Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-38120 State: PUBLISHED Published: 2025-07-03T08:35:27.233Z Last Updated: 2025-11-03T17:34:21.242Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_set_pipapo_avx2: fix initial map fill If the first field doesn't cover the entire start map, then we must zero out the remainder, else we leak those bits into the next match round map. The early fix was incomplete and did only fix up the generic C implementation. A followup patch adds a test case to nft_concat_range.sh. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/b5ad58285f9217d68cd5ea2ad86ce254a3fe7c4d
t Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/b5ad58285f9217d68cd5ea2ad86ce254a3fe7c4d - https://git.kernel.org/stable/c/90bc7f5a244aadee4292b28098b7c98aadd4b3aa - https://git.kernel.org/stable/c/39bab2d3517b5b50c609b4f8c66129bf619fffa0 - https://git.kernel.org/stable/c/251496ce1728c9fd47bd2b20a7b21b20b9a020ca - https://git.kernel.org/stable/c/8068e1e42b46518ce680dc6470bcd710efc3fa0a - https://git.kernel.org/stable/c/ea77c397bff8b6d59f6d83dae1425b08f465e8b5
CVE ID: CVE-2025-38121 State: PUBLISHED Published: 2025-07-03T08:35:27.900Z Last Updated: 2025-07-28T04:12:41.142Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: avoid panic on init failure In case of an error during init, in_hw_restart will be set, but it will never get cleared. Instead, we will retry to init again, and then we will act like we are in a restart when we are actually not. This causes (among others) to a NULL pointer dereference when canceling rx_omi::finished_work, that was not even initialized, because we thought that we are in hw_restart. Set in_hw_restart to true only if the fw is running,
not even initialized, because we thought that we are in hw_restart. Set in_hw_restart to true only if the fw is running, then we know that FW was loaded successfully and we are not going to the retry loop. References: - https://git.kernel.org/stable/c/a26ec8e16958b6dd37dac9daf5fb6978fe0cb0b8 - https://git.kernel.org/stable/c/960c7e6d388034d219dafffa6da0a5c2ccd5ff30
CVE ID: CVE-2025-38122 State: PUBLISHED Published: 2025-07-03T08:35:28.582Z Last Updated: 2025-11-03T17:34:22.190Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO gve_alloc_pending_packet() can return NULL, but gve_tx_add_skb_dqo() did not check for this case before dereferencing the returned pointer. Add a missing NULL check to prevent a potential NULL pointer dereference when allocation fails. This improves robustness in low-memory scenarios. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/ae98a1787fdcb0096d122
. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/ae98a1787fdcb0096d122bc80d93c3c7d812c04b - https://git.kernel.org/stable/c/2e5ead9e4e91fbe7799bd38afd8904543be1cb51 - https://git.kernel.org/stable/c/7f6265fce3bd424ded666481b37f106d7915fb6b - https://git.kernel.org/stable/c/a0319c9b1648a67511e947a596ca86888451c0a7 - https://git.kernel.org/stable/c/c741a7ef68023ac800054e2131c3e22e647fd7e3 - https://git.kernel.org/stable/c/12c331b29c7397ac3b03584e12902990693bc248
CVE ID: CVE-2025-38123 State: PUBLISHED Published: 2025-07-03T08:35:29.312Z Last Updated: 2025-07-28T04:12:48.944Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: Fix napi rx poll issue When driver handles the napi rx polling requests, the netdev might have been released by the dellink logic triggered by the disconnect operation on user plane. However, in the logic of processing skb in polling, an invalid netdev is still being used, which causes a panic. BUG: kernel NULL pointer dereference, address: 00000000000000f1 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:dev_gro_receive+0x3a/0x620 [...] Call Trace: <IRQ> ?
