Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
nd `INSN_WRITE` instructions, then `data[0]` may contain uninitialized data, and certainly contains invalid data, possibly from a different instruction in the array of instructions handled by `do_insnlist_ioctl()`. This will result in an incorrect value being written to the digital output channel (or to the digital input/output channel if configured as an output), and may be reflected in the internal saved state of the channel. Fix it by returning 0 early if `insn->n` is 0, before reaching the code that accesses `data[0]`. Previously, the function always returned 1 on success, but it is supposed to be the number of data samples actually read or written up to `insn->n`, which is 0 in this cas
ss, but it is supposed to be the number of data samples actually read or written up to `insn->n`, which is 0 in this case. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/4c2981bf30401adfcdbfece4ab6f411f7c5875a1 - https://git.kernel.org/stable/c/16256d7efcf7acc9f39abe21522c4c6b77f67c00 - https://git.kernel.org/stable/c/c53570e62b5b28bdb56bb563190227f8307817a5 - https://git.kernel.org/stable/c/3050d197d6bc9ef128944a70210f42d2430b3000 - https://git.kernel.org/stable/c/10f9024a8c824a41827fff1fefefb314c98e2c88 - https://git.kernel.org/stable/c/2af1e7d389c2619219171d23f5b96dbcbb7f9656 - https://git.kernel.org/stable/c/3ab55ffaaf75d0c7b68e332c1cdcc1
l.org/stable/c/2af1e7d389c2619219171d23f5b96dbcbb7f9656 - https://git.kernel.org/stable/c/3ab55ffaaf75d0c7b68e332c1cdcc1b0e0044870 - https://git.kernel.org/stable/c/e9cb26291d009243a4478a7ffb37b3a9175bfce9
CVE ID: CVE-2025-38481 State: PUBLISHED Published: 2025-07-28T11:21:46.147Z Last Updated: 2025-11-03T17:38:50.413Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large The handling of the `COMEDI_INSNLIST` ioctl allocates a kernel buffer to hold the array of `struct comedi_insn`, getting the length from the `n_insns` member of the `struct comedi_insnlist` supplied by the user. The allocation will fail with a WARNING and a stack dump if it is too large. Avoid that by failing with an `-EINVAL` error if the supplied `n_insns` value is unreasonable. Define the limit on the `n_ins
that by failing with an `-EINVAL` error if the supplied `n_insns` value is unreasonable. Define the limit on the `n_insns` value in the `MAX_INSNS` macro. Set this to the same value as `MAX_SAMPLES` (65536), which is the maximum allowed sum of the values of the member `n` in the array of `struct comedi_insn`, and sensible comedi instructions will have an `n` of at least 1. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/454d732dfd0aef7d7aa950c409215ca06d717e93 - https://git.kernel.org/stable/c/c68257588e87f45530235701a42496b7e9e56adb - https://git.kernel.org/stable/c/69dc06b9514522de532e997a21d035cd29b0db44 - https://git.kernel.org/stable/c/d
