CVE-2025-40304

In the Linux kernel, the following vulnerability has been resolved: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if the Y position is off-screen and clip image height to screen boundary. Break from the rendering loop if the X position is off-screen. When clipping image width to fit the screen, update the character count to match the clipped width to prevent buffer size mismatches. Without the character count update, bit_putcs_aligned and bit_putcs_unaligned receive mismatched parameters where the buffer is allocated for the clipped width but cnt reflects the original larger count, causing out-of-bounds writes.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()

Jakub added a lockdep_assert_no_hardirq() check in __page_pool_put_page() to increase test coverage.

syzbot found a splat caused by hard irq blocking in ptr_ring_resize_multiple() [1]

As current users of ptr_ring_resize_multiple() do not require hard irqs being masked, replace it to only block BH.

Rename helpers to better reflect they are safe against BH only.

• ptr_ring_resize_multiple() to ptr_ring_resize_multiple_bh()
• skb_array_resize_multiple() to skb_array_resize_multiple_bh()

[1]

WARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 __page_pool_put_page net/core/page_pool.c:709 [inline] WARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780 Modules linked in: CPU: 1 UID: 0 PID: 9150 Comm: syz.1.1052 Not tainted 6.11.0-rc3-syzkaller-00202-gf8669d7b5f5d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:__page_pool_put_page net/core/page_pool.c:709 [inline] RIP: 0010:page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780 Code: 74 0e e8 7c aa fb f7 eb 43 e8 75 aa fb f7 eb 3c 65 8b 1d 38 a8 6a 76 31 ff 89 de e8 a3 ae fb f7 85 db 74 0b e8 5a aa fb f7 90 <0f> 0b 90 eb 1d 65 8b 1d 15 a8 6a 76 31 ff 89 de e8 84 ae fb f7 85 RSP: 0018:ffffc9000bda6b58 EFLAGS: 00010083 RAX: ffffffff8997e523 RBX: 0000000000000000 RCX: 0000000000040000 RDX: ffffc9000fbd0000 RSI: 0000000000001842 RDI: 0000000000001843 RBP: 0000000000000000 R08: ffffffff8997df2c R09: 1ffffd40003a000d R10: dffffc0000000000 R11: fffff940003a000e R12: ffffea0001d00040 R13: ffff88802e8a4000 R14: dffffc0000000000 R15: 00000000ffffffff FS: 00007fb7aaf716c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa15a0d4b72 CR3: 00000000561b0000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> tun_ptr_free drivers/net/tun.c:617 [inline] __ptr_ring_swap_queue include/linux/ptr_ring.h:571 [inline] ptr_ring_resize_multiple_noprof include/linux/ptr_ring.h:643 [inline] tun_queue_resize drivers/net/tun.c:3694 [inline] tun_device_event+0xaaf/0x1080 drivers/net/tun.c:3714 notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93 call_netdevice_notifiers_extack net/core/dev.c:2032 [inline] call_netdevice_notifiers net/core/dev.c:2046 [inline] dev_change_tx_queue_len+0x158/0x2a0 net/core/dev.c:9024 do_setlink+0xff6/0x41f0 net/core/rtnetlink.c:2923 rtnl_setlink+0x40d/0x5a0 net/core/rtnetlink.c:3201 rtnetlink_rcv_msg+0x73f/0xcf0 net/core/rtnetlink.c:6647 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550(CVE-2024-57994)

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params

Each cpu DAI should associate with a widget. However, the topology might not create the right number of DAI widgets for aggregated amps. And it will cause NULL pointer deference. Check that the DAI widget associated with the CPU DAI is valid to prevent NULL pointer deference due to missing DAI widgets in topologies with aggregated amps.(CVE-2024-58012)

In the Linux kernel, the following vulnerability has been resolved:

driver core: fix potential NULL pointer dereference in dev_uevent()

If userspace reads "uevent" device attribute at the same time as another threads unbinds the device from its driver, change to dev->driver from a valid pointer to NULL may result in crash. Fix this by using READ_ONCE() when fetching the pointer, and take bus' drivers klist lock to make sure driver instance will not disappear while we access it.

Use WRITE_ONCE() when setting the…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()

Jakub added a lockdep_assert_no_hardirq() check in __page_pool_put_page() to increase test coverage.

syzbot found a splat caused by hard irq blocking in ptr_ring_resize_multiple() [1]

As current users of ptr_ring_resize_multiple() do not require hard irqs being masked, replace it to only block BH.

Rename helpers to better reflect they are safe against BH only.

