Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-21954 State: PUBLISHED Published: 2025-04-01T15:46:55.226Z Last Updated: 2025-05-04T07:25:40.966Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netmem: prevent TX of unreadable skbs Currently on stable trees we have support for netmem/devmem RX but not TX. It is not safe to forward/redirect an RX unreadable netmem packet into the device's TX path, as the device may call dma-mapping APIs on dma addrs that should not be passed to it. Fix this by preventing the xmit of unreadable skbs. Tested by configuring tc redirect: sudo tc qdisc add dev eth1 ingress sudo tc filter add dev eth1 ingress protocol ip prio 1 flow
configuring tc redirect: sudo tc qdisc add dev eth1 ingress sudo tc filter add dev eth1 ingress protocol ip prio 1 flower ip_proto \ tcp src_ip 192.168.1.12 action mirred egress redirect dev eth1 Before, I see unreadable skbs in the driver's TX path passed to dma mapping APIs. After, I don't see unreadable skbs in the driver's TX path passed to dma mapping APIs. References: - https://git.kernel.org/stable/c/454825019d2f0c59e5174ece9e713f45ad80beff - https://git.kernel.org/stable/c/1c17c8ced25c5fbe424c7ad7ea11d33014a986b1 - https://git.kernel.org/stable/c/f3600c867c99a2cc8038680ecf211089c50e7971
CVE ID: CVE-2025-21955 State: PUBLISHED Published: 2025-04-01T15:46:55.724Z Last Updated: 2025-05-04T07:25:42.311Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent connection release during oplock break notification ksmbd_work could be freed when after connection release. Increment r_count of ksmbd_conn to indicate that requests are not finished yet and to not release the connection. References: - https://git.kernel.org/stable/c/09aeab68033161cb54f194da93e51a11aee6144b - https://git.kernel.org/stable/c/a4261bbc33fbf99b99c80aa3a2c5097611802980 - https://git.kernel.org/stable/c/f17d1c63a76b0fe8e9c78023a86507a3a6d62cf
ble/c/a4261bbc33fbf99b99c80aa3a2c5097611802980 - https://git.kernel.org/stable/c/f17d1c63a76b0fe8e9c78023a86507a3a6d62cfa - https://git.kernel.org/stable/c/3aa660c059240e0c795217182cf7df32909dd917
CVE ID: CVE-2025-21956 State: PUBLISHED Published: 2025-04-01T15:46:56.219Z Last Updated: 2025-11-03T19:39:55.636Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Assign normalized_pix_clk when color depth = 14 [WHY & HOW] A warning message "WARNING: CPU: 4 PID: 459 at ... /dc_resource.c:3397 calculate_phy_pix_clks+0xef/0x100 [amdgpu]" occurs because the display_color_depth == COLOR_DEPTH_141414 is not handled. This is observed in Radeon RX 6600 XT. It is fixed by assigning pix_clk * (14 * 3) / 24 - same as the rests. Also fixes the indentation in get_norm_pix_clk. (cherry picked from commit 274a87eb389f58eddcbc
24 - same as the rests. Also fixes the indentation in get_norm_pix_clk. (cherry picked from commit 274a87eb389f58eddcbc5659ab0b180b37e92775) Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/cca3ab74f90176099b6392e8e894b52b27b3d080 - https://git.kernel.org/stable/c/0174a2e5770efee9dbd4b58963ed4d939298ff5e - https://git.kernel.org/stable/c/0c0016712e5dc23ce4a7e673cbebc24a535d8c8a - https://git.kernel.org/stable/c/dc831b38680c47d07e425871a9852109183895cf - https://git.kernel.org/stable/c/a8f77e1658d78e4a8bb227a83bcee67de97f7634 - https://git.kernel.org/stable/c/04f90b505ad3a6eed474bbaa03167095fef5203a - https://git.kernel.org/stable/c/27df3010669
- https://git.kernel.org/stable/c/04f90b505ad3a6eed474bbaa03167095fef5203a - https://git.kernel.org/stable/c/27df30106690969f7d63604f0d49ed8e9bffa2cb - https://git.kernel.org/stable/c/79e31396fdd7037c503e6add15af7cb00633ea92
