_peer_tid_setup(), the tid value is already incremented, even though the corresponding…

  • High 8.8

    wifi: ath12k: Decrement TID on RX peer frag setup error handling

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Decrement TID on RX peer frag setup error handling Currently, TID is not decremented before peer cleanup, during error handling path of ath12k_dp_rx_peer_frag_setup(). This coul…

  • High 8.4

    bus: mhi: host: Detect events pointing to unexpected TREs

    In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Detect events pointing to unexpected TREs When a remote device sends a completion event to the host, it contains a pointer to the consumed TRE. The host uses this pointer to p…

  • High 7.8

    drm/xe/migrate: prevent potential UAF

    In the Linux kernel, the following vulnerability has been resolved: drm/xe/migrate: prevent potential UAF If we hit the error path, the previous fence (if there is one) has already been put() prior to this, so doing a fence_wait could lead to UAF. Tweak the f…

  • High 7.8

    btrfs: subpage: keep TOWRITE tag until folio is cleaned

    In the Linux kernel, the following vulnerability has been resolved: btrfs: subpage: keep TOWRITE tag until folio is cleaned btrfs_subpage_set_writeback() calls folio_start_writeback() the first time a folio is written back, and it also clears the PAGECACHE_TA…

  • High 7.8

    sched/ext: Fix invalid task state transitions on class switch

    In the Linux kernel, the following vulnerability has been resolved: sched/ext: Fix invalid task state transitions on class switch When enabling a sched_ext scheduler, we may trigger invalid task state transitions, resulting in warnings like the following (whi…

  • High 7.8

    drm/hisilicon/hibmc: fix irq_request()'s irq name variable is local

    In the Linux kernel, the following vulnerability has been resolved: drm/hisilicon/hibmc: fix irq_request()'s irq name variable is local The local variable is passed in request_irq (), and there will be use after free problem, which will make request_irq faile…

  • High 7.8

    iio: adc: ad7173: fix channels index for syscalib_mode

    In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad7173: fix channels index for syscalib_mode Fix the index used to look up the channel when accessing the syscalib_mode attribute. The address field is a 0-based index (same as scan…

  • High 7.8

    soc: qcom: mdt_loader: Ensure we don't read past the ELF header

    In the Linux kernel, the following vulnerability has been resolved: soc: qcom: mdt_loader: Ensure we don't read past the ELF header When the MDT loader is used in remoteproc, the ELF header is sanitized beforehand, but that's not necessary the case for other …

  • High 7.8

    dm: dm-crypt: Do not partially accept write BIOs with zoned targets

    In the Linux kernel, the following vulnerability has been resolved: dm: dm-crypt: Do not partially accept write BIOs with zoned targets Read and write operations issued to a dm-crypt target may be split according to the dm-crypt internal limits defined by the…

  • High 7.5

    net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM

    In the Linux kernel, the following vulnerability has been resolved: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM When performing Generic Segmentation Offload (GSO) on an IPv6 packet that contains extension headers, the kernel incor…

  • High 7.3

    btrfs: do not allow relocation of partially dropped subvolumes

    In the Linux kernel, the following vulnerability has been resolved: btrfs: do not allow relocation of partially dropped subvolumes [BUG] There is an internal report that balance triggered transaction abort, with the following call trace: item 85 key (59450982…

  • High 7.3

    crypto: x86/aegis - Add missing error checks

    In the Linux kernel, the following vulnerability has been resolved: crypto: x86/aegis - Add missing error checks The skcipher_walk functions can allocate memory and can fail, so checking for errors is necessary.

