Summary
Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder weitere, nicht spezifizierte Auswirkungen zu erlangen.
Product
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Vulnerabilities 104
-
Critical 9.8
cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname
In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname TCP_Server_Info::hostname may be updated once or many times during reconnect, so protect its access outside reconnect path…
-
Critical 9.8
smb: client: fix potential cfid UAF in smb2_query_info_compound
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential cfid UAF in smb2_query_info_compound When smb2_query_info_compound() retries, a previously allocated cfid may have been freed in the first attempt. Because cfid was…
-
Critical 9.3
virt/coco/sev-guest: Double-buffer messages
In the Linux kernel, the following vulnerability has been resolved: virt/coco/sev-guest: Double-buffer messages The encryption algorithms read and write directly to shared unencrypted memory, which may leak information as well as permit the host to tamper wit…
-
High 8.8
Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync Use-after-free can occur in hci_disconnect_all_sync if a connection is deleted by concurrent processing of a controller event. To preve…
-
High 8.8
wifi: ath12k: Handle lock during peer_id find
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Handle lock during peer_id find ath12k_peer_find_by_id() requires that the caller hold the ab->base_lock. Currently the WBM error path does not hold the lock and calling that fu…
-
High 8.8
NFSD: free copynotify stateid in nfs4_free_ol_stateid()
In the Linux kernel, the following vulnerability has been resolved: NFSD: free copynotify stateid in nfs4_free_ol_stateid() Typically copynotify stateid is freed either when parent's stateid is being close/freed or in nfsd4_laundromat if the stateid hasn't be…
-
High 8.8
Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: reset link-local header on ipv6 recv path Bluetooth 6lowpan.c netdev has header_ops, so it must set link-local header for RX skb, otherwise things crash, eg. with AF_PACKE…
-
High 8.8
Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() c…
-
High 8.4
virtio-net: fix received length check in big packets
In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix received length check in big packets Since commit 4959aebba8c0 ("virtio-net: use mtu size as buffer length for big packets"), when guest gso is off, the allocated size for big…
-
High 8.0
Bluetooth: SCO: Fix UAF on sco_conn_free
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix UAF on sco_conn_free BUG: KASAN: slab-use-after-free in sco_conn_free net/bluetooth/sco.c:87 [inline] BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:65 […
-
High 7.8
fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()
In the Linux kernel, the following vulnerability has been resolved: fpga: prevent integer overflow in dfl_feature_ioctl_set_irq() The "hdr.count * sizeof(s32)" multiplication can overflow on 32 bit systems leading to memory corruption. Use array_size() to fix…
-
High 7.8
mm: hugetlb: fix UAF in hugetlb_handle_userfault
In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: fix UAF in hugetlb_handle_userfault The vma_lock and hugetlb_fault_mutex are dropped before handling userfault and reacquire them again after handle_userfault(), but reacquire th…
-
High 7.8
vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF
In the Linux kernel, the following vulnerability has been resolved: vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF After a call to console_unlock() in vcs_write() the vc_data struct can be freed by vc_port_destruct(). Because of …
-
High 7.8
net: deal with integer overflows in kmalloc_reserve()
In the Linux kernel, the following vulnerability has been resolved: net: deal with integer overflows in kmalloc_reserve() Blamed commit changed: ptr = kmalloc(size); if (ptr) size = ksize(ptr); size = kmalloc_size_roundup(size); ptr = kmalloc(size); This allo…
-
High 7.8
drm/amd/display: fix mapping to non-allocated address
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix mapping to non-allocated address [Why] There is an issue mapping non-allocated location of memory. It would allocate gpio registers from an array out of bounds. [How] Pat…
-
High 7.8
HID: hidraw: fix data race on device refcount
In the Linux kernel, the following vulnerability has been resolved: HID: hidraw: fix data race on device refcount The hidraw_open() function increments the hidraw device reference counter. The counter has no dedicated synchronization mechanism, resulting in a…
-
High 7.8
Revert "f2fs: fix to do sanity check on extent cache correctly"
In the Linux kernel, the following vulnerability has been resolved: Revert "f2fs: fix to do sanity check on extent cache correctly" syzbot reports a f2fs bug as below: UBSAN: array-index-out-of-bounds in fs/f2fs/f2fs.h:3275:19 index 1409 is out of range for t…
-
High 7.8
regmap-irq: Fix out-of-bounds access when allocating config buffers
In the Linux kernel, the following vulnerability has been resolved: regmap-irq: Fix out-of-bounds access when allocating config buffers When allocating the 2D array for handling IRQ type registers in regmap_add_irq_chip_fwnode(), the intent is to allocate a m…
-
High 7.8
ALSA: usb-audio: Fix potential overflow of PCM transfer buffer
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential overflow of PCM transfer buffer The PCM stream data in USB-audio driver is transferred over USB URB packet buffers, and each packet size is determined dynamical…
-
High 7.8
mm, swap: fix potential UAF issue for VMA readahead
In the Linux kernel, the following vulnerability has been resolved: mm, swap: fix potential UAF issue for VMA readahead Since commit 78524b05f1a3 ("mm, swap: avoid redundant swap device pinning"), the common helper for allocating and preparing a folio in the …
-
High 7.8CVE-2025-40271 Public exploit
fs/proc: fix uaf in proc_readdir_de()
In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the…
-
High 7.8
mm/secretmem: fix use-after-free race in fault handler
In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: fix use-after-free race in fault handler When a page fault occurs in a secret memory file created with `memfd_secret(2)`, the kernel will allocate a new folio for it, mark the u…
-
High 7.8
KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying
In the Linux kernel, the following vulnerability has been resolved: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying When unbinding a memslot from a guest_memfd instance, remove the bindings even if the guest_memfd file is dying, i.e. …
-
High 7.8
drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE This data originates from userspace and is used in buffer offset calculations which could potentially overflow causing a…
-
High 7.8
tipc: Fix use-after-free in tipc_mon_reinit_self().