CVE ID: CVE-2025-21957 State: PUBLISHED Published: 2025-04-01T15:46:56.733Z Last Updated: 2025-11-03T19:39:58.405Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: qla1280: Fix kernel oops when debug level > 2 A null dereference or oops exception will eventually occur when qla1280.c driver is compiled with DEBUG_QLA1280 enabled and ql_debug_level > 2. I think its clear from the code that the intention here is sg_dma_len(s) not length of sg_next(s) when printing the debug info. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/afa27b7c17a48e01546ccaad0ab
ISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/afa27b7c17a48e01546ccaad0ab017ad0496a522 - https://git.kernel.org/stable/c/11a8dac1177a596648a020a7f3708257a2f95fee - https://git.kernel.org/stable/c/c737e2a5fb7f90b96a96121da1b50a9c74ae9b8c - https://git.kernel.org/stable/c/24602e2664c515a4f2950d7b52c3d5997463418c - https://git.kernel.org/stable/c/ea371d1cdefb0951c7127a33bcd7eb931cf44571 - https://git.kernel.org/stable/c/af71ba921d08c241a817010f96458dc5e5e26762 - https://git.kernel.org/stable/c/7ac2473e727d67a38266b2b7e55c752402ab588c - https://git.kernel.org/stable/c/5233e3235dec3065ccc632729675575dbe3c6b8a
CVE ID: CVE-2025-21958 State: PUBLISHED Published: 2025-04-01T15:46:57.268Z Last Updated: 2025-05-04T07:25:46.303Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Revert "openvswitch: switch to per-action label counting in conntrack" Currently, ovs_ct_set_labels() is only called for confirmed conntrack entries (ct) within ovs_ct_commit(). However, if the conntrack entry does not have the labels_ext extension, attempting to allocate it in ovs_ct_get_conn_labels() for a confirmed entry triggers a warning in nf_ct_ext_add(): WARN_ON(nf_ct_is_confirmed(ct)); This happens when the conntrack entry is created externally before OVS incr
_ext_add(): WARN_ON(nf_ct_is_confirmed(ct)); This happens when the conntrack entry is created externally before OVS increments net->ct.labels_used. The issue has become more likely since commit fcb1aa5163b1 ("openvswitch: switch to per-action label counting in conntrack"), which changed to use per-action label counting and increment net->ct.labels_used when a flow with ct action is added. Since there’s no straightforward way to fully resolve this issue at the moment, this reverts the commit to avoid breaking existing use cases. References: - https://git.kernel.org/stable/c/9e79fdabd52cfce1a021640a81256878a2c516a2 - https://git.kernel.org/stable/c/d91bfc64a4886102746e74d2c6f3a61e9a77fd7d - ht
9e79fdabd52cfce1a021640a81256878a2c516a2 - https://git.kernel.org/stable/c/d91bfc64a4886102746e74d2c6f3a61e9a77fd7d - https://git.kernel.org/stable/c/1063ae07383c0ddc5bcce170260c143825846b03
CVE ID: CVE-2025-21959 State: PUBLISHED Published: 2025-04-01T15:46:57.775Z Last Updated: 2025-11-03T19:40:01.234Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() Since commit b36e4523d4d5 ("netfilter: nf_conncount: fix garbage collection confirm race"), `cpu` and `jiffies32` were introduced to the struct nf_conncount_tuple. The commit made nf_conncount_add() initialize `conn->cpu` and `conn->jiffies32` when allocating the struct. In contrast, count_tree() was not changed to initialize them. By commit 34848d5c896e ("netfilter: nf_conncount: Spli
ct. In contrast, count_tree() was not changed to initialize them. By commit 34848d5c896e ("netfilter: nf_conncount: Split insert and traversal"), count_tree() was split and the relevant allocation code now resides in insert_tree(). Initialize `conn->cpu` and `conn->jiffies32` in insert_tree(). BUG: KMSAN: uninit-value in find_or_evict net/netfilter/nf_conncount.c:117 [inline] BUG: KMSAN: uninit-value in __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143 find_or_evict net/netfilter/nf_conncount.c:117 [inline] __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143 count_tree net/netfilter/nf_conncount.c:438 [inline] nf_conncount_count+0x82f/0x1e80 net/netfilter/nf_connc
