Skip to content
OpenAdvisories
High WID-SEC-2025-2595 31 CVEs

Linux Kernel: Mehrere Schwachstellen

Published Nov 12, 2025 · Updated Sep 24, 2026 · Revision 77 · de-DE

Vendor: amazon Vendor: Debian Vendor: Dell Vendor: Google Vendor: IBM Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: SUSE Vendor: Ubuntu Product: Avamar Product: Container-Optimized OS Product: DataPower Gateway Product: ECS Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: NetWorker Product: openSUSE Product: Rocky Linux Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um nicht näher spezifizierte Angriffe durchzuführen, die möglicherweise zu einer Denial-of-Service- Bedingung führen oder eine Speicherbeschädigung verursachen können.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 31

  • High 8.1
    CVE-2025-40186

    tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().

    In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in tc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.1
    CVE-2025-40204

    sctp: Fix MAC comparison to be constant-time

    In the Linux kernel, the following vulnerability has been resolved: sctp: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40182

    crypto: skcipher - Fix reqsize handling

    In the Linux kernel, the following vulnerability has been resolved: crypto: skcipher - Fix reqsize handling Commit afddce13ce81d ("crypto: api - Add reqsize to crypto_alg") introduced cra_reqsize field in crypto_alg struct to replace type specific reqsize fie…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40190

    ext4: guard against EA inode refcount underflow in xattr update

    In the Linux kernel, the following vulnerability has been resolved: ext4: guard against EA inode refcount underflow in xattr update syzkaller found a path where ext4_xattr_inode_update_ref() reads an EA inode refcount that is already <= 0 and then applies ref…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40198

    ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()

    In the Linux kernel, the following vulnerability has been resolved: ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() Unlike other strings in the ext4 superblock, we rely on tune2fs to make sure s_mount_opts is NUL terminated. Harden pa…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40199

    page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches

    In the Linux kernel, the following vulnerability has been resolved: page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches Helge reported that the introduction of PP_MAGIC_MASK let to crashes on boot on his 32-bit parisc machine. The cause of th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40201

    kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths

    In the Linux kernel, the following vulnerability has been resolved: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths The usage of task_lock(tsk->group_leader) in sys_prlimit64()->do_prlimit() path is very broken. sys_p…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40202

    ipmi: Rework user message limit handling

    In the Linux kernel, the following vulnerability has been resolved: ipmi: Rework user message limit handling The limit on the number of user messages had a number of issues, improper counting in some cases and a use after free. Restructure how this is all don…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40203

    listmount: don't call path_put() under namespace semaphore

    In the Linux kernel, the following vulnerability has been resolved: listmount: don't call path_put() under namespace semaphore Massage listmount() and make sure we don't call path_put() under the namespace semaphore. If we put the last reference we're fscked.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40205

    btrfs: avoid potential out-of-bounds in btrfs_encode_fh()

    In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid potential out-of-bounds in btrfs_encode_fh() The function btrfs_encode_fh() does not properly account for the three cases it handles. Before writing to the file handle (fh), the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40206

    netfilter: nft_objref: validate objref and objrefmap expressions

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_objref: validate objref and objrefmap expressions Referencing a synproxy stateful object from OUTPUT hook causes kernel crash due to infinite recursive calls: BUG: TASK stack g…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2025-40183

    bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}

    In the Linux kernel, the following vulnerability has been resolved: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} Cilium has a BPF egress gateway feature which forces outgoing K8s Pod traffic to pass through dedicated egress gateways which then SNAT …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2025-40187

    net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()

    In the Linux kernel, the following vulnerability has been resolved: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 and sctp_ulpevent_make_authkey() returns 0, then …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-40178

    pid: Add a judgment for ns null in pid_nr_ns

    In the Linux kernel, the following vulnerability has been resolved: pid: Add a judgment for ns null in pid_nr_ns __task_pid_nr_ns ns = task_active_pid_ns(current); pid_nr_ns(rcu_dereference(*task_pid_ptr(task, type)), ns); if (pid && ns->level <= pid->level) …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-40179

    ext4: verify orphan file size is not too big

    In the Linux kernel, the following vulnerability has been resolved: ext4: verify orphan file size is not too big In principle orphan file can be arbitrarily large. However orphan replay needs to traverse it all and we also pin all its buffers in memory. Thus …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-40180

    mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop

    In the Linux kernel, the following vulnerability has been resolved: mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop The cleanup loop was starting at the wrong array index, causing out-of-bounds access. Start the loop at the correct index…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-40181

    x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP

    In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP When running as an SNP or TDX guest under KVM, force the legacy PCI hole, i.e. memory between Top of Lower Usable DRAM a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-40184

