CVE-2025-38685

In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix vmalloc out-of-bounds write in fastimageblit This issue triggers when a userspace program does an ioctl FBIOPUTCON2FBMAP by passing console number and frame buffer number. Ideally this maps console to frame buffer and...

DEBIAN-CVE-2025-38685

In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix vmalloc out-of-bounds write in fastimageblit This issue triggers when a userspace program does an ioctl FBIOPUTCON2FBMAP by passing console number and frame buffer number. Ideally this maps console to frame buffer and...

DEBIAN-CVE-2025-38688

In the Linux kernel, the following vulnerability has been resolved: iommufd: Prevent ALIGN overflow When allocating IOVA the candidate range gets aligned to the target alignment. If the range is close to ULONGMAX then the ALIGN can wrap resulting in a corrupted iova. Open code the ALIGN using...

AZL-73836 CVE-2025-38685 affecting package kernel for versions less than 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix vmalloc out-of-bounds write in fastimageblit This issue triggers when a userspace program does an ioctl FBIOPUTCON2FBMAP by passing console number and frame buffer number. Ideally this maps console to frame buffer and...

UBUNTU-CVE-2025-38685

In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix vmalloc out-of-bounds write in fastimageblit This issue triggers when a userspace program does an ioctl FBIOPUTCON2FBMAP by passing console number and frame buffer number. Ideally this maps console to frame buffer and...

CVE-2025-38696 MIPS: Don't crash in stack_top() for tasks without ABI or vDSO

In the Linux kernel, the following vulnerability has been resolved: MIPS: Don't crash in stacktop for tasks without ABI or vDSO Not all tasks have an ABI associated or vDSO mapped, for example kthreads never do. If such a task ever ends up calling stacktop, it will derefence the NULL ABI pointer...

CVE-2025-38688 iommufd: Prevent ALIGN() overflow

In the Linux kernel, the following vulnerability has been resolved: iommufd: Prevent ALIGN overflow When allocating IOVA the candidate range gets aligned to the target alignment. If the range is close to ULONGMAX then the ALIGN can wrap resulting in a corrupted iova. Open code the ALIGN using...

CVE-2025-38688 iommufd: Prevent ALIGN() overflow

In the Linux kernel, the following vulnerability has been resolved: iommufd: Prevent ALIGN overflow When allocating IOVA the candidate range gets aligned to the target alignment. If the range is close to ULONGMAX then the ALIGN can wrap resulting in a corrupted iova. Open code the ALIGN using...

CVE-2025-38685 fbdev: Fix vmalloc out-of-bounds write in fast_imageblit

In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix vmalloc out-of-bounds write in fastimageblit This issue triggers when a userspace program does an ioctl FBIOPUTCON2FBMAP by passing console number and frame buffer number. Ideally this maps console to frame buffer and...

CVE-2025-38685

CVE-2025-38685 affects the Linux kernel fbdev path. The issue arises in vmalloc out-of-bounds write within fast_imageblit when a userspace ioctl (FBIOPUT_CON2FBMAP) maps a console to a framebuffer; if the console resize during mapping fails but the code continues, it can end up updating display s...

CVE-2025-36905

In gxpmappingcreate of gxpmapping.c, there is a possible privilege escalation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

xen/events: close evtchn after mapping cleanup

...

mtk-sd: Prevent memory corruption from DMA map failure

...

CVE-2025-36905

In gxpmappingcreate of gxpmapping.c, there is a possible privilege escalation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-36905

In gxpmappingcreate of gxpmapping.c, there is a possible privilege escalation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-36905

In gxpmappingcreate of gxpmapping.c, there is a possible privilege escalation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

x86/mm/ident_map: Use gbpages only where full GB page should be mapped.

...

fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name

...

btrfs: check folio mapping after unlock in relocate_one_folio()

...

PT-2025-35888

Name of the Vulnerable Software and Affected Versions: gxp mapping.c affected versions not specified Description: A logic error exists in the gxp mapping create function within gxp mapping.c that may allow for local privilege escalation. Exploitation does not require additional execution privileg...