Linux
Monthly
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Limit num_syncs to prevent oversized allocations The exec and vm_bind ioctl allow userspace to specify an arbitrary num_syncs value.
Local privilege-holder-triggered use-after-free in the Linux kernel's mlxsw Spectrum switch driver (drivers/net/ethernet/mellanox/mlxsw) lets a network-admin operation on Nvidia/Mellanox Spectrum ASIC hardware dereference a freed neighbour object during RIF teardown. The driver cached a neighbour pointer without holding a reference, so freeing the neighbour (e.g. while removing a device from a VRF) leaves a dangling pointer that mlxsw_sp_neigh_entry_update() reads, corrupting kernel memory. CVSS is 7.8 (local, low privilege in the automated NVD scoring) but EPSS is only 0.05% (16th percentile) and there is no public exploit or CISA KEV listing - the flaw was found via an internal stress test, not observed attacks.
Local privilege escalation potential arising from a use-after-free in the Linux kernel's mlxsw Spectrum driver (spectrum_mr) allows an attacker with network-administration rights on a Mellanox Spectrum switch to trigger memory corruption during multicast route replacement. A prior fix introduced a dedicated mutex to protect the multicast route list, but one list-entry deletion path during route replace was missed, so the periodic mlxsw_sp_mr_stats_update worker can read a freed route object. EPSS is low (0.05%) and there is no public exploit identified at time of analysis; a vendor patch is available across multiple stable branches.
Denial of service and potential kernel memory disclosure in the Linux kernel's CAIF protocol stack arises because cffrml_receive() subtracts 2 from a packet-derived length field without checking that the value is at least 2 when FCS checking is disabled. An adjacent attacker sending a CAIF frame whose length field is 0 or 1 triggers an integer underflow, leading to memory exhaustion, kernel instability, and possible leakage of uninitialized kernel memory contained in packet padding. There is no public exploit identified at time of analysis, EPSS risk is very low (0.05%), and the flaw is not in CISA KEV.
In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd: Check event before enable to avoid GPF On AMD machines cpuc->events[idx] can become NULL in a subtle race condition with NMI->throttle->x86_pmu_stop().
In the Linux kernel, the following vulnerability has been resolved: char: applicom: fix NULL pointer dereference in ac_ioctl Discovered by Atuin - Automated Vulnerability Discovery Engine. In ac_ioctl, the validation of IndexCard and the check for a valid RamIO pointer are skipped when cmd is 6.
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid updating zero-sized extent in extent cache As syzbot reported: F2FS-fs (loop0): __update_extent_tree_range: extent len is zero, type: 0, extent [0, 0, 0], age [0, 0] ------------[ cut here ]------------ kernel BUG at fs/f2fs/extent_cache.c:678!
Local privilege-level buffer overflow in the Linux kernel's ethtool subsystem allows an attacker who can trigger a device stat-count change between the ETHTOOL_GSSET_INFO, ETHTOOL_GSTRINGS, and ETHTOOL_GSTATS ioctls to overflow a userspace stats buffer, corrupting memory and potentially escalating privileges. The flaw stems from a TOCTOU race where drivers using dynamic counters (mlx5, bnx2x, bna, ksz884x) can report a different stat count than the buffer sized by userspace. It is not in CISA KEV, EPSS exploitation probability is very low (0.06%), and no public exploit has been identified, though a vendor patch is available.
Out-of-bounds read range miscalculation in the Linux kernel iomap subsystem allows a local attacker who can mount a crafted filesystem image (demonstrated against erofs via syzbot) to trigger a length underflow that returns a read position beyond the folio, leading to information disclosure or memory corruption during buffered reads. The flaw lives in iomap_adjust_read_range(), which incorrectly assumed block-aligned positions and lengths. No public exploit identified at time of analysis; EPSS exploitation probability is very low (0.03%), and it is not listed in CISA KEV.
Local privilege escalation or kernel memory disclosure in the Linux kernel's amdgpu DRM driver stems from a use-after-free during GPU recovery, where a race between the scheduler timeout callback (drm_sched_job_timedout) and the TDR work queue can free a job structure before amdgpu_device_gpu_recover reads its pasid field. Affected systems are those running vulnerable kernels with AMD GPUs using the amdgpu driver; a local attacker able to submit GPU work and induce a GPU hang could trigger the freed-memory access, as demonstrated by the supplied KASAN slab-use-after-free trace. There is no public exploit identified at time of analysis, and the EPSS score is negligible (0.03%, 7th percentile), consistent with a difficult-to-win kernel race rather than a broadly exploited flaw.
Memory corruption in the Linux kernel's TPM 2.0 session-handling code (tpm2-sessions) arises because the 'name_size' value derived from a TPM_ALG_ID is used to index without range validation, so an unrecognized or malicious algorithm identifier can drive an out-of-bounds access. The affected TPM HMAC/authorization session path is reachable from local, low-privileged kernel-driver interactions; at worst this leads to kernel memory corruption affecting confidentiality, integrity, and availability. No public exploit is identified at time of analysis and the EPSS probability is negligible (0.03%), consistent with a locally-scoped kernel hardening fix rather than a mass-exploited flaw.
In the Linux kernel, the following vulnerability has been resolved: fuse: missing copy_finish in fuse-over-io-uring argument copies Fix a possible reference count leak of payload pages during fuse argument copies. [Joanne: simplified error cleanup]
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix double unregister of HCA_PORTS component Clear hca_devcom_comp in device's private data after unregistering it in LAG teardown.
In the Linux kernel, the following vulnerability has been resolved: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users with no read access to a file to subscribe to events (e.g.
In the Linux kernel, the following vulnerability has been resolved: netrom: Fix memory leak in nr_sendmsg() syzbot reported a memory leak [1]. When function sock_alloc_send_skb() return NULL in nr_output(), the original skb is not freed, which was allocated in nr_sendmsg().
In the Linux kernel, the following vulnerability has been resolved: ksmbd: skip lock-range check on equal size to avoid size==0 underflow When size equals the current i_size (including 0), the code used to call check_lock_range(filp, i_size, size - 1, WRITE), which computes `size - 1` and can underflow for size==0.
Out-of-bounds memory access in the Linux kernel's Open vSwitch (openvswitch) module allows a local user holding CAP_NET_ADMIN to leak kernel memory or crash the host by submitting a malformed OVS_ACTION_ATTR_PUSH_NSH netlink action with an incorrectly sized middle attribute. The push_nsh() action path validates the outer and inner NSH attributes but never checks the intermediate OVS_KEY_ATTR_NSH wrapper, so nsh_hdr_from_nlattr() performs a 184-byte read past a slab allocation (KASAN slab-out-of-bounds). A patch is available from the kernel stable tree and via Ubuntu USN-8096-1; there is no public exploit identified at time of analysis, and EPSS is very low (0.07%).
In the Linux kernel, the following vulnerability has been resolved: xfs: fix a UAF problem in xattr repair The xchk_setup_xattr_buf function can allocate a new value buffer, which means that any reference to ab->value before the call could become a dangling pointer.
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-mixer: us16x08: validate meter packet indices get_meter_levels_from_urb() parses the 64-byte meter packets sent by the device and fills the per-channel arrays meter_level[], comp_level[] and master_level[] in struct snd_us16x08_meter_store.
Remote denial of service in the Linux kernel SCSI target (LIO) subsystem allows an initiator to crash a storage server by triggering a NULL-pointer dereference on the command error path. When allocation of the per-command CDB buffer (cmd->t_task_cdb) fails, the pointer is left NULL yet subsequently dereferenced in the 'err' cleanup path, panicking the kernel. No public exploit identified at time of analysis and EPSS is very low (0.05%), consistent with a hard-to-trigger memory-pressure condition rather than a reliably weaponizable flaw.
