Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
the rest of the payload (say TLS alert's level/description) which goes into the msg payload buffer. This patch proposes to rework how control messages are setup and used by sock_recvmsg(). If no control message structure is setup, kTLS layer will read and process TLS data record types. As soon as it encounters a TLS control message, it would return an error. At that point, NFS can setup a kvec backed msg buffer and read in the control message such as a TLS alert. Msg iterator can advance the kvec pointer as a part of the copy process thus we need to revert the iterator before calling into the tls_alert_recv. References: - https://git.kernel.org/stable/c/b1df394621710b312f0393e3f240fdac0764f
ore calling into the tls_alert_recv. References: - https://git.kernel.org/stable/c/b1df394621710b312f0393e3f240fdac0764f968 - https://git.kernel.org/stable/c/25bb3647d30a20486b5fe7cff2b0e503c16c9692 - https://git.kernel.org/stable/c/3b549da875414989f480b66835d514be80a0bd9c - https://git.kernel.org/stable/c/6b33c31cc788073bfbed9297e1f4486ed73d87da - https://git.kernel.org/stable/c/bee47cb026e762841f3faece47b51f985e215edb
CVE ID: CVE-2025-38567 State: PUBLISHED Published: 2025-08-19T17:02:48.306Z Last Updated: 2025-09-29T05:53:56.067Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfsd: avoid ref leak in nfsd_open_local_fh() If two calls to nfsd_open_local_fh() race and both successfully call nfsd_file_acquire_local(), they will both get an extra reference to the net to accompany the file reference stored in *pnf. One of them will fail to store (using xchg()) the file reference in *pnf and will drop that reference but WON'T drop the accompanying reference to the net. This leak means that when the nfs server is shut down it will hang in nfsd_shut
p the accompanying reference to the net. This leak means that when the nfs server is shut down it will hang in nfsd_shutdown_net() waiting for &nn->nfsd_net_free_done. This patch adds the missing nfsd_net_put(). References: - https://git.kernel.org/stable/c/fcb0a417fddb605530c4837e0996620f8ed38023 - https://git.kernel.org/stable/c/c4bf8f26c51e51bbb840935659a7b3b65a802c07 - https://git.kernel.org/stable/c/e5a73150776f18547ee685c9f6bfafe549714899
CVE ID: CVE-2025-38568 State: PUBLISHED Published: 2025-08-19T17:02:49.278Z Last Updated: 2025-09-29T05:53:57.182Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing TCA_MQPRIO_TC_ENTRY_INDEX is validated using NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value TC_QOPT_MAX_QUEUE (16). This leads to a 4-byte out-of-bounds stack write in the fp[] array, which only has room for 16 elements (0–15). Fix this by changing the policy to allow only up to TC_QOPT_MAX_QUEUE - 1. References: - https://git.kernel.org/stable/c/39491e859fd494d0b51adc5c7d54c8a7dcf
llow only up to TC_QOPT_MAX_QUEUE - 1. References: - https://git.kernel.org/stable/c/39491e859fd494d0b51adc5c7d54c8a7dcf1d198 - https://git.kernel.org/stable/c/d00e4125680f7074c4f42ce3c297336f23128e70 - https://git.kernel.org/stable/c/66fc2ebdd9d5dd6e5a9c7edeace5a61a0ab2cd86 - https://git.kernel.org/stable/c/f1a9dbcb7d17bf0abb325cdc984957cfabc59693 - https://git.kernel.org/stable/c/ffd2dc4c6c49ff4f1e5d34e454a6a55608104c17
CVE ID: CVE-2025-38569 State: PUBLISHED Published: 2025-08-19T17:02:49.987Z Last Updated: 2025-11-03T17:39:57.223Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: benet: fix BUG when creating VFs benet crashes as soon as SRIOV VFs are created: kernel BUG at mm/vmalloc.c:3457! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 4 UID: 0 PID: 7408 Comm: test.sh Kdump: loaded Not tainted 6.16.0+ #1 PREEMPT(voluntary) [...] RIP: 0010:vunmap+0x5f/0x70 [...] Call Trace: <TASK> __iommu_dma_free+0xe8/0x1c0 be_cmd_set_mac_list+0x3fe/0x640 [be2net] be_cmd_set_mac+0xaf/0x110 [be2net] be_vf_eth_addr_config+0x19f/0x330 [be2net] be_vf_setup+
