CVE-2025-37849

KVM: arm64: Tear down vGIC on failed vCPU creation

8.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Tear down vGIC on failed vCPU creation

If kvm_arch_vcpu_create() fails to share the vCPU page with the hypervisor, we propagate the error back to the ioctl but leave the vGIC vCPU data initialised. Note only does this leak the corresponding memory when the vCPU is destroyed but it can also lead to use-after-free if the redistributor device handling tries to walk into the vCPU.

Add the missing cleanup to kvm_arch_vcpu_create(), ensuring that the vGIC vCPU structures are destroyed on error.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.27%Up 0.2 points since May 9, 2025

What each source reports

CVE List Score used 8.8

KVM: arm64: Tear down vGIC on failed vCPU creation

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Tear down vGIC on failed vCPU creation

Add the missing cleanup to kvm_arch_vcpu_create(), ensuring that the vGIC vCPU structures are destroyed on error.

Record: CVE-2025-37849
CVSS 3.1: 8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2025-14143 8.8

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Tear down vGIC on failed vCPU creation

Add the missing cleanup to kvm_arch_vcpu_create(), ensuring that the vGIC vCPU structures are destroyed on error.

Record: EUVD-2025-14143
CVSS 3.1: 8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-4wfv-x2vf-68j5 7.8

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Tear down vGIC...

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Tear down vGIC on failed vCPU creation

Add the missing cleanup to kvm_arch_vcpu_create(), ensuring that the vGIC vCPU structures are destroyed on error.

Record: GHSA-4wfv-x2vf-68j5
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

NVD 8.8

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Tear down vGIC on failed vCPU creation

Add the missing cleanup to kvm_arch_vcpu_create(), ensuring that the vGIC vCPU structures are destroyed on error.

Record: CVE-2025-37849
CVSS 3.1: 8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSVBELL-CVE-2025-37849 7.8

Record: BELL-CVE-2025-37849
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 8.8

KVM: arm64: Tear down vGIC on failed vCPU creation

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Tear down vGIC on failed vCPU creation

Add the missing cleanup to kvm_arch_vcpu_create(), ensuring that the vGIC vCPU structures are destroyed on error.

Record: CVE-2025-37849
CVSS 3.1: 8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

Show 47 moreShow less

OSVDEBIAN-CVE-2025-37849 7.8

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Tear down vGIC on failed vCPU creation If kvm_arch_vcpu_create() fails to share the vCPU page with the hypervisor, we propagate the error back to the ioctl but leave the vGIC vCPU data initialised. Note only does this leak the corresponding memory when the vCPU is destroyed but it can also lead to use-after-free if the redistributor device handling tries to walk into the vCPU. Add the missing cleanup to kvm_arch_vcpu_create(), ensuring that the vGIC vCPU structures are destroyed on error.

Record: DEBIAN-CVE-2025-37849
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-1729 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after()irq_find_at_or_after() dereferences the interrupt descriptor which isreturned by mt_find() while neither holding sparse_irq_lock nor RCU readlock, which means the descriptor can be freed between mt_find() and thedereference: CPU0 CPU1 desc = mt_find() delayed_free_desc(desc) irq_desc_get_irq(desc)The use-after-free is reported by KASAN: Call trace: irq_get_next_irq+0x58/0x84 show_stat+0x638/0x824 seq_read_iter+0x158/0x4ec proc_reg_read_iter+0x94/0x12c vfs_read+0x1e0/0x2c8 Freed by task 4471: slab_free_freelist_hook+0x174/0x1e0 __kmem_cache_free+0xa4/0x1dc kfree+0x64/0x128 irq_kobj_release+0x28/0x3c kobject_put+0xcc/0x1e0 delayed_free_desc+0x14/0x2c rcu_do_batch+0x214/0x720Guard the access with a RCU read lock section.(CVE-2024-38385)

