Summary
Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen um nicht näher spezifizierte Angriffe durchzuführen, die möglicherweise zu einer Denial-of-Service- Bedingung führen oder eine Speicherbeschädigung verursachen können.
Product
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Vulnerabilities 95
-
Critical 9.8
net/handshake: duplicate handshake cancellations leak socket
In the Linux kernel, the following vulnerability has been resolved: net/handshake: duplicate handshake cancellations leak socket When a handshake request is cancelled it is removed from the handshake_net->hn_requests list, but it is still present in the hands…
-
Critical 9.8
iomap: adjust read range correctly for non-block-aligned positions
In the Linux kernel, the following vulnerability has been resolved: iomap: adjust read range correctly for non-block-aligned positions iomap_adjust_read_range() assumes that the position and length passed in are block-aligned. This is not always the case howe…
-
Critical 9.8
svcrdma: use rc_pageoff for memcpy byte offset
In the Linux kernel, the following vulnerability has been resolved: svcrdma: use rc_pageoff for memcpy byte offset svc_rdma_copy_inline_range added rc_curpage (page index) to the page base instead of the byte offset rc_pageoff. Use rc_pageoff so copies land w…
-
Critical 9.8
ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency Under high concurrency, A tree-connection object (tcon) is freed on a disconnect path while another path still holds a re…
-
Critical 9.8
svcrdma: bound check rq_pages index in inline path
In the Linux kernel, the following vulnerability has been resolved: svcrdma: bound check rq_pages index in inline path svc_rdma_copy_inline_range indexed rqstp->rq_pages[rc_curpage] without verifying rc_curpage stays within the allocated page array. Add guard…
-
Critical 9.1
ksmbd: vfs: fix race on m_flags in vfs_cache
In the Linux kernel, the following vulnerability has been resolved: ksmbd: vfs: fix race on m_flags in vfs_cache ksmbd maintains delete-on-close and pending-delete state in ksmbd_inode->m_flags. In vfs_cache.c this field is accessed under inconsistent locking…
-
Critical 9.1
e1000: fix OOB in e1000_tbi_should_accept()
In the Linux kernel, the following vulnerability has been resolved: e1000: fix OOB in e1000_tbi_should_accept() In e1000_tbi_should_accept() we read the last byte of the frame via 'data[length - 1]' to evaluate the TBI workaround. If the descriptor- reported …
-
Critical 9.1
net: stmmac: fix the crash issue for zero copy XDP_TX action
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix the crash issue for zero copy XDP_TX action There is a crash issue when running zero copy XDP_TX action, the crash log is shown below. [ 216.122464] Unable to handle kernel p…
-
High 8.8
scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path"
In the Linux kernel, the following vulnerability has been resolved: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" This reverts commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9. The commit being reverted added code to __qla2x00…
-
High 8.2
shmem: fix recovery on rename failures
In the Linux kernel, the following vulnerability has been resolved: shmem: fix recovery on rename failures maple_tree insertions can fail if we are seriously short on memory; simple_offset_rename() does not recover well if it runs into that. The same goes for…
-
High 8.1
caif: fix integer underflow in cffrml_receive()
In the Linux kernel, the following vulnerability has been resolved: caif: fix integer underflow in cffrml_receive() The cffrml_receive() function extracts a length field from the packet header and, when FCS is disabled, subtracts 2 from this length without va…
-
High 8.0
NFSD: NFSv4 file creation neglects setting ACL
In the Linux kernel, the following vulnerability has been resolved: NFSD: NFSv4 file creation neglects setting ACL An NFSv4 client that sets an ACL with a named principal during file creation retrieves the ACL afterwards, and finds that it is only a default A…
-
High 7.8
tpm2-sessions: Fix out of range indexing in name_size
In the Linux kernel, the following vulnerability has been resolved: tpm2-sessions: Fix out of range indexing in name_size 'name_size' does not have any range checks, and it just directly indexes with TPM_ALG_ID, which could lead into memory corruption at wors…
-
High 7.8
drm/amdgpu: fix a job->pasid access race in gpu recovery
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix a job->pasid access race in gpu recovery Avoid a possible UAF in GPU recovery due to a race between the sched timeout callback and the tdr work queue. The gpu recovery functio…
-
High 7.8
ethtool: Avoid overflowing userspace buffer on stats query
In the Linux kernel, the following vulnerability has been resolved: ethtool: Avoid overflowing userspace buffer on stats query The ethtool -S command operates across three ioctl calls: ETHTOOL_GSSET_INFO for the size, ETHTOOL_GSTRINGS for the names, and ETHTO…
-
High 7.8
mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats Cited commit added a dedicated mutex (instead of RTNL) to protect the multicast route list, so that it will not chan…
-
High 7.8
mlxsw: spectrum_router: Fix neighbour use-after-free
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_router: Fix neighbour use-after-free We sometimes observe use-after-free when dereferencing a neighbour [1]. The problem seems to be that the driver stores a pointer to the ne…
-
High 7.8
fuse: fix io-uring list corruption for terminated non-committed requests
In the Linux kernel, the following vulnerability has been resolved: fuse: fix io-uring list corruption for terminated non-committed requests When a request is terminated before it has been committed, the request is not removed from the queue's list. This leav…
-
High 7.8
media: vidtv: initialize local pointers upon transfer of memory ownership
In the Linux kernel, the following vulnerability has been resolved: media: vidtv: initialize local pointers upon transfer of memory ownership vidtv_channel_si_init() creates a temporary list (program, service, event) and ownership of the memory itself is tran…
-
High 7.8
KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot
In the Linux kernel, the following vulnerability has been resolved: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot Reject attempts to disable KVM_MEM_GUEST_MEMFD on a memslot that was initially created with a guest_memfd binding, as KVM doe…
-
High 7.8
net/sched: ets: Remove drr class from the active list if it changes to strict
In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Remove drr class from the active list if it changes to strict Whenever a user issues an ets qdisc change command, transforming a drr class into a strict one, the ets code isn'…
-
High 7.8
media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()
In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() rlen value is a user-controlled value, but dtv5100_i2c_msg() does not check the size of the rlen value. Therefore, if it is set…
-
High 7.8
Input: alps - fix use-after-free bugs caused by dev3_register_work
In the Linux kernel, the following vulnerability has been resolved: Input: alps - fix use-after-free bugs caused by dev3_register_work The dev3_register_work delayed work item is initialized within alps_reconnect() and scheduled upon receipt of the first bare…
-
High 7.8
net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change
In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change zdi-disclosures@trendmicro.com says: The vulnerability is a race condition between `ets_qdisc_dequeue`…
-
High 7.8
ublk: clean up user copy references on ublk server exit
In the Linux kernel, the following vulnerability has been resolved: ublk: clean up user copy references on ublk server exit If a ublk server process releases a ublk char device file, any requests dispatched to the ublk server but not yet completed will retain…
-
High 7.8
functionfs: fix the open/removal races
In the Linux kernel, the following vulnerability has been resolved: functionfs: fix the open/removal races ffs_epfile_open() can race with removal, ending up with file->private_data pointing to freed object. There is a total count of opened files on functionf…
-
High 7.8
powerpc/64s/slb: Fix SLB multihit issue during SLB preload
In the Linux kernel, the following vulnerability has been resolved: powerpc/64s/slb: Fix SLB multihit issue during SLB preload On systems using the hash MMU, there is a software SLB preload cache that mirrors the entries loaded into the hardware SLB buffer. T…
-
High 7.8
Bluetooth: btusb: revert use of devm_kzalloc in btusb
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: revert use of devm_kzalloc in btusb This reverts commit 98921dbd00c4e ("Bluetooth: Use devm_kzalloc in btusb.c file"). In btusb_probe(), we use devm_kzalloc() to allocate th…
-
High 7.8
iommu: disable SVA when CONFIG_X86 is set
In the Linux kernel, the following vulnerability has been resolved: iommu: disable SVA when CONFIG_X86 is set Patch series "Fix stale IOTLB entries for kernel address space", v7. This proposes a fix for a security vulnerability related to IOMMU Shared Virtual…
-
High 7.8
RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats()
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats() Commit ef56081d1864 ("RDMA/bnxt_re: RoCE related hardware counters update") added three new counters and placed them after BNXT_RE_OUT_…
-
High 7.8
drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()
In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() In xe_oa_add_config_ioctl(), we accessed oa_config->id after dropping metrics_lock. Since this lock protects the lifetime of oa_config…
-
High 7.6
wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()
In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() TID getting from ieee80211_get_tid() might be out of range of array size of sta_entry->tids[], so check TID is less than …
-
High 7.5
bnxt_en: Fix XDP_TX path
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix XDP_TX path For XDP_TX action in bnxt_rx_xdp(), clearing of the event flags is not correct. __bnxt_poll_work() -> bnxt_rx_pkt() -> bnxt_rx_xdp() may be looping within NAPI and so…