dress: 00000000000000f1 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:dev_gro_receive+0x3a/0x620 [...] Call Trace: <IRQ> ? __die_body+0x68/0xb0 ? page_fault_oops+0x379/0x3e0 ? exc_page_fault+0x4f/0xa0 ? asm_exc_page_fault+0x22/0x30 ? __pfx_t7xx_ccmni_recv_skb+0x10/0x10 [mtk_t7xx (HASH:1400 7)] ? dev_gro_receive+0x3a/0x620 napi_gro_receive+0xad/0x170 t7xx_ccmni_recv_skb+0x48/0x70 [mtk_t7xx (HASH:1400 7)] t7xx_dpmaif_napi_rx_poll+0x590/0x800 [mtk_t7xx (HASH:1400 7)] net_rx_action+0x103/0x470 irq_exit_rcu+0x13a/0x310 sysvec_apic_timer_interrupt+0x56/0x90 </IRQ> References: - https://git.kernel.org/stable/c/cc89f457d9133a558d4e8ef26dc20843c2d12073 - https://git.kernel.org/stable/c/e2df04e69c3f10b4
ps://git.kernel.org/stable/c/cc89f457d9133a558d4e8ef26dc20843c2d12073 - https://git.kernel.org/stable/c/e2df04e69c3f10b412f54be036dd0ed3b14756cf - https://git.kernel.org/stable/c/66542e9430c625f878a5b5dc0fe41e3458d614bf - https://git.kernel.org/stable/c/905fe0845bb27e4eed2ca27ea06e6c4847f1b2b1
CVE ID: CVE-2025-38124 State: PUBLISHED Published: 2025-07-03T08:35:30.499Z Last Updated: 2025-11-03T17:34:23.227Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: fix udp gso skb_segment after pull from frag_list Commit a1e40ac5b5e9 ("net: gso: fix udp gso fraglist segmentation after pull from frag_list") detected invalid geometry in frag_list skbs and redirects them from skb_segment_list to more robust skb_segment. But some packets with modified geometry can also hit bugs in that code. We don't know how many such cases exist. Addressing each one by one also requires touching the complex skb_segment code, which risks introd
any such cases exist. Addressing each one by one also requires touching the complex skb_segment code, which risks introducing bugs for other types of skbs. Instead, linearize all these packets that fail the basic invariants on gso fraglist skbs. That is more robust. If only part of the fraglist payload is pulled into head_skb, it will always cause exception when splitting skbs by skb_segment. For detailed call stack information, see below. Valid SKB_GSO_FRAGLIST skbs - consist of two or more segments - the head_skb holds the protocol headers plus first gso_size - one or more frag_list skbs hold exactly one segment - all but the last must be gso_size Optional datapath hooks such as NAT and BP
e frag_list skbs hold exactly one segment - all but the last must be gso_size Optional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can modify fraglist skbs, breaking these invariants. In extreme cases they pull one part of data into skb linear. For UDP, this causes three payloads with lengths of (11,11,10) bytes were pulled tail to become (12,10,10) bytes. The skbs no longer meets the above SKB_GSO_FRAGLIST conditions because payload was pulled into head_skb, it needs to be linearized before pass to regular skb_segment. skb_segment+0xcd0/0xd14 __udp_gso_segment+0x334/0x5f4 udp4_ufo_fragment+0x118/0x15c inet_gso_segment+0x164/0x338 skb_mac_gso_segment+0xc4/0x13c __skb_gso_segment+0
x334/0x5f4 udp4_ufo_fragment+0x118/0x15c inet_gso_segment+0x164/0x338 skb_mac_gso_segment+0xc4/0x13c __skb_gso_segment+0xc4/0x124 validate_xmit_skb+0x9c/0x2c0 validate_xmit_skb_list+0x4c/0x80 sch_direct_xmit+0x70/0x404 __dev_queue_xmit+0x64c/0xe5c neigh_resolve_output+0x178/0x1c4 ip_finish_output2+0x37c/0x47c __ip_finish_output+0x194/0x240 ip_finish_output+0x20/0xf4 ip_output+0x100/0x1a0 NF_HOOK+0xc4/0x16c ip_forward+0x314/0x32c ip_rcv+0x90/0x118 __netif_receive_skb+0x74/0x124 process_backlog+0xe8/0x1a4 __napi_poll+0x5c/0x1f8 net_rx_action+0x154/0x314 handle_softirqs+0x154/0x4b8 [118.376811] [C201134] rxq0_pus: [name:bug&]kernel BUG at net/core/skbuff.c:4278! [118.376829] [C201134] rxq0_pus:
