Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-38312 State: PUBLISHED Published: 2025-07-10T07:42:20.647Z Last Updated: 2025-11-03T17:36:25.507Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() In fb_find_mode_cvt(), iff mode->refresh somehow happens to be 0x80000000, cvt.f_refresh will become 0 when multiplying it by 2 due to overflow. It's then passed to fb_cvt_hperiod(), where it's used as a divider -- division by 0 will result in kernel oops. Add a sanity check for cvt.f_refresh to avoid such overflow... Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool. Ad
to avoid such overflow... Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/9027ce4c037b566b658b8939a76326b7125e3627 - https://git.kernel.org/stable/c/610f247f2772e4f92b63442125a1b7ade79898d8 - https://git.kernel.org/stable/c/2d63433e8eaa3c91b2948190e395bc67009db0d9 - https://git.kernel.org/stable/c/54947530663edcbaaee1314c01fdd8c72861b124 - https://git.kernel.org/stable/c/ab91647acdf43b984824776559a452212eaeb21a - https://git.kernel.org/stable/c/b235393b9f43ff86a38ca2bde6372312ea215dc5 - https://git.kernel.org/stable/c/53784073cbad18f75583fd3da9ffdfc4d1f
/stable/c/b235393b9f43ff86a38ca2bde6372312ea215dc5 - https://git.kernel.org/stable/c/53784073cbad18f75583fd3da9ffdfc4d1f05405 - https://git.kernel.org/stable/c/3f6dae09fc8c306eb70fdfef70726e1f154e173a
CVE ID: CVE-2025-38313 State: PUBLISHED Published: 2025-07-10T07:42:21.314Z Last Updated: 2025-11-03T17:36:27.591Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: fix double-free on mc_dev The blamed commit tried to simplify how the deallocations are done but, in the process, introduced a double-free on the mc_dev variable. In case the MC device is a DPRC, a new mc_bus is allocated and the mc_dev variable is just a reference to one of its fields. In this circumstance, on the error path only the mc_bus should be freed. This commit introduces back the following checkpatch warning which is a false-positive. WARNING: kf
bus should be freed. This commit introduces back the following checkpatch warning which is a false-positive. WARNING: kfree(NULL) is safe and this check is probably not required + if (mc_bus) + kfree(mc_bus); Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/12e4431e5078847791936820bd39df9e1ee26d2e - https://git.kernel.org/stable/c/3135e03a92f6b5259d0a7f25f728e9e7866ede3f - https://git.kernel.org/stable/c/7002b954c4a8b9965ba0f139812ee4a6f71beac8 - https://git.kernel.org/stable/c/b2057374f326303c86d8423415ab58656eebc695 - https://git.kernel.org/stable/c/4b23c46eb2d88924b93aca647bde9a4b9cf62cf9 - https://git.kernel.org/stable/c/1d5baab39e5b09a7687
//git.kernel.org/stable/c/4b23c46eb2d88924b93aca647bde9a4b9cf62cf9 - https://git.kernel.org/stable/c/1d5baab39e5b09a76870b345cdee7933871b881f - https://git.kernel.org/stable/c/873d47114fd5e5a1cad2018843671537cc71ac84 - https://git.kernel.org/stable/c/d694bf8a9acdbd061596f3e7549bc8cb70750a60
CVE ID: CVE-2025-38314 State: PUBLISHED Published: 2025-07-10T07:42:21.937Z Last Updated: 2025-07-28T04:18:24.788Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: virtio-pci: Fix result size returned for the admin command completion The result size returned by virtio_pci_admin_dev_parts_get() is 8 bytes larger than the actual result data size. This occurs because the result_sg_size field of the command is filled with the result length from virtqueue_get_buf(), which includes both the data size and an additional 8 bytes of status. This oversized result size causes two issues: 1. The state transferred to the destination includes 8