  • High 7.0

    mm/debug_vm_pgtable: clear page table entries at destroy_args()

    In the Linux kernel, the following vulnerability has been resolved: mm/debug_vm_pgtable: clear page table entries at destroy_args() The mm/debug_vm_pagetable test allocates manually page table entries for the tests it runs, using also its manually allocated m…

  • Unscored —

    mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock

    In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock When netpoll is enabled, calling pr_warn_once() while holding kmemleak_lock in mem_pool_alloc() can cause a deadlock due …

  • Unscored —

    mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()

    In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() A soft lockup warning was observed on a relative small system x86-64 system with 16 GB of memory when running a debug kernel with kme…

  • Unscored —

    iommu/arm-smmu-qcom: Add SM6115 MDSS compatible

    In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-qcom: Add SM6115 MDSS compatible Add the SM6115 MDSS compatible to clients compatible list, as it also needs that workaround. Without this workaround, for example, QRB4210 RB2 …

  • Unscored —

    drm/xe/migrate: don't overflow max copy size

    In the Linux kernel, the following vulnerability has been resolved: drm/xe/migrate: don't overflow max copy size With non-page aligned copy, we need to use 4 byte aligned pitch, however the size itself might still be close to our maximum of ~8M, and so the di…

  • Unscored —

    RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()

    In the Linux kernel, the following vulnerability has been resolved: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() The function divides number of online CPUs by num_core_siblings, and later checks the divider by zero. This implies a possibil…

  • Unscored —

    jfs: truncate good inode pages when hard link is 0

    In the Linux kernel, the following vulnerability has been resolved: jfs: truncate good inode pages when hard link is 0 The fileset value of the inode copy from the disk by the reproducer is AGGR_RESERVED_I. When executing evict, its hard link number is 0, so …

  • Unscored —

    rcu: Fix rcu_read_unlock() deadloop due to IRQ work

    In the Linux kernel, the following vulnerability has been resolved: rcu: Fix rcu_read_unlock() deadloop due to IRQ work During rcu_read_unlock_special(), if this happens during irq_exit(), we can lockup if an IPI is issued. This is because the IPI itself trig…

  • Unscored —

    rcutorture: Fix rcutorture_one_extend_check() splat in RT kernels

    In the Linux kernel, the following vulnerability has been resolved: rcutorture: Fix rcutorture_one_extend_check() splat in RT kernels For built with CONFIG_PREEMPT_RT=y kernels, running rcutorture tests resulted in the following splat: [ 68.797425] rcutorture…

  • Unscored —

    wifi: ath10k: shutdown driver when hardware is unreliable

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: shutdown driver when hardware is unreliable In rare cases, ath10k may lose connection with the PCIe bus due to some unknown reasons, which could further lead to system crashes d…

  • Unscored —

    drm/msm: Add error handling for krealloc in metadata setup

    In the Linux kernel, the following vulnerability has been resolved: drm/msm: Add error handling for krealloc in metadata setup Function msm_ioctl_gem_info_set_metadata() now checks for krealloc failure and returns -ENOMEM, avoiding potential NULL pointer dere…

  • Unscored —

    bpf: Forget ranges when refining tnum after JSET

    In the Linux kernel, the following vulnerability has been resolved: bpf: Forget ranges when refining tnum after JSET Syzbot reported a kernel warning due to a range invariant violation on the following BPF program. 0: call bpf_get_netns_cookie 1: if r0 == 0 g…

  • Unscored —

    rcu: Protect ->defer_qs_iw_pending from data race

    In the Linux kernel, the following vulnerability has been resolved: rcu: Protect ->defer_qs_iw_pending from data race On kernels built with CONFIG_IRQ_WORK=y, when rcu_read_unlock() is invoked within an interrupts-disabled region of code [1], it will invoke r…

  • Unscored —
    CVE-2025-39751 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    ARM: rockchip: fix kernel hang during smp initialization

    In the Linux kernel, the following vulnerability has been resolved: ARM: rockchip: fix kernel hang during smp initialization In order to bring up secondary CPUs main CPU write trampoline code to SRAM. The trampoline code is written while secondary CPUs are po…

  • Unscored —

    gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops

    In the Linux kernel, the following vulnerability has been resolved: gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops Clears up the warning added in 7ee3647243e5 ("migrate: Remove call to ->writepage") that occurs in various xfstests, causing "something found…

