Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-37789 State: PUBLISHED Published: 2025-05-01T13:07:22.809Z Last Updated: 2025-11-03T19:55:14.808Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix nested key length validation in the set() action It's not safe to access nla_len(ovs_key) if the data is smaller than the netlink header. Check that the attribute is OK first. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/54c6957d1123a2032099b9eab51c314800f677ce - https://git.kernel.org/stable/c/7fcaec0b2ab8fa5fbf0b45e5512364a168f445bd - https://git.kernel.org/stable/c/a27526e6b48eee9e2d82efff502c
nel.org/stable/c/7fcaec0b2ab8fa5fbf0b45e5512364a168f445bd - https://git.kernel.org/stable/c/a27526e6b48eee9e2d82efff502c4f272f1a91d4 - https://git.kernel.org/stable/c/1489c195c8eecd262aa6712761ba5288203e28ec - https://git.kernel.org/stable/c/824a7c2df5127b2402b68a21a265d413e78dcad7 - https://git.kernel.org/stable/c/be80768d4f3b6fd13f421451cc3fee8778aba8bc - https://git.kernel.org/stable/c/03d7262dd53e8c404da35cc81aaa887fd901f76b - https://git.kernel.org/stable/c/65d91192aa66f05710cfddf6a14b5a25ee554dba
CVE ID: CVE-2025-37790 State: PUBLISHED Published: 2025-05-01T13:07:23.416Z Last Updated: 2025-11-03T19:55:16.190Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: mctp: Set SOCK_RCU_FREE Bind lookup runs under RCU, so ensure that a socket doesn't go away in the middle of a lookup. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/5c1313b93c8c2e3904a48aa88e2fa1db28c607ae - https://git.kernel.org/stable/c/b9764ebebb007249fb733a131b6110ff333b6616 - https://git.kernel.org/stable/c/a8a3b61ce140e2b0a72a779e8d70f60c0cf1e47a - https://git.kernel.org/stable/c/3f899bd6dd56ddc46509b526e23
rnel.org/stable/c/a8a3b61ce140e2b0a72a779e8d70f60c0cf1e47a - https://git.kernel.org/stable/c/3f899bd6dd56ddc46509b526e23a8f0a97712a6d - https://git.kernel.org/stable/c/e3b5edbdb45924a7d4206d13868a2aac71f1e53d - https://git.kernel.org/stable/c/52024cd6ec71a6ca934d0cc12452bd8d49850679
CVE ID: CVE-2025-37791 State: PUBLISHED Published: 2025-05-01T13:07:24.062Z Last Updated: 2025-05-26T05:20:58.400Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() rpl is passed as a pointer to ethtool_cmis_module_poll(), so the correct size of rpl is sizeof(*rpl) which should be just 1 byte. Using the pointer size instead can cause stack corruption: Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ethtool_cmis_wait_for_cond+0xf4/0x100 CPU: 72 UID: 0 PID: 4440 Comm: kworker/72:2 Kdump: loaded Tainted: G OE 6.11.0 #24 Tainted: [O]=OOT_M
or_cond+0xf4/0x100 CPU: 72 UID: 0 PID: 4440 Comm: kworker/72:2 Kdump: loaded Tainted: G OE 6.11.0 #24 Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. PowerEdge R760/04GWWM, BIOS 1.6.6 09/20/2023 Workqueue: events module_flash_fw_work Call Trace: <TASK> panic+0x339/0x360 ? ethtool_cmis_wait_for_cond+0xf4/0x100 ? __pfx_status_success+0x10/0x10 ? __pfx_status_fail+0x10/0x10 __stack_chk_fail+0x10/0x10 ethtool_cmis_wait_for_cond+0xf4/0x100 ethtool_cmis_cdb_execute_cmd+0x1fc/0x330 ? __pfx_status_fail+0x10/0x10 cmis_cdb_module_features_get+0x6d/0xd0 ethtool_cmis_cdb_init+0x8a/0xd0 ethtool_cmis_fw_update+0x46/0x1d0 module_flash_fw_work+0x17/0xa0 process_one_work+0x179/0x390 wor
mis_cdb_init+0x8a/0xd0 ethtool_cmis_fw_update+0x46/0x1d0 module_flash_fw_work+0x17/0xa0 process_one_work+0x179/0x390 worker_thread+0x239/0x340 ? __pfx_worker_thread+0x10/0x10 kthread+0xcc/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2d/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> References: - https://git.kernel.org/stable/c/61765e1b417a23371c3735e3cddf4ad9354ed2e9 - https://git.kernel.org/stable/c/7eb0a0072f966bb0b01d8b7d529d9743a7187bd1 - https://git.kernel.org/stable/c/f3fdd4fba16c74697d8bc730b82fb7c1eff7fab3
