Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/62b1a9bbfebba4b4c2bb6c1ede9ef7ecee7a9ff6 - https://git.kernel.org/stable/c/da3f599517ef2ea851208df3229d07728d238dc5 - https://git.kernel.org/stable/c/6a5e3b23054cee3b92683d1467e3fa83921f5622 - https://git.kernel.org/stable/c/f4112cb477c727a65787a4065a75ca593bb5b2f4 - https://git.kernel.org/stable/c/35ef07112b61b06eb30683a6563c9f6378c02476 - https://git.kernel.org/stable/c/be7c5f00aa7f1344293e4d48d0e12be83a2f223d - https://git.kernel.org/stable/c/17aa34c84867f6cd181a5743e1c647e7766962a6 - https://git.kernel.org/stable/c/59b348be7597c4a9903cb003c69e37df20c04a30
CVE ID: CVE-2025-21911 State: PUBLISHED Published: 2025-04-01T15:40:49.698Z Last Updated: 2025-10-01T19:26:34.387Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/imagination: avoid deadlock on fence release Do scheduler queue fence release processing on a workqueue, rather than in the release function itself. Fixes deadlock issues such as the following: [ 607.400437] ============================================ [ 607.405755] WARNING: possible recursive locking detected [ 607.415500] -------------------------------------------- [ 607.420817] weston:zfq0/24149 is trying to acquire lock: [ 607.426131] ffff000017d041a0 (reserva
--------------------- [ 607.420817] weston:zfq0/24149 is trying to acquire lock: [ 607.426131] ffff000017d041a0 (reservation_ww_class_mutex){+.+.}-{3:3}, at: pvr_gem_object_vunmap+0x40/0xc0 [powervr] [ 607.436728] but task is already holding lock: [ 607.442554] ffff000017d105a0 (reservation_ww_class_mutex){+.+.}-{3:3}, at: dma_buf_ioctl+0x250/0x554 [ 607.451727] other info that might help us debug this: [ 607.458245] Possible unsafe locking scenario: [ 607.464155] CPU0 [ 607.466601] ---- [ 607.469044] lock(reservation_ww_class_mutex); [ 607.473584] lock(reservation_ww_class_mutex); [ 607.478114] *** DEADLOCK *** Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.ker
_mutex); [ 607.478114] *** DEADLOCK *** Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d993ae7360923efd6ade43a32043459a121c28c1 - https://git.kernel.org/stable/c/9bd8b8d34cf4efba18766d64f817c819ed1bbde7 - https://git.kernel.org/stable/c/df1a1ed5e1bdd9cc13148e0e5549f5ebcf76cf13
CVE ID: CVE-2025-21912 State: PUBLISHED Published: 2025-04-01T15:40:50.299Z Last Updated: 2025-11-03T19:38:58.412Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: gpio: rcar: Use raw_spinlock to protect register access Use raw_spinlock in order to fix spurious messages about invalid context when spinlock debugging is enabled. The lock is only used to serialize register access. [ 4.239592] ============================= [ 4.239595] [ BUG: Invalid wait context ] [ 4.239599] 6.13.0-rc7-arm64-renesas-05496-gd088502a519f #35 Not tainted [ 4.239603] ----------------------------- [ 4.239606] kworker/u8:5/76 is trying to lock: [ 4.239609
519f #35 Not tainted [ 4.239603] ----------------------------- [ 4.239606] kworker/u8:5/76 is trying to lock: [ 4.239609] ffff0000091898a0 (&p->lock){....}-{3:3}, at: gpio_rcar_config_interrupt_input_mode+0x34/0x164 [ 4.239641] other info that might help us debug this: [ 4.239643] context-{5:5} [ 4.239646] 5 locks held by kworker/u8:5/76: [ 4.239651] #0: ffff0000080fb148 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work+0x190/0x62c [ 4.250180] OF: /soc/sound@ec500000/ports/port@0/endpoint: Read of boolean property 'frame-master' with a value. [ 4.254094] #1: ffff80008299bd80 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work+0x1b8/0x62c [ 4.254109] #2: ffff00000920c8f
