CVE-2025-22079

ocfs2: validate l_tree_depth to avoid out-of-bounds access

7.8 HighFix available

What does this mean?

: 7.8v3.1, from CVE List
: 0.26%17th percentile
Fixed in: 6.1.134-r0linux-lts
Published: April 16, 2025
Modified: November 11, 2026
Weakness: CWE-125
Also known as: BELL-CVE-2025-22079CLSA-2025-1757963029CLSA-2025-1758010922CLSA-2025-1763991095DEBIAN-CVE-2025-22079DLA-4178-1DLA-4193-1DSA-5907-1
Show 48 moreShow less
EUVD-2025-11222GHSA-h8h5-wj84-22hpMGASA-2025-0142MGASA-2025-0146OESA-2025-1539OESA-2025-1540OESA-2025-2852OESA-2025-2853ROOT-OS-UBUNTU-2404-CVE-2025-22079UBUNTU-CVE-2025-22079USN-7585-1USN-7585-2USN-7585-3USN-7585-4USN-7585-5USN-7585-6USN-7585-7USN-7591-1USN-7591-2USN-7591-3USN-7591-4USN-7591-5USN-7591-6USN-7592-1USN-7593-1USN-7594-1USN-7594-2USN-7594-3USN-7597-1USN-7597-2USN-7598-1USN-7602-1USN-7605-1USN-7605-2USN-7606-1USN-7628-1USN-7640-1USN-7655-1USN-7835-1USN-7835-2USN-7835-3USN-7835-4USN-7835-5USN-7835-6USN-7887-1USN-7887-2USN-7940-1USN-7940-2

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate l_tree_depth to avoid out-of-bounds access

The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is limited to OCFS2_MAX_PATH_DEPTH.

Add a check to prevent out-of-bounds access if l_tree_depth has an invalid value, which may occur when reading from a corrupted mounted disk [1].

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.26%Up 0.2 points since Apr 17, 2025

What each source reports

CVE List Score used 7.8

ocfs2: validate l_tree_depth to avoid out-of-bounds access

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate l_tree_depth to avoid out-of-bounds access

The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is limited to OCFS2_MAX_PATH_DEPTH.

Add a check to prevent out-of-bounds access if l_tree_depth has an invalid value, which may occur when reading from a corrupted mounted disk [1].

Record: CVE-2025-22079
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2025-11222 7.8

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate l_tree_depth to avoid out-of-bounds access

The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is limited to OCFS2_MAX_PATH_DEPTH.

Add a check to prevent out-of-bounds access if l_tree_depth has an invalid value, which may occur when reading from a corrupted mounted disk [1].

Record: EUVD-2025-11222
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-h8h5-wj84-22hp 7.1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate l_tree_depth...

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate l_tree_depth to avoid out-of-bounds access

The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is limited to OCFS2_MAX_PATH_DEPTH.

Add a check to prevent out-of-bounds access if l_tree_depth has an invalid value, which may occur when reading from a corrupted mounted disk [1].

Record: GHSA-h8h5-wj84-22hp
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

NVD 7.8

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate l_tree_depth to avoid out-of-bounds access

The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is limited to OCFS2_MAX_PATH_DEPTH.

Add a check to prevent out-of-bounds access if l_tree_depth has an invalid value, which may occur when reading from a corrupted mounted disk [1].

Record: CVE-2025-22079
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

OSVBELL-CVE-2025-22079 7.1

Record: BELL-CVE-2025-22079
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSV 7.8

ocfs2: validate l_tree_depth to avoid out-of-bounds access

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate l_tree_depth to avoid out-of-bounds access

The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is limited to OCFS2_MAX_PATH_DEPTH.

Add a check to prevent out-of-bounds access if l_tree_depth has an invalid value, which may occur when reading from a corrupted mounted disk [1].

Record: CVE-2025-22079
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 45 moreShow less

OSVDEBIAN-CVE-2025-22079 7.1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate l_tree_depth to avoid out-of-bounds access The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is limited to OCFS2_MAX_PATH_DEPTH. Add a check to prevent out-of-bounds access if l_tree_depth has an invalid value, which may occur when reading from a corrupted mounted disk [1].

