DEBIAN-CVE-2025-38097

In the Linux kernel, the following vulnerability has been resolved: espintcp: remove encap socket caching to avoid reference leak The current scheme for caching the encap socket can lead to reference leaks when we try to delete the netns. The reference chain is: xfrmstate - enacpsk - netns Since...

CVE-2025-38032

The CVE pertains to the Linux kernel (CVE-2025-38032) where a splat was reported in the ipmr netns cleanup path due to ipmr_can_free_table() checks in net/ipv4/ipmr.c. The issue was addressed by consolidating the relevant sanity check in a single helper and reusing it for both IPv4 and IPv6 code ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: cookiehmacalg: avoid using current-nsproxy As mentioned in a previous commit of this series, using the net structure via current is not recommended for various reasons: - Inconsistency: obtaining information from th...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: “smb: client: fix TCP timers deadlock after rmmod” This fix reverts to the previous state with commit e9f2517a3e18a54a3943c098d2226b245d488801. The commit e9f2517a3e18 “smb: client: fix TCP timers deadlock after rmmod” is intende...

PT-2025-28993

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The Linux kernel contains an issue where a refcount warning occurs in the tipc aead encrypt function. This is triggered when calling get net on a network namespace during its...

SUSE CVE-2025-37959

In the Linux kernel, the following vulnerability has been resolved: bpf: Scrub packet on bpfredirectpeer When bpfredirectpeer is used to redirect packets to a device in another network namespace, the skb isn't scrubbed. That can lead skb information from one namespace to be "misused" in another...

DEBIAN-CVE-2025-37959

In the Linux kernel, the following vulnerability has been resolved: bpf: Scrub packet on bpfredirectpeer When bpfredirectpeer is used to redirect packets to a device in another network namespace, the skb isn't scrubbed. That can lead skb information from one namespace to be "misused" in another...

CVE-2025-37959

In the Linux kernel, the following vulnerability has been resolved: bpf: Scrub packet on bpfredirectpeer When bpfredirectpeer is used to redirect packets to a device in another network namespace, the skb isn't scrubbed. That can lead skb information from one namespace to be "misused" in another...

CVE-2025-37959 bpf: Scrub packet on bpf_redirect_peer

In the Linux kernel, the following vulnerability has been resolved: bpf: Scrub packet on bpfredirectpeer When bpfredirectpeer is used to redirect packets to a device in another network namespace, the skb isn't scrubbed. That can lead skb information from one namespace to be "misused" in another...

CVE-2025-37959 bpf: Scrub packet on bpf_redirect_peer

In the Linux kernel, the following vulnerability has been resolved: bpf: Scrub packet on bpfredirectpeer When bpfredirectpeer is used to redirect packets to a device in another network namespace, the skb isn't scrubbed. That can lead skb information from one namespace to be "misused" in another...

kernel: wifi: cfg80211: clear wdev->cqm_config pointer on free

A flaw was found in the Linux kernel's wifi: cfg80211 subsystem. A local attacker with administrative privileges could exploit this vulnerability. When a wireless device wdev/netdev is unregistered, its cqmconfig pointer is freed but not cleared. If the same device is re-registered in another...

kernel: bpf: Fix too early release of tcx_entry

A flaw was found in the Linux kernel in which certain sequences of network namespace activity can cause a use-after-free, resulting in a denial of service...

kernel: smb: client: Fix use-after-free of network namespace.

A flaw was found in the Linux kernel's Server Message Block SMB client. Improper reference counting allows kernel sockets to persist after their associated network namespace has been released. A local attacker with permission to create and destroy network namespaces—such as in containerized...

Important: kernel

Issue Overview: A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol L2TP. A missing lock when clearing skuserdata can lead to a race condition and NULL pointer dereference. A local user could use this flaw to potentially crash the system causing a denial of service. CVE-2022-4129 In...

USN-7462-1 linux-aws, linux-aws-5.4, linux-gcp-5.4, linux-iot vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - GPU drivers; - Network drivers; - File systems infrastructure; - Ext4 file system; - Network file system NFS server...

USN-7402-5: Linux kernel (GCP) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Block layer subsystem; - GPU drivers; - HID subsystem; - Media drivers; - JFS file system; - Network namespace; -...

USN-7402-5 linux-gcp-6.8 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Block layer subsystem; - GPU drivers; - HID subsystem; - Media drivers; - JFS file system; - Network namespace; -...

SUSE CVE-2025-22077

In the Linux kernel, the following vulnerability has been resolved: Revert "smb: client: fix TCP timers deadlock after rmmod" This reverts commit e9f2517a3e18a54a3943c098d2226b245d488801. Commit e9f2517a3e18 "smb: client: fix TCP timers deadlock after rmmod" is intended to fix a null-ptr-deref in...

CVE-2025-22105 bonding: check xdp prog when set bond mode

In the Linux kernel, the following vulnerability has been resolved: bonding: check xdp prog when set bond mode Following operations can trigger a warning1: ip netns add ns1 ip netns exec ns1 ip link add bond0 type bond mode balance-rr ip netns exec ns1 ip link set dev bond0 xdp obj afxdpkern.o se...

CVE-2025-22105

CVE-2025-22105 affects the Linux kernel bonding driver. When an XDP program is attached to a bonded interface, changing the bond mode may trigger a warning inside bond_xdp_set. The fix adds a check for the presence of an XDP program when setting bond mode, since some modes (e.g., balance-rr with ...