In the Linux kernel, the following vulnerability has been resolved:

drm/lima: fix shared irq handling on driver remove

lima uses a shared interrupt, so the interrupt handlers must be prepared to be called at any time. At driver removal time, the clocks are disabled early and the interrupts stay registered until the very end of the remove process due to the devm usage. This is potentially a bug as the interrupts access device registers which assumes clocks are enabled. A crash can be triggered by removing the driver in a kernel with CONFIG_DEBUG_SHIRQ enabled. This patch frees the interrupts at each lima device finishing callback so that the handlers are already unregistered by the time we fully disable clocks.(CVE-2024-42127)

In the Linux kernel, the following vulnerability has been resolved:mm: avoid overflows in dirty throttling logicThe dirty throttling logic is interspersed with assumptions that dirtylimits in PAGE_SIZE units fit into 32-bit (so that various multiplicationsfit into 64-bits). If limits end up being larger, we will hit overflows,possible divisions by 0 etc. Fix these problems by never allowing solarge dirty limits as they have dubious practical value anyway. Fordirty_bytes / dirty_background_bytes interfaces we can just refuse to setso large limits. For dirty_ratio / dirty_background_ratio it isn t sosimple as the dirty limit is computed from the amount of available memorywhich can change due to memory hotplug etc. So when converting dirtylimits from ratios to numbers of pages, we just don t allow the result toexceed UINT_MAX.This is root-only triggerable problem which occurs when the operatorsets dirty limits to >16 TB.(CVE-2024-42131)

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable()

For cases where the crtc's connectors_changed was set without enable/active getting toggled , there is an atomic_enable() call followed by an atomic_disable() but without an atomic_mode_set().

This results in a NULL ptr access for the dpu_encoder_get_drm_fmt() call in the atomic_enable() as the dpu_encoder's connector was cleared in the atomic_disable() but not re-assigned as there was no atomic_mode_set() call.

Fix the NULL ptr access by moving the assignment for atomic_enable() and also use drm_atomic_get_new_connector_for_encoder() to get the connector from the atomic_state.

Patchwork: https://patchwork.freedesktop.org/patch/606729/(CVE-2024-45015)

In the Linux kernel, the following vulnerability has been resolved:

crypto: iaa - Fix potential use after free bug

The free_device_compression_mode(iaa_device, device_mode) function frees "device_mode" but it iss passed to iaa_compression_modes[i]->free() a few lines later resulting in a use after free.

The good news is that, so far as I can tell, nothing implements the ->free()…

Record: OESA-2025-1729
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-1730 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

crypto: iaa - Fix potential use after free bug

The free_device_compression_mode(iaa_device, device_mode) function frees "device_mode" but it iss passed to iaa_compression_modes[i]->free() a few lines later resulting in a use after free.

The good news is that, so far as I can tell, nothing implements the ->free() function and the use after free happens in dead code. But, with this fix, when something does implement it, we'll be ready. :)(CVE-2024-47732)

In the Linux kernel, the following vulnerability has been resolved:

tomoyo: don't emit warning in tomoyo_write_control()

syzbot is reporting too large allocation warning at tomoyo_write_control(), for one can write a very very long line without new line character. To fix this warning, I use __GFP_NOWARN rather than checking for KMALLOC_MAX_SIZE, for practically a valid line should be always shorter than 32KB where the "too small to fail" memory-allocation rule applies.

One might try to write a valid line that is longer than 32KB, but such request will likely fail with -ENOMEM. Therefore, I feel that separately returning -EINVAL when a line is longer than KMALLOC_MAX_SIZE is redundant. There is no need to distinguish over-32KB and over-KMALLOC_MAX_SIZE.(CVE-2024-58085)

In the Linux kernel, the following vulnerability has been resolved:

sockmap, vsock: For connectible sockets allow only connected

sockmap expects all vsocks to have a transport assigned, which is expressed in vsock_proto::psock_update_sk_prot(). However, there is an edge case where an unconnected (connectible) socket may lose its previously assigned transport. This is handled with a NULL check in the vsock/BPF recv path.