CVE ID: CVE-2025-37792 State: PUBLISHED Published: 2025-05-01T13:07:24.882Z Last Updated: 2025-11-03T19:55:19.562Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: Prevent potential NULL dereference The btrtl_initialize() function checks that rtl_load_file() either had an error or it loaded a zero length file. However, if it loaded a zero length file then the error code is not set correctly. It results in an error pointer vs NULL bug, followed by a NULL pointer dereference. This was detected by Smatch: drivers/bluetooth/btrtl.c:592 btrtl_initialize() warn: passing zero to 'ERR_PTR' Additional Analyst Notes: - CV
Smatch: drivers/bluetooth/btrtl.c:592 btrtl_initialize() warn: passing zero to 'ERR_PTR' Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/c3e9717276affe59fd8213706db021b493e81e34 - https://git.kernel.org/stable/c/73dc99c0ea94abd22379b2d82cacbc73f3e18ec1 - https://git.kernel.org/stable/c/2d7c60c2a38b4b461fa960ad0995136a6bfe0756 - https://git.kernel.org/stable/c/d8441818690d795232331bd8358545c5c95b6b72 - https://git.kernel.org/stable/c/3db6605043b50c8bb768547b23e0222f67ceef3e - https://git.kernel.org/stable/c/aaf356f872a60db1e96fb762a62c4607fd22741f - https://git.kernel.org/stable/c/53ceef799dcfc22c734d600811bfc9dd32eaea0a - https://git.kernel.o
6fb762a62c4607fd22741f - https://git.kernel.org/stable/c/53ceef799dcfc22c734d600811bfc9dd32eaea0a - https://git.kernel.org/stable/c/324dddea321078a6eeb535c2bff5257be74c9799
CVE ID: CVE-2025-37793 State: PUBLISHED Published: 2025-05-01T13:07:25.516Z Last Updated: 2025-05-26T05:21:00.925Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() devm_kasprintf() returns NULL when memory allocation fails. Currently, avs_component_probe() does not check for this case, which results in a NULL pointer dereference. References: - https://git.kernel.org/stable/c/aaa93b8846101461de815759d39979661b82d5a5 - https://git.kernel.org/stable/c/23fde311ea1d0a6c36bf92ce48b90b77d0ece1a4 - https://git.kernel.org/stable/c/c2825073271b6f15e669a424b363612082494863 - http
fde311ea1d0a6c36bf92ce48b90b77d0ece1a4 - https://git.kernel.org/stable/c/c2825073271b6f15e669a424b363612082494863 - https://git.kernel.org/stable/c/95f723cf141b95e3b3a5b92cf2ea98a863fe7275
CVE ID: CVE-2025-37794 State: PUBLISHED Published: 2025-05-01T13:07:26.168Z Last Updated: 2025-11-03T19:55:22.706Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Purge vif txq in ieee80211_do_stop() After ieee80211_do_stop() SKB from vif's txq could still be processed. Indeed another concurrent vif schedule_and_wake_txq call could cause those packets to be dequeued (see ieee80211_handle_wake_tx_queue()) without checking the sdata current state. Because vif.drv_priv is now cleared in this function, this could lead to driver crash. For example in ath12k, ahvif is store in vif.drv_priv. Thus if ath12k_mac_op_tx() i
on, this could lead to driver crash. For example in ath12k, ahvif is store in vif.drv_priv. Thus if ath12k_mac_op_tx() is called after ieee80211_do_stop(), ahvif->ah can be NULL, leading the ath12k_warn(ahvif->ah,...) call in this function to trigger the NULL deref below. Unable to handle kernel paging request at virtual address dfffffc000000001 KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] batman_adv: bat0: Interface deactivated: brbh1337 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR
PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [dfffffc000000001] address between user and kernel address ranges Internal error: Oops: 0000000096000004 [#1] SMP CPU: 1 UID: 0 PID: 978 Comm: lbd Not tainted 6.13.0-g633f875b8f1e #114 Hardware name: HW (DT) pstate: 10000005 (nzcV daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ath12k_mac_op_tx+0x6cc/0x29b8 [ath12k] lr : ath12k_mac_op_tx+0x174/0x29b8 [ath12k] sp : ffffffc086ace450 x29: ffffffc086ace450 x28: 0000000000000000 x27: 1ffffff810d59ca4 x26: ffffff801d05f7c0 x25: 0000000000000000 x24: 000000004000
ffffc086ace450 x28: 0000000000000000 x27: 1ffffff810d59ca4 x26: ffffff801d05f7c0 x25: 0000000000000000 x24: 000000004000001e x23: ffffff8009ce4926 x22: ffffff801f9c0800 x21: ffffff801d05f7f0 x20: ffffff8034a19f40 x19: 0000000000000000 x18: ffffff801f9c0958 x17: ffffff800bc0a504 x16: dfffffc000000000 x15: ffffffc086ace4f8 x14: ffffff801d05f83c x13: 0000000000000000 x12: ffffffb003a0bf03 x11: 0000000000000000 x10: ffffffb003a0bf02 x9 : ffffff8034a19f40 x8 : ffffff801d05f818 x7 : 1ffffff0069433dc x6 : ffffff8034a19ee0 x5 : ffffff801d05f7f0 x4 : 0000000000000000 x3 : 0000000000000001 x2 : 0000000000000000 x1 : dfffffc000000000 x0 : 0000000000000008 Call trace: ath12k_mac_op_tx+0x6cc/0x29b8 [ath1
000001 x2 : 0000000000000000 x1 : dfffffc000000000 x0 : 0000000000000008 Call trace: ath12k_mac_op_tx+0x6cc/0x29b8 [ath12k] (P) ieee80211_handle_wake_tx_queue+0x16c/0x260 ieee80211_queue_skb+0xeec/0x1d20 ieee80211_tx+0x200/0x2c8 ieee80211_xmit+0x22c/0x338 __ieee80211_subif_start_xmit+0x7e8/0xc60 ieee80211_subif_start_xmit+0xc4/0xee0 __ieee80211_subif_start_xmit_8023.isra.0+0x854/0x17a0 ieee80211_subif_start_xmit_8023+0x124/0x488 dev_hard_start_xmit+0x160/0x5a8 __dev_queue_xmit+0x6f8/0x3120 br_dev_queue_push_xmit+0x120/0x4a8 __br_forward+0xe4/0x2b0 deliver_clone+0x5c/0xd0 br_flood+0x398/0x580 br_dev_xmit+0x454/0x9f8 dev_hard_start_xmit+0x160/0x5a8 __dev_queue_xmit+0x6f8/0x3120 ip6_finish_outp
_flood+0x398/0x580 br_dev_xmit+0x454/0x9f8 dev_hard_start_xmit+0x160/0x5a8 __dev_queue_xmit+0x6f8/0x3120 ip6_finish_output2+0xc28/0x1b60 __ip6_finish_output+0x38c/0x638 ip6_output+0x1b4/0x338 ip6_local_out+0x7c/0xa8 ip6_send_skb+0x7c/0x1b0 ip6_push_pending_frames+0x94/0xd0 rawv6_sendmsg+0x1a98/0x2898 inet_sendmsg+0x94/0xe0 __sys_sendto+0x1e4/0x308 __arm64_sys_sendto+0xc4/0x140 do_el0_svc+0x110/0x280 el0_svc+0x20/0x60 el0t_64_sync_handler+0x104/0x138 el0t_64_sync+0x154/0x158 To avoid that, empty vif's txq at ieee80211_do_stop() so no packet could be dequeued after ieee80211_do_stop() (new packets cannot be queued because SDATA_STATE_RUNNING is cleared at this point). Additional Analyst Notes:
do_stop() (new packets cannot be queued because SDATA_STATE_RUNNING is cleared at this point). Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/929ec2c9ad34248ef625e137b6118b6e965797d9 - https://git.kernel.org/stable/c/a932a5ce4eee0cbad20220f950fe7bd3534bcbc9 - https://git.kernel.org/stable/c/305741e7e63234cbcf9b5c4e6aeca25ba0834be8 - https://git.kernel.org/stable/c/5f6863dc407f25fcf23fc857f9ac51756a09ea2c - https://git.kernel.org/stable/c/c74b84544dee27298a71715b3ce2c40d372b5a23 - https://git.kernel.org/stable/c/a8df245b5b29f6de98d016dc18e2bb35ec70b0cb - https://git.kernel.org/stable/c/8bc34db7f771a464ff8f686b6f8d4e04963fec27 - https://git.ker
6de98d016dc18e2bb35ec70b0cb - https://git.kernel.org/stable/c/8bc34db7f771a464ff8f686b6f8d4e04963fec27 - https://git.kernel.org/stable/c/378677eb8f44621ecc9ce659f7af61e5baa94d81
CVE ID: CVE-2025-37795 State: REJECTED Published: 2025-05-01T13:07:26.815Z Last Updated: 2025-05-10T14:03:17.311Z Description: No description available.
