Skip to content
OpenAdvisories
High WID-SEC-2025-2450 20 CVEs

Linux Kernel: Mehrere Schwachstellen

Published Oct 29, 2025 · Updated Nov 12, 2026 · Revision 90 · de

Vendor: amazon Vendor: Debian Vendor: Dell Vendor: Google Vendor: IBM Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: Siemens Vendor: SUSE Vendor: Ubuntu Product: Avamar Product: Container-Optimized OS Product: DataPower Gateway Product: ECS Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: NetWorker Product: openSUSE Product: Rocky Linux Product: SIMATIC S7 Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um nicht näher spezifizierte Angriffe durchzuführen, die möglicherweise zu einer Denial-of-Service-Situation führen oder eine Speicherbeschädigung verursachen können.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 20

  • Critical 9.4
    CVE-2025-40099

    cifs: parse_dfs_referrals: prevent oob on malformed input

    In the Linux kernel, the following vulnerability has been resolved: cifs: parse_dfs_referrals: prevent oob on malformed input Malicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS - reply smaller than sizeof(struct get_dfs_referral_rsp) - rep…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40092

    usb: gadget: f_ncm: Refactor bind path to use __free()

    In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: Refactor bind path to use __free() After an bind/unbind cycle, the ncm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40093

    usb: gadget: f_ecm: Refactor bind path to use __free()

    In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ecm: Refactor bind path to use __free() After an bind/unbind cycle, the ecm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40094

    usb: gadget: f_acm: Refactor bind path to use __free()

    In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_acm: Refactor bind path to use __free() After an bind/unbind cycle, the acm->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free this…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40095

    usb: gadget: f_rndis: Refactor bind path to use __free()

    In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_rndis: Refactor bind path to use __free() After an bind/unbind cycle, the rndis->notify_req is left stale. If a subsequent bind fails, the unified error label attempts to free …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40096

    drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies

    In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies When adding dependencies with drm_sched_job_add_dependency(), that function consumes the fence reference both on su…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40104

    ixgbevf: fix mailbox API compatibility by negotiating supported features

    In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix mailbox API compatibility by negotiating supported features There was backward compatibility in the terms of mailbox API. Various drivers from various OSes supporting 10G adapter…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40105

    vfs: Don't leak disconnected dentries on umount

    In the Linux kernel, the following vulnerability has been resolved: vfs: Don't leak disconnected dentries on umount When user calls open_by_handle_at() on some inode that is not cached, we will create disconnected dentry for it. If such dentry is a directory,…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2025-40087

    NFSD: Define a proc_layoutcommit for the FlexFiles layout type

    In the Linux kernel, the following vulnerability has been resolved: NFSD: Define a proc_layoutcommit for the FlexFiles layout type Avoid a crash if a pNFS client should happen to send a LAYOUTCOMMIT operation on a FlexFiles layout.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2025-40090

    ksmbd: fix recursive locking in RPC handle list access

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix recursive locking in RPC handle list access Since commit 305853cce3794 ("ksmbd: Fix race condition in RPC handle list access"), ksmbd_session_rpc_method() attempts to lock sess->rp…

    Linux Linux linux-raspi2 linux-hwe Linux Ubuntu
  • High 7.1
    CVE-2025-40088

    hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()

    In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() The hfsplus_strcasecmp() logic can trigger the issue: [ 117.317703][ T9855] ======================================================…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-40086

    drm/xe: Don't allow evicting of BOs in same VM in array of VM binds

    In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds An array of VM binds can potentially evict other buffer objects (BOs) within the same VM under certain conditions, which ma…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-40089

    cxl/features: Add check for no entries in cxl_feature_info

    In the Linux kernel, the following vulnerability has been resolved: cxl/features: Add check for no entries in cxl_feature_info cxl EDAC calls cxl_feature_info() to get the feature information and if the hardware has no Features support, cxlfs may be passed in…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-40091

    ixgbe: fix too early devlink_free() in ixgbe_remove()

    In the Linux kernel, the following vulnerability has been resolved: ixgbe: fix too early devlink_free() in ixgbe_remove() Since ixgbe_adapter is embedded in devlink, calling devlink_free() prematurely in the ixgbe_remove() path can lead to UAF. Move devlink_f…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-40097

    ALSA: hda: Fix missing pointer check in hda_component_manager_init function

    In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix missing pointer check in hda_component_manager_init function The __component_match_add function may assign the 'matchptr' pointer the value ERR_PTR(-ENOMEM), which will subsequ…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-40098

    ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state()

    In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() Return value of a function acpi_evaluate_dsm() is dereferenced without checking for NULL, but it is usually c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-40100

    btrfs: do not assert we found block group item when creating free space tree

    In the Linux kernel, the following vulnerability has been resolved: btrfs: do not assert we found block group item when creating free space tree Currently, when building a free space tree at populate_free_space_tree(), if we are not using the block group tree…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-40101

    btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST

    In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST At the end of btrfs_load_block_group_zone_info() the first thing we do is to ensure that if the mapping type is…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-40102

    KVM: arm64: Prevent access to vCPU events before init

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Prevent access to vCPU events before init Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, lea…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-40103

    smb: client: Fix refcount leak for cifs_sb_tlink

    In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix refcount leak for cifs_sb_tlink Fix three refcount inconsistency issues related to `cifs_sb_tlink`. Comments for `cifs_sb_tlink` state that `cifs_put_tlink()` needs to be cal…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

Revision history

  1. #90

    Neue Updates von Ubuntu aufgenommen

  2. #89

    Neue Updates von Ubuntu aufgenommen

  3. #88

    Neue Updates von Ubuntu aufgenommen

  4. #87

    Neue Updates von SUSE aufgenommen

  5. #86

    Neue Updates von Debian aufgenommen

  6. #85

    Neue Updates von Oracle Linux und Debian aufgenommen

  7. #84

    Neue Updates von Oracle Linux aufgenommen

  8. #83

    Neue Updates von Ubuntu aufgenommen

  9. #82

    Neue Updates von Oracle Linux aufgenommen

  10. #81

    Neue Updates von Oracle Linux aufgenommen

  11. #80

    Neue Updates von Debian aufgenommen

  12. #79

    Neue Updates von Debian aufgenommen

  13. #78

    Neue Updates von Ubuntu aufgenommen

  14. #77

    Neue Updates von Debian aufgenommen

  15. #76

    Neue Updates von Dell aufgenommen

  16. #75

    Neue Updates von Ubuntu aufgenommen

  17. #74

    Neue Updates von Debian aufgenommen

  18. #73

    Neue Updates von Debian aufgenommen

  19. #72

    Neue Updates von Ubuntu aufgenommen

  20. #71

    Neue Updates von Ubuntu aufgenommen

  21. #70

    Neue Updates von Ubuntu aufgenommen

  22. #69

    Neue Updates von Ubuntu aufgenommen

  23. #68

    Neue Updates von Ubuntu aufgenommen

  24. #67

    Neue Updates von Ubuntu aufgenommen

  25. #66

    Neue Updates von IBM aufgenommen

References