• ptr_ring_resize_multiple() to ptr_ring_resize_multiple_bh()
• skb_array_resize_multiple() to skb_array_resize_multiple_bh()

[1]

WARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 __page_pool_put_page net/core/page_pool.c:709 [inline] WARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780 Modules linked in: CPU: 1 UID: 0 PID: 9150 Comm: syz.1.1052 Not tainted 6.11.0-rc3-syzkaller-00202-gf8669d7b5f5d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:__page_pool_put_page net/core/page_pool.c:709 [inline] RIP: 0010:page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780 Code: 74 0e e8 7c aa fb f7 eb 43 e8 75 aa fb f7 eb 3c 65 8b 1d 38 a8 6a 76 31 ff 89 de e8 a3 ae fb f7 85 db 74 0b e8 5a aa fb f7 90 <0f> 0b 90 eb 1d 65 8b 1d 15 a8 6a 76 31 ff 89 de e8 84 ae fb f7 85 RSP: 0018:ffffc9000bda6b58 EFLAGS: 00010083 RAX: ffffffff8997e523 RBX: 0000000000000000 RCX: 0000000000040000 RDX: ffffc9000fbd0000 RSI: 0000000000001842 RDI: 0000000000001843 RBP: 0000000000000000 R08: ffffffff8997df2c R09: 1ffffd40003a000d R10: dffffc0000000000 R11: fffff940003a000e R12: ffffea0001d00040 R13: ffff88802e8a4000 R14: dffffc0000000000 R15: 00000000ffffffff FS: 00007fb7aaf716c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa15a0d4b72 CR3: 00000000561b0000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> tun_ptr_free drivers/net/tun.c:617 [inline] __ptr_ring_swap_queue include/linux/ptr_ring.h:571 [inline] ptr_ring_resize_multiple_noprof include/linux/ptr_ring.h:643 [inline] tun_queue_resize drivers/net/tun.c:3694 [inline] tun_device_event+0xaaf/0x1080 drivers/net/tun.c:3714 notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93 call_netdevice_notifiers_extack net/core/dev.c:2032 [inline] call_netdevice_notifiers net/core/dev.c:2046 [inline] dev_change_tx_queue_len+0x158/0x2a0 net/core/dev.c:9024 do_setlink+0xff6/0x41f0 net/core/rtnetlink.c:2923 rtnl_setlink+0x40d/0x5a0 net/core/rtnetlink.c:3201 rtnetlink_rcv_msg+0x73f/0xcf0 net/core/rtnetlink.c:6647 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550(CVE-2024-57994)

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params

Each cpu DAI should associate with a widget. However, the topology might not create the right number of DAI widgets for aggregated amps. And it will cause NULL pointer deference. Check that the DAI widget associated with the CPU DAI is valid to prevent NULL pointer deference due to missing DAI widgets in topologies with aggregated amps.(CVE-2024-58012)

In the Linux kernel, the following vulnerability has been resolved:

driver core: fix potential NULL pointer dereference in dev_uevent()

If userspace reads "uevent" device attribute at the same time as another threads unbinds the device from its driver, change to dev->driver from a valid pointer to NULL may result in crash. Fix this by using READ_ONCE() when fetching the pointer, and take bus' drivers klist lock to make sure driver instance will not disappear while we access it.

Use WRITE_ONCE() when setting the…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()

Jakub added a lockdep_assert_no_hardirq() check in __page_pool_put_page() to increase test coverage.

syzbot found a splat caused by hard irq blocking in ptr_ring_resize_multiple() [1]

As current users of ptr_ring_resize_multiple() do not require hard irqs being masked, replace it to only block BH.

Rename helpers to better reflect they are safe against BH only.

• ptr_ring_resize_multiple() to ptr_ring_resize_multiple_bh()
• skb_array_resize_multiple() to skb_array_resize_multiple_bh()

[1]

WARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 __page_pool_put_page net/core/page_pool.c:709 [inline] WARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780 Modules linked in: CPU: 1 UID: 0 PID: 9150 Comm: syz.1.1052 Not tainted 6.11.0-rc3-syzkaller-00202-gf8669d7b5f5d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:__page_pool_put_page net/core/page_pool.c:709 [inline] RIP: 0010:page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780 Code: 74 0e e8 7c aa fb f7 eb 43 e8 75 aa fb f7 eb 3c 65 8b 1d 38 a8 6a 76 31 ff 89 de e8 a3 ae fb f7 85 db 74 0b e8 5a aa fb f7 90 <0f> 0b 90 eb 1d 65 8b 1d 15 a8 6a 76 31 ff 89 de e8 84 ae fb f7 85 RSP: 0018:ffffc9000bda6b58 EFLAGS: 00010083 RAX: ffffffff8997e523 RBX: 0000000000000000 RCX: 0000000000040000 RDX: ffffc9000fbd0000 RSI: 0000000000001842 RDI: 0000000000001843 RBP: 0000000000000000 R08: ffffffff8997df2c R09: 1ffffd40003a000d R10: dffffc0000000000 R11: fffff940003a000e R12: ffffea0001d00040 R13: ffff88802e8a4000 R14: dffffc0000000000 R15: 00000000ffffffff FS: 00007fb7aaf716c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa15a0d4b72 CR3: 00000000561b0000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> tun_ptr_free drivers/net/tun.c:617 [inline] __ptr_ring_swap_queue include/linux/ptr_ring.h:571 [inline] ptr_ring_resize_multiple_noprof include/linux/ptr_ring.h:643 [inline] tun_queue_resize drivers/net/tun.c:3694 [inline] tun_device_event+0xaaf/0x1080 drivers/net/tun.c:3714 notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93 call_netdevice_notifiers_extack net/core/dev.c:2032 [inline] call_netdevice_notifiers net/core/dev.c:2046 [inline] dev_change_tx_queue_len+0x158/0x2a0 net/core/dev.c:9024 do_setlink+0xff6/0x41f0 net/core/rtnetlink.c:2923 rtnl_setlink+0x40d/0x5a0 net/core/rtnetlink.c:3201 rtnetlink_rcv_msg+0x73f/0xcf0 net/core/rtnetlink.c:6647 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550(CVE-2024-57994)