In the Linux kernel, the following vulnerability has been resolved: usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal The delayed work item otg_event is initialized in fsl_otg_conf() and scheduled under two conditions: 1.
In the Linux kernel, the following vulnerability has been resolved: sched/deadline: only set free_cpus for online runqueues Commit 16b269436b72 ("sched/deadline: Modify cpudl::free_cpus to reflect rd->online") introduced the cpudl_set/clear_freecpu functions to allow the cpu_dl::free_cpus mask to be manipulated by the deadline scheduler class rq_on/offline callbacks so the mask would also reflect this state.
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid unregistering PSP twice PSP is unregistered twice in: _mlx5e_remove -> mlx5e_psp_unregister mlx5e_nic_cleanup -> mlx5e_psp_unregister This leads to a refcount underflow in some conditions: ------------[ cut here ]------------ refcount_t: underflow; use-after-free.
In the Linux kernel, the following vulnerability has been resolved: btrfs: don't log conflicting inode if it's a dir moved in the current transaction We can't log a conflicting inode if it's a directory and it was moved from one parent directory to another parent directory in the current transaction, as this can result an attempt to have a directory with two hard links during log replay, one for the old parent directory and another for the new parent directory.
In the Linux kernel, the following vulnerability has been resolved: Input: ti_am335x_tsc - fix off-by-one error in wire_order validation The current validation 'wire_order[i] > ARRAY_SIZE(config_pins)' allows wire_order[i] to equal ARRAY_SIZE(config_pins), which causes out-of-bounds access when used as index in 'config_pins[wire_order[i]]'.
In the Linux kernel, the following vulnerability has been resolved: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() prp_get_untagged_frame() calls __pskb_copy() to create frame->skb_std but doesn't check if the allocation failed.
Refcount underflow in the Linux kernel's net/handshake subsystem lets duplicate cancellation of the same TLS handshake request drop an extra reference on the underlying socket, corrupting its reference count and leaking/freeing the socket structure. The flaw affects kernels using the in-kernel TLS handshake upcall path (notably SUNRPC-over-TLS via tlshd), where a handshake timeout can trigger two cancellation requests - one from xs_reset_transport() and one from xs_tls_handshake_sync() - for a request still present in handshake_rhashtbl. Despite an assigned 9.8 CVSS, the practical impact is a kernel memory-safety fault (crash / potential use-after-free) rather than trivial remote code execution, and there is no public exploit identified at time of analysis; EPSS is very low (0.03%).
Denial of service in the Linux kernel's HFS+ (hfsplus) filesystem driver allows a local user with access to a mounted HFS+ volume to crash the kernel via a reference-counting race in __hfs_bnode_create(). When sync() and link() operations run concurrently, two threads can both attempt to create the same B-tree node; the thread that loses the race reuses the already-hashed node without incrementing its refcount, so a later put trips BUG_ON(!atomic_read(&node->refcnt)) and panics the system. No public exploit has been identified at time of analysis, EPSS risk is very low (0.05%), and the issue is not in CISA KEV.
In the Linux kernel, the following vulnerability has been resolved: spi: fsl-cpm: Check length parity before switching to 16 bit mode Commit fc96ec826bce ("spi: fsl-cpm: Use 16 bit mode for large transfers with even size") failed to make sure that the size is really even before switching to 16 bit mode.
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid updating compression context during writeback Bai, Shuangpeng <sjb7183@psu.edu> reported a bug as below: Oops: divide error: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 11441 Comm: syz.0.46 Not tainted 6.17.0 #1 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:f2fs_all_cluster_page_ready+0x106/0x550 fs/f2fs/compress.c:857 Call Trace: <TASK> f2fs_write_cache_pages fs/f2fs/data.c:3078 [inline] __f2fs_write_data_pages fs/f2fs/data.c:3290 [inline] f2fs_write_data_pages+0x1c19/0x3600 fs/f2fs/data.c:3317 do_writepages+0x38e/0x640 mm/page-writeback.c:2634 filemap_fdatawrite_wbc mm/filemap.c:386 [inline] __filemap_fdatawrite_range mm/filemap.c:419 [inline] file_write_and_wait_range+0x2ba/0x3e0 mm/filemap.c:794 f2fs_do_sync_file+0x6e6/0x1b00 fs/f2fs/file.c:294 generic_write_sync include/linux/fs.h:3043 [inline] f2fs_file_write_iter+0x76e/0x2700 fs/f2fs/file.c:5259 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x7e9/0xe00 fs/read_write.c:686 ksys_write+0x19d/0x2d0 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf7/0x470 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The bug was triggered w/ below race condition: fsync setattr ioctl - f2fs_do_sync_file - file_write_and_wait_range - f2fs_write_cache_pages : inode is non-compressed : cc.cluster_size = F2FS_I(inode)->i_cluster_size = 0 - tag_pages_for_writeback - f2fs_setattr - truncate_setsize - f2fs_truncate - f2fs_fileattr_set - f2fs_setflags_common - set_compress_context : F2FS_I(inode)->i_cluster_size = 4 : set_inode_flag(inode, FI_COMPRESSED_FILE) - f2fs_compressed_file : return true - f2fs_all_cluster_page_ready : "pgidx % cc->cluster_size" trigger dividing 0 issue Let's change as below to fix this issue: - introduce a new atomic type variable .writeback in structure f2fs_inode_info to track the number of threads which calling f2fs_write_cache_pages().
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix kernel BUG in ocfs2_find_victim_chain syzbot reported a kernel BUG in ocfs2_find_victim_chain() because the `cl_next_free_rec` field of the allocation chain list (next free slot in the chain list) is 0, triggring the BUG_ON(!cl->cl_next_free_rec) condition in ocfs2_find_victim_chain() and panicking the kernel.
Denial of service in the Linux kernel's bnxt_en driver (Broadcom NetXtreme-E) affects systems running an XDP program that uses the XDP_TX action. Incorrect clearing of NAPI event flags in the XDP_TX path causes the TX doorbell to be skipped when the TX ring is full, stalling the associated RX ring so it is never refilled and all subsequent packets are silently dropped. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.02%, 6th percentile); an upstream fix is available in mainline and stable kernels.
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix return value of f2fs_recover_fsync_data() With below scripts, it will trigger panic in f2fs: mkfs.f2fs -f /dev/vdd mount /dev/vdd /mnt/f2fs touch /mnt/f2fs/foo sync echo 111 >> /mnt/f2fs/foo f2fs_io fsync /mnt/f2fs/foo f2fs_io shutdown 2 /mnt/f2fs umount /mnt/f2fs mount -o ro,norecovery /dev/vdd /mnt/f2fs or mount -o ro,disable_roll_forward /dev/vdd /mnt/f2fs F2FS-fs (vdd): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 F2FS-fs (vdd): Mounted with checkpoint version = 7f5c361f F2FS-fs (vdd): Stopped filesystem due to reason: 0 F2FS-fs (vdd): f2fs_recover_fsync_data: recovery fsync data, check_only: 1 Filesystem f2fs get_tree() didn't set fc->root, returned 1 ------------[ cut here ]------------ kernel BUG at fs/super.c:1761!
In the Linux kernel, the following vulnerability has been resolved: inet: frags: flush pending skbs in fqdir_pre_exit() We have been seeing occasional deadlocks on pernet_ops_rwsem since September in NIPA.
In the Linux kernel, the following vulnerability has been resolved: hfsplus: Verify inode mode when loading from disk syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 16bits "mode" field loaded from disk are corrupted.