In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free in tipc_mon_reinit_self(). syzbot reported use-after-free of tipc_net(net)->monitors[] in tipc_mon_reinit_self(). [0] The array is protected by RTNL, but tipc_mon_rei…
-
High 7.8
Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF There is a KASAN: slab-use-after-free read in btusb_disconnect(). Calling "usb_driver_release_interface(&btusb_driver, data-…
-
High 7.8
Bluetooth: MGMT: cancel mesh send timer when hdev removed
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: cancel mesh send timer when hdev removed mesh_send_done timer is not canceled when hdev is removed, which causes crash if the timer triggers after hdev is gone. Cancel the ti…
-
High 7.8
xsk: avoid data corruption on cq descriptor number
In the Linux kernel, the following vulnerability has been resolved: xsk: avoid data corruption on cq descriptor number Since commit 30f241fcf52a ("xsk: Fix immature cq descriptor production"), the descriptor number is stored in skb control block and xsk_cq_su…
-
High 7.8
io_uring: fix regbuf vector size truncation
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix regbuf vector size truncation There is a report of io_estimate_bvec_size() truncating the calculated number of segments that leads to corruption issues. Check it doesn't overflo…
-
High 7.8
net: bridge: fix use-after-free due to MST port state bypass
In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix use-after-free due to MST port state bypass syzbot reported[1] a use-after-free when deleting an expired fdb. It is due to a race condition between learning still happening a…
-
High 7.8
media: videobuf2: forbid remove_bufs when legacy fileio is active
In the Linux kernel, the following vulnerability has been resolved: media: videobuf2: forbid remove_bufs when legacy fileio is active vb2_ioctl_remove_bufs() call manipulates queue internal buffer list, potentially overwriting some pointers used by the legacy…
-
High 7.8
btrfs: ensure no dirty metadata is written back for an fs with errors
In the Linux kernel, the following vulnerability has been resolved: btrfs: ensure no dirty metadata is written back for an fs with errors [BUG] During development of a minor feature (make sure all btrfs_bio::end_io() is called in task context), I noticed a cr…
-
High 7.8
fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
In the Linux kernel, the following vulnerability has been resolved: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if t…
-
High 7.8
orangefs: fix xattr related buffer overflow...
In the Linux kernel, the following vulnerability has been resolved: orangefs: fix xattr related buffer overflow... Willy Tarreau <w@1wt.eu> forwarded me a message from Disclosure <disclosure@aisle.com> with the following warning: > The helper `xattr_key()` us…
-
High 7.8
exfat: validate cluster allocation bits of the allocation bitmap
In the Linux kernel, the following vulnerability has been resolved: exfat: validate cluster allocation bits of the allocation bitmap syzbot created an exfat image with cluster bits not set for the allocation bitmap. exfat-fs reads and uses the allocation bitm…
-
High 7.8
regmap: slimbus: fix bus_context pointer in regmap init calls
In the Linux kernel, the following vulnerability has been resolved: regmap: slimbus: fix bus_context pointer in regmap init calls Commit 4e65bda8273c ("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()") revealed the problem in the slimbus regma…
-
High 7.8
bpf: Sync pending IRQ work before freeing ring buffer
In the Linux kernel, the following vulnerability has been resolved: bpf: Sync pending IRQ work before freeing ring buffer Fix a race where irq_work can be queued in bpf_ringbuf_commit() but the ring buffer is freed before the work executes. In the syzbot repr…
-
High 7.8
fbcon: Set fb_display[i]->mode to NULL when the mode is released
In the Linux kernel, the following vulnerability has been resolved: fbcon: Set fb_display[i]->mode to NULL when the mode is released Recently, we discovered the following issue through syzkaller: BUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0…
-
High 7.6
Bluetooth: hci_event: validate skb length for unknown CC opcode
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: validate skb length for unknown CC opcode In hci_cmd_complete_evt(), if the command complete event has an unknown opcode, we assume the first byte of the remaining skb->…
-
High 7.5
smb/server: fix possible refcount leak in smb2_sess_setup()
In the Linux kernel, the following vulnerability has been resolved: smb/server: fix possible refcount leak in smb2_sess_setup() Reference count of ksmbd_session will leak when session need reconnect. Fix this by adding the missing ksmbd_user_session_put().