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params

Each cpu DAI should associate with a widget. However, the topology might not create the right number of DAI widgets for aggregated amps. And it will cause NULL pointer deference. Check that the DAI widget associated with the CPU DAI is valid to prevent NULL pointer deference due to missing DAI widgets in topologies with aggregated amps.(CVE-2024-58012)

In the Linux kernel, the following vulnerability has been resolved:

driver core: fix potential NULL pointer dereference in dev_uevent()

If userspace reads "uevent" device attribute at the same time as another threads unbinds the device from its driver, change to dev->driver from a valid pointer to NULL may result in crash. Fix this by using READ_ONCE() when fetching the pointer, and take bus' drivers klist lock to make sure driver instance will not disappear while we access it.

Use WRITE_ONCE() when setting the…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation (CVE-2025-38415)

• kernel: vsock/vmci: Clear the vmci transport packet properly when initializing it (CVE-2025-38403)

• kernel: Linux kernel: Data corruption and system instability due to improper io_uring/net buffer handling (CVE-2025-38730)

• kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length (CVE-2025-39933)

• kernel: mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable() (CVE-2025-40133)

• kernel: Linux kernel: Out-of-bounds write in fbdev can lead to privilege escalation, information disclosure, or denial of service. (CVE-2025-40304)

• kernel: Linux kernel: Information disclosure and denial of service via out-of-bounds read in font glyph handling (CVE-2025-40322)

• kernel: svcrdma: use rc_pageoff for memcpy byte offset (CVE-2025-68811)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (CVE-2025-40168)

• kernel: Linux kernel Bluetooth: Denial of Service due to use-after-free in connection handling (CVE-2023-53762)

• kernel: Linux kernel: Out-of-bounds write in fbdev can lead to privilege escalation, information disclosure, or denial of service. (CVE-2025-40304)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (CVE-2023-53034)

• kernel: smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064)

• kernel: Linux kernel: Out-of-bounds write in fbdev can lead to privilege escalation, information disclosure, or denial of service. (CVE-2025-40304)

• kernel: Linux kernel: Information disclosure and denial of service via out-of-bounds read in font glyph handling (CVE-2025-40322)

• kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CVE-2025-68349)

• kernel: svcrdma: use rc_pageoff for memcpy byte offset (CVE-2025-68811)

• kernel: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CVE-2026-22998)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (CVE-2025-40168)

• kernel: Linux kernel Bluetooth: Denial of Service due to use-after-free in connection handling (CVE-2023-53762)