Deserialization of Untrusted Data vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Object Injection.This issue affects DX NetOps Spectrum: 24.3.13 and earlier. [CVSS 8.8 HIGH]
Dependency on Vulnerable Third-Party Component vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows DOM-Based XSS.This issue affects DX NetOps Spectrum: 24.3.9 and earlier. [CVSS 6.1 MEDIUM]
Authorization Bypass Through User-Controlled Key vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Privilege Escalation.This issue affects DX NetOps Spectrum: 24.3.10 and earlier. [CVSS 8.8 HIGH]
Improper Authentication vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Authentication Bypass.This issue affects DX NetOps Spectrum: 24.3.10 and earlier. [CVSS 7.5 HIGH]
Cleartext Transmission of Sensitive Information vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Sniffing Attacks.This issue affects DX NetOps Spectrum: 21.2.1 and earlier. [CVSS 7.5 HIGH]
Insufficiently Protected Credentials vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Sniffing Attacks.This issue affects DX NetOps Spectrum: 24.3.13 and earlier. [CVSS 7.5 HIGH]
Broadcom DX NetOps Spectrum (24.3.8 and earlier) exposes session tokens in URL query strings, enabling session hijacking through browser history, referer headers, or proxy logs.
Broadcom DX NetOps Spectrum (23.3.6 and earlier) has unauthenticated OS command injection on both Windows and Linux platforms. As a network management system, compromise gives attackers visibility and control over the entire monitored infrastructure.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Reflected XSS.This issue affects DX NetOps Spectrum: 24.3.8 and earlier. [CVSS 6.1 MEDIUM]
Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Path Traversal.This issue affects DX NetOps Spectrum: 24.3.8 and earlier. [CVSS 6.5 MEDIUM]
INIM Electronics Smartliving SmartLAN/G/SI <=6.x contains hard-coded credentials in its Linux distribution image that cannot be changed through normal device operations. [CVSS 7.5 HIGH]
Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. Prior to versions 3.31.0, 3.27.2, and 3.20.5, a vulnerability exists in the HTTP layer of Quarkus REST related to response handling. When a response is being written, the framework waits for previously written response chunks to be fully transmitted before proceeding. If the client connection is dropped during this waiting period, the associated worker thread is never released and becomes permanently b...
Stored cross-site scripting (XSS, CWE-79) in the survey content and administration functionality in Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 on all supported platforms ( on Windows and Linux servers ) allows authenticated remote users with survey creation or edit privileges to execute arbitrary JavaScript in other users’ browsers, steal session information and perform unauthorized actions on their behalf via crafted survey content that is rendered without proper output encoding. [CVSS 5.4 MEDIUM]
Memory corruption when accessing resources in kernel driver. [CVSS 7.8 HIGH]
Memory corruption while processing shared command buffer packet between camera userspace and kernel. [CVSS 6.7 MEDIUM]
Nokia SR Linux is vulnerable to an authentication vulnerability allowing unauthorized access to the JSON-RPC service. When exploited, an invalid validation allows JSON RPC access without providing valid authentication credentials. [CVSS 6.4 MEDIUM]
An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. An invalid kernel address dereference in the issimian device driver leads to a denial of service. [CVSS 6.2 MEDIUM]
In the Linux kernel, the following vulnerability has been resolved: irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() If irq_domain_translate_twocell() sets "hwirq" to >= MCHP_EIC_NIRQ (2) then it results in an out of bounds access.
In the Linux kernel, the following vulnerability has been resolved: mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() In mt7615_mcu_wtbl_sta_add(), an skb sskb is allocated.
Security-flag inheritance bypass in the Linux kernel NFS client allows a low-privileged local user to obtain access on automounted NFS submounts that ignores the restrictive superblock options (ro, noexec, nodev, sync) set on the parent mount. Because automounted filesystems fail to preserve these user-set mount flags, protections such as read-only or no-execute enforcement can be silently dropped on the child mount, undermining the security posture an administrator intended. No public exploit identified at time of analysis, and the EPSS score is negligible (0.05%, 16th percentile), consistent with a local, configuration-dependent defense-in-depth weakness rather than a mass-exploited flaw.
In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Correctly handle return of sg_nents_for_len The return value of sg_nents_for_len was assigned to an unsigned long in starfive_hash_digest, causing negative error codes to be converted to large positive integers.
In the Linux kernel, the following vulnerability has been resolved: net: netpoll: initialize work queue before error checks Prevent a kernel warning when netconsole setup fails on devices with IFF_DISABLE_NETPOLL flag.
Memory corruption in the Linux kernel's HFS filesystem driver stems from a use-after-free in hfs_correct_next_unused_CNID(), where hfs_bnode_put() drops a b-tree node's refcount and the freed node is then dereferenced on the following line. The flaw affects systems that mount or process HFS (legacy Apple) volumes and can lead to a kernel crash or potential memory corruption. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%), and it is not in CISA KEV; the tags characterize the practical impact as denial of service.
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show In iommu_mmio_write(), it validates the user-provided offset with the check: `iommu->dbg_mmio_offset > iommu->mmio_phys_end - 4`. This assumes a 4-byte access.
In the Linux kernel, the following vulnerability has been resolved: wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() In rtl8180_init_rx_ring(), memory is allocated for skb packets and DMA allocations in a loop.
In the Linux kernel, the following vulnerability has been resolved: backlight: led-bl: Add devlink to supplier LEDs LED Backlight is a consumer of one or multiple LED class devices, but devlink is currently unable to create correct supplier-producer links when the supplier is a class device.
In the Linux kernel, the following vulnerability has been resolved: drm/vgem-fence: Fix potential deadlock on release A timer that expires a vgem fence automatically in 10 seconds is now released with timer_delete_sync() from fence->ops.release() called on last dma_fence_put().
In the Linux kernel, the following vulnerability has been resolved: block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock blk_mq_{add,del}_queue_tag_set() functions add and remove queues from tagset, the functions make sure that tagset and queues are marked as shared when two or more queues are attached to the same tagset.
In the Linux kernel, the following vulnerability has been resolved: staging: most: remove broken i2c driver The MOST I2C driver has been completely broken for five years without anyone noticing so remove the driver from staging.
In the Linux kernel, the following vulnerability has been resolved: rtc: amlogic-a4: fix double free caused by devm The clock obtained via devm_clk_get_enabled() is automatically managed by devres and will be disabled and freed on driver detach.
Out-of-bounds write in the Linux kernel's ALSA firewire-motu driver (snd-firewire-motu) allows a local process reading DSP events to trigger a kernel put_user() copy past the end of its supplied buffer when that buffer's size is not a multiple of 4 bytes. The flaw affects systems with a MOTU FireWire audio interface driver loaded and requires local low-privileged access; it is fixed in stable kernel releases and shipped in Ubuntu USN-8094-1. EPSS is very low (0.05%, 16th percentile), there is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
In the Linux kernel, the following vulnerability has been resolved: iavf: Implement settime64 with -EOPNOTSUPP ptp_clock_settime() assumes every ptp_clock has implemented settime64(). Stub it with -EOPNOTSUPP to prevent a NULL dereference.
In the Linux kernel, the following vulnerability has been resolved: s390/fpu: Fix false-positive kmsan report in fpu_vstl() A false-positive kmsan report is detected when running ping command.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: arm64: set __exception_irq_entry with __irq_entry as a default filter_irq_stacks() is supposed to cut entries which are related irq. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init blk-iocost sometimes causes the following crash:. No vendor patch available.