8299bd80 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work+0x1b8/0x62c [ 4.254109] #2: ffff00000920c8f8 [ 4.258345] OF: /soc/sound@ec500000/ports/port@1/endpoint: Read of boolean property 'bitclock-master' with a value. [ 4.264803] (&dev->mutex){....}-{4:4}, at: __device_attach_async_helper+0x3c/0xdc [ 4.264820] #3: ffff00000a50ca40 (request_class#2){+.+.}-{4:4}, at: __setup_irq+0xa0/0x690 [ 4.264840] #4: [ 4.268872] OF: /soc/sound@ec500000/ports/port@1/endpoint: Read of boolean property 'frame-master' with a value. [ 4.273275] ffff00000a50c8c8 (lock_class){....}-{2:2}, at: __setup_irq+0xc4/0x690 [ 4.296130] renesas_sdhi_internal_dmac ee100000.mmc: mmc1 base at 0x00000000ee
){....}-{2:2}, at: __setup_irq+0xc4/0x690 [ 4.296130] renesas_sdhi_internal_dmac ee100000.mmc: mmc1 base at 0x00000000ee100000, max clock rate 200 MHz [ 4.304082] stack backtrace: [ 4.304086] CPU: 1 UID: 0 PID: 76 Comm: kworker/u8:5 Not tainted 6.13.0-rc7-arm64-renesas-05496-gd088502a519f #35 [ 4.304092] Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT) [ 4.304097] Workqueue: async async_run_entry_fn [ 4.304106] Call trace: [ 4.304110] show_stack+0x14/0x20 (C) [ 4.304122] dump_stack_lvl+0x6c/0x90 [ 4.304131] dump_stack+0x14/0x1c [ 4.304138] __lock_acquire+0xdfc/0x1584 [ 4.426274] lock_acquire+0x1c4/0x33c [ 4.429942] _raw_spin_lock_irqsave+0x5c/0x80 [ 4.434307] gpio_r
cquire+0xdfc/0x1584 [ 4.426274] lock_acquire+0x1c4/0x33c [ 4.429942] _raw_spin_lock_irqsave+0x5c/0x80 [ 4.434307] gpio_rcar_config_interrupt_input_mode+0x34/0x164 [ 4.440061] gpio_rcar_irq_set_type+0xd4/0xd8 [ 4.444422] __irq_set_trigger+0x5c/0x178 [ 4.448435] __setup_irq+0x2e4/0x690 [ 4.452012] request_threaded_irq+0xc4/0x190 [ 4.456285] devm_request_threaded_irq+0x7c/0xf4 [ 4.459398] ata1: link resume succeeded after 1 retries [ 4.460902] mmc_gpiod_request_cd_irq+0x68/0xe0 [ 4.470660] mmc_start_host+0x50/0xac [ 4.474327] mmc_add_host+0x80/0xe4 [ 4.477817] tmio_mmc_host_probe+0x2b0/0x440 [ 4.482094] renesas_sdhi_probe+0x488/0x6f4 [ 4.486281] renesas_sdhi_internal_dmac_probe+0x60/0x78 [ 4.49
obe+0x2b0/0x440 [ 4.482094] renesas_sdhi_probe+0x488/0x6f4 [ 4.486281] renesas_sdhi_internal_dmac_probe+0x60/0x78 [ 4.491509] platform_probe+0x64/0xd8 [ 4.495178] really_probe+0xb8/0x2a8 [ 4.498756] __driver_probe_device+0x74/0x118 [ 4.503116] driver_probe_device+0x3c/0x154 [ 4.507303] __device_attach_driver+0xd4/0x160 [ 4.511750] bus_for_each_drv+0x84/0xe0 [ 4.515588] __device_attach_async_helper+0xb0/0xdc [ 4.520470] async_run_entry_fn+0x30/0xd8 [ 4.524481] process_one_work+0x210/0x62c [ 4.528494] worker_thread+0x1ac/0x340 [ 4.532245] kthread+0x10c/0x110 [ 4.535476] ret_from_fork+0x10/0x20 Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/3898
rom_fork+0x10/0x20 Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/389891ac9f678baf68e13623ef1308493af4b074 - https://git.kernel.org/stable/c/7c1f36f9c9aca507d317479a3d3388150ae40a87 - https://git.kernel.org/stable/c/3e300913c42041e81c5b17a970c4e078086ff2d1 - https://git.kernel.org/stable/c/c10365031f16514a29c812cd909085a6e4ea4b61 - https://git.kernel.org/stable/c/b42c84f9e4ec5bc2885e7fd80c79ec0352f5d2af - https://git.kernel.org/stable/c/51ef3073493e2a25dced05fdd59dfb059e7e284d - https://git.kernel.org/stable/c/f02c41f87cfe61440c18bf77d1ef0a884b9ee2b5