8 bytes of status. This oversized result size causes two issues: 1. The state transferred to the destination includes 8 bytes of extra data at the end. 2. The allocated buffer in the kernel may be smaller than the returned size, leading to failures when reading beyond the allocated size. The commit fixes this by subtracting the status size from the result of virtqueue_get_buf(). This fix has been tested through live migrations with virtio-net, virtio-net-transitional, and virtio-blk devices. References: - https://git.kernel.org/stable/c/920b6720bb63893b81516c0c45884a8350f9e4bf - https://git.kernel.org/stable/c/9ef41ebf787fcbde99ac404ae473f8467641f983
CVE ID: CVE-2025-38315 State: PUBLISHED Published: 2025-07-10T07:42:22.569Z Last Updated: 2025-07-28T04:18:26.041Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Check dsbr size from EFI variable Since the size of struct btintel_dsbr is already known, we can just start there instead of querying the EFI variable size. If the final result doesn't match what we expect also fail. This fixes a stack buffer overflow when the EFI variable is larger than struct btintel_dsbr. References: - https://git.kernel.org/stable/c/9427f6081f37c795a8bd29d0ee72a4da3bd64af8 - https://git.kernel.org/stable/c/7b8526bb489780ccc0caff
it.kernel.org/stable/c/9427f6081f37c795a8bd29d0ee72a4da3bd64af8 - https://git.kernel.org/stable/c/7b8526bb489780ccc0caffc446ecabec83cfe568 - https://git.kernel.org/stable/c/3aa1dc3c9060e335e82e9c182bf3d1db29220b1b
CVE ID: CVE-2025-38316 State: PUBLISHED Published: 2025-07-10T07:42:23.219Z Last Updated: 2025-07-28T04:18:27.267Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: avoid NULL pointer dereference in mt7996_set_monitor() The function mt7996_set_monitor() dereferences phy before the NULL sanity check. Fix this to avoid NULL pointer dereference by moving the dereference after the check. References: - https://git.kernel.org/stable/c/83a422c8169eef95aef57f7ddc467bb126d9ae81 - https://git.kernel.org/stable/c/cb423ddad0f6e6f55b1700422ab777b25597cc83
CVE ID: CVE-2025-38317 State: PUBLISHED Published: 2025-07-10T07:42:23.841Z Last Updated: 2025-07-28T04:18:28.701Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix buffer overflow in debugfs If the user tries to write more than 32 bytes then it results in memory corruption. Fortunately, this is debugfs so it's limited to root users. References: - https://git.kernel.org/stable/c/0c57aa8ef94cffc5c2d68230e19329a03e71a94f - https://git.kernel.org/stable/c/8c4a200d03574bfcbf54fdb7ba5968b58ad2e0b3 - https://git.kernel.org/stable/c/8c7a5031a6b0d42e640fbd2d5d05f61f74e32dce
CVE ID: CVE-2025-38318 State: PUBLISHED Published: 2025-07-10T07:42:24.461Z Last Updated: 2025-07-28T04:18:30.380Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: perf: arm-ni: Fix missing platform_set_drvdata() Add missing platform_set_drvdata in arm_ni_probe(), otherwise calling platform_get_drvdata() in remove returns NULL. References: - https://git.kernel.org/stable/c/8e43fa9c713a6d084a5732aa6dd41c734845f25e - https://git.kernel.org/stable/c/498129a868ce966af277841f7e32e9f76b3779ad - https://git.kernel.org/stable/c/fc5106088d6db75df61308ef6de314d1f7959646