Availability impact in the Linux kernel's Intel VPU accelerator driver (accel/ivpu) stems from a race condition between Buffer Object (BO) freeing and context teardown. A local, low-privileged user on a system with Intel VPU/NPU hardware can trigger the ivpu_gem_bo_free() path to remove a BO from the list before it is fully unmapped, causing file_priv_unbind() to encounter an unclean memory manager state and trigger a drm_mm_takedown() warning, ultimately resulting in a kernel availability impact. No public exploit exists and EPSS sits at the 1st percentile, indicating negligible real-world exploitation interest at this time.
Local privilege escalation and memory corruption in the Linux kernel's drm/panthor GPU driver arises from a use-after-free race between device unplug (panthor_fw_unplug()) freeing firmware memory sections and the asynchronous process_fw_events_work() handler, which can still access those freed FW memory regions. An attacker with local access to a system using an ARM Mali CSF-based GPU can potentially corrupt kernel memory or leak information by racing device teardown against pending firmware event processing. CVSS is 7.8 (High) with full confidentiality/integrity/availability impact; no public exploit has been identified and it is not in CISA KEV.
Local privilege escalation and memory corruption in the Linux kernel's Panthor DRM driver (ARM Mali GPU) arises from a use-after-free on kernel buffer-object virtual-address nodes; when the GPU MMU is down, panthor_vm_unmap_range() returns early and leaves a va_node stuck in the drm_mm tree, so removing adjacent nodes later dereferences freed memory. A local user with GPU/render access can trigger the condition to corrupt kernel memory (CVSS 7.8, high confidentiality/integrity/availability impact). No public exploit identified at time of analysis; an upstream fix has been merged to stable trees.
Use-after-free in the Linux kernel's Tegra210 QSPI (tegra210-quad) SPI controller driver arises when a transfer times out before the threaded IRQ handler runs, leaving the curr_xfer field pointing at freed memory that the IRQ thread may later dereference. Local low-privileged users on NVIDIA Tegra-based systems could trigger memory corruption affecting confidentiality, integrity, and availability, though exploitation depends on winning a narrow timing race. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix is delivered as upstream stable-tree commits.
Kernel instability in the Linux qla2xxx SCSI driver (QLogic Fibre Channel target/host adapter) allows a chip-reset event to leave in-flight commands stuck and never freed, and can trigger a BUG_ON kernel panic (BUG_ON(cmd->sg_mapped) or BUG_ON(!valid_dma_direction(dir))) when two CPUs race to unmap the same scatter-gather list. This fix reverts commit 26f9ce53817a and partially reverts aefed3e5548f at __qla2x00_abort_all_cmds to restore correct command cleanup after a firmware/chip reset. No public exploit identified at time of analysis; the NVD-assigned CVSS of 9.8 (AV:N) is inconsistent with the local, hardware-dependent nature of the bug.
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix invalid prog->stats access when update_effective_progs fails Syzkaller triggers an invalid memory access issue following fault injection in update_effective_progs. The issue can be described as follows: __cgroup_bpf_detach update_effective_progs compute_effective_progs bpf_prog_array_alloc <-- fault inject purge_effective_progs /* change to dummy_bpf_prog */ array->items[index] = &dummy_bpf_prog.prog ---softirq start--- __do_softirq ... __cgroup_bpf_run_filter_skb __bpf_prog_run_save_cb bpf_prog_run stats = this_cpu_ptr(prog->stats) /* invalid memory access */ flags = u64_stats_update_begin_irqsave(&stats->syncp) ---softirq end--- static_branch_dec(&cgroup_bpf_enabled_key[atype]) The reason is that fault injection caused update_effective_progs to fail and then changed the original prog into dummy_bpf_prog.prog in purge_effective_progs. Then a softirq came, and accessing the members of dummy_bpf_prog.prog in the softirq triggers invalid mem access. To fix it, skip updating stats when stats is NULL.
Memory corruption in the Linux kernel's qla2xxx QLogic Fibre Channel HBA driver arises from an error-handling path in qla2xxx_process_purls_iocb() that calls kfree() on a purex item which may have originated from a per-adapter pre-allocated pool rather than kzalloc(). Freeing a pool-backed object with kfree() can corrupt kernel heap state. The fix routes deallocation through qla24xx_free_purex_item(), which correctly distinguishes dynamically allocated from pooled items; no public exploit identified at time of analysis, and the issue is not in CISA KEV.
Access-control inconsistency in the Linux kernel's Landlock LSM allows a sandboxed local task to widen its effective filesystem access rights by operating on "disconnected" directories - files opened through a bind mount and then renamed or moved out of scope of the mount point. Because the mount point could not be located during the hierarchy walk, Landlock collected access rights straight down to the filesystem root, ignoring the more restrictive mount-point hierarchy and permitting renames (notably under LANDLOCK_ACCESS_FS_REFER) that should have been denied. Only Linux systems actively enforcing Landlock sandboxing are affected; there is no public exploit identified at time of analysis and EPSS is negligible (0.02%, 6th percentile).
Local privilege escalation via a use-after-free in the Linux kernel's drm/panthor driver (the DRM driver for newer Arm Mali CSF-based GPUs) allows a local user with GPU render-node access to free and reuse a group object during creation. The GROUP_CREATE ioctl stored a group pointer in an Xarray and then continued to dereference it, letting a second thread call GROUP_DESTROY on a guessed handle to trigger the UAF. No public exploit or CISA KEV listing has been identified; the fix adds an Xarray entry mark so a group cannot be destroyed until GROUP_CREATE has fully returned.
Kernel panic in the Linux octeontx2-af driver exposes Marvell CN103XX OcteonTX2 systems to a denial-of-service crash when firmware reports a physical link change event with an invalid lmac_type_id value. The driver's cgx_link_change_handler() uses the unvalidated firmware-supplied ID to index into an array and calls strncpy with the resulting out-of-bounds pointer, producing a fatal kernel Oops in a workqueue context. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the crash is deterministic once the invalid firmware value is processed, making Availability impact high on affected hardware.
Use-after-free in the Linux kernel NTFS3 filesystem driver allows a local attacker with low privileges to corrupt kernel heap memory via a crafted NTFS volume with malformed extended attributes. The `ntfs_read_ea` function fails to propagate error codes on encountering inconsistent EA structures, causing `ntfs_set_ea` to perform a 4-byte write to already-freed memory - confirmed by an in-description KASAN trace captured at 6.2.0-rc1+. No active exploitation is confirmed (not in CISA KEV), and an EPSS of 0.16% (6th percentile) signals very low observed exploitation activity, though a researcher-developed proof-of-concept is implied by the kernel trace.
Local privilege-tier memory corruption in the Linux kernel's Intel VPU/NPU accelerator driver (accel/ivpu) arises from a dangling buffer object left on a per-device list after a failed allocation, later dereferenced in ivpu_bo_unbind_all_bos_from_context() to cause a page fault. A local user with access to the ivpu device can trigger this use-after-free via the DRM/accel interface, with CVSS 7.8 (High) and CISA-style impact of confidentiality, integrity, and availability all High. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; the primary observed effect is a kernel page fault (crash), though the dangling-pointer condition carries corruption potential.
Kernel-side memory corruption in the Linux kernel's crypto AEAD framework arises because AEAD algorithms began populating the generic cra_reqsize field (added by commit afddce13ce81d) without the framework being updated to translate it into a proper per-request size via crypto_aead_set_reqsize(). As a result, request buffers for affected AEAD transforms are undersized, producing out-of-bounds memory writes and kernel crashes when the algorithm is used. This is tracked as a Denial-of-Service class issue; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Limit num_syncs to prevent oversized allocations The exec and vm_bind ioctl allow userspace to specify an arbitrary num_syncs value.
