Skip to content
OpenAdvisories
High WID-SEC-2025-2394 68 CVEs

Linux Kernel: Mehrere Schwachstellen

Published Oct 22, 2025 · Updated Nov 9, 2026 · Revision 38 · de

Summary

Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff oder andere, nicht näher spezifizierte Angriffe durchzuführen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 68

  • High 8.2

    ipv6: Fix out-of-bounds access in ipv6_find_tlv()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix out-of-bounds access in ipv6_find_tlv() optlen is fetched without checking whether there is more than one byte to parse. It can lead to out-of-bounds access. Found by InfoTeCS on be…

  • High 8.2

    NFS: Fix a potential data corruption

    In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a potential data corruption We must ensure that the subrequests are joined back into the head before we can retransmit a request. If the head was not on the commit lists, because the…

  • High 7.8

    fs: jfs: fix shift-out-of-bounds in dbAllocAG

    In the Linux kernel, the following vulnerability has been resolved: fs: jfs: fix shift-out-of-bounds in dbAllocAG Syzbot found a crash : UBSAN: shift-out-of-bounds in dbAllocAG. The underlying bug is the missing check of bmp->db_agl2size. The field can be gre…

  • High 7.8

    xfrm: Update ipcomp_scratches with NULL when freed

    In the Linux kernel, the following vulnerability has been resolved: xfrm: Update ipcomp_scratches with NULL when freed Currently if ipcomp_alloc_scratches() fails to allocate memory ipcomp_scratches holds obsolete address. So when we try to free the percpu sc…

  • High 7.8

    platform/chrome: fix memory corruption in ioctl

    In the Linux kernel, the following vulnerability has been resolved: platform/chrome: fix memory corruption in ioctl If "s_mem.bytes" is larger than the buffer size it leads to memory corruption.

  • High 7.8

    hfs: fix OOB Read in __hfs_brec_find

    In the Linux kernel, the following vulnerability has been resolved: hfs: fix OOB Read in __hfs_brec_find Syzbot reported a OOB read bug: ================================================================== BUG: KASAN: slab-out-of-bounds in hfs_strcmp+0x117/0x19…

  • High 7.8

    ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline

    In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline Syzbot found the following issue: loop0: detected capacity change from 0 to 2048 EXT4-fs (loop0): mounted filesystem 00…

  • High 7.8

    udf: Detect system inodes linked into directory hierarchy

    In the Linux kernel, the following vulnerability has been resolved: udf: Detect system inodes linked into directory hierarchy When UDF filesystem is corrupted, hidden system inodes can be linked into directory hierarchy which is an avenue for further serious …

  • High 7.8

    xsk: fix refcount underflow in error path

    In the Linux kernel, the following vulnerability has been resolved: xsk: fix refcount underflow in error path Fix a refcount underflow problem reported by syzbot that can happen when a system is running out of memory. If xp_alloc_tx_descs() fails, and it can …

  • High 7.8

    drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1 The type of size is unsigned int, if size is 0x40000000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t…

  • High 7.8

    arm64: sme: Use STR P to clear FFR context field in streaming SVE mode

    In the Linux kernel, the following vulnerability has been resolved: arm64: sme: Use STR P to clear FFR context field in streaming SVE mode The FFR is a predicate register which can vary between 16 and 256 bits in size depending upon the configured vector leng…

  • High 7.8

    ring-buffer: Do not swap cpu_buffer during resize process

    In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not swap cpu_buffer during resize process When ring_buffer_swap_cpu was called during resize process, the cpu buffer was swapped in the middle, resulting in incorrect state. C…

  • High 7.8

    soc: qcom: qmi_encdec: Restrict string length in decode

    In the Linux kernel, the following vulnerability has been resolved: soc: qcom: qmi_encdec: Restrict string length in decode The QMI TLV value for strings in a lot of qmi element info structures account for null terminated strings with MAX_LEN + 1. If a string…

  • High 7.1

    arm64: csum: Fix OoB access in IP checksum code for negative lengths

    In the Linux kernel, the following vulnerability has been resolved: arm64: csum: Fix OoB access in IP checksum code for negative lengths Although commit c2c24edb1d9c ("arm64: csum: Fix pathological zero-length calls") added an early return for zero-length inp…

  • Unscored —

    drm: Fix potential null-ptr-deref due to drmm_mode_config_init()

