kernel

Vulnerabilities (1,755)

• CVE-2025-40034Oct 28, 2025
  affected >= 6.16.0, < 6.17.3fixed 6.17.3

  In the Linux kernel, the following vulnerability has been resolved: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() When platform firmware supplies error information to the OS, e.g., via the ACPI APEI GHES mechanism, it may identify an error source device that doesn'

• CVE-2025-40033Oct 28, 2025
  affected >= 6.3.0, < 6.6.112fixed 6.6.112

  In the Linux kernel, the following vulnerability has been resolved: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() pru_rproc_set_ctable() accessed rproc->priv before the IS_ERR_OR_NULL check, which could lead to a null pointer dereference. Mov

• CVE-2025-40032Oct 28, 2025
  affected >= 5.7.0, < 6.1.157fixed 6.1.157

  In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release The fields dma_chan_tx and dma_chan_rx of the struct pci_epf_test can be NULL even after EPF initialization. Then it is prudent to che

• CVE-2025-40031Oct 28, 2025
  affected >= 6.8.0, < 6.12.53fixed 6.12.53

  In the Linux kernel, the following vulnerability has been resolved: tee: fix register_shm_helper() In register_shm_helper(), fix incorrect error handling for a call to iov_iter_extract_pages(). A case is missing for when iov_iter_extract_pages() only got some pages and return a

• CVE-2025-40030Oct 28, 2025
  affected >= 4.19.0, < 5.4.301fixed 5.4.301

  In the Linux kernel, the following vulnerability has been resolved: pinctrl: check the return value of pinmux_ops::get_function_name() While the API contract in docs doesn't specify it explicitly, the generic implementation of the get_function_name() callback from struct pinmux

• CVE-2025-40029Oct 28, 2025
  affected >= 5.9.0, < 5.10.246fixed 5.10.246

  In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: Check return value of platform_get_resource() platform_get_resource() returns NULL in case of failure, so check its return value and propagate the error in order to prevent NULL pointer dereference

• CVE-2025-40028Oct 28, 2025
  affected >= 6.11.0, < 6.12.52fixed 6.12.52

  In the Linux kernel, the following vulnerability has been resolved: binder: fix double-free in dbitmap A process might fail to allocate a new bitmap when trying to expand its proc->dmap. In that case, dbitmap_grow() fails and frees the old bitmap via dbitmap_free(). However, th

• CVE-2025-40027Oct 28, 2025
  affected >= 3.15.0, < 5.4.301fixed 5.4.301

  In the Linux kernel, the following vulnerability has been resolved: net/9p: fix double req put in p9_fd_cancelled Syzkaller reports a KASAN issue as below: general protection fault, probably for non-canonical address 0xfbd59c0000000021: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN:

• CVE-2025-40026Oct 28, 2025
  affected >= 3.0.0, < 5.4.301fixed 5.4.301

  In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished th

• CVE-2025-40025Oct 28, 2025
  affected >= 3.8.0, < 6.17.2fixed 6.17.2

  In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on node footer for non inode dnode As syzbot reported below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/file.c:1243! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI

• CVE-2025-40024Oct 24, 2025
  affected >= 6.4.0, < 6.6.109fixed 6.6.109

  In the Linux kernel, the following vulnerability has been resolved: vhost: Take a reference on the task in struct vhost_task. vhost_task_create() creates a task and keeps a reference to its task_struct. That task may exit early via a signal and its task_struct will be released.

• CVE-2025-40023Oct 24, 2025
  affected >= 6.16.0, < 6.16.10fixed 6.16.10

  In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Don't expose sysfs attributes not applicable for VFs VFs can't read BMG_PCIE_CAP(0x138340) register nor access PCODE (already guarded by the info.skip_pcode flag) so we shouldn't expose attributes th

• CVE-2025-40022Oct 24, 2025
  affected >= 6.1.154, < 6.1.155fixed 6.1.155

  In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx Commit 1b34cbbf4f01 ("crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg") changed some fields from bool to 1-bit bitfields of type u32. H

• CVE-2025-40021Oct 24, 2025
  affected >= 5.4.0, < 5.10.245fixed 5.10.245

  In the Linux kernel, the following vulnerability has been resolved: tracing: dynevent: Add a missing lockdown check on dynevent Since dynamic_events interface on tracefs is compatible with kprobe_events and uprobe_events, it should also check the lockdown status and reject if i

• CVE-2025-40020Oct 24, 2025
  affected >= 3.4.0, < 5.4.300fixed 5.4.300

  In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: fix shift-out-of-bounds issue Explicitly uses a 64-bit constant when the number of bits used for its shifting is 32 (which is the case for PC CAN FD interfaces supported by this driver). [mkl: u

• CVE-2025-40019Oct 24, 2025
  affected >= 5.4.0, < 5.4.301fixed 5.4.301

  In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption.

• CVE-2025-40018Oct 24, 2025
  affected >= 2.6.39, < 5.4.301fixed 5.4.301

  In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leading to a use-after-fr

• CVE-2023-53733Oct 24, 2025
  affected >= 4.7.0, < 6.1.42fixed 6.1.42

  In the Linux kernel, the following vulnerability has been resolved: net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode When u32_replace_hw_knode fails, we need to undo the tcf_bind_filter operation done at u32_set_parms.

• CVE-2023-53732Oct 22, 2025
  affected >= 5.15.0, < 5.15.113fixed 5.15.113

  In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix NULL dereference in ni_write_inode Syzbot reports a NULL dereference in ni_write_inode. When creating a new inode, if allocation fails in mi_init function (called in mi_format_new function), mi->m

• CVE-2023-53731Oct 22, 2025
  affected < 4.14.322fixed 4.14.322

  In the Linux kernel, the following vulnerability has been resolved: netlink: fix potential deadlock in netlink_set_err() syzbot reported a possible deadlock in netlink_set_err() [1] A similar issue was fixed in commit 1d482e666b8e ("netlink: disable IRQs for netlink_lock_table