Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-38133 State: PUBLISHED Published: 2025-07-03T08:35:36.802Z Last Updated: 2025-07-28T04:13:08.930Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad4851: fix ad4858 chan pointer handling The pointer returned from ad4851_parse_channels_common() is incremented internally as each channel is populated. In ad4858_parse_channels(), the same pointer was further incremented while setting ext_scan_type fields for each channel. This resulted in indio_dev->channels being set to a pointer past the end of the allocated array, potentially causing memory corruption or undefined behavior. Fix this by iterating over th
e end of the allocated array, potentially causing memory corruption or undefined behavior. Fix this by iterating over the channels using an explicit index instead of incrementing the pointer. This preserves the original base pointer and ensures all channel metadata is set correctly. References: - https://git.kernel.org/stable/c/6c3b9e1167d072ce2d01cafec7866647cf8d3616 - https://git.kernel.org/stable/c/499a8cee812588905cc940837e69918c1649a19e
CVE ID: CVE-2025-38134 State: PUBLISHED Published: 2025-07-03T08:35:37.674Z Last Updated: 2025-07-28T04:13:10.210Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() As demonstrated by the fix for update_port_device_state, commit 12783c0b9e2c ("usb: core: Prevent null pointer dereference in update_port_device_state"), usb_hub_to_struct_hub() can return NULL in certain scenarios, such as during hub driver unbind or teardown race conditions, even if the underlying usb_device structure exists. Plus, all other places that call usb_hub_to_struct_hub() in the same
even if the underlying usb_device structure exists. Plus, all other places that call usb_hub_to_struct_hub() in the same file do check for NULL return values. If usb_hub_to_struct_hub() returns NULL, the subsequent access to hub->ports[udev->portnum - 1] will cause a null pointer dereference. References: - https://git.kernel.org/stable/c/8fa544bff8466062e42949c93f3e528f4be5624b - https://git.kernel.org/stable/c/e3d530173b70514d4390a94f9f979acad689b70a - https://git.kernel.org/stable/c/73fb0ec9436ae87bcae067ce35d6cdd72bade86c
CVE ID: CVE-2025-38135 State: PUBLISHED Published: 2025-07-03T08:35:38.295Z Last Updated: 2025-11-03T17:34:27.045Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: serial: Fix potential null-ptr-deref in mlb_usio_probe() devm_ioremap() can return NULL on error. Currently, mlb_usio_probe() does not check for this case, which could result in a NULL pointer dereference. Add NULL check after devm_ioremap() to prevent this issue. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/a05ebe384c7ca75476453f3070c67d9cf1d1a89f - https://git.kernel.org/stable/c/81159a6b064142b993f2f39828b77e199c77
stable/c/a05ebe384c7ca75476453f3070c67d9cf1d1a89f - https://git.kernel.org/stable/c/81159a6b064142b993f2f39828b77e199c77872a - https://git.kernel.org/stable/c/19fd9f5a69363d33079097d866eb6082d61bf31d - https://git.kernel.org/stable/c/548b0e81b9a0902a8bc8259430ed965663baadfc - https://git.kernel.org/stable/c/a6c7c365734cd0fa1c5aa225a6294fdf80cad2ea - https://git.kernel.org/stable/c/c23d87b43f7dba5eb12820f6cf21a1cd4f63eb3d - https://git.kernel.org/stable/c/e1b144aebe6fb898d96ced8c990d7aa38fda4a7a - https://git.kernel.org/stable/c/86bcae88c9209e334b2f8c252f4cc66beb261886
