Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-22094 State: PUBLISHED Published: 2025-04-16T14:12:45.512Z Last Updated: 2025-05-26T05:18:20.178Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: powerpc/perf: Fix ref-counting on the PMU 'vpa_pmu' Commit 176cda0619b6 ("powerpc/perf: Add perf interface to expose vpa counters") introduced 'vpa_pmu' to expose Book3s-HV nested APIv2 provided L1<->L2 context switch latency counters to L1 user-space via perf-events. However the newly introduced PMU named 'vpa_pmu' doesn't assign ownership of the PMU to the module 'vpa_pmu'. Consequently the module 'vpa_pmu' can be unloaded while one of the perf-events are still activ
to the module 'vpa_pmu'. Consequently the module 'vpa_pmu' can be unloaded while one of the perf-events are still active, which can lead to kernel oops and panic of the form below on a Pseries-LPAR: BUG: Kernel NULL pointer dereference on read at 0x00000058 <snip> NIP [c000000000506cb8] event_sched_out+0x40/0x258 LR [c00000000050e8a4] __perf_remove_from_context+0x7c/0x2b0 Call Trace: [c00000025fc3fc30] [c00000025f8457a8] 0xc00000025f8457a8 (unreliable) [c00000025fc3fc80] [fffffffffffffee0] 0xfffffffffffffee0 [c00000025fc3fcd0] [c000000000501e70] event_function+0xa8/0x120 <snip> Kernel panic - not syncing: Aiee, killing interrupt handler! Fix this by adding the module ownership to 'vpa_pmu'
snip> Kernel panic - not syncing: Aiee, killing interrupt handler! Fix this by adding the module ownership to 'vpa_pmu' so that the module 'vpa_pmu' is ref-counted and prevented from being unloaded when perf-events are initialized. References: - https://git.kernel.org/stable/c/70ea7c5189197c6f5acdcfd8a2651be2c41e2faa - https://git.kernel.org/stable/c/6cf045b51e2c5721db7e55305f09ee32741e00f9 - https://git.kernel.org/stable/c/ff99d5b6a246715f2257123cdf6c4a29cb33aa78
CVE ID: CVE-2025-22095 State: PUBLISHED Published: 2025-04-16T14:12:46.226Z Last Updated: 2025-11-03T19:42:11.748Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: PCI: brcmstb: Fix error path after a call to regulator_bulk_get() If the regulator_bulk_get() returns an error and no regulators are created, we need to set their number to zero. If we don't do this and the PCIe link up fails, a call to the regulator_bulk_free() will result in a kernel panic. While at it, print the error value, as we cannot return an error upwards as the kernel will WARN() on an error from add_bus(). [kwilczynski: commit log, use comma in the message t
error upwards as the kernel will WARN() on an error from add_bus(). [kwilczynski: commit log, use comma in the message to match style with other similar messages] Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/99a0efba9f903acbdece548862b6b4cbe7d999e1 - https://git.kernel.org/stable/c/eedd054834930b8d678f0776cd4b091b8fffbb4a - https://git.kernel.org/stable/c/df63321a40cc98e52313cffbff376b8ae9ceffa7 - https://git.kernel.org/stable/c/7842e842a9bf6bd5866c84f588353711d131ab1a - https://git.kernel.org/stable/c/6f44e1fdb006db61394aa4d4c25728ada00842e7 - https://git.kernel.org/stable/c/3651ad5249c51cf7eee078e12612557040a6bdb4
CVE ID: CVE-2025-22096 State: PUBLISHED Published: 2025-04-16T14:12:46.933Z Last Updated: 2025-05-26T05:18:22.711Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/msm/gem: Fix error code msm_parse_deps() The SUBMIT_ERROR() macro turns the error code negative. This extra '-' operation turns it back to positive EINVAL again. The error code is passed to ERR_PTR() and since positive values are not an IS_ERR() it eventually will lead to an oops. Delete the '-'. Patchwork: https://patchwork.freedesktop.org/patch/637625/ References: - https://git.kernel.org/stable/c/efe759dcf3352d8379a1adad7b4d14044a4c41a7 - https://git.kernel.org/
