CLSA-2025-1753298759 kernel: Fix of 18 CVEs

udf: Fix a slab-out-of-bounds write bug in udffindentry CVE-2022-49846 - Bluetooth: hcisync: Fix queuing commands when HCIUNREGISTER is set CVE-2022-49136 - Bluetooth: Fix use after free in hcisendacl CVE-2022-49111 - NFSv4/pnfs: Fix a use-after-free bug in open CVE-2022-50072 - NFSv4: Don't hold...

kernel: ext4: fix off-by-one error in do_split

In the Linux kernel, the following vulnerability has been resolved: ext4: fix off-by-one error in dosplit Syzkaller detected a use-after-free issue in ext4insertdentry that was caused by out-of-bounds access due to incorrect splitting in dosplit. BUG: KASAN: use-after-free in...

USN-7654-2 linux-intel-iot-realtime, linux-realtime vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - PA-RISC architecture; - PowerPC architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; -...

kernel: ext4: ignore xattrs past end

A use-after-free vulnerability has been discovered in the Linux kernel, specifically within the ext4xattrinodedecrefall function related to the ext4 filesystem's extended attributes. An attacker could exploit this flaw by providing a specially crafted payload, leading to a denial of service...

AZL-64767 CVE-2025-38220 affecting package kernel for versions less than 6.6.96.1-1

In the Linux kernel, the following vulnerability has been resolved: ext4: only dirty folios when data journaling regular files fstest generic/388 occasionally reproduces a crash that looks as follows: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... Call Trace:...

CVE-2025-38222 ext4: inline: fix len overflow in ext4_prepare_inline_data

In the Linux kernel, the following vulnerability has been resolved: ext4: inline: fix len overflow in ext4prepareinlinedata When running the following code on an ext4 filesystem with inlinedata feature enabled, it will lead to the bug below. fd = open"file1", ORDWR | OCREAT | OTRUNC, 0666;...

CVE-2025-38222

Summary : CVE-2025-38222 refers to a Linux kernel vulnerability in ext4 inline data handling. When inline_data is enabled, a length parameter (len) is incorrectly treated as an unsigned int, causing a truncation of pos+len in ext4_prepare_inline_data. This leads to an incorrect len being passed t...

CVE-2025-38220 ext4: only dirty folios when data journaling regular files

In the Linux kernel, the following vulnerability has been resolved: ext4: only dirty folios when data journaling regular files fstest generic/388 occasionally reproduces a crash that looks as follows: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... Call Trace:...

PT-2025-27997

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to the fixed version Description: A vulnerability has been identified in the Linux kernel related to the ext4 filesystem with the inline data feature enabled. The issue arises from a length overflow in the ext4...

kernel: ext4: fix off-by-one error in do_split

In the Linux kernel, the following vulnerability has been resolved: ext4: fix off-by-one error in dosplit Syzkaller detected a use-after-free issue in ext4insertdentry that was caused by out-of-bounds access due to incorrect splitting in dosplit. BUG: KASAN: use-after-free in...

The vulnerability of the ext4_mb_init_backend() function in the fs/ext4/mballoc.c module of the Ext4 file system support module for Linux’s kernel allows a attacker to cause a service failure.

The vulnerability of the ext4mbinitbackend function in the fs/ext4/mballoc.c module of the Ext4 file system support module in the Linux operating system is related to improper memory release before deleting the last reference „memory leak“. Exploiting this vulnerability could allow an attacker to...

CVE-2022-50020

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid resizing to a partial cluster size This patch avoids an attempt to resize the filesystem to an unaligned cluster boundary. An online resize to a size that is not integral to cluster size results in the last iteration...

UBUNTU-CVE-2022-50020

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid resizing to a partial cluster size This patch avoids an attempt to resize the filesystem to an unaligned cluster boundary. An online resize to a size that is not integral to cluster size results in the last iteration...

UBUNTU-CVE-2022-50082

In the Linux kernel, the following vulnerability has been resolved: ext4: fix warning in ext4iomapbegin as race between bmap and write We got issue as follows: ------------ cut here ------------ WARNING: CPU: 3 PID: 9310 at fs/ext4/inode.c:3441 ext4iomapbegin+0x182/0x5d0 RIP:...

CVE-2022-50021

CVE-2022-50021 documents a Linux kernel ext4 bug where a validated block range for freeing blocks could be altered after validation on bigalloc filesystems, potentially triggering a kernel BUG in ext4_free_blocks() / ext4_mb_clear_bb(). The issue arises because the range may be adjusted after val...

Important: kernel6.12

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: bpf: track changespktdata property for global functions CVE-2024-58098 In the Linux kernel, the following vulnerability has been resolved: bpf: check changespktdata property for extension programs CVE-2024-58100 I...

USN-7553-5 linux-azure vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Clock framework and drivers; - GPU drivers; - Parport drivers; - Ext4 file system; - JFFS2 file system; - JFS file...

kernel: ext4: fix OOB read when checking dotdot dir

A flaw was found in the ext4 module in the Linux kernel. An out-of-bounds read can be triggered when a corrupted ext4 filesystem is mounted due to a missing check, resulting in a denial of service that causes the system to freeze or become unusable...

USN-7554-3 linux-fips vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Block layer subsystem; - Clock framework and drivers; - GPU drivers; - Parport drivers; - Ext4 file system; - JFFS2...

CVE-2019-13106

Das U-Boot versions 2016.09 through 2019.07-rc4 can memset too much data while reading a crafted ext4 filesystem, which results in a stack buffer overflow and likely code execution...