Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from allowing BOs to be evicted in the same VM, potentially leading to null pointer dereferencing...

The vulnerability of the stm32_csi_start() function in the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability of the stm32csistart function in the Linux operating system’s kernel is related to a pointer arithmetic error. Exploiting this vulnerability could allow an attacker to cause a system failure...

kernel: KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 Don't BUG/WARN on interrupt injection due to GIF being cleared, since it's trivial for userspace to force the situation via KVMSETVCPUEVENTS even if having at least...

SUSE CVE-2025-40055

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix double free in userclusterconnect userclusterdisconnect frees "conn-ccprivate" which is "lc" but then the error handling frees "lc" a second time. Set "lc" to NULL on this path to avoid a double free...

SUSE CVE-2025-40060

In the Linux kernel, the following vulnerability has been resolved: coresight: trbe: Return NULL pointer for allocation failures When the TRBE driver fails to allocate a buffer, it currently returns the error code "-ENOMEM". However, the caller etmsetupaux only checks for a NULL pointer, so it...

kernel: sctp: linearize cloned gso packets in sctp_rcv

A flaw use of uninitialized memory uncontrolled and invisible by attacker in the Linux kernel SCTP transport protocol was found in the way user triggers malicious SCTP packets. A remote user could use this flaw to crash the system. The bug actual only for systems where SCTP protocol being enabled...

Siemens SIMATIC, SCALANCE and RUGGEDCOM Devices Race Condition (CVE-2024-49952)

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: prevent nfskbduplicated corruption. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

CVE-2025-40082 hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()

In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplusuni2asc BUG: KASAN: slab-out-of-bounds in hfsplusuni2asc+0xa71/0xb90 fs/hfsplus/unicode.c:186 Read of size 2 at addr ffff8880289ef218 by task syz.6.248/14290 CPU: 0 UID: 0 PID: 14290...

CVE-2025-40080

CVE-2025-40080 affects the Linux kernel NBD subsystem, where sockets were restricted to TCP/UDP. The root cause was mitigated by a commit that verifies the socket type during setup and ensures the socket supports shutdown(), explicitly accepting TCP and UNIX stream sockets. Public advisories indi...

CVE-2025-40076

The CVE-2025-40076 entry describes a Linux kernel PCI issue in the rcar-host driver where the MSI parent IRQ domain could be NULL due to how irq_domain_info is passed during a transition to msi_create_parent_irq_domain(). This could cause a NULL pointer dereference in generic_handle_domain_irq() ...

CVE-2025-40073 drm/msm: Do not validate SSPP when it is not ready

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Do not validate SSPP when it is not ready Current code will validate current plane and previous plane to confirm they can share a SSPP with multi-rect mode. The SSPP is already allocated for previous plane, while current...

CVE-2025-40073 drm/msm: Do not validate SSPP when it is not ready

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Do not validate SSPP when it is not ready Current code will validate current plane and previous plane to confirm they can share a SSPP with multi-rect mode. The SSPP is already allocated for previous plane, while current...

CVE-2025-40065

Technical details for CVE-2025-40065 are not publicly provided in the supplied documents. No specific product/version/root-cause/impact/fix is disclosed here. Monitor the sources for updates and authoritative advisories.

CVE-2025-40064

CVE-2025-40064 (kernel): The Linux kernel smc subsystem had a use-after-free in __pnet_find_base_ndev() triggered during connect() via sk_dst_get(dst)->dev. The root cause was not holding the device’s refcount before calling smc_pnet_find_ism_resource() (and smc_pnet_find_roce_resource()). The...

CVE-2025-40057 ptp: Add a upper bound on max_vclocks

In the Linux kernel, the following vulnerability has been resolved: ptp: Add a upper bound on maxvclocks syzbot reported WARNING in maxvclocksstore. This occurs when the argument max is too large for kcalloc to handle. Extend the guard to guard against values that are too large for kcalloc...

CVE-2025-40053 net: dlink: handle copy_thresh allocation failure

In the Linux kernel, the following vulnerability has been resolved: net: dlink: handle copythresh allocation failure The driver did not handle failure of netdevallocskbipalign. If the allocation failed, dereferencing skb-protocol could lead to a NULL pointer dereference. This patch tries to...

CVE-2025-40051 vhost: vringh: Modify the return value check

In the Linux kernel, the following vulnerability has been resolved: vhost: vringh: Modify the return value check The return value of copyfromiter and copytoiter can't be negative, check whether the copied lengths are equal...

CVE-2025-40043 net: nfc: nci: Add parameter validation for packet data

In the Linux kernel, the following vulnerability has been resolved: net: nfc: nci: Add parameter validation for packet data Syzbot reported an uninitialized value bug in nciinitreq, which was introduced by commit 5aca7966d2a7 "Merge tag 'perf-tools-fixes-for-v6.17-2025-09-16' of...

CVE-2025-40038 KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid Skip the WRMSR and HLT fastpaths in SVM's VM-Exit handler if the next RIP isn't valid, e.g. because KVM is running with nrips=false. SVM must decode and emulate...

CVE-2025-40036

CVE-2025-40036 in the Linux kernel is resolved by fixing a map-leak in the fastrpc path. The vulnerability occurred when copy_to_user() could fail and cause an early return, leaving the fdlist updated by the DSP uncleared, potentially leaking maps. The fix redirects on failure to a cleanup path t...