-
High 7.5
hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create
In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create When sync() and link() are called concurrently, both threads may enter hfs_bnode_find() without finding the node in the hash table a…
-
High 7.5
scsi: target: Reset t_task_cdb pointer in error case
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Reset t_task_cdb pointer in error case If allocation of cmd->t_task_cdb fails, it remains NULL but is later dereferenced in the 'err' path. In case of error, reset NULL t_task_c…
-
High 7.5
ksmbd: fix buffer validation by including null terminator size in EA length
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix buffer validation by including null terminator size in EA length The smb2_set_ea function, which handles Extended Attributes (EA), was performing buffer validation checks that inco…
-
High 7.5
ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT On PREEMPT_RT kernels, after rt6_get_pcpu_route() returns NULL, the current task can be preempted. Another task running on the same CP…
-
High 7.5
ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
In the Linux kernel, the following vulnerability has been resolved: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() There exists a kernel oops caused by a BUG_ON(nhead < 0) at net/core/skbuff.c:2232 in pskb_expand_head(). This bug is tri…
-
High 7.5
nfsd: fix nfsd_file reference leak in nfsd4_add_rdaccess_to_wrdeleg()
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd_file reference leak in nfsd4_add_rdaccess_to_wrdeleg() nfsd4_add_rdaccess_to_wrdeleg() unconditionally overwrites fp->fi_fds[O_RDONLY] with a newly acquired nfsd_file. However,…
-
High 7.1
net: openvswitch: fix middle attribute validation in push_nsh() action
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix middle attribute validation in push_nsh() action The push_nsh() action structure looks like this: OVS_ACTION_ATTR_PUSH_NSH(OVS_KEY_ATTR_NSH(OVS_NSH_KEY_ATTR_BASE,...)) T…
-
High 7.1
platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing The hp_populate_*_elements_from_package() functions in the hp-bioscfg driver contain out-of-bounds array acces…
-
Unscored —
hfsplus: Verify inode mode when loading from disk
In the Linux kernel, the following vulnerability has been resolved: hfsplus: Verify inode mode when loading from disk syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 16bits "mode" field loaded from disk are c…
-
Unscored —
inet: frags: flush pending skbs in fqdir_pre_exit()
In the Linux kernel, the following vulnerability has been resolved: inet: frags: flush pending skbs in fqdir_pre_exit() We have been seeing occasional deadlocks on pernet_ops_rwsem since September in NIPA. The stuck task was usually modprobe (often loading a …
-
Unscored —
f2fs: fix return value of f2fs_recover_fsync_data()
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix return value of f2fs_recover_fsync_data() With below scripts, it will trigger panic in f2fs: mkfs.f2fs -f /dev/vdd mount /dev/vdd /mnt/f2fs touch /mnt/f2fs/foo sync echo 111 >> /mnt…
-
Unscored —
ocfs2: fix kernel BUG in ocfs2_find_victim_chain
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix kernel BUG in ocfs2_find_victim_chain syzbot reported a kernel BUG in ocfs2_find_victim_chain() because the `cl_next_free_rec` field of the allocation chain list (next free slot in…
-
Unscored —
f2fs: fix to avoid updating compression context during writeback
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid updating compression context during writeback Bai, Shuangpeng <sjb7183@psu.edu> reported a bug as below: Oops: divide error: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 1144…
-
Unscored —
spi: fsl-cpm: Check length parity before switching to 16 bit mode
In the Linux kernel, the following vulnerability has been resolved: spi: fsl-cpm: Check length parity before switching to 16 bit mode Commit fc96ec826bce ("spi: fsl-cpm: Use 16 bit mode for large transfers with even size") failed to make sure that the size is…
-
Unscored —
net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()
In the Linux kernel, the following vulnerability has been resolved: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() prp_get_untagged_frame() calls __pskb_copy() to create frame->skb_std but doesn't check if the allocation failed. If __pskb_c…
-
Unscored —
Input: ti_am335x_tsc - fix off-by-one error in wire_order validation
In the Linux kernel, the following vulnerability has been resolved: Input: ti_am335x_tsc - fix off-by-one error in wire_order validation The current validation 'wire_order[i] > ARRAY_SIZE(config_pins)' allows wire_order[i] to equal ARRAY_SIZE(config_pins), wh…
-
Unscored —
btrfs: don't log conflicting inode if it's a dir moved in the current transaction
In the Linux kernel, the following vulnerability has been resolved: btrfs: don't log conflicting inode if it's a dir moved in the current transaction We can't log a conflicting inode if it's a directory and it was moved from one parent directory to another pa…
