CVE-2025-37746

CVE-2025-37746 affects the Linux kernel (perf/dwc_pcie). During platform_device_register, using struct device pci_dev as platform_data caused a kmemdup copy of pci_dev; accessing the duplicated device leads to list corruption since the mutex content (e.g., list, magic) remains identical to the or...

CVE-2025-37745

CVE-2025-37745 : Linux kernel vulnerability in the hibernate subsystem where a write to /sys/module/hibernate/parameters/compressor could deadlock with ieee80211 device registration. The root cause is a potential deadlock involving system_transition_mutex held under param_lock in hibernate_compre...

CVE-2025-37745 PM: hibernate: Avoid deadlock in hibernate_compressor_param_set()

In the Linux kernel, the following vulnerability has been resolved: PM: hibernate: Avoid deadlock in hibernatecompressorparamset syzbot reported a deadlock in locksystemsleep see below. The write operation to "/sys/module/hibernate/parameters/compressor" conflicts with the registration of ieee802...

CVE-2025-37742

CVE-2025-37742 : In the Linux kernel, the jfs_imap diMount path allocates imap with kmalloc and fails to initialize it, causing uninit-value usage in hex_dump_to_buffer and a KMSAN report during mount/evict paths. Root cause: imap is not initialized after memory allocation. Remediation: replace k...

CVE-2025-37740 jfs: add sanity check for agwidth in dbMount

In the Linux kernel, the following vulnerability has been resolved: jfs: add sanity check for agwidth in dbMount The width in dmapctl of the AG is zero, it trigger a divide error when calculating the control page level in dbAllocAG. To avoid this issue, add a check for agwidth in dbAllocAG...

CVE-2025-37741

CVE-2025-37741 affects the Linux kernel JFS, where a race/locking path can lead to a deadlock in diFree when nlink is incorrectly derived as 0. Root cause: during inode handling for iag creation, a corrupted metapage can cause dinode’s nlink to be copied as 0, triggering diFree and a deadlock seq...

CVE-2025-23163

CVE-2025-23163 relates to a Linux kernel issue in VLAN handling: net: vlan: don't propagate flags on open. The root cause is a possible deadlock when opening VLAN devices due to the device instance lock, where a task may try to acquire dev->lock while already holding it (seen in dev_open + dev...

CVE-2025-23163 net: vlan: don't propagate flags on open

In the Linux kernel, the following vulnerability has been resolved: net: vlan: don't propagate flags on open With the device instance lock, there is now a possibility of a deadlock: 1.211455 ============================================ 1.211571 WARNING: possible recursive locking detected 1.21168...

CVE-2025-23161

CVE-2025-23161 : In the Linux kernel, the PCI vmd driver fixed a lock context issue by changing vmd_dev::cfg_lock from spinlock_t to raw_spinlock_t so it can be used with interrupts disabled in PREEMPT_RT contexts. This avoids a sleeping-lock scenario when accessing PCI config space via pci_ops r...

CVE-2025-23162 drm/xe/vf: Don't try to trigger a full GT reset if VF

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Don't try to trigger a full GT reset if VF VFs don't have access to the GDRST0x941c register that driver uses to reset a GT. Attempt to trigger a reset using debugfs: $ cat...

CVE-2025-23160 media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization On Mediatek devices with a system companion processor SCP the mtkscp structure has to be removed explicitly to avoid a resource leak. Fre...

CVE-2025-23159 media: venus: hfi: add a check to handle OOB in sfr region

In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add a check to handle OOB in sfr region sfr-bufsize is in shared memory and can be modified by malicious user. OOB write is possible when the size is made higher than actual sfr data buffer. Cap the size to...

CVE-2025-23157 media: venus: hfi_parser: add check to avoid out of bound access

In the Linux kernel, the following vulnerability has been resolved: media: venus: hfiparser: add check to avoid out of bound access There is a possibility that initcodecs is invoked multiple times during manipulated payload from video firmware. In such case, if codecscount can get incremented to...

CVE-2025-23156

The CVE-2025-23156 vulnerability affects the Linux kernel’s media: venus: hfi_parser component. It is caused by a potential out-of-bounds access when parsing a payload’s words_count and data pointers; when words_count reaches the last word, data may read beyond the total payload. The issue is mit...

CVE-2025-23156 media: venus: hfi_parser: refactor hfi packet parsing logic

In the Linux kernel, the following vulnerability has been resolved: media: venus: hfiparser: refactor hfi packet parsing logic wordscount denotes the number of words in total payload, while data points to payload of various property within it. When wordscount reaches last word, data can access...

CVE-2025-23155

The CVE-2025-23155 issue affects the Linux kernel’s STMicroelectronics stmmac driver. In stmmac_request_irq_multi_msi(), a pointer to the stack variable cpu_mask is passed to irq_set_affinity_hint(), which is stored in irq_desc->affinity_hint. After the function returns, the pointer becomes da...

CVE-2025-23155 net: stmmac: Fix accessing freed irq affinity_hint

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Fix accessing freed irq affinityhint In stmmacrequestirqmultimsi, a pointer to the stack variable cpumask is passed to irqsetaffinityhint. This value is stored in irqdesc-affinityhint, but once stmmacrequestirqmultim...

CVE-2025-23153

The CVE-2025-23153 entry is confirmed with concrete details in connected sources: Linux kernel affected area is arm/crc-t10dif, where a bug caused an out-of-scope array access in crc_t10dif_arch(). The issue is fixed by the patch(es) referenced from kernel stable commits, addressing the use-after...

CVE-2025-23153 arm/crc-t10dif: fix use of out-of-scope array in crc_t10dif_arch()

In the Linux kernel, the following vulnerability has been resolved: arm/crc-t10dif: fix use of out-of-scope array in crct10difarch Fix a silly bug where an array was used outside of its scope...

CVE-2025-23154 io_uring/net: fix io_req_post_cqe abuse by send bundle

In the Linux kernel, the following vulnerability has been resolved: iouring/net: fix ioreqpostcqe abuse by send bundle 114.987980 T5313 WARNING: CPU: 6 PID: 5313 at iouring/iouring.c:872 ioreqpostcqe+0x12e/0x4f0 114.991597 T5313 RIP: 0010:ioreqpostcqe+0x12e/0x4f0 115.001880 T5313 Call Trace:...