CVE-2025-38190

CVE-2025-38190 affects the Linux kernel ATM path. The issue arises when in the vcc_sendmsg() path, skb->truesize is accounted to sk_wmem_alloc via atm_account_tx(), but the corresponding revert is not performed on copy_from_iter_full() failure, potentially leaking a socket. The fixed approach ...

CVE-2025-38191 ksmbd: fix null pointer dereference in destroy_previous_session

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in destroyprevioussession If client set -PreviousSessionId on kerberos session setup stage, NULL pointer dereference error will happen. Since sess-user is not set yet, It can pass the user...

CVE-2025-38191 ksmbd: fix null pointer dereference in destroy_previous_session

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in destroyprevioussession If client set -PreviousSessionId on kerberos session setup stage, NULL pointer dereference error will happen. Since sess-user is not set yet, It can pass the user...

CVE-2025-38190 atm: Revert atm_account_tx() if copy_from_iter_full() fails.

In the Linux kernel, the following vulnerability has been resolved: atm: Revert atmaccounttx if copyfromiterfull fails. In vccsendmsg, we account skb-truesize to sk-skwmemalloc by atmaccounttx. It is expected to be reverted by atmpopraw later called by vcc-dev-ops-sendvcc, skb. However, vccsendms...

CVE-2025-38189

Technical details about CVE-2025-38189 are not publicly available in the provided Connected documents. The available Initial description contains some information, but no specific affected product/version or impact is confirmed here. Monitor for updated disclosures.

CVE-2025-38189 drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Avoid NULL pointer dereference in v3djobupdatestats The following kernel Oops was recently reported by Mesa CI: 800.139824 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000588 800.148619 M...

CVE-2025-38188

CVE-2025-38188 affects the Linux kernel DRM MSM (a7xx) path. The vulnerability arises from missing CP_RESET_CONTEXT_STATE handling when switching contexts, risking userspace submissions in one context causing another context to hang (DoS) without data leakage. The fix ensures CP_RESET_CONTEXT_STA...

CVE-2025-38188 drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a7xx: Call CPRESETCONTEXTSTATE Calling this packet is necessary when we switch contexts because there are various pieces of state used by userspace to synchronize between BR and BV that are persistent across submits and w...

CVE-2025-38187

Root-cause: In Linux kernel DRM Nouveau, a use-after-free occurs when sending large RPC fragments because the RPC container is freed prematurely after being passed to r535_gsp_rpc_send(). Fix: allocate a temporary RPC container for the initial fragment and free the caller’s container only after a...

CVE-2025-38187 drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix a use-after-free in r535gsprpcpush The RPC container is released after being passed to r535gsprpcsend. When sending the initial fragment of a large RPC and passing the caller's RPC container, the container will b...

CVE-2025-38188 drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a7xx: Call CPRESETCONTEXTSTATE Calling this packet is necessary when we switch contexts because there are various pieces of state used by userspace to synchronize between BR and BV that are persistent across submits and w...

CVE-2025-38187

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix a use-after-free in r535gsprpcpush The RPC container is released after being passed to r535gsprpcsend. When sending the initial fragment of a large RPC and passing the caller's RPC container, the container will b...

CVE-2025-38186

CVE-2025-38186 (Linux kernel, bnxt_en/RoCE driver) : The issue arises from a double invocation path where bnxt_ulp_stop() and bnxt_ulp_start() can be invoked in sequence after bnxt_ulp_restart(), causing the RoCE driver’s aux driver suspend() to run twice and potentially dereference a NULL pointe...

CVE-2025-38186 bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start()

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix double invocation of bnxtulpstop/bnxtulpstart Before the commit under the Fixes tag below, bnxtulpstop and bnxtulpstart were always invoked in pairs. After that commit, the new bnxtulprestart can be invoked after...

CVE-2025-38185

In the Linux kernel, the following vulnerability has been resolved: atm: atmtcp: Free invalid length skb in atmtcpcsend. syzbot reported the splat below. 0 vccsendmsg copies data passed from userspace to skb and passes it to vcc-dev-ops-send. atmtcpcsend accesses skb-data as struct atmtcphdr afte...

CVE-2025-38184 tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer

In the Linux kernel, the following vulnerability has been resolved: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer The reproduction steps: 1. create a tun interface 2. enable l2 bearer 3. TIPCNLUDPGETREMOTEIP with media name set to tun tipc: Started in network mode tipc: Nod...

CVE-2025-38184 tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer

In the Linux kernel, the following vulnerability has been resolved: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer The reproduction steps: 1. create a tun interface 2. enable l2 bearer 3. TIPCNLUDPGETREMOTEIP with media name set to tun tipc: Started in network mode tipc: Nod...

CVE-2025-38183 net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix potential out-of-bounds write in lan743xptpioeventclockget Before calling lan743xptpioeventclockget, the 'channel' value is checked against the maximum value of PCI11X1XPTPIOMAXCHANNELS8. This seems correct and...

CVE-2025-38182 ublk: santizize the arguments from userspace when adding a device

In the Linux kernel, the following vulnerability has been resolved: ublk: santizize the arguments from userspace when adding a device Sanity check the values for queue depth and number of queues we get from userspace when adding a device...

CVE-2025-38182

CVE-2025-38182 affects the Linux kernel ublk (userspace block driver). The connected advisories confirm the issue is fixed in the kernel by sanitizing arguments from userspace when adding a device and by sanity-checking the queue depth/number of queues obtained from userspace. Root cause: inadequ...