mac_list+0x3fe/0x640 [be2net] be_cmd_set_mac+0xaf/0x110 [be2net] be_vf_eth_addr_config+0x19f/0x330 [be2net] be_vf_setup+0x4f7/0x990 [be2net] be_pci_sriov_configure+0x3a1/0x470 [be2net] sriov_numvfs_store+0x20b/0x380 kernfs_fop_write_iter+0x354/0x530 vfs_write+0x9b9/0xf60 ksys_write+0xf3/0x1d0 do_syscall_64+0x8c/0x3d0 be_cmd_set_mac_list() calls dma_free_coherent() under a spin_lock_bh. Fix it by freeing only after the lock has been released. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/3697e37e012bbd2bb5a5b467689811ba097b2eff - https://git.kernel.org/stable/c/975e73b9102d844a3dc3f091ad631c56145c8b4c - https://git.kernel.org/stable/c/f80b34e
eff - https://git.kernel.org/stable/c/975e73b9102d844a3dc3f091ad631c56145c8b4c - https://git.kernel.org/stable/c/f80b34ebc579216407b128e9d155bfcae875c30f - https://git.kernel.org/stable/c/46d44a23a3723a89deeb65b13cddb17f8d9f2700 - https://git.kernel.org/stable/c/c377ba2be9430d165a98e4b782902ed630bc7546 - https://git.kernel.org/stable/c/0ddfe8b127ef1149fddccb79db6e6eaba7738e7d - https://git.kernel.org/stable/c/d5dc09ee5d74277bc47193fe28ce8703e229331b - https://git.kernel.org/stable/c/f4e4e0c4bc4d799d6fa39055acdbc3af066cd13e - https://git.kernel.org/stable/c/5a40f8af2ba1b9bdf46e2db10e8c9710538fbc63
CVE ID: CVE-2025-38570 State: PUBLISHED Published: 2025-08-19T17:02:50.677Z Last Updated: 2025-09-29T05:53:59.478Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: unlink NAPIs from queues on error to open CI hit a UaF in fbnic in the AF_XDP portion of the queues.py test. The UaF is in the __sk_mark_napi_id_once() call in xsk_bind(), NAPI has been freed. Looks like the device failed to open earlier, and we lack clearing the NAPI pointer from the queue. References: - https://git.kernel.org/stable/c/21d3f8441c7f317b93ba6a8029610c8b7e3773db - https://git.kernel.org/stable/c/4b59f9deff3bdb52b223c85048f1d2924803b817 - http
d3f8441c7f317b93ba6a8029610c8b7e3773db - https://git.kernel.org/stable/c/4b59f9deff3bdb52b223c85048f1d2924803b817 - https://git.kernel.org/stable/c/4b31bcb025cb497da2b01f87173108ff32d350d2
CVE ID: CVE-2025-38571 State: PUBLISHED Published: 2025-08-19T17:02:51.620Z Last Updated: 2025-09-29T05:54:02.055Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix client side handling of tls alerts A security exploit was discovered in NFS over TLS in tls_alert_recv due to its assumption that there is valid data in the msghdr's iterator's kvec. Instead, this patch proposes the rework how control messages are setup and used by sock_recvmsg(). If no control message structure is setup, kTLS layer will read and process TLS data record types. As soon as it encounters a TLS control message, it would return an error. At that
ead and process TLS data record types. As soon as it encounters a TLS control message, it would return an error. At that point, NFS can setup a kvec backed control buffer and read in the control message such as a TLS alert. Scott found that a msg iterator can advance the kvec pointer as a part of the copy process thus we need to revert the iterator before calling into the tls_alert_recv. References: - https://git.kernel.org/stable/c/a55b3d15331859d9fdd261cfa6d34ca2aeb0fb95 - https://git.kernel.org/stable/c/c36b2fbd60e8f9c6f975522130998608880c93be - https://git.kernel.org/stable/c/3ee397eaaca4fa04db21bb98c8f1d0c6cc525368 - https://git.kernel.org/stable/c/3feada5baf4dc96e151ff2ca54630e1d274e54