-
Unscored —
net/mlx5e: Avoid unregistering PSP twice
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid unregistering PSP twice PSP is unregistered twice in: _mlx5e_remove -> mlx5e_psp_unregister mlx5e_nic_cleanup -> mlx5e_psp_unregister This leads to a refcount underflow in so…
-
Unscored —
sched/deadline: only set free_cpus for online runqueues
In the Linux kernel, the following vulnerability has been resolved: sched/deadline: only set free_cpus for online runqueues Commit 16b269436b72 ("sched/deadline: Modify cpudl::free_cpus to reflect rd->online") introduced the cpudl_set/clear_freecpu functions …
-
Unscored —
usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal
In the Linux kernel, the following vulnerability has been resolved: usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal The delayed work item otg_event is initialized in fsl_otg_conf() and scheduled under two conditions: 1. When a host…
-
Unscored —
ALSA: usb-mixer: us16x08: validate meter packet indices
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-mixer: us16x08: validate meter packet indices get_meter_levels_from_urb() parses the 64-byte meter packets sent by the device and fills the per-channel arrays meter_level[], comp_le…
-
Unscored —
xfs: fix a UAF problem in xattr repair
In the Linux kernel, the following vulnerability has been resolved: xfs: fix a UAF problem in xattr repair The xchk_setup_xattr_buf function can allocate a new value buffer, which means that any reference to ab->value before the call could become a dangling p…
-
Unscored —
ksmbd: skip lock-range check on equal size to avoid size==0 underflow
In the Linux kernel, the following vulnerability has been resolved: ksmbd: skip lock-range check on equal size to avoid size==0 underflow When size equals the current i_size (including 0), the code used to call check_lock_range(filp, i_size, size - 1, WRITE),…
-
Unscored —
netrom: Fix memory leak in nr_sendmsg()
In the Linux kernel, the following vulnerability has been resolved: netrom: Fix memory leak in nr_sendmsg() syzbot reported a memory leak [1]. When function sock_alloc_send_skb() return NULL in nr_output(), the original skb is not freed, which was allocated i…
-
Unscored —
fsnotify: do not generate ACCESS/MODIFY events on child for special files
In the Linux kernel, the following vulnerability has been resolved: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users with no read access to a file to subscribe to events (e.g. IN_ACCESS/IN_MODIFY), …
-
Unscored —CVE-2025-68789 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
net/mlx5: Fix double unregister of HCA_PORTS component
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix double unregister of HCA_PORTS component Clear hca_devcom_comp in device's private data after unregistering it in LAG teardown. Otherwise a slightly lagging second pass through …
-
Unscored —
fuse: missing copy_finish in fuse-over-io-uring argument copies
In the Linux kernel, the following vulnerability has been resolved: fuse: missing copy_finish in fuse-over-io-uring argument copies Fix a possible reference count leak of payload pages during fuse argument copies. [Joanne: simplified error cleanup]
-
Unscored —
f2fs: fix to avoid updating zero-sized extent in extent cache
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid updating zero-sized extent in extent cache As syzbot reported: F2FS-fs (loop0): __update_extent_tree_range: extent len is zero, type: 0, extent [0, 0, 0], age [0, 0] ------…
-
Unscored —
char: applicom: fix NULL pointer dereference in ac_ioctl
In the Linux kernel, the following vulnerability has been resolved: char: applicom: fix NULL pointer dereference in ac_ioctl Discovered by Atuin - Automated Vulnerability Discovery Engine. In ac_ioctl, the validation of IndexCard and the check for a valid Ram…
-
Unscored —
perf/x86/amd: Check event before enable to avoid GPF
In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd: Check event before enable to avoid GPF On AMD machines cpuc->events[idx] can become NULL in a subtle race condition with NMI->throttle->x86_pmu_stop(). Check event for NULL in a…
-
Unscored —
drm/xe: Limit num_syncs to prevent oversized allocations
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Limit num_syncs to prevent oversized allocations The exec and vm_bind ioctl allow userspace to specify an arbitrary num_syncs value. Without bounds checking, a very large num_syncs ca…
-
Unscored —
platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver
In the Linux kernel, the following vulnerability has been resolved: platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver After unbinding the driver, another kthread `cros_ec_console_log_work` is still accessing the device, resulting an UAF and crash…
-
Unscored —
block: fix race between wbt_enable_default and IO submission
In the Linux kernel, the following vulnerability has been resolved: block: fix race between wbt_enable_default and IO submission When wbt_enable_default() is moved out of queue freezing in elevator_change(), it can cause the wbt inflight counter to become neg…
