CVE-2025-38199

The connected Astra/Linux kernel advisory describes CVE-2025-38199 as a memory leak in wifi/ath12k where arsta->rx_stats was allocated each time a station was added, including repeated additions for the same station. The root cause is redundant allocations when ath12k_mac_station_add() is call...

CVE-2025-38199

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix memory leak due to multiple rxstats allocation rxstats for each arsta is allocated when adding a station. arsta-rxstats will be freed when a station is removed. Redundant allocations are occurring when the same...

CVE-2025-38198 fbcon: Make sure modelist not set on unregistered console

In the Linux kernel, the following vulnerability has been resolved: fbcon: Make sure modelist not set on unregistered console It looks like attempting to write to the "storemodes" sysfs node will run afoul of unregistered consoles: UBSAN: array-index-out-of-bounds in...

CVE-2025-38198

CVE-2025-38198 – Linux kernel fbcon : A fix resolves an out-of-bounds access when writing to store_modes if con2fb_map contains -1 for an unregistered console. The issue stems from fbcon_info_from_console accessing fbcon_registered_fb[con2fb_map[console]]; the patch changes this to handle invalid...

CVE-2025-38197 platform/x86: dell_rbu: Fix list usage

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dellrbu: Fix list usage Pass the correct list head to listforeachentry when looping through the packet list. Without this patch, reading the packet data via sysfs will show the data incorrectly because it starts at...

CVE-2025-38196

In the Linux kernel, the following vulnerability has been resolved: iouring/rsrc: validate buffer count with offset for cloning syzbot reports that it can trigger a WARNON for kmalloc attempt that's too big: WARNING: CPU: 0 PID: 6488 at mm/slub.c:5024 kvmallocnodenoprof+0x520/0x640 mm/slub.c:5024...

CVE-2025-38197

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dellrbu: Fix list usage Pass the correct list head to listforeachentry when looping through the packet list. Without this patch, reading the packet data via sysfs will show the data incorrectly because it starts at...

CVE-2025-38197

CVE-2025-38197 affects the Linux kernel component platform/x86: dell_rbu. The root cause is a wrong list head passed to list_for_each_entry*() when iterating the packet list, causing incorrect data reads via sysfs and, on clearing the list, potential NULL pointer dereference. A patch fix was intr...

CVE-2025-38195

CVE-2025-38195 concerns the Linux kernel LoongArch code, where a NULL-PMD handling path in huge_pte_offset() could trigger a kernel-panic when processing huge pages, as shown by the error trace and mitigation notes. The issue affects the kernel’s page fault / madvise pathways, with a local attack...

CVE-2025-38195 LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix panic caused by NULL-PMD in hugepteoffset ERROR INFO: CPU 25 Unable to handle kernel paging request at virtual address 0x0 ... Call Trace: hugepteoffset+0x3c/0x58 hugetlbfollowpagemask+0x74/0x438...

CVE-2025-38194 jffs2: check that raw node were preallocated before writing summary

In the Linux kernel, the following vulnerability has been resolved: jffs2: check that raw node were preallocated before writing summary Syzkaller detected a kernel bug in jffs2linknoderef, caused by fault injection in jffs2preallocrawnoderefs. jffs2sumwritesumnode doesn't check return value of...

CVE-2025-38194 jffs2: check that raw node were preallocated before writing summary

In the Linux kernel, the following vulnerability has been resolved: jffs2: check that raw node were preallocated before writing summary Syzkaller detected a kernel bug in jffs2linknoderef, caused by fault injection in jffs2preallocrawnoderefs. jffs2sumwritesumnode doesn't check return value of...

CVE-2025-38193 net_sched: sch_sfq: reject invalid perturb period

In the Linux kernel, the following vulnerability has been resolved: netsched: schsfq: reject invalid perturb period Gerrard Tai reported that SFQ perturbperiod has no range check yet, and this can be used to trigger a race condition fixed in a separate patch. We want to make sure ctl-perturbperio...

CVE-2025-38193

CVE-2025-38193 affects the Linux kernel net_sched SFQ (sch_sfq). The issue is a missing range check on perturb_period, which can enable a race condition; patches fix perturb_period overflow/invalid values. Public demonstrations show negative, oversized, and a valid perturb value (2000000), with t...

CVE-2025-38194

CVE-2025-38194 affects the Linux kernel’s JFFS2 file system. The issue arises when jffs2_sum_write_sumnode does not validate the return value of jffs2_prealloc_raw_node_refs, allowing an preallocation error to propagate into jffs2_link_node_ref and potentially cause a kernel BUG at fs/jffs2/nodel...

CVE-2025-38193

In the Linux kernel, the following vulnerability has been resolved: netsched: schsfq: reject invalid perturb period Gerrard Tai reported that SFQ perturbperiod has no range check yet, and this can be used to trigger a race condition fixed in a separate patch. We want to make sure ctl-perturbperio...

CVE-2025-38192 net: clear the dst when changing skb protocol

In the Linux kernel, the following vulnerability has been resolved: net: clear the dst when changing skb protocol A not-so-careful NAT46 BPF program can crash the kernel if it indiscriminately flips ingress packets from v4 to v6: BUG: kernel NULL pointer dereference, address: 0000000000000000...

CVE-2025-38192

CVE-2025-38192 is a Linux kernel vulnerability where an ingress NAT46 BPF program that flips IPv4/IPv6 can mutate skb->protocol to v6 while the dst remains IPv4, leading to a NULL pointer dereference in ip6_rcv_core. The fix is to clear the destination (dst) in all BPF helpers that change skb-...

CVE-2025-38190

CVE-2025-38190 affects the Linux kernel ATM path. The issue arises when in the vcc_sendmsg() path, skb->truesize is accounted to sk_wmem_alloc via atm_account_tx(), but the corresponding revert is not performed on copy_from_iter_full() failure, potentially leaking a socket. The fixed approach ...

CVE-2025-38190 atm: Revert atm_account_tx() if copy_from_iter_full() fails.

In the Linux kernel, the following vulnerability has been resolved: atm: Revert atmaccounttx if copyfromiterfull fails. In vccsendmsg, we account skb-truesize to sk-skwmemalloc by atmaccounttx. It is expected to be reverted by atmpopraw later called by vcc-dev-ops-sendvcc, skb. However, vccsendms...