CVE ID: CVE-2025-38319 State: PUBLISHED Published: 2025-07-10T07:42:25.111Z Last Updated: 2025-11-03T17:36:28.555Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table The function atomctrl_initialize_mc_reg_table() and atomctrl_initialize_mc_reg_table_v2_2() does not check the return value of smu_atom_get_data_table(). If smu_atom_get_data_table() fails to retrieve vram_info, it returns NULL which is later dereferenced. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/85cdcb834fb490731ff2d123f87ca799
l Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/85cdcb834fb490731ff2d123f87ca799c57dacf2 - https://git.kernel.org/stable/c/7080c20a9139842033ed4af604dc1fa4028593ad - https://git.kernel.org/stable/c/cdf7e1ff99ab06ef15d0b5d1aca5258a4fb62b85 - https://git.kernel.org/stable/c/64f3acc8c7e6809631457b75638601b36dea3129 - https://git.kernel.org/stable/c/a4ff7391c8b75b1541900bd9d0c238e558c11fb3 - https://git.kernel.org/stable/c/820116a39f96bdc7d426c33a804b52f53700a919
CVE ID: CVE-2025-38320 State: PUBLISHED Published: 2025-07-10T08:14:56.398Z Last Updated: 2025-11-03T17:36:30.512Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() KASAN reports a stack-out-of-bounds read in regs_get_kernel_stack_nth(). Call Trace: [ 97.283505] BUG: KASAN: stack-out-of-bounds in regs_get_kernel_stack_nth+0xa8/0xc8 [ 97.284677] Read of size 8 at addr ffff800089277c10 by task 1.sh/2550 [ 97.285732] [ 97.286067] CPU: 7 PID: 2550 Comm: 1.sh Not tainted 6.6.0+ #11 [ 97.287032] Hardware name: linux,dummy-virt (DT) [ 97.287815] Call trace: [ 97.28
550 Comm: 1.sh Not tainted 6.6.0+ #11 [ 97.287032] Hardware name: linux,dummy-virt (DT) [ 97.287815] Call trace: [ 97.288279] dump_backtrace+0xa0/0x128 [ 97.288946] show_stack+0x20/0x38 [ 97.289551] dump_stack_lvl+0x78/0xc8 [ 97.290203] print_address_description.constprop.0+0x84/0x3c8 [ 97.291159] print_report+0xb0/0x280 [ 97.291792] kasan_report+0x84/0xd0 [ 97.292421] __asan_load8+0x9c/0xc0 [ 97.293042] regs_get_kernel_stack_nth+0xa8/0xc8 [ 97.293835] process_fetch_insn+0x770/0xa30 [ 97.294562] kprobe_trace_func+0x254/0x3b0 [ 97.295271] kprobe_dispatcher+0x98/0xe0 [ 97.295955] kprobe_breakpoint_handler+0x1b0/0x210 [ 97.296774] call_break_hook+0xc4/0x100 [ 97.297451] brk_handler+0x24/0x78 [
955] kprobe_breakpoint_handler+0x1b0/0x210 [ 97.296774] call_break_hook+0xc4/0x100 [ 97.297451] brk_handler+0x24/0x78 [ 97.298073] do_debug_exception+0xac/0x178 [ 97.298785] el1_dbg+0x70/0x90 [ 97.299344] el1h_64_sync_handler+0xcc/0xe8 [ 97.300066] el1h_64_sync+0x78/0x80 [ 97.300699] kernel_clone+0x0/0x500 [ 97.301331] __arm64_sys_clone+0x70/0x90 [ 97.302084] invoke_syscall+0x68/0x198 [ 97.302746] el0_svc_common.constprop.0+0x11c/0x150 [ 97.303569] do_el0_svc+0x38/0x50 [ 97.304164] el0_svc+0x44/0x1d8 [ 97.304749] el0t_64_sync_handler+0x100/0x130 [ 97.305500] el0t_64_sync+0x188/0x190 [ 97.306151] [ 97.306475] The buggy address belongs to stack of task 1.sh/2550 [ 97.307461] and is located at
188/0x190 [ 97.306151] [ 97.306475] The buggy address belongs to stack of task 1.sh/2550 [ 97.307461] and is located at offset 0 in frame: [ 97.308257] __se_sys_clone+0x0/0x138 [ 97.308910] [ 97.309241] This frame has 1 object: [ 97.309873] [48, 184) 'args' [ 97.309876] [ 97.310749] The buggy address belongs to the virtual mapping at [ 97.310749] [ffff800089270000, ffff800089279000) created by: [ 97.310749] dup_task_struct+0xc0/0x2e8 [ 97.313347] [ 97.313674] The buggy address belongs to the physical page: [ 97.314604] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14f69a [ 97.315885] flags: 0x15ffffe00000000(node=1|zone=2|lastcpupid=0xfffff) [ 97.316957] raw: 015ffffe0