CVE ID: CVE-2025-38136 State: PUBLISHED Published: 2025-07-03T08:35:39.207Z Last Updated: 2025-11-03T17:34:28.949Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: renesas_usbhs: Reorder clock handling and power management in probe Reorder the initialization sequence in `usbhs_probe()` to enable runtime PM before accessing registers, preventing potential crashes due to uninitialized clocks. Currently, in the probe path, registers are accessed before enabling the clocks, leading to a synchronous external abort on the RZ/V2H SoC. The problematic call flow is as follows: usbhs_probe() usbhs_sys_clock_ctrl() usbhs_bset() usbhs_w
rt on the RZ/V2H SoC. The problematic call flow is as follows: usbhs_probe() usbhs_sys_clock_ctrl() usbhs_bset() usbhs_write() iowrite16() <-- Register access before enabling clocks Since `iowrite16()` is performed without ensuring the required clocks are enabled, this can lead to access errors. To fix this, enable PM runtime early in the probe function and ensure clocks are acquired before register access, preventing crashes like the following on RZ/V2H: [13.272640] Internal error: synchronous external abort: 0000000096000010 [#1] PREEMPT SMP [13.280814] Modules linked in: cec renesas_usbhs(+) drm_kms_helper fuse drm backlight ipv6 [13.289088] CPU: 1 UID: 0 PID: 195 Comm: (udev-worker) Not
cec renesas_usbhs(+) drm_kms_helper fuse drm backlight ipv6 [13.289088] CPU: 1 UID: 0 PID: 195 Comm: (udev-worker) Not tainted 6.14.0-rc7+ #98 [13.296640] Hardware name: Renesas RZ/V2H EVK Board based on r9a09g057h44 (DT) [13.303834] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [13.310770] pc : usbhs_bset+0x14/0x4c [renesas_usbhs] [13.315831] lr : usbhs_probe+0x2e4/0x5ac [renesas_usbhs] [13.321138] sp : ffff8000827e3850 [13.324438] x29: ffff8000827e3860 x28: 0000000000000000 x27: ffff8000827e3ca0 [13.331554] x26: ffff8000827e3ba0 x25: ffff800081729668 x24: 0000000000000025 [13.338670] x23: ffff0000c0f08000 x22: 0000000000000000 x21: ffff0000c0f08010 [13.345783] x20: 00000
4: 0000000000000025 [13.338670] x23: ffff0000c0f08000 x22: 0000000000000000 x21: ffff0000c0f08010 [13.345783] x20: 0000000000000000 x19: ffff0000c3b52080 x18: 00000000ffffffff [13.352895] x17: 0000000000000000 x16: 0000000000000000 x15: ffff8000827e36ce [13.360009] x14: 00000000000003d7 x13: 00000000000003d7 x12: 0000000000000000 [13.367122] x11: 0000000000000000 x10: 0000000000000aa0 x9 : ffff8000827e3750 [13.374235] x8 : ffff0000c1850b00 x7 : 0000000003826060 x6 : 000000000000001c [13.381347] x5 : 000000030d5fcc00 x4 : ffff8000825c0000 x3 : 0000000000000000 [13.388459] x2 : 0000000000000400 x1 : 0000000000000000 x0 : ffff0000c3b52080 [13.395574] Call trace: [13.398013] usbhs_bset+0x14/0x4c
: 0000000000000400 x1 : 0000000000000000 x0 : ffff0000c3b52080 [13.395574] Call trace: [13.398013] usbhs_bset+0x14/0x4c [renesas_usbhs] (P) [13.403076] platform_probe+0x68/0xdc [13.406738] really_probe+0xbc/0x2c0 [13.410306] __driver_probe_device+0x78/0x120 [13.414653] driver_probe_device+0x3c/0x154 [13.418825] __driver_attach+0x90/0x1a0 [13.422647] bus_for_each_dev+0x7c/0xe0 [13.426470] driver_attach+0x24/0x30 [13.430032] bus_add_driver+0xe4/0x208 [13.433766] driver_register+0x68/0x130 [13.437587] __platform_driver_register+0x24/0x30 [13.442273] renesas_usbhs_driver_init+0x20/0x1000 [renesas_usbhs] [13.448450] do_one_initcall+0x60/0x1d4 [13.452276] do_init_module+0x54/0x1f8 [13.456014] loa
