suse/kernel-azure&distro=SUSE Linux Enterprise Server 16.0

Vulnerabilities (594)

• CVE-2025-40332Dec 9, 2025
  affected < 6.12.0-160000.9.1fixed 6.12.0-160000.9.1

  In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix mmap write lock not release If mmap write lock is taken while draining retry fault, mmap write lock is not released because svm_range_restore_pages calls mmap_read_unlock then returns. This caus

• CVE-2025-40331Dec 9, 2025
  affected < 6.12.0-160000.9.1fixed 6.12.0-160000.9.1

  In the Linux kernel, the following vulnerability has been resolved: sctp: Prevent TOCTOU out-of-bounds write For the following path not holding the sock lock, sctp_diag_dump() -> sctp_for_each_endpoint() -> sctp_ep_dump() make sure not to exceed bounds in case the address l

• CVE-2025-40330Dec 9, 2025
  affected < 6.12.0-160000.9.1fixed 6.12.0-160000.9.1

  In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Shutdown FW DMA in bnxt_shutdown() The netif_close() call in bnxt_shutdown() only stops packet DMA. There may be FW DMA for trace logging (recently added) that will continue. If we kexec to a new ker

• CVE-2025-40329Dec 9, 2025
  affected < 6.12.0-160000.9.1fixed 6.12.0-160000.9.1

  In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb The Mesa issue referenced below pointed out a possible deadlock: [ 1231.611031] Possible interrupt unsafe locking scenario: [ 1231.611033] CPU0

• CVE-2025-40328Dec 9, 2025
  affected < 6.12.0-160000.9.1fixed 6.12.0-160000.9.1

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_close_cached_fid() find_or_create_cached_dir() could grab a new reference after kref_put() had seen the refcount drop to zero but before cfid_list_lock is acquired in smb2

• CVE-2025-40324Dec 8, 2025
  affected < 6.12.0-160000.9.1fixed 6.12.0-160000.9.1

  In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix crash in nfsd4_read_release() When tracing is enabled, the trace_nfsd_read_done trace point crashes during the pynfs read.testNoFh test.

• CVE-2025-40323Dec 8, 2025
  affected < 6.12.0-160000.9.1fixed 6.12.0-160000.9.1

  In the Linux kernel, the following vulnerability has been resolved: fbcon: Set fb_display[i]->mode to NULL when the mode is released Recently, we discovered the following issue through syzkaller: BUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0 Read of size 4 at

• CVE-2025-40322Dec 8, 2025
  affected < 6.12.0-160000.9.1fixed 6.12.0-160000.9.1

  In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_putcs* bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and

• CVE-2025-40321Dec 8, 2025
  affected < 6.12.0-160000.9.1fixed 6.12.0-160000.9.1

  In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode Currently, whenever there is a need to transmit an Action frame, the brcmfmac driver always uses the P2P vif to send the "actframe" IO

• CVE-2025-40320Dec 8, 2025
  affected < 6.12.0-160000.9.1fixed 6.12.0-160000.9.1

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential cfid UAF in smb2_query_info_compound When smb2_query_info_compound() retries, a previously allocated cfid may have been freed in the first attempt. Because cfid wasn't reset on replay

• CVE-2025-40319Dec 8, 2025
  affected < 6.12.0-160000.9.1fixed 6.12.0-160000.9.1

  In the Linux kernel, the following vulnerability has been resolved: bpf: Sync pending IRQ work before freeing ring buffer Fix a race where irq_work can be queued in bpf_ringbuf_commit() but the ring buffer is freed before the work executes. In the syzbot reproducer, a BPF progr

• CVE-2025-40318Dec 8, 2025
  affected < 6.12.0-160000.9.1fixed 6.12.0-160000.9.1

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the

• CVE-2025-40317Dec 8, 2025
  affected < 6.12.0-160000.9.1fixed 6.12.0-160000.9.1

  In the Linux kernel, the following vulnerability has been resolved: regmap: slimbus: fix bus_context pointer in regmap init calls Commit 4e65bda8273c ("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()") revealed the problem in the slimbus regmap. That commit brea

• CVE-2025-40316Dec 8, 2025
  affected < 6.12.0-160000.9.1fixed 6.12.0-160000.9.1

  In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix device use-after-free on unbind A recent change fixed device reference leaks when looking up drm platform device driver data during bind() but failed to remove a partial fix which had been add

• CVE-2025-40315Dec 8, 2025
  affected < 6.12.0-160000.9.1fixed 6.12.0-160000.9.1

  In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix epfile null pointer access after ep enable. A race condition occurs when ffs_func_eps_enable() runs concurrently with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset() set

• CVE-2025-40314Dec 8, 2025
  affected < 6.12.0-160000.9.1fixed 6.12.0-160000.9.1

  In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget In the __cdnsp_gadget_init() and cdnsp_gadget_exit() functions, the gadget structure (pdev->gadget) was freed before its

• CVE-2025-40311Dec 8, 2025
  affected < 6.12.0-160000.9.1fixed 6.12.0-160000.9.1

  In the Linux kernel, the following vulnerability has been resolved: accel/habanalabs: support mapping cb with vmalloc-backed coherent memory When IOMMU is enabled, dma_alloc_coherent() with GFP_USER may return addresses from the vmalloc range. If such an address is mapped witho

• CVE-2025-40310Dec 8, 2025
  affected < 6.12.0-160000.9.1fixed 6.12.0-160000.9.1

  In the Linux kernel, the following vulnerability has been resolved: amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw There is race in amdgpu_amdkfd_device_fini_sw and interrupt. if amdgpu_amdkfd_device_fini_sw run in b/w kfd_cleanup_nodes and kfree(kfd), and KGD int

• CVE-2025-40309Dec 8, 2025
  affected < 6.12.0-160000.9.1fixed 6.12.0-160000.9.1

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix UAF on sco_conn_free BUG: KASAN: slab-use-after-free in sco_conn_free net/bluetooth/sco.c:87 [inline] BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:65 [inline] BUG: KASAN:

• CVE-2025-40308Dec 8, 2025
  affected < 6.12.0-160000.9.1fixed 6.12.0-160000.9.1

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bcsp: receive data only if registered Currently, bcsp_recv() can be called even when the BCSP protocol has not been registered. This leads to a NULL pointer dereference, as shown in the following sta