  • Unscored —

    mm/smaps: fix race between smaps_hugetlb_range and migration

    In the Linux kernel, the following vulnerability has been resolved: mm/smaps: fix race between smaps_hugetlb_range and migration smaps_hugetlb_range() handles the pte without holdling ptl, and may be concurrenct with migration, leaing to BUG_ON in pfn_swap_en…

  • Unscored —

    fs: Prevent file descriptor table allocations exceeding INT_MAX

    In the Linux kernel, the following vulnerability has been resolved: fs: Prevent file descriptor table allocations exceeding INT_MAX When sysctl_nr_open is set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file d…

  • Unscored —

    ALSA: usb-audio: Validate UAC3 cluster segment descriptors

    In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the…

  • Unscored —

    btrfs: qgroup: fix race between quota disable and quota rescan ioctl

    In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix race between quota disable and quota rescan ioctl There's a race between a task disabling quotas and another running the rescan ioctl that can result in a use-after-free of…

  • Unscored —

    usb: core: config: Prevent OOB read in SS endpoint companion parsing

    In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buf…

  • Unscored —

    drm/amd/display: add null check

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: add null check [WHY] Prevents null pointer dereferences to enhance function robustness [HOW] Adds early null check and return false if invalid.

  • Unscored —

    ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered

    In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered If a synchronous error is detected as a result of user-space process triggering a 2-bit uncorrected error, th…

  • Unscored —

    netfilter: ctnetlink: remove refcounting in expectation dumpers

    In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: remove refcounting in expectation dumpers Same pattern as previous patch: do not keep the expectation object alive via refcount, only store a cookie value and then use t…

  • Unscored —

    ALSA: timer: fix ida_free call while not allocated

    In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: fix ida_free call while not allocated In the snd_utimer_create() function, if the kasprintf() function return NULL, snd_utimer_put_id() will be called, finally use ida_free() to …

  • Unscored —

    net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit

    In the Linux kernel, the following vulnerability has been resolved: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit The following setup can trigger a WARNING in htb_activate due to the condition: !cl->leaf.q->q.qlen tc qdisc del dev lo …

  • Unscored —

    LoongArch: Optimize module load time by optimizing PLT/GOT counting

    In the Linux kernel, the following vulnerability has been resolved: LoongArch: Optimize module load time by optimizing PLT/GOT counting When enabling CONFIG_KASAN, CONFIG_PREEMPT_VOLUNTARY_BUILD and CONFIG_PREEMPT_VOLUNTARY at the same time, there will be sof…

  • Unscored —

    net/mlx5: HWS, fix complex rules rehash error flow

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, fix complex rules rehash error flow Moving rules from matcher to matcher should not fail. However, if it does fail due to various reasons, the error flow should allow the kerne…

  • Unscored —

    bnxt_en: Fix lockdep warning during rmmod

    In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix lockdep warning during rmmod The commit under the Fixes tag added a netdev_assert_locked() in bnxt_free_ntp_fltrs(). The lock should be held during normal run-time but the assert…

  • Unscored —

    regulator: pca9450: Use devm_register_sys_off_handler

    In the Linux kernel, the following vulnerability has been resolved: regulator: pca9450: Use devm_register_sys_off_handler With module test, there is error dump: ------------[ cut here ]------------ notifier callback pca9450_i2c_restart_handler already registe…

  • Unscored —

    drm/hisilicon/hibmc: fix the hibmc loaded failed bug

    In the Linux kernel, the following vulnerability has been resolved: drm/hisilicon/hibmc: fix the hibmc loaded failed bug When hibmc loaded failed, the driver use hibmc_unload to free the resource, but the mutexes in mode.config are not init, which will access…

  • Unscored —

    net: bridge: fix soft lockup in br_multicast_query_expired()

    In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix soft lockup in br_multicast_query_expired() When set multicast_query_interval to a large value, the local variable 'time' in br_multicast_send_query() may overflow. If the ti…