-
Unscored —CVE-2025-68812 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
ipvs: fix ipv4 null-ptr-deref in route error path
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix ipv4 null-ptr-deref in route error path The IPv4 code path in __ip_vs_get_out_rt() calls dst_link_failure() without ensuring skb->dev is set, leading to a NULL pointer dereference i…
-
Unscored —
io_uring: fix filename leak in __io_openat_prep()
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix filename leak in __io_openat_prep() __io_openat_prep() allocates a struct filename using getname(). However, for the condition of the file being installed in the fixed file tabl…
-
Unscored —
net/mlx5: fw_tracer, Validate format string parameters
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fw_tracer, Validate format string parameters Add validation for format string parameters in the firmware tracer to prevent potential security vulnerabilities and crashes from malfor…
-
Unscored —
ext4: xattr: fix null pointer deref in ext4_raw_inode()
In the Linux kernel, the following vulnerability has been resolved: ext4: xattr: fix null pointer deref in ext4_raw_inode() If ext4_get_inode_loc() fails (e.g. if it returns -EFSCORRUPTED), iloc.bh will remain set to NULL. Since ext4_xattr_inode_dec_ref_all()…
-
Unscored —
fuse: fix readahead reclaim deadlock
In the Linux kernel, the following vulnerability has been resolved: fuse: fix readahead reclaim deadlock Commit e26ee4efbc79 ("fuse: allocate ff->release_args only if release is needed") skips allocating ff->release_args if the server does not implement open.…
-
Unscored —
ublk: fix deadlock when reading partition table
In the Linux kernel, the following vulnerability has been resolved: ublk: fix deadlock when reading partition table When one process(such as udev) opens ublk block device (e.g., to read the partition table via bdev_open()), a deadlock[1] can occur: 1. bdev_op…
-
Unscored —
net: hns3: using the num_tqps in the vf driver to apply for resources
In the Linux kernel, the following vulnerability has been resolved: net: hns3: using the num_tqps in the vf driver to apply for resources Currently, hdev->htqp is allocated using hdev->num_tqps, and kinfo->tqp is allocated using kinfo->num_tqps. However, kinf…
-
Unscored —
f2fs: fix to avoid potential deadlock
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential deadlock As Jiaming Zhang and syzbot reported, there is potential deadlock in f2fs as below: Chain exists of: &sbi->cp_rwsem --> fs_reclaim --> sb_internal#2 Poss…
-
Unscored —
ntfs: set dummy blocksize to read boot_block when mounting
In the Linux kernel, the following vulnerability has been resolved: ntfs: set dummy blocksize to read boot_block when mounting When mounting, sb->s_blocksize is used to read the boot_block without being defined or validated. Set a dummy blocksize before attem…
-
Unscored —
f2fs: invalidate dentry cache on failed whiteout creation
In the Linux kernel, the following vulnerability has been resolved: f2fs: invalidate dentry cache on failed whiteout creation F2FS can mount filesystems with corrupted directory depth values that get runtime-clamped to MAX_DIR_HASH_DEPTH. When RENAME_WHITEOUT…
-
Unscored —
iommu/mediatek: fix use-after-free on probe deferral
In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: fix use-after-free on probe deferral The driver is dropping the references taken to the larb devices during probe after successful lookup as well as on errors. This can potent…
-
Unscored —
Input: lkkbd - disable pending work before freeing device
In the Linux kernel, the following vulnerability has been resolved: Input: lkkbd - disable pending work before freeing device lkkbd_interrupt() schedules lk->tq via schedule_work(), and the work handler lkkbd_reinit() dereferences the lkkbd structure and its …
-
Unscored —
scsi: aic94xx: fix use-after-free in device removal path
In the Linux kernel, the following vulnerability has been resolved: scsi: aic94xx: fix use-after-free in device removal path The asd_pci_remove() function fails to synchronize with pending tasklets before freeing the asd_ha structure, leading to a potential u…
-
Unscored —
drm/xe/oa: Limit num_syncs to prevent oversized allocations
In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Limit num_syncs to prevent oversized allocations The OA open parameters did not validate num_syncs, allowing userspace to pass arbitrarily large values, potentially leading to exce…
-
Unscored —
tpm: Cap the number of PCR banks
In the Linux kernel, the following vulnerability has been resolved: tpm: Cap the number of PCR banks tpm2_get_pcr_allocation() does not cap any upper limit for the number of banks. Cap the limit to eight banks so that out of bounds values coming from external…
-
Unscored —
net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
In the Linux kernel, the following vulnerability has been resolved: net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write A deadlock can occur between nfc_unregister_device() and rfkill_fop_write() due to lock ordering inversion between de…