CVE ID: CVE-2025-21913 State: PUBLISHED Published: 2025-04-01T15:40:50.907Z Last Updated: 2025-11-03T19:38:59.818Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() Xen doesn't offer MSR_FAM10H_MMIO_CONF_BASE to all guests. This results in the following warning: unchecked MSR access error: RDMSR from 0xc0010058 at rIP: 0xffffffff8101d19f (xen_do_read_msr+0x7f/0xa0) Call Trace: xen_read_msr+0x1e/0x30 amd_get_mmconfig_range+0x2b/0x80 quirk_amd_mmconfig_area+0x28/0x100 pnp_fixup_device+0x39/0x50 __pnp_add_device+0xf/0x150 pnp_add_device+0x3d/0x100 pnpacpi_add_device_handler+0x1
x28/0x100 pnp_fixup_device+0x39/0x50 __pnp_add_device+0xf/0x150 pnp_add_device+0x3d/0x100 pnpacpi_add_device_handler+0x1f9/0x280 acpi_ns_get_device_callback+0x104/0x1c0 acpi_ns_walk_namespace+0x1d0/0x260 acpi_get_devices+0x8a/0xb0 pnpacpi_init+0x50/0x80 do_one_initcall+0x46/0x2e0 kernel_init_freeable+0x1da/0x2f0 kernel_init+0x16/0x1b0 ret_from_fork+0x30/0x50 ret_from_fork_asm+0x1b/0x30 based on quirks for a "PNP0c01" device. Treating MMCFG as disabled is the right course of action, so no change is needed there. This was most likely exposed by fixing the Xen MSR accessors to not be silently-safe. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/
not be silently-safe. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/0c65d13bdcc54e5b924ebe790f85a7f01bfe1cb1 - https://git.kernel.org/stable/c/8f43ba5ee498fe037d1570f6868d9aeaf49dda80 - https://git.kernel.org/stable/c/ebf6a763904e42dabeb2e270ceb0bbe0f825d7ae - https://git.kernel.org/stable/c/923fede9eae9865af305bcdf8f111e4b62ae4bda - https://git.kernel.org/stable/c/14cb5d83068ecf15d2da6f7d0e9ea9edbcbc0457
CVE ID: CVE-2025-21914 State: PUBLISHED Published: 2025-04-01T15:40:51.437Z Last Updated: 2025-11-03T19:39:02.707Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: slimbus: messaging: Free transaction ID in delayed interrupt scenario In case of interrupt delay for any reason, slim_do_transfer() returns timeout error but the transaction ID (TID) is not freed. This results into invalid memory access inside qcom_slim_ngd_rx_msgq_cb() due to invalid TID. Fix the issue by freeing the TID in slim_do_transfer() before returning timeout error to avoid invalid memory access. Call trace: __memcpy_fromio+0x20/0x190 qcom_slim_ngd_rx_msgq_cb+
returning timeout error to avoid invalid memory access. Call trace: __memcpy_fromio+0x20/0x190 qcom_slim_ngd_rx_msgq_cb+0x130/0x290 [slim_qcom_ngd_ctrl] vchan_complete+0x2a0/0x4a0 tasklet_action_common+0x274/0x700 tasklet_action+0x28/0x3c _stext+0x188/0x620 run_ksoftirqd+0x34/0x74 smpboot_thread_fn+0x1d8/0x464 kthread+0x178/0x238 ret_from_fork+0x10/0x20 Code: aa0003e8 91000429 f100044a 3940002b (3800150b) ---[ end trace 0fe00bec2b975c99 ]--- Kernel panic - not syncing: Oops: Fatal exception in interrupt. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/cec8c0ac173fe5321f03fdb1a09a9cb69bc9a9fe - https://git.kernel.org/stable/c/a32e5198a9134772eb
://git.kernel.org/stable/c/cec8c0ac173fe5321f03fdb1a09a9cb69bc9a9fe - https://git.kernel.org/stable/c/a32e5198a9134772eb03f7b72a7849094c55bda9 - https://git.kernel.org/stable/c/09d34c4cbc38485c7514069f25348e439555b282 - https://git.kernel.org/stable/c/18ae4cee05c310c299ba75d7477dcf34be67aa16 - https://git.kernel.org/stable/c/faac8e894014e8167471a8e4a5eb35a8fefbb82a - https://git.kernel.org/stable/c/6abf3d8bb51cbaf886c3f08109a0462890b10db6 - https://git.kernel.org/stable/c/0c541c8f6da23e0b92f0a6216d899659a7572074 - https://git.kernel.org/stable/c/dcb0d43ba8eb9517e70b1a0e4b0ae0ab657a0e5a
