kernel

Vulnerabilities (1,755)

• CVE-2025-40076Oct 28, 2025
  affected >= 6.17.0, < 6.17.3fixed 6.17.3

  In the Linux kernel, the following vulnerability has been resolved: PCI: rcar-host: Pass proper IRQ domain to generic_handle_domain_irq() Starting with commit dd26c1a23fd5 ("PCI: rcar-host: Switch to msi_create_parent_irq_domain()"), the MSI parent IRQ domain is NULL because th

• CVE-2025-40075Oct 28, 2025
  affected >= 4.13.0, < 6.12.63fixed 6.12.63

  In the Linux kernel, the following vulnerability has been resolved: tcp_metrics: use dst_dev_net_rcu() Replace three dst_dev() with a lockdep enabled helper.

• CVE-2025-40074Oct 28, 2025
  affected >= 4.13.0, < 6.17.3fixed 6.17.3

  In the Linux kernel, the following vulnerability has been resolved: ipv4: start using dst_dev_rcu() Change icmpv4_xrlim_allow(), ip_defrag() to prevent possible UAF. Change ipmr_prepare_xmit(), ipmr_queue_fwd_xmit(), ip_mr_output(), ipv4_neigh_lookup() to use lockdep enabled d

• CVE-2025-40073Oct 28, 2025
  affected >= 6.16.0, < 6.17.3fixed 6.17.3

  In the Linux kernel, the following vulnerability has been resolved: drm/msm: Do not validate SSPP when it is not ready Current code will validate current plane and previous plane to confirm they can share a SSPP with multi-rect mode. The SSPP is already allocated for previous p

• CVE-2025-40072Oct 28, 2025
  affected >= 6.16.0, < 6.17.3fixed 6.17.3

  In the Linux kernel, the following vulnerability has been resolved: fanotify: Validate the return value of mnt_ns_from_dentry() before dereferencing The function do_fanotify_mark() does not validate if mnt_ns_from_dentry() returns NULL before dereferencing mntns->user_ns. This

• CVE-2025-40071Oct 28, 2025
  affected >= 5.18.0, < 6.6.112fixed 6.6.112

  In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: Don't block input queue by waiting MSC Currently gsm_queue() processes incoming frames and when opening a DLC channel it calls gsm_dlci_open() which calls gsm_modem_update(). If basic mode is used i

• CVE-2025-40070Oct 28, 2025
  affected < 5.4.301fixed 5.4.301

  In the Linux kernel, the following vulnerability has been resolved: pps: fix warning in pps_register_cdev when register device fail Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error handling in __video_register_device()"), the release hook should be set befor

• CVE-2025-40069Oct 28, 2025
  affected >= 6.17.0, < 6.17.3fixed 6.17.3

  In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix obj leak in VM_BIND error path If we fail a handle-lookup part way thru, we need to drop the already obtained obj references. Patchwork: https://patchwork.freedesktop.org/patch/669784/

• CVE-2025-40068Oct 28, 2025
  affected >= 5.15.0, < 5.15.195fixed 5.15.195

  In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: Fix integer overflow in run_unpack() The MFT record relative to the file being opened contains its runlist, an array containing information about the file's location on the physical disk. Analysis of

• CVE-2025-40067Oct 28, 2025
  affected < 6.6.112fixed 6.6.112

  In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist Index allocation requires at least one bit in the $BITMAP attribute to track usage of index entries. If the bitmap is empty while index blo

• CVE-2025-40066Oct 28, 2025
  affected >= 6.15.0, < 6.17.3fixed 6.17.3

  In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Check phy before init msta_link in mt7996_mac_sta_add_links() In order to avoid a possible NULL pointer dereference in mt7996_mac_sta_init_link routine, move the phy pointer check before run

• CVE-2025-40065Oct 28, 2025
  affected >= 5.16.0, < 6.17.3fixed 6.17.3

  In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Write hgatp register with valid mode bits According to the RISC-V Privileged Architecture Spec, when MODE=Bare is selected,software must write zero to the remaining fields of hgatp. We have detect

• CVE-2025-40064Oct 28, 2025
  affected >= 4.19.0, < 6.17.3fixed 6.17.3

  In the Linux kernel, the following vulnerability has been resolved: smc: Fix use-after-free in __pnet_find_base_ndev(). syzbot reported use-after-free of net_device in __pnet_find_base_ndev(), which was called during connect(). [0] smc_pnet_find_ism_resource() fetches sk_dst_g

• CVE-2025-40063Oct 28, 2025
  affected >= 6.16.0, < 6.17.3fixed 6.17.3

  In the Linux kernel, the following vulnerability has been resolved: crypto: comp - Use same definition of context alloc and free ops In commit 42d9f6c77479 ("crypto: acomp - Move scomp stream allocation code into acomp"), the crypto_acomp_streams struct was made to rely on havi

• CVE-2025-40062Oct 28, 2025
  affected < 6.1.156fixed 6.1.156

  In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs When the initialization of qm->debug.acc_diff_reg fails, the probe process does not exit. However, after qm->debug.qm_diff_regs is freed, it is not set

• CVE-2025-40061Oct 28, 2025
  affected >= 6.5.0, < 6.6.112fixed 6.6.112

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix race in do_task() when draining When do_task() exhausts its iteration budget (!ret), it sets the state to TASK_STATE_IDLE to reschedule, without a secondary check on the current task->state. This

• CVE-2025-40060Oct 28, 2025
  affected >= 5.13.0, < 5.15.195fixed 5.15.195

  In the Linux kernel, the following vulnerability has been resolved: coresight: trbe: Return NULL pointer for allocation failures When the TRBE driver fails to allocate a buffer, it currently returns the error code "-ENOMEM". However, the caller etm_setup_aux() only checks for a

• CVE-2025-40059Oct 28, 2025
  affected >= 6.8.0, < 6.12.53fixed 6.12.53

  In the Linux kernel, the following vulnerability has been resolved: coresight: Fix incorrect handling for return value of devm_kzalloc The return value of devm_kzalloc could be an null pointer, use "!desc.pdata" to fix incorrect handling return value of devm_kzalloc.

• CVE-2025-40058Oct 28, 2025
  affected >= 6.7.0, < 6.12.53fixed 6.12.53

  In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Disallow dirty tracking if incoherent page walk Dirty page tracking relies on the IOMMU atomically updating the dirty bit in the paging-structure entry. For this operation to succeed, the paging- st

• CVE-2025-40057Oct 28, 2025
  affected >= 5.14.0, < 6.12.53fixed 6.12.53

  In the Linux kernel, the following vulnerability has been resolved: ptp: Add a upper bound on max_vclocks syzbot reported WARNING in max_vclocks_store. This occurs when the argument max is too large for kcalloc to handle. Extend the guard to guard against values that are too