-
High 7.5
NFSD: Fix crash in nfsd4_read_release()
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix crash in nfsd4_read_release() When tracing is enabled, the trace_nfsd_read_done trace point crashes during the pynfs read.testNoFh test.
-
High 7.5
NFSD: Define actions for the new time_deleg FATTR4 attributes
In the Linux kernel, the following vulnerability has been resolved: NFSD: Define actions for the new time_deleg FATTR4 attributes NFSv4 clients won't send legitimate GETATTR requests for these new attributes because they are intended to be used only with CB_G…
-
High 7.3
drm/panthor: Flush shmem writes before mapping buffers CPU-uncached
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached The shmem layer zeroes out the new pages using cached mappings, and if we don't CPU-flush we might leave dirty cachelines b…
-
High 7.1
media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup variable *nplanes is provided by user via system call argument. The possible value of q_data->fmt->num_planes…
-
High 7.1
fbdev: bitblit: bound-check glyph index in bit_putcs*
In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_putcs* bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font…
-
Unscored —
md/raid0, raid10: Don't set discard sectors for request queue
In the Linux kernel, the following vulnerability has been resolved: md/raid0, raid10: Don't set discard sectors for request queue It should use disk_stack_limits to get a proper max_discard_sectors rather than setting a value by stack drivers. And there is a …
-
Unscored —
misc: pci_endpoint_test: Fix pci_endpoint_test_{copy,write,read}() panic
In the Linux kernel, the following vulnerability has been resolved: misc: pci_endpoint_test: Fix pci_endpoint_test_{copy,write,read}() panic The dma_map_single() doesn't permit zero length mapping. It causes a follow panic. A panic was reported on arm64: [ 60…
-
Unscored —
perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map()
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map() pci_get_device() will increase the reference count for the returned pci_dev, so snr_uncore_get_mc_dev() will return a …
-
Unscored —
regulator: core: Use different devices for resource allocation and DT lookup
In the Linux kernel, the following vulnerability has been resolved: regulator: core: Use different devices for resource allocation and DT lookup Following by the below discussion, there's the potential UAF issue between regulator and mfd. https://lore.kernel.…
-
Unscored —
drm/amdgpu/powerplay/psm: Fix memory leak in power state init
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/powerplay/psm: Fix memory leak in power state init Commit 902bc65de0b3 ("drm/amdgpu/powerplay/psm: return an error in power state init") made the power state init function return e…
-
Unscored —
mmc: meson-gx: fix return value check of mmc_add_host()
In the Linux kernel, the following vulnerability has been resolved: mmc: meson-gx: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, it will lead two issues: 1. The memory that allocated in mmc_alloc_host…
-
Unscored —
drm/amdkfd: Fix memory leak in kfd_mem_dmamap_userptr()
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix memory leak in kfd_mem_dmamap_userptr() If the number of pages from the userptr BO differs from the SG BO then the allocated memory for the SG table doesn't get freed before r…
-
Unscored —
f2fs: fix to invalidate dcc->f2fs_issue_discard in error path
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to invalidate dcc->f2fs_issue_discard in error path Syzbot reports a NULL pointer dereference issue as below: __refcount_add include/linux/refcount.h:193 [inline] __refcount_inc inc…
-
Unscored —
dm: verity-loadpin: Only trust verity targets with enforcement
In the Linux kernel, the following vulnerability has been resolved: dm: verity-loadpin: Only trust verity targets with enforcement Verity targets can be configured to ignore corrupted data blocks. LoadPin must only trust verity targets that are configured to …
-
Unscored —
ext4: fix potential memory leak in ext4_fc_record_modified_inode()
In the Linux kernel, the following vulnerability has been resolved: ext4: fix potential memory leak in ext4_fc_record_modified_inode() As krealloc may return NULL, in this case 'state->fc_modified_inodes' may not be freed by krealloc, but 'state->fc_modified_…
-
Unscored —
net: netsec: fix error handling in netsec_register_mdio()
In the Linux kernel, the following vulnerability has been resolved: net: netsec: fix error handling in netsec_register_mdio() If phy_device_register() fails, phy_device_free() need be called to put refcount, so memory of phy device and device name can be free…
