CVE-2025-38257 s390/pkey: Prevent overflow in size calculation for memdup_user()

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Prevent overflow in size calculation for memdupuser Number of apqn target list entries contained in 'nrapqns' variable is determined by userspace via an ioctl call so the result of the product in calculation of size...

CVE-2025-38257 s390/pkey: Prevent overflow in size calculation for memdup_user()

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Prevent overflow in size calculation for memdupuser Number of apqn target list entries contained in 'nrapqns' variable is determined by userspace via an ioctl call so the result of the product in calculation of size...

CVE-2025-38256 io_uring/rsrc: fix folio unpinning

In the Linux kernel, the following vulnerability has been resolved: iouring/rsrc: fix folio unpinning syzbot complains about an unmapping failure: 108.070381 T14 kernel BUG at mm/gup.c:71! 108.070502 T14 Internal error: Oops - BUG: 00000000f2000800 1 SMP 108.123672 T14 Hardware name: QEMU KVM...

CVE-2025-38255 lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()

In the Linux kernel, the following vulnerability has been resolved: lib/groupcpus: fix NULL pointer dereference from groupcpusevenly While testing nullblk with configfs, echo 0 pollqueues will trigger following panic: BUG: kernel NULL pointer dereference, address: 0000000000000010 Oops: Oops: 000...

CVE-2025-38254

The CVE-2025-38254 issue is in the Linux kernel (drm/amd/display) where drm_edid_raw() could return NULL or oversized EDID bytes, risking an Oops or memory corruption. The fix adds sanity checks for drm_edid_raw() and returns EDID_BAD_INPUT in those corner cases. It is related to EDID handling wh...

CVE-2025-38253

CVE-2025-38253: In the Linux kernel HID driver for Wacom, wacom_aes_battery_handler() could crash if the device was removed while a pending aes_battery_work was scheduled. The fix cancels aes_battery_work in wacom_remove() to prevent a crash, addressing a use-after-free/pending-work scenario on d...

CVE-2025-38252

The CVE-2025-38252 entry concerns a Linux kernel vulnerability in the cxl/ras CPER handler device confusion. The defect stems from cxl_cper_handle_prot_err() making fragile assumptions: it may treat endpoints as CXL-Type-3 devices, assume the device is bound to the cxl_pci driver, and unnecessari...

CVE-2025-38251 atm: clip: prevent NULL deref in clip_push()

In the Linux kernel, the following vulnerability has been resolved: atm: clip: prevent NULL deref in clippush Blamed commit missed that vccdestroysocket calls clippush with a NULL skb. If clipdevs is NULL, clippush then crashes when reading skb-truesize...

CVE-2025-38250

In CVE-2025-38250, the Linux kernel Bluetooth vhci_flush() path is affected by a use-after-free when a thread closes a vhci fd while another thread uses the device. The issue stems from a missing synchronization after unlinking hdev from hci_dev_list in hci_unregister_dev(), allowing another thre...

CVE-2025-38251 atm: clip: prevent NULL deref in clip_push()

In the Linux kernel, the following vulnerability has been resolved: atm: clip: prevent NULL deref in clippush Blamed commit missed that vccdestroysocket calls clippush with a NULL skb. If clipdevs is NULL, clippush then crashes when reading skb-truesize...

CVE-2025-38248

CVE-2025-38248 : In the Linux kernel, a use-after-free flaw occurs in bridge multicast routing port handling. When per-VLAN multicast snooping is active, per-port multicast context is disabled and ports are removed from the global router port list, but can be re-added, leaving stale entries. This...

CVE-2025-38249

The CVE CVE-2025-38249 affects the Linux kernel ALSA USB-audio path (snd_usb_get_audioformat_uac3). The root cause is that the length returned by snd_usb_ctl_msg() is used directly to allocate memory and then access the buffer as a uac3_cluster_header_descriptor without verifying the buffer size....

CVE-2025-38247

CVE-2025-38247 concerns the Linux kernel: a leak of user namespaces and possibly mnt_idmap in open_tree_attr(2) due to not releasing ->mnt_userns after a positive result from want_mount_setattr(). The root cause is that finish_mount_kattr() must release the namespace, and if do_mount_setattr()...

CVE-2025-38247 userns and mnt_idmap leak in open_tree_attr(2)

In the Linux kernel, the following vulnerability has been resolved: userns and mntidmap leak in opentreeattr2 Once wantmountsetattr has returned a positive, it does require finishmountkattr to release -mntuserns. Failing domountsetattr does not change that. As the result, we can end up leaking...

CVE-2025-38246 bnxt: properly flush XDP redirect lists

In the Linux kernel, the following vulnerability has been resolved: bnxt: properly flush XDP redirect lists We encountered following crash when testing a XDPREDIRECT feature in production: 56251.579676 listadd corruption. next-prev should be prev ffff93120dd40f30, but was ffffb301ef3a6740...

CVE-2025-38245 atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().

In the Linux kernel, the following vulnerability has been resolved: atm: Release atmdevmutex after removing procfs in atmdevderegister. syzbot reported a warning below during atmdevregister. 0 Before creating a new device and procfs/sysfs for it, atmdevregister looks up a duplicated device by...

CVE-2025-38245

In the Linux kernel ATM subsystem, CVE-2025-38245 is due to releasing atm_dev_mutex before procfs/sysfs removal in atm_dev_deregister(), creating a race window where a device may still appear in procfs while the device list no longer contains it. This can trigger a splat warning during atm_dev_re...

CVE-2025-38245 atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().

In the Linux kernel, the following vulnerability has been resolved: atm: Release atmdevmutex after removing procfs in atmdevderegister. syzbot reported a warning below during atmdevregister. 0 Before creating a new device and procfs/sysfs for it, atmdevregister looks up a duplicated device by...

CVE-2025-38244 smb: client: fix potential deadlock when reconnecting channels

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential deadlock when reconnecting channels Fix cifssignalcifsdforreconnect to take the correct lock order and prevent the following deadlock from happening =====================================================...

CVE-2025-38244

The CVE-2025-38244 issue affects the Linux kernel’s SMB client, specifically the CIFS deadlock when reconnecting channels. The vulnerability stems from incorrect lock ordering in cifs_signal_cifsd_for_reconnect(), which could create a circular locking dependency among tcp_ses->srv_lock, ret_bu...