Skip to content
OpenAdvisories
High WID-SEC-2025-2298 34 CVEs

Linux Kernel: Mehrere Schwachstellen

Published Oct 14, 2025 · Updated Nov 3, 2026 · Revision 110 · de-DE

Vendor: amazon Vendor: Debian Vendor: Dell Vendor: Google Vendor: IBM Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: Siemens Vendor: SUSE Vendor: Ubuntu Product: Container-Optimized OS Product: DataPower Gateway Product: ECS Product: Enterprise Linux Product: FlashSystem Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: NetWorker Product: openSUSE Product: QRadar SIEM Product: Rocky Linux Product: SAN Volume Controller Product: SIMATIC S7 Product: Storwize Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen, Daten zu manipulieren und andere, nicht näher spezifizierte Angriffe durchzuführen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 34

  • Critical 9.8
    CVE-2025-39975

    smb: client: fix wrong index reference in smb2_compound_op()

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix wrong index reference in smb2_compound_op() In smb2_compound_op(), the loop that processes each command's response uses wrong indices when accessing response bufferes. This i…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2025-39969

    i40e: fix validation of VF state in get resources

    In the Linux kernel, the following vulnerability has been resolved: i40e: fix validation of VF state in get resources VF state I40E_VF_STATE_ACTIVE is not the only state in which VF is actually active so it should not be used to determine if a VF is allowed t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2025-39970

    i40e: fix input validation logic for action_meta

    In the Linux kernel, the following vulnerability has been resolved: i40e: fix input validation logic for action_meta Fix condition to check 'greater or equal' to prevent OOB dereference.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2025-39971

    i40e: fix idx validation in config queues msg

    In the Linux kernel, the following vulnerability has been resolved: i40e: fix idx validation in config queues msg Ensure idx is within range of active/initialized TCs when iterating over vf->ch[idx] in i40e_vc_config_queues_msg().

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2025-39972

    i40e: fix idx validation in i40e_validate_queue_map

    In the Linux kernel, the following vulnerability has been resolved: i40e: fix idx validation in i40e_validate_queue_map Ensure idx is within range of active/initialized TCs when iterating over vf->ch[idx] in i40e_validate_queue_map().

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2025-39973

    i40e: add validation for ring_len param

    In the Linux kernel, the following vulnerability has been resolved: i40e: add validation for ring_len param The `ring_len` parameter provided by the virtual function (VF) is assigned directly to the hardware memory context (HMC) without any validation. To add…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2025-39982

    Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync This fixes the following UFA in hci_acl_create_conn_sync where a connection still pending is command submission (conn->state == BT_OP…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2025-39983

    Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue This fixes the following UAF caused by not properly locking hdev when processing HCI_EV_NUM_COMP_PKTS: BUG: KASAN: slab-use-after-free in …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2025-40000

    wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()

    In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() There is a bug observed when rtw89_core_tx_kick_off_and_wait() tries to access already freed skb_data: BUG: KFENCE: use-af…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-39966

    iommufd: Fix race during abort for file descriptors

    In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix race during abort for file descriptors fput() doesn't actually call file_operations release() synchronously, it puts the file on a work queue and it will be released eventually. …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-39967

    fbcon: fix integer overflow in fbcon_do_set_font

    In the Linux kernel, the following vulnerability has been resolved: fbcon: fix integer overflow in fbcon_do_set_font Fix integer overflow vulnerabilities in fbcon_do_set_font() where font size calculations could overflow when handling user-controlled font par…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-39976

    futex: Use correct exit on failure from futex_hash_allocate_default()

    In the Linux kernel, the following vulnerability has been resolved: futex: Use correct exit on failure from futex_hash_allocate_default() copy_process() uses the wrong error exit path from futex_hash_allocate_default(). After exiting from futex_hash_allocate_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-39977

    futex: Prevent use-after-free during requeue-PI

    In the Linux kernel, the following vulnerability has been resolved: futex: Prevent use-after-free during requeue-PI syzbot managed to trigger the following race: T1 T2 futex_wait_requeue_pi() futex_do_wait() schedule() futex_requeue() futex_proxy_trylock_atom…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-39978

    octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()

    In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() This code calls kfree_rcu(new_node, rcu) and then dereferences "new_node" and then dereferences it on the next line. Two lines…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-39979

    net/mlx5: fs, fix UAF in flow counter release

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fs, fix UAF in flow counter release Fix a kernel trace [1] caused by releasing an HWS action of a local flow counter in mlx5_cmd_hws_delete_fte(), where the HWS action refcount and …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-39981

    Bluetooth: MGMT: Fix possible UAFs

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix possible UAFs This attemps to fix possible UAFs caused by struct mgmt_pending being freed while still being processed like in the following trace, in order to fix mgmt_pe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-39985

    can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow

    In the Linux kernel, the following vulnerability has been resolved: can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow Sending an PF_PACKET allows to bypass the CAN framework logic and to directly reach the xmit() function of a CAN driver. Th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-39986

    can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow

    In the Linux kernel, the following vulnerability has been resolved: can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow Sending an PF_PACKET allows to bypass the CAN framework logic and to directly reach the xmit() function of a CAN driver. T…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-39987

    can: hi311x: populate ndo_change_mtu() to prevent buffer overflow

    In the Linux kernel, the following vulnerability has been resolved: can: hi311x: populate ndo_change_mtu() to prevent buffer overflow Sending an PF_PACKET allows to bypass the CAN framework logic and to directly reach the xmit() function of a CAN driver. The …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-39988

    can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow

    In the Linux kernel, the following vulnerability has been resolved: can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow Sending an PF_PACKET allows to bypass the CAN framework logic and to directly reach the xmit() function of a CAN driver. …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-39990

    bpf: Check the helper function is valid in get_helper_proto

    In the Linux kernel, the following vulnerability has been resolved: bpf: Check the helper function is valid in get_helper_proto kernel test robot reported verifier bug [1] where the helper func pointer could be NULL due to disabled config option. As Alexei su…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-39993

    media: rc: fix races with imon_disconnect()

