kernel

Vulnerabilities (1,755)

• CVE-2025-40056Oct 28, 2025
  affected >= 6.0.0, < 6.1.156fixed 6.1.156

  In the Linux kernel, the following vulnerability has been resolved: vhost: vringh: Fix copy_to_iter return value check The return value of copy_to_iter can't be negative, check whether the copied length is equal to the requested length instead of checking for negative values.

• CVE-2025-40055Oct 28, 2025
  affected >= 3.14.0, < 5.4.301fixed 5.4.301

  In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix double free in user_cluster_connect() user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then the error handling frees "lc" a second time. Set "lc" to NULL on this path to avoid a

• CVE-2025-40054Oct 28, 2025
  affected >= 5.5.0, < 6.17.3fixed 6.17.3

  In the Linux kernel, the following vulnerability has been resolved: f2fs: fix UAF issue in f2fs_merge_page_bio() As JY reported in bugzilla [1], Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 pc : [0xffffffe51d249484] f2fs_is_cp_guaranteed

• CVE-2025-40053Oct 28, 2025
  affected >= 2.6.12, < 5.10.246fixed 5.10.246

  In the Linux kernel, the following vulnerability has been resolved: net: dlink: handle copy_thresh allocation failure The driver did not handle failure of `netdev_alloc_skb_ip_align()`. If the allocation failed, dereferencing `skb->protocol` could lead to a NULL pointer derefer

• CVE-2025-40052Oct 28, 2025
  affected >= 6.3.0, < 6.6.112fixed 6.6.112

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix crypto buffers in non-linear memory The crypto API, through the scatterlist API, expects input buffers to be in linear memory. We handle this with the cifs_sg_set_buf() helper that converts vm

• CVE-2025-40051Oct 28, 2025
  affected >= 6.0.0, < 6.1.156fixed 6.1.156

  In the Linux kernel, the following vulnerability has been resolved: vhost: vringh: Modify the return value check The return value of copy_from_iter and copy_to_iter can't be negative, check whether the copied lengths are equal.

• CVE-2025-40050Oct 28, 2025
  affected >= 6.17.0, < 6.17.3fixed 6.17.3

  In the Linux kernel, the following vulnerability has been resolved: bpf: Skip scalar adjustment for BPF_NEG if dst is a pointer In check_alu_op(), the verifier currently calls check_reg_arg() and adjust_scalar_min_max_vals() unconditionally for BPF_NEG operations. However, if t

• CVE-2025-40049Oct 28, 2025
  affected >= 2.6.29, < 5.4.301fixed 5.4.301

  In the Linux kernel, the following vulnerability has been resolved: Squashfs: fix uninit-value in squashfs_get_parent Syzkaller reports a "KMSAN: uninit-value in squashfs_get_parent" bug. This is caused by open_by_handle_at() being called with a file handle containing an inval

• CVE-2025-40048Oct 28, 2025
  affected >= 4.10.0, < 5.4.301fixed 5.4.301

  In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Let userspace take care of interrupt mask Remove the logic to set interrupt mask by default in uio_hv_generic driver as the interrupt mask value is supposed to be controlled completely by the us

• CVE-2025-40047Oct 28, 2025
  affected >= 6.7.0, < 6.12.53fixed 6.12.53

  In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: always prune wait queue entry in io_waitid_wait() For a successful return, always remove our entry from the wait queue entry list. Previously this was skipped if a cancelation was in progress,

• CVE-2025-40046Oct 28, 2025
  affected >= 6.15.0, < 6.17.3fixed 6.17.3

  In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix overshooting recv limit It's reported that sometimes a zcrx request can receive more than was requested. It's caused by io_zcrx_recv_skb() adjusting desc->count for all received buffers inclu

• CVE-2025-40045Oct 28, 2025
  affected >= 6.11.0, < 6.12.53fixed 6.12.53

  In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd937x: set the comp soundwire port correctly For some reason we endup with setting soundwire port for HPHL_COMP and HPHR_COMP as zero, this can potentially result in a memory corruption due to a

• CVE-2025-40044Oct 28, 2025
  affected >= 2.6.12, < 5.4.301fixed 5.4.301

  In the Linux kernel, the following vulnerability has been resolved: fs: udf: fix OOB read in lengthAllocDescs handling When parsing Allocation Extent Descriptor, lengthAllocDescs comes from on-disk data and must be validated against the block size. Crafted or corrupted images m

• CVE-2025-40043Oct 28, 2025
  affected >= 3.2.0, < 5.15.195fixed 5.15.195

  In the Linux kernel, the following vulnerability has been resolved: net: nfc: nci: Add parameter validation for packet data Syzbot reported an uninitialized value bug in nci_init_req, which was introduced by commit 5aca7966d2a7 ("Merge tag 'perf-tools-fixes-for-v6.17-2025-09-16

• CVE-2025-40042Oct 28, 2025
  affected >= 2.6.33, < 5.4.301fixed 5.4.301

  In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference There is a critical race condition in kprobe initialization that can lead to NULL pointer dereference and kernel crash. [11

• CVE-2025-40041Oct 28, 2025
  affected >= 6.17.0, < 6.17.3fixed 6.17.3

  In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Sign-extend struct ops return values properly The ns_bpf_qdisc selftest triggers a kernel panic: Oops[#1]: CPU 0 Unable to handle kernel paging request at virtual address 0000000000741d58,

• CVE-2025-40038Oct 28, 2025
  affected >= 6.5.0, < 6.6.113fixed 6.6.113

  In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid Skip the WRMSR and HLT fastpaths in SVM's VM-Exit handler if the next RIP isn't valid, e.g. because KVM is running with nrips=false. SVM mus

• CVE-2025-40037Oct 28, 2025
  affected >= 6.8.0, < 6.12.53fixed 6.12.53

  In the Linux kernel, the following vulnerability has been resolved: fbdev: simplefb: Fix use after free in simplefb_detach_genpds() The pm_domain cleanup can not be devres managed as it uses struct simplefb_par which is allocated within struct fb_info by framebuffer_alloc(). Th

• CVE-2025-40036Oct 28, 2025
  affected >= 5.1.0, < 6.1.156fixed 6.1.156

  In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix possible map leak in fastrpc_put_args copy_to_user() failure would cause an early return without cleaning up the fdlist, which has been updated by the DSP. This could lead to map leak. Fix th

• CVE-2025-40035Oct 28, 2025
  affected >= 2.6.29, < 5.4.301fixed 5.4.301

  In the Linux kernel, the following vulnerability has been resolved: Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak Struct ff_effect_compat is embedded twice inside uinput_ff_upload_compat, contains internal padding. In particular, there is a hole aft