0x20/0x1000 [renesas_usbhs] [13.448450] do_one_initcall+0x60/0x1d4 [13.452276] do_init_module+0x54/0x1f8 [13.456014] load_module+0x1754/0x1c98 [13.459750] init_module_from_file+0x88/0xcc [13.464004] __arm64_sys_finit_module+0x1c4/0x328 [13.468689] invoke_syscall+0x48/0x104 [13.472426] el0_svc_common.constprop.0+0xc0/0xe0 [13.477113] do_el0_svc+0x1c/0x28 [13.480415] el0_svc+0x30/0xcc [13.483460] el0t_64_sync_handler+0x10c/0x138 [13.487800] el0t_64_sync+0x198/0x19c [13.491453] Code: 2a0103e1 12003c42 12003c63 8b010084 (79400084) [13.497522] ---[ end trace 0000000000000000 ]--- Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/095cc0b5888acc228f123
- Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/095cc0b5888acc228f12344e85b17539b9ce9367 - https://git.kernel.org/stable/c/155453ada562c450a4ff5fcf4852b9fa5b6b793a - https://git.kernel.org/stable/c/0a1e16a6cbf4452b46f20b862d6141a1e90844ee - https://git.kernel.org/stable/c/1637623ad6205162b17804d07512e6f4cbd2a050 - https://git.kernel.org/stable/c/db96a4fd8614d47c0def265e0e6c996b0ee52a38 - https://git.kernel.org/stable/c/d4c368e4a638ddf4a9d6d687b0ff691aa46cce53 - https://git.kernel.org/stable/c/6bab152e817fd41b9e178fa6b275354795c9703d - https://git.kernel.org/stable/c/ffb34a60ce86656ba12d46e91f1ccc71dd221251
CVE ID: CVE-2025-38137 State: PUBLISHED Published: 2025-07-03T08:35:39.849Z Last Updated: 2025-07-28T04:13:14.854Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: Cancel outstanding rescan work when unregistering It's possible to trigger use-after-free here by: (a) forcing rescan_work_func() to take a long time and (b) utilizing a pwrctrl driver that may be unloaded for some reason Cancel outstanding work to ensure it is finished before we allow our data structures to be cleaned up. [bhelgaas: tidy commit log] References: - https://git.kernel.org/stable/c/b3ad6d23fec23fbef382ce9ea640c37446593cf5 - https://git.kernel
commit log] References: - https://git.kernel.org/stable/c/b3ad6d23fec23fbef382ce9ea640c37446593cf5 - https://git.kernel.org/stable/c/8b926f237743f020518162c62b93cb7107a2b5eb
CVE ID: CVE-2025-38138 State: PUBLISHED Published: 2025-07-03T08:35:40.499Z Last Updated: 2025-11-03T17:34:30.919Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: Add NULL check in udma_probe() devm_kasprintf() returns NULL when memory allocation fails. Currently, udma_probe() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this issue. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/ec1ea394c40523835bbedd8fc4934b77b461b6fe - https://git.kernel.org/stable/c/9f133e04c62246353b8b1f0a679535c6516
/stable/c/ec1ea394c40523835bbedd8fc4934b77b461b6fe - https://git.kernel.org/stable/c/9f133e04c62246353b8b1f0a679535c65161ebcf - https://git.kernel.org/stable/c/d61d5ba5bd5b0e39e30b34dcd92946e084bca0d0 - https://git.kernel.org/stable/c/b79e10050d9d1e200541d25751dd5cb8ec58483c - https://git.kernel.org/stable/c/bc6ddff79835f71310a21645d8fcf08ec473e969 - https://git.kernel.org/stable/c/643db430f4cbd91dd2b63c49d62d0abb6debc13b - https://git.kernel.org/stable/c/fd447415e74bccd7362f760d4ea727f8e1ebfe91
CVE ID: CVE-2025-38139 State: PUBLISHED Published: 2025-07-03T08:35:41.271Z Last Updated: 2025-07-28T04:13:17.620Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix oops in write-retry from mis-resetting the subreq iterator Fix the resetting of the subrequest iterator in netfs_retry_write_stream() to use the iterator-reset function as the iterator may have been shortened by a previous retry. In such a case, the amount of data to be written by the subrequest is not "subreq->len" but "subreq->len - subreq->transferred". Without this, KASAN may see an error in iov_iter_revert(): BUG: KASAN: slab-out-of-bounds in iov_iter_r