ncount.c:143 count_tree net/netfilter/nf_conncount.c:438 [inline] nf_conncount_count+0x82f/0x1e80 net/netfilter/nf_conncount.c:521 connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72 __nft_match_eval net/netfilter/nft_compat.c:403 [inline] nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663 NF_HOOK_LIST include/linux/netfilter.h:350
/netfilter/core.c:626 nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663 NF_HOOK_LIST include/linux/netfilter.h:350 [inline] ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633 ip_list_rcv+0x9ef/0xa40 net/ipv4/ip_input.c:669 __netif_receive_skb_list_ptype net/core/dev.c:5936 [inline] __netif_receive_skb_list_core+0x15c5/0x1670 net/core/dev.c:5983 __netif_receive_skb_list net/core/dev.c:6035 [inline] netif_receive_skb_list_internal+0x1085/0x1700 net/core/dev.c:6126 netif_receive_skb_list+0x5a/0x460 net/core/dev.c:6178 xdp_recv_frames net/bpf/test_run.c:280 [inline] xdp_test_run_batch net/bpf/test_run.c:361 [inline] bpf_test_run_xdp_live+0x2e86/0x3480 net/bpf/test_run.c:390 bpf_prog_test_
test_run_batch net/bpf/test_run.c:361 [inline] bpf_test_run_xdp_live+0x2e86/0x3480 net/bpf/test_run.c:390 bpf_prog_test_run_xdp+0xf1d/0x1ae0 net/bpf/test_run.c:1316 bpf_prog_test_run+0x5e5/0xa30 kernel/bpf/syscall.c:4407 __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5813 __do_sys_bpf kernel/bpf/syscall.c:5902 [inline] __se_sys_bpf kernel/bpf/syscall.c:5900 [inline] __ia32_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5900 ia32_sys_call+0x394d/0x4180 arch/x86/include/generated/asm/syscalls_32.h:358 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/common.c:387 do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:412 do_SYSENTER_32+0x1f/0x30 arch/x
110 arch/x86/entry/common.c:387 do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:412 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:450 entry_SYSENTER_compat_after_hwframe+0x84/0x8e Uninit was created at: slab_post_alloc_hook mm/slub.c:4121 [inline] slab_alloc_node mm/slub.c:4164 [inline] kmem_cache_alloc_noprof+0x915/0xe10 mm/slub.c:4171 insert_tree net/netfilter/nf_conncount.c:372 [inline] count_tree net/netfilter/nf_conncount.c:450 [inline] nf_conncount_count+0x1415/0x1e80 net/netfilter/nf_conncount.c:521 connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72 __nft_match_eval net/netfilter/nft_compat.c:403 [inline] nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433 expr_cal
ft_match_eval net/netfilter/nft_compat.c:403 [inline] nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663 NF_HOOK_LIST include/linux/netfilter.h:350 [inline] ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633 ip_list_rcv+0x9ef/0xa40 net/ip ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refere
cv+0x9ef/0xa40 net/ip ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f522229c5563b59b4240261e406779bba6754159 - https://git.kernel.org/stable/c/2a154ce766b995494e88d8d117fa82cc6b73dd87 - https://git.kernel.org/stable/c/e8544a5a97bee3674e7cd6bf0f3a4af517fa9146 - https://git.kernel.org/stable/c/a62a25c6ad58fae997f48a0749afeda1c252ae51 - https://git.kernel.org/stable/c/fda50302a13701d47fbe01e1739c7a51114144fb - https://git.kernel.org/stable/c/db1e0c0856821c59a32ea3af79476bf20a6beeb2 - https://git.kernel.org/stable/c/2db5baaf047a7c8d6ed5e2cc657b7854e155b7fc - https://git.kernel.org/stable/c/d653bfeb07ebb34