Record: DEBIAN-CVE-2025-22079
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVOESA-2025-1539 7.0

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

bpf: track changes_pkt_data property for global functions

When processing calls to certain helpers, verifier invalidates all packet pointers in a current state. For example, consider the following program:

__attribute__((__noinline__))
long skb_pull_data(struct __sk_buff *sk, __u32 len)
{
    return bpf_skb_pull_data(sk, len);
}

SEC(&quot;tc&quot;)
int test_invalidate_checks(struct __sk_buff *sk)
{
    int *p = (void *)(long)sk-&gt;data;
    if ((void *)(p + 1) &gt; (void *)(long)sk-&gt;data_end) return TCX_DROP;
    skb_pull_data(sk, 0);
    *p = 42;
    return TCX_PASS;
}

After a call to bpf_skb_pull_data() the pointer 'p' can't be used safely. See function filter.c:bpf_helper_changes_pkt_data() for a list of such helpers.

At the moment verifier invalidates packet pointers when processing helper function calls, and does not traverse global sub-programs when processing calls to global sub-programs. This means that calls to helpers done from global sub-programs do not invalidate pointers in the caller state. E.g. the program above is unsafe, but is not rejected by verifier.

This commit fixes the omission by computing field bpf_subprog_info->changes_pkt_data for each sub-program before main verification pass. changes_pkt_data should be set if:

subprogram calls helper for which bpf_helper_changes_pkt_data returns true;
subprogram calls a global function, for which bpf_subprog_info->changes_pkt_data should be set.

The verifier.c:check_cfg() pass is modified to compute this information. The commit relies on depth first instruction traversal done by check_cfg() and absence of recursive function calls:

check_cfg() would eventually visit every call to subprogram S in a state when S is fully explored;
when S is fully explored:
- every direct helper call within S is explored (and thus changes_pkt_data is set if needed);
- every call to subprogram S1 called by S was visited with S1 fully explored (and thus S inherits changes_pkt_data from S1).

The downside of such approach is that dead code elimination is not taken into account: if a helper call inside global function is dead because of current configuration, verifier would conservatively assume that the call occurs for the purpose of the changes_pkt_data computation.(CVE-2024-58098)

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate l_tree_depth to avoid out-of-bounds access

The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is limited to OCFS2_MAX_PATH_DEPTH.

Add a check to prevent out-of-bounds access if l_tree_depth has an invalid value, which may occur when reading from a corrupted mounted disk [1].(CVE-2025-22079)

In the Linux kernel, the following vulnerability has been resolved:

mfd: ene-kb3930: Fix a potential NULL pointer dereference

The off_gpios could be NULL. Add missing check in the kb3930_probe(). This is similar to the issue fixed in commit b1ba8bcb2d1f ("backlight: hx8357: Fix potential NULL pointer dereference").

This was detected by our static analysis tool.(CVE-2025-23146)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix kmemleak warning for percpu hashmap

Vlad Poenaru reported the following kmemleak issue:

unreferenced object 0x606fd7c44ac8 (size 32): backtrace (crc 0): pcpu_alloc_noprof+0x730/0xeb0 bpf_map_alloc_percpu+0x69/0xc0 prealloc_init+0x9d/0x1b0 htab_map_alloc+0x363/0x510 map_create+0x215/0x3a0 __sys_bpf+0x16b/0x3e0 __x64_sys_bpf+0x18/0x20 do_syscall_64+0x7b/0x150 entry_SYSCALL_64_after_hwframe+0x4b/0x53

Further investigation shows the reason is due to not 8-byte aligned store of percpu pointer in htab_elem_set_ptr(): *(void __percpu…

Record: OESA-2025-1539
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-1540 7.0

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

bpf: track changes_pkt_data property for global functions

When processing calls to certain helpers, verifier invalidates all packet pointers in a current state. For example, consider the following program:

__attribute__((__noinline__))
long skb_pull_data(struct __sk_buff *sk, __u32 len)
{
    return bpf_skb_pull_data(sk, len);
}

SEC(&quot;tc&quot;)
int test_invalidate_checks(struct __sk_buff *sk)
{
    int *p = (void *)(long)sk-&gt;data;
    if ((void *)(p + 1) &gt; (void *)(long)sk-&gt;data_end) return TCX_DROP;
    skb_pull_data(sk, 0);
    *p = 42;
    return TCX_PASS;
}

After a call to bpf_skb_pull_data() the pointer 'p' can't be used safely. See function filter.c:bpf_helper_changes_pkt_data() for a list of such helpers.

