CVE-2025-21792 ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt

In the Linux kernel, the following vulnerability has been resolved: ax25: Fix refcount leak caused by setting SOBINDTODEVICE sockopt If an AX25 device is bound to a socket by setting the SOBINDTODEVICE socket option, a refcount leak will occur in ax25release. Commit 9fd75b66b8f6 "ax25: Fix refcou...

CVE-2025-21788 net: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases If the XDP program doesn't result in XDPPASS then we leak the memory allocated by am65cpswbuildskb. It is pointless to allocate SKB memory before running the XDP...

CVE-2025-21774 can: rockchip: rkcanfd_handle_rx_fifo_overflow_int(): bail out if skb cannot be allocated

In the Linux kernel, the following vulnerability has been resolved: can: rockchip: rkcanfdhandlerxfifooverflowint: bail out if skb cannot be allocated Fix NULL pointer check in rkcanfdhandlerxfifooverflowint to bail out if skb cannot be allocated...

CVE-2025-21758

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: add RCU protection to mldnewpack mldnewpack can be called without RTNL or RCU being held. Note that we no longer can use sockallocsendskb because ipv6.igmpsk uses GFPKERNEL allocations which can sleep. Instead use...

CVE-2025-21758 ipv6: mcast: add RCU protection to mld_newpack()

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: add RCU protection to mldnewpack mldnewpack can be called without RTNL or RCU being held. Note that we no longer can use sockallocsendskb because ipv6.igmpsk uses GFPKERNEL allocations which can sleep. Instead use...

CVE-2025-21759

CVE-2025-21759: In the Linux kernel, ipv6 mcast path igmp6_send() could be invoked without RTNL/RCU held, risking use-after-free of the net pointer. The fix extends RCU protection to safely fetch the net pointer and avoid UAF, and replaces sock_alloc_send_skb usage with alloc_skb under RCU protec...

CVE-2025-21755

Removed by vendor...

CVE-2025-21756 vsock: Keep the binding until socket destruction

In the Linux kernel, the following vulnerability has been resolved: vsock: Keep the binding until socket destruction Preserve sockets bindings; this includes both resulting from an explicit bind and those implicitly bound through autobind during connect. Prevents socket unbinding during a transpo...

CVE-2025-21756 vsock: Keep the binding until socket destruction

In the Linux kernel, the following vulnerability has been resolved: vsock: Keep the binding until socket destruction Preserve sockets bindings; this includes both resulting from an explicit bind and those implicitly bound through autobind during connect. Prevents socket unbinding during a transpo...

CVE-2025-21756

In the Linux kernel, the following vulnerability has been resolved: vsock: Keep the binding until socket destruction Preserve sockets bindings; this includes both resulting from an explicit bind and those implicitly bound through autobind during connect. Prevents socket unbinding during a transpo...

CVE-2025-21755

CVE-2025-21755 is rejected/not used per the Initial Description.

CVE-2025-21755

...

CVE-2025-21756

CVE-2025-21756 affects the Linux kernel vsock subsystem. The issue arises from keeping socket bindings until destruction, preventing correct unbinding during transport reassignment. This leads to a use-after-free in the binding path, observed as a KASAN slab-use-after-free in __vsock_bind and rel...

CVE-2025-21756 vsock: Keep the binding until socket destruction

In the Linux kernel, the following vulnerability has been resolved: vsock: Keep the binding until socket destruction Preserve sockets bindings; this includes both resulting from an explicit bind and those implicitly bound through autobind during connect. Prevents socket unbinding during a transpo...

DEBIAN-CVE-2025-21718

In the Linux kernel, the following vulnerability has been resolved: net: rose: fix timer races against user threads Rose timers only acquire the socket spinlock, without checking if the socket is owned by one user thread. Add a check and rearm the timers if needed. BUG: KASAN: slab-use-after-free...

CVE-2025-21710

In the Linux kernel, the following vulnerability has been resolved: tcp: correct handling of extreme memory squeeze Testing with iperf3 using the "pasta" protocol splicer has revealed a problem in the way tcp handles window advertising in extreme memory squeeze situations. Under memory pressure, ...

CVE-2024-57974

In the Linux kernel, the following vulnerability has been resolved: udp: Deal with race between UDP socket address change and rehash If a UDP socket changes its local address while it's receiving datagrams, as a result of connect, there is a period during which a lookup operation might fail to fi...

DEBIAN-CVE-2024-57974

In the Linux kernel, the following vulnerability has been resolved: udp: Deal with race between UDP socket address change and rehash If a UDP socket changes its local address while it's receiving datagrams, as a result of connect, there is a period during which a lookup operation might fail to fi...

AZL-68748 CVE-2024-57974 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: udp: Deal with race between UDP socket address change and rehash If a UDP socket changes its local address while it's receiving datagrams, as a result of connect, there is a period during which a lookup operation might fail to fi...

UBUNTU-CVE-2025-21718

In the Linux kernel, the following vulnerability has been resolved: net: rose: fix timer races against user threads Rose timers only acquire the socket spinlock, without checking if the socket is owned by one user thread. Add a check and rearm the timers if needed. BUG: KASAN: slab-use-after-free...