dex:0x0 pfn:0x14f69a [ 97.315885] flags: 0x15ffffe00000000(node=1|zone=2|lastcpupid=0xfffff) [ 97.316957] raw: 015ffffe00000000 0000000000000000 dead000000000122 0000000000000000 [ 97.318207] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 97.319445] page dumped because: kasan: bad access detected [ 97.320371] [ 97.320694] Memory state around the buggy address: [ 97.321511] ffff800089277b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 97.322681] ffff800089277b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 97.323846] >ffff800089277c00: 00 00 f1 f1 f1 f1 f1 f1 00 00 00 00 00 00 00 00 [ 97.325023] ^ [ 97.325683] ffff800089277c80: 00 00 00 00 00 00 00 00 0
00 00 f1 f1 f1 f1 f1 f1 00 00 00 00 00 00 00 00 [ 97.325023] ^ [ 97.325683] ffff800089277c80: 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 f3 f3 [ 97.326856] ffff800089277d00: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 This issue seems to be related to the behavior of some gcc compilers and was also fixed on the s390 architecture before: commit d93a855c31b7 ("s390/ptrace: Avoid KASAN false positives in regs_get_kernel_stack_nth()") As described in that commit, regs_get_kernel_stack_nth() has confirmed that `addr` is on the stack, so reading the value at `*addr` should be allowed. Use READ_ONCE_NOCHECK() helper to silence the KASAN check for this case. [will: Use '*addr' as the argument to
allowed. Use READ_ONCE_NOCHECK() helper to silence the KASAN check for this case. [will: Use '*addr' as the argument to READ_ONCE_NOCHECK()] Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/64773b3ea09235168a549a195cba43bb867c4a17 - https://git.kernel.org/stable/c/67abac27d806e8f9d4226ec1528540cf73af673a - https://git.kernel.org/stable/c/92750bfe7b0d8dbcaf578c091a65eda1c5f9ad38 - https://git.kernel.org/stable/c/01f91d415a8375d85e0c7d3615cd4a168308bb7c - https://git.kernel.org/stable/c/21da6d3561f373898349ca7167c9811c020da695 - https://git.kernel.org/stable/c/22f935bc86bdfbde04009f05eee191d220cd8c89 - https://git.kernel.org/stable/c/422e565b788
- https://git.kernel.org/stable/c/22f935bc86bdfbde04009f05eee191d220cd8c89 - https://git.kernel.org/stable/c/422e565b7889ebfd9c8705a3fc786642afe61fca - https://git.kernel.org/stable/c/39dfc971e42d886e7df01371cd1bef505076d84c
CVE ID: CVE-2025-38321 State: PUBLISHED Published: 2025-07-10T08:14:57.046Z Last Updated: 2025-07-28T04:18:34.550Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb: Log an error when close_all_cached_dirs fails Under low-memory conditions, close_all_cached_dirs() can't move the dentries to a separate list to dput() them once the locks are dropped. This will result in a "Dentry still in use" error, so add an error message that makes it clear this is what happened: [ 495.281119] CIFS: VFS: \\otters.example.com\share Out of memory while dropping dentries [ 495.281595] ------------[ cut here ]------------ [ 495.281887] BUG: Dentr
\share Out of memory while dropping dentries [ 495.281595] ------------[ cut here ]------------ [ 495.281887] BUG: Dentry ffff888115531138{i=78,n=/} still in use (2) [unmount of cifs cifs] [ 495.282391] WARNING: CPU: 1 PID: 2329 at fs/dcache.c:1536 umount_check+0xc8/0xf0 Also, bail out of looping through all tcons as soon as a single allocation fails, since we're already in trouble, and kmalloc() attempts for subseqeuent tcons are likely to fail just like the first one did. References: - https://git.kernel.org/stable/c/b8ced2b9a23a1a2c1e0ed8d0d02512e51bdf38da - https://git.kernel.org/stable/c/43f26094d6702e494e800532c3f1606e7a68eb30 - https://git.kernel.org/stable/c/4479db143390bdcadc1561292