-
Unscored —
serial: amba-pl011: avoid SBSA UART accessing DMACR register
In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: avoid SBSA UART accessing DMACR register Chapter "B Generic UART" in "ARM Server Base System Architecture" [1] documentation describes a generic UART interface. Such gener…
-
Unscored —
media: dvb-usb: fix memory leak in dvb_usb_adapter_init()
In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb: fix memory leak in dvb_usb_adapter_init() Syzbot reports a memory leak in "dvb_usb_adapter_init()". The leak is due to not accounting for and freeing current iteration's adapt…
-
Unscored —
wifi: ath11k: fix monitor mode bringup crash
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix monitor mode bringup crash When the interface is brought up in monitor mode, it leads to NULL pointer dereference crash. This crash happens when the packet type is extracted…
-
Unscored —
drm/gud: Fix UBSAN warning
In the Linux kernel, the following vulnerability has been resolved: drm/gud: Fix UBSAN warning UBSAN complains about invalid value for bool: [ 101.165172] [drm] Initialized gud 1.0.0 20200422 for 2-3.2:1.0 on minor 1 [ 101.213360] gud 2-3.2:1.0: [drm] fb1: gu…
-
Unscored —
wifi: rsi: Fix memory leak in rsi_coex_attach()
In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: Fix memory leak in rsi_coex_attach() The coex_cb needs to be freed when rsi_create_kthread() failed in rsi_coex_attach().
-
Unscored —
kcsan: Avoid READ_ONCE() in read_instrumented_memory()
In the Linux kernel, the following vulnerability has been resolved: kcsan: Avoid READ_ONCE() in read_instrumented_memory() Haibo Li reported: | Unable to handle kernel paging request at virtual address | ffffff802a0d8d7171 | Mem abort info:o: | ESR = 0x960000…
-
Unscored —
PCI: Free released resource after coalescing
In the Linux kernel, the following vulnerability has been resolved: PCI: Free released resource after coalescing release_resource() doesn't actually free the resource or resource list entry so free the resource list entry to avoid a leak.
-
Unscored —
soc: ti: pm33xx: Fix refcount leak in am33xx_pm_probe
In the Linux kernel, the following vulnerability has been resolved: soc: ti: pm33xx: Fix refcount leak in am33xx_pm_probe wkup_m3_ipc_get() takes refcount, which should be freed by wkup_m3_ipc_put(). Add missing refcount release in the error paths.
-
Unscored —
um: vector: Fix memory leak in vector_config
In the Linux kernel, the following vulnerability has been resolved: um: vector: Fix memory leak in vector_config If the return value of the uml_parse_vector_ifspec function is NULL, we should call kfree(params) to prevent memory leak.
-
Unscored —
s390/vfio-ap: fix memory leak in vfio_ap device driver
In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix memory leak in vfio_ap device driver The device release callback function invoked to release the matrix device uses the dev_get_drvdata(device *dev) function to retrieve the…
-
Unscored —CVE-2023-53749 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
pinctrl: freescale: Fix a memory out of bounds when num_configs is 1
In the Linux kernel, the following vulnerability has been resolved: pinctrl: freescale: Fix a memory out of bounds when num_configs is 1 The config passed in by pad wakeup is 1, when num_configs is 1, Configuration [1] should not be fetched, which will be det…
-
Unscored —
scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() When if_type equals zero and pci_resource_start(pdev, PCI_64BIT_BAR4) returns false, drbl_regs_memmap_p is not remapped. This passe…
-
Unscored —
dmaengine: ptdma: check for null desc before calling pt_cmd_callback
In the Linux kernel, the following vulnerability has been resolved: dmaengine: ptdma: check for null desc before calling pt_cmd_callback Resolves a panic that can occur on AMD systems, typically during host shutdown, after the PTDMA driver had been exercised.…
-
Unscored —
KVM: VMX: Fix crash due to uninitialized current_vmcs
In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Fix crash due to uninitialized current_vmcs KVM enables 'Enlightened VMCS' and 'Enlightened MSR Bitmap' when running as a nested hypervisor on top of Hyper-V. When MSR bitmap is upd…
-
Unscored —
irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe
In the Linux kernel, the following vulnerability has been resolved: irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore.…
-
Unscored —
spi: atmel-quadspi: Free resources even if runtime resume failed in .remove()