    In the Linux kernel, the following vulnerability has been resolved: media: rc: fix races with imon_disconnect() Syzbot reports a KASAN issue as below: BUG: KASAN: use-after-free in __create_pipe include/linux/usb.h:1945 [inline] BUG: KASAN: use-after-free in …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.3
    CVE-2025-39968

    i40e: add max boundary check for VF filters

    In the Linux kernel, the following vulnerability has been resolved: i40e: add max boundary check for VF filters There is no check for max filters that VF can request. Add it.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.3
    CVE-2025-39994

    media: tuner: xc5000: Fix use-after-free in xc5000_release

    In the Linux kernel, the following vulnerability has been resolved: media: tuner: xc5000: Fix use-after-free in xc5000_release The original code uses cancel_delayed_work() in xc5000_release(), which does not guarantee that the delayed work item timer_sleep ha…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2025-39998

    scsi: target: target_core_configfs: Add length check to avoid buffer overflow

    In the Linux kernel, the following vulnerability has been resolved: scsi: target: target_core_configfs: Add length check to avoid buffer overflow A buffer overflow arises from the usage of snprintf to write into the buffer "buf" in target_lu_gp_members_show f…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-39974

    tracing/osnoise: Fix slab-out-of-bounds in _parse_integer_limit()

    In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Fix slab-out-of-bounds in _parse_integer_limit() When config osnoise cpus by write() syscall, the following KASAN splat may be observed: BUG: KASAN: slab-out-of-bounds in _pa…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-39980

    nexthop: Forbid FDB status change while nexthop is in a group

    In the Linux kernel, the following vulnerability has been resolved: nexthop: Forbid FDB status change while nexthop is in a group The kernel forbids the creation of non-FDB nexthop groups with FDB nexthops: # ip nexthop add id 1 via 192.0.2.1 fdb # ip nexthop…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-39984

    net: tun: Update napi->skb after XDP process

    In the Linux kernel, the following vulnerability has been resolved: net: tun: Update napi->skb after XDP process The syzbot report a UAF issue: BUG: KASAN: slab-use-after-free in skb_reset_mac_header include/linux/skbuff.h:3150 [inline] BUG: KASAN: slab-use-a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-39991

    wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() If ab->fw.m3_data points to data, then fw pointer remains null. Further, if m3_mem is not allocated, then fw is dereferenced to be p…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-39992

    mm: swap: check for stable address space before operating on the VMA

    In the Linux kernel, the following vulnerability has been resolved: mm: swap: check for stable address space before operating on the VMA It is possible to hit a zero entry while traversing the vmas in unuse_mm() called from swapoff path and accessing it cause…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-39995

    media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe

    In the Linux kernel, the following vulnerability has been resolved: media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe The state->timer is a cyclic timer that schedules work_i2c_poll and delayed_work_enable_hotplug, while rearming i…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-39996

    media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove

    In the Linux kernel, the following vulnerability has been resolved: media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove The original code uses cancel_delayed_work() in flexcop_pci_remove(), which does not guarantee that the delayed…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-39997

    ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free

    In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free The previous commit 0718a78f6a9f ("ALSA: usb-audio: Kill timer properly at removal") patched a UAF issue caused by the error tim…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-39999

    blk-mq: fix blk_mq_tags double free while nr_requests grown

    In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix blk_mq_tags double free while nr_requests grown In the case user trigger tags grow by queue sysfs attribute nr_requests, hctx->sched_tags will be freed directly and replaced with …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Revision history

  1. #110

    Neue Updates von IBM aufgenommen

  2. #109

    Neue Updates von IBM aufgenommen

  3. #108

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  4. #107

    Neue Updates von Red Hat aufgenommen

  5. #106

    Neue Updates von Ubuntu aufgenommen

  6. #105

    Neue Updates von IBM aufgenommen

  7. #104

    Neue Updates von Red Hat aufgenommen

  8. #103

    Neue Updates von IBM aufgenommen

  9. #102

    Neue Updates von Siemens aufgenommen

  10. #101

    Neue Updates von Oracle Linux aufgenommen

  11. #100

    Neue Updates von Debian aufgenommen

  12. #99

    Neue Updates von Rocky Enterprise Software Foundation und Oracle Linux aufgenommen

  13. #98

    Neue Updates von Red Hat aufgenommen

  14. #97

    Neue Updates von Red Hat aufgenommen

  15. #96

    Neue Updates von SUSE aufgenommen

  16. #95

    Neue Updates von Dell aufgenommen

  17. #94

    Neue Updates von SUSE aufgenommen

  18. #93

    Neue Updates von SUSE aufgenommen

  19. #92

    Neue Updates von SUSE aufgenommen

  20. #91

    Neue Updates von SUSE aufgenommen

  21. #90

    Neue Updates von SUSE aufgenommen

  22. #89

    Neue Updates von SUSE aufgenommen

  23. #88

    Neue Updates von SUSE und Red Hat aufgenommen

  24. #87

    Neue Updates von SUSE aufgenommen

  25. #86

    Neue Updates von Red Hat, openSUSE und SUSE aufgenommen

References