Local privilege-holder-triggered use-after-free in the Linux kernel's mlxsw Spectrum switch driver (drivers/net/ethernet/mellanox/mlxsw) lets a network-admin operation on Nvidia/Mellanox Spectrum ASIC hardware dereference a freed neighbour object during RIF teardown. The driver cached a neighbour pointer without holding a reference, so freeing the neighbour (e.g. while removing a device from a VRF) leaves a dangling pointer that mlxsw_sp_neigh_entry_update() reads, corrupting kernel memory. CVSS is 7.8 (local, low privilege in the automated NVD scoring) but EPSS is only 0.05% (16th percentile) and there is no public exploit or CISA KEV listing - the flaw was found via an internal stress test, not observed attacks.
Local privilege escalation potential arising from a use-after-free in the Linux kernel's mlxsw Spectrum driver (spectrum_mr) allows an attacker with network-administration rights on a Mellanox Spectrum switch to trigger memory corruption during multicast route replacement. A prior fix introduced a dedicated mutex to protect the multicast route list, but one list-entry deletion path during route replace was missed, so the periodic mlxsw_sp_mr_stats_update worker can read a freed route object. EPSS is low (0.05%) and there is no public exploit identified at time of analysis; a vendor patch is available across multiple stable branches.
Denial of service and potential kernel memory disclosure in the Linux kernel's CAIF protocol stack arises because cffrml_receive() subtracts 2 from a packet-derived length field without checking that the value is at least 2 when FCS checking is disabled. An adjacent attacker sending a CAIF frame whose length field is 0 or 1 triggers an integer underflow, leading to memory exhaustion, kernel instability, and possible leakage of uninitialized kernel memory contained in packet padding. There is no public exploit identified at time of analysis, EPSS risk is very low (0.05%), and the flaw is not in CISA KEV.
In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd: Check event before enable to avoid GPF On AMD machines cpuc->events[idx] can become NULL in a subtle race condition with NMI->throttle->x86_pmu_stop().
In the Linux kernel, the following vulnerability has been resolved: char: applicom: fix NULL pointer dereference in ac_ioctl Discovered by Atuin - Automated Vulnerability Discovery Engine. In ac_ioctl, the validation of IndexCard and the check for a valid RamIO pointer are skipped when cmd is 6.
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid updating zero-sized extent in extent cache As syzbot reported: F2FS-fs (loop0): __update_extent_tree_range: extent len is zero, type: 0, extent [0, 0, 0], age [0, 0] ------------[ cut here ]------------ kernel BUG at fs/f2fs/extent_cache.c:678!
Local privilege-level buffer overflow in the Linux kernel's ethtool subsystem allows an attacker who can trigger a device stat-count change between the ETHTOOL_GSSET_INFO, ETHTOOL_GSTRINGS, and ETHTOOL_GSTATS ioctls to overflow a userspace stats buffer, corrupting memory and potentially escalating privileges. The flaw stems from a TOCTOU race where drivers using dynamic counters (mlx5, bnx2x, bna, ksz884x) can report a different stat count than the buffer sized by userspace. It is not in CISA KEV, EPSS exploitation probability is very low (0.06%), and no public exploit has been identified, though a vendor patch is available.
Out-of-bounds read range miscalculation in the Linux kernel iomap subsystem allows a local attacker who can mount a crafted filesystem image (demonstrated against erofs via syzbot) to trigger a length underflow that returns a read position beyond the folio, leading to information disclosure or memory corruption during buffered reads. The flaw lives in iomap_adjust_read_range(), which incorrectly assumed block-aligned positions and lengths. No public exploit identified at time of analysis; EPSS exploitation probability is very low (0.03%), and it is not listed in CISA KEV.
Local privilege escalation or kernel memory disclosure in the Linux kernel's amdgpu DRM driver stems from a use-after-free during GPU recovery, where a race between the scheduler timeout callback (drm_sched_job_timedout) and the TDR work queue can free a job structure before amdgpu_device_gpu_recover reads its pasid field. Affected systems are those running vulnerable kernels with AMD GPUs using the amdgpu driver; a local attacker able to submit GPU work and induce a GPU hang could trigger the freed-memory access, as demonstrated by the supplied KASAN slab-use-after-free trace. There is no public exploit identified at time of analysis, and the EPSS score is negligible (0.03%, 7th percentile), consistent with a difficult-to-win kernel race rather than a broadly exploited flaw.
Memory corruption in the Linux kernel's TPM 2.0 session-handling code (tpm2-sessions) arises because the 'name_size' value derived from a TPM_ALG_ID is used to index without range validation, so an unrecognized or malicious algorithm identifier can drive an out-of-bounds access. The affected TPM HMAC/authorization session path is reachable from local, low-privileged kernel-driver interactions; at worst this leads to kernel memory corruption affecting confidentiality, integrity, and availability. No public exploit is identified at time of analysis and the EPSS probability is negligible (0.03%), consistent with a locally-scoped kernel hardening fix rather than a mass-exploited flaw.
In the Linux kernel, the following vulnerability has been resolved: fuse: missing copy_finish in fuse-over-io-uring argument copies Fix a possible reference count leak of payload pages during fuse argument copies. [Joanne: simplified error cleanup]
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix double unregister of HCA_PORTS component Clear hca_devcom_comp in device's private data after unregistering it in LAG teardown.
In the Linux kernel, the following vulnerability has been resolved: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users with no read access to a file to subscribe to events (e.g.
In the Linux kernel, the following vulnerability has been resolved: netrom: Fix memory leak in nr_sendmsg() syzbot reported a memory leak [1]. When function sock_alloc_send_skb() return NULL in nr_output(), the original skb is not freed, which was allocated in nr_sendmsg().
In the Linux kernel, the following vulnerability has been resolved: ksmbd: skip lock-range check on equal size to avoid size==0 underflow When size equals the current i_size (including 0), the code used to call check_lock_range(filp, i_size, size - 1, WRITE), which computes `size - 1` and can underflow for size==0.
Out-of-bounds memory access in the Linux kernel's Open vSwitch (openvswitch) module allows a local user holding CAP_NET_ADMIN to leak kernel memory or crash the host by submitting a malformed OVS_ACTION_ATTR_PUSH_NSH netlink action with an incorrectly sized middle attribute. The push_nsh() action path validates the outer and inner NSH attributes but never checks the intermediate OVS_KEY_ATTR_NSH wrapper, so nsh_hdr_from_nlattr() performs a 184-byte read past a slab allocation (KASAN slab-out-of-bounds). A patch is available from the kernel stable tree and via Ubuntu USN-8096-1; there is no public exploit identified at time of analysis, and EPSS is very low (0.07%).
In the Linux kernel, the following vulnerability has been resolved: xfs: fix a UAF problem in xattr repair The xchk_setup_xattr_buf function can allocate a new value buffer, which means that any reference to ab->value before the call could become a dangling pointer.
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-mixer: us16x08: validate meter packet indices get_meter_levels_from_urb() parses the 64-byte meter packets sent by the device and fills the per-channel arrays meter_level[], comp_level[] and master_level[] in struct snd_us16x08_meter_store.
Remote denial of service in the Linux kernel SCSI target (LIO) subsystem allows an initiator to crash a storage server by triggering a NULL-pointer dereference on the command error path. When allocation of the per-command CDB buffer (cmd->t_task_cdb) fails, the pointer is left NULL yet subsequently dereferenced in the 'err' cleanup path, panicking the kernel. No public exploit identified at time of analysis and EPSS is very low (0.05%), consistent with a hard-to-trigger memory-pressure condition rather than a reliably weaponizable flaw.