kernel.org/stable/c/43f26094d6702e494e800532c3f1606e7a68eb30 - https://git.kernel.org/stable/c/4479db143390bdcadc1561292aab579cdfa9f6c6 - https://git.kernel.org/stable/c/a2182743a8b4969481f64aec4908ff162e8a206c
CVE ID: CVE-2025-38322 State: PUBLISHED Published: 2025-07-10T08:14:57.603Z Last Updated: 2025-11-03T17:36:31.455Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix crash in icl_update_topdown_event() The perf_fuzzer found a hard-lockup crash on a RaptorLake machine: Oops: general protection fault, maybe for address 0xffff89aeceab400: 0000 CPU: 23 UID: 0 PID: 0 Comm: swapper/23 Tainted: [W]=WARN Hardware name: Dell Inc. Precision 9660/0VJ762 RIP: 0010:native_read_pmc+0x7/0x40 Code: cc e8 8d a9 01 00 48 89 03 5b cd cc cc cc cc 0f 1f ... RSP: 000:fffb03100273de8 EFLAGS: 00010046 .... Call Trace: <TASK> icl_update
01 00 48 89 03 5b cd cc cc cc cc 0f 1f ... RSP: 000:fffb03100273de8 EFLAGS: 00010046 .... Call Trace: <TASK> icl_update_topdown_event+0x165/0x190 ? ktime_get+0x38/0xd0 intel_pmu_read_event+0xf9/0x210 __perf_event_read+0xf9/0x210 CPUs 16-23 are E-core CPUs that don't support the perf metrics feature. The icl_update_topdown_event() should not be invoked on these CPUs. It's a regression of commit: f9bdf1f95339 ("perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read") The bug introduced by that commit is that the is_topdown_event() function is mistakenly used to replace the is_topdown_count() call to check if the topdown functions for the perf metrics feature should be invoked. Fix
eplace the is_topdown_count() call to check if the topdown functions for the perf metrics feature should be invoked. Fix it. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/702ea6028032d6c1fe96c2d4762a3575e3654819 - https://git.kernel.org/stable/c/79e2dd573116d3338507c311460da9669095c94d - https://git.kernel.org/stable/c/e97c45c770f5e56c784a46c2a96ab968d26b97d9 - https://git.kernel.org/stable/c/a85cc69acdcb05f8cd226b8ea0778b8e2e887e6f - https://git.kernel.org/stable/c/b0823d5fbacb1c551d793cbfe7af24e0d1fa45ed
CVE ID: CVE-2025-38323 State: PUBLISHED Published: 2025-07-10T08:14:58.212Z Last Updated: 2025-11-03T17:36:33.359Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: atm: add lec_mutex syzbot found its way in net/atm/lec.c, and found an error path in lecd_attach() could leave a dangling pointer in dev_lec[]. Add a mutex to protect dev_lecp[] uses from lecd_attach(), lec_vcc_attach() and lec_mcast_attach(). Following patch will use this mutex for /proc/net/atm/lec. BUG: KASAN: slab-use-after-free in lecd_attach net/atm/lec.c:751 [inline] BUG: KASAN: slab-use-after-free in lane_ioctl+0x2224/0x23e0 net/atm/lec.c:1008 Read of size
h net/atm/lec.c:751 [inline] BUG: KASAN: slab-use-after-free in lane_ioctl+0x2224/0x23e0 net/atm/lec.c:1008 Read of size 8 at addr ffff88807c7b8e68 by task syz.1.17/6142 CPU: 1 UID: 0 PID: 6142 Comm: syz.1.17 Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xcd/0x680 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 lecd_attach net/atm/lec.c:751 [inline] lane_ioctl+0x2224/0x23e0 net/atm/l
kasan_report+0xe0/0x110 mm/kasan/report.c:634 lecd_attach net/atm/lec.c:751 [inline] lane_ioctl+0x2224/0x23e0 net/atm/lec.c:1008 do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159 sock_do_ioctl+0x118/0x280 net/socket.c:1190 sock_ioctl+0x227/0x6b0 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated by task 6132: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison
ted by task 6132: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4328 [inline] __kvmalloc_node_noprof+0x27b/0x620 mm/slub.c:5015 alloc_netdev_mqs+0xd2/0x1570 net/core/dev.c:11711 lecd_attach net/atm/lec.c:737 [inline] lane_ioctl+0x17db/0x23e0 net/atm/lec.c:1008 do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159 sock_do_ioctl+0x118/0x280 net/socket.c:1190 sock_ioctl+0x227/0x6b0 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys
ock_ioctl+0x227/0x6b0 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6132: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2381 [in
ree+0x51/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2381 [inline] slab_free mm/slub.c:4643 [inline] kfree+0x2b4/0x4d0 mm/slub.c:4842 free_netdev+0x6c5/0x910 net/core/dev.c:11892 lecd_attach net/atm/lec.c:744 [inline] lane_ioctl+0x1ce8/0x23e0 net/atm/lec.c:1008 do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159 sock_do_ioctl+0x118/0x280 net/socket.c:1190 sock_ioctl+0x227/0x6b0 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893 Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/
18e/0x210 fs/ioctl.c:893 Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/e91274cc7ed88ab5bdc62d426067c82b0b118a0b - https://git.kernel.org/stable/c/a7a713dfb5f9477345450f27c7c0741864511192 - https://git.kernel.org/stable/c/17e156a94e94a906a570dbf9b48877956c60bef8 - https://git.kernel.org/stable/c/18e8f0c4f826fb08c2d3825cdd6c57e24b207e0a - https://git.kernel.org/stable/c/dffd03422ae6a459039c8602f410e6c0f4cbc6c8 - https://git.kernel.org/stable/c/f4d80b16ecc4229f7e6345158ef34c36be323f0e - https://git.kernel.org/stable/c/64b378db28a967f7b271b055380c2360279aa424 - https://git.kernel.org/stable/c/d13a3824bfd2b4774b671a75cf766a16637a0e67
CVE ID: CVE-2025-38324 State: PUBLISHED Published: 2025-07-10T08:14:58.857Z Last Updated: 2025-11-03T17:36:35.272Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). As syzbot reported [0], mpls_route_input_rcu() can be called from mpls_getroute(), where is under RTNL. net->mpls.platform_label is only updated under RTNL. Let's use rcu_dereference_rtnl() in mpls_route_input_rcu() to silence the splat. [0]: WARNING: suspicious RCU usage 6.15.0-rc7-syzkaller-00082-g5cdb2c77c4c3 #0 Not tainted ---------------------------- net/mpls/af_mpls.c:84 suspicious rcu_dereference_check(
-00082-g5cdb2c77c4c3 #0 Not tainted ---------------------------- net/mpls/af_mpls.c:84 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by syz.2.4451/17730: #0: ffffffff9012a3e8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff9012a3e8 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x371/0xe90 net/core/rtnetlink.c:6961 stack backtrace: CPU: 1 UID: 0 PID: 17730 Comm: syz.2.4451 Not tainted 6.15.0-rc7-syzkaller-00082-g5cdb2c77c4c3 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: <TASK> __dump_stack li
ware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 lockdep_rcu_suspicious+0x166/0x260 kernel/locking/lockdep.c:6865 mpls_route_input_rcu+0x1d4/0x200 net/mpls/af_mpls.c:84 mpls_getroute+0x621/0x1ea0 net/mpls/af_mpls.c:2381 rtnetlink_rcv_msg+0x3c9/0xe90 net/core/rtnetlink.c:6964 netlink_rcv_skb+0x16d/0x440 net/netlink/af_netlink.c:2534 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] netlink_unicast+0x53a/0x7f0 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:712 [inlin