Another design detail is that listening vsocks are not supposed to have any transport assigned at all. Which implies they are not supported by the sockmap. But this is complicated by the fact that a socket, before switching to TCP_LISTEN, may have had some transport assigned during a failed connect() attempt. Hence, we may end up with a listening vsock in a sockmap, which blows up quickly:

KASAN: null-ptr-deref in range [0x0000000000000120-0x0000000000000127] CPU: 7 UID: 0 PID: 56 Comm: kworker/7:0 Not tainted 6.14.0-rc1+ Workqueue: vsock-loopback vsock_loopback_work RIP: 0010:vsock_read_skb+0x4b/0x90 Call Trace: sk_psock_verdict_data_ready+0xa4/0x2e0 virtio_transport_recv_pkt+0x1ca8/0x2acc vsock_loopback_work+0x27d/0x3f0 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x35a/0x700 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30

For connectible sockets, instead of relying solely on the state of vsk->transport, tell sockmap to only allow those representing established connections. This aligns with the behaviour for AF_INET and AF_UNIX.(CVE-2025-21854)

In the Linux kernel, the following vulnerability has been resolved:

mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()

If migration succeeded, we called folio_migrate_flags()->mem_cgroup_migrate() to migrate the memcg from the old to the new folio. This will set memcg_data of the old folio to 0.

Similarly, if migration failed, memcg_data of the dst folio is left unset.

If we call folio_putback_lru() on such folios (memcg_data == 0), we will add the folio to be freed to the LRU, making memcg code unhappy. Running the hmm selftests:

./hmm-tests

...

RUN hmm.hmm_device_private.migrate ...

Record: OESA-2025-1730
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-1870 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

crypto: iaa - Fix potential use after free bug

The free_device_compression_mode(iaa_device, device_mode) function frees "device_mode" but it iss passed to iaa_compression_modes[i]->free() a few lines later resulting in a use after free.

In the Linux kernel, the following vulnerability has been resolved:

mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()

If migration succeeded, we called folio_migrate_flags()->mem_cgroup_migrate() to migrate the memcg from the old to the new folio. This will set memcg_data of the old folio to 0.

Similarly, if migration failed, memcg_data of the dst folio is left unset.

If we call folio_putback_lru() on such folios (memcg_data == 0), we will add the folio to be freed to the LRU, making memcg code unhappy. Running the hmm selftests:

./hmm-tests

...

RUN hmm.hmm_device_private.migrate ...