    In the Linux kernel, the following vulnerability has been resolved: drm: Fix potential null-ptr-deref due to drmm_mode_config_init() drmm_mode_config_init() will call drm_mode_create_standard_properties() and won't check the ret value. When drm_mode_create_st…

  • Unscored —

    pinctrl: thunderbay: fix possible memory leak in thunderbay_build_functions()

    In the Linux kernel, the following vulnerability has been resolved: pinctrl: thunderbay: fix possible memory leak in thunderbay_build_functions() The thunderbay_add_functions() will free memory of thunderbay_funcs when everything is ok, but thunderbay_funcs w…

  • Unscored —

    regmap-irq: Use the new num_config_regs property in regmap_add_irq_chip_fwnode

    In the Linux kernel, the following vulnerability has been resolved: regmap-irq: Use the new num_config_regs property in regmap_add_irq_chip_fwnode Commit faa87ce9196d ("regmap-irq: Introduce config registers for irq types") added the num_config_regs, then com…

  • Unscored —

    clk: imx: scu: fix memleak on platform_device_add() fails

    In the Linux kernel, the following vulnerability has been resolved: clk: imx: scu: fix memleak on platform_device_add() fails No error handling is performed when platform_device_add() fails. Add error processing before return, and modified the return value.

  • Unscored —

    drm/meson: explicitly remove aggregate driver at module unload time

    In the Linux kernel, the following vulnerability has been resolved: drm/meson: explicitly remove aggregate driver at module unload time Because component_master_del wasn't being called when unloading the meson_drm module, the aggregate device would linger for…

  • Unscored —

    iio: fix memory leak in iio_device_register_eventset()

    In the Linux kernel, the following vulnerability has been resolved: iio: fix memory leak in iio_device_register_eventset() When iio_device_register_sysfs_group() returns failed, iio_device_register_eventset() needs to free attrs array. Otherwise, kmemleak wou…

  • Unscored —

    tpm: acpi: Call acpi_put_table() to fix memory leak

    In the Linux kernel, the following vulnerability has been resolved: tpm: acpi: Call acpi_put_table() to fix memory leak The start and length of the event log area are obtained from TPM2 or TCPA table, so we call acpi_get_table() to get the ACPI information, b…

  • Unscored —

    dm thin: Fix UAF in run_timer_softirq()

    In the Linux kernel, the following vulnerability has been resolved: dm thin: Fix UAF in run_timer_softirq() When dm_resume() and dm_destroy() are concurrent, it will lead to UAF, as follows: BUG: KASAN: use-after-free in __run_timers+0x173/0x710 Write of size…

  • Unscored —

    s390/netiucv: Fix return type of netiucv_tx()

    In the Linux kernel, the following vulnerability has been resolved: s390/netiucv: Fix return type of netiucv_tx() With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer pr…

  • Unscored —

    wifi: plfxlc: fix potential memory leak in __lf_x_usb_enable_rx()

    In the Linux kernel, the following vulnerability has been resolved: wifi: plfxlc: fix potential memory leak in __lf_x_usb_enable_rx() urbs does not be freed in exception paths in __lf_x_usb_enable_rx(). That will trigger memory leak. To fix it, add kfree() fo…

  • Unscored —

    mtd: Fix device name leak when register device failed in add_mtd_device()

    In the Linux kernel, the following vulnerability has been resolved: mtd: Fix device name leak when register device failed in add_mtd_device() There is a kmemleak when register device failed: unreferenced object 0xffff888101aab550 (size 8): comm "insmod", pid …

  • Unscored —

    usb: gadget: f_hid: fix f_hidg lifetime vs cdev

    In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_hid: fix f_hidg lifetime vs cdev The embedded struct cdev does not have its lifetime correctly tied to the enclosing struct f_hidg, so there is a use-after-free if /dev/hidgN i…

  • Unscored —

    btrfs: call __btrfs_remove_free_space_cache_locked on cache load failure

    In the Linux kernel, the following vulnerability has been resolved: btrfs: call __btrfs_remove_free_space_cache_locked on cache load failure Now that lockdep is staying enabled through our entire CI runs I started seeing the following stack in generic/475 ---…

  • Unscored —

    ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link()

    In the Linux kernel, the following vulnerability has been resolved: ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link() The of_get_next_child() returns a node with refcount incremented, and decrements the refcount of prev. So in the…

