PT-2025-53130

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a data race condition within the IPv6/sit module. Specifically, multiple CPUs can concurrently update the dev-stats.tx error variable, leading to potential...

CVE-2025-68342

In the Linux kernel, the following vulnerability has been resolved: can: gsusb: gsusbreceivebulkcallback: check actuallength before accessing data The URB received in gsusbreceivebulkcallback contains a struct gshostframe. The length of the data after the header depends on the gshostframe hf::fla...

AZL-72989 CVE-2025-68342 affecting package kernel for versions less than 6.6.119.3-1

In the Linux kernel, the following vulnerability has been resolved: can: gsusb: gsusbreceivebulkcallback: check actuallength before accessing data The URB received in gsusbreceivebulkcallback contains a struct gshostframe. The length of the data after the header depends on the gshostframe hf::fla...

CVE-2025-68343 can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header

In the Linux kernel, the following vulnerability has been resolved: can: gsusb: gsusbreceivebulkcallback: check actuallength before accessing header The driver expects to receive a struct gshostframe in gsusbreceivebulkcallback. Use structgroup to describe the header of the struct gshostframe and...

CVE-2025-68343

In the Linux kernel, the following vulnerability has been resolved: can: gsusb: gsusbreceivebulkcallback: check actuallength before accessing header The driver expects to receive a struct gshostframe in gsusbreceivebulkcallback. Use structgroup to describe the header of the struct gshostframe and...

CVE-2025-68342 can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data

In the Linux kernel, the following vulnerability has been resolved: can: gsusb: gsusbreceivebulkcallback: check actuallength before accessing data The URB received in gsusbreceivebulkcallback contains a struct gshostframe. The length of the data after the header depends on the gshostframe hf::fla...

CVE-2025-68342

In the Linux kernel gs_usb driver, a vulnerability in gs_usb_receive_bulk_callback() could access data before ensuring the actual_length was sufficient. The patch introduces a minimum length check (gs_usb_get_minimum_length(), later renamed to gs_usb_get_minimum_rx_length()) and validates that th...

CVE-2025-68342 can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data

In the Linux kernel, the following vulnerability has been resolved: can: gsusb: gsusbreceivebulkcallback: check actuallength before accessing data The URB received in gsusbreceivebulkcallback contains a struct gshostframe. The length of the data after the header depends on the gshostframe hf::fla...

PT-2025-52759

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the CAN subsystem, specifically in the gs usb receive bulk callback function. The driver incorrectly assumes the presence of a gs host frame...

PT-2025-52758

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s CAN subsystem, specifically within the gs usb receive bulk callback function. This issue relates to insufficient validation of the length of data...

CVE-2025-68342

In the Linux kernel, the following vulnerability has been resolved: can: gsusb: gsusbreceivebulkcallback: check actuallength before accessing data The URB received in gsusbreceivebulkcallback contains a struct gshostframe. The length of the data after the header depends on the gshostframe hf::fla...

net: sxgbe: fix potential NULL dereference in sxgbe_rx()

...

net: atlantic: fix fragment overflow handling in RX path

...

SUSE CVE-2025-68291

In the Linux kernel, the following vulnerability has been resolved: mptcp: Initialise rcvmss before calling tcpsendactivereset in mptcpdofastclose. syzbot reported divide-by-zero in tcpselectwindow by MPTCP socket. 0 We had a similar issue for the bare TCP and fixed in commit 499350a5a6e7 "tcp:...

SUSE CVE-2025-68304

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: lookup hciconn on RX path on protocol side The hdev lock/lookup/unlock/use pattern in the packet RX path doesn't ensure hciconn is not concurrently modified/deleted. This locking appears to be leftover from...

OSV-2025-994 Heap-buffer-overflow in rx_icmp

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=469520969 Crash type: Heap-buffer-overflow READ 1 Crash state: rxicmp mgtcpiprx fuzz.c...

kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path

A use-after-free vulnerability exists in the linux kernel such that the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock...

kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path

A use-after-free vulnerability exists in the linux kernel such that the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock...

SUSE CVE-2025-68321

In the Linux kernel, the following vulnerability has been resolved: pagepool: always add GFPNOWARN for ATOMIC allocations Driver authors often forget to add GFPNOWARN for page allocation from the datapath. This is annoying to users as OOMs are a fact of life, and we pretty much expect network Rx ...

EUVD-2025-203776

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: lookup hciconn on RX path on protocol side The hdev lock/lookup/unlock/use pattern in the packet RX path doesn't ensure hciconn is not concurrently modified/deleted. This locking appears to be leftover from...