In the Linux kernel, the following vulnerability has been resolved: usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal The delayed work item otg_event is initialized in fsl_otg_conf() and scheduled under two conditions: 1.
In the Linux kernel, the following vulnerability has been resolved: sched/deadline: only set free_cpus for online runqueues Commit 16b269436b72 ("sched/deadline: Modify cpudl::free_cpus to reflect rd->online") introduced the cpudl_set/clear_freecpu functions to allow the cpu_dl::free_cpus mask to be manipulated by the deadline scheduler class rq_on/offline callbacks so the mask would also reflect this state.
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid unregistering PSP twice PSP is unregistered twice in: _mlx5e_remove -> mlx5e_psp_unregister mlx5e_nic_cleanup -> mlx5e_psp_unregister This leads to a refcount underflow in some conditions: ------------[ cut here ]------------ refcount_t: underflow; use-after-free.
In the Linux kernel, the following vulnerability has been resolved: btrfs: don't log conflicting inode if it's a dir moved in the current transaction We can't log a conflicting inode if it's a directory and it was moved from one parent directory to another parent directory in the current transaction, as this can result an attempt to have a directory with two hard links during log replay, one for the old parent directory and another for the new parent directory.
In the Linux kernel, the following vulnerability has been resolved: Input: ti_am335x_tsc - fix off-by-one error in wire_order validation The current validation 'wire_order[i] > ARRAY_SIZE(config_pins)' allows wire_order[i] to equal ARRAY_SIZE(config_pins), which causes out-of-bounds access when used as index in 'config_pins[wire_order[i]]'.
In the Linux kernel, the following vulnerability has been resolved: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() prp_get_untagged_frame() calls __pskb_copy() to create frame->skb_std but doesn't check if the allocation failed.
Refcount underflow in the Linux kernel's net/handshake subsystem lets duplicate cancellation of the same TLS handshake request drop an extra reference on the underlying socket, corrupting its reference count and leaking/freeing the socket structure. The flaw affects kernels using the in-kernel TLS handshake upcall path (notably SUNRPC-over-TLS via tlshd), where a handshake timeout can trigger two cancellation requests - one from xs_reset_transport() and one from xs_tls_handshake_sync() - for a request still present in handshake_rhashtbl. Despite an assigned 9.8 CVSS, the practical impact is a kernel memory-safety fault (crash / potential use-after-free) rather than trivial remote code execution, and there is no public exploit identified at time of analysis; EPSS is very low (0.03%).
Denial of service in the Linux kernel's HFS+ (hfsplus) filesystem driver allows a local user with access to a mounted HFS+ volume to crash the kernel via a reference-counting race in __hfs_bnode_create(). When sync() and link() operations run concurrently, two threads can both attempt to create the same B-tree node; the thread that loses the race reuses the already-hashed node without incrementing its refcount, so a later put trips BUG_ON(!atomic_read(&node->refcnt)) and panics the system. No public exploit has been identified at time of analysis, EPSS risk is very low (0.05%), and the issue is not in CISA KEV.
In the Linux kernel, the following vulnerability has been resolved: spi: fsl-cpm: Check length parity before switching to 16 bit mode Commit fc96ec826bce ("spi: fsl-cpm: Use 16 bit mode for large transfers with even size") failed to make sure that the size is really even before switching to 16 bit mode.
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid updating compression context during writeback Bai, Shuangpeng <sjb7183@psu.edu> reported a bug as below: Oops: divide error: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 11441 Comm: syz.0.46 Not tainted 6.17.0 #1 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:f2fs_all_cluster_page_ready+0x106/0x550 fs/f2fs/compress.c:857 Call Trace: <TASK> f2fs_write_cache_pages fs/f2fs/data.c:3078 [inline] __f2fs_write_data_pages fs/f2fs/data.c:3290 [inline] f2fs_write_data_pages+0x1c19/0x3600 fs/f2fs/data.c:3317 do_writepages+0x38e/0x640 mm/page-writeback.c:2634 filemap_fdatawrite_wbc mm/filemap.c:386 [inline] __filemap_fdatawrite_range mm/filemap.c:419 [inline] file_write_and_wait_range+0x2ba/0x3e0 mm/filemap.c:794 f2fs_do_sync_file+0x6e6/0x1b00 fs/f2fs/file.c:294 generic_write_sync include/linux/fs.h:3043 [inline] f2fs_file_write_iter+0x76e/0x2700 fs/f2fs/file.c:5259 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x7e9/0xe00 fs/read_write.c:686 ksys_write+0x19d/0x2d0 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf7/0x470 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The bug was triggered w/ below race condition: fsync setattr ioctl - f2fs_do_sync_file - file_write_and_wait_range - f2fs_write_cache_pages : inode is non-compressed : cc.cluster_size = F2FS_I(inode)->i_cluster_size = 0 - tag_pages_for_writeback - f2fs_setattr - truncate_setsize - f2fs_truncate - f2fs_fileattr_set - f2fs_setflags_common - set_compress_context : F2FS_I(inode)->i_cluster_size = 4 : set_inode_flag(inode, FI_COMPRESSED_FILE) - f2fs_compressed_file : return true - f2fs_all_cluster_page_ready : "pgidx % cc->cluster_size" trigger dividing 0 issue Let's change as below to fix this issue: - introduce a new atomic type variable .writeback in structure f2fs_inode_info to track the number of threads which calling f2fs_write_cache_pages().
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix kernel BUG in ocfs2_find_victim_chain syzbot reported a kernel BUG in ocfs2_find_victim_chain() because the `cl_next_free_rec` field of the allocation chain list (next free slot in the chain list) is 0, triggring the BUG_ON(!cl->cl_next_free_rec) condition in ocfs2_find_victim_chain() and panicking the kernel.
Denial of service in the Linux kernel's bnxt_en driver (Broadcom NetXtreme-E) affects systems running an XDP program that uses the XDP_TX action. Incorrect clearing of NAPI event flags in the XDP_TX path causes the TX doorbell to be skipped when the TX ring is full, stalling the associated RX ring so it is never refilled and all subsequent packets are silently dropped. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.02%, 6th percentile); an upstream fix is available in mainline and stable kernels.
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix return value of f2fs_recover_fsync_data() With below scripts, it will trigger panic in f2fs: mkfs.f2fs -f /dev/vdd mount /dev/vdd /mnt/f2fs touch /mnt/f2fs/foo sync echo 111 >> /mnt/f2fs/foo f2fs_io fsync /mnt/f2fs/foo f2fs_io shutdown 2 /mnt/f2fs umount /mnt/f2fs mount -o ro,norecovery /dev/vdd /mnt/f2fs or mount -o ro,disable_roll_forward /dev/vdd /mnt/f2fs F2FS-fs (vdd): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 F2FS-fs (vdd): Mounted with checkpoint version = 7f5c361f F2FS-fs (vdd): Stopped filesystem due to reason: 0 F2FS-fs (vdd): f2fs_recover_fsync_data: recovery fsync data, check_only: 1 Filesystem f2fs get_tree() didn't set fc->root, returned 1 ------------[ cut here ]------------ kernel BUG at fs/super.c:1761!
In the Linux kernel, the following vulnerability has been resolved: inet: frags: flush pending skbs in fqdir_pre_exit() We have been seeing occasional deadlocks on pernet_ops_rwsem since September in NIPA.
In the Linux kernel, the following vulnerability has been resolved: hfsplus: Verify inode mode when loading from disk syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 16bits "mode" field loaded from disk are corrupted.