In the Linux kernel, the following vulnerability has been resolved: spi: atmel-quadspi: Free resources even if runtime resume failed in .remove() An early error exit in atmel_qspi_remove() doesn't prevent the device unbind. So this results in an spi controlle…
-
Unscored —
scsi: ufs: core: mcq: Fix &hwq->cq_lock deadlock issue
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: mcq: Fix &hwq->cq_lock deadlock issue When ufshcd_err_handler() is executed, CQ event interrupt can enter waiting for the same lock. This can happen in ufshcd_handle_mcq_cq_e…
-
Unscored —
USB: usbtmc: Fix direction for 0-length ioctl control messages
In the Linux kernel, the following vulnerability has been resolved: USB: usbtmc: Fix direction for 0-length ioctl control messages The syzbot fuzzer found a problem in the usbtmc driver: When a user submits an ioctl for a 0-length control transfer, the driver…
-
Unscored —
dm cache: free background tracker's queued work in btracker_destroy
In the Linux kernel, the following vulnerability has been resolved: dm cache: free background tracker's queued work in btracker_destroy Otherwise the kernel can BUG with: [ 2245.426978] =========================================================================…
-
Unscored —
FS: JFS: Check for read-only mounted filesystem in txBegin
In the Linux kernel, the following vulnerability has been resolved: FS: JFS: Check for read-only mounted filesystem in txBegin This patch adds a check for read-only mounted filesystem in txBegin before starting a transaction potentially saving from NULL point…
-
Unscored —
wifi: ath12k: fix memory leak in ath12k_qmi_driver_event_work()
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12k_qmi_driver_event_work() Currently the buffer pointed by event is not freed in case ATH12K_FLAG_UNREGISTERING bit is set, this causes memory leak. Add a…
-
Unscored —
io_uring/rw: ensure allocated iovec gets cleared for early failure
In the Linux kernel, the following vulnerability has been resolved: io_uring/rw: ensure allocated iovec gets cleared for early failure A previous commit reused the recyling infrastructure for early cleanup, but this is not enough for the case where our intern…
-
Unscored —
cifs: client: fix memory leak in smb3_fs_context_parse_param
In the Linux kernel, the following vulnerability has been resolved: cifs: client: fix memory leak in smb3_fs_context_parse_param The user calls fsconfig twice, but when the program exits, free() only frees ctx->source for the second fsconfig, not the first. R…
-
Unscored —
ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd In snd_usb_create_streams(), for UAC version 3 devices, the Interface Association Descriptor (IAD) is retrieved vi…
-
Unscored —
net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
In the Linux kernel, the following vulnerability has been resolved: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak Fix a KMSAN kernel-infoleak detected by the syzbot . [net?] KMSAN: kernel-infoleak in __skb_datagram_iter In tcf_ife…
-
Unscored —
net: sched: act_connmark: initialize struct tc_ife to fix kernel leak
In the Linux kernel, the following vulnerability has been resolved: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak In tcf_connmark_dump(), the variable 'opt' was partially initialized using a designatied initializer. While the padding b…
-
Unscored —
sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
In the Linux kernel, the following vulnerability has been resolved: sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto syzbot reported a possible shift-out-of-bounds [1] Blamed commit added rto_alpha_max and rto_beta_max set to 1000. It i…
-
Unscored —
smb/server: fix possible memory leak in smb2_read()
In the Linux kernel, the following vulnerability has been resolved: smb/server: fix possible memory leak in smb2_read() Memory leak occurs when ksmbd_vfs_read() fails. Fix this by adding the missing kvfree().
-
Unscored —
exfat: fix improper check of dentry.stream.valid_size
In the Linux kernel, the following vulnerability has been resolved: exfat: fix improper check of dentry.stream.valid_size We found an infinite loop bug in the exFAT file system that can lead to a Denial-of-Service (DoS) condition. When a dentry in an exFAT fi…
-
Unscored —
drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices Previously, APU platforms (and other scenarios with uninitialized VRAM managers) triggered a NULL pointer dereference in…
-
Unscored —
drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM Otherwise accessing them can cause a crash.