This commit fixes the omission by computing field bpf_subprog_info->changes_pkt_data for each sub-program before main verification pass. changes_pkt_data should be set if:

subprogram calls helper for which bpf_helper_changes_pkt_data returns true;
subprogram calls a global function, for which bpf_subprog_info->changes_pkt_data should be set.

The verifier.c:check_cfg() pass is modified to compute this information. The commit relies on depth first instruction traversal done by check_cfg() and absence of recursive function calls:

check_cfg() would eventually visit every call to subprogram S in a state when S is fully explored;
when S is fully explored:
- every direct helper call within S is explored (and thus changes_pkt_data is set if needed);
- every call to subprogram S1 called by S was visited with S1 fully explored (and thus S inherits changes_pkt_data from S1).

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate l_tree_depth to avoid out-of-bounds access

The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is limited to OCFS2_MAX_PATH_DEPTH.

Add a check to prevent out-of-bounds access if l_tree_depth has an invalid value, which may occur when reading from a corrupted mounted disk [1].(CVE-2025-22079)

In the Linux kernel, the following vulnerability has been resolved:

mfd: ene-kb3930: Fix a potential NULL pointer dereference

The off_gpios could be NULL. Add missing check in the kb3930_probe(). This is similar to the issue fixed in commit b1ba8bcb2d1f ("backlight: hx8357: Fix potential NULL pointer dereference").

This was detected by our static analysis tool.(CVE-2025-23146)

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix kmemleak warning for percpu hashmap

Vlad Poenaru reported the following kmemleak issue:

Further investigation shows the reason is due to not 8-byte aligned store of percpu pointer in htab_elem_set_ptr(): *(void __percpu…

Record: OESA-2025-1540
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-2852 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate l_tree_depth to avoid out-of-bounds access

The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is limited to OCFS2_MAX_PATH_DEPTH.

Add a check to prevent out-of-bounds access if l_tree_depth has an invalid value, which may occur when reading from a corrupted mounted disk [1].(CVE-2025-22079)

In the Linux kernel, the following vulnerability has been resolved:

mfd: ene-kb3930: Fix a potential NULL pointer dereference

The off_gpios could be NULL. Add missing check in the kb3930_probe(). This is similar to the issue fixed in commit b1ba8bcb2d1f ("backlight: hx8357: Fix potential NULL pointer dereference").

This was detected by our static analysis tool.(CVE-2025-23146)

In the Linux kernel, the following vulnerability has been resolved:

jbd2: remove wrong sb->s_sequence check

Journal emptiness is not determined by sb->s_sequence == 0 but rather by sb->s_start == 0 (which is set a few lines above). Furthermore 0 is a valid transaction ID so the check can spuriously trigger. Remove the invalid WARN_ON.(CVE-2025-37839)

In the Linux kernel, bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and read past the end of the built-in font array. Clamp the index to the actual glyph count before computing the address. This fixes a global out-of-bounds read reported by syzbot.(CVE-2025-40322)

Record: OESA-2025-2852
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-2853 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate l_tree_depth to avoid out-of-bounds access

The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is limited to OCFS2_MAX_PATH_DEPTH.

Add a check to prevent out-of-bounds access if l_tree_depth has an invalid value, which may occur when reading from a corrupted mounted disk [1].(CVE-2025-22079)

In the Linux kernel, the following vulnerability has been resolved:

mfd: ene-kb3930: Fix a potential NULL pointer dereference

The off_gpios could be NULL. Add missing check in the kb3930_probe(). This is similar to the issue fixed in commit b1ba8bcb2d1f ("backlight: hx8357: Fix potential NULL pointer dereference").