Deserialization of Untrusted Data vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Object Injection.This issue affects DX NetOps Spectrum: 24.3.13 and earlier. [CVSS 8.8 HIGH]
Dependency on Vulnerable Third-Party Component vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows DOM-Based XSS.This issue affects DX NetOps Spectrum: 24.3.9 and earlier. [CVSS 6.1 MEDIUM]
Authorization Bypass Through User-Controlled Key vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Privilege Escalation.This issue affects DX NetOps Spectrum: 24.3.10 and earlier. [CVSS 8.8 HIGH]
Improper Authentication vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Authentication Bypass.This issue affects DX NetOps Spectrum: 24.3.10 and earlier. [CVSS 7.5 HIGH]
Cleartext Transmission of Sensitive Information vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Sniffing Attacks.This issue affects DX NetOps Spectrum: 21.2.1 and earlier. [CVSS 7.5 HIGH]
Insufficiently Protected Credentials vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Sniffing Attacks.This issue affects DX NetOps Spectrum: 24.3.13 and earlier. [CVSS 7.5 HIGH]
Broadcom DX NetOps Spectrum (24.3.8 and earlier) exposes session tokens in URL query strings, enabling session hijacking through browser history, referer headers, or proxy logs.
Broadcom DX NetOps Spectrum (23.3.6 and earlier) has unauthenticated OS command injection on both Windows and Linux platforms. As a network management system, compromise gives attackers visibility and control over the entire monitored infrastructure.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Reflected XSS.This issue affects DX NetOps Spectrum: 24.3.8 and earlier. [CVSS 6.1 MEDIUM]
Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Path Traversal.This issue affects DX NetOps Spectrum: 24.3.8 and earlier. [CVSS 6.5 MEDIUM]
INIM Electronics Smartliving SmartLAN/G/SI <=6.x contains hard-coded credentials in its Linux distribution image that cannot be changed through normal device operations. [CVSS 7.5 HIGH]
Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. Prior to versions 3.31.0, 3.27.2, and 3.20.5, a vulnerability exists in the HTTP layer of Quarkus REST related to response handling. When a response is being written, the framework waits for previously written response chunks to be fully transmitted before proceeding. If the client connection is dropped during this waiting period, the associated worker thread is never released and becomes permanently b...
Stored cross-site scripting (XSS, CWE-79) in the survey content and administration functionality in Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 on all supported platforms ( on Windows and Linux servers ) allows authenticated remote users with survey creation or edit privileges to execute arbitrary JavaScript in other users’ browsers, steal session information and perform unauthorized actions on their behalf via crafted survey content that is rendered without proper output encoding. [CVSS 5.4 MEDIUM]
Memory corruption when accessing resources in kernel driver. [CVSS 7.8 HIGH]
Memory corruption while processing shared command buffer packet between camera userspace and kernel. [CVSS 6.7 MEDIUM]
Nokia SR Linux is vulnerable to an authentication vulnerability allowing unauthorized access to the JSON-RPC service. When exploited, an invalid validation allows JSON RPC access without providing valid authentication credentials. [CVSS 6.4 MEDIUM]
An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. An invalid kernel address dereference in the issimian device driver leads to a denial of service. [CVSS 6.2 MEDIUM]
In the Linux kernel, the following vulnerability has been resolved: irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() If irq_domain_translate_twocell() sets "hwirq" to >= MCHP_EIC_NIRQ (2) then it results in an out of bounds access.
In the Linux kernel, the following vulnerability has been resolved: mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() In mt7615_mcu_wtbl_sta_add(), an skb sskb is allocated.
Security-flag inheritance bypass in the Linux kernel NFS client allows a low-privileged local user to obtain access on automounted NFS submounts that ignores the restrictive superblock options (ro, noexec, nodev, sync) set on the parent mount. Because automounted filesystems fail to preserve these user-set mount flags, protections such as read-only or no-execute enforcement can be silently dropped on the child mount, undermining the security posture an administrator intended. No public exploit identified at time of analysis, and the EPSS score is negligible (0.05%, 16th percentile), consistent with a local, configuration-dependent defense-in-depth weakness rather than a mass-exploited flaw.
In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Correctly handle return of sg_nents_for_len The return value of sg_nents_for_len was assigned to an unsigned long in starfive_hash_digest, causing negative error codes to be converted to large positive integers.
In the Linux kernel, the following vulnerability has been resolved: net: netpoll: initialize work queue before error checks Prevent a kernel warning when netconsole setup fails on devices with IFF_DISABLE_NETPOLL flag.
Memory corruption in the Linux kernel's HFS filesystem driver stems from a use-after-free in hfs_correct_next_unused_CNID(), where hfs_bnode_put() drops a b-tree node's refcount and the freed node is then dereferenced on the following line. The flaw affects systems that mount or process HFS (legacy Apple) volumes and can lead to a kernel crash or potential memory corruption. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%), and it is not in CISA KEV; the tags characterize the practical impact as denial of service.
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show In iommu_mmio_write(), it validates the user-provided offset with the check: `iommu->dbg_mmio_offset > iommu->mmio_phys_end - 4`. This assumes a 4-byte access.
In the Linux kernel, the following vulnerability has been resolved: wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() In rtl8180_init_rx_ring(), memory is allocated for skb packets and DMA allocations in a loop.
In the Linux kernel, the following vulnerability has been resolved: backlight: led-bl: Add devlink to supplier LEDs LED Backlight is a consumer of one or multiple LED class devices, but devlink is currently unable to create correct supplier-producer links when the supplier is a class device.
In the Linux kernel, the following vulnerability has been resolved: drm/vgem-fence: Fix potential deadlock on release A timer that expires a vgem fence automatically in 10 seconds is now released with timer_delete_sync() from fence->ops.release() called on last dma_fence_put().
In the Linux kernel, the following vulnerability has been resolved: block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock blk_mq_{add,del}_queue_tag_set() functions add and remove queues from tagset, the functions make sure that tagset and queues are marked as shared when two or more queues are attached to the same tagset.
In the Linux kernel, the following vulnerability has been resolved: staging: most: remove broken i2c driver The MOST I2C driver has been completely broken for five years without anyone noticing so remove the driver from staging.
In the Linux kernel, the following vulnerability has been resolved: rtc: amlogic-a4: fix double free caused by devm The clock obtained via devm_clk_get_enabled() is automatically managed by devres and will be disabled and freed on driver detach.
Out-of-bounds write in the Linux kernel's ALSA firewire-motu driver (snd-firewire-motu) allows a local process reading DSP events to trigger a kernel put_user() copy past the end of its supplied buffer when that buffer's size is not a multiple of 4 bytes. The flaw affects systems with a MOTU FireWire audio interface driver loaded and requires local low-privileged access; it is fixed in stable kernel releases and shipped in Ubuntu USN-8094-1. EPSS is very low (0.05%, 16th percentile), there is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
In the Linux kernel, the following vulnerability has been resolved: iavf: Implement settime64 with -EOPNOTSUPP ptp_clock_settime() assumes every ptp_clock has implemented settime64(). Stub it with -EOPNOTSUPP to prevent a NULL dereference.
In the Linux kernel, the following vulnerability has been resolved: s390/fpu: Fix false-positive kmsan report in fpu_vstl() A false-positive kmsan report is detected when running ping command.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: arm64: set __exception_irq_entry with __irq_entry as a default filter_irq_stacks() is supposed to cut entries which are related irq. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init blk-iocost sometimes causes the following crash:. No vendor patch available.