able/c/3ee397eaaca4fa04db21bb98c8f1d0c6cc525368 - https://git.kernel.org/stable/c/3feada5baf4dc96e151ff2ca54630e1d274e5458 - https://git.kernel.org/stable/c/cc5d59081fa26506d02de2127ab822f40d88bc5a
CVE ID: CVE-2025-38572 State: PUBLISHED Published: 2025-08-19T17:02:52.340Z Last Updated: 2025-11-03T17:39:59.107Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ipv6: reject malicious packets in ipv6_gso_segment() syzbot was able to craft a packet with very long IPv6 extension headers leading to an overflow of skb->transport_header. This 16bit field has a limited range. Add skb_reset_transport_header_careful() helper and use it from ipv6_gso_segment() WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skb_reset_transport_header include/linux/skbuff.h:3032 [inline] WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3
skb_reset_transport_header include/linux/skbuff.h:3032 [inline] WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Modules linked in: CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:skb_reset_transport_header include/linux/skbuff.h:3032 [inline] RIP: 0010:ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Call Trace: <TASK> skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 nsh_gso_segment+0x54a/0xe10 net/nsh/nsh.c:110 skb_mac_gso_segment+0x31c/0x640 net/core/g
t+0x31c/0x640 net/core/gso.c:53 nsh_gso_segment+0x54a/0xe10 net/nsh/nsh.c:110 skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 __skb_gso_segment+0x342/0x510 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x857/0x11b0 net/core/dev.c:3950 validate_xmit_skb_list+0x84/0x120 net/core/dev.c:4000 sch_direct_xmit+0xd3/0x4b0 net/sched/sch_generic.c:329 __dev_xmit_skb net/core/dev.c:4102 [inline] __dev_queue_xmit+0x17b6/0x3a70 net/core/dev.c:4679 Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/5dc60b2a00ed7629214ac0c48e43f40af2078703 - https://git.kernel.org/stable/c/3f638e0b28bde7c3354a0df938ab3a96739455d1 - https:/
b2a00ed7629214ac0c48e43f40af2078703 - https://git.kernel.org/stable/c/3f638e0b28bde7c3354a0df938ab3a96739455d1 - https://git.kernel.org/stable/c/09ff062b89d8e48165247d677d1ca23d6d607e9b - https://git.kernel.org/stable/c/de322cdf600fc9433845a9e944d1ca6b31cfb67e - https://git.kernel.org/stable/c/ef05007b403dcc21e701cb1f30d4572ac0a9da20 - https://git.kernel.org/stable/c/5489e7fc6f8be3062f8cb7e49406de4bfd94db67 - https://git.kernel.org/stable/c/573b8250fc2554761db3bc2bbdbab23789d52d4e - https://git.kernel.org/stable/c/ee851768e4b8371ce151fd446d24bf3ae2d18789 - https://git.kernel.org/stable/c/d45cf1e7d7180256e17c9ce88e32e8061a7887fe
CVE ID: CVE-2025-38573 State: PUBLISHED Published: 2025-08-19T17:02:53.008Z Last Updated: 2025-09-29T05:54:04.540Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: spi: cs42l43: Property entry should be a null-terminated array The software node does not specify a count of property entries, so the array must be null-terminated. When unterminated, this can lead to a fault in the downstream cs35l56 amplifier driver, because the node parse walks off the end of the array into unknown memory. References: - https://git.kernel.org/stable/c/674328102baad76c7a06628efc01974ece5ae27f - https://git.kernel.org/stable/c/9f0035ae38d2571f5ddedc82
.kernel.org/stable/c/674328102baad76c7a06628efc01974ece5ae27f - https://git.kernel.org/stable/c/9f0035ae38d2571f5ddedc829d74492013caa625 - https://git.kernel.org/stable/c/139b5df757a0aa436f763b0038e0b73808d2f4b6 - https://git.kernel.org/stable/c/ffcfd071eec7973e58c4ffff7da4cb0e9ca7b667