0x4b8 [118.376811] [C201134] rxq0_pus: [name:bug&]kernel BUG at net/core/skbuff.c:4278! [118.376829] [C201134] rxq0_pus: [name:traps&]Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP [118.470774] [C201134] rxq0_pus: [name:mrdump&]Kernel Offset: 0x178cc00000 from 0xffffffc008000000 [118.470810] [C201134] rxq0_pus: [name:mrdump&]PHYS_OFFSET: 0x40000000 [118.470827] [C201134] rxq0_pus: [name:mrdump&]pstate: 60400005 (nZCv daif +PAN -UAO) [118.470848] [C201134] rxq0_pus: [name:mrdump&]pc : [0xffffffd79598aefc] skb_segment+0xcd0/0xd14 [118.470900] [C201134] rxq0_pus: [name:mrdump&]lr : [0xffffffd79598a5e8] skb_segment+0x3bc/0xd14 [118.470928] [C201134] rxq0_pus: [name:mrdump&]sp : ff
: [name:mrdump&]lr : [0xffffffd79598a5e8] skb_segment+0x3bc/0xd14 [118.470928] [C201134] rxq0_pus: [name:mrdump&]sp : ffffffc008013770 Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/0e65f38bd1aa14ea86e221b7bb814d38278d86c3 - https://git.kernel.org/stable/c/85eef1748c024da1a191aed56b30a3a65958c50c - https://git.kernel.org/stable/c/4399f59a9467a324ed46657555f0e1f209a14acb - https://git.kernel.org/stable/c/a04302867094bdc6efac1b598370fc47cf3f2388 - https://git.kernel.org/stable/c/3382a1ed7f778db841063f5d7e317ac55f9e7f72
CVE ID: CVE-2025-38125 State: PUBLISHED Published: 2025-07-03T08:35:31.176Z Last Updated: 2025-07-28T04:12:51.703Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: stmmac: make sure that ptp_rate is not 0 before configuring EST If the ptp_rate recorded earlier in the driver happens to be 0, this bogus value will propagate up to EST configuration, where it will trigger a division by 0. Prevent this division by 0 by adding the corresponding check and error code. References: - https://git.kernel.org/stable/c/451ee661d0f6272017fa012f99617101aa8ddf2c - https://git.kernel.org/stable/c/d5e3bfdba0dc419499b801937128957f77503761 - htt
51ee661d0f6272017fa012f99617101aa8ddf2c - https://git.kernel.org/stable/c/d5e3bfdba0dc419499b801937128957f77503761 - https://git.kernel.org/stable/c/cbefe2ffa7784525ec5d008ba87c7add19ec631a
CVE ID: CVE-2025-38126 State: PUBLISHED Published: 2025-07-03T08:35:31.812Z Last Updated: 2025-11-03T17:34:24.171Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping The stmmac platform drivers that do not open-code the clk_ptp_rate value after having retrieved the default one from the device-tree can end up with 0 in clk_ptp_rate (as clk_get_rate can return 0). It will eventually propagate up to PTP initialization when bringing up the interface, leading to a divide by 0: Division by zero in kernel. CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.30
nterface, leading to a divide by 0: Division by zero in kernel. CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.30-00001-g48313bd5768a #22 Hardware name: STM32 (Device Tree Support) Call trace: unwind_backtrace from show_stack+0x18/0x1c show_stack from dump_stack_lvl+0x6c/0x8c dump_stack_lvl from Ldiv0_64+0x8/0x18 Ldiv0_64 from stmmac_init_tstamp_counter+0x190/0x1a4 stmmac_init_tstamp_counter from stmmac_hw_setup+0xc1c/0x111c stmmac_hw_setup from __stmmac_open+0x18c/0x434 __stmmac_open from stmmac_open+0x3c/0xbc stmmac_open from __dev_open+0xf4/0x1ac __dev_open from __dev_change_flags+0x1cc/0x224 __dev_change_flags from dev_change_flags+0x24/0x60 dev_change_flags from ip_auto_config+0x
