3701 matches found
CVE-2025-38731 drm/xe: Fix vm_bind_ioctl double free bug
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix vmbindioctl double free bug If the argument check during an array bind fails, the bindops are freed twice as seen below. Fix this by setting bindops to NULL after freeing...
PT-2025-36261
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.16.0-xe-eudebug-cmanszew+ 520 Description A double-free issue was resolved in the drm/xe module within the Linux kernel. Specifically, the vulnerability occurs in the xe vm bind ioctl function when the argument...
AZL-73881 CVE-2025-38701 affecting package kernel for versions less than 5.15.200.1-1
In the Linux kernel, the following vulnerability has been resolved: ext4: do not BUG when INLINEDATAFL lacks system.data xattr A syzbot fuzzed image triggered a BUGON in ext4updateinlinedata when an inode had the INLINEDATAFL flag set but was missing the system.data extended attribute. Since this...
CVE-2025-38691
In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix uninited ptr deref in block/scsi layout The error occurs on the third attempt to encode extents. When function exttreepreparecommit reallocates a larger buffer to retry encoding extents, the "layoutupdatepages" page arr...
DEBIAN-CVE-2025-38687
In the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free in comedi in the below link, which is due to comedi gladly removing the allocated async area even though poll requests are still active on the...
UBUNTU-CVE-2025-38728
In the Linux kernel, the following vulnerability has been resolved: smb3: fix for slab out of bounds on mount to ksmbd With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parseserverinterfaces see below: BUG: KASAN: slab-out-of-bounds in...
UBUNTU-CVE-2025-38692
In the Linux kernel, the following vulnerability has been resolved: exfat: add cluster chain loop check for dir An infinite loop may occur if the following conditions occur due to file system corruption. 1 Condition for exfatcountdirentries to loop infinitely. - The cluster chain includes a loop....
CVE-2025-38724
CVE-2025-38724 affects the Linux kernel; nfsd4_setclientid_confirm() could race with an expiring confirmed client due to not checking get_client_locked() return value, risking a use-after-free. The fix applies to scenarios with an extant confirmed client by obtaining a reference earlier and handl...
CVE-2025-38722 habanalabs: fix UAF in export_dmabuf()
In the Linux kernel, the following vulnerability has been resolved: habanalabs: fix UAF in exportdmabuf As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is returning that descriptor to userland it's a...
CVE-2025-38721 netfilter: ctnetlink: fix refcount leak on table dump
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refcount leak on table dump There is a reference count leak in ctnetlinkdumptable: if res ctgeneral; // HERE cb-args1 = unsigned longct; ... While its very unlikely, its possible that ct == last. If this...
CVE-2025-38714
CVE-2025-38714 affects the Linux kernel’s HFS+ subsystem. The issue is a slab-out-of-bounds in hfsplus_bnode_read(), leading to potential memory corruption during operations that touch HFS+ bnodes. The connected advisories indicate a fix has been applied in upstream kernel code (hfsplus_bnode_rea...
CVE-2025-38700
Concrete details found in connected documents confirm CVE-2025-38700 affects the Linux kernel's SCSI libiscsi path (iscsi_conn->dd_data) during iSER setup when ib_fast_reg_mr allocation fails. The root cause is unconditional initialization of iscsi_conn->dd_data when dd_size may be 0, leadi...
CVE-2025-38694 media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()
In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090prwonapb In dib7090prwonapb, msg is controlled by user. When msg0.buf is null and msg0.len is zero, former checks on msg0.buf would be passed. If accessing msg0.buf2...
CVE-2025-38692 exfat: add cluster chain loop check for dir
In the Linux kernel, the following vulnerability has been resolved: exfat: add cluster chain loop check for dir An infinite loop may occur if the following conditions occur due to file system corruption. 1 Condition for exfatcountdirentries to loop infinitely. - The cluster chain includes a loop....
CVE-2025-38690 drm/xe/migrate: prevent infinite recursion
In the Linux kernel, the following vulnerability has been resolved: drm/xe/migrate: prevent infinite recursion If the buf + offset is not aligned to XECAHELINEBYTES we fallback to using a bounce buffer. However the bounce buffer here is allocated on the stack, and the only alignment requirement...
f2fs: fix to avoid panic in f2fs_evict_inode
...
tipc: Fix use-after-free in tipc_conn_close().
...
fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
...