tps://git.kernel.org/stable/c/2db5baaf047a7c8d6ed5e2cc657b7854e155b7fc - https://git.kernel.org/stable/c/d653bfeb07ebb3499c403404c21ac58a16531607
CVE ID: CVE-2025-21960 State: PUBLISHED Published: 2025-04-01T15:46:58.291Z Last Updated: 2025-11-03T19:40:02.778Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: do not update checksum in bnxt_xdp_build_skb() The bnxt_rx_pkt() updates ip_summed value at the end if checksum offload is enabled. When the XDP-MB program is attached and it returns XDP_PASS, the bnxt_xdp_build_skb() is called to update skb_shared_info. The main purpose of bnxt_xdp_build_skb() is to update skb_shared_info, but it updates ip_summed value too if checksum offload is enabled. This is actually duplicate work. When the bnxt_rx_pkt() updates ip_su
p_summed value too if checksum offload is enabled. This is actually duplicate work. When the bnxt_rx_pkt() updates ip_summed value, it checks if ip_summed is CHECKSUM_NONE or not. It means that ip_summed should be CHECKSUM_NONE at this moment. But ip_summed may already be updated to CHECKSUM_UNNECESSARY in the XDP-MB-PASS path. So the by skb_checksum_none_assert() WARNS about it. This is duplicate work and updating ip_summed in the bnxt_xdp_build_skb() is not needed. Splat looks like: WARNING: CPU: 3 PID: 5782 at ./include/linux/skbuff.h:5155 bnxt_rx_pkt+0x479b/0x7610 [bnxt_en] Modules linked in: bnxt_re bnxt_en rdma_ucm rdma_cm iw_cm ib_cm ib_uverbs veth xt_nat xt_tcpudp xt_conntrack nft_ch
_en] Modules linked in: bnxt_re bnxt_en rdma_ucm rdma_cm iw_cm ib_cm ib_uverbs veth xt_nat xt_tcpudp xt_conntrack nft_chain_nat xt_MASQUERADE nf_] CPU: 3 UID: 0 PID: 5782 Comm: socat Tainted: G W 6.14.0-rc4+ #27 Tainted: [W]=WARN Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021 RIP: 0010:bnxt_rx_pkt+0x479b/0x7610 [bnxt_en] Code: 54 24 0c 4c 89 f1 4c 89 ff c1 ea 1f ff d3 0f 1f 00 49 89 c6 48 85 c0 0f 84 4c e5 ff ff 48 89 c7 e8 ca 3d a0 c8 e9 8f f4 ff ff <0f> 0b f RSP: 0018:ffff88881ba09928 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 00000000c7590303 RCX: 0000000000000000 RDX: 1ffff1104e7d1610 RSI: 0000000000000001 RDI: ffff8881c91300b8 RBP: ffff88881ba09b28 R08: f
303 RCX: 0000000000000000 RDX: 1ffff1104e7d1610 RSI: 0000000000000001 RDI: ffff8881c91300b8 RBP: ffff88881ba09b28 R08: ffff888273e8b0d0 R09: ffff888273e8b070 R10: ffff888273e8b010 R11: ffff888278b0f000 R12: ffff888273e8b080 R13: ffff8881c9130e00 R14: ffff8881505d3800 R15: ffff888273e8b000 FS: 00007f5a2e7be080(0000) GS:ffff88881ba00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff2e708ff8 CR3: 000000013e3b0000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <IRQ> ? __warn+0xcd/0x2f0 ? bnxt_rx_pkt+0x479b/0x7610 ? report_bug+0x326/0x3c0 ? handle_bug+0x53/0xa0 ? exc_invalid_op+0x14/0x50 ? asm_exc_invalid_op+0x16/0x20 ? bnxt_rx_pkt+0x479b/0x7610 ? bn
/0x3c0 ? handle_bug+0x53/0xa0 ? exc_invalid_op+0x14/0x50 ? asm_exc_invalid_op+0x16/0x20 ? bnxt_rx_pkt+0x479b/0x7610 ? bnxt_rx_pkt+0x3e41/0x7610 ? __pfx_bnxt_rx_pkt+0x10/0x10 ? napi_complete_done+0x2cf/0x7d0 __bnxt_poll_work+0x4e8/0x1220 ? __pfx___bnxt_poll_work+0x10/0x10 ? __pfx_mark_lock.part.0+0x10/0x10 bnxt_poll_p5+0x36a/0xfa0 ? __pfx_bnxt_poll_p5+0x10/0x10 __napi_poll.constprop.0+0xa0/0x440 net_rx_action+0x899/0xd00 ... Following ping.py patch adds xdp-mb-pass case. so ping.py is going to be able to reproduce this issue. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/e8e3e03d69f2420eaa578199a65d281c58867105 - https://git.kernel.org/stable