• kernel: Linux kernel: Out-of-bounds write in fbdev can lead to privilege escalation, information disclosure, or denial of service. (CVE-2025-40304)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if the Y position is off-screen and clip image height to screen boundary. Break from the rendering loop if the X position is off-screen. When clipping image width to fit the screen, update the character count to match the clipped width to prevent buffer size mismatches. Without the character count update, bit_putcs_aligned and bit_putcs_unaligned receive mismatched parameters where the buffer is allocated for the clipped width but cnt reflects the original larger count, causing out-of-bounds writes.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation (CVE-2025-38415)
• kernel: vsock/vmci: Clear the vmci transport packet properly when initializing it (CVE-2025-38403)
• kernel: Linux kernel: Data corruption and system instability due to improper io_uring/net buffer handling (CVE-2025-38730)
• kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length (CVE-2025-39933)
• kernel: mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable() (CVE-2025-40133)
• kernel: Linux kernel: Out-of-bounds write in fbdev can lead to privilege escalation, information disclosure, or denial of service. (CVE-2025-40304)
• kernel: Linux kernel: Information disclosure and denial of service via out-of-bounds read in font glyph handling (CVE-2025-40322)
• kernel: svcrdma: use rc_pageoff for memcpy byte offset (CVE-2025-68811)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (CVE-2025-40168)
• kernel: Linux kernel Bluetooth: Denial of Service due to use-after-free in connection handling (CVE-2023-53762)
• kernel: Linux kernel: Out-of-bounds write in fbdev can lead to privilege escalation, information disclosure, or denial of service. (CVE-2025-40304)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (CVE-2023-53034)
• kernel: smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064)
• kernel: Linux kernel: Out-of-bounds write in fbdev can lead to privilege escalation, information disclosure, or denial of service. (CVE-2025-40304)
• kernel: Linux kernel: Information disclosure and denial of service via out-of-bounds read in font glyph handling (CVE-2025-40322)
• kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CVE-2025-68349)
• kernel: svcrdma: use rc_pageoff for memcpy byte offset (CVE-2025-68811)
• kernel: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CVE-2026-22998)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (CVE-2025-40168)
• kernel: Linux kernel Bluetooth: Denial of Service due to use-after-free in connection handling (CVE-2023-53762)
• kernel: Linux kernel: Out-of-bounds write in fbdev can lead to privilege escalation, information disclosure, or denial of service. (CVE-2025-40304)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• crypto: af_alg - Fix incorrect boolean values in af_alg_ctx {CVE-2025-40022}
• arm64: pensando: Must boot Ortano kernel with spin-table
• net/sched: adjust device watchdog timer to detect stopped queue at right time
• net/mlx5: Mark the mellanox graceful_period fix as out-of-tree change
• infiniband/xsigo: Replace BUG_ON with WARN_ON_ONCE.
• infiniband/xsigo: xsvnic_main: Remove unused functions
• infiniband/xsigo: xve_cm: Fix mixed code warning
• infiniband/xsigo: xve_ethtool: Remove unused variable 'priv'
• infiniband/xsigo: xve_ib: Fix misleading indentation
• infiniband/xsigo: xve_ib: Fix mixed code warning
• infiniband/xsigo: xve_verbs: Remove unused label 'out_free_pd'
• infiniband/xsigo: xve_main: Remove unused function 'xve_napi_del'
• infiniband/xsigo: xve_main: Fix mixed code warning
• infiniband/xsigo: xve_main: Fix misleading indentation
• inifinibad/xsigo: xsvnic_main: Remove unused variable 'xsvnic_ethtool_ops'
• infiniband/xsigo: xscore_impl: Remove unused label 'err_pd'
• rds: Fix jiffies type in struct rds_conn_path
• kernel: sysctl: Remove unused variable 'zero'
• crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• RDMA/cm: Base cm_id destruction timeout on CMA values
• x86/its: Build fails with CONFIG_MITIGATION_ITS=n
• LTS tag: v5.4.302
• Input: pegasus-notetaker - fix potential out-of-bounds access {CVE-2025-68217}
• Input: remove third argument of usb_maxpacket()
• usb: deprecate the third argument of usb_maxpacket()
• fs/proc: fix uaf in proc_readdir_de() {CVE-2025-40271}
• pmdomain: imx: Fix reference count leak in imx_gpc_remove
• pmdomain: arm: scmi: Fix genpd leak on provider registration failure {CVE-2025-68204}
• net: netpoll: fix incorrect refcount handling causing incorrect cleanup {CVE-2025-68245}
• net: qede: Initialize qede_ll_ops with designated initializer
• net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error {CVE-2025-68220}
• ALSA: usb-audio: fix uac2 clock source at terminal parser
• mm/page_alloc: fix hash table order logging in alloc_large_system_hash()
• kconfig/nconf: Initialize the default locale at startup
• kconfig/mconf: Initialize the default locale at startup
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
• s390/ctcm: Fix double-kfree {CVE-2025-40253}
• net: openvswitch: remove never-working support for setting nsh fields {CVE-2025-40254}
• mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()
• MIPS: Malta: Fix !EVA SOC-it PCI MMIO
• scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() {CVE-2025-68229}
• scsi: sg: Do not sleep in atomic context {CVE-2025-40259}
• Input: cros_ec_keyb - fix an invalid memory access {CVE-2025-40263}
• be2net: pass wrb_params in case of OS2BMC {CVE-2025-40264}
• isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() {CVE-2025-68734}
• EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
• EDAC/altera: Handle OCRAM ECC enable after warm reset
• spi: Try to get ACPI GPIO IRQ earlier
• ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe {CVE-2025-68241}
• strparser: Fix signed/unsigned mismatch bug
• gcov: add support for GCC 15
• mm/ksm: fix flag-dropping behavior in ksm_madvise {CVE-2025-40040}
• ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd {CVE-2025-40275}
• drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE {CVE-2025-40277}
• ASoC: cs4271: Fix regulator leak on probe failure
• regulator: fixed: fix GPIO descriptor leak on register failure
• regulator: fixed: use dev_err_probe for register
• Bluetooth: L2CAP: export l2cap_chan_hold for modules
• net_sched: limit try_bulk_dequeue_skb() batches
• net_sched: remove need_resched() from qdisc_run()
• net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
• net/mlx5e: Fix maxrate wraparound in threshold between units
• net: sched: act_ife: initialize struct tc_ife to fix KMSAN…