_dev_change_flags+0x1cc/0x224 __dev_change_flags from dev_change_flags+0x24/0x60 dev_change_flags from ip_auto_config+0x2e8/0x11a0 ip_auto_config from do_one_initcall+0x84/0x33c do_one_initcall from kernel_init_freeable+0x1b8/0x214 kernel_init_freeable from kernel_init+0x24/0x140 kernel_init from ret_from_fork+0x14/0x28 Exception stack(0xe0815fb0 to 0xe0815ff8) Prevent this division by 0 by adding an explicit check and error log about the actual issue. While at it, remove the same check from stmmac_ptp_register, which then becomes duplicate Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/32af9c289234990752281c805500dfe03c5b2b8f - https://git.k
rogram Container: References: - https://git.kernel.org/stable/c/32af9c289234990752281c805500dfe03c5b2b8f - https://git.kernel.org/stable/c/b263088ee8ab14563817a8be3519af8e25225793 - https://git.kernel.org/stable/c/bb033c6781ce1b0264c3993b767b4aa9021959c2 - https://git.kernel.org/stable/c/379cd990dfe752b38fcf46034698a9a150626c7a - https://git.kernel.org/stable/c/030ce919e114a111e83b7976ecb3597cefd33f26
CVE ID: CVE-2025-38127 State: PUBLISHED Published: 2025-07-03T08:35:32.453Z Last Updated: 2025-07-28T04:12:54.977Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ice: fix Tx scheduler error handling in XDP callback When the XDP program is loaded, the XDP callback adds new Tx queues. This means that the callback must update the Tx scheduler with the new queue number. In the event of a Tx scheduler failure, the XDP callback should also fail and roll back any changes previously made for XDP preparation. The previous implementation had a bug that not all changes made by the XDP callback were rolled back. This caused the crash with
ous implementation had a bug that not all changes made by the XDP callback were rolled back. This caused the crash with the following call trace: [ +9.549584] ice 0000:ca:00.0: Failed VSI LAN queue config for XDP, error: -5 [ +0.382335] Oops: general protection fault, probably for non-canonical address 0x50a2250a90495525: 0000 [#1] SMP NOPTI [ +0.010710] CPU: 103 UID: 0 PID: 0 Comm: swapper/103 Not tainted 6.14.0-net-next-mar-31+ #14 PREEMPT(voluntary) [ +0.010175] Hardware name: Intel Corporation M50CYP2SBSTD/M50CYP2SBSTD, BIOS SE5C620.86B.01.01.0005.2202160810 02/16/2022 [ +0.010946] RIP: 0010:__ice_update_sample+0x39/0xe0 [ice] [...] [ +0.002715] Call Trace: [ +0.002452] <IRQ> [ +0.002021
[ +0.010946] RIP: 0010:__ice_update_sample+0x39/0xe0 [ice] [...] [ +0.002715] Call Trace: [ +0.002452] <IRQ> [ +0.002021] ? __die_body.cold+0x19/0x29 [ +0.003922] ? die_addr+0x3c/0x60 [ +0.003319] ? exc_general_protection+0x17c/0x400 [ +0.004707] ? asm_exc_general_protection+0x26/0x30 [ +0.004879] ? __ice_update_sample+0x39/0xe0 [ice] [ +0.004835] ice_napi_poll+0x665/0x680 [ice] [ +0.004320] __napi_poll+0x28/0x190 [ +0.003500] net_rx_action+0x198/0x360 [ +0.003752] ? update_rq_clock+0x39/0x220 [ +0.004013] handle_softirqs+0xf1/0x340 [ +0.003840] ? sched_clock_cpu+0xf/0x1f0 [ +0.003925] __irq_exit_rcu+0xc2/0xe0 [ +0.003665] common_interrupt+0x85/0xa0 [ +0.003839] </IRQ> [ +0.002098] <TASK> [
[ +0.003925] __irq_exit_rcu+0xc2/0xe0 [ +0.003665] common_interrupt+0x85/0xa0 [ +0.003839] </IRQ> [ +0.002098] <TASK> [ +0.002106] asm_common_interrupt+0x26/0x40 [ +0.004184] RIP: 0010:cpuidle_enter_state+0xd3/0x690 Fix this by performing the missing unmapping of XDP queues from q_vectors and setting the XDP rings pointer back to NULL after all those queues are released. Also, add an immediate exit from the XDP callback in case of ring preparation failure. References: - https://git.kernel.org/stable/c/1d3c5d0dec6797eca3a861dab0816fa9505d9c3e - https://git.kernel.org/stable/c/276849954d7cbe6eec827b21fe2df43f9bf07011 - https://git.kernel.org/stable/c/0e061abaad1498c5b76c10c594d4359ceb6b9145 -