  • Unscored —

    wifi: mt76: mt7915: fix mt7915_rate_txpower_get() resource leaks

    In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix mt7915_rate_txpower_get() resource leaks Coverity message: variable "buf" going out of scope leaks the storage. Addresses-Coverity-ID: 1527799 ("Resource leaks")

  • Unscored —

    drm/omap: dss: Fix refcount leak bugs

    In the Linux kernel, the following vulnerability has been resolved: drm/omap: dss: Fix refcount leak bugs In dss_init_ports() and __dss_uninit_ports(), we should call of_node_put() for the reference returned by of_graph_get_port_by_id() in fail path or when i…

  • Unscored —

    xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource()

    In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource() As 'kdata.num' is user-controlled data, if user tries to allocate memory larger than(>=) MAX_ORDER, then kcalloc() will fa…

  • Unscored —

    serial: pch: Fix PCI device refcount leak in pch_request_dma()

    In the Linux kernel, the following vulnerability has been resolved: serial: pch: Fix PCI device refcount leak in pch_request_dma() As comment of pci_get_slot() says, it returns a pci_device with its refcount increased. The caller must decrement the reference …

  • Unscored —

    ima: Fix memory leak in __ima_inode_hash()

    In the Linux kernel, the following vulnerability has been resolved: ima: Fix memory leak in __ima_inode_hash() Commit f3cc6b25dcc5 ("ima: always measure and audit files in policy") lets measurement or audit happen even if the file digest cannot be calculated.…

  • Unscored —

    class: fix possible memory leak in __class_register()

    In the Linux kernel, the following vulnerability has been resolved: class: fix possible memory leak in __class_register() If class_add_groups() returns error, the 'cp->subsys' need be unregister, and the 'cp' need be freed. We can not call kset_unregister() h…

  • Unscored —

    arm64: ftrace: fix module PLTs with mcount

    In the Linux kernel, the following vulnerability has been resolved: arm64: ftrace: fix module PLTs with mcount Li Huafei reports that mcount-based ftrace with module PLTs was broken by commit: a6253579977e4c6f ("arm64: ftrace: consistently handle PLTs.") When…

  • Unscored —

    blk-throttle: prevent overflow while calculating wait time

    In the Linux kernel, the following vulnerability has been resolved: blk-throttle: prevent overflow while calculating wait time There is a problem found by code review in tg_with_in_bps_limit() that 'bps_limit * jiffy_elapsed_rnd' might overflow. Fix the probl…

  • Unscored —

    regulator: core: Prevent integer underflow

    In the Linux kernel, the following vulnerability has been resolved: regulator: core: Prevent integer underflow By using a ratio of delay to poll_enabled_time that is not integer time_remaining underflows and does not exit the loop as expected. As delay could …

  • Unscored —

    USB: gadget: Fix the memory leak in raw_gadget driver

    In the Linux kernel, the following vulnerability has been resolved: USB: gadget: Fix the memory leak in raw_gadget driver Currently, increasing raw_dev->count happens before invoke the raw_queue_event(), if the raw_queue_event() return error, invoke raw_relea…

  • Unscored —

    riscv: ftrace: Fixup panic by disabling preemption

    In the Linux kernel, the following vulnerability has been resolved: riscv: ftrace: Fixup panic by disabling preemption In RISCV, we must use an AUIPC + JALR pair to encode an immediate, forming a jump that jumps to an address over 4K. This may cause errors if…

  • Unscored —

    scsi: qla2xxx: Fix memory leak in qla2x00_probe_one()

    In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix memory leak in qla2x00_probe_one() There is a memory leak reported by kmemleak: unreferenced object 0xffffc900003f0000 (size 12288): comm "modprobe", pid 19117, jiffies 429…

  • Unscored —

    nvdimm: Fix memleak of pmu attr_groups in unregister_nvdimm_pmu()

    In the Linux kernel, the following vulnerability has been resolved: nvdimm: Fix memleak of pmu attr_groups in unregister_nvdimm_pmu() Memory pointed by 'nd_pmu->pmu.attr_groups' is allocated in function 'register_nvdimm_pmu' and is lost after 'kfree(nd_pmu)' …

  • Unscored —

    riscv: move memblock_allow_resize() after linear mapping is ready

    In the Linux kernel, the following vulnerability has been resolved: riscv: move memblock_allow_resize() after linear mapping is ready The initial memblock metadata is accessed from kernel image mapping. The regions arrays need to "reallocated" from memblock a…

  • Unscored —

    media: max9286: Fix memleak in max9286_v4l2_register()

