kernel: scsi: ufs: core: Fix handling of lrbp->cmd

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix handling of lrbp-cmd ufshcdqueuecommand may be called two times in a row for a SCSI command before it is completed. Hence make the following changes: - In the functions that submit a command, do not check the...

kernel: wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use two-phase skb reclamation in ieee80211dostop Since 'devqueuexmit' should be called with interrupts enabled, the following backtrace: ieee80211dostop ... spinlockirqsave&local-queuestopreasonlock, flags...

kernel: md/raid10: fix null ptr dereference in raid10_size()

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix null ptr dereference in raid10size In raid10run if raid10setqueuelimits succeed, the return value is set to zero, and if following procedures failed raid10run will return zero while mddev-private is still NULL,...

kernel: Bluetooth: hci_conn: Use disable_delayed_work_sync

A flaw was found in the Bluetooth subsystem of the Linux kernel, in the handling of delayed work within the hciconn Host Controller Interface connection structure. The kernel used canceldelayedworksync when shutting down a connection, which cancels ongoing work but allows rescheduling. This could...

kernel: Bluetooth: Fix memory leak in hci_req_sync_complete()

This CVE identifies a memory leak in the Linux kernel's Bluetooth subsystem, specifically within the hcireqsynccomplete function. The issue arises because the function fails to release the previous synchronization request state before assigning a new one, leading to increased memory usage over...

kernel: pipe: wakeup wr_wait after setting max_usage

CVE-2023-52672 is a vulnerability in the Linux kernel's pipe subsystem caused by a regression in how pipes are resized. When a pipe is full and resized, incorrect handling of wakeups for writers can lead to deadlocks or system lockups. This issue has been resolved by ensuring that the pipe's usag...

kernel: block: fix deadlock between sd_remove & sd_release

In the Linux kernel, the following vulnerability has been resolved: block: fix deadlock between sdremove & sdrelease Our test report the following hung task: 2538.459400 INFO: task "kworker/0:0":7 blocked for more than 188 seconds. 2538.459427 Call trace: 2538.459430 switchto+0x174/0x338...

USN-7506-4 linux-lts-xenial vulnerabilities

Demi Marie Obenour and Simon Gaiser discovered that several Xen para- virtualization device frontends did not properly restrict the access rights of device backends. An attacker could possibly use a malicious Xen backend to gain access to memory pages of a guest VM or cause a denial of service in...

USN-7506-3 linux-fips vulnerabilities

Demi Marie Obenour and Simon Gaiser discovered that several Xen para- virtualization device frontends did not properly restrict the access rights of device backends. An attacker could possibly use a malicious Xen backend to gain access to memory pages of a guest VM or cause a denial of service in...

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-7506-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7506-1 advisory. Demi Marie Obenour and Simon Gaiser discovered that several Xen para- virtualization device frontends did not properly restrict the access rights of devi...

SUSE CVE-2025-37851

In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: Add 'plane' value check Function dispcovlsetup is not intended to work with the value OMAPDSSWB of the enum parameter plane. The value of this parameter is initialized in dssinitoverlays and in the current state of...

DEBIAN-CVE-2025-37889

In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Consistently treat platformmax as control value This reverts commit 9bdd10d57a88 "ASoC: ops: Shift tested values in sndsocputvolsw by +min", and makes some additional related updates. There are two ways the platformmax...

CVE-2025-37851

In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: Add 'plane' value check Function dispcovlsetup is not intended to work with the value OMAPDSSWB of the enum parameter plane. The value of this parameter is initialized in dssinitoverlays and in the current state of...

CVE-2025-37870 drm/amd/display: prevent hang on link training fail

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: prevent hang on link training fail Why When link training fails, the phy clock will be disabled. However, in enablestreams, it is assumed that link training succeeded and the mux selects the phy clock, causing a...

CVE-2025-37857 scsi: st: Fix array overflow in st_setup()

In the Linux kernel, the following vulnerability has been resolved: scsi: st: Fix array overflow in stsetup Change the array size to follow parms size instead of a fixed value...

CVE-2025-37840

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: brcmnand: fix PM resume warning Fixed warning on PM resume as shown below caused due to uninitialized struct nandoperation that checks chip select field : WARNONop-cs = nanddevntargets&chip-base 14.588522 ----------...

SUSE CVE-2022-49905

In the Linux kernel, the following vulnerability has been resolved: net/smc: Fix possible leaked pernet namespace in smcinit In smcinit, registerpernetsubsys&smcnetstatops is called without any error handling. If it fails, registering of &smcnetops won't be reverted. And if smcnlinit fails,...

SUSE CVE-2025-37814

In the Linux kernel, the following vulnerability has been resolved: tty: Require CAPSYSADMIN for all usages of TIOCLSELMOUSEREPORT This requirement was overeagerly loosened in commit 2f83e38a095f "tty: Permit some TIOCLSETSEL modes without CAPSYSADMIN", but as it turns out, 1 the logic I...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an incorrect sb-ssequence check in jbd2...

The vulnerability of the tcf_ct_handle_fragments() function in the net/sched/act_ct.c module of the net/sched/networking subsystem of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the tcfcthandlefragments function in the net/sched/actct.c module of the net/sched/networking subsystem of the Linux operating system is related to insufficient checking of exceptional states. Exploiting this vulnerability could allow an attacker to compromise the...