    KVM: arm64: Fix debug checking for np-guests using huge mappings

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix debug checking for np-guests using huge mappings When running with transparent huge pages and CONFIG_NVHE_EL2_DEBUG then the debug checking in assert_host_shared_guest() fails…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-40185

    ice: ice_adapter: release xa entry on adapter allocation failure

    In the Linux kernel, the following vulnerability has been resolved: ice: ice_adapter: release xa entry on adapter allocation failure When ice_adapter_new() fails, the reserved XArray entry created by xa_insert() is not released. This causes subsequent inserti…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-40188

    pwm: berlin: Fix wrong register in suspend/resume

    In the Linux kernel, the following vulnerability has been resolved: pwm: berlin: Fix wrong register in suspend/resume The 'enable' register should be BERLIN_PWM_EN rather than BERLIN_PWM_ENABLE, otherwise, the driver accesses wrong address, there will be cpu …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-40189

    net: usb: lan78xx: Fix lost EEPROM read timeout error(-ETIMEDOUT) in lan78xx_read_raw_eeprom

    In the Linux kernel, the following vulnerability has been resolved: net: usb: lan78xx: Fix lost EEPROM read timeout error(-ETIMEDOUT) in lan78xx_read_raw_eeprom Syzbot reported read of uninitialized variable BUG with following call stack. lan78xx 8-1:1.0 (unn…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-40191

    drm/amdkfd: Fix kfd process ref leaking when userptr unmapping

    In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix kfd process ref leaking when userptr unmapping kfd_lookup_process_by_pid hold the kfd process reference to ensure it doesn't get destroyed while sending the segfault event to …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-40192

    Revert "ipmi: fix msg stack when IPMI is disconnected"

    In the Linux kernel, the following vulnerability has been resolved: Revert "ipmi: fix msg stack when IPMI is disconnected" This reverts commit c608966f3f9c2dca596967501d00753282b395fc. This patch has a subtle bug that can cause the IPMI driver to go into an i…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-40193

    xtensa: simdisk: add input size check in proc_write_simdisk

    In the Linux kernel, the following vulnerability has been resolved: xtensa: simdisk: add input size check in proc_write_simdisk A malicious user could pass an arbitrarily bad value to memdup_user_nul(), potentially causing kernel crash. This follows the same …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-40194

    cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()

    In the Linux kernel, the following vulnerability has been resolved: cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_q…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-40195

    mount: handle NULL values in mnt_ns_release()

    In the Linux kernel, the following vulnerability has been resolved: mount: handle NULL values in mnt_ns_release() When calling in listmount() mnt_ns_release() may be passed a NULL pointer. Handle that case gracefully.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-40196

    fs: quota: create dedicated workqueue for quota_release_work

    In the Linux kernel, the following vulnerability has been resolved: fs: quota: create dedicated workqueue for quota_release_work There is a kernel panic due to WARN_ONCE when panic_on_warn is set. This issue occurs when writeback is triggered due to sync call…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-40197

    media: mc: Clear minor number before put device

    In the Linux kernel, the following vulnerability has been resolved: media: mc: Clear minor number before put device The device minor should not be cleared after the device is released.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-40200

    Squashfs: reject negative file sizes in squashfs_read_inode()

    In the Linux kernel, the following vulnerability has been resolved: Squashfs: reject negative file sizes in squashfs_read_inode() Syskaller reports a "WARNING in ovl_copy_up_file" in overlayfs. This warning is ultimately caused because the underlying Squashfs…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-40207

    media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try()

    In the Linux kernel, the following vulnerability has been resolved: media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() v4l2_subdev_call_state_try() macro allocates a subdev state with __v4l2_subdev_state_alloc(), but does not check th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-40208

    media: iris: fix module removal if firmware download failed

    In the Linux kernel, the following vulnerability has been resolved: media: iris: fix module removal if firmware download failed Fix remove if firmware failed to load: qcom-iris aa00000.video-codec: Direct firmware load for qcom/vpu/vpu33_p4.mbn failed with er…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Revision history

  1. #77

    Neue Updates von Oracle Linux aufgenommen

  2. #76

    Neue Updates von SUSE aufgenommen

  3. #75

    Neue Updates von SUSE aufgenommen

  4. #74

    Neue Updates von SUSE aufgenommen

  5. #73

    Neue Updates von SUSE aufgenommen

  6. #72

    Neue Updates von Debian aufgenommen

  7. #71

    Neue Updates von Dell und SUSE aufgenommen

  8. #70

    Neue Updates von SUSE aufgenommen

  9. #69

    Neue Updates von SUSE aufgenommen

  10. #68

    Neue Updates von SUSE aufgenommen

  11. #67

    Neue Updates von SUSE aufgenommen

  12. #66

    Neue Updates von SUSE aufgenommen

  13. #65

    Neue Updates von SUSE aufgenommen

  14. #64

    Neue Updates von Debian aufgenommen

  15. #63

    Neue Updates von Debian aufgenommen

  16. #62

    Neue Updates von IBM aufgenommen

  17. #61

    Neue Updates von SUSE aufgenommen

  18. #60

    Neue Updates von openSUSE und SUSE aufgenommen

  19. #59

    Neue Updates von Dell aufgenommen

  20. #58

    Neue Updates von Ubuntu aufgenommen

  21. #57

    Neue Updates von SUSE aufgenommen

  22. #56

    Neue Updates von SUSE aufgenommen

  23. #55

    Neue Updates von Ubuntu aufgenommen

  24. #54

    Neue Updates von Ubuntu aufgenommen

  25. #53

    Neue Updates von Ubuntu aufgenommen

References