• fix: dm: fix dm_blk_report_zones {CVE-2025-38141}
• ice: Fix a null pointer dereference in ice_copy_and_init_pkg() {CVE-2025-38664}
• qed: Don't collect too many protection override GRC elements {CVE-2025-39949}
• drm/amd/display: Avoid a NULL pointer dereference {CVE-2025-39693}
• iommu/amd/pgtbl: Fix possible race while increase page table level {CVE-2025-39961}
• pNFS: Fix uninited ptr deref in block/scsi layout {CVE-2025-38691}
• netfilter: nf_reject: don't leak dst refcount for loopback packets {CVE-2025-38732}
• net/mlx5: Check device memory pointer before usage {CVE-2025-38645}
• ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() {CVE-2025-71085}
• ice: fix Tx scheduler error handling in XDP callback {CVE-2025-38127}
• tracing: Limit access to parser->buffer when trace_get_user failed {CVE-2025-39683}
• rcu: Protect ->defer_qs_iw_pending from data race {CVE-2025-39749}
• netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX {CVE-2025-38201}
• KVM: x86: use array_index_nospec with indices that come from guest {CVE-2025-39823}
• phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode {CVE-2025-38535}
• nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec {CVE-2026-22998}
• HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824}
• svcrdma: use rc_pageoff for memcpy byte offset {CVE-2025-68811}
• fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}
• NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid {CVE-2025-68349}
• cnic: Fix use-after-free bugs in cnic_delete_task {CVE-2025-39945}
• scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels {CVE-2025-38288}
• fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
• tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. {CVE-2025-39913}
• net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit {CVE-2025-39766}
• ftrace: Also allocate and copy hash for reading of filter files {CVE-2025-39689}
• fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685}
• HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}

• smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728}
• netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX {CVE-2025-38201}
• ALSA: usb-audio: Validate UAC3 power domain descriptors, too {CVE-2025-38729}
• net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
• tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. {CVE-2025-39913}
• fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
• KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration {CVE-2023-54296}
• mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats {CVE-2025-68800}
• net/sched: Enforce that teql can only be used as root qdisc {CVE-2026-23074}
• net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() {CVE-2023-54114}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• media: dvb-frontends: avoid stack overflow warnings with clang {CVE-2024-27075}
• ipv6: Fix infinite recursion in fib6_dump_done(). {CVE-2024-35886}
• HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
• fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}
• HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824}
• cnic: Fix use-after-free bugs in cnic_delete_task {CVE-2025-39945}
• ALSA: usb-audio: Fix potential overflow of PCM transfer buffer {CVE-2025-40269}
• NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid {CVE-2025-68349}
• pptp: ensure minimal skb length in pptp_xmit() {CVE-2025-38574}
• ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
• fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702}
• i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891}
• i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
• media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() {CVE-2025-38680}
• fs/buffer: fix use-after-free when call bh_read() helper {CVE-2025-39691}
• fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
• usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
• mptcp: fix race condition in mptcp_schedule_work() {CVE-2025-40258}
• KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}

• i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• media: rc: fix races with imon_disconnect() {CVE-2025-39993}
• VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
• tracing: Fix oob write in trace_seq_to_buffer() {CVE-2025-37923}
• drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE {CVE-2025-40277}
• Bluetooth: fix use-after-free in device_for_each_child() {CVE-2024-53237}
• net/atm: remove the atmdev_ops {get, set}sockopt methods {CVE-2022-50410}
• i40e: add validation for ring_len param {CVE-2025-39973}
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
• sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
• nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF {CVE-2023-53259}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749}
• Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() {CVE-2025-39860}
• i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
• ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249}
• fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
• fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}

• i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• media: rc: fix races with imon_disconnect() {CVE-2025-39993}
• VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
• tracing: Fix oob write in trace_seq_to_buffer() {CVE-2025-37923}
• drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE {CVE-2025-40277}
• Bluetooth: fix use-after-free in device_for_each_child() {CVE-2024-53237}
• net/atm: remove the atmdev_ops {get, set}sockopt methods {CVE-2022-50410}
• i40e: add validation for ring_len param {CVE-2025-39973}
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
• sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
• nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF {CVE-2023-53259}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749}
• Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() {CVE-2025-39860}
• i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
• ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249}
• fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
• fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}

