CVE-2025-37922

CVE-2025-37922 concerns Linux kernel memory management: when section vmemmap start addresses are misaligned across namespaces, an altmap page may be reused by a different namespace, causing the previous namespace to free a page incorrectly and crash the kernel. The connected documents describe a ...

CVE-2025-37903

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix slab-use-after-free in hdcp The HDCP code in amdgpudmhdcp.c copies pointers to amdgpudmconnector objects without incrementing the kref reference counts. When using a USB-C dock, and the dock is unplugged, the...

CVE-2025-37890 net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc

In the Linux kernel, the following vulnerability has been resolved: netsched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report 1, we have a UAF case when an hfsc class has a netem child qdisc. The crux of the issue is that hfsc is assuming that...

CVE-2025-37889

In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Consistently treat platformmax as control value This reverts commit 9bdd10d57a88 "ASoC: ops: Shift tested values in sndsocputvolsw by +min", and makes some additional related updates. There are two ways the platformmax...

CVE-2025-37887 pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result

In the Linux kernel, the following vulnerability has been resolved: pdscore: handle unsupported PDSCORECMDFWCONTROL result If the FW doesn't support the PDSCORECMDFWCONTROL command the driver might at the least print garbage and at the worst crash when the user runs the "devlink dev info" devlink...

CVE-2025-37866 mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show()

In the Linux kernel, the following vulnerability has been resolved: mlxbf-bootctl: use sysfsemitat in securebootfusestateshow A warning is seen when running the latest kernel on a BlueField SOC: 251.512704 ------------ cut here ------------ 251.512711 invalid sysfsemit: buf:0000000003aa32ae...

CVE-2025-37863 ovl: don't allow datadir only

In the Linux kernel, the following vulnerability has been resolved: ovl: don't allow datadir only In theory overlayfs could support upper layer directly referring to a data layer, but there's no current use case for this. Originally, when data-only layers were introduced, this wasn't allowed, onl...

CVE-2025-37850 pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config()

In the Linux kernel, the following vulnerability has been resolved: pwm: mediatek: Prevent divide-by-zero in pwmmediatekconfig With CONFIGCOMPILETEST && !CONFIGHAVECLK, pwmmediatekconfig has a divide-by-zero in the following line: dodivresolution, clkgetratepc-clkpwmspwm-hwpwm; due to the fact th...

CVE-2025-37850

The CVE-2025-37850 issue relates to the Linux kernel PWM Mediatek driver. Under CONFIG_COMPILE_TEST && !CONFIG_HAVE_CLK, pwm_mediatek_config() could divide by zero when obtaining the clock rate for pc->clk_pwms[pwm->hwpwm], because clk_get_rate() may return zero in the !CONFIG_HAVE_CLK path...

CVE-2025-37846 arm64: mops: Do not dereference src reg for a set operation

In the Linux kernel, the following vulnerability has been resolved: arm64: mops: Do not dereference src reg for a set operation The source register is not used for SET and reading it can result in a UBSAN out-of-bounds array access error, specifically when the MOPS exception is taken from a SET...

CVE-2025-37842 spi: fsl-qspi: use devm function instead of driver remove

In the Linux kernel, the following vulnerability has been resolved: spi: fsl-qspi: use devm function instead of driver remove Driver use devm APIs to manage clk/irq/resources and register the spi controller, but the legacy remove function will be called first during device detach and trigger kern...

CVE-2025-37802

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix WARNING "do not call blocking ops when !TASKRUNNING" waiteventtimeout will set the state of the current task to TASKUNINTERRUPTIBLE, before doing the condition check. This means that ksmbddurablescavengeralive will try...

CVE-2025-37827 btrfs: zoned: return EIO on RAID1 block group write pointer mismatch

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: return EIO on RAID1 block group write pointer mismatch There was a bug report about a NULL pointer dereference in btrfsaddfreespacezoned that ultimately happens because a conversion from the default metadata profile...

CVE-2025-37811 usb: chipidea: ci_hdrc_imx: fix usbmisc handling

In the Linux kernel, the following vulnerability has been resolved: usb: chipidea: cihdrcimx: fix usbmisc handling usbmisc is an optional device property so it is totally valid for the corresponding data-usbmiscdata to have a NULL value. Check that before dereferencing the pointer. Found by Linux...

CVE-2023-53103

In the Linux kernel, the following vulnerability has been resolved: bonding: restore bond's IFFSLAVE flag if a non-eth dev enslave fails syzbot reported a warning1 where the bond device itself is a slave and we try to enslave a non-ethernet device as the first slave which fails but then in the...

CVE-2023-53142 ice: copy last block omitted in ice_get_module_eeprom()

In the Linux kernel, the following vulnerability has been resolved: ice: copy last block omitted in icegetmoduleeeprom icegetmoduleeeprom is broken since commit e9c9692c8a81 "ice: Reimplement module reads used by ethtool" In this refactor, icegetmoduleeeprom reads the eeprom in blocks of size 8...

CVE-2023-53134

CVE-2023-53134 is a Linux kernel issue affecting the bnxt_en driver where 4K-page systems could experience memory-allocation failure when tracking concurrent TPA (GRO/LRO) completions on 4K pages (up to 256 on P5). The root cause was an order-5 allocation for TPA data. The patch changes allocatio...

CVE-2023-53113

The CVE-2023-53113 entry concerns the Linux kernel wifi NL80211 offchannel check. A NULL-pointer dereference could occur when a link was created by userspace in AP mode but not activated yet, resulting in a chandef that is invalid or has no channel. The vulnerability arises from dereferencing thi...

CVE-2023-53098

CVE-2023-53098 summary (Linux kernel) : The vulnerability resides in the Media driver gpio-ir-recv under media: rc, where an added remove function plus runtime-pm cleanup is required. If runtime PM is enabled, systems must perform runtime PM cleanup to remove a cpu-latency QoS request; otherwise,...

CVE-2023-53085

In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix info leak when failing to get panel id Make sure to clear the transfer buffer before fetching the EDID to avoid leaking slab data to the logs on errors that leave the buffer unchanged...