Linux Distros Unpatched Vulnerability : CVE-2025-40237

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/notify: call exportfsencodefid with sumount Calling intotifyshowfdinfo on fd watching an overlayfs inode, while the overlayfs is being unmounted, can lead to...

The vulnerability of the pci_epfremove_cfs() function in the drivers/pci/endpoint/pci-epf-core.c component of the Linux kernel allows a hacker to cause a service failure.

The vulnerability of the pciepfremovecfs function in the drivers/pci/endpoint/pci-epf-core.c component of the Linux kernel lies in the use of memory after it has been freed. Exploiting this vulnerability allows an attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2025-40230

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm: prevent poison consumption when splitting THP When performing memory error injection on a THP Transparent Huge Page mapped to userspace on an x86 server, th...

Linux Distros Unpatched Vulnerability : CVE-2025-40216

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iouring/rsrc: don't rely on user vaddr alignment There is no guaranteed alignment for user pointers, however the calculation of an offset of the first page into...

CVE-2025-40243

In the Linux kernel, the following vulnerability has been resolved: hfs: fix KMSAN uninit-value issue in hfsfindsetzerobits The syzbot reported issue in hfsfindsetzerobits: ===================================================== BUG: KMSAN: uninit-value in hfsfindsetzerobits+0x74d/0xb60...

UBUNTU-CVE-2025-40230

In the Linux kernel, the following vulnerability has been resolved: mm: prevent poison consumption when splitting THP When performing memory error injection on a THP Transparent Huge Page mapped to userspace on an x86 server, the kernel panics with the following trace. The expected behavior is to...

UBUNTU-CVE-2025-40244

In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix KMSAN uninit-value issue in hfsplusextcacheextent The syzbot reported issue in hfsplusextcacheextent: 70.194323 T9350 BUG: KMSAN: uninit-value in hfsplusextcacheextent+0x7d0/0x990 70.195022 T9350...

CVE-2025-40266 KVM: arm64: Check the untrusted offset in FF-A memory share

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Check the untrusted offset in FF-A memory share Verify the offset to prevent OOB access in the hypervisor FF-A buffer in case an untrusted large enough value U32MAX - sizeofstruct ffacompositememregion + 1, U32MAX is...

CVE-2025-40264

The CVE-2025-40264 issue affects the Linux kernel be2net code path with OS2BMC. be_insert_vlan_in_pkt() could dereference a NULL wrb_params at the be_send_pkt_to_bmc() call site, due to the wrb_params not being passed from be_xmit(); this could lead to a NULL pointer dereference. The fix involves...

CVE-2025-40261

CVE-2025-40261 affects the Linux kernel’s NVMe over Fibre Channel (nvme_fc) driver. The issue stems from nvme_fc_delete_association() allowing a pending I/O to be left running and ->ioerr_work to be queued after cancel_work_sync() is called, risking list corruption and a kernel Oops when the n...

CVE-2025-40257 mptcp: fix a race in mptcp_pm_del_add_timer()

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix a race in mptcppmdeladdtimer mptcppmdeladdtimer can call skstoptimersyncsk, &entry-addtimer while another might have free entry already, as reported by syzbot. Add RCU protection to fix this issue. Also change confusin...

CVE-2025-40252 net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()

In the Linux kernel, the following vulnerability has been resolved: net: qlogic/qede: fix potential out-of-bounds read in qedetpacont and qedetpaend The loops in 'qedetpacont' and 'qedetpaend', iterate over 'cqe-lenlist' using only a zero-length terminator as the stopping condition. If the...

CVE-2025-40247

CVE-2025-40247 affects the Linux kernel drm/msm path. The issue arises in msm_vma_job_free via an ioctl path cleanup when prealloc_cleanup() runs without a preceding successful prealloc_allocate(), leading to a NULL-pointer/translation fault in the pgtable preallocation flow. Public details descr...

CVE-2025-40246 xfs: fix out of bounds memory read error in symlink repair

In the Linux kernel, the following vulnerability has been resolved: xfs: fix out of bounds memory read error in symlink repair xfs/286 produced this report on my test fleet: ================================================================== BUG: KFENCE: out-of-bounds read in memcpyorig+0x54/0x110...

CVE-2025-40246 xfs: fix out of bounds memory read error in symlink repair

In the Linux kernel, the following vulnerability has been resolved: xfs: fix out of bounds memory read error in symlink repair xfs/286 produced this report on my test fleet: ================================================================== BUG: KFENCE: out-of-bounds read in memcpyorig+0x54/0x110...

CVE-2025-40236 virtio-net: zero unused hash fields

In the Linux kernel, the following vulnerability has been resolved: virtio-net: zero unused hash fields When GSO tunnel is negotiated virtionethdrtnlfromskb tries to initialize the tunnel metadata but forget to zero unused rxhash fields. This may leak information to another side. Fixing this by...

CVE-2025-40233 ocfs2: clear extent cache after moving/defragmenting extents

In the Linux kernel, the following vulnerability has been resolved: ocfs2: clear extent cache after moving/defragmenting extents The extent map cache can become stale when extents are moved or defragmented, causing subsequent operations to see outdated extent flags. This triggers a BUGON in...

DEBIAN-CVE-2025-40214

In the Linux kernel, the following vulnerability has been resolved: afunix: Initialise sccindex in unixaddedge. Quang Le reported that the AFUNIX GC could garbage-collect a receive queue of an alive in-flight socket, with a nice repro. The repro consists of three stages. 1 1-a. Create a single...

kernel: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction

In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix use-after-free of work objects after cmid destruction The commit 59c68ac31e15 "iwcm: free cmid resources on the last deref" simplified cmid resource management by freeing cmid once all references to the cmid were...

kernel: net_sched: ets: Fix double list add in class with netem as child qdisc

A use-after-free vulnerability was found in the Linux kernel’s netem qdisc. This issue occurs when it incorrectly manages duplicated packets in classful parent qdiscs. This leads to a corrupted internal state and eventual dereferencing of freed memory, resulting in unpredictable behavior, system...