637625/ References: - https://git.kernel.org/stable/c/efe759dcf3352d8379a1adad7b4d14044a4c41a7 - https://git.kernel.org/stable/c/0b305b7cadce835505bd93183a599acb1f800a05
CVE ID: CVE-2025-22097 State: PUBLISHED Published: 2025-04-16T14:12:47.649Z Last Updated: 2025-11-03T19:42:13.124Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Fix use after free and double free on init error If the driver initialization fails, the vkms_exit() function might access an uninitialized or freed default_config pointer and it might double free it. Fix both possible errors by initializing default_config only when the driver initialization succeeded. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/49a69f67f53518bdd9b7eeebf019a2da6cc0e
lnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/49a69f67f53518bdd9b7eeebf019a2da6cc0e954 - https://git.kernel.org/stable/c/79d138d137b80eeb0a83244d1cff29e64cf91067 - https://git.kernel.org/stable/c/561fc0c5cf41f646f3e9e61784cbc0fc832fb936 - https://git.kernel.org/stable/c/d5eb8e347905ab17788a7903fa1d3d06747355f5 - https://git.kernel.org/stable/c/b8a18bb53e06d6d3c1fd03d12533d6e333ba8853 - https://git.kernel.org/stable/c/1f68f1cf09d06061eb549726ff8339e064eddebd - https://git.kernel.org/stable/c/ed15511a773df86205bda66c37193569575ae828
CVE ID: CVE-2025-22098 State: PUBLISHED Published: 2025-04-16T14:12:48.356Z Last Updated: 2025-05-26T05:18:25.260Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm: zynqmp_dp: Fix a deadlock in zynqmp_dp_ignore_hpd_set() Instead of attempting the same mutex twice, lock and unlock it. This bug has been detected by the Clang thread-safety analyzer. References: - https://git.kernel.org/stable/c/3f988cd2f65175e79349961a43a9deb115174784 - https://git.kernel.org/stable/c/7a8d53aa5b7d2a89cda598239d08423bd66920f1 - https://git.kernel.org/stable/c/f887685ee0eb4ef716391355568181230338f6eb
CVE ID: CVE-2025-22099 State: PUBLISHED Published: 2025-04-16T14:12:49.189Z Last Updated: 2025-05-26T05:18:26.526Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm: xlnx: zynqmp_dpsub: Add NULL check in zynqmp_audio_init devm_kasprintf() calls can return null pointers on failure. But some return values were not checked in zynqmp_audio_init(). Add NULL check in zynqmp_audio_init(), avoid referencing null pointers in the subsequent code. References: - https://git.kernel.org/stable/c/066d6f22e7d84953db6bbf2dae507401157660c6 - https://git.kernel.org/stable/c/d0660f9c588a1246a1a543c91a1e3cad910237da
CVE ID: CVE-2025-22100 State: PUBLISHED Published: 2025-04-16T14:12:49.851Z Last Updated: 2025-05-26T05:18:27.731Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix race condition when gathering fdinfo group samples Commit e16635d88fa0 ("drm/panthor: add DRM fdinfo support") failed to protect access to groups with an xarray lock, which could lead to use-after-free errors. References: - https://git.kernel.org/stable/c/6d98c83ad67e7bd86a47494fd6c3863e7bb26db9 - https://git.kernel.org/stable/c/e9d45f42a64a400adba59ee83d03e6db662530b4 - https://git.kernel.org/stable/c/0590c94c3596d6c1a3d549ae611366f2ad4e1d8d
CVE ID: CVE-2025-22101 State: PUBLISHED Published: 2025-04-16T14:12:50.498Z Last Updated: 2025-07-06T09:08:51.877Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix Tx L4 checksum The hardware only supports L4 checksum offload for TCP/UDP/SCTP protocol. There was a bug to set Tx checksum flag for the other protocol that results in Tx ring hang. Fix to compute software checksum for these packets. References: - https://git.kernel.org/stable/c/6d56ea133adf0389b216ba6e47f7f35e95776713 - https://git.kernel.org/stable/c/5f583e059eced1857f41e221ef5951e029e632bd - https://git.kernel.org/stable/c/c7d82913d5f9e97860772ee4051