CVE ID: CVE-2025-38574 State: PUBLISHED Published: 2025-08-19T17:02:53.866Z Last Updated: 2025-11-03T17:40:01.333Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: pptp: ensure minimal skb length in pptp_xmit() Commit aabc6596ffb3 ("net: ppp: Add bound checking for skb data on ppp_sync_txmung") fixed ppp_sync_txmunge() We need a similar fix in pptp_xmit(), otherwise we might read uninit data as reported by syzbot. BUG: KMSAN: uninit-value in pptp_xmit+0xc34/0x2720 drivers/net/ppp/pptp.c:193 pptp_xmit+0xc34/0x2720 drivers/net/ppp/pptp.c:193 ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2290 [inline] ppp_input+0x1d6/0xe60
0 drivers/net/ppp/pptp.c:193 ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2290 [inline] ppp_input+0x1d6/0xe60 drivers/net/ppp/ppp_generic.c:2314 pppoe_rcv_core+0x1e8/0x760 drivers/net/ppp/pppoe.c:379 sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148 __release_sock+0x1d3/0x330 net/core/sock.c:3213 release_sock+0x6b/0x270 net/core/sock.c:3767 pppoe_sendmsg+0x15d/0xcb0 drivers/net/ppp/pppoe.c:904 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x330/0x3d0 net/socket.c:727 ____sys_sendmsg+0x893/0xd80 net/socket.c:2566 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2620 __sys_sendmmsg+0x2d9/0x7c0 net/socket.c:2709 Additional Analyst Notes: - CVE Program Container: References: - ht
.c:2620 __sys_sendmmsg+0x2d9/0x7c0 net/socket.c:2709 Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/97b8c5d322c5c0038cac4bc56fdbe237d0be426f - https://git.kernel.org/stable/c/26672f1679b143aa34fca0b6046b7fd0c184770d - https://git.kernel.org/stable/c/5de7513f38f3c19c0610294ee478242bea356f8c - https://git.kernel.org/stable/c/504cc4ab91073d2ac7404ad146139f86ecee7193 - https://git.kernel.org/stable/c/5005d24377378a20e5c0e53052fc4ebdcdcbc611 - https://git.kernel.org/stable/c/ea99b88b1999ebcb24d5d3a6b7910030f40d3bba - https://git.kernel.org/stable/c/b7dcda76fd0615c0599c89f36873a6cd48e02dbb - https://git.kernel.org/stable/c/1a04db0fd75cb6034fc27a56b
kernel.org/stable/c/b7dcda76fd0615c0599c89f36873a6cd48e02dbb - https://git.kernel.org/stable/c/1a04db0fd75cb6034fc27a56b67b3b8b9022a98c - https://git.kernel.org/stable/c/de9c4861fb42f0cd72da844c3c34f692d5895b7b
CVE ID: CVE-2025-38575 State: PUBLISHED Published: 2025-04-18T07:01:33.904Z Last Updated: 2025-11-03T19:58:31.892Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: use aead_request_free to match aead_request_alloc Use aead_request_free() instead of kfree() to properly free memory allocated by aead_request_alloc(). This ensures sensitive crypto data is zeroed before being freed. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/571b342d4688801fc1f6a1934389dac09425dc93 - https://git.kernel.org/stable/c/a6b594868268c3a7bfaeced912525cd2c445529a - https://git.kernel.org/stable/c/1d
9425dc93 - https://git.kernel.org/stable/c/a6b594868268c3a7bfaeced912525cd2c445529a - https://git.kernel.org/stable/c/1de7fec4d3012672e31eeb6679ea60f7ca010ef9 - https://git.kernel.org/stable/c/3e341dbd5f5a6e5a558e67da80731dc38a7f758c - https://git.kernel.org/stable/c/aef10ccd74512c52e30c5ee19d0031850973e78d - https://git.kernel.org/stable/c/46caeae23035192b9cc41872c827f30d0233f16e - https://git.kernel.org/stable/c/6171063e9d046ffa46f51579b2ca4a43caef581a
CVE ID: CVE-2025-38576 State: PUBLISHED Published: 2025-08-19T17:02:59.623Z Last Updated: 2025-11-03T17:40:03.438Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: Make EEH driver device hotplug safe Multiple race conditions existed between the PCIe hotplug driver and the EEH driver, leading to a variety of kernel oopses of the same general nature: <pcie device unplug> <eeh driver trigger> <hotplug removal trigger> <pcie tree reconfiguration> <eeh recovery next step> <oops in EEH driver bus iteration loop> A second class of oops is also seen when the underlying bus disappears during device recovery. Refactor the EEH
