kernel: memcg: fix possible use-after-free in memcg_write_event_control()

A flaw was found in the Linux kernel's memory cgroup memcg component. A missing file type check in the memcgwriteeventcontrol function allows arbitrary files to bypass validation. This can lead to a use-after-free condition when dname and parent accesses race against file renames and removals. A...

kernel: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper()

In the Linux kernel, the following vulnerability has been resolved: EDAC/i10nm: fix refcount leak in pcigetdevwrapper As the comment of pcigetdomainbusandslot says, it returns a PCI device with refcount incremented, so it doesn't need to call an extra pcidevget in pcigetdevwrapper, and the PCI...

kernel: scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests The following message and call trace was seen with debug kernels: DMA-API: qla2xxx 0000:41:00.0: device driver failed to check map error device address=0x00000002a3ff38d8...

kernel: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Don't let sockmapclose,destroy,unhash call itself sockmap proto callbacks should never call themselves by design. Protect against bugs like 1 and break out of the recursive loop to avoid a stack overflow in favor of...

kernel: nvmet: avoid potential UAF in nvmet_req_complete()

In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid potential UAF in nvmetreqcomplete An nvme target -queueresponse operation implementation may free the request passed as argument. Such implementation potentially could result in a use after free of the request pointe...

kernel: nvme-pci: fix mempool alloc size

A flaw was addressed in the Linux kernel’s nvme-pci driver related to how the driver calculated the worst-case number of PRP Physical Region Page lists required for a given I/O request. The implementation previously rounded the allocation to one list instead of correctly converting the maximum si...

kernel: wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: Fix global-out-of-bounds bug in rtl8812aephysettxpowerlimit There is a global-out-of-bounds reported by KASAN: BUG: KASAN: global-out-of-bounds in rtl8812aeeqnbyte.part.0+0x3d/0x84 rtl8821ae Read of size 1 at addr...

kernel: selinux: fix memleak in security_read_state_kernel()

In the Linux kernel, the following vulnerability has been resolved: selinux: fix memleak in securityreadstatekernel In this function, it directly returns the result of securityreadpolicy without freeing the allocated memory in data, cause memory leak issue, so free the memory if securityreadpolic...

kernel: PCI: Fix pci_device_is_present() for VFs by checking PF

A flaw was found in the way the Linux kernel’s PCI subsystem detects the presence of devices for Single Root I/O Virtualization,Virtual Functions VFs. The existing pcideviceispresent implementation incorrectly determines that VFs are absent by reading the Vendor and Device IDs, which return 0xfff...

kernel: drm/shmem-helper: Remove another errant put in error path

In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove another errant put in error path drmgemshmemmmap doesn't own reference in error code path, resulting in the dma-buf shmem GEM object getting prematurely freed leading to a later use-after-free...

kernel: cifs: Fix xid leak in cifs_copy_file_range()

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix xid leak in cifscopyfilerange If the file is used by swap, before return -EOPNOTSUPP, should free the xid, otherwise, the xid will be leaked...

kernel: wifi: ath9k: verify the expected usb_endpoints are present

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: verify the expected usbendpoints are present The bug arises when a USB device claims to be an ATH9K but doesn't have the expected endpoints. In this case there was an interrupt endpoint where the driver expected a bu...

PT-2025-41115

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.0-rc1 Description The Linux kernel contains a flaw related to SRCU Sub Read Copy Update. A commit assumed that CPU 0 is always online, but this is not always the case, particularly when booting a kdump kernel...

PT-2025-53198

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue within the btrfs file system related to incorrect splitting in the btrfs drop extent map range function. This can lead to invalid extent maps being...

PT-2025-49492

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.5.0-rc1+ 10 Description A use-after-free condition can occur in the Bluetooth stack within the Linux kernel, specifically in the hci disconnect all sync function. This issue arises when a connection is deleted...

PT-2025-49493

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contained a flaw related to the f2fs filesystem. A regression was introduced by a previous fix intended to improve sanity checks on the extent cache. The issue manifeste...

PT-2025-54083

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s DRM/TTM subsystem where a resource could be leaked during eviction errors, specifically those other than -EMULTIHOP. The issue was addressed by...

USN-6152-1: Linux kernel (GKE) regression

It was discovered that NFS client's access cache implementation in the Linux kernel caused a severe NFS performance degradation in certain conditions. This updated makes the NFS file-access stale cache behavior to be optional...

kernel: virtio-gpu: fix a missing check to avoid NULL dereference

In the Linux kernel, the following vulnerability has been resolved: virtio-gpu: fix a missing check to avoid NULL dereference 'cacheent' could be set NULL inside virtiogpucmdgetcapset and it will lead to a NULL dereference by a lately use of it i.e., ptr = cacheent-capscache. Fix it with a NULL...

kernel: drm/amdgpu: Fix use-after-free on amdgpu_bo_list mutex

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix use-after-free on amdgpubolist mutex If amdgpucsvmhandling returns r != 0, then it will unlock the bolistmutex inside the function amdgpucsvmhandling and again on amdgpucsparserfini. This problem results in the...