    In the Linux kernel, the following vulnerability has been resolved: media: max9286: Fix memleak in max9286_v4l2_register() There is a kmemleak when testing the media/i2c/max9286.c with bpf mock device: kmemleak: 5 new suspected memory leaks (see /sys/kernel/d…

  • Unscored —
    CVE-2023-53701 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    s390/crypto: use vector instructions only if available for ChaCha20

    In the Linux kernel, the following vulnerability has been resolved: s390/crypto: use vector instructions only if available for ChaCha20 Commit 349d03ffd5f6 ("crypto: s390 - add crypto library interface for ChaCha20") added a library interface to the s390 spec…

  • Unscored —

    HID: amd_sfh: Fix for shift-out-of-bounds

    In the Linux kernel, the following vulnerability has been resolved: HID: amd_sfh: Fix for shift-out-of-bounds Shift operation of 'exp' and 'shift' variables exceeds the maximum number of shift values in the u32 range leading to UBSAN shift-out-of-bounds. ... …

  • Unscored —

    clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe()

    In the Linux kernel, the following vulnerability has been resolved: clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe() Replace of_iomap() and kzalloc() with devm_of_iomap() and devm_kzalloc() which can automatically release the related memo…

  • Unscored —

    mm/vmemmap/devdax: fix kernel crash when probing devdax devices

    In the Linux kernel, the following vulnerability has been resolved: mm/vmemmap/devdax: fix kernel crash when probing devdax devices commit 4917f55b4ef9 ("mm/sparse-vmemmap: improve memory savings for compound devmaps") added support for using optimized vmmema…

  • Unscored —

    ACPI: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objects

    In the Linux kernel, the following vulnerability has been resolved: ACPI: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objects If a badly constructed firmware includes multiple `ACPI_TYPE_PACKAGE` objects while evaluating the AMD LPS0 _DSM, there will be a m…

  • Unscored —

    ring-buffer: Handle race between rb_move_tail and rb_check_pages

    In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Handle race between rb_move_tail and rb_check_pages It seems a data race between ring_buffer writing and integrity check. That is, RB_FLAG of head_page is been updating, while at…

  • Unscored —

    wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read

    In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read Kernel NULL pointer dereference when ACPI SAR table isn't implemented well. Fix the error code of return to mark the ACPI SAR …

  • Unscored —

    ARM: 9317/1: kexec: Make smp stop calls asynchronous

    In the Linux kernel, the following vulnerability has been resolved: ARM: 9317/1: kexec: Make smp stop calls asynchronous If a panic is triggered by a hrtimer interrupt all online cpus will be notified and set offline. But as highlighted by commit 19dbdcb8039c…

  • Unscored —

    drm/stm: ltdc: fix late dereference check

    In the Linux kernel, the following vulnerability has been resolved: drm/stm: ltdc: fix late dereference check In ltdc_crtc_set_crc_source(), struct drm_crtc was dereferenced in a container_of() before the pointer check. This could cause a kernel panic. Fix th…

  • Unscored —

    wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex

    In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex Apparently the hex passphrase mechanism does not work on newer chips/firmware (e.g. BCM4387). It seems there was a simple way o…

  • Unscored —

    net: fix skb leak in __skb_tstamp_tx()

    In the Linux kernel, the following vulnerability has been resolved: net: fix skb leak in __skb_tstamp_tx() Commit 50749f2dd685 ("tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.") added a call to skb_orphan_frags_rx() to fix leaks with zerocop…

  • Unscored —

    wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() Fix a stack-out-of-bounds write that occurs in a WMI response callback function that is called after a timeout…

  • Unscored —

    serial: arc_uart: fix of_iomap leak in `arc_serial_probe`

    In the Linux kernel, the following vulnerability has been resolved: serial: arc_uart: fix of_iomap leak in `arc_serial_probe` Smatch reports: drivers/tty/serial/arc_uart.c:631 arc_serial_probe() warn: 'port->membase' from of_iomap() not released on lines: 631…

  • Unscored —

    net/mlx5e: Release the label when replacing existing ct entry

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Release the label when replacing existing ct entry Cited commit doesn't release the label mapping when replacing existing ct entry which leads to following memleak report: unrefere…

  • Unscored —

    wifi: ath12k: Fix a NULL pointer dereference in ath12k_mac_op_hw_scan()