q->transferred". Without this, KASAN may see an error in iov_iter_revert(): BUG: KASAN: slab-out-of-bounds in iov_iter_revert lib/iov_iter.c:633 [inline] BUG: KASAN: slab-out-of-bounds in iov_iter_revert+0x443/0x5a0 lib/iov_iter.c:611 Read of size 4 at addr ffff88802912a0b8 by task kworker/u32:7/1147 CPU: 1 UID: 0 PID: 1147 Comm: kworker/u32:7 Not tainted 6.15.0-rc6-syzkaller-00052-g9f35e33144ae #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: events_unbound netfs_write_collection_worker Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_descri
e: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 iov_iter_revert lib/iov_iter.c:633 [inline] iov_iter_revert+0x443/0x5a0 lib/iov_iter.c:611 netfs_retry_write_stream fs/netfs/write_retry.c:44 [inline] netfs_retry_writes+0x166d/0x1a50 fs/netfs/write_retry.c:231 netfs_collect_write_results fs/netfs/write_collect.c:352 [inline] netfs_write_collection_worker+0x23fd/0x3830 fs/netfs/write_collect.c:374 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319
rite_collect.c:374 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c2/0x780 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> References: - https://git.kernel.org/stable/c/e0fefe9bc07e6101fdc57abda3644f296c114e31 - https://git.kernel.org/stable/c/bd0edaf99a920b1a9decd773179caacacb61d0fd - https://git.kernel.org/stable/c/4481f7f2b3df123ec77e828c849138f75cff2bf2
CVE ID: CVE-2025-38140 State: PUBLISHED Published: 2025-07-03T08:35:41.929Z Last Updated: 2025-07-28T04:13:19.143Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dm: limit swapping tables for devices with zone write plugs dm_revalidate_zones() only allowed new or previously unzoned devices to call blk_revalidate_disk_zones(). If the device was already zoned, disk->nr_zones would always equal md->nr_zones, so dm_revalidate_zones() returned without doing any work. This would make the zoned settings for the device not match the new table. If the device had zone write plug resources, it could run into errors like bdev_zone_is_seq()
e not match the new table. If the device had zone write plug resources, it could run into errors like bdev_zone_is_seq() reading invalid memory because disk->conv_zones_bitmap was the wrong size. If the device doesn't have any zone write plug resources, calling blk_revalidate_disk_zones() will always correctly update device. If blk_revalidate_disk_zones() fails, it can still overwrite or clear the current disk->nr_zones value. In this case, DM must restore the previous value of disk->nr_zones, so that the zoned settings will continue to match the previous value that it fell back to. If the device already has zone write plug resources, blk_revalidate_disk_zones() will not correctly update the
back to. If the device already has zone write plug resources, blk_revalidate_disk_zones() will not correctly update them, if it is called for arbitrary zoned device changes. Since there is not much need for this ability, the easiest solution is to disallow any table reloads that change the zoned settings, for devices that already have zone plug resources. Specifically, if a device already has zone plug resources allocated, it can only switch to another zoned table that also emulates zone append. Also, it cannot change the device size or the zone size. A device can switch to an error target. References: - https://git.kernel.org/stable/c/ac8acb0bfd98a1c65f3ca9a3e217a766124eebd8 - https://git.