c/276849954d7cbe6eec827b21fe2df43f9bf07011 - https://git.kernel.org/stable/c/0e061abaad1498c5b76c10c594d4359ceb6b9145 - https://git.kernel.org/stable/c/0153f36041b8e52019ebfa8629c13bf8f9b0a951
CVE ID: CVE-2025-38128 State: PUBLISHED Published: 2025-07-03T08:35:33.089Z Last Updated: 2025-07-28T04:12:56.421Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject malformed HCI_CMD_SYNC commands In 'mgmt_hci_cmd_sync()', check whether the size of parameters passed in 'struct mgmt_cp_hci_cmd_sync' matches the total size of the data (i.e. 'sizeof(struct mgmt_cp_hci_cmd_sync)' plus trailing bytes). Otherwise, large invalid 'params_len' will cause 'hci_cmd_sync_alloc()' to do 'skb_put_data()' from an area beyond the one actually passed to 'mgmt_hci_cmd_sync()'. References: - https://git.kernel.org/stable/c/9e
' from an area beyond the one actually passed to 'mgmt_hci_cmd_sync()'. References: - https://git.kernel.org/stable/c/9eeafd16d76a7642d12b3442a26c15cd345e12f7 - https://git.kernel.org/stable/c/03f1700b9b4d4f2fed3165370f3c23db76553178
CVE ID: CVE-2025-38129 State: PUBLISHED Published: 2025-07-03T08:35:33.728Z Last Updated: 2025-07-28T04:12:58.108Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: page_pool: Fix use-after-free in page_pool_recycle_in_ring syzbot reported a uaf in page_pool_recycle_in_ring: BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862 Read of size 8 at addr ffff8880286045a0 by task syz.0.284/6943 CPU: 0 UID: 0 PID: 6943 Comm: syz.0.284 Not tainted 6.13.0-rc3-syzkaller-gdfa94ce54f41 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <TASK> __dump_sta
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:165 [inline] _raw_spin_unlock_bh+0x1b/0x40 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] ptr_ring_produce_bh include/linux/ptr_ring.h:164 [inline] page_pool_recycle_in_ring net/core/page_pool.c:707 [inli
line] ptr_ring_produce_bh include/linux/ptr_ring.h:164 [inline] page_pool_recycle_in_ring net/core/page_pool.c:707 [inline] page_pool_put_unrefed_netmem+0x748/0xb00 net/core/page_pool.c:826 page_pool_put_netmem include/net/page_pool/helpers.h:323 [inline] page_pool_put_full_netmem include/net/page_pool/helpers.h:353 [inline] napi_pp_put_page+0x149/0x2b0 net/core/skbuff.c:1036 skb_pp_recycle net/core/skbuff.c:1047 [inline] skb_free_head net/core/skbuff.c:1094 [inline] skb_release_data+0x6c4/0x8a0 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x1c9/0x380 net/core/skbuff.c:1242 kfree_skb_reason include/linux
skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x1c9/0x380 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1263 [inline] __skb_queue_purge_reason include/linux/skbuff.h:3343 [inline] root cause is: page_pool_recycle_in_ring ptr_ring_produce spin_lock(&r->producer_lock); WRITE_ONCE(r->queue[r->producer++], ptr) //recycle last page to pool page_pool_release page_pool_scrub page_pool_empty_ring ptr_ring_consume page_pool_return_page //release all page __page_pool_destroy free_percpu(pool->recycle_stats); free(pool) //free spin_unlock(&r->producer_lock); //pool->ring uaf read recycle_stat_inc(pool, ring); page_pool can be free while page pool recycle the last page in ring.