n loop> A second class of oops is also seen when the underlying bus disappears during device recovery. Refactor the EEH module to be PCI rescan and remove safe. Also clean up a few minor formatting / readability issues. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/502f08831a9afb72dc98a56ae6504da43e93b250 - https://git.kernel.org/stable/c/f56e004b781719d8fdf6c9619b15caf2579bc1f2 - https://git.kernel.org/stable/c/59c6d3d81d42bf543c90597b4f38c53d6874c5a1 - https://git.kernel.org/stable/c/a426e8a6ae161f51888585b065db0f8f93ab2e16 - https://git.kernel.org/stable/c/d2c60a8a387e9fcc28447ef36c03f8e49fd052a6 - https://git.kernel.org/stable/c/d42bbd8f
16 - https://git.kernel.org/stable/c/d2c60a8a387e9fcc28447ef36c03f8e49fd052a6 - https://git.kernel.org/stable/c/d42bbd8f30ac38b1ce54715bf08ec3dac18d6b25 - https://git.kernel.org/stable/c/19d5036e7ad766cf212aebec23b9f1d7924a62bc - https://git.kernel.org/stable/c/1010b4c012b0d78dfb9d3132b49aa2ef024a07a7
CVE ID: CVE-2025-38577 State: PUBLISHED Published: 2025-08-19T17:03:00.534Z Last Updated: 2025-11-03T17:40:05.572Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid panic in f2fs_evict_inode As syzbot [1] reported as below: R10: 0000000000000100 R11: 0000000000000206 R12: 00007ffe17473450 R13: 00007f28b1c10854 R14: 000000000000dae5 R15: 00007ffe17474520 </TASK> ---[ end trace 0000000000000000 ]--- ================================================================== BUG: KASAN: use-after-free in __list_del_entry_valid+0xa6/0x130 lib/list_debug.c:62 Read of size 8 at addr ffff88812d962278 by task syz-executor/564 CP
_list_del_entry_valid+0xa6/0x130 lib/list_debug.c:62 Read of size 8 at addr ffff88812d962278 by task syz-executor/564 CPU: 1 PID: 564 Comm: syz-executor Tainted: G W 6.1.129-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: <TASK> __dump_stack+0x21/0x24 lib/dump_stack.c:88 dump_stack_lvl+0xee/0x158 lib/dump_stack.c:106 print_address_description+0x71/0x210 mm/kasan/report.c:316 print_report+0x4a/0x60 mm/kasan/report.c:427 kasan_report+0x122/0x150 mm/kasan/report.c:531 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:351 __list_del_entry_valid+0xa6/0x130 lib/list_debug.c:62 __list_del_entry include/linux/list.h:134
san/report_generic.c:351 __list_del_entry_valid+0xa6/0x130 lib/list_debug.c:62 __list_del_entry include/linux/list.h:134 [inline] list_del_init include/linux/list.h:206 [inline] f2fs_inode_synced+0xf7/0x2e0 fs/f2fs/super.c:1531 f2fs_update_inode+0x74/0x1c40 fs/f2fs/inode.c:585 f2fs_update_inode_page+0x137/0x170 fs/f2fs/inode.c:703 f2fs_write_inode+0x4ec/0x770 fs/f2fs/inode.c:731 write_inode fs/fs-writeback.c:1460 [inline] __writeback_single_inode+0x4a0/0xab0 fs/fs-writeback.c:1677 writeback_single_inode+0x221/0x8b0 fs/fs-writeback.c:1733 sync_inode_metadata+0xb6/0x110 fs/fs-writeback.c:2789 f2fs_sync_inode_meta+0x16d/0x2a0 fs/f2fs/checkpoint.c:1159 block_operations fs/f2fs/checkpoint.c:1269
-writeback.c:2789 f2fs_sync_inode_meta+0x16d/0x2a0 fs/f2fs/checkpoint.c:1159 block_operations fs/f2fs/checkpoint.c:1269 [inline] f2fs_write_checkpoint+0xca3/0x2100 fs/f2fs/checkpoint.c:1658 kill_f2fs_super+0x231/0x390 fs/f2fs/super.c:4668 deactivate_locked_super+0x98/0x100 fs/super.c:332 deactivate_super+0xaf/0xe0 fs/super.c:363 cleanup_mnt+0x45f/0x4e0 fs/namespace.c:1186 __cleanup_mnt+0x19/0x20 fs/namespace.c:1193 task_work_run+0x1c6/0x230 kernel/task_work.c:203 exit_task_work include/linux/task_work.h:39 [inline] do_exit+0x9fb/0x2410 kernel/exit.c:871 do_group_exit+0x210/0x2d0 kernel/exit.c:1021 __do_sys_exit_group kernel/exit.c:1032 [inline] __se_sys_exit_group kernel/exit.c:1030 [inline]