7e9e56adb - https://git.kernel.org/stable/c/69dc06b9514522de532e997a21d035cd29b0db44 - https://git.kernel.org/stable/c/d4c73ce13f5b5a0fe0319f1f352ff602f0ace8e3 - https://git.kernel.org/stable/c/c9d3d9667443caafa804cd07940aeaef8e53aa90 - https://git.kernel.org/stable/c/992d600f284e719242a434166e86c1999649b71c - https://git.kernel.org/stable/c/e3b8322cc8081d142ee4c1a43e1d702bdba1ed76 - https://git.kernel.org/stable/c/08ae4b20f5e82101d77326ecab9089e110f224cc
CVE ID: CVE-2025-38482 State: PUBLISHED Published: 2025-07-28T11:21:47.026Z Last Updated: 2025-11-03T17:38:52.280Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: comedi: das6402: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: /* IRQs 2,3,5,6,7, 10,11,15 are valid for "enhanced" mode */ if ((1 << it->options[1]) & 0x8cec) { However, `it->options[i]` is an unchecked `int` value from userspace, so the shift amount could be negative or out of bounds. Fix the test by requiring `it->options[1]` to be within bounds before proceeding with the original test. Valid `it->options[1]` value
by requiring `it->options[1]` to be within bounds before proceeding with the original test. Valid `it->options[1]` values that select the IRQ will be in the range [1,15]. The value 0 explicitly disables the use of interrupts. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/a15e9c175f783298c4ee48146be6841335400406 - https://git.kernel.org/stable/c/de8da1063cce9234d55c8270d9bdf4cf84411c80 - https://git.kernel.org/stable/c/73f34d609397805c20d6b2ef5c07a4cbf7c4d63a - https://git.kernel.org/stable/c/a18a42e77545afcacd6a2b8d9fc16191b87454df - https://git.kernel.org/stable/c/8a3637027ceeba4ca5e500b23cb7d24c25592513 - https://git.kernel.org/stable/c/3e
b87454df - https://git.kernel.org/stable/c/8a3637027ceeba4ca5e500b23cb7d24c25592513 - https://git.kernel.org/stable/c/3eab654f5d199ecd45403c6588cda63e491fcfca - https://git.kernel.org/stable/c/4a3c18cde02e35aba87e0ad5672b3e1c72dda5a4 - https://git.kernel.org/stable/c/70f2b28b5243df557f51c054c20058ae207baaac
CVE ID: CVE-2025-38483 State: PUBLISHED Published: 2025-07-28T11:21:47.895Z Last Updated: 2025-11-03T17:38:54.170Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: comedi: das16m1: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: /* only irqs 2, 3, 4, 5, 6, 7, 10, 11, 12, 14, and 15 are valid */ if ((1 << it->options[1]) & 0xdcfc) { However, `it->options[i]` is an unchecked `int` value from userspace, so the shift amount could be negative or out of bounds. Fix the test by requiring `it->options[1]` to be within bounds before proceeding with the original test. Additional Analyst Not
test by requiring `it->options[1]` to be within bounds before proceeding with the original test. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/539bdff832adac9ea653859fa0b6bc62e743329c - https://git.kernel.org/stable/c/d1291c69f46d6572b2cf75960dd8975d7ab2176b - https://git.kernel.org/stable/c/b3c95fa508e5dc3da60520eea92a5241095ceef1 - https://git.kernel.org/stable/c/65c03e6fc524eb2868abedffd8a4613d78abc288 - https://git.kernel.org/stable/c/adb7df8a8f9d788423e161b779764527dd3ec2d0 - https://git.kernel.org/stable/c/076b13ee60eb01ed0d140ef261f95534562a3077 - https://git.kernel.org/stable/c/f211572818ed5bec2b3f5d4e0719ef8699b3c269 - https://git.