CVE ID: CVE-2025-21915 State: PUBLISHED Published: 2025-04-01T15:40:52.019Z Last Updated: 2025-05-04T07:24:23.107Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cdx: Fix possible UAF error in driver_override_show() Fixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c This function driver_override_show() is part of DEVICE_ATTR_RW, which includes both driver_override_show() and driver_override_store(). These functions can be executed concurrently in sysfs. The driver_override_store() function uses driver_set_override() to update the driver_override value, and driver_set_override() internally locks the devi
tion uses driver_set_override() to update the driver_override value, and driver_set_override() internally locks the device (device_lock(dev)). If driver_override_show() reads cdx_dev->driver_override without locking, it could potentially access a freed pointer if driver_override_store() frees the string concurrently. This could lead to printing a kernel address, which is a security risk since DEVICE_ATTR can be read by all users. Additionally, a similar pattern is used in drivers/amba/bus.c, as well as many other bus drivers, where device_lock() is taken in the show function, and it has been working without issues. This potential bug was detected by our experimental static analysis tool, whi
n, and it has been working without issues. This potential bug was detected by our experimental static analysis tool, which analyzes locking APIs and paired functions to identify data races and atomicity violations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d7b339bbc887bcfc1a5b620bfc70c6fbb8f733bf - https://git.kernel.org/stable/c/8473135f89c0949436a22adb05b8cece2fb3da91 - https://git.kernel.org/stable/c/0439d541aa8d3444ad41c39e39eb71acb57acde3 - https://git.kernel.org/stable/c/91d44c1afc61a2fec37a9c7a3485368309391e0b
CVE ID: CVE-2025-21916 State: PUBLISHED Published: 2025-04-01T15:40:52.519Z Last Updated: 2025-11-03T19:39:05.568Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: fix a flaw in existing endpoint checks Syzbot once again identified a flaw in usb endpoint checking, see [1]. This time the issue stems from a commit authored by me (2eabb655a968 ("usb: atm: cxacru: fix endpoint checking in cxacru_bind()")). While using usb_find_common_endpoints() may usually be enough to discard devices with wrong endpoints, in this case one needs more than just finding and identifying the sufficient number of endpoints of correct ty
ndpoints, in this case one needs more than just finding and identifying the sufficient number of endpoints of correct types - one needs to check the endpoint's address as well. Since cxacru_bind() fills URBs with CXACRU_EP_CMD address in mind, switch the endpoint verification approach to usb_check_XXX_endpoints() instead to fix incomplete ep testing. [1] Syzbot report: usb 5-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 1378 at drivers/usb/core/urb.c:504 usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503 ... RIP: 0010:usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503 ... Call Trace: <TASK> cxacru_cm+0x3c8/0xe50 drivers/usb/atm/cxacru.c:649 cxacru_card_status drivers/usb/a
ore/urb.c:503 ... Call Trace: <TASK> cxacru_cm+0x3c8/0xe50 drivers/usb/atm/cxacru.c:649 cxacru_card_status drivers/usb/atm/cxacru.c:760 [inline] cxacru_bind+0xcf9/0x1150 drivers/usb/atm/cxacru.c:1223 usbatm_usb_probe+0x314/0x1d30 drivers/usb/atm/usbatm.c:1058 cxacru_usb_probe+0x184/0x220 drivers/usb/atm/cxacru.c:1377 usb_probe_interface+0x641/0xbb0 drivers/usb/core/driver.c:396 really_probe+0x2b9/0xad0 drivers/base/dd.c:658 __driver_probe_device+0x1a2/0x390 drivers/base/dd.c:800 driver_probe_device+0x50/0x430 drivers/base/dd.c:830 ... Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/dcd592ab9dd8a2bfc36e75583b9006db2a77ec24 - https://git.kernel.