This was detected by our static analysis tool.(CVE-2025-23146)

In the Linux kernel, the following vulnerability has been resolved:

jbd2: remove wrong sb->s_sequence check

Record: OESA-2025-2853
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2404-CVE-2025-22079 7.1

CVE-2025-22079 in linux - Patched by Root

Root has patched CVE-2025-22079 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2025-22079
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2025-22079 7.2

Record: UBUNTU-CVE-2025-22079
CVSS 4.0: 7.2 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-11

OSVCLSA-2025-1757963029 No score

kernel-uek: Fix of 195 CVEs

rds: tcp: block BH in TCP callbacks
kexec: Improve & fix crash_exclude_mem_range() to handle overlapping ranges
module: correctly exit module_kallsyms_on_each_symbol when fn() != 0
module: potential uninitialized return in module_kallsyms_on_each_symbol()
module: use RCU to synchronize find_module
kallsyms: refactor {,module_}kallsyms_on_each_symbol
LTS tag: v5.4.295
scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() {CVE-2025-38320}
perf: Fix sample vs do_exit() {CVE-2025-38424}
s390/pci: Fix __pcilg_mio_inuser() inline assembly
rtc: test: Fix invalid format specifier.
jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() {CVE-2025-38337}
mm/huge_memory: fix dereferencing invalid pmd migration entry {CVE-2025-37958}
rtc: Make rtc_time64_to_tm() support dates before 1970
rtc: Improve performance of rtc_time64_to_tm(). Add tests.
xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create {CVE-2022-48773}
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms
ARM: dts: am335x-bone-common: Increase MDIO reset deassert time
ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board
net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
net: atm: add lec_mutex {CVE-2025-38323}
calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). {CVE-2025-38181}
tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer {CVE-2025-38184}
tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
atm: atmtcp: Free invalid length skb in atmtcp_c_send(). {CVE-2025-38185}
mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). {CVE-2025-38324}
wifi: carl9170: do not ping device which has failed to load firmware {CVE-2025-38420}
aoe: clean device rq_list in aoedev_downdev() {CVE-2025-38326}
hwmon: (occ) fix unaligned accesses
drm/nouveau/bl: increase buffer size to avoid truncate warning
erofs: remove unused trace event erofs_destroy_inode
ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
ALSA: hda/intel: Add Thinkpad E15 to PM deny list
Input: sparcspkr - avoid unannotated fall-through
HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
atm: Revert atm_account_tx() if copy_from_iter_full() fails. {CVE-2025-38190}
selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
scsi: s390: zfcp: Ensure synchronous unit_add
scsi: storvsc: Increase the timeouts to storvsc_timeout
jffs2: check jffs2_prealloc_raw_node_refs() result in few other places {CVE-2025-38328}
jffs2: check that raw node were preallocated before writing summary {CVE-2025-38194}
drivers/rapidio/rio_cm.c: prevent possible heap overwrite {CVE-2025-38090}
powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
platform/x86: dell_rbu: Stop overwriting data buffer
platform: Add Surface platform directory
Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
tee: Prevent size calculation wraparound on 32-bit kernels
ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
watchdog: da9052_wdt: respect TWDMIN
i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}
sock: Correct error checking condition for (assign|release)_proto_idx()
scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
vxlan: Do not treat dst cache initialization errors as fatal
clk: rockchip: rk3036: mark ddrphy as critical
wifi: mac80211: do not offer a mesh path if forwarding is disabled
net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
pinctrl: armada-37xx:…