: References: - https://git.kernel.org/stable/c/e8e3e03d69f2420eaa578199a65d281c58867105 - https://git.kernel.org/stable/c/ee086c8e775f9690282e3d26471dbcfd5dad5a6a - https://git.kernel.org/stable/c/5b57ed14a1b85e7ab0074d9668a0baa6c94826c7 - https://git.kernel.org/stable/c/44578bc6460b8fca530fc7bd5897c115d9bd27e2 - https://git.kernel.org/stable/c/c03e7d05aa0e2f7e9a9ce5ad8a12471a53f941dc
CVE ID: CVE-2025-21961 State: PUBLISHED Published: 2025-04-01T15:46:58.795Z Last Updated: 2025-10-01T17:15:48.731Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix truesize for mb-xdp-pass case When mb-xdp is set and return is XDP_PASS, packet is converted from xdp_buff to sk_buff with xdp_update_skb_shared_info() in bnxt_xdp_build_skb(). bnxt_xdp_build_skb() passes incorrect truesize argument to xdp_update_skb_shared_info(). The truesize is calculated as BNXT_RX_PAGE_SIZE * sinfo->nr_frags but the skb_shared_info was wiped by napi_build_skb() before. So it stores sinfo->nr_frags before bnxt_xdp_build_skb() and use
e skb_shared_info was wiped by napi_build_skb() before. So it stores sinfo->nr_frags before bnxt_xdp_build_skb() and use it instead of getting skb_shared_info from xdp_get_shared_info_from_buff(). Splat looks like: ------------[ cut here ]------------ WARNING: CPU: 2 PID: 0 at net/core/skbuff.c:6072 skb_try_coalesce+0x504/0x590 Modules linked in: xt_nat xt_tcpudp veth af_packet xt_conntrack nft_chain_nat xt_MASQUERADE nf_conntrack_netlink xfrm_user xt_addrtype nft_coms CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.14.0-rc2+ #3 RIP: 0010:skb_try_coalesce+0x504/0x590 Code: 4b fd ff ff 49 8b 34 24 40 80 e6 40 0f 84 3d fd ff ff 49 8b 74 24 48 40 f6 c6 01 0f 84 2e fd ff ff 48 8d 4e ff e9 25
e: 4b fd ff ff 49 8b 34 24 40 80 e6 40 0f 84 3d fd ff ff 49 8b 74 24 48 40 f6 c6 01 0f 84 2e fd ff ff 48 8d 4e ff e9 25 fd ff ff <0f> 0b e99 RSP: 0018:ffffb62c4120caa8 EFLAGS: 00010287 RAX: 0000000000000003 RBX: ffffb62c4120cb14 RCX: 0000000000000ec0 RDX: 0000000000001000 RSI: ffffa06e5d7dc000 RDI: 0000000000000003 RBP: ffffa06e5d7ddec0 R08: ffffa06e6120a800 R09: ffffa06e7a119900 R10: 0000000000002310 R11: ffffa06e5d7dcec0 R12: ffffe4360575f740 R13: ffffe43600000000 R14: 0000000000000002 R15: 0000000000000002 FS: 0000000000000000(0000) GS:ffffa0755f700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f147b76b0f8 CR3: 00000001615d4000 CR4: 00000000007
0000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f147b76b0f8 CR3: 00000001615d4000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <IRQ> ? __warn+0x84/0x130 ? skb_try_coalesce+0x504/0x590 ? report_bug+0x18a/0x1a0 ? handle_bug+0x53/0x90 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? skb_try_coalesce+0x504/0x590 inet_frag_reasm_finish+0x11f/0x2e0 ip_defrag+0x37a/0x900 ip_local_deliver+0x51/0x120 ip_sublist_rcv_finish+0x64/0x70 ip_sublist_rcv+0x179/0x210 ip_list_rcv+0xf9/0x130 How to reproduce: <Node A> ip link set $interface1 xdp obj xdp_pass.o ip link set $interface1 mtu 9000 up ip a a 10.0.0.1/24 dev $interface1 <Node B> ip link set $interfac2 mtu 9000 up i
s.o ip link set $interface1 mtu 9000 up ip a a 10.0.0.1/24 dev $interface1 <Node B> ip link set $interfac2 mtu 9000 up ip a a 10.0.0.2/24 dev $interface2 ping 10.0.0.1 -s 65000 Following ping.py patch adds xdp-mb-pass case. so ping.py is going to be able to reproduce this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/19107e71be330dbccb9f8f9f4cf0a9abeadad802 - https://git.kernel.org/stable/c/b4679807c6083ade4d47f03f80da891afcb6ef62 - https://git.kernel.org/stable/c/9f7b2aa5034e24d3c49db73d5f760c0435fe31c2