• wifi: iwlwifi: mvm: guard against invalid STA ID on removal {CVE-2024-36921}
• ASoC: topology: Fix references to freed memory {CVE-2024-41069}
• net/sched: act_mirred: don't override retval if we already lost the skb {CVE-2024-26739}
• drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
• usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
• fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685}
• net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• ext4: fix use-after-free in ext4_orphan_cleanup {CVE-2022-50673}
• xfrm: fix slab-use-after-free in decode_session6 {CVE-2023-53500}
• net: bridge: xmit: make sure we have at least eth header len bytes {CVE-2024-38538}
• NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL {CVE-2023-53680}
• perf/core: Exit early on perf_mmap() fail {CVE-2025-38565}
• i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• fs/proc: fix uaf in proc_readdir_de() {CVE-2025-40271}
• virtio_net: fix xdp_rxq_info bug after suspend/resume {CVE-2022-49687}
• NFSD: Fix the behavior of READ near OFFSET_MAX {CVE-2022-48827}
• usb: xhci: Apply the link chain quirk on NEC isoc endpoints {CVE-2025-22022}
• Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
• Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
• Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35967}
• netfilter: nf_tables: prefer nft_chain_validate {CVE-2024-41042}
• netfilter: validate user input for expected length {CVE-2024-35896}
• erspan: do not use skb_mac_header() in ndo_start_xmit() {CVE-2023-53053}
• scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• i40e: remove read access to debugfs files {CVE-2025-39901}
• wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937}
• Bluetooth: hci_sock: Prevent race in socket write iter and sock bind {CVE-2025-68305}
• RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
• netfilter: allow exp not to be removed in nf_ct_find_expectation {CVE-2023-52927}
• dm-bufio: don't schedule in atomic context {CVE-2025-37928}
• HID: multitouch: Add NULL check in mt_input_configured {CVE-2024-58020}
• netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX {CVE-2025-38201}
• fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
• tracing/histograms: Add histograms to hist_vars if they have referenced variables {CVE-2023-53560}
• netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
• drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
• KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() {CVE-2024-35791}
• scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() {CVE-2023-53521}
• dm cache: Fix UAF in destroy() {CVE-2022-50496}
• xhci: Remove device endpoints from bandwidth list when freeing the device {CVE-2022-50470}
• Bluetooth: L2CAP: Fix user-after-free {CVE-2022-50386}
• mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats {CVE-2025-68800}
• net/sched: Enforce that teql can only be used as root qdisc {CVE-2026-23074}
• igb: Do not bring the device up after non-fatal error {CVE-2024-50040}
• wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891}
• HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824}
• fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}
• HID: multitouch: Correct devm device reference for hidinput input_dev name {CVE-2023-53454}
• udf: Do not bother merging very long extents {CVE-2023-53506}
• wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() {CVE-2022-50551}
• ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
• dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path…

• xhci: Remove device endpoints from bandwidth list when freeing the device {CVE-2022-50470}
• HID: multitouch: Add NULL check in mt_input_configured {CVE-2024-58020}
• netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX {CVE-2025-38201}
• fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
• tracing/histograms: Add histograms to hist_vars if they have referenced variables {CVE-2023-53560}
• netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
• scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() {CVE-2023-53521}
• dm cache: Fix UAF in destroy() {CVE-2022-50496}
• Bluetooth: L2CAP: Fix user-after-free {CVE-2022-50386}
• VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
• wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf {CVE-2023-53524}
• xfrm: fix slab-use-after-free in decode_session6 {CVE-2023-53500}
• ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
• Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
• Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
• Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35967}
• NFSD: Fix the behavior of READ near OFFSET_MAX {CVE-2022-48827}
• NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL {CVE-2023-53680}
• mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory {CVE-2025-39883}
• fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685}
• erspan: do not use skb_mac_header() in ndo_start_xmit() {CVE-2023-53053}
• net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
• i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• i40e: remove read access to debugfs files {CVE-2025-39901}
• Bluetooth: hci_sock: Prevent race in socket write iter and sock bind {CVE-2025-68305}
• RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
• usb: xhci: Apply the link chain quirk on NEC isoc endpoints {CVE-2025-22022}
• netfilter: allow exp not to be removed in nf_ct_find_expectation {CVE-2023-52927}
• dm-bufio: don't schedule in atomic context {CVE-2025-37928}
• ACPI: EC: Fix oops when removing custom query handlers {CVE-2023-54244}
• mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats {CVE-2025-68800}
• net/sched: Enforce that teql can only be used as root qdisc {CVE-2026-23074}
• net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() {CVE-2023-54114}
• igb: Do not bring the device up after non-fatal error {CVE-2024-50040}
• HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
• drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras {CVE-2023-53471}
• wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891}
• HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824}
• fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}
• HID: multitouch: Correct devm device reference for hidinput input_dev name {CVE-2023-53454}
• udf: Do not bother merging very long extents {CVE-2023-53506}
• wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() {CVE-2022-50551}
• dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path {CVE-2023-53604}
• gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
• iavf: Fix use-after-free in free_netdev {CVE-2023-53556}
• cnic: Fix use-after-free bugs in cnic_delete_task {CVE-2025-39945}
• kernfs: fix use-after-free in __kernfs_remove {CVE-2022-50432}
• net/sched: act_mirred: don't override retval if we already lost the skb…

