Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
turn_thunk+0x5/0x5f [ +0.000004] ? up_write+0x55/0xb0 [ +0.000007] ? srso_return_thunk+0x5/0x5f [ +0.000005] ? blocking_notifier_chain_unregister+0x6c/0xc0 [ +0.000008] amdgpu_driver_unload_kms+0x69/0x90 [amdgpu] [ +0.000484] amdgpu_pci_remove+0x93/0x130 [amdgpu] [ +0.000482] pci_device_remove+0xae/0x1e0 [ +0.000008] device_remove+0xc7/0x180 [ +0.000008] device_release_driver_internal+0x3d4/0x5a0 [ +0.000007] device_release_driver+0x12/0x20 [ +0.000004] pci_stop_bus_device+0x104/0x150 [ +0.000006] pci_stop_and_remove_bus_device_locked+0x1b/0x40 [ +0.000005] remove_store+0xd7/0xf0 [ +0.000005] ? __pfx_remove_store+0x10/0x10 [ +0.000006] ? __pfx__copy_from_iter+0x10/0x10 [ +0.000006] ? __pfx_d
7/0xf0 [ +0.000005] ? __pfx_remove_store+0x10/0x10 [ +0.000006] ? __pfx__copy_from_iter+0x10/0x10 [ +0.000006] ? __pfx_dev_attr_store+0x10/0x10 [ +0.000006] dev_attr_store+0x3f/0x80 [ +0.000006] sysfs_kf_write+0x125/0x1d0 [ +0.000004] ? srso_return_thunk+0x5/0x5f [ +0.000005] ? __kasan_check_write+0x14/0x30 [ +0.000005] kernfs_fop_write_iter+0x2ea/0x490 [ +0.000005] ? rw_verify_area+0x70/0x420 [ +0.000005] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ +0.000006] vfs_write+0x90d/0xe70 [ +0.000005] ? srso_return_thunk+0x5/0x5f [ +0.000005] ? __pfx_vfs_write+0x10/0x10 [ +0.000004] ? local_clock+0x15/0x30 [ +0.000008] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? __kasan_slab_free+0x5f/0x80 [ +0.00000
? local_clock+0x15/0x30 [ +0.000008] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? __kasan_slab_free+0x5f/0x80 [ +0.000005] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? __kasan_check_read+0x11/0x20 [ +0.000004] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? fdget_pos+0x1d3/0x500 [ +0.000007] ksys_write+0x119/0x220 [ +0.000005] ? putname+0x1c/0x30 [ +0.000006] ? __pfx_ksys_write+0x10/0x10 [ +0.000007] __x64_sys_write+0x72/0xc0 [ +0.000006] x64_sys_call+0x18ab/0x26f0 [ +0.000006] do_syscall_64+0x7c/0x170 [ +0.000004] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? __pfx___x64_sys_openat+0x10/0x10 [ +0.000006] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? __kasan_check_read+0x11/0x20 [ +0.000003] ? srso_r
at+0x10/0x10 [ +0.000006] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? __kasan_check_read+0x11/0x20 [ +0.000003] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? fpregs_assert_state_consistent+0x21/0xb0 [ +0.000006] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? syscall_exit_to_user_mode+0x4e/0x240 [ +0.000005] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? do_syscall_64+0x88/0x170 [ +0.000003] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? irqentry_exit+0x43/0x50 [ +0.000004] ? srso_return_thunk+0x5 ---truncated--- References: - https://git.kernel.org/stable/c/96f663ae897b3e6ac17ced1d9b9c2ae9f165ad9a - https://git.kernel.org/stable/c/a886d26f2c8f9e3f3c1869ae368d09c75daac553
CVE ID: CVE-2025-38599 State: PUBLISHED Published: 2025-08-19T17:03:34.029Z Last Updated: 2025-09-29T05:54:33.469Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible OOB access in mt7996_tx() Fis possible Out-Of-Boundary access in mt7996_tx routine if link_id is set to IEEE80211_LINK_UNSPECIFIED References: - https://git.kernel.org/stable/c/f82eabd0ff8067d1ee95515f4174c9a9569d54cb - https://git.kernel.org/stable/c/f43e7d8ae4b6a73213032545552bab26f76f113a - https://git.kernel.org/stable/c/64cbf0d7ce9afe20666da90ec6ecaec6ba5ac64b
CVE ID: CVE-2025-38600 State: PUBLISHED Published: 2025-08-19T17:03:34.830Z Last Updated: 2025-09-29T05:54:34.694Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix off by one in mt7925_mcu_hw_scan() The ssid->ssids[] and sreq->ssids[] arrays have MT7925_RNR_SCAN_MAX_BSSIDS elements so this >= needs to be > to prevent an out of bounds access. References: - https://git.kernel.org/stable/c/4d80d4fa986c5da99042b66bf30a028e7f564156 - https://git.kernel.org/stable/c/b3a431fe2e399b2e0cc5f43f7e9d63d63d3710ee
CVE ID: CVE-2025-38601 State: PUBLISHED Published: 2025-08-19T17:03:35.798Z Last Updated: 2025-11-03T17:40:15.658Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: clear initialized flag for deinit-ed srng lists In a number of cases we see kernel panics on resume due to ath11k kernel page fault, which happens under the following circumstances: 1) First ath11k_hal_dump_srng_stats() call Last interrupt received for each group: ath11k_pci 0000:01:00.0: group_id 0 22511ms before ath11k_pci 0000:01:00.0: group_id 1 14440788ms before [..] ath11k_pci 0000:01:00.0: failed to receive control response completion, polling.. at