-
Unscored —
ASoC: stm32: sai: fix OF node leak on probe
In the Linux kernel, the following vulnerability has been resolved: ASoC: stm32: sai: fix OF node leak on probe The reference taken to the sync provider OF node when probing the platform device is currently only dropped if the set_sync() callback fails during…
-
Unscored —
drm/ttm: Avoid NULL pointer deref for evicted BOs
In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Avoid NULL pointer deref for evicted BOs It is possible for a BO to exist that is not currently associated with a resource, e.g. because it has been evicted. When devcoredump tries t…
-
Unscored —
RDMA/cm: Fix leaking the multicast GID table reference
In the Linux kernel, the following vulnerability has been resolved: RDMA/cm: Fix leaking the multicast GID table reference If the CM ID is destroyed while the CM event for multicast creating is still queued the cancel_work_sync() will prevent the work from ru…
-
Unscored —
net: rose: fix invalid array index in rose_kill_by_device()
In the Linux kernel, the following vulnerability has been resolved: net: rose: fix invalid array index in rose_kill_by_device() rose_kill_by_device() collects sockets into a local array[] and then iterates over them to disconnect sockets bound to a device bei…
-
Unscored —
iavf: fix off-by-one issues in iavf_config_rss_reg()
In the Linux kernel, the following vulnerability has been resolved: iavf: fix off-by-one issues in iavf_config_rss_reg() There are off-by-one bugs when configuring RSS hash key and lookup table, causing out-of-bounds reads to memory [1] and out-of-bounds writ…
-
Unscored —
mptcp: fallback earlier on simult connection
In the Linux kernel, the following vulnerability has been resolved: mptcp: fallback earlier on simult connection Syzkaller reports a simult-connect race leading to inconsistent fallback status: WARNING: CPU: 3 PID: 33 at net/mptcp/subflow.c:1515 subflow_data_…
-
Unscored —
team: fix check for port enabled in team_queue_override_port_prio_changed()
In the Linux kernel, the following vulnerability has been resolved: team: fix check for port enabled in team_queue_override_port_prio_changed() There has been a syzkaller bug reported recently with the following trace: list_del corruption, ffff888058bea080->p…
-
Unscored —
net: usb: asix: validate PHY address before use
In the Linux kernel, the following vulnerability has been resolved: net: usb: asix: validate PHY address before use The ASIX driver reads the PHY address from the USB device via asix_read_phy_addr(). A malicious or faulty device can return an invalid address …
-
Unscored —
RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly The netlink response for RDMA_NL_LS_OP_IP_RESOLVE should always have a LS_NLA_TYPE_DGID attribute, it is invalid if it does not…
-
Unscored —
ipv4: Fix reference count leak when using error routes with nexthop objects
In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix reference count leak when using error routes with nexthop objects When a nexthop object is deleted, it is marked as dead and then fib_table_flush() is called to flush all the routes…
-
Unscored —
ip6_gre: make ip6gre_header() robust
In the Linux kernel, the following vulnerability has been resolved: ip6_gre: make ip6gre_header() robust Over the years, syzbot found many ways to crash the kernel in ip6gre_header() [1]. This involves team or bonding drivers ability to dynamically change the…
Revision history
-
#129
Neue Updates von Debian aufgenommen
-
#128
Neue Updates von SUSE aufgenommen
-
#127
Neue Updates von Ubuntu aufgenommen
-
#126
Neue Updates von SUSE aufgenommen
-
#125
Neue Updates von Red Hat, SUSE und IBM aufgenommen
-
#124
Neue Updates von Red Hat und Debian aufgenommen
-
#123
Neue Updates von Oracle Linux aufgenommen
-
#122
Neue Updates von Oracle Linux aufgenommen
-
#121
Neue Updates von Oracle Linux aufgenommen
-
#120
Neue Updates von Ubuntu aufgenommen
-
#119
Neue Updates von Oracle Linux aufgenommen
-
#118
Neue Updates von IBM aufgenommen
-
#117
Neue Updates von Oracle Linux aufgenommen
-
#116
Neue Updates von SUSE aufgenommen
-
#115
Neue Updates von openSUSE aufgenommen
-
#114
Neue Updates von Rocky Enterprise Software Foundation aufgenommen
-
#113
Neue Updates von Red Hat aufgenommen
-
#112
Neue Updates von SUSE aufgenommen
-
#111
Neue Updates von SUSE aufgenommen
-
#110
Neue Updates von SUSE aufgenommen
-
#109
Neue Updates von SUSE aufgenommen
-
#108
Neue Updates von Debian aufgenommen
-
#107
Neue Updates von Oracle Linux aufgenommen
-
#106
Neue Updates von Dell aufgenommen
-
#105
Neue Updates von SUSE aufgenommen
References
-
Kernel CVE Announce Mailingliste
https://lore.kernel.org/linux-cve-announce/
-
Linux Kernel CVE Announcement CVE-2025-68767
https://lore.kernel.org/linux-cve-announce/2026011353-CVE-2025-68767-cd16@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68768
https://lore.kernel.org/linux-cve-announce/2026011356-CVE-2025-68768-d458@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68769