Availability impact in the Linux kernel's Intel VPU accelerator driver (accel/ivpu) stems from a race condition between Buffer Object (BO) freeing and context teardown. A local, low-privileged user on a system with Intel VPU/NPU hardware can trigger the ivpu_gem_bo_free() path to remove a BO from the list before it is fully unmapped, causing file_priv_unbind() to encounter an unclean memory manager state and trigger a drm_mm_takedown() warning, ultimately resulting in a kernel availability impact. No public exploit exists and EPSS sits at the 1st percentile, indicating negligible real-world exploitation interest at this time.
Local privilege escalation and memory corruption in the Linux kernel's drm/panthor GPU driver arises from a use-after-free race between device unplug (panthor_fw_unplug()) freeing firmware memory sections and the asynchronous process_fw_events_work() handler, which can still access those freed FW memory regions. An attacker with local access to a system using an ARM Mali CSF-based GPU can potentially corrupt kernel memory or leak information by racing device teardown against pending firmware event processing. CVSS is 7.8 (High) with full confidentiality/integrity/availability impact; no public exploit has been identified and it is not in CISA KEV.
Local privilege escalation and memory corruption in the Linux kernel's Panthor DRM driver (ARM Mali GPU) arises from a use-after-free on kernel buffer-object virtual-address nodes; when the GPU MMU is down, panthor_vm_unmap_range() returns early and leaves a va_node stuck in the drm_mm tree, so removing adjacent nodes later dereferences freed memory. A local user with GPU/render access can trigger the condition to corrupt kernel memory (CVSS 7.8, high confidentiality/integrity/availability impact). No public exploit identified at time of analysis; an upstream fix has been merged to stable trees.
Use-after-free in the Linux kernel's Tegra210 QSPI (tegra210-quad) SPI controller driver arises when a transfer times out before the threaded IRQ handler runs, leaving the curr_xfer field pointing at freed memory that the IRQ thread may later dereference. Local low-privileged users on NVIDIA Tegra-based systems could trigger memory corruption affecting confidentiality, integrity, and availability, though exploitation depends on winning a narrow timing race. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix is delivered as upstream stable-tree commits.
Kernel instability in the Linux qla2xxx SCSI driver (QLogic Fibre Channel target/host adapter) allows a chip-reset event to leave in-flight commands stuck and never freed, and can trigger a BUG_ON kernel panic (BUG_ON(cmd->sg_mapped) or BUG_ON(!valid_dma_direction(dir))) when two CPUs race to unmap the same scatter-gather list. This fix reverts commit 26f9ce53817a and partially reverts aefed3e5548f at __qla2x00_abort_all_cmds to restore correct command cleanup after a firmware/chip reset. No public exploit identified at time of analysis; the NVD-assigned CVSS of 9.8 (AV:N) is inconsistent with the local, hardware-dependent nature of the bug.
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix invalid prog->stats access when update_effective_progs fails Syzkaller triggers an invalid memory access issue following fault injection in update_effective_progs. The issue can be described as follows: __cgroup_bpf_detach update_effective_progs compute_effective_progs bpf_prog_array_alloc <-- fault inject purge_effective_progs /* change to dummy_bpf_prog */ array->items[index] = &dummy_bpf_prog.prog ---softirq start--- __do_softirq ... __cgroup_bpf_run_filter_skb __bpf_prog_run_save_cb bpf_prog_run stats = this_cpu_ptr(prog->stats) /* invalid memory access */ flags = u64_stats_update_begin_irqsave(&stats->syncp) ---softirq end--- static_branch_dec(&cgroup_bpf_enabled_key[atype]) The reason is that fault injection caused update_effective_progs to fail and then changed the original prog into dummy_bpf_prog.prog in purge_effective_progs. Then a softirq came, and accessing the members of dummy_bpf_prog.prog in the softirq triggers invalid mem access. To fix it, skip updating stats when stats is NULL.
Memory corruption in the Linux kernel's qla2xxx QLogic Fibre Channel HBA driver arises from an error-handling path in qla2xxx_process_purls_iocb() that calls kfree() on a purex item which may have originated from a per-adapter pre-allocated pool rather than kzalloc(). Freeing a pool-backed object with kfree() can corrupt kernel heap state. The fix routes deallocation through qla24xx_free_purex_item(), which correctly distinguishes dynamically allocated from pooled items; no public exploit identified at time of analysis, and the issue is not in CISA KEV.
Access-control inconsistency in the Linux kernel's Landlock LSM allows a sandboxed local task to widen its effective filesystem access rights by operating on "disconnected" directories - files opened through a bind mount and then renamed or moved out of scope of the mount point. Because the mount point could not be located during the hierarchy walk, Landlock collected access rights straight down to the filesystem root, ignoring the more restrictive mount-point hierarchy and permitting renames (notably under LANDLOCK_ACCESS_FS_REFER) that should have been denied. Only Linux systems actively enforcing Landlock sandboxing are affected; there is no public exploit identified at time of analysis and EPSS is negligible (0.02%, 6th percentile).
Local privilege escalation via a use-after-free in the Linux kernel's drm/panthor driver (the DRM driver for newer Arm Mali CSF-based GPUs) allows a local user with GPU render-node access to free and reuse a group object during creation. The GROUP_CREATE ioctl stored a group pointer in an Xarray and then continued to dereference it, letting a second thread call GROUP_DESTROY on a guessed handle to trigger the UAF. No public exploit or CISA KEV listing has been identified; the fix adds an Xarray entry mark so a group cannot be destroyed until GROUP_CREATE has fully returned.
Kernel panic in the Linux octeontx2-af driver exposes Marvell CN103XX OcteonTX2 systems to a denial-of-service crash when firmware reports a physical link change event with an invalid lmac_type_id value. The driver's cgx_link_change_handler() uses the unvalidated firmware-supplied ID to index into an array and calls strncpy with the resulting out-of-bounds pointer, producing a fatal kernel Oops in a workqueue context. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the crash is deterministic once the invalid firmware value is processed, making Availability impact high on affected hardware.
Use-after-free in the Linux kernel NTFS3 filesystem driver allows a local attacker with low privileges to corrupt kernel heap memory via a crafted NTFS volume with malformed extended attributes. The `ntfs_read_ea` function fails to propagate error codes on encountering inconsistent EA structures, causing `ntfs_set_ea` to perform a 4-byte write to already-freed memory - confirmed by an in-description KASAN trace captured at 6.2.0-rc1+. No active exploitation is confirmed (not in CISA KEV), and an EPSS of 0.16% (6th percentile) signals very low observed exploitation activity, though a researcher-developed proof-of-concept is implied by the kernel trace.
Local privilege-tier memory corruption in the Linux kernel's Intel VPU/NPU accelerator driver (accel/ivpu) arises from a dangling buffer object left on a per-device list after a failed allocation, later dereferenced in ivpu_bo_unbind_all_bos_from_context() to cause a page fault. A local user with access to the ivpu device can trigger this use-after-free via the DRM/accel interface, with CVSS 7.8 (High) and CISA-style impact of confidentiality, integrity, and availability all High. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; the primary observed effect is a kernel page fault (crash), though the dangling-pointer condition carries corruption potential.
Kernel-side memory corruption in the Linux kernel's crypto AEAD framework arises because AEAD algorithms began populating the generic cra_reqsize field (added by commit afddce13ce81d) without the framework being updated to translate it into a proper per-request size via crypto_aead_set_reqsize(). As a result, request buffers for affected AEAD transforms are undersized, producing out-of-bounds memory writes and kernel crashes when the algorithm is used. This is tracked as a Denial-of-Service class issue; no public exploit identified at time of analysis, and it is not listed in CISA KEV.