//pool->ring uaf read recycle_stat_inc(pool, ring); page_pool can be free while page pool recycle the last page in ring. Add producer-lock barrier to page_pool_release to prevent the page pool from being free before all pages have been recycled. recycle_stat_inc() is empty when CONFIG_PAGE_POOL_STATS is not enabled, which will trigger Wempty-body build warning. Add definition for pool stat macro to fix warning. References: - https://git.kernel.org/stable/c/e869a85acc2e60dc554579b910826a4919d8cd98 - https://git.kernel.org/stable/c/4ab8c0f8905c9c4d05e7f437e65a9a365573ff02 - https://git.kernel.org/stable/c/271683bb2cf32e5126c592b5d5e6a756fa374fd9
CVE ID: CVE-2025-38130 State: PUBLISHED Published: 2025-07-03T08:35:34.385Z Last Updated: 2025-07-28T04:12:59.341Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/connector: only call HDMI audio helper plugged cb if non-null On driver remove, sound/soc/codecs/hdmi-codec.c calls the plugged_cb with NULL as the callback function and codec_dev, as seen in its hdmi_remove function. The HDMI audio helper then happily tries calling said null function pointer, and produces an Oops as a result. Fix this by only executing the callback if fn is non-null. This means the .plugged_cb and .plugged_cb_dev members still get appropriately cl
cuting the callback if fn is non-null. This means the .plugged_cb and .plugged_cb_dev members still get appropriately cleared. References: - https://git.kernel.org/stable/c/933f3eab1d489af8d734bff855b10d29dd5968a4 - https://git.kernel.org/stable/c/be9b3f9a54101c19226c25ba7163d291183777a0
CVE ID: CVE-2025-38131 State: PUBLISHED Published: 2025-07-03T08:35:35.036Z Last Updated: 2025-11-03T17:34:25.127Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: coresight: prevent deactivate active config while enabling the config While enable active config via cscfg_csdev_enable_active_config(), active config could be deactivated via configfs' sysfs interface. This could make UAF issue in below scenario: CPU0 CPU1 (sysfs enable) load module cscfg_load_config_sets() activate config. // sysfs (sys_active_cnt == 1) ... cscfg_csdev_enable_active_config() lock(csdev->cscfg_csdev_lock) // here load config activate by CPU1 unlock(cs
= 1) ... cscfg_csdev_enable_active_config() lock(csdev->cscfg_csdev_lock) // here load config activate by CPU1 unlock(csdev->cscfg_csdev_lock) deactivate config // sysfs (sys_activec_cnt == 0) cscfg_unload_config_sets() unload module // access to config_desc which freed // while unloading module. cscfg_csdev_enable_config To address this, use cscfg_config_desc's active_cnt as a reference count which will be holded when - activate the config. - enable the activated config. and put the module reference when config_active_cnt == 0. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/dfe8224c9c7a43d356eb9f74b06868aa05f90223 - https://git.kernel.org/st
iner: References: - https://git.kernel.org/stable/c/dfe8224c9c7a43d356eb9f74b06868aa05f90223 - https://git.kernel.org/stable/c/b3b4efa2e623aecaebd7c9b9e4171f5c659e9724 - https://git.kernel.org/stable/c/31028812724cef7bd57a51525ce58a32a6d73b22 - https://git.kernel.org/stable/c/ed42ee1ed05ff2f4c36938379057413a40c56680 - https://git.kernel.org/stable/c/408c97c4a5e0b634dcd15bf8b8808b382e888164
CVE ID: CVE-2025-38132 State: PUBLISHED Published: 2025-07-03T08:35:35.695Z Last Updated: 2025-07-28T04:13:02.340Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: coresight: holding cscfg_csdev_lock while removing cscfg from csdev There'll be possible race scenario for coresight config: CPU0 CPU1 (perf enable) load module cscfg_load_config_sets() activate config. // sysfs (sys_active_cnt == 1) ... cscfg_csdev_enable_active_config() lock(csdev->cscfg_csdev_lock) deactivate config // sysfs (sys_activec_cnt == 0) cscfg_unload_config_sets() <iterating config_csdev_list> cscfg_remove_owned_csdev_configs() // here load config activate
cscfg_unload_config_sets() <iterating config_csdev_list> cscfg_remove_owned_csdev_configs() // here load config activate by CPU1 unlock(csdev->cscfg_csdev_lock) iterating config_csdev_list could be raced with config_csdev_list's entry delete. To resolve this race , hold csdev->cscfg_csdev_lock() while cscfg_remove_owned_csdev_configs() References: - https://git.kernel.org/stable/c/42f8afb0b161631fd1d814d017f75f955475ad41 - https://git.kernel.org/stable/c/53b9e2659719b04f5ba7593f2af0f2335f75e94a