CVE-2025-68285 libceph: fix potential use-after-free in have_mon_and_osd_map()

In the Linux kernel, the following vulnerability has been resolved: libceph: fix potential use-after-free in havemonandosdmap The wait loop in cephopensession can race with the client receiving a new monmap or osdmap shortly after the initial map is received. Both cephmonchandlemap and handleonem...

CVE-2025-68285 libceph: fix potential use-after-free in have_mon_and_osd_map()

In the Linux kernel, the following vulnerability has been resolved: libceph: fix potential use-after-free in havemonandosdmap The wait loop in cephopensession can race with the client receiving a new monmap or osdmap shortly after the initial map is received. Both cephmonchandlemap and handleonem...

CVE-2025-68285

CVE-2025-68285 affects the Linux kernel’s Ceph client code path (libceph). The issue is a use-after-free in have_mon_and_osd_map() where a race between map updates (monmap/osdmap) and the wait loop could dereference freed maps if epochs race alignment isn’t held under the appropriate locks. The f...

CVE-2025-68265 nvme: fix admin request_queue lifetime

In the Linux kernel, the following vulnerability has been resolved: nvme: fix admin requestqueue lifetime The namespaces can access the controller's admin requestqueue, and stale references on the namespaces may exist after tearing down the controller. Ensure the admin requestqueue is active by...

CVE-2025-68261 ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()

In the Linux kernel, the following vulnerability has been resolved: ext4: add idatasem protection in ext4destroyinlinedatanolock Fix a race between inline data destruction and block mapping. The function ext4destroyinlinedatanolock changes the inode data layout by clearing EXT4INODEINLINEDATA and...

CVE-2025-68261 ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()

In the Linux kernel, the following vulnerability has been resolved: ext4: add idatasem protection in ext4destroyinlinedatanolock Fix a race between inline data destruction and block mapping. The function ext4destroyinlinedatanolock changes the inode data layout by clearing EXT4INODEINLINEDATA and...

CVE-2025-68255 staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing The Supported Rates IE length from an incoming Association Request frame was used directly as the memcpy length when copying into a fixed-size 16-byte stack...

CVE-2025-68255

Technical details for CVE-2025-68255 are not present in the provided connected documents. The materials reference this CVE within multiple advisories but do not disclose affected product specifics, root cause, impact, or fixes. Monitor for updates.

CVE-2025-68255 staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing The Supported Rates IE length from an incoming Association Request frame was used directly as the memcpy length when copying into a fixed-size 16-byte stack...

CVE-2025-68252

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix dmabuf object leak in fastrpcmaplookup In fastrpcmaplookup, dmabufget is called to obtain a reference to the dmabuf for comparison purposes. However, this reference is never released when the function returns,...

CVE-2025-68247 posix-timers: Plug potential memory leak in do_timer_create()

In the Linux kernel, the following vulnerability has been resolved: posix-timers: Plug potential memory leak in dotimercreate When posix timer creation is set to allocate a given timer ID and the access to the user space value faults, the function terminates without freeing the already allocated...

CVE-2025-68241

CVE-2025-68241 relates to the Linux kernel IPv4 route path (net/ipv4/route.c) where a race between fnhe_remove_oldest() selecting an entry for deletion and the kfree_rcu() callback can allow a stale fnhe to be rebound to a new dst, causing a device reference count leak and a dmesg warning on unre...

CVE-2025-68239 binfmt_misc: restore write access before closing files opened by open_exec()

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: restore write access before closing files opened by openexec bmregisterwrite opens an executable file using openexec, which internally calls doopenexecat and denies write access on the file to avoid modification while...

UBUNTU-CVE-2025-68170

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: Do not kfree devres managed rdev Since the allocation of the drivers main structure was changed to devmdrmdevalloc rdev is managed by devres and we shouldn't be calling kfree on it. This fixes things exploding if the...

UBUNTU-CVE-2025-68230

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix gpu page fault after hibernation on PF passthrough On PF passthrough environment, after hibernate and then resume, coralgemm will cause gpu page fault. Mode1 reset happens during hibernate, but partition mode is n...

UBUNTU-CVE-2025-40359

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix KASAN global-out-of-bounds warning When running "perf mem record" command on CWF, the below KASAN global-out-of-bounds warning is seen. ================================================================== BUG:...

UBUNTU-CVE-2025-68190

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/atom: Check kcalloc for WS buffer in amdgpuatomexecutetablelocked kcalloc may fail. When WS is non-zero and allocation fails, ectx.ws remains NULL while ectx.wssize is set, leading to a potential NULL pointer dereferen...

CVE-2025-68238 mtd: rawnand: cadence: fix DMA device NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: cadence: fix DMA device NULL pointer dereference The DMA device pointer dmadev was being dereferenced before ensuring that cdnsctrl-dmac is properly initialized. Move the assignment of dmadev after successfully...

CVE-2025-68238

CVE-2025-68238 affects the Linux kernel mtd: rawnand: cadence driver. Root cause: the DMA device pointer (dma_dev) was dereferenced before cdns_ctrl->dmac was initialized, risking NULL dereference. Fix: move the assignment of dma_dev to after successfully acquiring the DMA channel, ensuring th...

CVE-2025-68228

CVE-2025-68228 concerns the Linux kernel DRM plane code: specifically create_in_format_blob() could return NULL instead of a valid pointer or an error, causing a potential kernel oops when the blob is dereferenced. The issue is resolved by returning proper error values in failure cases. Multiple ...