  • Unscored —

    iio: adc: rzg2l_adc: Set driver data before enabling runtime PM

    In the Linux kernel, the following vulnerability has been resolved: iio: adc: rzg2l_adc: Set driver data before enabling runtime PM When stress-testing the system by repeatedly unbinding and binding the ADC device in a loop, and the ADC is a supplier for anot…

  • Unscored —

    mm/mremap: fix WARN with uffd that has remap events disabled

    In the Linux kernel, the following vulnerability has been resolved: mm/mremap: fix WARN with uffd that has remap events disabled Registering userfaultd on a VMA that spans at least one PMD and then mremap()'ing that VMA can trigger a WARN when recovering from…

  • Unscored —

    crypto: acomp - Fix CFI failure due to type punning

    In the Linux kernel, the following vulnerability has been resolved: crypto: acomp - Fix CFI failure due to type punning To avoid a crash when control flow integrity is enabled, make the workspace ("stream") free function use a consistent type, and call it thr…

  • Unscored —

    parisc: Drop WARN_ON_ONCE() from flush_cache_vmap

    In the Linux kernel, the following vulnerability has been resolved: parisc: Drop WARN_ON_ONCE() from flush_cache_vmap I have observed warning to occassionally trigger.

  • Unscored —

    jbd2: prevent softlockup in jbd2_log_do_checkpoint()

    In the Linux kernel, the following vulnerability has been resolved: jbd2: prevent softlockup in jbd2_log_do_checkpoint() Both jbd2_log_do_checkpoint() and jbd2_journal_shrink_checkpoint_list() periodically release j_list_lock after processing a batch of buffe…

  • Unscored —

    PCI: endpoint: Fix configfs group list head handling

    In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix configfs group list head handling Doing a list_del() on the epf_group field of struct pci_epf_driver in pci_epf_remove_cfs() is not correct as this field is a list head, no…

  • Unscored —

    PCI: Fix link speed calculation on retrain failure

    In the Linux kernel, the following vulnerability has been resolved: PCI: Fix link speed calculation on retrain failure When pcie_failed_link_retrain() fails to retrain, it tries to revert to the previous link speed. However it calculates that speed from the L…

  • Unscored —

    scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE

    In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE On Google gs101, the number of UTP transfer request slots (nutrs) is 32, and in this case the driver ends up programming the UTRL_NEX…

  • Unscored —

    x86/vmscape: Add conditional IBPB mitigation

    In the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing …

Revision history

  1. #130

    Neue Updates von SUSE aufgenommen

  2. #129

    Neue Updates von SUSE aufgenommen

  3. #128

    Neue Updates von Debian aufgenommen

  4. #127

    Neue Updates von SUSE aufgenommen

  5. #126

    Neue Updates von SUSE aufgenommen

  6. #125

    Neue Updates von openSUSE aufgenommen

  7. #124

    Neue Updates von IBM aufgenommen

  8. #123

    Neue Updates von Ubuntu aufgenommen

  9. #122

    Neue Updates von Ubuntu aufgenommen

  10. #121

    Neue Updates von Dell aufgenommen

  11. #120

    Neue Updates von Ubuntu aufgenommen

  12. #119

    Neue Updates von Ubuntu aufgenommen

  13. #118

    Neue Updates von Oracle Linux aufgenommen

  14. #117

    Neue Updates von Ubuntu aufgenommen

  15. #116

    Neue Updates von Ubuntu aufgenommen

  16. #115

    Neue Updates von Ubuntu aufgenommen

  17. #114

    Neue Updates von Ubuntu aufgenommen

  18. #113

    Neue Updates von Oracle Linux aufgenommen

  19. #112

    Neue Updates von Ubuntu aufgenommen

  20. #111

    Neue Updates von IBM aufgenommen

  21. #110

    Neue Updates von Ubuntu aufgenommen

  22. #109

    Neue Updates von Siemens aufgenommen

  23. #108

    Neue Updates von Oracle Linux aufgenommen

  24. #107

    Neue Updates von Oracle Linux aufgenommen

  25. #106

    Neue Updates von Red Hat aufgenommen

References