CVE ID: CVE-2025-21962 State: PUBLISHED Published: 2025-04-01T15:46:59.285Z Last Updated: 2025-11-03T19:40:04.218Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix integer overflow while processing closetimeo mount option User-provided mount parameter closetimeo of type u32 is intended to have an upper limit, but before it is validated, the value is converted from seconds to jiffies which can lead to an integer overflow. Found by Linux Verification Center (linuxtesting.org) with SVACE. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/513f6cf2e906a5
st Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/513f6cf2e906a504b7ab0b62b2eea993a6f64558 - https://git.kernel.org/stable/c/9968fcf02cf6b0f78fbacf3f63e782162603855a - https://git.kernel.org/stable/c/6c13fcb7cf59ae65940da1dfea80144e42921e53 - https://git.kernel.org/stable/c/1c46673be93dd2954f44fe370fb4f2b8e6214224 - https://git.kernel.org/stable/c/b24edd5c191c2689c59d0509f0903f9487eb6317 - https://git.kernel.org/stable/c/d5a30fddfe2f2e540f6c43b59cf701809995faef
CVE ID: CVE-2025-21963 State: PUBLISHED Published: 2025-04-01T15:46:59.773Z Last Updated: 2025-11-03T19:40:05.668Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix integer overflow while processing acdirmax mount option User-provided mount parameter acdirmax of type u32 is intended to have an upper limit, but before it is validated, the value is converted from seconds to jiffies which can lead to an integer overflow. Found by Linux Verification Center (linuxtesting.org) with SVACE. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/0c26edf477e093cefc
otes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/0c26edf477e093cefc41637f5bccc102e1a77399 - https://git.kernel.org/stable/c/39d086bb3558da9640ef335f97453e01d32578a1 - https://git.kernel.org/stable/c/9e438d0410a4002d24f420f2c28897ba2dc0af64 - https://git.kernel.org/stable/c/2809a79bc64964ce02e0c5f2d6bd39b9d09bdb3c - https://git.kernel.org/stable/c/6124cbf73e3dea7591857dd63b8ccece28952afd - https://git.kernel.org/stable/c/5b29891f91dfb8758baf1e2217bef4b16b2b165b
CVE ID: CVE-2025-21964 State: PUBLISHED Published: 2025-04-01T15:47:00.594Z Last Updated: 2025-11-03T19:40:07.069Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix integer overflow while processing acregmax mount option User-provided mount parameter acregmax of type u32 is intended to have an upper limit, but before it is validated, the value is converted from seconds to jiffies which can lead to an integer overflow. Found by Linux Verification Center (linuxtesting.org) with SVACE. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/a13351624a6af8d913
otes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/a13351624a6af8d91398860b8c9d4cf6c8e63de5 - https://git.kernel.org/stable/c/dd190168e60ac15408f074a1fe0ce36aff34027b - https://git.kernel.org/stable/c/0252c33cc943e9e48ddfafaa6b1eb72adb68a099 - https://git.kernel.org/stable/c/833f2903eb8b70faca7967319e580e9ce69729fc - https://git.kernel.org/stable/c/5f500874ab9b3cc8c169c2ab49f00b838520b9c5 - https://git.kernel.org/stable/c/7489161b1852390b4413d57f2457cd40b34da6cc
CVE ID: CVE-2025-21965 State: PUBLISHED Published: 2025-04-01T15:47:01.129Z Last Updated: 2025-05-04T07:25:55.365Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl() If a BPF scheduler provides an invalid CPU (outside the nr_cpu_ids range) as prev_cpu to scx_bpf_select_cpu_dfl() it can cause a kernel crash. To prevent this, validate prev_cpu in scx_bpf_select_cpu_dfl() and trigger an scx error if an invalid CPU is specified. References: - https://git.kernel.org/stable/c/752b56bb76e2471197d25d6948d85753043b10da - https://git.kernel.org/stable/c/515680e76c536dd4aa8e2b5d674b0d44
org/stable/c/752b56bb76e2471197d25d6948d85753043b10da - https://git.kernel.org/stable/c/515680e76c536dd4aa8e2b5d674b0d441baddf5b - https://git.kernel.org/stable/c/9360dfe4cbd62ff1eb8217b815964931523b75b3