DEBIAN-CVE-2025-38157

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9khtc: Abort software beacon handling if disabled A malicious USB device can send a WMISWBAEVENTID event from an ath9khtc-managed device before beaconing has been enabled. This causes a device-by-zero error in the driver...

DEBIAN-CVE-2025-38136

In the Linux kernel, the following vulnerability has been resolved: usb: renesasusbhs: Reorder clock handling and power management in probe Reorder the initialization sequence in usbhsprobe to enable runtime PM before accessing registers, preventing potential crashes due to uninitialized clocks...

AZL-64601 CVE-2025-38136 affecting package kernel for versions less than 6.6.96.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: renesasusbhs: Reorder clock handling and power management in probe Reorder the initialization sequence in usbhsprobe to enable runtime PM before accessing registers, preventing potential crashes due to uninitialized clocks...

CVE-2025-38134

In the Linux kernel, the following vulnerability has been resolved: usb: acpi: Prevent null pointer dereference in usbacpiaddusb4devlink As demonstrated by the fix for updateportdevicestate, commit 12783c0b9e2c "usb: core: Prevent null pointer dereference in updateportdevicestate",...

DEBIAN-CVE-2025-38134

In the Linux kernel, the following vulnerability has been resolved: usb: acpi: Prevent null pointer dereference in usbacpiaddusb4devlink As demonstrated by the fix for updateportdevicestate, commit 12783c0b9e2c "usb: core: Prevent null pointer dereference in updateportdevicestate",...

AZL-64505 CVE-2025-38105 affecting package kernel for versions less than 6.6.112.1-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill timer properly at removal The USB-audio MIDI code initializes the timer, but in a rare case, the driver might be freed without the disconnect call. This leaves the timer in an active state while the assigned...

AZL-70627 CVE-2025-38105 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill timer properly at removal The USB-audio MIDI code initializes the timer, but in a rare case, the driver might be freed without the disconnect call. This leaves the timer in an active state while the assigned...

AZL-64610 CVE-2025-38103 affecting package kernel for versions less than 6.6.96.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhidparse Update struct hiddescriptor to better reflect the mandatory and optional parts of the HID Descriptor as per USB HID 1.11 specification. Note: the kernel currently...

CVE-2025-38103

In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhidparse Update struct hiddescriptor to better reflect the mandatory and optional parts of the HID Descriptor as per USB HID 1.11 specification. Note: the kernel currently...

CVE-2025-38105

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill timer properly at removal The USB-audio MIDI code initializes the timer, but in a rare case, the driver might be freed without the disconnect call. This leaves the timer in an active state while the assigned...

DEBIAN-CVE-2025-38105

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill timer properly at removal The USB-audio MIDI code initializes the timer, but in a rare case, the driver might be freed without the disconnect call. This leaves the timer in an active state while the assigned...

CVE-2025-38157 wifi: ath9k_htc: Abort software beacon handling if disabled

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9khtc: Abort software beacon handling if disabled A malicious USB device can send a WMISWBAEVENTID event from an ath9khtc-managed device before beaconing has been enabled. This causes a device-by-zero error in the driver...

CVE-2025-38136 usb: renesas_usbhs: Reorder clock handling and power management in probe

In the Linux kernel, the following vulnerability has been resolved: usb: renesasusbhs: Reorder clock handling and power management in probe Reorder the initialization sequence in usbhsprobe to enable runtime PM before accessing registers, preventing potential crashes due to uninitialized clocks...

CVE-2025-38136

In the Linux kernel, the following vulnerability has been resolved: usb: renesasusbhs: Reorder clock handling and power management in probe Reorder the initialization sequence in usbhsprobe to enable runtime PM before accessing registers, preventing potential crashes due to uninitialized clocks...

CVE-2025-38136

The CVE-2025-38136 issue in the Linux kernel concerns Renesas USBHS on the RZ/V2H platform. Vulnerable path: in usbhs_probe(), clocks are sometimes not enabled before memory-mapped register access (iowrite16), causing a synchronous external abort. Root cause: initialization sequence in usbhs_prob...

CVE-2025-38134 usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink()

In the Linux kernel, the following vulnerability has been resolved: usb: acpi: Prevent null pointer dereference in usbacpiaddusb4devlink As demonstrated by the fix for updateportdevicestate, commit 12783c0b9e2c "usb: core: Prevent null pointer dereference in updateportdevicestate",...

CVE-2025-38134

In the Linux kernel, the following vulnerability has been resolved: usb: acpi: Prevent null pointer dereference in usbacpiaddusb4devlink As demonstrated by the fix for updateportdevicestate, commit 12783c0b9e2c "usb: core: Prevent null pointer dereference in updateportdevicestate",...

CVE-2025-38105

CVE-2025-38105 concerns the Linux kernel ALSA USB audio path. The issue arises when the USB-audio MIDI driver’s timer is initialized but the driver is freed without an explicit disconnect, potentially leaving an active timer and triggering a kernel warning under debug builds. The documented fix i...

CVE-2025-38105 ALSA: usb-audio: Kill timer properly at removal

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill timer properly at removal The USB-audio MIDI code initializes the timer, but in a rare case, the driver might be freed without the disconnect call. This leaves the timer in an active state while the assigned...

CVE-2025-38105 ALSA: usb-audio: Kill timer properly at removal

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill timer properly at removal The USB-audio MIDI code initializes the timer, but in a rare case, the driver might be freed without the disconnect call. This leaves the timer in an active state while the assigned...