Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990796)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990796 advisory. In the Linux kernel, the following vulnerability has been resolved: ntfs: check overflow when iterating ATTRRECORDs Kernel iterates over ATTRRECORDs in mft record in...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990762)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990762 advisory. In the Linux kernel, the following vulnerability has been resolved: nfc: fdp: add null check of devmkmallocarray in fdpncii2creaddeviceproperties devmkmallocarray ma...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990898)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990898 advisory. In the Linux kernel, the following vulnerability has been resolved: serial: max3100: Lock port-lock when calling uarthandlectschange uarthandlectschange has to be...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990833)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990833 advisory. In the Linux kernel, the following vulnerability has been resolved: tcp: Fix shift-out-of-bounds in dctcpupdatealpha. In dctcpupdatealpha, we use a module parameter...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990832)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990832 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make ICCSGIEL1 undef in the absence of a vGICv3 On a system with a GICv3, if a guest...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990779)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990779 advisory. In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Fix zero-division error when disabling tc cbs The commit b8c43360f6e4 net: stmmac: N...

kernel: cachestat: fix page cache statistics permission checking

In the Linux kernel, the following vulnerability has been resolved: cachestat: fix page cache statistics permission checking When the 'cachestat' system call was added in commit cf264e1329fb "cachestat: implement cachestat syscall", it was meant to be a much more convenient and performant version...

kernel: net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.

In the Linux kernel, the following vulnerability has been resolved: net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. SIOCBRDELIF is passed to devioctl first and later forwarded to brioctlcall, which causes unnecessary RTNL dance and the splat below 0 under RTNL pressure. Let's say Thread A...

kernel: padata: fix UAF in padata_reorder

A use-after-free vulnerability was found in the Linux kernel's padata subsystem, in the padatareorder function. Caused by improper synchronization controls, this vulnerability can occur when a reference-counted data structure pd is decremented in one thread, freeing it, while another thread still...

kernel: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmsmac: add gain range check to wlcphyiqcalgainparamsnphy In 'wlcphyiqcalgainparamsnphy', add gain range check to WARN instead of possible out-of-bounds 'tbliqcalgainparamsnphy' access. Compile tested only. Found by Linux...

kernel: x86/tdx: Fix "in-kernel MMIO" check

A flaw was found in the Linux kernel. Userspace can deceive the kernel into performing MMIO Memory-Mapped IO operations in TDX Trust Domain Extensions on its behalf, allowing a VE Virtualization Exception to be incorrectly handled as a in-kernel MMIO operation...

kernel: linux/dim: Fix divide by 0 in RDMA DIM

In the Linux kernel, the following vulnerability has been resolved: linux/dim: Fix divide by 0 in RDMA DIM Fix a divide 0 error in rdmadimstatscompare when prev-cperatio == 0. CallTrace: Hardware name: H3C R4900 G3/RS33M2C9S, BIOS 2.00.37P21 03/12/2020 task: ffff880194b78000 task.stack:...

kernel: io_uring/uring_cmd: unconditionally copy SQEs at prep time

No description is available for this CVE...

kernel: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data()

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: stream-ipc: Check for cstream nullity in sofipcmsgdata The nullity of sps-cstream should be checked similarly as it is done in sofsetstreamdataoffset function. Assuming that it is not NULL if sps-stream is NULL is...

kernel: RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix mlx5pollone curqp update flow When curqp isn't NULL, in order to avoid fetching the QP from the radix tree again we check if the next cqe QP is identical to the one we already have. The bug however is that we are...

kernel: nfsd: release svc_expkey/svc_export with rcu_work

In the Linux kernel, the following vulnerability has been resolved: nfsd: release svcexpkey/svcexport with rcuwork The last reference for cachehead can be reduced to zero in cshow and eshowusing rcureadlock and rcureadunlock. Consequently, svcexportput and expkeyput will be invoked, leading to tw...

kernel: nfsd: clear acl_access/acl_default after releasing them

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear aclaccess/acldefault after releasing them If getting acldefault fails, aclaccess and acldefault will be released simultaneously. However, aclaccess will still retain a pointer pointing to the released posixacl, which...

kernel: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl

In the Linux kernel, the following vulnerability has been resolved: acpi: nfit: vmalloc-out-of-bounds Read in acpinfitctl Fix an issue detected by syzbot with KASAN: BUG: KASAN: vmalloc-out-of-bounds in cmdtofunc drivers/acpi/nfit/ core.c:416 inline BUG: KASAN: vmalloc-out-of-bounds in...

kernel: vrf: use RCU protection in l3mdev_l3_out()

A use-after-free vulnerability was found in the Linux kernel. l3mdevl3out can be called without RCU being held, causing damage to the availability of the system...

kernel: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period

In the Linux kernel, the following vulnerability has been resolved: iouring/eventfd: ensure ioeventfdsignal defers another RCU period ioeventfddosignal is invoked from an RCU callback, but when dropping the reference to the ioevfd, it calls ioeventfdfree directly if the refcount drops to zero. Th...