-
Unscored —
iommufd: Don't overflow during division for dirty tracking
In the Linux kernel, the following vulnerability has been resolved: iommufd: Don't overflow during division for dirty tracking If pgshift is 63 then BITS_PER_TYPE(*bitmap->bitmap) * pgsize will overflow to 0 and this triggers divide by 0. In this case the ind…
-
Unscored —
Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() In the parse_adv_monitor_pattern() function, the value of the 'length' variable is currently limited to HCI_MAX_EXT_AD_LENGTH(25…
-
Unscored —
fscrypt: fix left shift underflow when inode->i_blkbits > PAGE_SHIFT
In the Linux kernel, the following vulnerability has been resolved: fscrypt: fix left shift underflow when inode->i_blkbits > PAGE_SHIFT When simulating an nvme device on qemu with both logical_block_size and physical_block_size set to 8 KiB, an error trace a…
-
Unscored —
platform/x86: int3472: Fix double free of GPIO device during unregister
In the Linux kernel, the following vulnerability has been resolved: platform/x86: int3472: Fix double free of GPIO device during unregister regulator_unregister() already frees the associated GPIO device. On ThinkPad X9 (Lunar Lake), this causes a double free…
-
Unscored —
gve: Implement settime64 with -EOPNOTSUPP
In the Linux kernel, the following vulnerability has been resolved: gve: Implement settime64 with -EOPNOTSUPP ptp_clock_settime() assumes every ptp_clock has implemented settime64(). Stub it with -EOPNOTSUPP to prevent a NULL dereference.
-
Unscored —
gve: Implement gettimex64 with -EOPNOTSUPP
In the Linux kernel, the following vulnerability has been resolved: gve: Implement gettimex64 with -EOPNOTSUPP gve implemented a ptp_clock for sole use of do_aux_work at this time. ptp_clock_gettime() and ptp_sys_offset() assume every ptp_clock has implemente…
-
Unscored —
9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN
In the Linux kernel, the following vulnerability has been resolved: 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN p9_read_work() doesn't set Rworksched and doesn't do schedule_work(m->rq) if list_empty(&m->req_list). However, if the pipe is full, we n…
-
Unscored —
Bluetooth: bcsp: receive data only if registered
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bcsp: receive data only if registered Currently, bcsp_recv() can be called even when the BCSP protocol has not been registered. This leads to a NULL pointer dereference, as shown i…
-
Unscored —
amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw
In the Linux kernel, the following vulnerability has been resolved: amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw There is race in amdgpu_amdkfd_device_fini_sw and interrupt. if amdgpu_amdkfd_device_fini_sw run in b/w kfd_cleanup_nodes and kfree(…
-
Unscored —
accel/habanalabs: support mapping cb with vmalloc-backed coherent memory
In the Linux kernel, the following vulnerability has been resolved: accel/habanalabs: support mapping cb with vmalloc-backed coherent memory When IOMMU is enabled, dma_alloc_coherent() with GFP_USER may return addresses from the vmalloc range. If such an addr…
-
Unscored —
jfs: Verify inode mode when loading from disk
In the Linux kernel, the following vulnerability has been resolved: jfs: Verify inode mode when loading from disk The inode mode loaded from corrupted disk can be invalid. Do like what commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk") do…
-
Unscored —
ntfs3: pretend $Extend records as regular files
In the Linux kernel, the following vulnerability has been resolved: ntfs3: pretend $Extend records as regular files Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()") requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/ S_IF…
-
Unscored —
usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget In the __cdnsp_gadget_init() and cdnsp_gadget_exit() functions, the gadget structure (pdev->gadget) wa…
-
Unscored —
usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix epfile null pointer access after ep enable. A race condition occurs when ffs_func_eps_enable() runs concurrently with ffs_data_reset(). The ffs_data_clear() called in f…
-
Unscored —
drm/mediatek: Fix device use-after-free on unbind
In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix device use-after-free on unbind A recent change fixed device reference leaks when looking up drm platform device driver data during bind() but failed to remove a partial fix…
-
Unscored —
wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode Currently, whenever there is a need to transmit an Action frame, the brcmfmac driver always uses the P2P vif to sen…
Revision history
-
#95
Neue Updates von SUSE aufgenommen
-
#94
Neue Updates von SUSE aufgenommen
-
#93
Neue Updates von IBM aufgenommen
-
#92
Neue Updates von Oracle Linux aufgenommen
-
#91
Neue Updates von Debian aufgenommen
-
#90
Neue Updates von Oracle Linux aufgenommen
-
#89
Neue Updates von Oracle Linux aufgenommen
-
#88
Neue Updates von Oracle Linux aufgenommen
-
#87
Neue Updates von Rocky Enterprise Software Foundation aufgenommen
-
#86
Neue Updates von Red Hat und Oracle Linux aufgenommen
-
#85
Neue Updates von Rocky Enterprise Software Foundation aufgenommen
-
#84
Neue Updates von Red Hat aufgenommen
-
#83
Neue Updates von SUSE aufgenommen
-
#82
Neue Updates von Ubuntu aufgenommen
-
#81
Neue Updates von Ubuntu aufgenommen
-
#80
Neue Updates von Debian aufgenommen
-
#79
Neue Updates von Dell aufgenommen