[ 102.078007][T14893] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x7ff27d200 pfn:0x13cc00 [ 102.079974][T14893] anon flags: 0x17ff00000020018(uptodate|dirty|swapbacked|node=0|zone=2|lastcpupid=0x7ff) [ 102.082037][T14893] raw: 017ff00000020018 dead000000000100 dead000000000122 ffff8881353896c9 [ 102.083687][T14893] raw: 00000007ff27d200 0000000000000000 00000001ffffffff 0000000000000000 [ 102.085331][T14893] page dumped because: VM_WARN_ON_ONCE_FOLIO(!memcg && !mem_cgroup_disabled()) [ 102.087230][T14893] ------------[ cut here ]------------ [ 102.088279][T14893] WARNING: CPU: 0 PID: 14893 at ./include/linux/memcontrol.h:726 folio_lruvec_lock_irqsave+0x10e/0x170 [ 102.090478][T14893] Modules linked in: [ 102.091244][T14893] CPU: 0 UID: 0 PID: 14893 Comm: hmm-tests Not tainted 6.13.0-09623-g6c216bc522fd #151 [ 102.093089][T14893] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 [ 102.094848][T14893] RIP: 0010:folio_lruvec_lock_irqsave+0x10e/0x170 [ 102.096104][T14893] Code: ... [ 102.099908][T14893] RSP: 0018:ffffc900236c37b0 EFLAGS: 00010293 [ 102.101152][T14893] RAX: 0000000000000000 RBX: ffffea0004f30000 RCX: ffffffff8183f426 [ 102.102684][T14893] RDX: ffff8881063cb880 RSI: ffffffff81b8117f RDI: ffff8881063cb880 [ 102.104227][T14893] RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 [ 102.105757][T14893] R10: 0000000000000001 R11: 0000000000000002 R12: ffffc900236c37d8 [ 102.107296][T14893] R13: ffff888277a2bcb0 R14: 000000000000001f R15: 0000000000000000 [ 102.108830][T14893] FS: 00007ff27dbdd740(0000) GS:ffff888277a00000(0000) knlGS:0000000000000000 [ 102.110643][T14893] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 102.111924][T14893] CR2: 00007ff27d400000 CR3: 000000010866e000 CR4: 0000000000750ef0 [ 102.113478][T14893] PKRU: 55555554 [ 102.114172][T14893] Call Trace: [ 102.114805][T14893] <TASK> [ 102.115397][T14893] ? folio_lruvec_lock_irqsave+0x10e/0x170 [ 102.116547][T14893] ? __warn.cold+0x110/0x210 [ 102.117461][T14893] ? folio_lruvec_lock_irqsave+0x10e/0x170 [ 102.118667][T14893] ? report_bug+0x1b9/0x320 [ 102.119571][T14893] ? handle_bug+0x54/0x90 [ 102.120494][T14893] ? exc_invalid_op+0x17/0x50 [ 102.121433][T14893] ? asm_exc_invalid_op+0x1a/0x20 [ 102.122435][T14893] ? __wake_up_klogd.part.0+0x76/0xd0 [ 102.123506][T14893] ? dump_page+0x4f/0x60 [ 102.124352][T14893] ? folio_lruvec_lock_irqsave+0x10e/0x170 [ 102.125500][T14893] folio_batch_move_lru+0xd4/0x200 [ 102.126577][T14893] ? __pfx_lru_add+0x10/0x10 [ 102.127505][T14893] …

Record: OESA-2025-1870
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2025:20095 7.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2025:20095
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2025:20518 7.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2025:20518
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:0804 7.5

Red Hat Security Advisory: kernel security update

Record: RHSA-2026:0804
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:0917 7.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2026:0917
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:1441 7.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2026:1441
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:1443 7.8

Red Hat Security Advisory: kernel-rt security update

Record: RHSA-2026:1443
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:1494 7.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2026:1494
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:1495 7.8

Red Hat Security Advisory: kernel-rt security update

Record: RHSA-2026:1495
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:6193 7.5

Red Hat Security Advisory: kernel security update

Record: RHSA-2026:6193
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-11-CVE-2025-37849 7.8

CVE-2025-37849 in linux - Patched by Root

Root has patched CVE-2025-37849 in the linux package for Root:Debian:11. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-11-CVE-2025-37849
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-12-CVE-2025-37849 7.8

CVE-2025-37849 in linux - Patched by Root

Root has patched CVE-2025-37849 in the linux package for Root:Debian:12. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-12-CVE-2025-37849
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2204-CVE-2025-37849 7.8

CVE-2025-37849 in linux - Patched by Root

Root has patched CVE-2025-37849 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2204-CVE-2025-37849
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2404-CVE-2025-37849 7.8

CVE-2025-37849 in linux - Patched by Root

Root has patched CVE-2025-37849 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2025-37849
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-37849 7.8

Record: UBUNTU-CVE-2025-37849
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVAZL-70367 No score

CVE-2025-37849 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Tear down vGIC on failed vCPU creation

Add the missing cleanup to kvm_arch_vcpu_create(), ensuring that the vGIC vCPU structures are destroyed on error.