o an error target. References: - https://git.kernel.org/stable/c/ac8acb0bfd98a1c65f3ca9a3e217a766124eebd8 - https://git.kernel.org/stable/c/121218bef4c1df165181f5cd8fc3a2246bac817e
CVE ID: CVE-2025-38141 State: PUBLISHED Published: 2025-07-03T08:35:42.787Z Last Updated: 2025-07-28T04:13:20.687Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dm: fix dm_blk_report_zones If dm_get_live_table() returned NULL, dm_put_live_table() was never called. Also, it is possible that md->zone_revalidate_map will change while calling this function. Only read it once, so that we are always using the same value. Otherwise we might miss a call to dm_put_live_table(). Finally, while md->zone_revalidate_map is set and a process is calling blk_revalidate_disk_zones() to set up the zone append emulation resources, it is possible
s set and a process is calling blk_revalidate_disk_zones() to set up the zone append emulation resources, it is possible that another process, perhaps triggered by blkdev_report_zones_ioctl(), will call dm_blk_report_zones(). If blk_revalidate_disk_zones() fails, these resources can be freed while the other process is still using them, causing a use-after-free error. blk_revalidate_disk_zones() will only ever be called when initially setting up the zone append emulation resources, such as when setting up a zoned dm-crypt table for the first time. Further table swaps will not set md->zone_revalidate_map or call blk_revalidate_disk_zones(). However it must be called using the new table (refere
t set md->zone_revalidate_map or call blk_revalidate_disk_zones(). However it must be called using the new table (referenced by md->zone_revalidate_map) and the new queue limits while the DM device is suspended. dm_blk_report_zones() needs some way to distinguish between a call from blk_revalidate_disk_zones(), which must be allowed to use md->zone_revalidate_map to access this not yet activated table, and all other calls to dm_blk_report_zones(), which should not be allowed while the device is suspended and cannot use md->zone_revalidate_map, since the zone resources might be freed by the process currently calling blk_revalidate_disk_zones(). Solve this by tracking the process that sets md-
be freed by the process currently calling blk_revalidate_disk_zones(). Solve this by tracking the process that sets md->zone_revalidate_map in dm_revalidate_zones() and only allowing that process to make use of it in dm_blk_report_zones(). References: - https://git.kernel.org/stable/c/f9c1bdf24615303d48a2d0fd629c88f3189563aa - https://git.kernel.org/stable/c/d19bc1b4dd5f322980b1f05f79b2ea4f0db10920 - https://git.kernel.org/stable/c/37f53a2c60d03743e0eacf7a0c01c279776fef4e
CVE ID: CVE-2025-38142 State: PUBLISHED Published: 2025-07-03T08:35:43.521Z Last Updated: 2025-11-03T17:34:31.871Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus-ec-sensors) check sensor index in read_string() Prevent a potential invalid memory access when the requested sensor is not found. find_ec_sensor_index() may return a negative value (e.g. -ENOENT), but its result was used without checking, which could lead to undefined behavior when passed to get_sensor_info(). Add a proper check to return -EINVAL if sensor_index is negative. Found by Linux Verification Center (linuxtesting.org) with SVACE. [groeck: Return
-EINVAL if sensor_index is negative. Found by Linux Verification Center (linuxtesting.org) with SVACE. [groeck: Return error code returned from find_ec_sensor_index] Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/6bf529ce84dccc0074dbc704e70aee4aa545057e - https://git.kernel.org/stable/c/4e9e45746b861ebd54c03ef301da2cb8fc990536 - https://git.kernel.org/stable/c/19bd9cde38dd4ca1771aed7afba623e7f4247c8e - https://git.kernel.org/stable/c/7eeb3df6f07a886bdfd52757ede127a59a8784dc - https://git.kernel.org/stable/c/25be318324563c63cbd9cb53186203a08d2f83a1