eb01ed0d140ef261f95534562a3077 - https://git.kernel.org/stable/c/f211572818ed5bec2b3f5d4e0719ef8699b3c269 - https://git.kernel.org/stable/c/ed93c6f68a3be06e4e0c331c6e751f462dee3932
CVE ID: CVE-2025-38484 State: PUBLISHED Published: 2025-07-28T11:21:48.690Z Last Updated: 2025-07-28T11:21:48.690Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iio: backend: fix out-of-bound write The buffer is set to 80 character. If a caller write more characters, count is truncated to the max available space in "simple_write_to_buffer". But afterwards a string terminator is written to the buffer at offset count without boundary check. The zero termination is written OUT-OF-BOUND. Add a check that the given buffer is smaller then the buffer to prevent. References: - https://git.kernel.org/stable/c/6eea9f7648ddb9e4903735a1f7
n buffer is smaller then the buffer to prevent. References: - https://git.kernel.org/stable/c/6eea9f7648ddb9e4903735a1f77cf196c957aa38 - https://git.kernel.org/stable/c/01e941aa7f5175125df4ac5d3aab099961525602 - https://git.kernel.org/stable/c/da9374819eb3885636934c1006d450c3cb1a02ed
CVE ID: CVE-2025-38485 State: PUBLISHED Published: 2025-07-28T11:21:49.624Z Last Updated: 2025-11-03T17:38:55.102Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush fxls8962af_fifo_flush() uses indio_dev->active_scan_mask (with iio_for_each_active_channel()) without making sure the indio_dev stays in buffer mode. There is a race if indio_dev exits buffer mode in the middle of the interrupt that flushes the fifo. Fix this by calling synchronize_irq() to ensure that no interrupt is currently running when disabling buffer mode. Unable to handle kernel NULL pointer de
q() to ensure that no interrupt is currently running when disabling buffer mode. Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read [...] _find_first_bit_le from fxls8962af_fifo_flush+0x17c/0x290 fxls8962af_fifo_flush from fxls8962af_interrupt+0x80/0x178 fxls8962af_interrupt from irq_thread_fn+0x1c/0x7c irq_thread_fn from irq_thread+0x110/0x1f4 irq_thread from kthread+0xe0/0xfc kthread from ret_from_fork+0x14/0x2c Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/6ecd61c201b27ad2760b3975437ad2b97d725b98 - https://git.kernel.org/stable/c/dda42f23a8f5439eaac9521ce0531547d880cc54 - https://git.kernel.org/stable/c
2b97d725b98 - https://git.kernel.org/stable/c/dda42f23a8f5439eaac9521ce0531547d880cc54 - https://git.kernel.org/stable/c/bfcda3e1015791b3a63fb4d3aad408da9cf76e8f - https://git.kernel.org/stable/c/1803d372460aaa9ae0188a30c9421d3f157f2f04 - https://git.kernel.org/stable/c/1fe16dc1a2f5057772e5391ec042ed7442966c9a
CVE ID: CVE-2025-38486 State: PUBLISHED Published: 2025-07-28T11:21:50.349Z Last Updated: 2025-07-28T11:21:50.349Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: soundwire: Revert "soundwire: qcom: Add set_channel_map api support" This reverts commit 7796c97df6b1b2206681a07f3c80f6023a6593d5. This patch broke Dragonboard 845c (sdm845). I see: Unexpected kernel BRK exception at EL1 Internal error: BRK handler: 00000000f20003e8 [#1] SMP pc : qcom_swrm_set_channel_map+0x7c/0x80 [soundwire_qcom] lr : snd_soc_dai_set_channel_map+0x34/0x78 Call trace: qcom_swrm_set_channel_map+0x7c/0x80 [soundwire_qcom] (P) sdm845_dai_init+0x18c/0x2e0