CVE ID: CVE-2025-37796 State: PUBLISHED Published: 2025-05-01T13:07:27.694Z Last Updated: 2025-11-03T19:55:25.591Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x: fix use after free access in at76_disconnect The memory pointed to by priv is freed at the end of at76_delete_device function (using ieee80211_free_hw). But the code then accesses the udev field of the freed object to put the USB device. This may also lead to a memory leak of the usb device. Fix this by using udev from interface. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/c731cdfddcf1be1590d5ba8c9b50
ional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/c731cdfddcf1be1590d5ba8c9b508f98e3a2b3d6 - https://git.kernel.org/stable/c/6e4ab3e574c2a335b40fa1f70d1c54fcb58ab33f - https://git.kernel.org/stable/c/3c619aec1f538333b56746d2f796aab1bca5c9a5 - https://git.kernel.org/stable/c/5e7df74745700f059dc117a620e566964a2e8f2c - https://git.kernel.org/stable/c/7ca513631fa6ad3011b8b9197cdde0f351103704 - https://git.kernel.org/stable/c/a9682bfef2cf3802515a902e964d774e137be1b9 - https://git.kernel.org/stable/c/152721cbae42713ecfbca6847e0f102ee6b19546 - https://git.kernel.org/stable/c/27c7e63b3cb1a20bb78ed4a36c561ea4579fd7da
CVE ID: CVE-2025-37797 State: PUBLISHED Published: 2025-05-02T14:16:01.905Z Last Updated: 2025-11-03T19:55:28.428Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class handling This patch fixes a Use-After-Free vulnerability in the HFSC qdisc class handling. The issue occurs due to a time-of-check/time-of-use condition in hfsc_change_class() when working with certain child qdiscs like netem or codel. The vulnerability works as follows: 1. hfsc_change_class() checks if a class has packets (q.qlen != 0) 2. It then calls qdisc_peek_len(), which for certain qdiscs (e.g., codel, netem) mig
f a class has packets (q.qlen != 0) 2. It then calls qdisc_peek_len(), which for certain qdiscs (e.g., codel, netem) might drop packets and empty the queue 3. The code continues assuming the queue is still non-empty, adding the class to vttree 4. This breaks HFSC scheduler assumptions that only non-empty classes are in vttree 5. Later, when the class is destroyed, this can lead to a Use-After-Free The fix adds a second queue length check after qdisc_peek_len() to verify the queue wasn't emptied. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/28b09a067831f7317c3841812276022d6c940677 - https://git.kernel.org/stable/c/39b9095dd3b55d9b2743df038c3
rnel.org/stable/c/28b09a067831f7317c3841812276022d6c940677 - https://git.kernel.org/stable/c/39b9095dd3b55d9b2743df038c32138efa34a9de - https://git.kernel.org/stable/c/fcc8ede663569c704fb00a702973bd6c00373283 - https://git.kernel.org/stable/c/20d584a33e480ae80d105f43e0e7b56784da41b9 - https://git.kernel.org/stable/c/3aa852e3605000d5c47035c3fc3a986d14ccfa9f - https://git.kernel.org/stable/c/86cd4641c713455a4f1c8e54c370c598c2b1cee0 - https://git.kernel.org/stable/c/bb583c88d23b72d8d16453d24856c99bd93dadf5 - https://git.kernel.org/stable/c/3df275ef0a6ae181e8428a6589ef5d5231e58b5c
CVE ID: CVE-2025-37798 State: PUBLISHED Published: 2025-05-02T14:16:02.623Z Last Updated: 2025-11-03T19:55:29.865Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() After making all ->qlen_notify() callbacks idempotent, now it is safe to remove the check of qlen!=0 from both fq_codel_dequeue() and codel_qdisc_dequeue(). Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/7a742a9506849d1c1aa71e36c89855ceddc7d58e - https://git.kernel.org/stable/c/cc71a757da78dd4aa1b4a9b19cb011833730ccf2 - https://git.kernel.org/stable/c/ed
