CVE-2025-40151

CVE-2025-40151 : The connected documents confirm a concrete Linux kernel issue on LoongArch related to BPF trampoline programs lacking support for struct arguments. The vulnerability description shows an oops scenario when running the bpf selftest, including kernel paging fault traces and RCU-rel...

CVE-2025-40139 smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().

In the Linux kernel, the following vulnerability has been resolved: smc: Use skdstget and dstdevrcu in in smcclcprfxset. smcclcprfxset is called during connect and not under RCU nor RTNL. Using skdstgetsk-dev could trigger UAF. Let's use skdstget and devdstrcu under rcureadlock after...

CVE-2025-40138 f2fs: fix to avoid NULL pointer dereference in f2fs_check_quota_consistency()

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid NULL pointer dereference in f2fscheckquotaconsistency syzbot reported a f2fs bug as below: Oops: gen 107.736417 T5848 Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 ...

CVE-2025-40116 usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup

In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup The kthreadrun function returns error pointers so the max3421hcd-spithread pointer can be either error pointers or NULL. Check for both before dereferencing i...

CVE-2025-40116 usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup

In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup The kthreadrun function returns error pointers so the max3421hcd-spithread pointer can be either error pointers or NULL. Check for both before dereferencing i...

CVE-2025-40117 misc: pci_endpoint_test: Fix array underflow in pci_endpoint_test_ioctl()

In the Linux kernel, the following vulnerability has been resolved: misc: pciendpointtest: Fix array underflow in pciendpointtestioctl Commit eefb83790a0d "misc: pciendpointtest: Add doorbell test case" added NOBAR -1 to the pcibarno enum which, in practical terms, changes the enum from an unsign...

kernel: Bluetooth: L2CAP: Fix user-after-free

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2capchanholdunlesszero after calling l2capgetchanblah to prevent the following trace: Bluetooth: l2capcore.c:static void l2capchandestroystruct kref kref Bluetooth: chan...

kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy

In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfsmdtdestroy In allocinode, inodeinitalways could return -ENOMEM if securityinodealloc fails, which causes inode-iprivate uninitialized. Then nilfsismetadatafileinode returns true and nilfsfreeinode...

kernel: wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: slab-out-of-bounds read in brcmfgetassocies Fix a slab-out-of-bounds read that occurs in kmemdup called from brcmfgetassocies. The bug could occur when associnfo-reqlen, data from a URB provided by a USB device, i...

kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy

In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfsmdtdestroy In allocinode, inodeinitalways could return -ENOMEM if securityinodealloc fails, which causes inode-iprivate uninitialized. Then nilfsismetadatafileinode returns true and nilfsfreeinode...

AZL-69953 CVE-2025-40110 affecting package kernel for versions less than 6.6.117.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix a null-ptr access in the cursor snooper Check that the resource which is converted to a surface exists before trying to use the cursor snooper on it. vmwcmdrescheck allows explicit invalid SVGA3DINVALIDID...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990735)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990735 advisory. In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation The expiry time of a key is unconditionall...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-990739)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990739 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix a procfs host directory removal regression scsiprochostdirrm decreases a referenc...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990870)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990870 advisory. In the Linux kernel, the following vulnerability has been resolved: ecryptfs: Fix buffer size for tag 66 packet The 'TAG 66 Packet Format' description is missing the...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990740)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990740 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: zero idisksize when initializing the bootloader inode If the boot loader inode has never...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-990795)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990795 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: target: tcmloop: Fix possible name leak in tcmloopsetuphbabus If deviceregister fails in...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990833)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990833 advisory. In the Linux kernel, the following vulnerability has been resolved: tcp: Fix shift-out-of-bounds in dctcpupdatealpha. In dctcpupdatealpha, we use a module parameter...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-990815)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990815 advisory. In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix null pointer dereference in ftraceaddmod The @ftracemod is allocated by kzalloc, so...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990854)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990854 advisory. In the Linux kernel, the following vulnerability has been resolved: fbdev: sisfb: Fix strbuf array overflow The values of the variables xres and yres are placed in...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990851)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990851 advisory. In the Linux kernel, the following vulnerability has been resolved: afunix: Fix data races in unixreleasesock/unixstreamsendmsg A data-race condition has been...