https://lore.kernel.org/linux-cve-announce/2026011357-CVE-2025-68769-e471@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68770
https://lore.kernel.org/linux-cve-announce/2026011357-CVE-2025-68770-6464@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68771
https://lore.kernel.org/linux-cve-announce/2026011357-CVE-2025-68771-cf0d@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68772
https://lore.kernel.org/linux-cve-announce/2026011358-CVE-2025-68772-9d70@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68773
https://lore.kernel.org/linux-cve-announce/2026011358-CVE-2025-68773-bd5d@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68774
https://lore.kernel.org/linux-cve-announce/2026011358-CVE-2025-68774-f2fd@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68775
https://lore.kernel.org/linux-cve-announce/2026011359-CVE-2025-68775-6e68@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68776
https://lore.kernel.org/linux-cve-announce/2026011359-CVE-2025-68776-5aed@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68777
https://lore.kernel.org/linux-cve-announce/2026011359-CVE-2025-68777-2073@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68778
https://lore.kernel.org/linux-cve-announce/2026011300-CVE-2025-68778-c392@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68779
https://lore.kernel.org/linux-cve-announce/2026011300-CVE-2025-68779-726e@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68780
https://lore.kernel.org/linux-cve-announce/2026011300-CVE-2025-68780-f5c8@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68781
https://lore.kernel.org/linux-cve-announce/2026011301-CVE-2025-68781-f30f@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68782
https://lore.kernel.org/linux-cve-announce/2026011301-CVE-2025-68782-a72f@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68783
https://lore.kernel.org/linux-cve-announce/2026011302-CVE-2025-68783-e807@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68784
https://lore.kernel.org/linux-cve-announce/2026011302-CVE-2025-68784-b1e0@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68785
https://lore.kernel.org/linux-cve-announce/2026011302-CVE-2025-68785-c96c@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68786
https://lore.kernel.org/linux-cve-announce/2026011303-CVE-2025-68786-d145@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68787
https://lore.kernel.org/linux-cve-announce/2026011303-CVE-2025-68787-af6d@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68788
https://lore.kernel.org/linux-cve-announce/2026011303-CVE-2025-68788-05bd@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68789
https://lore.kernel.org/linux-cve-announce/2026011304-CVE-2025-68789-cca8@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68790
https://lore.kernel.org/linux-cve-announce/2026011304-CVE-2025-68790-6166@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68791
https://lore.kernel.org/linux-cve-announce/2026011304-CVE-2025-68791-e739@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68792
https://lore.kernel.org/linux-cve-announce/2026011305-CVE-2025-68792-9a3f@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68793
https://lore.kernel.org/linux-cve-announce/2026011305-CVE-2025-68793-bb5f@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68794
https://lore.kernel.org/linux-cve-announce/2026011305-CVE-2025-68794-32db@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68795
https://lore.kernel.org/linux-cve-announce/2026011306-CVE-2025-68795-4e3e@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68796
https://lore.kernel.org/linux-cve-announce/2026011306-CVE-2025-68796-9eee@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68797
https://lore.kernel.org/linux-cve-announce/2026011306-CVE-2025-68797-b45e@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68798
https://lore.kernel.org/linux-cve-announce/2026011307-CVE-2025-68798-ea9c@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68799
https://lore.kernel.org/linux-cve-announce/2026011307-CVE-2025-68799-b0dd@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68800
https://lore.kernel.org/linux-cve-announce/2026011307-CVE-2025-68800-39d2@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68801
https://lore.kernel.org/linux-cve-announce/2026011308-CVE-2025-68801-d3d5@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68802
https://lore.kernel.org/linux-cve-announce/2026011308-CVE-2025-68802-a7f9@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68803
https://lore.kernel.org/linux-cve-announce/2026011309-CVE-2025-68803-d897@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68804
https://lore.kernel.org/linux-cve-announce/2026011309-CVE-2025-68804-f10e@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68805
https://lore.kernel.org/linux-cve-announce/2026011309-CVE-2025-68805-3284@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68806
https://lore.kernel.org/linux-cve-announce/2026011310-CVE-2025-68806-a2fb@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68807
