CVE-2025-38193

CVE-2025-38193 affects the Linux kernel net_sched SFQ (sch_sfq). The issue is a missing range check on perturb_period, which can enable a race condition; patches fix perturb_period overflow/invalid values. Public demonstrations show negative, oversized, and a valid perturb value (2000000), with t...

CVE-2025-38194 jffs2: check that raw node were preallocated before writing summary

In the Linux kernel, the following vulnerability has been resolved: jffs2: check that raw node were preallocated before writing summary Syzkaller detected a kernel bug in jffs2linknoderef, caused by fault injection in jffs2preallocrawnoderefs. jffs2sumwritesumnode doesn't check return value of...

CVE-2025-38194 jffs2: check that raw node were preallocated before writing summary

In the Linux kernel, the following vulnerability has been resolved: jffs2: check that raw node were preallocated before writing summary Syzkaller detected a kernel bug in jffs2linknoderef, caused by fault injection in jffs2preallocrawnoderefs. jffs2sumwritesumnode doesn't check return value of...

CVE-2025-38193

In the Linux kernel, the following vulnerability has been resolved: netsched: schsfq: reject invalid perturb period Gerrard Tai reported that SFQ perturbperiod has no range check yet, and this can be used to trigger a race condition fixed in a separate patch. We want to make sure ctl-perturbperio...

CVE-2025-38192 net: clear the dst when changing skb protocol

In the Linux kernel, the following vulnerability has been resolved: net: clear the dst when changing skb protocol A not-so-careful NAT46 BPF program can crash the kernel if it indiscriminately flips ingress packets from v4 to v6: BUG: kernel NULL pointer dereference, address: 0000000000000000...

CVE-2025-38192

CVE-2025-38192 is a Linux kernel vulnerability where an ingress NAT46 BPF program that flips IPv4/IPv6 can mutate skb->protocol to v6 while the dst remains IPv4, leading to a NULL pointer dereference in ip6_rcv_core. The fix is to clear the destination (dst) in all BPF helpers that change skb-...

CVE-2025-38191

Summary: The Linux kernel ksmbd component has a null-pointer dereference in destroy_previous_session during Kerberos session setup when PreviousSessionId is used. The root cause is that sess->user is not yet set, allowing a NULL user to be passed to destroy_previous_session. Fix: The patch def...

CVE-2025-38190

In the Linux kernel, the following vulnerability has been resolved: atm: Revert atmaccounttx if copyfromiterfull fails. In vccsendmsg, we account skb-truesize to sk-skwmemalloc by atmaccounttx. It is expected to be reverted by atmpopraw later called by vcc-dev-ops-sendvcc, skb. However, vccsendms...

CVE-2025-38190

CVE-2025-38190 affects the Linux kernel ATM path. The issue arises when in the vcc_sendmsg() path, skb->truesize is accounted to sk_wmem_alloc via atm_account_tx(), but the corresponding revert is not performed on copy_from_iter_full() failure, potentially leaking a socket. The fixed approach ...

CVE-2025-38191 ksmbd: fix null pointer dereference in destroy_previous_session

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in destroyprevioussession If client set -PreviousSessionId on kerberos session setup stage, NULL pointer dereference error will happen. Since sess-user is not set yet, It can pass the user...

CVE-2025-38191 ksmbd: fix null pointer dereference in destroy_previous_session

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in destroyprevioussession If client set -PreviousSessionId on kerberos session setup stage, NULL pointer dereference error will happen. Since sess-user is not set yet, It can pass the user...

CVE-2025-38190 atm: Revert atm_account_tx() if copy_from_iter_full() fails.

In the Linux kernel, the following vulnerability has been resolved: atm: Revert atmaccounttx if copyfromiterfull fails. In vccsendmsg, we account skb-truesize to sk-skwmemalloc by atmaccounttx. It is expected to be reverted by atmpopraw later called by vcc-dev-ops-sendvcc, skb. However, vccsendms...

CVE-2025-38189

Technical details about CVE-2025-38189 are not publicly available in the provided Connected documents. The available Initial description contains some information, but no specific affected product/version or impact is confirmed here. Monitor for updated disclosures.

CVE-2025-38189 drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Avoid NULL pointer dereference in v3djobupdatestats The following kernel Oops was recently reported by Mesa CI: 800.139824 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000588 800.148619 M...

CVE-2025-38188

CVE-2025-38188 affects the Linux kernel DRM MSM (a7xx) path. The vulnerability arises from missing CP_RESET_CONTEXT_STATE handling when switching contexts, risking userspace submissions in one context causing another context to hang (DoS) without data leakage. The fix ensures CP_RESET_CONTEXT_STA...

CVE-2025-38188 drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a7xx: Call CPRESETCONTEXTSTATE Calling this packet is necessary when we switch contexts because there are various pieces of state used by userspace to synchronize between BR and BV that are persistent across submits and w...

CVE-2025-38187 drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix a use-after-free in r535gsprpcpush The RPC container is released after being passed to r535gsprpcsend. When sending the initial fragment of a large RPC and passing the caller's RPC container, the container will b...

CVE-2025-38188 drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a7xx: Call CPRESETCONTEXTSTATE Calling this packet is necessary when we switch contexts because there are various pieces of state used by userspace to synchronize between BR and BV that are persistent across submits and w...

CVE-2025-38187

Root-cause: In Linux kernel DRM Nouveau, a use-after-free occurs when sending large RPC fragments because the RPC container is freed prematurely after being passed to r535_gsp_rpc_send(). Fix: allocate a temporary RPC container for the initial fragment and free the caller’s container only after a...

CVE-2025-38187

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix a use-after-free in r535gsprpcpush The RPC container is released after being passed to r535gsprpcsend. When sending the initial fragment of a large RPC and passing the caller's RPC container, the container will b...