CVE-2025-40301

The CVE-2025-40301 issue concerns the Linux kernel Bluetooth stack. In hci_cmd_complete_evt(), when an unknown command opcode is reported, the code may treat the first byte of remaining skb->data as the return status. If parameters were already pulled in hci_event_func(), skb may be empty, cau...

CVE-2025-40301

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate skb length for unknown CC opcode In hcicmdcompleteevt, if the command complete event has an unknown opcode, we assume the first byte of the remaining skb-data contains the return status. However,...

CVE-2025-40301 Bluetooth: hci_event: validate skb length for unknown CC opcode

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate skb length for unknown CC opcode In hcicmdcompleteevt, if the command complete event has an unknown opcode, we assume the first byte of the remaining skb-data contains the return status. However,...

CVE-2025-40294

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix OOB access in parseadvmonitorpattern In the parseadvmonitorpattern function, the value of the 'length' variable is currently limited to HCIMAXEXTADLENGTH251. The size of the 'value' array in the mgmtadvpatter...

CVE-2025-40294 Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix OOB access in parseadvmonitorpattern In the parseadvmonitorpattern function, the value of the 'length' variable is currently limited to HCIMAXEXTADLENGTH251. The size of the 'value' array in the mgmtadvpatter...

CVE-2025-40294 Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix OOB access in parseadvmonitorpattern In the parseadvmonitorpattern function, the value of the 'length' variable is currently limited to HCIMAXEXTADLENGTH251. The size of the 'value' array in the mgmtadvpatter...

CVE-2025-40294

CVE-2025-40294 concerns the Linux kernel Bluetooth MGMT path (parse_adv_monitor_pattern). The vulnerability stems from an OOB read when copying the patterns array: length is capped at 251 while the corresponding value buffer is only 31 bytes, allowing out-of-bounds access if pattern[i].length exc...

CVE-2025-40294 Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix OOB access in parseadvmonitorpattern In the parseadvmonitorpattern function, the value of the 'length' variable is currently limited to HCIMAXEXTADLENGTH251. The size of the 'value' array in the mgmtadvpatter...

CVE-2025-40292

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix received length check in big packets Since commit 4959aebba8c0 "virtio-net: use mtu size as buffer length for big packets", when guest gso is off, the allocated size for big packets is not MAXSKBFRAGS PAGESIZE...

CVE-2025-40292 virtio-net: fix received length check in big packets

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix received length check in big packets Since commit 4959aebba8c0 "virtio-net: use mtu size as buffer length for big packets", when guest gso is off, the allocated size for big packets is not MAXSKBFRAGS PAGESIZE...

CVE-2025-40292

The CVE-2025-40292 issue is in the Linux kernel virtio-net receive path. When guest GSO is off, the allocation size for large packets is now MTU-dependent (not MAX_SKB_FRAGS * PAGE_SIZE) and tracked in vi->big_packets_num_skbfrags. If the host’s announced RX buffer length is incorrect, a lengt...

CVE-2025-40292 virtio-net: fix received length check in big packets

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix received length check in big packets Since commit 4959aebba8c0 "virtio-net: use mtu size as buffer length for big packets", when guest gso is off, the allocated size for big packets is not MAXSKBFRAGS PAGESIZE...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an unverified skb length that could lead to the use of uninitialized memory...

PT-2025-49433

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's Bluetooth implementation within the hci cmd complete evt function. Specifically, the code does not validate the length of the socket buffer skb before...

PT-2025-49425

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the virtio-net component of the Linux kernel related to the handling of received packet lengths in large packets. A change introduced by commit 4959aebba8c0 altered how...

Linux Distros Unpatched Vulnerability : CVE-2023-53761

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - USB: usbtmc: Fix direction for 0-length ioctl control messages The syzbot fuzzer found a problem in the usbtmc driver: When a user submits an ioctl for a 0-leng...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a zero-length mapping allowed by the pciendpointtest driver, which could lead to a kernel crash...

PT-2025-49427

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s Bluetooth implementation within the parse adv monitor pattern function. The issue involves a potential out-of-bounds access when copying data into the...

PT-2025-49455

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.0.0-rc1rpci-dev+ 237 Description The Linux kernel contained a flaw in the pci endpoint test module where the dma map single function did not properly handle zero-length mappings, leading to a potential kernel...

Linux Distros Unpatched Vulnerability : CVE-2022-50614

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - misc: pciendpointtest: Fix pciendpointtestcopy,write,read panic The dmamapsingle doesn't permit zero length mapping. It causes a follow panic. A panic was...