-
#78
Neue Updates von Ubuntu aufgenommen
-
#77
Neue Updates von Ubuntu aufgenommen
-
#76
Neue Updates von Ubuntu aufgenommen
-
#75
Neue Updates von Ubuntu aufgenommen
-
#74
Neue Updates von Ubuntu aufgenommen
-
#73
Neue Updates von Ubuntu aufgenommen
-
#72
Neue Updates von Ubuntu aufgenommen
-
#71
Neue Updates von IBM aufgenommen
References
-
Kernel CVE Announce Mailingliste
https://lore.kernel.org/linux-cve-announce/
-
Linux Kernel CVE Announcement CVE-2022-50583
https://lore.kernel.org/linux-cve-announce/2025120822-CVE-2022-50583-a25a@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50614
https://lore.kernel.org/linux-cve-announce/2025120851-CVE-2022-50614-cc88@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50615
https://lore.kernel.org/linux-cve-announce/2025120851-CVE-2022-50615-5c90@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50616
https://lore.kernel.org/linux-cve-announce/2025120851-CVE-2022-50616-bef8@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50617
https://lore.kernel.org/linux-cve-announce/2025120851-CVE-2022-50617-84c9@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50618
https://lore.kernel.org/linux-cve-announce/2025120852-CVE-2022-50618-6be5@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50619
https://lore.kernel.org/linux-cve-announce/2025120852-CVE-2022-50619-9b47@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50620
https://lore.kernel.org/linux-cve-announce/2025120852-CVE-2022-50620-bf1f@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50621
https://lore.kernel.org/linux-cve-announce/2025120852-CVE-2022-50621-be59@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50622
https://lore.kernel.org/linux-cve-announce/2025120852-CVE-2022-50622-9f34@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50623
https://lore.kernel.org/linux-cve-announce/2025120853-CVE-2022-50623-03df@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50624
https://lore.kernel.org/linux-cve-announce/2025120853-CVE-2022-50624-0011@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50625
https://lore.kernel.org/linux-cve-announce/2025120853-CVE-2022-50625-a1e2@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50626
https://lore.kernel.org/linux-cve-announce/2025120853-CVE-2022-50626-a97f@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50627
https://lore.kernel.org/linux-cve-announce/2025120853-CVE-2022-50627-a907@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50628
https://lore.kernel.org/linux-cve-announce/2025120854-CVE-2022-50628-69d3@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50629
https://lore.kernel.org/linux-cve-announce/2025120854-CVE-2022-50629-52d9@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50630
https://lore.kernel.org/linux-cve-announce/2025120854-CVE-2022-50630-3891@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53742
https://lore.kernel.org/linux-cve-announce/2025120840-CVE-2023-53742-3a0d@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53743
https://lore.kernel.org/linux-cve-announce/2025120840-CVE-2023-53743-5da6@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53744
https://lore.kernel.org/linux-cve-announce/2025120841-CVE-2023-53744-c66e@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53745
https://lore.kernel.org/linux-cve-announce/2025120841-CVE-2023-53745-2ae7@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53746
https://lore.kernel.org/linux-cve-announce/2025120841-CVE-2023-53746-cbfd@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53747
https://lore.kernel.org/linux-cve-announce/2025120842-CVE-2023-53747-ae4a@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53748
https://lore.kernel.org/linux-cve-announce/2025120842-CVE-2023-53748-4905@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53749
https://lore.kernel.org/linux-cve-announce/2025120842-CVE-2023-53749-b458@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53750
https://lore.kernel.org/linux-cve-announce/2025120842-CVE-2023-53750-c3be@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53751
https://lore.kernel.org/linux-cve-announce/2025120842-CVE-2023-53751-2ff2@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53752
https://lore.kernel.org/linux-cve-announce/2025120843-CVE-2023-53752-339f@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53753
https://lore.kernel.org/linux-cve-announce/2025120843-CVE-2023-53753-1a11@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53754
https://lore.kernel.org/linux-cve-announce/2025120843-CVE-2023-53754-c601@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53755
https://lore.kernel.org/linux-cve-announce/2025120843-CVE-2023-53755-1c4b@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53756
https://lore.kernel.org/linux-cve-announce/2025120843-CVE-2023-53756-f234@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53757
https://lore.kernel.org/linux-cve-announce/2025120844-CVE-2023-53757-8c1e@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53758
https://lore.kernel.org/linux-cve-announce/2025120844-CVE-2023-53758-93a2@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53759
https://lore.kernel.org/linux-cve-announce/2025120844-CVE-2023-53759-c444@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53760
https://lore.kernel.org/linux-cve-announce/2025120844-CVE-2023-53760-8e04@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53761
https://lore.kernel.org/linux-cve-announce/2025120844-CVE-2023-53761-ea1d@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53762
