CVE-2025-38490

CVE-2025-38490 – Linux kernel : The vulnerability concerns the page_pool_put_full_page() call in net: libwx, where pages could be double-freed, potentially causing a kernel panic. The fix removes the duplicate page_put path so pages are reused unless freeing Rx buffers or building a skb when the ...

CVE-2025-38490 net: libwx: remove duplicate page_pool_put_full_page()

In the Linux kernel, the following vulnerability has been resolved: net: libwx: remove duplicate pagepoolputfullpage pagepoolputfullpage should only be invoked when freeing Rx buffers or building a skb if the size is too short. At other times, the pages need to be reused. So remove the redundant...

CVE-2025-38489 s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Fix bpfarchtextpoke with newaddr == NULL again Commit 7ded842b356d "s390/bpf: Fix bpfplt pointer arithmetic" has accidentally removed the critical piece of commit c730fce7c70c "s390/bpf: Fix bpfarchtextpoke with newaddr...

CVE-2025-38489

CVE-2025-38489: In the Linux kernel (s390/BPF), the on-disk description notes that bpf_arch_text_poke() with new_addr == NULL caused intermittent panics; the fix re‑instates the previously removed correction from commit c730fce7c70c, restoring the intended behavior and adding a clarifying comment...

CVE-2025-38488

The CVE-2025-38488 issue affects the Linux kernel SMB client (smb: client) where use-after-free occurs in crypt_message() when hardware crypto accelerators perform asynchronous AEAD operations. The root cause was the removal of asynchronous crypto handling (assuming synchronous crypto), causing c...

CVE-2025-38488 smb: client: fix use-after-free in crypt_message when using async crypto

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cryptmessage when using async crypto The CVE-2024-50047 fix removed asynchronous crypto handling from cryptmessage, assuming all crypto operations are synchronous. However, when hardware crypto...

CVE-2025-38487

CVE-2025-38487 relates to the Linux kernel ASPEED SoC LPC snoop driver. The vulnerability arises from disabling channels that aren’t enabled, which can lead to a NULL pointer dereference and a kernel Oops on ARM systems, as illustrated by the provided trace. The Ubuntu/Astra Linux advisory confir...

CVE-2025-38487

In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled Mitigate e.g. the following: echo 1e789080.lpc-snoop /sys/bus/platform/drivers/aspeed-lpc-snoop/unbind ... 120.363594 Unable to handle kernel NULL pointer...

CVE-2025-38487 soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled

In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled Mitigate e.g. the following: echo 1e789080.lpc-snoop /sys/bus/platform/drivers/aspeed-lpc-snoop/unbind ... 120.363594 Unable to handle kernel NULL pointer...

CVE-2025-38486

CVE-2025-38486 concerns the Linux kernel SoundWire subsystem, specifically related to reverting the commit that added set_channel_map API support for Qualcomm SoundWire. The vulnerability manifests in the soundwire_qcom path (qcom_swrm_set_channel_map) and was linked to a broken zero-th pconfig e...

CVE-2025-38485

CVE-2025-38485 affects the Linux kernel IIO FXLS8962AF accelerator driver. The flaw is a use-after-free in fxls8962af_fifo_flush where indio_dev->active_scan_mask is accessed while the device might exit buffer mode mid-interrupt, creating a race that can lead to a NULL pointer dereference. The...

CVE-2025-38485

In the Linux kernel, the following vulnerability has been resolved: iio: accel: fxls8962af: Fix use after free in fxls8962affifoflush fxls8962affifoflush uses indiodev-activescanmask with iioforeachactivechannel without making sure the indiodev stays in buffer mode. There is a race if indiodev...

CVE-2025-38484

In the Linux kernel, the following vulnerability has been resolved: iio: backend: fix out-of-bound write The buffer is set to 80 character. If a caller write more characters, count is truncated to the max available space in "simplewritetobuffer". But afterwards a string terminator is written to t...

CVE-2025-38483 comedi: das16m1: Fix bit shift out of bounds

In the Linux kernel, the following vulnerability has been resolved: comedi: das16m1: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: / only irqs 2, 3, 4, 5, 6, 7, 10, 11, 12, 14, and 15 are valid / if 1 options1 & 0xdcfc However, it-optionsi is an...

CVE-2025-38483

CVE-2025-38483 concerns the Linux kernel’s comedi das16m1 IRQ validation. The test for valid IRQs uses a bitmask check on (1 <options[1]), but it->options[i] is an unchecked int from userspace, allowing the shift amount to be negative or out of bounds. The fix adds a bounds check on it->...

CVE-2025-38483

In the Linux kernel, the following vulnerability has been resolved: comedi: das16m1: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: / only irqs 2, 3, 4, 5, 6, 7, 10, 11, 12, 14, and 15 are valid / if 1 options1 & 0xdcfc However, it-optionsi is an...

CVE-2025-38482 comedi: das6402: Fix bit shift out of bounds

In the Linux kernel, the following vulnerability has been resolved: comedi: das6402: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: / IRQs 2,3,5,6,7, 10,11,15 are valid for "enhanced" mode / if 1 options1 & 0x8cec However, it-optionsi is an...

CVE-2025-38481 comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large

In the Linux kernel, the following vulnerability has been resolved: comedi: Fail COMEDIINSNLIST ioctl if ninsns is too large The handling of the COMEDIINSNLIST ioctl allocates a kernel buffer to hold the array of struct comediinsn, getting the length from the ninsns member of the struct...

CVE-2025-38481

In the Linux kernel, the following vulnerability has been resolved: comedi: Fail COMEDIINSNLIST ioctl if ninsns is too large The handling of the COMEDIINSNLIST ioctl allocates a kernel buffer to hold the array of struct comediinsn, getting the length from the ninsns member of the struct...

CVE-2025-38481 comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large

In the Linux kernel, the following vulnerability has been resolved: comedi: Fail COMEDIINSNLIST ioctl if ninsns is too large The handling of the COMEDIINSNLIST ioctl allocates a kernel buffer to hold the array of struct comediinsn, getting the length from the ninsns member of the struct...