CVE-2025-37915 net_sched: drr: Fix double list add in class with netem as child qdisc

In the Linux kernel, the following vulnerability has been resolved: netsched: drr: Fix double list add in class with netem as child qdisc As described in Gerrard's report 1, there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of drr,...

CVE-2025-37914

In the Linux kernel, the following vulnerability has been resolved: netsched: ets: Fix double list add in class with netem as child qdisc As described in Gerrard's report 1, there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of ets,...

CVE-2025-37913 net_sched: qfq: Fix double list add in class with netem as child qdisc

In the Linux kernel, the following vulnerability has been resolved: netsched: qfq: Fix double list add in class with netem as child qdisc As described in Gerrard's report 1, there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of qfq,...

CVE-2025-37912

CVE-2025-37912 affects the Linux kernel ICE driver. The root cause is a missing null pointer check on the value returned by ice_get_vf_vsi(), which could lead to using a NULL VSI pointer in ice_vc_add_fdir_fltr(). The fix, described in commit baeb705fd6a7 ("ice: always check VF VSI pointer values...

CVE-2025-37912 ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr()

In the Linux kernel, the following vulnerability has been resolved: ice: Check VF VSI Pointer Value in icevcaddfdirfltr As mentioned in the commit baeb705fd6a7 "ice: always check VF VSI pointer values", we need to perform a null pointer check on the return value of icegetvfvsi before using it...

CVE-2025-37913

In the Linux kernel, the following vulnerability has been resolved: netsched: qfq: Fix double list add in class with netem as child qdisc As described in Gerrard's report 1, there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of qfq,...

CVE-2025-37911

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix out-of-bound memcpy during ethtool -w When retrieving the FW coredump using ethtool, it can sometimes cause memory corruption: BUG: KFENCE: memory corruption in bnxtgetcoredump+0x3ef/0x670 bnxten Corrupted memory at...

CVE-2025-37911 bnxt_en: Fix out-of-bound memcpy() during ethtool -w

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix out-of-bound memcpy during ethtool -w When retrieving the FW coredump using ethtool, it can sometimes cause memory corruption: BUG: KFENCE: memory corruption in bnxtgetcoredump+0x3ef/0x670 bnxten Corrupted memory at...

CVE-2025-37910

In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations On Adva boards, SMA sysfs store/get operations can call handlesignaloutputs or handlesignalinputs while the irig and dcf pointers are uninitialized, leading to a...

CVE-2025-37908 mm, slab: clean up slab->obj_exts always

In the Linux kernel, the following vulnerability has been resolved: mm, slab: clean up slab-objexts always When memory allocation profiling is disabled at runtime or due to an error, shutdownmemprofiling is called: slab-objexts which previously allocated remains. It won't be cleared by...

CVE-2025-37909

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Fix memleak issue when GSO enabled Always map the skb to the LS descriptor. Previously skb was mapped to EXT descriptor when the number of fragments is zero with GSO enabled. Mapping the skb to EXT descriptor preven...

CVE-2025-37908 mm, slab: clean up slab->obj_exts always

In the Linux kernel, the following vulnerability has been resolved: mm, slab: clean up slab-objexts always When memory allocation profiling is disabled at runtime or due to an error, shutdownmemprofiling is called: slab-objexts which previously allocated remains. It won't be cleared by...

CVE-2025-37907 accel/ivpu: Fix locking order in ivpu_job_submit

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix locking order in ivpujobsubmit Fix deadlock in job submission and abort handling. When a thread aborts currently executing jobs due to a fault, it first locks the global lock protecting submittedjobs 1. After the...

CVE-2025-37906 ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd

In the Linux kernel, the following vulnerability has been resolved: ublk: fix race between iouringcmdcompleteintask and ublkcancelcmd ublkcancelcmd calls iouringcmddone to complete uringcmd, but we may have scheduled task work via iouringcmdcompleteintask for dispatching request, then kernel cras...

CVE-2025-37906

In the Linux kernel, the following vulnerability has been resolved: ublk: fix race between iouringcmdcompleteintask and ublkcancelcmd ublkcancelcmd calls iouringcmddone to complete uringcmd, but we may have scheduled task work via iouringcmdcompleteintask for dispatching request, then kernel cras...

CVE-2025-37905

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Balance device refcount when destroying devices Using devicefindchild to lookup the proper SCMI device to destroy causes an unbalance in device refcount, since devicefindchild calls an implicit getdevice: this,...

CVE-2025-37904

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix the inode leak in btrfsiget BUG There is a bug report that a syzbot reproducer can lead to the following busy inode at unmount time: BTRFS info device loop1: last unmount of filesystem...

CVE-2025-37902

CVE-2025-37902 entry is rejected/not used and does not represent an active vulnerability.

CVE-2025-37900

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix two issues in iommucopystructfromuser In the review for iommucopystructtouser helper, Matt pointed out that a NULL pointer should be rejected prior to dereferencing it:...

CVE-2025-37899

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in session logoff The sess-user object can currently be in use by another thread, for example if another connection has sent a session setup request to bind to the session being free'd. The handler for...