rnel.org/stable/c/5f583e059eced1857f41e221ef5951e029e632bd - https://git.kernel.org/stable/c/c7d82913d5f9e97860772ee4051eaa66b56a6273
CVE ID: CVE-2025-22102 State: PUBLISHED Published: 2025-04-16T14:12:51.482Z Last Updated: 2025-05-26T05:18:30.231Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix kernel panic during FW release This fixes a kernel panic seen during release FW in a stress test scenario where WLAN and BT FW download occurs simultaneously, and due to a HW bug, chip sends out only 1 bootloader signatures. When driver receives the bootloader signature, it enters FW download mode, but since no consequtive bootloader signatures seen, FW file is not requested. After 60 seconds, when FW download times out, release_firmware cause
otloader signatures seen, FW file is not requested. After 60 seconds, when FW download times out, release_firmware causes a kernel panic. [ 2601.949184] Unable to handle kernel paging request at virtual address 0000312e6f006573 [ 2601.992076] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000111802000 [ 2601.992080] [0000312e6f006573] pgd=0000000000000000, p4d=0000000000000000 [ 2601.992087] Internal error: Oops: 0000000096000021 [#1] PREEMPT SMP [ 2601.992091] Modules linked in: algif_hash algif_skcipher af_alg btnxpuart(O) pciexxx(O) mlan(O) overlay fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine authenc libdes crct10dif_ce polyval_ce snd_soc_fsl_easrc snd_soc_fs
eyblob_desc caamhash_desc caamalg_desc crypto_engine authenc libdes crct10dif_ce polyval_ce snd_soc_fsl_easrc snd_soc_fsl_asoc_card imx8_media_dev(C) snd_soc_fsl_micfil polyval_generic snd_soc_fsl_xcvr snd_soc_fsl_sai snd_soc_imx_audmux snd_soc_fsl_asrc snd_soc_imx_card snd_soc_imx_hdmi snd_soc_fsl_aud2htx snd_soc_fsl_utils imx_pcm_dma dw_hdmi_cec flexcan can_dev [ 2602.001825] CPU: 2 PID: 20060 Comm: hciconfig Tainted: G C O 6.6.23-lts-next-06236-gb586a521770e #1 [ 2602.010182] Hardware name: NXP i.MX8MPlus EVK board (DT) [ 2602.010185] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 2602.010191] pc : _raw_spin_lock+0x34/0x68 [ 2602.010201] lr : free_fw_priv+0x20/0xfc [ 26
O -TCO -DIT -SSBS BTYPE=--) [ 2602.010191] pc : _raw_spin_lock+0x34/0x68 [ 2602.010201] lr : free_fw_priv+0x20/0xfc [ 2602.020561] sp : ffff800089363b30 [ 2602.020563] x29: ffff800089363b30 x28: ffff0000d0eb5880 x27: 0000000000000000 [ 2602.020570] x26: 0000000000000000 x25: ffff0000d728b330 x24: 0000000000000000 [ 2602.020577] x23: ffff0000dc856f38 [ 2602.033797] x22: ffff800089363b70 x21: ffff0000dc856000 [ 2602.033802] x20: ff00312e6f006573 x19: ffff0000d0d9ea80 x18: 0000000000000000 [ 2602.033809] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaad80dd480 [ 2602.083320] x14: 0000000000000000 x13: 00000000000001b9 x12: 0000000000000002 [ 2602.083326] x11: 0000000000000000 x10: 0000
083320] x14: 0000000000000000 x13: 00000000000001b9 x12: 0000000000000002 [ 2602.083326] x11: 0000000000000000 x10: 0000000000000a60 x9 : ffff800089363a30 [ 2602.083333] x8 : ffff0001793d75c0 x7 : ffff0000d6dbc400 x6 : 0000000000000000 [ 2602.083339] x5 : 00000000410fd030 x4 : 0000000000000000 x3 : 0000000000000001 [ 2602.083346] x2 : 0000000000000000 x1 : 0000000000000001 x0 : ff00312e6f006573 [ 2602.083354] Call trace: [ 2602.083356] _raw_spin_lock+0x34/0x68 [ 2602.083364] release_firmware+0x48/0x6c [ 2602.083370] nxp_setup+0x3c4/0x540 [btnxpuart] [ 2602.083383] hci_dev_open_sync+0xf0/0xa34 [ 2602.083391] hci_dev_open+0xd8/0x178 [ 2602.083399] hci_sock_ioctl+0x3b0/0x590 [ 2602.083405] sock