CVE ID: CVE-2025-38143 State: PUBLISHED Published: 2025-07-03T08:35:44.224Z Last Updated: 2025-11-03T17:34:33.856Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: backlight: pm8941: Add NULL check in wled_configure() devm_kasprintf() returns NULL when memory allocation fails. Currently, wled_configure() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this issue. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/6a56446595730a5e3f06a30902e23cb037d28146 - https://git.kernel.org/stable/c/9d06ac32c202142da409041
t.kernel.org/stable/c/6a56446595730a5e3f06a30902e23cb037d28146 - https://git.kernel.org/stable/c/9d06ac32c202142da40904180f2669ed4f5073ac - https://git.kernel.org/stable/c/21528806560510458378ea52c37e35b0773afaea - https://git.kernel.org/stable/c/fde314445332015273c8f51d2659885c606fe135 - https://git.kernel.org/stable/c/1be2000b703b02e149f8f2061054489f6c18c972 - https://git.kernel.org/stable/c/4a715be3fe80b68fa55cb3569af3d294be101626 - https://git.kernel.org/stable/c/e12d3e1624a02706cdd3628bbf5668827214fa33
CVE ID: CVE-2025-38144 State: PUBLISHED Published: 2025-07-03T08:35:45.584Z Last Updated: 2025-07-28T04:13:25.382Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: watchdog: lenovo_se30_wdt: Fix possible devm_ioremap() NULL pointer dereference in lenovo_se30_wdt_probe() devm_ioremap() returns NULL on error. Currently, lenovo_se30_wdt_probe() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_ioremap() to prevent this issue. References: - https://git.kernel.org/stable/c/57f7a1da0ec06d8579accaf77762d0128d13e4af - https://git.kernel.org/stable/c/a4e2401438a26131ecff9be6a3a1d4cbfea66f
able/c/57f7a1da0ec06d8579accaf77762d0128d13e4af - https://git.kernel.org/stable/c/a4e2401438a26131ecff9be6a3a1d4cbfea66f9a
CVE ID: CVE-2025-38145 State: PUBLISHED Published: 2025-07-03T08:35:51.566Z Last Updated: 2025-11-03T17:34:35.777Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() devm_kasprintf() returns NULL when memory allocation fails. Currently, aspeed_lpc_enable_snoop() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this issue. [arj: Fix Fixes: tag to use subject from 3772e5da4454] Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/2beee9cf833374550e673d428ad8b6a
al Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/2beee9cf833374550e673d428ad8b6ab37c175b3 - https://git.kernel.org/stable/c/c550999f939b529d28a914d5034cc4290066aea6 - https://git.kernel.org/stable/c/1fd889c145722579aa038c31cbc07cfdd4d75166 - https://git.kernel.org/stable/c/d62a589eaaec6385e3e2b25cf5a28b4560ace93f - https://git.kernel.org/stable/c/8312b1f776f71979bf33bda7acc05b348e8792c7 - https://git.kernel.org/stable/c/f697ef117ecbf3a367dfc559a6a3589905956530 - https://git.kernel.org/stable/c/45b2e8b0fdd280aba04c3cc869e9ae500c44e4b7 - https://git.kernel.org/stable/c/f1706e0e1a74b095cbc60375b9b1e6205f5f4c98
CVE ID: CVE-2025-38146 State: PUBLISHED Published: 2025-07-03T08:35:52.230Z Last Updated: 2025-11-03T17:34:37.672Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix the dead loop of MPLS parse The unexpected MPLS packet may not end with the bottom label stack. When there are many stacks, The label count value has wrapped around. A dead loop occurs, soft lockup/CPU stuck finally. stack backtrace: UBSAN: array-index-out-of-bounds in /build/linux-0Pa0xK/linux-5.15.0/net/openvswitch/flow.c:662:26 index -1 is out of range for type '__be32 [3]' CPU: 34 PID: 0 Comm: swapper/34 Kdump: loaded Tainted: G OE 5.15.0-121-
6 index -1 is out of range for type '__be32 [3]' CPU: 34 PID: 0 Comm: swapper/34 Kdump: loaded Tainted: G OE 5.15.0-121-generic #131-Ubuntu Hardware name: Dell Inc. PowerEdge C6420/0JP9TF, BIOS 2.12.2 07/14/2021 Call Trace: <IRQ> show_stack+0x52/0x5c dump_stack_lvl+0x4a/0x63 dump_stack+0x10/0x16 ubsan_epilogue+0x9/0x36 __ubsan_handle_out_of_bounds.cold+0x44/0x49 key_extract_l3l4+0x82a/0x840 [openvswitch] ? kfree_skbmem+0x52/0xa0 key_extract+0x9c/0x2b0 [openvswitch] ovs_flow_key_extract+0x124/0x350 [openvswitch] ovs_vport_receive+0x61/0xd0 [openvswitch] ? kernel_init_free_pages.part.0+0x4a/0x70 ? get_page_from_freelist+0x353/0x540 netdev_port_receive+0xc4/0x180 [openvswitch] ? netdev_port_rec