t_channel_map+0x34/0x78 Call trace: qcom_swrm_set_channel_map+0x7c/0x80 [soundwire_qcom] (P) sdm845_dai_init+0x18c/0x2e0 [snd_soc_sdm845] snd_soc_link_init+0x28/0x6c snd_soc_bind_card+0x5f4/0xb0c snd_soc_register_card+0x148/0x1a4 devm_snd_soc_register_card+0x50/0xb0 sdm845_snd_platform_probe+0x124/0x148 [snd_soc_sdm845] platform_probe+0x6c/0xd0 really_probe+0xc0/0x2a4 __driver_probe_device+0x7c/0x130 driver_probe_device+0x40/0x118 __device_attach_driver+0xc4/0x108 bus_for_each_drv+0x8c/0xf0 __device_attach+0xa4/0x198 device_initial_probe+0x18/0x28 bus_probe_device+0xb8/0xbc deferred_probe_work_func+0xac/0xfc process_one_work+0x244/0x658 worker_thread+0x1b4/0x360 kthread+0x148/0x228 ret_from_
deferred_probe_work_func+0xac/0xfc process_one_work+0x244/0x658 worker_thread+0x1b4/0x360 kthread+0x148/0x228 ret_from_fork+0x10/0x20 Kernel panic - not syncing: BRK handler: Fatal exception Dan has also reported following issues with the original patch https://lore.kernel.org/all/33fe8fe7-719a-405a-9ed2-d9f816ce1d57@sabinyo.mountain/ Bug #1: The zeroeth element of ctrl->pconfig[] is supposed to be unused. We start counting at 1. However this code sets ctrl->pconfig[0].ch_mask = 128. Bug #2: There are SLIM_MAX_TX_PORTS (16) elements in tx_ch[] array but only QCOM_SDW_MAX_PORTS + 1 (15) in the ctrl->pconfig[] array so it corrupts memory like Yongqin Liu pointed out. Bug 3: Like Jie Gan point
ORTS + 1 (15) in the ctrl->pconfig[] array so it corrupts memory like Yongqin Liu pointed out. Bug 3: Like Jie Gan pointed out, it erases all the tx information with the rx information. References: - https://git.kernel.org/stable/c/207cea8b72fcbdf4e6db178e54186ed4f1514b3c - https://git.kernel.org/stable/c/834bce6a715ae9a9c4dce7892454a19adf22b013
CVE ID: CVE-2025-38487 State: PUBLISHED Published: 2025-07-28T11:21:51.249Z Last Updated: 2025-11-03T17:38:56.987Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled Mitigate e.g. the following: # echo 1e789080.lpc-snoop > /sys/bus/platform/drivers/aspeed-lpc-snoop/unbind ... [ 120.363594] Unable to handle kernel NULL pointer dereference at virtual address 00000004 when write [ 120.373866] [00000004] *pgd=00000000 [ 120.377910] Internal error: Oops: 805 [#1] SMP ARM [ 120.383306] CPU: 1 UID: 0 PID: 315 Comm: sh Not tainted 6.15.0-rc1-00009-g926217bc7d7d-dirty #20 NO
: 805 [#1] SMP ARM [ 120.383306] CPU: 1 UID: 0 PID: 315 Comm: sh Not tainted 6.15.0-rc1-00009-g926217bc7d7d-dirty #20 NONE ... [ 120.679543] Call trace: [ 120.679559] misc_deregister from aspeed_lpc_snoop_remove+0x84/0xac [ 120.692462] aspeed_lpc_snoop_remove from platform_remove+0x28/0x38 [ 120.700996] platform_remove from device_release_driver_internal+0x188/0x200 ... Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/62e51f51d97477ea4e78c82e7076a171dac86c75 - https://git.kernel.org/stable/c/9e1d2b97f5e2a36a2fd30a8bd30ead9dac5e3a51 - https://git.kernel.org/stable/c/166afe964e8433d52c641f5d1c09102bacee9a92 - https://git.kernel.org/stable/c/dc559
e3a51 - https://git.kernel.org/stable/c/166afe964e8433d52c641f5d1c09102bacee9a92 - https://git.kernel.org/stable/c/dc5598482e2d3b234f6d72d6f5568e24f603e51a - https://git.kernel.org/stable/c/329a80adc0e5f815d0514a6d403aaaf0995cd9be - https://git.kernel.org/stable/c/b361598b7352f02456619a6105c7da952ef69f8f - https://git.kernel.org/stable/c/ac10ed9862104936a412f8b475c869e99f048448 - https://git.kernel.org/stable/c/56448e78a6bb4e1a8528a0e2efe94eff0400c247