https://lore.kernel.org/linux-cve-announce/2025120845-CVE-2023-53762-01bc@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53763
https://lore.kernel.org/linux-cve-announce/2025120845-CVE-2023-53763-3a65@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53764
https://lore.kernel.org/linux-cve-announce/2025120845-CVE-2023-53764-c257@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53765
https://lore.kernel.org/linux-cve-announce/2025120845-CVE-2023-53765-0317@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53766
https://lore.kernel.org/linux-cve-announce/2025120845-CVE-2023-53766-9bc9@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53767
https://lore.kernel.org/linux-cve-announce/2025120846-CVE-2023-53767-02ae@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53768
https://lore.kernel.org/linux-cve-announce/2025120846-CVE-2023-53768-2b71@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53769
https://lore.kernel.org/linux-cve-announce/2025120846-CVE-2023-53769-1a8b@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40267
https://lore.kernel.org/linux-cve-announce/2025120714-CVE-2025-40267-4904@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40268
https://lore.kernel.org/linux-cve-announce/2025120715-CVE-2025-40268-390a@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40269
https://lore.kernel.org/linux-cve-announce/2025120716-CVE-2025-40269-9769@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40270
https://lore.kernel.org/linux-cve-announce/2025120716-CVE-2025-40270-78dc@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40271
https://lore.kernel.org/linux-cve-announce/2025120716-CVE-2025-40271-7612@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40272
https://lore.kernel.org/linux-cve-announce/2025120716-CVE-2025-40272-507b@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40273
https://lore.kernel.org/linux-cve-announce/2025120716-CVE-2025-40273-3765@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40274
https://lore.kernel.org/linux-cve-announce/2025120716-CVE-2025-40274-53be@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40275
https://lore.kernel.org/linux-cve-announce/2025120717-CVE-2025-40275-021a@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40276
https://lore.kernel.org/linux-cve-announce/2025120717-CVE-2025-40276-6558@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40277
https://lore.kernel.org/linux-cve-announce/2025120717-CVE-2025-40277-d511@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40278
https://lore.kernel.org/linux-cve-announce/2025120717-CVE-2025-40278-dae4@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40279
https://lore.kernel.org/linux-cve-announce/2025120717-CVE-2025-40279-81d3@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40280
https://lore.kernel.org/linux-cve-announce/2025120717-CVE-2025-40280-4612@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40281
https://lore.kernel.org/linux-cve-announce/2025120718-CVE-2025-40281-557d@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40282
https://lore.kernel.org/linux-cve-announce/2025120718-CVE-2025-40282-cdda@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40283
https://lore.kernel.org/linux-cve-announce/2025120718-CVE-2025-40283-0706@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40284
https://lore.kernel.org/linux-cve-announce/2025120718-CVE-2025-40284-9c41@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40285
https://lore.kernel.org/linux-cve-announce/2025120718-CVE-2025-40285-9158@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40286
https://lore.kernel.org/linux-cve-announce/2025120718-CVE-2025-40286-1b9c@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40287
https://lore.kernel.org/linux-cve-announce/2025120719-CVE-2025-40287-a68f@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40288
https://lore.kernel.org/linux-cve-announce/2025120719-CVE-2025-40288-7d9f@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40289
https://lore.kernel.org/linux-cve-announce/2025120719-CVE-2025-40289-6833@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40290
https://lore.kernel.org/linux-cve-announce/2025120811-CVE-2025-40290-852d@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40291
https://lore.kernel.org/linux-cve-announce/2025120815-CVE-2025-40291-8752@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40292
https://lore.kernel.org/linux-cve-announce/2025120818-CVE-2025-40292-e613@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40293
https://lore.kernel.org/linux-cve-announce/2025120818-CVE-2025-40293-cfe7@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40294
https://lore.kernel.org/linux-cve-announce/2025120818-CVE-2025-40294-b8e3@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40295
https://lore.kernel.org/linux-cve-announce/2025120818-CVE-2025-40295-e4f2@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40296
https://lore.kernel.org/linux-cve-announce/2025120818-CVE-2025-40296-0769@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40297
https://lore.kernel.org/linux-cve-announce/2025120819-CVE-2025-40297-8d83@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40298
https://lore.kernel.org/linux-cve-announce/2025120819-CVE-2025-40298-af76@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-40299
https://lore.kernel.org/linux-cve-announce/2025120819-CVE-2025-40299-fd5b@gregkh/