pen_sync+0xf0/0xa34 [ 2602.083391] hci_dev_open+0xd8/0x178 [ 2602.083399] hci_sock_ioctl+0x3b0/0x590 [ 2602.083405] sock_do_ioctl+0x60/0x118 [ 2602.083413] sock_ioctl+0x2f4/0x374 [ 2602.091430] __arm64_sys_ioctl+0xac/0xf0 [ 2602.091437] invoke_syscall+0x48/0x110 [ 2602.091445] el0_svc_common.constprop.0+0xc0/0xe0 [ 2602.091452] do_el0_svc+0x1c/0x28 [ 2602.091457] el0_svc+0x40/0xe4 [ 2602.091465] el0t_64_sync_handler+0x120/0x12c [ 2602.091470] el0t_64_sync+0x190/0x194 References: - https://git.kernel.org/stable/c/a0a736d9857cadd87ae48b151d787e28954ea831 - https://git.kernel.org/stable/c/d22496de5049d9b8f5b6d8623682a56b3c3d7e18 - https://git.kernel.org/stable/c/6749cf49eff7ce6dadcb603c5c8db70b
org/stable/c/d22496de5049d9b8f5b6d8623682a56b3c3d7e18 - https://git.kernel.org/stable/c/6749cf49eff7ce6dadcb603c5c8db70b28079a5d - https://git.kernel.org/stable/c/1f77c05408c96bc0b58ae476a9cadc9e5b9cfd0f
CVE ID: CVE-2025-22103 State: PUBLISHED Published: 2025-04-16T14:12:52.164Z Last Updated: 2025-11-24T09:49:39.955Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: fix NULL pointer dereference in l3mdev_l3_rcv When delete l3s ipvlan: ip link del link eth0 ipvlan1 type ipvlan mode l3s This may cause a null pointer dereference: Call trace: ip_rcv_finish+0x48/0xd0 ip_rcv+0x5c/0x100 __netif_receive_skb_one_core+0x64/0xb0 __netif_receive_skb+0x20/0x80 process_backlog+0xb4/0x204 napi_poll+0xe8/0x294 net_rx_action+0xd8/0x22c __do_softirq+0x12c/0x354 This is because l3mdev_l3_rcv() visit dev->l3mdev_ops after ipvlan_l3s_unregister()
+0xd8/0x22c __do_softirq+0x12c/0x354 This is because l3mdev_l3_rcv() visit dev->l3mdev_ops after ipvlan_l3s_unregister() assign the dev->l3mdev_ops to NULL. The process like this: (CPU1) | (CPU2) l3mdev_l3_rcv() | check dev->priv_flags: | master = skb->dev; | | | ipvlan_l3s_unregister() | set dev->priv_flags | dev->l3mdev_ops = NULL; | visit master->l3mdev_ops | To avoid this by do not set dev->l3mdev_ops when unregister l3s ipvlan. References: - https://git.kernel.org/stable/c/52b44d8c653459c658b733d13658afdde45f6836 - https://git.kernel.org/stable/c/59599bce44af3df7a215ebc81cb166426e1c9204 - https://git.kernel.org/stable/c/f9dff65140efc289f01bcf39c3ca66a8806b6132 - https://git.kernel.org/s
c81cb166426e1c9204 - https://git.kernel.org/stable/c/f9dff65140efc289f01bcf39c3ca66a8806b6132 - https://git.kernel.org/stable/c/0032c99e83b9ce6d5995d65900aa4b6ffb501cce
CVE ID: CVE-2025-22104 State: PUBLISHED Published: 2025-04-16T14:12:53.118Z Last Updated: 2025-05-26T05:18:32.911Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Use kernel helpers for hex dumps Previously, when the driver was printing hex dumps, the buffer was cast to an 8 byte long and printed using string formatters. If the buffer size was not a multiple of 8 then a read buffer overflow was possible. Therefore, create a new ibmvnic function that loops over a buffer and calls hex_dump_to_buffer instead. This patch address KASAN reports like the one below: ibmvnic 30000003 env3: Login Buffer: ibmvnic 30000003 env3: 01
ead. This patch address KASAN reports like the one below: ibmvnic 30000003 env3: Login Buffer: ibmvnic 30000003 env3: 01000000af000000 <...> ibmvnic 30000003 env3: 2e6d62692e736261 ibmvnic 30000003 env3: 65050003006d6f63 ================================================================== BUG: KASAN: slab-out-of-bounds in ibmvnic_login+0xacc/0xffc [ibmvnic] Read of size 8 at addr c0000001331a9aa8 by task ip/17681 <...> Allocated by task 17681: <...> ibmvnic_login+0x2f0/0xffc [ibmvnic] ibmvnic_open+0x148/0x308 [ibmvnic] __dev_open+0x1ac/0x304 <...> The buggy address is located 168 bytes inside of allocated 175-byte region [c0000001331a9a00, c0000001331a9aaf) <...> ==============================
168 bytes inside of allocated 175-byte region [c0000001331a9a00, c0000001331a9aaf) <...> ================================================================= ibmvnic 30000003 env3: 000000000033766e References: - https://git.kernel.org/stable/c/ae6b1d6c1acee3a2000394d83ec9f1028321e207 - https://git.kernel.org/stable/c/d93a6caab5d7d9b5ce034d75b1e1e993338e3852
