kernel

Vulnerabilities (1,755)

• CVE-2025-40118Nov 12, 2025
  affected < 5.4.301fixed 5.4.301

  In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone") UBSAN reports: UBSAN: array-index-out-of-bounds in drivers/scs

• CVE-2025-40117Nov 12, 2025
  affected >= 6.17.0, < 6.17.3fixed 6.17.3

  In the Linux kernel, the following vulnerability has been resolved: misc: pci_endpoint_test: Fix array underflow in pci_endpoint_test_ioctl() Commit eefb83790a0d ("misc: pci_endpoint_test: Add doorbell test case") added NO_BAR (-1) to the pci_barno enum which, in practical term

• CVE-2025-40116Nov 12, 2025
  affected >= 3.16.0, < 5.4.301fixed 5.4.301

  In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup The kthread_run() function returns error pointers so the max3421_hcd->spi_thread pointer can be either error pointers or NULL. Check for bo

• CVE-2025-40115Nov 12, 2025
  affected >= 3.8.0, < 5.4.301fixed 5.4.301

  In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() During mpt3sas_transport_port_remove(), messages were logged with dev_printk() against &mpt3sas_port->port->dev. At this point the SAS trans

• CVE-2025-40113Nov 12, 2025
  affected >= 6.9.0, < 6.17.3fixed 6.17.3

  In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom: pas: Shutdown lite ADSP DTB on X1E The ADSP firmware on X1E has separate firmware binaries for the main firmware and the DTB. The same applies for the "lite" firmware loaded by the boot firmwa

• CVE-2025-40112Nov 12, 2025
  affected >= 4.9.0, < 5.4.301fixed 5.4.301

  In the Linux kernel, the following vulnerability has been resolved: sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers

• CVE-2025-40111Nov 12, 2025
  affected >= 4.20.0, < 5.4.301fixed 5.4.301

  In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix Use-after-free in validation Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are expected to be clea

• CVE-2025-40110Nov 12, 2025
  affected >= 3.8.0, < 5.10.248fixed 5.10.248

  In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix a null-ptr access in the cursor snooper Check that the resource which is converted to a surface exists before trying to use the cursor snooper on it. vmw_cmd_res_check allows explicit invalid (

• CVE-2025-40109Nov 9, 2025
  affected >= 5.10.0, < 5.10.246fixed 5.10.246

  In the Linux kernel, the following vulnerability has been resolved: crypto: rng - Ensure set_ent is always present Ensure that set_ent is always set since only drbg provides it.

• CVE-2025-40108Nov 9, 2025
  affected >= 6.17.0, < 6.17.2fixed 6.17.2

  In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: Fix blocked task Revert commit 1afa70632c39 ("serial: qcom-geni: Enable PM runtime for serial driver") and its dependent commit 86fa39dd6fb7 ("serial: qcom-geni: Enable Serial on SA8255p Qual

• CVE-2025-40107Nov 3, 2025
  affected >= 4.12.0, < 6.1.156fixed 6.1.156

  In the Linux kernel, the following vulnerability has been resolved: can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled This issue is similar to the vulnerability in the `mcp251x` driver, which was fixed in commit 03c427147b2d ("can:

• CVE-2025-40106Oct 31, 2025
  affected >= 2.6.29, < 5.4.301fixed 5.4.301

  In the Linux kernel, the following vulnerability has been resolved: comedi: fix divide-by-zero in comedi_buf_munge() The comedi_buf_munge() function performs a modulo operation `async->munge_chan %= async->cmd.chanlist_len` without first checking if chanlist_len is zero. If a u

• CVE-2025-40105Oct 30, 2025
  affected >= 4.16.0, < 5.4.301fixed 5.4.301

  In the Linux kernel, the following vulnerability has been resolved: vfs: Don't leak disconnected dentries on umount When user calls open_by_handle_at() on some inode that is not cached, we will create disconnected dentry for it. If such dentry is a directory, exportfs_decode_fh

• CVE-2025-40104Oct 30, 2025
  affected >= 4.20.0, < 6.1.158fixed 6.1.158

  In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix mailbox API compatibility by negotiating supported features There was backward compatibility in the terms of mailbox API. Various drivers from various OSes supporting 10G adapters from Intel portfo

• CVE-2025-40103Oct 30, 2025
  affected >= 3.7.0, < 6.1.158fixed 6.1.158

  In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix refcount leak for cifs_sb_tlink Fix three refcount inconsistency issues related to `cifs_sb_tlink`. Comments for `cifs_sb_tlink` state that `cifs_put_tlink()` needs to be called after successf

• CVE-2025-40102Oct 30, 2025
  affected >= 4.19.0, < 6.17.5fixed 6.17.5

  In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Prevent access to vCPU events before init Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, leading to KVM interpr

• CVE-2025-40101Oct 30, 2025
  affected >= 6.8.0, < 6.12.55fixed 6.12.55

  In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST At the end of btrfs_load_block_group_zone_info() the first thing we do is to ensure that if the mapping type is not a SINGLE one a

• CVE-2025-40100Oct 30, 2025
  affected >= 4.5.0, < 6.1.158fixed 6.1.158

  In the Linux kernel, the following vulnerability has been resolved: btrfs: do not assert we found block group item when creating free space tree Currently, when building a free space tree at populate_free_space_tree(), if we are not using the block group tree feature, we always

• CVE-2025-40099Oct 30, 2025
  affected >= 4.11.0, < 6.1.158fixed 6.1.158

  In the Linux kernel, the following vulnerability has been resolved: cifs: parse_dfs_referrals: prevent oob on malformed input Malicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS - reply smaller than sizeof(struct get_dfs_referral_rsp) - reply with number of

• CVE-2025-40098Oct 30, 2025
  affected >= 6.7.0, < 6.17.5fixed 6.17.5

  In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() Return value of a function acpi_evaluate_dsm() is dereferenced without checking for NULL, but it is usually checked for this fu