kernel: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Don't let sockmapclose,destroy,unhash call itself sockmap proto callbacks should never call themselves by design. Protect against bugs like 1 and break out of the recursive loop to avoid a stack overflow in favor of...

kernel: drm/shmem-helper: Remove another errant put in error path

In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove another errant put in error path drmgemshmemmmap doesn't own reference in error code path, resulting in the dma-buf shmem GEM object getting prematurely freed leading to a later use-after-free...

kernel: nvmet: avoid potential UAF in nvmet_req_complete()

In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid potential UAF in nvmetreqcomplete An nvme target -queueresponse operation implementation may free the request passed as argument. Such implementation potentially could result in a use after free of the request pointe...

kernel: mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data

In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data The MT7921 driver no longer uses eeprom.data, but the relevant code has not been removed completely since commit 16d98b548365 "mt76: mt7921: rely on...

kernel: tcp: fix skb_copy_ubufs() vs BIG TCP

In the Linux kernel, the following vulnerability has been resolved: tcp: fix skbcopyubufs vs BIG TCP David Ahern reported crashes in skbcopyubufs caused by TCP tx zerocopy using hugepages, and skb length bigger than 68 KB. skbcopyubufs assumed it could copy all payload using up to MAXSKBFRAGS...

kernel: drm/amdkfd: fix potential kgd_mem UAFs

A flaw was found in the Linux kernel related to improper synchronization in a filesystem allocation path. Under certain conditions, concurrent operations may access and modify shared kernel data structures without adequate locking. This race condition can result in inconsistent internal state,...

kernel: wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: Fix global-out-of-bounds bug in rtl8812aephysettxpowerlimit There is a global-out-of-bounds reported by KASAN: BUG: KASAN: global-out-of-bounds in rtl8812aeeqnbyte.part.0+0x3d/0x84 rtl8821ae Read of size 1 at addr...

kernel: scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()

In the Linux kernel, the following vulnerability has been resolved: scsi: iscsitcp: Check that sock is valid before iscsisetparam The validity of sock should be checked before assignment to avoid incorrect values. Commit 57569c37f0ad "scsi: iscsi: iscsitcp: Fix null-ptr-deref while calling...

kernel: scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests The following message and call trace was seen with debug kernels: DMA-API: qla2xxx 0000:41:00.0: device driver failed to check map error device address=0x00000002a3ff38d8...

kernel: cifs: Fix xid leak in cifs_copy_file_range()

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix xid leak in cifscopyfilerange If the file is used by swap, before return -EOPNOTSUPP, should free the xid, otherwise, the xid will be leaked...

kernel: memcg: fix possible use-after-free in memcg_write_event_control()

A flaw was found in the Linux kernel's memory cgroup memcg component. A missing file type check in the memcgwriteeventcontrol function allows arbitrary files to bypass validation. This can lead to a use-after-free condition when dname and parent accesses race against file renames and removals. A...

kernel: PCI: Fix pci_device_is_present() for VFs by checking PF

A flaw was found in the way the Linux kernel’s PCI subsystem detects the presence of devices for Single Root I/O Virtualization,Virtual Functions VFs. The existing pcideviceispresent implementation incorrectly determines that VFs are absent by reading the Vendor and Device IDs, which return 0xfff...

kernel: usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: qcom: Fix memory leak in dwc3qcominterconnectinit oficcget alloc resources for path handle, we should release it when not need anymore. Like the release in dwc3qcominterconnectexit function. Add iccput in error handlin...

PT-2025-41115

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.0-rc1 Description The Linux kernel contains a flaw related to SRCU Sub Read Copy Update. A commit assumed that CPU 0 is always online, but this is not always the case, particularly when booting a kdump kernel...

PT-2025-53198

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue within the btrfs file system related to incorrect splitting in the btrfs drop extent map range function. This can lead to invalid extent maps being...

PT-2025-49492

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.5.0-rc1+ 10 Description A use-after-free condition can occur in the Bluetooth stack within the Linux kernel, specifically in the hci disconnect all sync function. This issue arises when a connection is deleted...

PT-2025-49493

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contained a flaw related to the f2fs filesystem. A regression was introduced by a previous fix intended to improve sanity checks on the extent cache. The issue manifeste...

PT-2025-54083

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s DRM/TTM subsystem where a resource could be leaked during eviction errors, specifically those other than -EMULTIHOP. The issue was addressed by...

USN-6152-1: Linux kernel (GKE) regression

It was discovered that NFS client's access cache implementation in the Linux kernel caused a severe NFS performance degradation in certain conditions. This updated makes the NFS file-access stale cache behavior to be optional...

kernel: mm/slub: actually fix freelist pointer vs redzoning

In the Linux kernel, the following vulnerability has been resolved: mm/slub: actually fix freelist pointer vs redzoning It turns out that SLUB redzoning "slubdebug=Z" checks from s-objectsize rather than from s-inuse which is normally bumped to make room for the freelist pointer, so a cache creat...