CVE ID: CVE-2025-22105 State: PUBLISHED Published: 2025-04-16T14:12:53.830Z Last Updated: 2025-11-02T13:30:25.906Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bonding: check xdp prog when set bond mode Following operations can trigger a warning[1]: ip netns add ns1 ip netns exec ns1 ip link add bond0 type bond mode balance-rr ip netns exec ns1 ip link set dev bond0 xdp obj af_xdp_kern.o sec xdp ip netns exec ns1 ip link set bond0 type bond mode broadcast ip netns del ns1 When delete the namespace, dev_xdp_uninstall() is called to remove xdp program on bond dev, and bond_xdp_set() will check the bond mode. If bond mode is cha
ninstall() is called to remove xdp program on bond dev, and bond_xdp_set() will check the bond mode. If bond mode is changed after attaching xdp program, the warning may occur. Some bond modes (broadcast, etc.) do not support native xdp. Set bond mode with xdp program attached is not good. Add check for xdp program when set bond mode. [1] ------------[ cut here ]------------ WARNING: CPU: 0 PID: 11 at net/core/dev.c:9912 unregister_netdevice_many_notify+0x8d9/0x930 Modules linked in: CPU: 0 UID: 0 PID: 11 Comm: kworker/u4:0 Not tainted 6.14.0-rc4 #107 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 Workqueue: netns cleanup_n
andard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 Workqueue: netns cleanup_net RIP: 0010:unregister_netdevice_many_notify+0x8d9/0x930 Code: 00 00 48 c7 c6 6f e3 a2 82 48 c7 c7 d0 b3 96 82 e8 9c 10 3e ... RSP: 0018:ffffc90000063d80 EFLAGS: 00000282 RAX: 00000000ffffffa1 RBX: ffff888004959000 RCX: 00000000ffffdfff RDX: 0000000000000000 RSI: 00000000ffffffea RDI: ffffc90000063b48 RBP: ffffc90000063e28 R08: ffffffff82d39b28 R09: 0000000000009ffb R10: 0000000000000175 R11: ffffffff82d09b40 R12: ffff8880049598e8 R13: 0000000000000001 R14: dead000000000100 R15: ffffc90000045000 FS: 0000000000000000(0000) GS:ffff888007a00000(0000) knlGS:0000000000000000 CS
4: dead000000000100 R15: ffffc90000045000 FS: 0000000000000000(0000) GS:ffff888007a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000d406b60 CR3: 000000000483e000 CR4: 00000000000006f0 Call Trace: <TASK> ? __warn+0x83/0x130 ? unregister_netdevice_many_notify+0x8d9/0x930 ? report_bug+0x18e/0x1a0 ? handle_bug+0x54/0x90 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? unregister_netdevice_many_notify+0x8d9/0x930 ? bond_net_exit_batch_rtnl+0x5c/0x90 cleanup_net+0x237/0x3d0 process_one_work+0x163/0x390 worker_thread+0x293/0x3b0 ? __pfx_worker_thread+0x10/0x10 kthread+0xec/0x1e0 ? __pfx_kthread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_
3/0x3b0 ? __pfx_worker_thread+0x10/0x10 kthread+0xec/0x1e0 ? __pfx_kthread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2f/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> ---[ end trace 0000000000000000 ]--- References: - https://git.kernel.org/stable/c/6f3af8055ee7ab69d1451f056fcd890df99c167e - https://git.kernel.org/stable/c/0dd4fac43bdea23cfe4bb2a3eabb76d752ac32fb - https://git.kernel.org/stable/c/094ee6017ea09c11d6af187935a949df32803ce0
CVE ID: CVE-2025-22106 State: PUBLISHED Published: 2025-04-16T14:12:54.461Z Last Updated: 2025-09-25T09:49:08.249Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: vmxnet3: unregister xdp rxq info in the reset path vmxnet3 does not unregister xdp rxq info in the vmxnet3_reset_work() code path as vmxnet3_rq_destroy() is not invoked in this code path. So, we get below message with a backtrace. Missing unregister, handled but fix driver WARNING: CPU:48 PID: 500 at net/core/xdp.c:182 __xdp_rxq_info_reg+0x93/0xf0 This patch fixes the problem by moving the unregister code of XDP from vmxnet3_rq_destroy() to vmxnet3_rq_cleanup(). Refere
