CVE-2025-39856

CVE-2025-39856 concerns the Linux kernel network driver for TI am65 CPSW-NUSS (CPSW2G) where, in the TX completion path, the variable ndev may be accessed before initialization if no TX packets have been processed. This can cause a null pointer dereference and kernel crash. Affected component: ne...

CVE-2025-39856 net: ethernet: ti: am65-cpsw-nuss: Fix null pointer dereference for ndev

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix null pointer dereference for ndev In the TX completion packet stage of TI SoCs with CPSW2G instance, which has single external ethernet port, ndev is accessed without being initialized if no...

PT-2025-38513

Name of the Vulnerable Software and Affected Versions Bluetooth affected versions not specified Description An unsafe handling issue in bt conn tx processor can lead to a use-after-free condition, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precise memo...

CVE-2022-50408

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free bug in brcmfnetdevstartxmit ret = brcmfprototxqueuedatadrvr, ifp-ifidx, skb; may be schedule, and then complete before the line ndev-stats.txbytes += skb-len; 46.912801...

CVE-2022-50408

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free bug in brcmfnetdevstartxmit ret = brcmfprototxqueuedatadrvr, ifp-ifidx, skb; may be schedule, and then complete before the line ndev-stats.txbytes += skb-len; 46.912801...

DEBIAN-CVE-2022-50408

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free bug in brcmfnetdevstartxmit ret = brcmfprototxqueuedatadrvr, ifp-ifidx, skb; may be schedule, and then complete before the line ndev-stats.txbytes += skb-len; 46.912801...

CVE-2022-50408

The CVE-2022-50408 entry concerns a use-after-free in brcmfmac within the Linux kernel when handling wifi transmission in brcmf_netdev_start_xmit(). The vulnerability can allow a schedule race between brcmf_proto_tx_queue_data and updating skb stats, leading to a use-after-free observed by KASAN....

CVE-2022-50408 wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free bug in brcmfnetdevstartxmit ret = brcmfprototxqueuedatadrvr, ifp-ifidx, skb; may be schedule, and then complete before the line ndev-stats.txbytes += skb-len; 46.912801...

SUSE CVE-2022-50248

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix double free on tx path. We see kernel crashes and lockups and KASAN errors related to ax210 firmware crashes. One of the KASAN dumps pointed at the tx path, and it appears there is indeed a way to...

SUSE CVE-2023-53209

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: Fix possible NULL dereference In a call to mac80211hwsimselecttxlink the sta pointer might be NULL, thus need to check that it is not NULL before accessing it...

SUSE CVE-2023-53240

In the Linux kernel, the following vulnerability has been resolved: xsk: check IFFUP earlier in Tx path Xsk Tx can be triggered via either sendmsg or poll syscalls. These two paths share a call to common function xskxmit which has two sanity checks within. A pseudo code example to show the two...

CVE-2023-53338 lwt: Fix return values of BPF xmit ops

In the Linux kernel, the following vulnerability has been resolved: lwt: Fix return values of BPF xmit ops BPF encap ops can return different types of positive values, such like NETRXDROP, NETXMITCN, NETDEVTXBUSY, and so on, from function skbdoredirect and bpflwtxmitreroute. At the xmit hook, suc...

CVE-2023-53338

CVE-2023-53338 affects the Linux kernel’s LWT/BPF path. The vulnerability arises from BPF encap ops returning various positive values (e.g., NET_RX_DROP, NET_XMIT_CN, NETDEV_TX_BUSY) from skb_do_redirect and bpf_lwt_xmit_reroute. At the xmit hook these values were implicitly treated as LWTUNNEL_X...

CVE-2023-53338

In the Linux kernel, the following vulnerability has been resolved: lwt: Fix return values of BPF xmit ops BPF encap ops can return different types of positive values, such like NETRXDROP, NETXMITCN, NETDEVTXBUSY, and so on, from function skbdoredirect and bpflwtxmitreroute. At the xmit hook, suc...

SUSE CVE-2023-53180

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Avoid NULL pointer access during management transmit cleanup Currently 'ar' reference is not added in skbcb. Though this is generally not used during transmit completion callbacks, on interface removal the remaining...

SUSE CVE-2025-39810

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix memory corruption when FW resources change during ifdown bnxtsetdfltrings assumes that it is always called before any TC has been created. So it doesn't take bp-numtc into account and assumes that it is always 0 or 1...

CVE-2023-53312 net: fix net_dev_start_xmit trace event vs skb_transport_offset()

In the Linux kernel, the following vulnerability has been resolved: net: fix netdevstartxmit trace event vs skbtransportoffset After blamed commit, we must be more careful about using skbtransportoffset, as reminded us by syzbot: WARNING: CPU: 0 PID: 10 at include/linux/skbuff.h:2868...

CVE-2023-53312

In the Linux kernel, the following vulnerability has been resolved: net: fix netdevstartxmit trace event vs skbtransportoffset After blamed commit, we must be more careful about using skbtransportoffset, as reminded us by syzbot: WARNING: CPU: 0 PID: 10 at include/linux/skbuff.h:2868...

CVE-2025-39810

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix memory corruption when FW resources change during ifdown bnxtsetdfltrings assumes that it is always called before any TC has been created. So it doesn't take bp-numtc into account and assumes that it is always 0 or 1...

UBUNTU-CVE-2025-39810

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix memory corruption when FW resources change during ifdown bnxtsetdfltrings assumes that it is always called before any TC has been created. So it doesn't take bp-numtc into account and assumes that it is always 0 or 1...