ddc7d58e - https://git.kernel.org/stable/c/cc71a757da78dd4aa1b4a9b19cb011833730ccf2 - https://git.kernel.org/stable/c/eda741fe155ddf5ecd2dd3bfbd4fc3c0c7dbb450 - https://git.kernel.org/stable/c/829c49b6b2ff45b043739168fd1245e4e1a91a30 - https://git.kernel.org/stable/c/2f9761a94bae33d26e6a81b31b36e7d776d93dc1 - https://git.kernel.org/stable/c/4d55144b12e742404bb3f8fee6038bafbf45619d - https://git.kernel.org/stable/c/e73c838c80dccb9e4f19becc11d9f3cb4a27d483 - https://git.kernel.org/stable/c/a57fe60ef4cf96bfbb6b58397ec28bdb5a5c6b31 - https://git.kernel.org/stable/c/342debc12183b51773b3345ba267e9263bdfaaef
CVE ID: CVE-2025-37799 State: PUBLISHED Published: 2025-05-03T11:39:51.924Z Last Updated: 2025-05-26T05:21:07.764Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp vmxnet3 driver's XDP handling is buggy for packet sizes using ring0 (that is, packet sizes between 128 - 3k bytes). We noticed MTU-related connectivity issues with Cilium's service load- balancing in case of vmxnet3 as NIC underneath. A simple curl to a HTTP backend service where the XDP LB was doing IPIP encap led to overly large packet sizes but only for *some* of the packets (e.g. HTTP GET request) while ot
as doing IPIP encap led to overly large packet sizes but only for *some* of the packets (e.g. HTTP GET request) while others (e.g. the prior TCP 3WHS) looked completely fine on the wire. In fact, the pcap recording on the backend node actually revealed that the node with the XDP LB was leaking uninitialized kernel data onto the wire for the affected packets, for example, while the packets should have been 152 bytes their actual size was 1482 bytes, so the remainder after 152 bytes was padded with whatever other data was in that page at the time (e.g. we saw user/payload data from prior processed packets). We only noticed this through an MTU issue, e.g. when the XDP LB node and the backend no
a from prior processed packets). We only noticed this through an MTU issue, e.g. when the XDP LB node and the backend node both had the same MTU (e.g. 1500) then the curl request got dropped on the backend node's NIC given the packet was too large even though the IPIP-encapped packet normally would never even come close to the MTU limit. Lowering the MTU on the XDP LB (e.g. 1480) allowed to let the curl request succeed (which also indicates that the kernel ignored the padding, and thus the issue wasn't very user-visible). Commit e127ce7699c1 ("vmxnet3: Fix missing reserved tailroom") was too eager to also switch xdp_prepare_buff() from rcd->len to rbi->len. It really needs to stick to rcd->l
tailroom") was too eager to also switch xdp_prepare_buff() from rcd->len to rbi->len. It really needs to stick to rcd->len which is the actual packet length from the descriptor. The latter we also feed into vmxnet3_process_xdp_small(), by the way, and it indicates the correct length needed to initialize the xdp->{data,data_end} parts. For e127ce7699c1 ("vmxnet3: Fix missing reserved tailroom") the relevant part was adapting xdp_init_buff() to address the warning given the xdp_data_hard_end() depends on xdp->frame_sz. With that fixed, traffic on the wire looks good again. References: - https://git.kernel.org/stable/c/c4312c4d244aa58e811ff0297e013124d115e793 - https://git.kernel.org/stable/c/3
ferences: - https://git.kernel.org/stable/c/c4312c4d244aa58e811ff0297e013124d115e793 - https://git.kernel.org/stable/c/33e131a10459d16f181c8184d3f17f1c318c7002 - https://git.kernel.org/stable/c/e3ad76e36a37b0ff4a71b06d5b33530ee8c3a177 - https://git.kernel.org/stable/c/4c2227656d9003f4d77afc76f34dd81b95e4c2c4
CVE ID: CVE-2025-37800 State: PUBLISHED Published: 2025-05-08T06:26:01.125Z Last Updated: 2025-05-26T05:21:09.088Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: driver core: fix potential NULL pointer dereference in dev_uevent() If userspace reads "uevent" device attribute at the same time as another threads unbinds the device from its driver, change to dev->driver from a valid pointer to NULL may result in crash. Fix this by using READ_ONCE() when fetching the pointer, and take bus' drivers klist lock to make sure driver instance will not disappear while we access it. Use WRITE_ONCE() when setting the driver pointer to ensure