s patch fixes the problem by moving the unregister code of XDP from vmxnet3_rq_destroy() to vmxnet3_rq_cleanup(). References: - https://git.kernel.org/stable/c/a6157484bee3385a425d288a69e1eaf03232f5fc - https://git.kernel.org/stable/c/23da4e0bb2a38966d29db0ff90a8fe68fdfa1744 - https://git.kernel.org/stable/c/9908541a9e235b7c5e2fbdd59910eaf9c32c3075 - https://git.kernel.org/stable/c/0dd765fae295832934bf28e45dd5a355e0891ed4
CVE ID: CVE-2025-22107 State: PUBLISHED Published: 2025-04-16T14:12:55.109Z Last Updated: 2025-11-24T09:49:41.964Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() There are actually 2 problems: - deleting the last element doesn't require the memmove of elements [i + 1, end) over it. Actually, element i+1 is out of bounds. - The memmove itself should move size - i - 1 elements, because the last element is out of bounds. The out-of-bounds element still remains out of bounds after being accessed, so the problem is only that we touch it, not that it b
-bounds element still remains out of bounds after being accessed, so the problem is only that we touch it, not that it becomes in active use. But I suppose it can lead to issues if the out-of-bounds element is part of an unmapped page. References: - https://git.kernel.org/stable/c/031e00249e9e6bee72ba66701c8f83b45fc4b8a2 - https://git.kernel.org/stable/c/59b97641de03c081f26b3a8876628c765b5faa25 - https://git.kernel.org/stable/c/5f2b28b79d2d1946ee36ad8b3dc0066f73c90481
CVE ID: CVE-2025-22108 State: PUBLISHED Published: 2025-04-16T14:12:55.737Z Last Updated: 2025-05-26T05:18:38.511Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Mask the bd_cnt field in the TX BD properly The bd_cnt field in the TX BD specifies the total number of BDs for the TX packet. The bd_cnt field has 5 bits and the maximum number supported is 32 with the value 0. CONFIG_MAX_SKB_FRAGS can be modified and the total number of SKB fragments can approach or exceed the maximum supported by the chip. Add a macro to properly mask the bd_cnt field so that the value 32 will be properly masked and set to 0 in the bd_cnd f
Add a macro to properly mask the bd_cnt field so that the value 32 will be properly masked and set to 0 in the bd_cnd field. Without this patch, the out-of-range bd_cnt value will corrupt the TX BD and may cause TX timeout. The next patch will check for values exceeding 32. References: - https://git.kernel.org/stable/c/f60b41b815826f15c4d0323f923f398c423178d0 - https://git.kernel.org/stable/c/107b25db61122d8f990987895c2912927b8b6e3f
CVE ID: CVE-2025-22109 State: PUBLISHED Published: 2025-04-16T14:12:56.405Z Last Updated: 2025-05-26T05:18:39.940Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ax25: Remove broken autobind Binding AX25 socket by using the autobind feature leads to memory leaks in ax25_connect() and also refcount leaks in ax25_release(). Memory leak was detected with kmemleak: ================================================================ unreferenced object 0xffff8880253cd680 (size 96): backtrace: __kmalloc_node_track_caller_noprof (./include/linux/kmemleak.h:43) kmemdup_noprof (mm/util.c:136) ax25_rt_autobind (net/ax25/ax25_route.c:428) ax
er_noprof (./include/linux/kmemleak.h:43) kmemdup_noprof (mm/util.c:136) ax25_rt_autobind (net/ax25/ax25_route.c:428) ax25_connect (net/ax25/af_ax25.c:1282) __sys_connect_file (net/socket.c:2045) __sys_connect (net/socket.c:2064) __x64_sys_connect (net/socket.c:2067) do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) ================================================================ When socket is bound, refcounts must be incremented the way it is done in ax25_bind() and ax25_setsockopt() (SO_BINDTODEVICE). In case of autobind, the refcounts are not incremented. This bug leads to the following issue reported by S