CVE ID: CVE-2025-38488 State: PUBLISHED Published: 2025-07-28T11:21:52.085Z Last Updated: 2025-11-03T17:38:58.858Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in crypt_message when using async crypto The CVE-2024-50047 fix removed asynchronous crypto handling from crypt_message(), assuming all crypto operations are synchronous. However, when hardware crypto accelerators are used, this can cause use-after-free crashes: crypt_message() // Allocate the creq buffer containing the req creq = smb2_get_aead_req(..., &req); // Async encryption returns -EINPROGRESS immediately rc = enc ? crypto_aead_en
req creq = smb2_get_aead_req(..., &req); // Async encryption returns -EINPROGRESS immediately rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req); // Free creq while async operation is still in progress kvfree_sensitive(creq, ...); Hardware crypto modules often implement async AEAD operations for performance. When crypto_aead_encrypt/decrypt() returns -EINPROGRESS, the operation completes asynchronously. Without crypto_wait_req(), the function immediately frees the request buffer, leading to crashes when the driver later accesses the freed memory. This results in a use-after-free condition when the hardware crypto driver later accesses the freed request structure, leading to kern
n a use-after-free condition when the hardware crypto driver later accesses the freed request structure, leading to kernel crashes with NULL pointer dereferences. The issue occurs because crypto_alloc_aead() with mask=0 doesn't guarantee synchronous operation. Even without CRYPTO_ALG_ASYNC in the mask, async implementations can be selected. Fix by restoring the async crypto handling: - DECLARE_CRYPTO_WAIT(wait) for completion tracking - aead_request_set_callback() for async completion notification - crypto_wait_req() to wait for operation completion This ensures the request buffer isn't freed until the crypto operation completes, whether synchronous or asynchronous, while preserving the CVE-
buffer isn't freed until the crypto operation completes, whether synchronous or asynchronous, while preserving the CVE-2024-50047 fix. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/5d047b12f86cc3b9fde1171c02d9bccf4dba0632 - https://git.kernel.org/stable/c/6550b2bef095d0dd2d2c8390d2ea4c3837028833 - https://git.kernel.org/stable/c/9a1d3e8d40f151c2d5a5f40c410e6e433f62f438 - https://git.kernel.org/stable/c/15a0a5de49507062bc3be4014a403d8cea5533de - https://git.kernel.org/stable/c/2a76bc2b24ed889a689fb1c9015307bf16aafb5b - https://git.kernel.org/stable/c/8ac90f6824fc44d2e55a82503ddfc95defb19ae0 - https://git.kernel.org/stable/c/b220bed63330c0e17
s://git.kernel.org/stable/c/8ac90f6824fc44d2e55a82503ddfc95defb19ae0 - https://git.kernel.org/stable/c/b220bed63330c0e1733dc06ea8e75d5b9962b6b6
CVE ID: CVE-2025-38489 State: PUBLISHED Published: 2025-07-28T11:21:53.024Z Last Updated: 2025-07-28T11:21:53.024Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again Commit 7ded842b356d ("s390/bpf: Fix bpf_plt pointer arithmetic") has accidentally removed the critical piece of commit c730fce7c70c ("s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL"), causing intermittent kernel panics in e.g. perf's on_switch() prog to reappear. Restore the fix and add a comment. References: - https://git.kernel.org/stable/c/0c7b20f7785cfdd59403333612c90b458b12307c - https://git.
