opensuse/kernel-source&distro=openSUSE Tumbleweed

Vulnerabilities (1,862)

• CVE-2025-40034Oct 28, 2025
  affected < 6.17.7-1.1fixed 6.17.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() When platform firmware supplies error information to the OS, e.g., via the ACPI APEI GHES mechanism, it may identify an error source device that doesn'

• CVE-2025-40033Oct 28, 2025
  affected < 6.17.7-1.1fixed 6.17.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() pru_rproc_set_ctable() accessed rproc->priv before the IS_ERR_OR_NULL check, which could lead to a null pointer dereference. Mov

• CVE-2025-40032Oct 28, 2025
  affected < 6.17.7-1.1fixed 6.17.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release The fields dma_chan_tx and dma_chan_rx of the struct pci_epf_test can be NULL even after EPF initialization. Then it is prudent to che

• CVE-2025-40031Oct 28, 2025
  affected < 6.17.7-1.1fixed 6.17.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: tee: fix register_shm_helper() In register_shm_helper(), fix incorrect error handling for a call to iov_iter_extract_pages(). A case is missing for when iov_iter_extract_pages() only got some pages and return a

• CVE-2025-40030Oct 28, 2025
  affected < 6.17.7-1.1fixed 6.17.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: pinctrl: check the return value of pinmux_ops::get_function_name() While the API contract in docs doesn't specify it explicitly, the generic implementation of the get_function_name() callback from struct pinmux

• CVE-2025-40029Oct 28, 2025
  affected < 6.17.7-1.1fixed 6.17.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: Check return value of platform_get_resource() platform_get_resource() returns NULL in case of failure, so check its return value and propagate the error in order to prevent NULL pointer dereference

• CVE-2025-40028HigOct 28, 2025
  affected < 6.17.7-1.1fixed 6.17.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: binder: fix double-free in dbitmap A process might fail to allocate a new bitmap when trying to expand its proc->dmap. In that case, dbitmap_grow() fails and frees the old bitmap via dbitmap_free(). However, th

• CVE-2025-40027HigOct 28, 2025
  affected < 6.17.7-1.1fixed 6.17.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: net/9p: fix double req put in p9_fd_cancelled Syzkaller reports a KASAN issue as below: general protection fault, probably for non-canonical address 0xfbd59c0000000021: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN:

• CVE-2025-40026HigOct 28, 2025
  affected < 6.17.7-1.1fixed 6.17.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished th

• CVE-2025-40025HigOct 28, 2025
  affected < 6.17.7-1.1fixed 6.17.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on node footer for non inode dnode As syzbot reported below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/file.c:1243! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI

• CVE-2025-40019Oct 24, 2025
  affected < 6.17.7-1.1fixed 6.17.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption.

• CVE-2025-40018HigOct 24, 2025
  affected < 6.17.7-1.1fixed 6.17.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leading to a use-after-fr

• CVE-2025-40017Oct 20, 2025
  affected < 6.17.5-1.1fixed 6.17.5-1.1

  In the Linux kernel, the following vulnerability has been resolved: media: iris: Fix memory leak by freeing untracked persist buffer One internal buffer which is allocated only once per session was not being freed during session close because it was not being tracked as part of

• CVE-2025-40016Oct 20, 2025
  affected < 6.17.5-1.1fixed 6.17.5-1.1

  In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID Per UVC 1.1+ specification 3.7.2, units and terminals must have a non-zero unique ID. ``` Each Unit and Terminal within the video function i

• CVE-2025-40015Oct 20, 2025
  affected < 6.17.5-1.1fixed 6.17.5-1.1

  In the Linux kernel, the following vulnerability has been resolved: media: stm32-csi: Fix dereference before NULL check In 'stm32_csi_start', 'csidev->s_subdev' is dereferenced directly while assigning a value to the 'src_pad'. However the same value is being checked against NU

• CVE-2025-40013Oct 20, 2025
  affected < 6.17.5-1.1fixed 6.17.5-1.1

  In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: audioreach: fix potential null pointer dereference It is possible that the topology parsing function audioreach_widget_load_module_common() could return NULL or an error pointer. Add missing NULL ch

• CVE-2025-40004Oct 20, 2025
  affected < 6.17.5-1.1fixed 6.17.5-1.1

  In the Linux kernel, the following vulnerability has been resolved: net/9p: Fix buffer overflow in USB transport layer A buffer overflow vulnerability exists in the USB 9pfs transport layer where inconsistent size validation between packet header parsing and actual data copying

• CVE-2025-40003Oct 18, 2025
  affected < 6.17.5-1.1fixed 6.17.5-1.1

  In the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work The origin code calls cancel_delayed_work() in ocelot_stats_deinit() to cancel the cyclic delayed work item ocelot->stats_work. However, cance

• CVE-2025-40002Oct 18, 2025
  affected < 6.17.5-1.1fixed 6.17.5-1.1

  In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix use-after-free in tb_dp_dprx_work The original code relies on cancel_delayed_work() in tb_dp_dprx_stop(), which does not ensure that the delayed work item tunnel->dprx_work has fully completed

• CVE-2025-40001Oct 18, 2025
  affected < 6.17.5-1.1fixed 6.17.5-1.1

  In the Linux kernel, the following vulnerability has been resolved: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue During the detaching of Marvell's SAS/SATA controller, the original code calls cancel_delayed_work() in mvs_free() to cancel the delayed work item mwq->wor