0x2d0 kernel/exit.c:1021 __do_sys_exit_group kernel/exit.c:1032 [inline] __se_sys_exit_group kernel/exit.c:1030 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1030 x64_sys_call+0x7b4/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f28b1b8e169 Code: Unable to access opcode bytes at 0x7f28b1b8e13f. RSP: 002b:00007ffe174710a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 00007f28b1c10879 RCX: 00007f28b1b8e169 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 RBP: 0000000000000002 R08: 00
79 RCX: 00007f28b1b8e169 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 RBP: 0000000000000002 R08: 00007ffe1746ee47 R09: 00007ffe17472360 R10: 0000000000000009 R11: 0000000000000246 R12: 00007ffe17472360 R13: 00007f28b1c10854 R14: 000000000000dae5 R15: 00007ffe17474520 </TASK> Allocated by task 569: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:52 kasan_save_alloc_info+0x25/0x30 mm/kasan/generic.c:505 __kasan_slab_alloc+0x72/0x80 mm/kasan/common.c:328 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook+0x4f/0x2c0 mm/slab.h:737 slab_alloc_node mm/slub.c:3398 [inline] slab_alloc mm/slub.c:3406 [inline] __kmem_
t_alloc_hook+0x4f/0x2c0 mm/slab.h:737 slab_alloc_node mm/slub.c:3398 [inline] slab_alloc mm/slub.c:3406 [inline] __kmem_cache_alloc_lru mm/slub.c:3413 [inline] kmem_cache_alloc_lru+0x104/0x220 mm/slub.c:3429 alloc_inode_sb include/linux/fs.h:3245 [inline] f2fs_alloc_inode+0x2d/0x340 fs/f2fs/super.c:1419 alloc_inode fs/inode.c:261 [inline] iget_locked+0x186/0x880 fs/inode.c:1373 f2fs_iget+0x55/0x4c60 fs/f2fs/inode.c:483 f2fs_lookup+0x366/0xab0 fs/f2fs/namei.c:487 __lookup_slow+0x2a3/0x3d0 fs/namei.c:1690 lookup_slow+0x57/0x70 fs/namei.c:1707 walk_component+0x2e6/0x410 fs/namei ---truncated--- Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/15df
ei ---truncated--- Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/15df59809c54fbd687cdf27efbd2103a937459be - https://git.kernel.org/stable/c/9535e440fe5bc6c5ac7cfb407e53bf788b8bf8d4 - https://git.kernel.org/stable/c/5cd99d5aa3d39086bdb53eb5c52df16e98b101a0 - https://git.kernel.org/stable/c/4732ca17c17f5062426cfa982f43593e6b81963b - https://git.kernel.org/stable/c/880ef748e78a1eb7df2d8e11a9ef21e98bcaabe5 - https://git.kernel.org/stable/c/97df495d754116c8c28ac6a4112f831727bde887 - https://git.kernel.org/stable/c/9bbfe83924946552c4c513099c0e8c83af76311a - https://git.kernel.org/stable/c/42f9ea16aea8b49febaa87950a006a1792209f38 - https://git.kern
52c4c513099c0e8c83af76311a - https://git.kernel.org/stable/c/42f9ea16aea8b49febaa87950a006a1792209f38 - https://git.kernel.org/stable/c/a509a55f8eecc8970b3980c6f06886bbff0e2f68
CVE ID: CVE-2025-38578 State: PUBLISHED Published: 2025-08-19T17:03:01.483Z Last Updated: 2025-11-03T17:40:07.596Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid UAF in f2fs_sync_inode_meta() syzbot reported an UAF issue as below: [1] [2] [1] https://syzkaller.appspot.com/text?tag=CrashReport&x=16594c60580000 ================================================================== BUG: KASAN: use-after-free in __list_del_entry_valid+0xa6/0x130 lib/list_debug.c:62 Read of size 8 at addr ffff888100567dc8 by task kworker/u4:0/8 CPU: 1 PID: 8 Comm: kworker/u4:0 Tainted: G W 6.1.129-syzkaller-00017-g642656a36791 #0 Hard
67dc8 by task kworker/u4:0/8 CPU: 1 PID: 8 Comm: kworker/u4:0 Tainted: G W 6.1.129-syzkaller-00017-g642656a36791 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Workqueue: writeback wb_workfn (flush-7:0) Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:316 [inline] print_report+0x158/0x4e0 mm/kasan/report.c:427 kasan_report+0x13c/0x170 mm/kasan/report.c:531 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:351 __list_del_entry_valid+0xa6/0x130 lib/list_debug.c:62 __list_del_entry include/linux/list.h:134 [inline] list_del_init incl