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix a NULL pointer dereference in ath12k_mac_op_hw_scan() In ath12k_mac_op_hw_scan(), the return value of kzalloc() is directly used in memcpy(), which may lead to a NULL pointe…

  • Unscored —

    md: raid1: fix potential OOB in raid1_remove_disk()

    In the Linux kernel, the following vulnerability has been resolved: md: raid1: fix potential OOB in raid1_remove_disk() If rddev->raid_disk is greater than mddev->raid_disks, there will be an out-of-bounds in raid1_remove_disk(). We have already found similar…

  • Unscored —

    drm/amdgpu: disable sdma ecc irq only when sdma RAS is enabled in suspend

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: disable sdma ecc irq only when sdma RAS is enabled in suspend sdma_v4_0_ip is shared on a few asics, but in sdma_v4_0_hw_fini, driver unconditionally disables ecc_irq which is onl…

  • Unscored —

    mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()

    In the Linux kernel, the following vulnerability has been resolved: mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() `req` is allocated in pcf50633_adc_async_read(), but adc_enqueue_request() could fail to insert the `req` into queue. We …

  • Unscored —

    clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe

    In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe Smatch reports: drivers/clocksource/timer-cadence-ttc.c:529 ttc_timer_probe() warn: 'timer_baseaddr' from of_iomap() not re…

  • Unscored —

    net/sched: fq_pie: avoid stalls in fq_pie_timer()

    In the Linux kernel, the following vulnerability has been resolved: net/sched: fq_pie: avoid stalls in fq_pie_timer() When setting a high number of flows (limit being 65536), fq_pie_timer() is currently using too much time as syzbot reported. Add logic to yie…

  • Unscored —

    posix-timers: Ensure timer ID search-loop limit is valid

    In the Linux kernel, the following vulnerability has been resolved: posix-timers: Ensure timer ID search-loop limit is valid posix_timer_add() tries to allocate a posix timer ID by starting from the cached ID which was stored by the last successful allocation…

  • Unscored —

    blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost

    In the Linux kernel, the following vulnerability has been resolved: blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost adjust_inuse_and_calc_cost() use spin_lock_irq() and IRQ will be enabled when unlock. DEADLOCK might happen if we have held oth…

  • Unscored —

    netlink: fix potential deadlock in netlink_set_err()

    In the Linux kernel, the following vulnerability has been resolved: netlink: fix potential deadlock in netlink_set_err() syzbot reported a possible deadlock in netlink_set_err() [1] A similar issue was fixed in commit 1d482e666b8e ("netlink: disable IRQs for …

  • Unscored —

    fs/ntfs3: Fix NULL dereference in ni_write_inode

    In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix NULL dereference in ni_write_inode Syzbot reports a NULL dereference in ni_write_inode. When creating a new inode, if allocation fails in mi_init function (called in mi_format_n…

Revision history

  1. #38

    Neue Updates von Ubuntu aufgenommen

  2. #37

    Neue Updates von Ubuntu aufgenommen

  3. #36

    Neue Updates von SUSE aufgenommen

  4. #35

    Neue Updates von Debian aufgenommen

  5. #34

    Neue Updates von Dell aufgenommen

  6. #33

    Neue Updates von Dell aufgenommen

  7. #32

    Neue Updates von SUSE aufgenommen

  8. #31

    Neue Updates von SUSE aufgenommen

  9. #30

    Neue Updates von SUSE und Oracle Linux aufgenommen

  10. #29

    Neue Updates von Oracle Linux aufgenommen

  11. #28

    Neue Updates von SUSE aufgenommen

  12. #27

    Neue Updates von SUSE aufgenommen

  13. #26

    Neue Updates von SUSE aufgenommen

  14. #25

    Neue Updates von Oracle Linux aufgenommen

  15. #24

    Neue Updates von SUSE aufgenommen

  16. #23

    Neue Updates von SUSE aufgenommen

  17. #22

    Neue Updates von SUSE aufgenommen

  18. #21

    Neue Updates von Dell aufgenommen

  19. #20

    Neue Updates von Red Hat und SUSE aufgenommen

  20. #19

    Neue Updates von Red Hat aufgenommen

  21. #18

    Neue Updates von SUSE aufgenommen

  22. #17

    Neue Updates von SUSE aufgenommen

  23. #16

    Neue Updates von Red Hat aufgenommen

  24. #15

    Neue Updates von Red Hat aufgenommen

  25. #14

    Neue Updates von SUSE aufgenommen

References