CVE-2025-22088 RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Prevent use-after-free in erdmaacceptnewconn After the erdmacepputnewcep being called, newcep will be freed, and the following dereference will cause a UAF problem. Fix this issue...

CVE-2025-22087 bpf: Fix array bounds error with may_goto

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix array bounds error with maygoto maygoto uses an additional 8 bytes on the stack, which causes the interpreters array to go out of bounds when calculating index by stacksize. 1. If a BPF program is rewritten, re-evaluate...

CVE-2025-22086 RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix mlx5pollone curqp update flow When curqp isn't NULL, in order to avoid fetching the QP from the radix tree again we check if the next cqe QP is identical to the one we already have. The bug however is that we are...

CVE-2025-22085 RDMA/core: Fix use-after-free when rename device name

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix use-after-free when rename device name Syzbot reported a slab-use-after-free with the following call trace: ================================================================== BUG: KASAN: slab-use-after-free in...

CVE-2025-22085 RDMA/core: Fix use-after-free when rename device name

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix use-after-free when rename device name Syzbot reported a slab-use-after-free with the following call trace: ================================================================== BUG: KASAN: slab-use-after-free in...

CVE-2025-22073 spufs: fix a leak on spufs_new_file() failure

In the Linux kernel, the following vulnerability has been resolved: spufs: fix a leak on spufsnewfile failure It's called from spufsfilldir, and caller of that will do spufsrmdir in case of failure. That does remove everything we'd managed to create, but... the problem dentry is still negative...

CVE-2025-22071 spufs: fix a leak in spufs_create_context()

In the Linux kernel, the following vulnerability has been resolved: spufs: fix a leak in spufscreatecontext Leak fixes back in 2008 missed one case - if we are trying to set affinity and spufsmkdir fails, we need to drop the reference to neighbor...

CVE-2025-22069 riscv: fgraph: Fix stack layout to match __arch_ftrace_regs argument of ftrace_return_to_handler

In the Linux kernel, the following vulnerability has been resolved: riscv: fgraph: Fix stack layout to match archftraceregs argument of ftracereturntohandler Naresh Kamboju reported a "Bad frame pointer" kernel warning while running LTP trace ftracestresstest.sh in riscv. We can reproduce the sam...

CVE-2025-22061

CVE-2025-22061 concerns the Linux kernel’s airoha Ethernet driver (airoha_eth) and the function airoha_tc_get_htb_get_leaf_queue() . Connected advisories explicitly state the root cause as a fix to the qid reporting in that routine, addressing kernel warnings when deleting HTB offloaded qdiscs. T...

CVE-2025-22056

The CVE-2025-22056 issue affects the Linux kernel nft_tunnel handling of NFTA_TUNNEL_KEY_OPTS_GENEVE attributes, where the parse/dump logic performed type conversions before pointer arithmetic, causing a slab-out-of-bounds write. The fix is to perform pointer addition using char* units and correc...

CVE-2025-22052 staging: gpib: Fix Oops after disconnect in ni_usb

In the Linux kernel, the following vulnerability has been resolved: staging: gpib: Fix Oops after disconnect in niusb If the usb dongle is disconnected subsequent calls to the driver cause a NULL dereference Oops as the businterface is set to NULL on disconnect. This problem was introduced by...

CVE-2025-22045

Technical details for CVE-2025-22045 are not publicly available in the provided documents. Monitor for updates from vendor advisories and CVE databases.

CVE-2025-22041 ksmbd: fix use-after-free in ksmbd_sessions_deregister()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbdsessionsderegister In multichannel mode, UAF issue can occur in sessionderegister when the second channel sets up a session through the connection of the first channel. session that is freed...

CVE-2025-22040 ksmbd: fix session use-after-free in multichannel connection

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix session use-after-free in multichannel connection There is a race condition between session setup and ksmbdsessionsderegister. The session can be freed before the connection is added to channel list of session. This...

CVE-2025-22028 media: vimc: skip .s_stream() for stopped entities

In the Linux kernel, the following vulnerability has been resolved: media: vimc: skip .sstream for stopped entities Syzbot reported 1 a warning prompted by a check in callsstream that checks whether .sstream operation is warranted for unstarted or stopped subdevs. Add a simple fix in...

CVE-2025-22026

CVE-2025-22026 (Linux kernel) affects nfsd in the kernel. The issue: nfsd_proc_stat_init() ignored the return value of svc_proc_register(), so if procfile creation fails the kernel may WARN later during removal. The fix updates nfsd_proc_stat_init() to return the same pointer type as svc_proc_reg...

CVE-2025-22024 nfsd: fix management of listener transports

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix management of listener transports Currently, when no active threads are running, a root user using nfsdctl command can try to remove a particular listener from the list of previously added ones, then start the server by...

CVE-2024-58096

In the Linux kernel, CVE-2024-58096 concerns missing srng->lock protection when using ath11k_hal_srng_* in monitor mode, risking data contention in ath11k_dp_rx_mon_dest_process() and ath11k_dp_full_mon_process_rx(). Reports indicate repeated use of ath11k_hal_srng_* without acquiring srng-&gt...

CVE-2024-58096 wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: add srng-lock for ath11khalsrng in monitor mode ath11khalsrng should be used with srng-lock to protect srng data. For ath11kdprxmondestprocess and ath11kdpfullmonprocessrx, they use ath11khalsrng for many times but...

CVE-2024-58093

CVE-2024-58093 affects the Linux kernel’s PCI/ASPM link state handling. The issue arises when removing functions on a bus with a PCIe switch/MFD: freeing the ASPM link state either too late (function 0 removed last) or too early (before all subordinate links are gone), leading to use-after-free o...