• i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• media: rc: fix races with imon_disconnect() {CVE-2025-39993}
• VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
• tracing: Fix oob write in trace_seq_to_buffer() {CVE-2025-37923}
• drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE {CVE-2025-40277}
• Bluetooth: fix use-after-free in device_for_each_child() {CVE-2024-53237}
• net/atm: remove the atmdev_ops {get, set}sockopt methods {CVE-2022-50410}
• i40e: add validation for ring_len param {CVE-2025-39973}
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
• sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
• nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF {CVE-2023-53259}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749}
• Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() {CVE-2025-39860}
• i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
• ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249}
• fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
• fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}

• fix: fbdev: fix potential buffer overflow in do_register_framebuffer()
• qed: Don't collect too many protection override GRC elements {CVE-2025-39949}
• drm/amd/display: Avoid a NULL pointer dereference {CVE-2025-39693}
• pNFS: Fix uninited ptr deref in block/scsi layout {CVE-2025-38691}
• netfilter: nf_reject: don't leak dst refcount for loopback packets {CVE-2025-38732}
• ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() {CVE-2025-71085}
• fs: dlm: fix use after free in midcomms commit {CVE-2023-53629}
• svcrdma: use rc_pageoff for memcpy byte offset {CVE-2025-68811}
• bpf: Disable preemption in bpf_perf_event_output {CVE-2023-54303}
• scsi: target: iscsit: Free cmds before session free {CVE-2023-54184}
• fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
• scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
• memcg: protect concurrent access to mem_cgroup_idr {CVE-2024-43892}
• ACPI: EC: Fix oops when removing custom query handlers {CVE-2023-54244}
• KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration {CVE-2023-54296}
• net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() {CVE-2023-54114}
• net: tls: avoid hanging tasks on the tx_lock {CVE-2023-54306}
• usb: typec: bus: verify partner exists in typec_altmode_attention {CVE-2023-54299}
• scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization {CVE-2023-54234}
• rxrpc: Fix timeout of a call that hasn't yet been granted a channel {CVE-2023-54195}
• block, bfq: Fix division by zero error on zero wsum {CVE-2023-54242}
• wifi: cfg80211: reject auth/assoc to AP with our address {CVE-2023-53540}
• wifi: iwlwifi: mvm: don't trust firmware n_channels {CVE-2023-53589}
• wifi: mac80211: check for station first in client probe {CVE-2023-53588}
• bonding: do not assume skb mac_header is set {CVE-2023-53601}
• drm/i915: Make intel_get_crtc_new_encoder() less oopsy {CVE-2023-53571}
• wifi: rtw88: delete timer and free skb queue when unloading {CVE-2023-53574}
• net: bcmgenet: Add a check for oversized packets {CVE-2023-53535}
• media: uvcvideo: Fix memory leak in uvc_gpio_parse {CVE-2022-50882}
• md/raid10: fix memleak of md thread {CVE-2023-54294}
• usb: typec: altmodes/displayport: fix pin_assignment_show {CVE-2023-54186}
• scsi: qedf: Fix NULL dereference in error handling {CVE-2023-54289}
• HID: multitouch: Add NULL check in mt_input_configured {CVE-2024-58020}
• driver core: fix potential null-ptr-deref in device_add() {CVE-2023-54321}
• net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull {CVE-2023-53125}
• rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle() {CVE-2023-54246}
• bpf: Address KCSAN report on bpf_lru_list {CVE-2023-54283}
• usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
• nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec {CVE-2026-22998}
• drm/i915: fix race condition UAF in i915_perf_add_config_ioctl {CVE-2023-54202}
• mmc: via-sdmmc: fix return value check of mmc_add_host() {CVE-2022-50846}
• bpf: Disable preemption in bpf_event_output {CVE-2023-54173}
• net/mlx5e: Move representor neigh cleanup to profile cleanup_tx {CVE-2023-54148}
• net/mlx5: Handle pairing of E-switch via uplink un/load APIs {CVE-2023-53347}
• net/mlx5e: Fix cleanup null-ptr deref on encap lock {CVE-2023-53105}
• smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728}
• perf/core: Exit early on perf_mmap() fail {CVE-2025-38565}
• HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
• HID: core: ensure __hid_request reserves the report ID as the first byte
• HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495}
• HID: intel-ish-hid: Fix kernel panic during warm reset {CVE-2023-53392}
• xfs: do not propagate ENODATA…