Record: AZL-70367
Updated: 2026-11-02

OSVCLSA-2025-1765463110 No score

kernel: Fix of 45 CVEs

Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
padata: Fix pd UAF once and for all {CVE-2025-38584}
wifi: cfg80211: Fix use after free for wext {CVE-2023-53153}
padata: Fix list iterator in padata_do_serial()
padata: do not leak refcount in reorder_work {CVE-2025-38031}
padata: avoid UAF for reorder_work {CVE-2025-21726}
padata: add pd get/put refcnt helper
net/smc: fix UAF on smcsk after smc_listen_out() {CVE-2025-38734}
scsi: mpi3mr: Bad drive in topology results kernel crash {CVE-2023-53037}
scsi: mpi3mr: Driver unload crashes host when enhanced logging is enabled
wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
igb: Fix igb_down hung on surprise removal {CVE-2023-53148}
drm/i915/sseu: fix max_subslices array-index-out-of-bounds access {CVE-2023-53112}
i40e: fix idx validation in config queues msg {CVE-2025-39971}
dm-bufio: don't schedule in atomic context {CVE-2025-37928}
fs: prevent out-of-bounds array speculation when closing a file descriptor {CVE-2023-53117}
vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint {CVE-2025-22083}
iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid {CVE-2025-37927}
tracing: Fix oob write in trace_seq_to_buffer() {CVE-2025-37923}
KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
KVM: arm64: Tear down vGIC on failed vCPU creation {CVE-2025-37849}
KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache {CVE-2022-49882}
jbd2: remove wrong sb->s_sequence check {CVE-2025-37839}
power: supply: gpio-charger: Fix set charge current limits {CVE-2024-57792}
ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object {CVE-2024-46798}
ipv6: prevent possible UAF in ip6_xmit() {CVE-2024-44985}
ipv6: fix possible UAF in ip6_finish_output2() {CVE-2024-44986}
netfilter: flowtable: validate vlan header {CVE-2024-44983}
usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() {CVE-2024-50268}
usb: vhci-hcd: Do not drop references before new references are gained {CVE-2024-43883}
drm/amd/display: Fix slab-use-after-free on hdcp_work {CVE-2025-21968}
drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] {CVE-2024-46815}
drm/amd/display: Check index msg_id before read or write {CVE-2024-42121}
drm/amd/display: Check pipe offset before setting vblank {CVE-2024-42120}
drm/amdkfd: don't allow mapping the MMIO HDP page with large pages {CVE-2024-41011}
drm/amdkfd: Fix an illegal memory access {CVE-2023-53090}
drm/shmem-helper: Remove another errant put in error path {CVE-2023-53084}
drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes {CVE-2023-53077}
drm/i915: mark requests for GuC virtual engines to avoid use-after-free {CVE-2023-53552}
ptp: fix integer overflow in max_vclocks_store {CVE-2024-40994}
nvmet: avoid potential UAF in nvmet_req_complete() {CVE-2023-53116}
loop: Fix use-after-free issues {CVE-2023-53111}
ftrace: Fix invalid address access in lookup_rec() when index is 0 {CVE-2023-53075}
mptcp: use the workqueue to destroy unaccepted sockets {CVE-2023-53072}
perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output {CVE-2023-53065}
erspan: do not use skb_mac_header() in ndo_start_xmit() {CVE-2023-53053}
HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
coresight: Clear the connection field properly {CVE-2022-50214}
Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition {CVE-2023-53145}
Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync {CVE-2025-39982}
x86/tdx: Fix "in-kernel MMIO" check {CVE-2024-47727}
arm64: sme: Use STR P to clear FFR context field in streaming SVE mode {CVE-2023-53713}
wifi: mt76: mt7921: fix error code of return in…