: group_id 1 14440788ms before [..] ath11k_pci 0000:01:00.0: failed to receive control response completion, polling.. ath11k_pci 0000:01:00.0: Service connect timeout ath11k_pci 0000:01:00.0: failed to connect to HTT: -110 ath11k_pci 0000:01:00.0: failed to start core: -110 ath11k_pci 0000:01:00.0: firmware crashed: MHI_CB_EE_RDDM ath11k_pci 0000:01:00.0: already resetting count 2 ath11k_pci 0000:01:00.0: failed to wait wlan mode request (mode 4): -110 ath11k_pci 0000:01:00.0: qmi failed to send wlan mode off: -110 ath11k_pci 0000:01:00.0: failed to reconfigure driver on crash recovery [..] 2) At this point reconfiguration fails (we have 2 resets) and ath11k_core_reconfigure_on_crash() calls
ash recovery [..] 2) At this point reconfiguration fails (we have 2 resets) and ath11k_core_reconfigure_on_crash() calls ath11k_hal_srng_deinit() which destroys srng lists. However, it does not reset per-list ->initialized flag. 3) Second ath11k_hal_dump_srng_stats() call sees stale ->initialized flag and attempts to dump srng stats: Last interrupt received for each group: ath11k_pci 0000:01:00.0: group_id 0 66785ms before ath11k_pci 0000:01:00.0: group_id 1 14485062ms before ath11k_pci 0000:01:00.0: group_id 2 14485062ms before ath11k_pci 0000:01:00.0: group_id 3 14485062ms before ath11k_pci 0000:01:00.0: group_id 4 14780845ms before ath11k_pci 0000:01:00.0: group_id 5 14780845ms before ath
s before ath11k_pci 0000:01:00.0: group_id 4 14780845ms before ath11k_pci 0000:01:00.0: group_id 5 14780845ms before ath11k_pci 0000:01:00.0: group_id 6 14485062ms before ath11k_pci 0000:01:00.0: group_id 7 66814ms before ath11k_pci 0000:01:00.0: group_id 8 68997ms before ath11k_pci 0000:01:00.0: group_id 9 67588ms before ath11k_pci 0000:01:00.0: group_id 10 69511ms before BUG: unable to handle page fault for address: ffffa007404eb010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 100000067 P4D 100000067 PUD 10022d067 PMD 100b01067 PTE 0 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:ath11k_hal_dump_srng_stats+0x2b4/0x3b0 [ath11k] Call Trace: <TASK> ?
PTE 0 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:ath11k_hal_dump_srng_stats+0x2b4/0x3b0 [ath11k] Call Trace: <TASK> ? __die_body+0xae/0xb0 ? page_fault_oops+0x381/0x3e0 ? exc_page_fault+0x69/0xa0 ? asm_exc_page_fault+0x22/0x30 ? ath11k_hal_dump_srng_stats+0x2b4/0x3b0 [ath11k (HASH:6cea 4)] ath11k_qmi_driver_event_work+0xbd/0x1050 [ath11k (HASH:6cea 4)] worker_thread+0x389/0x930 kthread+0x149/0x170 Clear per-list ->initialized flag in ath11k_hal_srng_deinit(). Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/3a6daae987a829534636fd85ed6f84d5f0ad7fa4 - https://git.kernel.org/stable/c/eff3bb53c18c0ed4ab6f43d412b3ed3aecad52d5 - https://git.kernel.
636fd85ed6f84d5f0ad7fa4 - https://git.kernel.org/stable/c/eff3bb53c18c0ed4ab6f43d412b3ed3aecad52d5 - https://git.kernel.org/stable/c/916ac18d526a26f6072866b1a97622cf1351ef1c - https://git.kernel.org/stable/c/5bf201c55fdf303e79005038648dfa1e8af48f54 - https://git.kernel.org/stable/c/72a48be1f53942793f3bc68a37fad1f38b53b082 - https://git.kernel.org/stable/c/0ebb5fe494501c19f31270008b26ab95201af6fd - https://git.kernel.org/stable/c/16872194c80f2724472fc207991712895ac8a230 - https://git.kernel.org/stable/c/a5b46aa7cf5f05c213316a018e49a8e086efd98e
CVE ID: CVE-2025-38602 State: PUBLISHED Published: 2025-08-19T17:03:41.604Z Last Updated: 2025-11-03T17:40:17.635Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iwlwifi: Add missing check for alloc_ordered_workqueue Add check for the return value of alloc_ordered_workqueue since it may return NULL pointer. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/c80832d445653baba5ac80cd2c2637c437ac881b - https://git.kernel.org/stable/c/b398120fbe0acfef60b16f6a0f69902d385d7728 - https://git.kernel.org/stable/c/2e9f85ee3b46453a2f250a57d3a9f10c70c71202 - https://git.kernel.org/stable/c/6663
5d7728 - https://git.kernel.org/stable/c/2e9f85ee3b46453a2f250a57d3a9f10c70c71202 - https://git.kernel.org/stable/c/6663c52608d8d8727bf1911e6d9218069ba1c85e - https://git.kernel.org/stable/c/ca980f1911a7144d451d1c31298ab8507c6bd88f - https://git.kernel.org/stable/c/7dd6350307af6521b6240b295c93b7eec4daebe6 - https://git.kernel.org/stable/c/c0e43c3f6c0a79381b468574c241065998412b7c - https://git.kernel.org/stable/c/70a1b527eaea9430b1bd87de59f3b9f6bd225701 - https://git.kernel.org/stable/c/90a0d9f339960448a3acc1437a46730f975efd6a
CVE ID: CVE-2025-38603 State: REJECTED Published: 2025-08-19T17:03:42.409Z Last Updated: 2025-09-05T07:59:09.192Z Description: No description available.