Record: CLSA-2025-1757963029
Updated: 2026-11-02

OSVCLSA-2025-1758010922 No score

Fix of 49 CVEs

CVE-url: https://ubuntu.com/security/CVE-2025-38000
- sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
CVE-url: https://ubuntu.com/security/CVE-2024-57996 // CVE-url: https://ubuntu.com/security/CVE-2025-37752
- net_sched: sch_sfq: move the limit validation
Focal update: v5.4.285 upstream stable release (LP: #2089233) // CVE-2024-50202 // CVE-url: https://ubuntu.com/security/CVE-2024-50202
- nilfs2: propagate directory read errors from nilfs_find_entry()
Focal update: v5.4.279 upstream stable release (LP: #2073621) // CVE-url: https://ubuntu.com/security/CVE-2024-50202
- nilfs2: Remove check for PageError
- nilfs2: return the mapped address from nilfs_get_page()
Focal update: v5.4.287 upstream stable release (LP: #2095145) // CVE-url: https://ubuntu.com/security/CVE-2024-53131
- nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
Focal update: v5.4.287 upstream stable release (LP: #2095145) // CVE-url: https://ubuntu.com/security/CVE-2024-53130
- nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
CVE-url: https://ubuntu.com/security/CVE-2022-49179
- block, bfq: don't move oom_bfqq
CVE-url: https://ubuntu.com/security/CVE-2022-49176
- bfq: fix use-after-free in bfq_dispatch_request
CVE-url: https://ubuntu.com/security/CVE-2025-21956
- drm/amd/display: Assign normalized_pix_clk when color depth = 14
CVE-url: https://ubuntu.com/security/CVE-2025-21992
- HID: ignore non-functional sensor in HP 5MP Camera
CVE-url: https://ubuntu.com/security/CVE-2025-22021
- netfilter: socket: Lookup orig tuple for IPv6 SNAT
CVE-url: https://ubuntu.com/security/CVE-2025-22073
- spufs: fix a leak on spufs_new_file() failure
CVE-url: https://ubuntu.com/security/CVE-2025-22079
- ocfs2: validate l_tree_depth to avoid out-of-bounds access
CVE-url: https://ubuntu.com/security/CVE-2025-22086
- RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
CVE-url: https://ubuntu.com/security/CVE-2025-21722
- nilfs2: do not force clear folio if buffer is referenced
CVE-url: https://ubuntu.com/security/CVE-2025-22018
- atm: Fix NULL pointer dereference
CVE-url: https://ubuntu.com/security/CVE-2024-58071
- team: prevent adding a device which is already a team device lower
CVE-url: https://ubuntu.com/security/CVE-2024-58063
- wifi: rtlwifi: fix memory leaks and invalid access at probe error path
CVE-url: https://ubuntu.com/security/CVE-2024-58052
- drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table
CVE-url: https://ubuntu.com/security/CVE-2024-58058
- ubifs: skip dumping tnc tree when zroot is null
CVE-url: https://ubuntu.com/security/CVE-2025-21859
- USB: gadget: f_midi: f_midi_complete to call queue_work
CVE-url: https://ubuntu.com/security/CVE-2025-21640
- sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
CVE-url: https://ubuntu.com/security/CVE-2024-57922
- drm/amd/display: Add check for granularity in dml ceil/floor helpers
CVE-url: https://ubuntu.com/security/CVE-2024-57913
- usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
CVE-url: https://ubuntu.com/security/CVE-2025-21638
- sctp: sysctl: auth_enable: avoid using current->nsproxy
CVE-url: https://ubuntu.com/security/CVE-2024-50195
- posix-clock: Fix missing timespec64 check in pc_clock_settime()
CVE-url: https://ubuntu.com/security/CVE-2024-50299
- sctp: properly validate chunk size in sctp_sf_ootb()
CVE-url: https://ubuntu.com/security/CVE-2024-50273
- btrfs: reinitialize delayed ref list after deleting it from the list
CVE-url: https://ubuntu.com/security/CVE-2024-41016
- ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
CVE-url: https://ubuntu.com/security/CVE-2024-50287 -…