https://lore.kernel.org/linux-cve-announce/2026011310-CVE-2025-68807-0fd6@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68808
https://lore.kernel.org/linux-cve-announce/2026011310-CVE-2025-68808-4cb9@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68809
https://lore.kernel.org/linux-cve-announce/2026011311-CVE-2025-68809-e875@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68810
https://lore.kernel.org/linux-cve-announce/2026011311-CVE-2025-68810-308a@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68811
https://lore.kernel.org/linux-cve-announce/2026011311-CVE-2025-68811-7e46@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68812
https://lore.kernel.org/linux-cve-announce/2026011312-CVE-2025-68812-4098@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68813
https://lore.kernel.org/linux-cve-announce/2026011312-CVE-2025-68813-13a5@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68814
https://lore.kernel.org/linux-cve-announce/2026011312-CVE-2025-68814-146a@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68815
https://lore.kernel.org/linux-cve-announce/2026011313-CVE-2025-68815-2112@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68816
https://lore.kernel.org/linux-cve-announce/2026011313-CVE-2025-68816-e773@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68817
https://lore.kernel.org/linux-cve-announce/2026011313-CVE-2025-68817-03ab@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68818
https://lore.kernel.org/linux-cve-announce/2026011314-CVE-2025-68818-08ea@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68819
https://lore.kernel.org/linux-cve-announce/2026011314-CVE-2025-68819-64a3@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68820
https://lore.kernel.org/linux-cve-announce/2026011315-CVE-2025-68820-7a4f@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68821
https://lore.kernel.org/linux-cve-announce/2026011315-CVE-2025-68821-b515@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68822
https://lore.kernel.org/linux-cve-announce/2026011315-CVE-2025-68822-a75d@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-68823
https://lore.kernel.org/linux-cve-announce/2026011316-CVE-2025-68823-8bf1@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71064
https://lore.kernel.org/linux-cve-announce/2026011322-CVE-2025-71064-94ea@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71065
https://lore.kernel.org/linux-cve-announce/2026011322-CVE-2025-71065-6818@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71066
https://lore.kernel.org/linux-cve-announce/2026011323-CVE-2025-71066-f1fa@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71067
https://lore.kernel.org/linux-cve-announce/2026011323-CVE-2025-71067-9c81@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71068
https://lore.kernel.org/linux-cve-announce/2026011323-CVE-2025-71068-f1a9@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71069
https://lore.kernel.org/linux-cve-announce/2026011324-CVE-2025-71069-33d4@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71070
https://lore.kernel.org/linux-cve-announce/2026011324-CVE-2025-71070-b6c2@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71071
https://lore.kernel.org/linux-cve-announce/2026011325-CVE-2025-71071-67e9@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71072
https://lore.kernel.org/linux-cve-announce/2026011325-CVE-2025-71072-b52b@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71073
https://lore.kernel.org/linux-cve-announce/2026011325-CVE-2025-71073-b002@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71074
https://lore.kernel.org/linux-cve-announce/2026011326-CVE-2025-71074-f3ed@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71075
https://lore.kernel.org/linux-cve-announce/2026011326-CVE-2025-71075-c85d@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71076
https://lore.kernel.org/linux-cve-announce/2026011326-CVE-2025-71076-19ff@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71077
https://lore.kernel.org/linux-cve-announce/2026011327-CVE-2025-71077-6e08@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71078
https://lore.kernel.org/linux-cve-announce/2026011337-CVE-2025-71078-9a51@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71079
https://lore.kernel.org/linux-cve-announce/2026011338-CVE-2025-71079-9f24@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71080
https://lore.kernel.org/linux-cve-announce/2026011338-CVE-2025-71080-f9ae@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71081
https://lore.kernel.org/linux-cve-announce/2026011338-CVE-2025-71081-df43@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71082
https://lore.kernel.org/linux-cve-announce/2026011339-CVE-2025-71082-ef8a@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71083
https://lore.kernel.org/linux-cve-announce/2026011339-CVE-2025-71083-ddb3@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71084
https://lore.kernel.org/linux-cve-announce/2026011339-CVE-2025-71084-52a2@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71085
https://lore.kernel.org/linux-cve-announce/2026011340-CVE-2025-71085-e6c1@gregkh/