Record: CLSA-2025-1765463110
Updated: 2026-11-02

OSVCLSA-2025-1766488019 No score

kernel: Fix of 63 CVEs

scsi: target: iscsi: Fix timeout on deleted connection {CVE-2025-38075}
tls: wait for pending async decryptions if tls_strp_msg_hold fails {CVE-2025-40176}
clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns {CVE-2025-38499}
rcu: Fix rcu_read_unlock() deadloop due to IRQ work {CVE-2025-39744}
page_pool: Fix use-after-free in page_pool_recycle_in_ring {CVE-2025-38129}
rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access {CVE-2025-38704}
bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors {CVE-2024-56675}
padata: Fix pd UAF once and for all {CVE-2025-38584}
padata: do not leak refcount in reorder_work {CVE-2025-38031}
Bluetooth: MGMT: Fix possible UAFs {CVE-2025-39981}
Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
Bluetooth: MGMT: Remove unused mgmt_pending_find_data
Bluetooth: MGMT: set_mesh: update LE scan interval and window
Bluetooth: hci_sync: fix set_local_name race condition {CVE-2025-39797}
xfrm: Duplicate SPI Handling {CVE-2025-39797}
kernfs: Fix UAF in polling when open file is released {CVE-2025-39881}
OPP: add index check to assert to avoid buffer overflow in _read_freq() {CVE-2024-57998}
block: fix uaf for flush rq while iterating tags {CVE-2024-58072} {CVE-2024-53170}
wifi: rtlwifi: remove unused check_buddy_priv {CVE-2024-58072}
wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() {CVE-2025-21631}
net: af_can: do not leave a dangling sk pointer in can_create() {CVE-2024-40954}
Squashfs: sanity check symbolic link size {CVE-2024-46744}
e1000e: fix heap overflow in e1000_set_eeprom {CVE-2025-39898}
wifi: cfg80211: fix use-after-free in cmp_bss() {CVE-2025-39864}
nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
i40e: fix idx validation in config queues msg {CVE-2025-39971}
NFS: Fix a race when updating an existing write {CVE-2025-39697}
tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-39955}
wifi: mt76: fix linked list corruption {CVE-2025-39918}
io_uring/waitid: always prune wait queue entry in io_waitid_wait() {CVE-2025-40047}
Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync {CVE-2025-39982}
workqueue: Put the pwq after detaching the rescuer from the pool {CVE-2025-21786}
zram: fix potential UAF of zram table {CVE-2025-21671}
sched: sch_cake: add bounds checks to host bulk flow fairness counts {CVE-2025-21647}
wifi: mt76: mt7925: fix off by one in mt7925_load_clc() {CVE-2024-57990}
blk-cgroup: Fix UAF in blkcg_unpin_online() {CVE-2024-56672}
NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() {CVE-2024-54456}
nfsd: release svc_expkey/svc_export with rcu_work {CVE-2024-53216}
igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
x86/tdx: Fix "in-kernel MMIO" check {CVE-2024-47727}
drm/amd/display: Check dce_hwseq before dereferencing it {CVE-2025-38361}
dm-bufio: don't schedule in atomic context {CVE-2025-37928}
usb: xhci: Fix isochronous Ring Underrun/Overrun event handling {CVE-2025-37882}
KVM: arm64: Tear down vGIC on failed vCPU creation {CVE-2025-37849}
usb: xhci: Apply the link chain quirk on NEC isoc endpoints {CVE-2025-22022}
drm/amd/display: Fix out-of-bound accesses {CVE-2025-21985}
usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704}
pfifo_tail_enqueue: Drop new packet when sch->limit == 0 {CVE-2025-21702}
partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
ipmr: do not call mr_mfc_uses_dev() for unres entries {CVE-2025-21719}
net: openvswitch: fix nested key length validation in the set() action {CVE-2025-37789}
isofs: Prevent the use of too small fid {CVE-2025-37780}
sctp: detect and prevent references to a freed transport in sendmsg {CVE-2025-23142}
iommu/amd: Fix…

Record: CLSA-2025-1766488019
Updated: 2026-11-02

OSVLSN-120-1 No score

Kernel Live Patch Security Notice

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec nvmet_tcp_build_pdu_iovec() could walk past cmd->req.sg when a PDU length or offset exceeds sg_cnt and then use bogus sg->length/offset values, leading to _copy_to_iter() GPF/KASAN.

It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container.)(CVE-2026-31431)

Record: LSN-120-1
Updated: 2026-11-02

OSVopenSUSE-SU-2025:20081-1 No score