• CVE-2025-39683
  • tracing: Remove unneeded goto out logic {CVE-2025-39683}
  • tracing: Limit access to parser->buffer when trace_get_user failed {CVE-2025-39683}
• CVE-2025-38079
  • crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
• CVE-2025-38159
  • wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds {CVE-2025-38159}
• CVE-2025-38211
  • RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction {CVE-2025-38211}
• CVE-2025-38024
  • RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug {CVE-2025-38024}
• CVE-2025-38103
  • HID: hyperv: Correctly access fields declared as __le16 {CVE-2025-38103}
  • HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• CVE-2025-38157
  • wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157}
• CVE-2025-38230
  • jfs: add sanity check for agwidth in dbMount {CVE-2025-38230}
  • fs/jfs: consolidate sanity checking in dbMount {CVE-2025-38230}
  • jfs: validate AG parameters in dbMount() to prevent crashes {CVE-2025-38230}
• CVE-2025-39955
  • tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-39955}
• CVE-2025-38680
  • media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() {CVE-2025-38680}
• CVE-2025-38708
  • drbd: add missing kref_get in handle_write_conflicts {CVE-2025-38708}
• CVE-2025-39759
  • btrfs: qgroup: introduce quota mode {CVE-2025-39759}
  • btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• CVE-2025-38666
  • net: appletalk: Fix use-after-free in AARP proxy probe {CVE-2025-38666}
• CVE-2025-40269
  • ALSA: usb-audio: Improve frames size computation {CVE-2025-40269}
  • ALSA: usb-audio: Replace s/frame/packet/ where appropriate {CVE-2025-40269}
  • ALSA: usb-audio: Fix potential overflow of PCM transfer buffer {CVE-2025-40269}
• CVE-2025-40149
  • net: netdevice: Add operation ndo_sk_get_lower_dev {CVE-2025-40149}
  • net/tls: Device offload to use lowest netdevice in chain {CVE-2025-40149}
  • tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). {CVE-2025-40149}
• CVE-2025-71089
  • iommu: disable SVA when CONFIG_X86 is set {CVE-2025-71089}
• CVE-2026-23234
  • f2fs: fix to avoid UAF in f2fs_write_end_io() {CVE-2026-23234}
• CVE-2026-23089
  • ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() {CVE-2026-23089}
• CVE-2026-23074
  • net/sched: Enforce that teql can only be used as root qdisc {CVE-2026-23074}
• CVE-2026-23061
  • can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak {CVE-2026-23061}
• CVE-2026-23060
  • crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-23060}
• CVE-2026-22997
  • net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts {CVE-2026-22997}
• CVE-2026-22991
  • libceph: make free_choose_arg_map() resilient to partial allocation {CVE-2026-22991}
• CVE-2026-22990
  • libceph: replace overzealous BUG_ON in osdmap_apply_incremental() {CVE-2026-22990}
• CVE-2026-22978
  • wifi: avoid kernel-infoleak from struct iw_point {CVE-2026-22978}
• CVE-2026-22977
  • net: sock: fix hardened usercopy panic in sock_recv_errqueue {CVE-2026-22977}
• CVE-2025-71154
  • net: usb: rtl8150: fix memory leak on usb_submit_urb() failure {CVE-2025-71154}
• CVE-2025-71085
  • ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() {CVE-2025-71085}
• CVE-2025-68734
  • isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() {CVE-2025-68734}
• CVE-2025-68349
  • NFSv4/pNFS: Clear…

Upstream kernel version 6.6.120 fixes bugs and vulnerabilities. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel.

Vanilla upstream kernel version 6.6.120 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2025-39880: ceph: fix race condition validating r_parent before applying state (bsc#1250388).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40130: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1254961).
• CVE-2025-40215: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40218: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (bsc#1254964).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40237: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40239: net: phy: micrel: always set shared->phydev for LAN8814 (bsc#1254868).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair (bsc#1254861).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() (bsc#1255156).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
• CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
• CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
• CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
• CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (bsc#1254824).
• CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
• CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
• CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
• CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
• CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
• CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
• CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).
• CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
• CVE-2025-40330: bnxt_en: Shutdown FW…

Root has patched CVE-2025-40304 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2025-40304 in the linux package for Root:Debian:13. Multiple fixed versions available.

Root has patched CVE-2025-40304 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2025-40304 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
• CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
• CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
• CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
• CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
• CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
• CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
• CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
• CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
• CVE-2025-40287: exfat: fix improper check of dentry.stream.valid_size (bsc#1255030).
• CVE-2025-40289: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (bsc#1255042).
• CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
• CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
• CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187). -…