CVE-2025-23162 drm/xe/vf: Don't try to trigger a full GT reset if VF

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Don't try to trigger a full GT reset if VF VFs don't have access to the GDRST0x941c register that driver uses to reset a GT. Attempt to trigger a reset using debugfs: $ cat...

CVE-2025-23160 media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization On Mediatek devices with a system companion processor SCP the mtkscp structure has to be removed explicitly to avoid a resource leak. Fre...

CVE-2025-23159 media: venus: hfi: add a check to handle OOB in sfr region

In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add a check to handle OOB in sfr region sfr-bufsize is in shared memory and can be modified by malicious user. OOB write is possible when the size is made higher than actual sfr data buffer. Cap the size to...

CVE-2025-23157 media: venus: hfi_parser: add check to avoid out of bound access

In the Linux kernel, the following vulnerability has been resolved: media: venus: hfiparser: add check to avoid out of bound access There is a possibility that initcodecs is invoked multiple times during manipulated payload from video firmware. In such case, if codecscount can get incremented to...

CVE-2025-23156

The CVE-2025-23156 vulnerability affects the Linux kernel’s media: venus: hfi_parser component. It is caused by a potential out-of-bounds access when parsing a payload’s words_count and data pointers; when words_count reaches the last word, data may read beyond the total payload. The issue is mit...

CVE-2025-23156 media: venus: hfi_parser: refactor hfi packet parsing logic

In the Linux kernel, the following vulnerability has been resolved: media: venus: hfiparser: refactor hfi packet parsing logic wordscount denotes the number of words in total payload, while data points to payload of various property within it. When wordscount reaches last word, data can access...

CVE-2025-23155

The CVE-2025-23155 issue affects the Linux kernel’s STMicroelectronics stmmac driver. In stmmac_request_irq_multi_msi(), a pointer to the stack variable cpu_mask is passed to irq_set_affinity_hint(), which is stored in irq_desc->affinity_hint. After the function returns, the pointer becomes da...

CVE-2025-23155 net: stmmac: Fix accessing freed irq affinity_hint

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Fix accessing freed irq affinityhint In stmmacrequestirqmultimsi, a pointer to the stack variable cpumask is passed to irqsetaffinityhint. This value is stored in irqdesc-affinityhint, but once stmmacrequestirqmultim...

CVE-2025-23153

The CVE-2025-23153 entry is confirmed with concrete details in connected sources: Linux kernel affected area is arm/crc-t10dif, where a bug caused an out-of-scope array access in crc_t10dif_arch(). The issue is fixed by the patch(es) referenced from kernel stable commits, addressing the use-after...

CVE-2025-23154 io_uring/net: fix io_req_post_cqe abuse by send bundle

In the Linux kernel, the following vulnerability has been resolved: iouring/net: fix ioreqpostcqe abuse by send bundle 114.987980 T5313 WARNING: CPU: 6 PID: 5313 at iouring/iouring.c:872 ioreqpostcqe+0x12e/0x4f0 114.991597 T5313 RIP: 0010:ioreqpostcqe+0x12e/0x4f0 115.001880 T5313 Call Trace:...

CVE-2025-23153 arm/crc-t10dif: fix use of out-of-scope array in crc_t10dif_arch()

In the Linux kernel, the following vulnerability has been resolved: arm/crc-t10dif: fix use of out-of-scope array in crct10difarch Fix a silly bug where an array was used outside of its scope...

CVE-2025-23152

CVE-2025-23152 affects the Linux kernel on arm64, where the bug was in arm64/crc-t10dif: out-of-scope array usage in crc_t10dif_arch(). A fix was applied in the kernel, described as correcting an array used outside its scope. Connected advisories/patch references include kernel commits (stable) a...

CVE-2025-23151

Technical details for CVE-2025-23151 are not provided in the connected documents. The initial description mentions a Linux kernel fix for an MHI bus/host race, but there are no specifics on affected products, vectors, or remediation in the supplied sources. Monitor for updates.

CVE-2025-23151 bus: mhi: host: Fix race between unprepare and queue_buf

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Fix race between unprepare and queuebuf A client driver may use mhiunpreparefromtransfer to quiesce incoming data during the client driver's tear down. The client driver might also be processing data at the same...

CVE-2025-23150 ext4: fix off-by-one error in do_split

In the Linux kernel, the following vulnerability has been resolved: ext4: fix off-by-one error in dosplit Syzkaller detected a use-after-free issue in ext4insertdentry that was caused by out-of-bounds access due to incorrect splitting in dosplit. BUG: KASAN: use-after-free in...

CVE-2025-23148

The CVE-2025-23148 issue applies to the Linux kernel: the Samsung Exynos chipid driver (exynos_chipid_probe) now checks soc_dev_attr->revision for NULL to prevent NULL-pointer dereference. This fixes a potential local dereference vulnerability. The fix mirrors a prior NULL-pointer dereference ...

CVE-2025-23147

CVE-2025-23147 : Linux kernel i3c master/IBI handling vulnerability where an IBI can arrive before the target driver is probed, causing a NULL dereference in dev->ibi and a kernel panic. Affected component is the I3C master queue path (i3c_master_queue_ibi()); root cause is uninitialized dev-&...

CVE-2025-23147 i3c: Add NULL pointer check in i3c_master_queue_ibi()

In the Linux kernel, the following vulnerability has been resolved: i3c: Add NULL pointer check in i3cmasterqueueibi The I3C master driver may receive an IBI from a target device that has not been probed yet. In such cases, the master calls i3cmasterqueueibi to queue an IBI work task, leading to...

CVE-2025-23145

Summary (CVE-2025-23145) : Linux kernel MPTCP component fix for a NULL pointer dereference in can_accept_new_subflow when subflow_req->msk is NULL. The issue could occur when a SYN-ACK is received twice in quick succession and the ownership of subflow_req->msk is transferred to the first su...

CVE-2025-23145 mptcp: fix NULL pointer in can_accept_new_subflow

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix NULL pointer in canacceptnewsubflow When testing valkey benchmark tool with MPTCP, the kernel panics in 'mptcpcanacceptnewsubflow' because subflowreq-msk is NULL. Call trace: mptcpcanacceptnewsubflow...