e sure driver instance will not disappear while we access it. Use WRITE_ONCE() when setting the driver pointer to ensure there is no tearing. References: - https://git.kernel.org/stable/c/abe56be73eb10a677d16066f65ff9d30251f5eee - https://git.kernel.org/stable/c/2b344e779d9afd0fcb5ee4000e4d0fc7d8d867eb - https://git.kernel.org/stable/c/3781e4b83e174364998855de777e184cf0b62c40 - https://git.kernel.org/stable/c/18daa52418e7e4629ed1703b64777294209d2622
CVE ID: CVE-2025-37801 State: PUBLISHED Published: 2025-05-08T06:26:01.980Z Last Updated: 2025-11-03T19:55:31.277Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: spi: spi-imx: Add check for spi_imx_setupxfer() Add check for the return value of spi_imx_setupxfer(). spi_imx->rx and spi_imx->tx function pointer can be NULL when spi_imx_setupxfer() return error, and make NULL pointer dereference. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Call trace: 0x0 spi_imx_pio_transfer+0x50/0xd8 spi_imx_transfer_one+0x18c/0x858 spi_transfer_one_message+0x43c/0x790 __spi_pump_transfer_message+0x238/0x5
er+0x50/0xd8 spi_imx_transfer_one+0x18c/0x858 spi_transfer_one_message+0x43c/0x790 __spi_pump_transfer_message+0x238/0x5d4 __spi_sync+0x2b0/0x454 spi_write_then_read+0x11c/0x200 Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/2fea0d6d7b5d27fbf55512d51851ba0a346ede52 - https://git.kernel.org/stable/c/2b4479eb462ecb39001b38dfb331fc6028dedac8 - https://git.kernel.org/stable/c/185d376875ea6fb4256b9dc97ee0b4d2b0fdd399 - https://git.kernel.org/stable/c/055ef73bb1afc3f783a9a13b496770a781964a07 - https://git.kernel.org/stable/c/951a04ab3a2db4029debfa48d380ef834b93207e
CVE ID: CVE-2025-37802 State: PUBLISHED Published: 2025-05-08T06:26:03.075Z Last Updated: 2025-05-26T05:21:11.662Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" wait_event_timeout() will set the state of the current task to TASK_UNINTERRUPTIBLE, before doing the condition check. This means that ksmbd_durable_scavenger_alive() will try to acquire the mutex while already in a sleeping state. The scheduler warns us by giving the following warning: do not call blocking ops when !TASK_RUNNING; state=2 set at [<0000000061515a6f>] prepare_to_wait_event+0x9f/0x6c0 WARNIN
do not call blocking ops when !TASK_RUNNING; state=2 set at [<0000000061515a6f>] prepare_to_wait_event+0x9f/0x6c0 WARNING: CPU: 2 PID: 4147 at kernel/sched/core.c:10099 __might_sleep+0x12f/0x160 mutex lock is not needed in ksmbd_durable_scavenger_alive(). References: - https://git.kernel.org/stable/c/8f805b3746d2f41702c77cba22f94f8415fadd1a - https://git.kernel.org/stable/c/cd161198e091e8a62b9bd631be970ea9a87d2d6a - https://git.kernel.org/stable/c/1df0d4c616138784e033ad337961b6e1a6bcd999
CVE ID: CVE-2025-37803 State: PUBLISHED Published: 2025-05-08T06:26:03.819Z Last Updated: 2025-11-03T19:55:34.043Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: udmabuf: fix a buf size overflow issue during udmabuf creation by casting size_limit_mb to u64 when calculate pglimit. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e84a08fc7e25cdad5d9a3def42cc770ff711193f - https://git.kernel.org/stable/c/13fe12c037b470321436deec393030c6153cfeb9 - https://git.kernel.org/stable/c/373512760e13fdaa726faa9502d0f5be2abb3d33 - https://git.kernel.org/stable/c/3f6c9d6
eb9 - https://git.kernel.org/stable/c/373512760e13fdaa726faa9502d0f5be2abb3d33 - https://git.kernel.org/stable/c/3f6c9d66e0f8eb9679b57913aa64b4d2266f6fbe - https://git.kernel.org/stable/c/b2ff4e9c599b000833d16a917f519aa2e4a75de2 - https://git.kernel.org/stable/c/29b65a3171a49c9b69f31035146be966cec40b7a - https://git.kernel.org/stable/c/2b8419c6ecf69007dcff54ea0b9f0b215282c55a - https://git.kernel.org/stable/c/021ba7f1babd029e714d13a6bf2571b08af96d0f