Container: References: - https://git.kernel.org/stable/c/dcd592ab9dd8a2bfc36e75583b9006db2a77ec24 - https://git.kernel.org/stable/c/319529e0356bd904528c64647725a2272d297c83 - https://git.kernel.org/stable/c/bf4409f84023b52b5e9b36c0a071a121eee42138 - https://git.kernel.org/stable/c/197e78076c5ecd895f109158c4ea2954b9919af6 - https://git.kernel.org/stable/c/a0475a885d69849b1ade38add6d64338dfa83a8f - https://git.kernel.org/stable/c/cfc295f7cccf66cbd5123416bcf1bee2e1bd37de - https://git.kernel.org/stable/c/903b80c21458bb1e34c3a78c5fdc553821e357f8 - https://git.kernel.org/stable/c/c90aad369899a607cfbc002bebeafd51e31900cd
CVE ID: CVE-2025-21917 State: PUBLISHED Published: 2025-04-01T15:40:53.042Z Last Updated: 2025-11-03T19:39:08.336Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: renesas_usbhs: Flush the notify_hotplug_work When performing continuous unbind/bind operations on the USB drivers available on the Renesas RZ/G2L SoC, a kernel crash with the message "Unable to handle kernel NULL pointer dereference at virtual address" may occur. This issue points to the usbhsc_notify_hotplug() function. Flush the delayed work to avoid its execution when driver resources are unavailable. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Pro
avoid its execution when driver resources are unavailable. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/4cd847a7b630a85493d0294ad9542c21aafaa246 - https://git.kernel.org/stable/c/394965f90454d6f00fe11879142b720c6c1a872e - https://git.kernel.org/stable/c/3248c1f833f924246cb98ce7da4569133c1b2292 - https://git.kernel.org/stable/c/4ca078084cdd5f32d533311d6a0b63a60dcadd41 - https://git.kernel.org/stable/c/d50f5c0cd949593eb9a3d822b34d7b50046a06b7 - https://git.kernel.org/stable/c/e5aac1c9b2974636db7ce796ffa6de88fa08335e - https://git.kernel.org/stable/c/830818c8e70c0364e377f0c243b28061ef7967eb - https://git.kernel.org/st
6ffa6de88fa08335e - https://git.kernel.org/stable/c/830818c8e70c0364e377f0c243b28061ef7967eb - https://git.kernel.org/stable/c/552ca6b87e3778f3dd5b87842f95138162e16c82
CVE ID: CVE-2025-21918 State: PUBLISHED Published: 2025-04-01T15:40:53.561Z Last Updated: 2025-11-03T19:39:09.717Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Fix NULL pointer access Resources should be released only after all threads that utilize them have been destroyed. This commit ensures that resources are not released prematurely by waiting for the associated workqueue to complete before deallocating them. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/7a735a8a46f6ebf898bbefd96659ca5da798bce0 - https://git.kernel.org/stable/c/4
ferences: - https://git.kernel.org/stable/c/7a735a8a46f6ebf898bbefd96659ca5da798bce0 - https://git.kernel.org/stable/c/46fba7be161bb89068958138ea64ec33c0b446d4 - https://git.kernel.org/stable/c/079a3e52f3e751bb8f5937195bdf25c5d14fdff0 - https://git.kernel.org/stable/c/592a0327d026a122e97e8e8bb7c60cbbe7697344 - https://git.kernel.org/stable/c/b13abcb7ddd8d38de769486db5bd917537b32ab1
CVE ID: CVE-2025-21919 State: PUBLISHED Published: 2025-04-01T15:40:54.075Z Last Updated: 2025-11-03T19:39:11.086Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list child_cfs_rq_on_list attempts to convert a 'prev' pointer to a cfs_rq. This 'prev' pointer can originate from struct rq's leaf_cfs_rq_list, making the conversion invalid and potentially leading to memory corruption. Depending on the relative positions of leaf_cfs_rq_list and the task group (tg) pointer within the struct, this can cause a memory fault or access garbage data. The issue arises in list_add
group (tg) pointer within the struct, this can cause a memory fault or access garbage data. The issue arises in list_add_leaf_cfs_rq, where both cfs_rq->leaf_cfs_rq_list and rq->leaf_cfs_rq_list are added to the same leaf list. Also, rq->tmp_alone_branch can be set to rq->leaf_cfs_rq_list. This adds a check `if (prev == &rq->leaf_cfs_rq_list)` after the main conditional in child_cfs_rq_on_list. This ensures that the container_of operation will convert a correct cfs_rq struct. This check is sufficient because only cfs_rqs on the same CPU are added to the list, so verifying the 'prev' pointer against the current rq's list head is enough. Fixes a potential memory corruption issue that due to cu
