CVE-2025-23132 f2fs: quota: fix to avoid warning in dquot_writeback_dquots()

In the Linux kernel, the following vulnerability has been resolved: f2fs: quota: fix to avoid warning in dquotwritebackdquots F2FS-fs dm-59: checkpoint=enable has some unwritten data. ------------ cut here ------------ WARNING: CPU: 6 PID: 8013 at fs/quota/dquot.c:691...

CVE-2025-23132 f2fs: quota: fix to avoid warning in dquot_writeback_dquots()

In the Linux kernel, the following vulnerability has been resolved: f2fs: quota: fix to avoid warning in dquotwritebackdquots F2FS-fs dm-59: checkpoint=enable has some unwritten data. ------------ cut here ------------ WARNING: CPU: 6 PID: 8013 at fs/quota/dquot.c:691...

CVE-2025-22126 md: fix mddev uaf while iterating all_mddevs list

In the Linux kernel, the following vulnerability has been resolved: md: fix mddev uaf while iterating allmddevs list While iterating allmddevs list from mdnotifyreboot and mdexit, listforeachentrysafe is used, and this can race with deletint the next mddev, causing UAF: t1: spinlock...

CVE-2025-22126 md: fix mddev uaf while iterating all_mddevs list

In the Linux kernel, the following vulnerability has been resolved: md: fix mddev uaf while iterating allmddevs list While iterating allmddevs list from mdnotifyreboot and mdexit, listforeachentrysafe is used, and this can race with deletint the next mddev, causing UAF: t1: spinlock...

CVE-2025-22122 block: fix adding folio to bio

In the Linux kernel, the following vulnerability has been resolved: block: fix adding folio to bio 4GB folio is possible on some ARCHs, such as aarch64, 16GB hugepage is supported, then 'offset' of folio can't be held in 'unsigned int', cause warning in bioaddfolionofail and IO failure. Fix it by...

CVE-2025-22122 block: fix adding folio to bio

In the Linux kernel, the following vulnerability has been resolved: block: fix adding folio to bio 4GB folio is possible on some ARCHs, such as aarch64, 16GB hugepage is supported, then 'offset' of folio can't be held in 'unsigned int', cause warning in bioaddfolionofail and IO failure. Fix it by...

CVE-2025-22122

MODE C: The CVE-2025-22122 issue affects the Linux kernel where adding a folio to a bio could overflow the bi_offset when large folios are used (e.g., >4GB folio on ARCHs with 16GB hugepages like aarch64). The root cause is that the offset could not be represented in an unsigned int, triggerin...

CVE-2025-22120

CVE-2025-22120 affects the Linux kernel ext4: in ext4_setattr(), a jump to the right label out_mmap_sem may occur. If ext4_inode_attach_jinode() fails, filemap_invalidate_unlock() may not be called to unlock mapping->invalidate_lock, leading to a hung task (as shown by the given EXT4-fs error ...

CVE-2025-22118 ice: validate queue quanta parameters to prevent OOB access

In the Linux kernel, the following vulnerability has been resolved: ice: validate queue quanta parameters to prevent OOB access Add queue wraparound prevention in quanta configuration. Ensure endqid does not overflow by validating startqid and numqueues...

CVE-2025-22119 wifi: cfg80211: init wiphy_work before allocating rfkill fails

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: init wiphywork before allocating rfkill fails syzbort reported a uninitialize wiphyworklock in cfg80211devfree. 1 After rfkill allocation fails, the wiphy release process will be performed, which will cause...

CVE-2025-22117 ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw()

In the Linux kernel, the following vulnerability has been resolved: ice: fix using untrusted value of pktlen in icevcfdirparseraw Fix using the untrusted value of proto-raw.pktlen in function icevcfdirparseraw by verifying if it does not exceed the VIRTCHNLMAXSIZERAWPACKET value...

CVE-2025-22116

CVE-2025-22116 affects the Linux kernel idpf driver’s netdev handling. The patch adds an error check when creating vports, logs the vport number and error code, and ensures on removal that VPORT_REG_NETDEV is checked before unregister/free. It also introduces local variables (idx, vport_config, n...

CVE-2025-22111 net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.

In the Linux kernel, the following vulnerability has been resolved: net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. SIOCBRDELIF is passed to devioctl first and later forwarded to brioctlcall, which causes unnecessary RTNL dance and the splat below 0 under RTNL pressure. Let's say Thread A...

CVE-2025-22108 bnxt_en: Mask the bd_cnt field in the TX BD properly

In the Linux kernel, the following vulnerability has been resolved: bnxten: Mask the bdcnt field in the TX BD properly The bdcnt field in the TX BD specifies the total number of BDs for the TX packet. The bdcnt field has 5 bits and the maximum number supported is 32 with the value 0...

CVE-2025-22106 vmxnet3: unregister xdp rxq info in the reset path

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: unregister xdp rxq info in the reset path vmxnet3 does not unregister xdp rxq info in the vmxnet3resetwork code path as vmxnet3rqdestroy is not invoked in this code path. So, we get below message with a backtrace. Missin...

CVE-2025-22104 ibmvnic: Use kernel helpers for hex dumps

In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Use kernel helpers for hex dumps Previously, when the driver was printing hex dumps, the buffer was cast to an 8 byte long and printed using string formatters. If the buffer size was not a multiple of 8 then a read buffe...

CVE-2025-22102 Bluetooth: btnxpuart: Fix kernel panic during FW release

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix kernel panic during FW release This fixes a kernel panic seen during release FW in a stress test scenario where WLAN and BT FW download occurs simultaneously, and due to a HW bug, chip sends out only 1...

CVE-2025-22100 drm/panthor: Fix race condition when gathering fdinfo group samples

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix race condition when gathering fdinfo group samples Commit e16635d88fa0 "drm/panthor: add DRM fdinfo support" failed to protect access to groups with an xarray lock, which could lead to use-after-free errors...

CVE-2025-22099 drm: xlnx: zynqmp_dpsub: Add NULL check in zynqmp_audio_init

In the Linux kernel, the following vulnerability has been resolved: drm: xlnx: zynqmpdpsub: Add NULL check in zynqmpaudioinit devmkasprintf calls can return null pointers on failure. But some return values were not checked in zynqmpaudioinit. Add NULL check in zynqmpaudioinit, avoid referencing...

CVE-2025-22097 drm/vkms: Fix use after free and double free on init error

In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Fix use after free and double free on init error If the driver initialization fails, the vkmsexit function might access an uninitialized or freed defaultconfig pointer and it might double free it. Fix both possible erro...