and add a comment. References: - https://git.kernel.org/stable/c/0c7b20f7785cfdd59403333612c90b458b12307c - https://git.kernel.org/stable/c/d5629d1af0600f8cc7c9245e8d832a66358ef889 - https://git.kernel.org/stable/c/a4f9c7846b1ac428921ce9676b1b8c80ed60093c - https://git.kernel.org/stable/c/6a5abf8cf182f577c7ae6c62f14debc9754ec986
CVE ID: CVE-2025-38490 State: PUBLISHED Published: 2025-07-28T11:21:54.009Z Last Updated: 2025-07-28T11:21:54.009Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: libwx: remove duplicate page_pool_put_full_page() page_pool_put_full_page() should only be invoked when freeing Rx buffers or building a skb if the size is too short. At other times, the pages need to be reused. So remove the redundant page put. In the original code, double free pages cause kernel panic: [ 876.949834] __irq_exit_rcu+0xc7/0x130 [ 876.949836] common_interrupt+0xb8/0xd0 [ 876.949838] </IRQ> [ 876.949838] <TASK> [ 876.949840] asm_common_interrupt+0x22
876.949836] common_interrupt+0xb8/0xd0 [ 876.949838] </IRQ> [ 876.949838] <TASK> [ 876.949840] asm_common_interrupt+0x22/0x40 [ 876.949841] RIP: 0010:cpuidle_enter_state+0xc2/0x420 [ 876.949843] Code: 00 00 e8 d1 1d 5e ff e8 ac f0 ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 cd fc 5c ff 45 84 ff 0f 85 40 02 00 00 fb 0f 1f 44 00 00 <45> 85 f6 0f 88 84 01 00 00 49 63 d6 48 8d 04 52 48 8d 04 82 49 8d [ 876.949844] RSP: 0018:ffffaa7340267e78 EFLAGS: 00000246 [ 876.949845] RAX: ffff9e3f135be000 RBX: 0000000000000002 RCX: 0000000000000000 [ 876.949846] RDX: 000000cc2dc4cb7c RSI: ffffffff89ee49ae RDI: ffffffff89ef9f9e [ 876.949847] RBP: ffff9e378f940800 R08: 0000000000000002 R09: 00000000000000ed [ 876.9
ff89ee49ae RDI: ffffffff89ef9f9e [ 876.949847] RBP: ffff9e378f940800 R08: 0000000000000002 R09: 00000000000000ed [ 876.949848] R10: 000000000000afc8 R11: ffff9e3e9e5a9b6c R12: ffffffff8a6d8580 [ 876.949849] R13: 000000cc2dc4cb7c R14: 0000000000000002 R15: 0000000000000000 [ 876.949852] ? cpuidle_enter_state+0xb3/0x420 [ 876.949855] cpuidle_enter+0x29/0x40 [ 876.949857] cpuidle_idle_call+0xfd/0x170 [ 876.949859] do_idle+0x7a/0xc0 [ 876.949861] cpu_startup_entry+0x25/0x30 [ 876.949862] start_secondary+0x117/0x140 [ 876.949864] common_startup_64+0x13e/0x148 [ 876.949867] </TASK> [ 876.949868] ---[ end trace 0000000000000000 ]--- [ 876.949869] ------------[ cut here ]------------ [ 876.949870] l
K> [ 876.949868] ---[ end trace 0000000000000000 ]--- [ 876.949869] ------------[ cut here ]------------ [ 876.949870] list_del corruption, ffffead40445a348->next is NULL [ 876.949873] WARNING: CPU: 14 PID: 0 at lib/list_debug.c:52 __list_del_entry_valid_or_report+0x67/0x120 [ 876.949875] Modules linked in: snd_hrtimer(E) bnep(E) binfmt_misc(E) amdgpu(E) squashfs(E) vfat(E) loop(E) fat(E) amd_atl(E) snd_hda_codec_realtek(E) intel_rapl_msr(E) snd_hda_codec_generic(E) intel_rapl_common(E) snd_hda_scodec_component(E) snd_hda_codec_hdmi(E) snd_hda_intel(E) edac_mce_amd(E) snd_intel_dspcfg(E) snd_hda_codec(E) snd_hda_core(E) amdxcp(E) kvm_amd(E) snd_hwdep(E) gpu_sched(E) drm_panel_backlight_quirk
