CVE-2025-37794

In CVE-2025-37794, the Linux kernel Wi‑Fi stack (mac80211) could purge the vif TX queue too late during ieee80211_do_stop(), allowing SKBs from the vif’s txq to be dequeued and processed after SDATA_STATE_RUNNING is cleared. This could occur due to a concurrent schedule_and_wake_txq path that deq...

CVE-2025-37794 wifi: mac80211: Purge vif txq in ieee80211_do_stop()

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Purge vif txq in ieee80211dostop After ieee80211dostop SKB from vif's txq could still be processed. Indeed another concurrent vif scheduleandwaketxq call could cause those packets to be dequeued see...

CVE-2025-37795

...

CVE-2025-37793 ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe()

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix null-ptr-deref in avscomponentprobe devmkasprintf returns NULL when memory allocation fails. Currently, avscomponentprobe does not check for this case, which results in a NULL pointer dereference...

CVE-2025-37792 Bluetooth: btrtl: Prevent potential NULL dereference

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: Prevent potential NULL dereference The btrtlinitialize function checks that rtlloadfile either had an error or it loaded a zero length file. However, if it loaded a zero length file then the error code is not se...

CVE-2025-37790

The CVE-2025-37790 issue concerns the Linux kernel: specifically the net: mctp: Set SOCK_RCU_FREE path where a socket could disappear during a Bind lookup that runs under RCU. The vulnerability arises from the Bind lookup performing operations under RCU, potentially leading to use-after-free scen...

CVE-2025-37787

CVE-2025-37787 affects the Linux kernel in the mv88e6xxx DSA driver. The issue arises when unbinding the driver: a NULL devlink global region pointer is passed to devlink_region_destroy(), causing a NULL-tolerant crash. The root cause is that some devlink regions (MV88E6XXX_REGION_STU and MV88E6X...

CVE-2025-37786

CVE-2025-37786 affects the Linux kernel's DSA (distributed switch architecture) routing-table handling. When a tree probe completes with complete = true and a later step fails, dst->rtable entries may remain referencing freed ports, causing a use-after-free. The advisory explains that on probe...

CVE-2025-37783 drm/msm/dpu: Fix error pointers in dpu_plane_virtual_atomic_check

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Fix error pointers in dpuplanevirtualatomiccheck The function dpuplanevirtualatomiccheck was dereferencing pointers returned by drmatomicgetplanestate without checking for errors. This could lead to undefined behavio...

CVE-2025-37781

CVE-2025-37781 affects the Linux kernel involving the i2c Cros EC tunnel. When i2c-cros-ec-tunnel and the EC driver are built-in, the EC parent device may not be found, causing a NULL pointer dereference. The issue can be reproduced by unbinding the controller driver and re-loading the i2c-cros-e...

CVE-2025-37779

CVE-2025-37779 concerns the Linux kernel’s lib/iov_iter.c and arises from an incorrect refcount fix for non-slab folio pages used in EROFS/v9fs p9 read paths. The root cause is that pages in a bvec can be coalesced across folio boundaries, and the non-slab folio refcount was not increased suffici...

CVE-2025-37780 isofs: Prevent the use of too small fid

In the Linux kernel, the following vulnerability has been resolved: isofs: Prevent the use of too small fid syzbot reported a slab-out-of-bounds Read in isofsfhtoparent. 1 The handlebytes value passed in by the reproducing program is equal to 12. In handletopath, only 12 bytes of memory are...

CVE-2025-37777

CVE-2025-37777: In the Linux kernel ksmbd path, a use-after-free could occur in __smb2_lease_break_noti() when the connection is disconnected, because ksmbd_conn_write may touch freed structures if conn->ksmbd_transport is already freed. The fix moves the tcp_transport free to ksmbd_conn_free,...

CVE-2025-37776

CVE-2025-37776 : In the Linux kernel, ksmbd has a use-after-free in smb_break_all_levII_oplock() caused by a race when unlocking in the middle of the loop. A patch adds a read lock to protect the whole loop. This vulnerability has a local attack vector with high impact (C/H/I/A) per CVSS v3.1, an...

CVE-2025-37775

CVE-2025-37775 affects the Linux kernel in the ksmbd component. The issue centers on a warning in __kernel_write_iter that could relate to directory write attempts; the patch stabilizes behavior by not allowing writes to directories, as described in the initial advisory. The vulnerability is addr...

CVE-2025-37775 ksmbd: fix the warning from __kernel_write_iter

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix the warning from kernelwriteiter 2110.972290 ------------ cut here ------------ 2110.972301 WARNING: CPU: 3 PID: 735 at fs/readwrite.c:599 kernelwriteiter+0x21b/0x280 This patch doesn't allow writing to directory...

CVE-2025-37776 ksmbd: fix use-after-free in smb_break_all_levII_oplock()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smbbreakalllevIIoplock There is a room in smbbreakalllevIIoplock that can cause racy issues when unlocking in the middle of the loop. This patch use read lock to protect whole loop...

CVE-2025-37774 slab: ensure slab->obj_exts is clear in a newly allocated slab page

In the Linux kernel, the following vulnerability has been resolved: slab: ensure slab-objexts is clear in a newly allocated slab page ktest recently reported crashes while running several buffered io tests with alloctaggingslaballochook at the top of the crash call stack. The signature indicates ...

CVE-2025-37773 virtiofs: add filesystem context source name check

In the Linux kernel, the following vulnerability has been resolved: virtiofs: add filesystem context source name check In certain scenarios, for example, during fuzz testing, the source name may be NULL, which could lead to a kernel panic. Therefore, an extra check for the source name should be...

CVE-2025-37772

CVE-2025-37772 – Linux kernel RDMA CMA workqueue race condition. The vulnerability arises when multiple rapid calls to cma_netevent_callback() enqueue cma_netevent_work_handler() for the same rdma_cm_id, potentially overwriting a previously scheduled work item due to reusing the rdma_cm_id’s net_...