he 'prev' pointer against the current rq's list head is enough. Fixes a potential memory corruption issue that due to current struct layout might not be manifesting as a crash but could lead to unpredictable behavior when the layout changes. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5cb300dcdd27e6a351ac02541e0231261c775852 - https://git.kernel.org/stable/c/000c9ee43928f2ce68a156dd40bab7616256f4dd - https://git.kernel.org/stable/c/9cc7f0018609f75a349e42e3aebc3b0e905ba775 - https://git.kernel.org/stable/c/b5741e4b9ef3567613b2351384f91d3f16e59986 - https://git.kernel.org/stable/c/e1dd09df30ba86716cb2ffab97dc35195c01
stable/c/b5741e4b9ef3567613b2351384f91d3f16e59986 - https://git.kernel.org/stable/c/e1dd09df30ba86716cb2ffab97dc35195c01eb8f - https://git.kernel.org/stable/c/3b4035ddbfc8e4521f85569998a7569668cccf51
CVE ID: CVE-2025-21920 State: PUBLISHED Published: 2025-04-01T15:40:54.595Z Last Updated: 2025-11-03T19:39:13.839Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: vlan: enforce underlying device type Currently, VLAN devices can be created on top of non-ethernet devices. Besides the fact that it doesn't make much sense, this also causes a bug which leaks the address of a kernel function to usermode. When creating a VLAN device, we initialize GARP (garp_init_applicant) and MRP (mrp_init_applicant) for the underlying device. As part of the initialization process, we add the multicast address of each applicant to the underlying devi
ing device. As part of the initialization process, we add the multicast address of each applicant to the underlying device, by calling dev_mc_add. __dev_mc_add uses dev->addr_len to determine the length of the new multicast address. This causes an out-of-bounds read if dev->addr_len is greater than 6, since the multicast addresses provided by GARP and MRP are only 6 bytes long. This behaviour can be reproduced using the following commands: ip tunnel add gretest mode ip6gre local ::1 remote ::2 dev lo ip l set up dev gretest ip link add link gretest name vlantest type vlan id 100 Then, the following command will display the address of garp_pdu_rcv: ip maddr show | grep 01:80:c2:00:00:21 Fix t
d 100 Then, the following command will display the address of garp_pdu_rcv: ip maddr show | grep 01:80:c2:00:00:21 Fix the bug by enforcing the type of the underlying device during VLAN device initialization. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/7f1564b2b2072b7aa1ac75350e9560a07c7a44fd - https://git.kernel.org/stable/c/fa40ebef69234e39ec2d26930d045f2fb9a8cb2b - https://git.kernel.org/stable/c/0fb7aa04c19eac4417f360a9f7611a60637bdacc - https://git.kernel.org/stable/c/5a515d13e15536e82c5c7c83eb6cf5bc4827fee5 - https://git.kernel.org/stable/c/3561442599804905c3defca241787cd4546e99a7 - https://git.kernel.org/sta
eb6cf5bc4827fee5 - https://git.kernel.org/stable/c/3561442599804905c3defca241787cd4546e99a7 - https://git.kernel.org/stable/c/30e8aee77899173a82ae5ed89f536c096f20aaeb - https://git.kernel.org/stable/c/b6c72479748b7ea09f53ed64b223cee6463dc278 - https://git.kernel.org/stable/c/b33a534610067ade2bdaf2052900aaad99701353
CVE ID: CVE-2025-21921 State: PUBLISHED Published: 2025-04-01T15:40:55.110Z Last Updated: 2025-05-04T07:24:36.169Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: ethtool: netlink: Allow NULL nlattrs when getting a phy_device ethnl_req_get_phydev() is used to lookup a phy_device, in the case an ethtool netlink command targets a specific phydev within a netdev's topology. It takes as a parameter a const struct nlattr *header that's used for error handling : if (!phydev) { NL_SET_ERR_MSG_ATTR(extack, header, "no phy matching phyindex"); return ERR_PTR(-ENODEV); } In the notify path after a ->set operation however, there's no