ntel_dspcfg(E) snd_hda_codec(E) snd_hda_core(E) amdxcp(E) kvm_amd(E) snd_hwdep(E) gpu_sched(E) drm_panel_backlight_quirks(E) cec(E) snd_pcm(E) drm_buddy(E) snd_seq_dummy(E) drm_ttm_helper(E) btusb(E) kvm(E) snd_seq_oss(E) btrtl(E) ttm(E) btintel(E) snd_seq_midi(E) btbcm(E) drm_exec(E) snd_seq_midi_event(E) i2c_algo_bit(E) snd_rawmidi(E) bluetooth(E) drm_suballoc_helper(E) irqbypass(E) snd_seq(E) ghash_clmulni_intel(E) sha512_ssse3(E) drm_display_helper(E) aesni_intel(E) snd_seq_device(E) rfkill(E) snd_timer(E) gf128mul(E) drm_client_lib(E) drm_kms_helper(E) snd(E) i2c_piix4(E) joydev(E) soundcore(E) wmi_bmof(E) ccp(E) k10temp(E) i2c_smbus(E) gpio_amdpt(E) i2c_designware_platform(E) gpio_gene
(E) joydev(E) soundcore(E) wmi_bmof(E) ccp(E) k10temp(E) i2c_smbus(E) gpio_amdpt(E) i2c_designware_platform(E) gpio_generic(E) sg(E) [ 876.949914] i2c_designware_core(E) sch_fq_codel(E) parport_pc(E) drm(E) ppdev(E) lp(E) parport(E) fuse(E) nfnetlink(E) ip_tables(E) ext4 crc16 mbcache jbd2 sd_mod sfp mdio_i2c i2c_core txgbe ahci ngbe pcs_xpcs libahci libwx r8169 phylink libata realtek ptp pps_core video wmi [ 876.949933] CPU: 14 UID: 0 PID: 0 Comm: swapper/14 Kdump: loaded Tainted: G W E 6.16.0-rc2+ #20 PREEMPT(voluntary) [ 876.949935] Tainted: [W]=WARN, [E]=UNSIGNED_MODULE [ 876.949936] Hardware name: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING PLUS WIFI (MS-7E16), BIOS 1.90 12/
[ 876.949936] Hardware name: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING PLUS WIFI (MS-7E16), BIOS 1.90 12/31/2024 [ 876.949936] RIP: 0010:__list_del_entry_valid_or_report+0x67/0x120 [ 876.949938] Code: 00 00 00 48 39 7d 08 0f 85 a6 00 00 00 5b b8 01 00 00 00 5d 41 5c e9 73 0d 93 ff 48 89 fe 48 c7 c7 a0 31 e8 89 e8 59 7c b3 ff <0f> 0b 31 c0 5b 5d 41 5c e9 57 0d 93 ff 48 89 fe 48 c7 c7 c8 31 e8 [ 876.949940] RSP: 0018:ffffaa73405d0c60 EFLAGS: 00010282 [ 876.949941] RAX: 0000000000000000 RBX: ffffead40445a348 RCX: 0000000000000000 [ 876.949942] RDX: 0000000000000105 RSI: 00000 ---truncated--- References: - https://git.kernel.org/stable/c/3c91a56762b1f0d1e4af2d86c2cba83b61ed9eaa -
105 RSI: 00000 ---truncated--- References: - https://git.kernel.org/stable/c/3c91a56762b1f0d1e4af2d86c2cba83b61ed9eaa - https://git.kernel.org/stable/c/08d18bda0d03f5ec376929a8c6c4495f9594593a - https://git.kernel.org/stable/c/003e4765d8661be97e650a833868c53d35574130 - https://git.kernel.org/stable/c/1b7e585c04cd5f0731dd25ffd396277e55fae0e6
CVE ID: CVE-2025-38491 State: PUBLISHED Published: 2025-07-28T11:21:59.852Z Last Updated: 2025-11-03T17:38:59.794Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mptcp: make fallback action and fallback decision atomic Syzkaller reported the following splat: WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 __mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_do_fallback net/mptcp/protocol.h:1244 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 check_fully_established net/mptcp/options.c:982 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protoco
/protocol.h:1223 check_fully_established net/mptcp/options.c:982 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153 Modules linked in: CPU: 1 UID: 0 PID: 7704 Comm: syz.3.1419 Not tainted 6.16.0-rc3-gbd5ce2324dba #20 PREEMPT(voluntary) Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] RIP: 0010:mptcp_do_fallback net/mptcp/protocol.h:1244 [inline] RIP: 0010:check_fully_established net/mptcp/options.c:982 [inline] RIP: 0010:mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153 Code: 24 18 e8 bb 2a 00