Record: CLSA-2025-1758010922
Updated: 2026-11-02

OSVCLSA-2025-1763991095 No score

Fix of 25 CVEs

Focal update: v5.4.291 upstream stable release (LP: #2106002) // CVE-2025-21772
- partitions: mac: fix handling of bogus partition table
CVE-url: https://ubuntu.com/security/CVE-2025-22079
- ocfs2: validate l_tree_depth to avoid out-of-bounds access
CVE-url: https://ubuntu.com/security/CVE-2024-58014
- wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
CVE-url: https://ubuntu.com/security/CVE-2024-41042
- netfilter: nf_tables: prefer nft_chain_validate
CVE-url: https://ubuntu.com/security/CVE-2024-46713
- perf/aux: Fix AUX buffer serialization
CVE-url: https://ubuntu.com/security/CVE-2025-38352
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
CVE-url: https://ubuntu.com/security/CVE-2025-38477
- net/sched: sch_qfq: Fix race condition on qfq_aggregate
Focal update: v5.4.262 upstream stable release (LP: #2049069) // CVE-url: https://ubuntu.com/security/CVE-2023-52804
- fs/jfs: Add check for negative db_l2nbperpage
- fs/jfs: Add validity check for db_maxag and db_agpref
Focal update: v5.4.251 upstream stable release (LP: #2034918) // CVE-url: https://ubuntu.com/security/CVE-2023-52804
- jfs: jfs_dmap: Validate db_l2nbperpage while mounting
Bionic update: upstream stable patchset 2023-02-06 (LP: #2006403) // CVE- url: https://ubuntu.com/security/CVE-2023-52804
- fs: jfs: fix shift-out-of-bounds in dbAllocAG
CVE-url: https://ubuntu.com/security/CVE-2022-25265
- x86/elf: Add table to document READ_IMPLIES_EXEC
- x86/elf: Split READ_IMPLIES_EXEC from executable PT_GNU_STACK
- x86/elf: Disable automatic READ_IMPLIES_EXEC on 64-bit
Bionic update: upstream stable patchset 2021-06-11 (LP: #1931740) // CVE- url: https://ubuntu.com/security/CVE-2021-47153
- i2c: i801: Don't generate an interrupt on bus reset
Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE- url: https://ubuntu.com/security/CVE-2022-48757
- net: fix information leakage in /proc/net/ptype
Focal update: v5.4.279 upstream stable release (LP: #2073621) // CVE-url: https://ubuntu.com/security/CVE-2024-37078
- nilfs2: fix potential kernel bug due to lack of writeback flag waiting
Bionic update: upstream stable patchset 2022-03-04 (LP: #1963717) // CVE- url: https://ubuntu.com/security/CVE-2022-48760
- USB: core: Fix hang in usb_kill_urb by adding memory barriers
Bionic update: upstream stable patchset 2021-11-02 (LP: #1949512) // CVE- url: https://ubuntu.com/security/CVE-2021-47383
- tty: Fix out-of-bound vmalloc access in imageblit
Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE- url: https://ubuntu.com/security/CVE-2022-49145
- ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
Bionic update: upstream stable patchset 2021-11-23 (LP: #1951997) // CVE- url: https://ubuntu.com/security/CVE-2021-47458
- ocfs2: mount fails with buffer overflow in strlen
CVE-url: https://ubuntu.com/security/CVE-2022-49170
- f2fs: fix to do sanity check on curseg->alloc_type
CVE-url: https://ubuntu.com/security/CVE-2021-47479
- staging: rtl8712: fix use-after-free in rtl8712_dl_fw
Bionic update: upstream stable patchset 2021-12-03 (LP: #1953202) // CVE- url: https://ubuntu.com/security/CVE-2021-47477
- comedi: dt9812: fix DMA buffers on stack
Bionic update: upstream stable patchset 2022-05-17 (LP: #1973831) // CVE- url: https://ubuntu.com/security/CVE-2021-47642
- video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
Bionic update: upstream stable patchset 2022-01-06 (LP: #1956614) // CVE- url: https://ubuntu.com/security/CVE-2021-47565
- scsi: mpt3sas: Fix kernel panic during drive powercycle test
Bionic update: upstream stable patchset 2022-01-06…

Record: CLSA-2025-1763991095
Updated: 2026-11-02

OSVMGASA-2025-0142 No score

Updated kernel, kmod-virtualbox & kmod-xtables-addons packages fix security vulnerabilities

Upstream kernel version 6.6.87 fixes bugs and vulnerabilities. The kmod-virtualbox and kmod-xtables-addons packages have been updated to work with this new kernel. For information about the vulnerabilities see the links.

Record: MGASA-2025-0142
Updated: 2026-11-02

OSVMGASA-2025-0146 No score

Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.6.88 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.

Record: MGASA-2025-0146
Updated: 2026-11-02

OSVUSN-7585-1 No score

linux, linux-aws, linux-aws-5.4, linux-azure, linux-gcp, linux-gcp-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp vulnerabilities

It was discovered that the CIFS network file system implementation in the Linux kernel did not properly verify the target namespace when handling upcalls. An attacker could use this to expose sensitive information. (CVE-2025-2312)