CVE-2025-22078 staging: vchiq_arm: Fix possible NPR of keep-alive thread

In the Linux kernel, the following vulnerability has been resolved: staging: vchiqarm: Fix possible NPR of keep-alive thread In case vchiqplatformconnstatechanged is never called or fails before driver removal, kathread won't be a valid pointer to a taskstruct. So do the necessary checks before...

CVE-2025-22077 Revert "smb: client: fix TCP timers deadlock after rmmod"

In the Linux kernel, the following vulnerability has been resolved: Revert "smb: client: fix TCP timers deadlock after rmmod" This reverts commit e9f2517a3e18a54a3943c098d2226b245d488801. Commit e9f2517a3e18 "smb: client: fix TCP timers deadlock after rmmod" is intended to fix a null-ptr-deref in...

CVE-2025-22074 ksmbd: fix r_count dec/increment mismatch

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix rcount dec/increment mismatch rcount is only increased when there is an oplock break wait, so rcount inc/decrement are not paired. This can cause rcount to become negative, which can lead to a problem where the ksmbd...

CVE-2025-22072

CVE-2025-22072 affects the Linux kernel spufs component, addressing leaks in gang directory lifetimes. The issue: creating a gang returns an opened gang directory that should be removed on close, but if a context belonging to that gang remains alive, removal could fail, causing a leak. The fix de...

CVE-2025-22070

The CVE-2025-22070 issue affects the Linux kernel 9P client (9p/v9fs) where mkdir could crash a mounted 9p tree when posixacl is used. Root cause: v9fs_vfs_mkdir_dotl() incorrectly passes a NULL fid to v9fs_set_create_acl(), leading to a NULL pointer dereference in v9fs_set_acl and subsequent ACL...

CVE-2025-22071

CVE-2025-22071 concerns the Linux kernel spufs subsystem. The issue is a leak in spufs_create_context() that occurs when setting CPU affinity and spufs_mkdir() fails, requiring the code to drop the reference to the neighbor. The problem was fixed by this leak remediation, with historical notes th...

CVE-2025-22069 riscv: fgraph: Fix stack layout to match __arch_ftrace_regs argument of ftrace_return_to_handler

In the Linux kernel, the following vulnerability has been resolved: riscv: fgraph: Fix stack layout to match archftraceregs argument of ftracereturntohandler Naresh Kamboju reported a "Bad frame pointer" kernel warning while running LTP trace ftracestresstest.sh in riscv. We can reproduce the sam...

CVE-2025-22068 ublk: make sure ubq->canceling is set when queue is frozen

In the Linux kernel, the following vulnerability has been resolved: ublk: make sure ubq-canceling is set when queue is frozen Now ublk driver depends on ubq-canceling for deciding if the request can be dispatched via uringcmd & iouringcmdcompleteintask. Once ubq-canceling is set, the uringcmd can...

CVE-2025-22062 sctp: add mutual exclusion in proc_sctp_do_udp_port()

In the Linux kernel, the following vulnerability has been resolved: sctp: add mutual exclusion in procsctpdoudpport We must serialize calls to sctpudpsockstop and sctpudpsockstart or risk a crash as syzbot reported: Oops: general protection fault, probably for non-canonical address...

CVE-2025-22061 net: airoha: Fix qid report in airoha_tc_get_htb_get_leaf_queue()

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix qid report in airohatcgethtbgetleafqueue Fix the following kernel warning deleting HTB offloaded leafs and/or root HTB qdisc in airohaeth driver properly reporting qid in airohatcgethtbgetleafqueue routine. $tc...

CVE-2025-22060 net: mvpp2: Prevent parser TCAM memory corruption

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: Prevent parser TCAM memory corruption Protect the parser TCAM/SRAM memory, and the cached shadow SRAM information, from concurrent modifications. Both the TCAM and SRAM tables are indirectly accessed by configuring an...

CVE-2025-22060

CVE-2025-22060 concerns the Linux kernel mvpp2 parser TCAM/SRAM memory. The issue arises when concurrent accesses to the indirect TCAM/SRAM tables via an index register are not atomic, enabling TOCTOU-like corruption when mvpp2_set_rx_mode() runs on multiple CPUs. In the described scenario, this ...

CVE-2025-22058 udp: Fix memory accounting leak.

In the Linux kernel, the following vulnerability has been resolved: udp: Fix memory accounting leak. Matt Dowling reported a weird UDP memory usage issue. Under normal operation, the UDP memory usage reported in /proc/net/sockstat remains close to zero. However, it occasionally spiked to 524,288...

CVE-2025-22057 net: decrease cached dst counters in dst_release

In the Linux kernel, the following vulnerability has been resolved: net: decrease cached dst counters in dstrelease Upstream fix ac888d58869b "net: do not delay dstentriesadd in dstrelease" moved decrementing the dst count from dstdestroy to dstrelease to avoid accessing already freed data in cas...

CVE-2025-22058

CVE-2025-22058 affects the Linux kernel UDP memory accounting. When INT_MAX was used for SO_RCVBUF, an overflow in udp_rmem_release() could wrap the total UDP memory, causing memory accounting to double after socket close and potentially leading to packet drops once rmem_alloc exceeded net.ipv4.u...

CVE-2025-22055

CVE-2025-22055 affects the Linux kernel: a vulnerability in geneve_opt length handling (5-bit length per option) can let an attacker craft a 128-byte option to cause a heap out-of-bounds read. The issue originates from Netlink policy length guarantees not enforcing the 128-byte bound. The provide...

CVE-2025-22055 net: fix geneve_opt length integer overflow

In the Linux kernel, the following vulnerability has been resolved: net: fix geneveopt length integer overflow struct geneveopt uses 5 bit length for each single option, which means every vary size option should be smaller than 128 bytes. However, all current related Netlink policies cannot promi...

CVE-2025-22055 net: fix geneve_opt length integer overflow

In the Linux kernel, the following vulnerability has been resolved: net: fix geneveopt length integer overflow struct geneveopt uses 5 bit length for each single option, which means every vary size option should be smaller than 128 bytes. However, all current related Netlink policies cannot promi...

CVE-2025-22053 net: ibmveth: make veth_pool_store stop hanging

In the Linux kernel, the following vulnerability has been resolved: net: ibmveth: make vethpoolstore stop hanging v2: - Created a single error handling unlock and exit in vethpoolstore - Greatly expanded commit message with previous explanatory-only text Summary: Use rtnlmutex to synchronize...

CVE-2025-22054 arcnet: Add NULL check in com20020pci_probe()

In the Linux kernel, the following vulnerability has been resolved: arcnet: Add NULL check in com20020pciprobe devmkasprintf returns NULL when memory allocation fails. Currently, com20020pciprobe does not check for this case, which results in a NULL pointer dereference. Add NULL check after...