CVE ID: CVE-2025-38604 State: PUBLISHED Published: 2025-08-19T17:03:43.358Z Last Updated: 2025-11-03T17:40:19.561Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: rtl818x: Kill URBs before clearing tx status queue In rtl8187_stop() move the call of usb_kill_anchored_urbs() before clearing b_tx_status.queue. This change prevents callbacks from using already freed skb due to anchor was not killed before freeing such skb. BUG: kernel NULL pointer dereference, address: 0000000000000080 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 7 UID: 0
cess in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Not tainted 6.15.0 #8 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 RIP: 0010:ieee80211_tx_status_irqsafe+0x21/0xc0 [mac80211] Call Trace: <IRQ> rtl8187_tx_cb+0x116/0x150 [rtl8187] __usb_hcd_giveback_urb+0x9d/0x120 usb_giveback_urb_bh+0xbb/0x140 process_one_work+0x19b/0x3c0 bh_worker+0x1a7/0x210 tasklet_action+0x10/0x30 handle_softirqs+0xf0/0x340 __irq_exit_rcu+0xcd/0xf0 common_interrupt+0x85/0xa0 </IRQ> Tested on RTL8187BvE device. Found by Linux Verification Center (linuxtesting.org) with SVACE. Add
rupt+0x85/0xa0 </IRQ> Tested on RTL8187BvE device. Found by Linux Verification Center (linuxtesting.org) with SVACE. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/e64732ebff9e24258e7326f07adbe2f2b990daf8 - https://git.kernel.org/stable/c/789415771422f4fb9f444044f86ecfaec55df1bd - https://git.kernel.org/stable/c/c73c773b09e313278f9b960303a2809b8440bac6 - https://git.kernel.org/stable/c/8c767727f331fb9455b0f81daad832b5925688cb - https://git.kernel.org/stable/c/14ca6952691fa8cc91e7644512e6ff24a595283f - https://git.kernel.org/stable/c/7858a95566f4ebf59524666683d2dcdba3fca968 - https://git.kernel.org/stable/c/c51a45ad9070a6d296174fcbe5c466352836
stable/c/7858a95566f4ebf59524666683d2dcdba3fca968 - https://git.kernel.org/stable/c/c51a45ad9070a6d296174fcbe5c466352836c12b - https://git.kernel.org/stable/c/81cfe34d0630de4e23ae804dcc08fb6f861dc37d - https://git.kernel.org/stable/c/16d8fd74dbfca0ea58645cd2fca13be10cae3cdd
CVE ID: CVE-2025-38605 State: PUBLISHED Published: 2025-08-19T17:03:49.295Z Last Updated: 2025-09-29T05:54:39.359Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() In ath12k_dp_tx_get_encap_type(), the arvif parameter is only used to retrieve the ab pointer. In vdev delete sequence the arvif->ar could become NULL and that would trigger kernel panic. Since the caller ath12k_dp_tx() already has a valid ab pointer, pass it directly to avoid panic and unnecessary dereferencing. PC points to "ath12k_dp_tx+0x228/0x988 [ath12k]" LR points to "ath12k_dp_tx+0xc8/0x988
ic and unnecessary dereferencing. PC points to "ath12k_dp_tx+0x228/0x988 [ath12k]" LR points to "ath12k_dp_tx+0xc8/0x988 [ath12k]". The Backtrace obtained is as follows: ath12k_dp_tx+0x228/0x988 [ath12k] ath12k_mac_tx_check_max_limit+0x608/0x920 [ath12k] ieee80211_process_measurement_req+0x320/0x348 [mac80211] ieee80211_tx_dequeue+0x9ac/0x1518 [mac80211] ieee80211_tx_dequeue+0xb14/0x1518 [mac80211] ieee80211_tx_prepare_skb+0x224/0x254 [mac80211] ieee80211_xmit+0xec/0x100 [mac80211] __ieee80211_subif_start_xmit+0xc50/0xf40 [mac80211] ieee80211_subif_start_xmit+0x2e8/0x308 [mac80211] netdev_start_xmit+0x150/0x18c dev_hard_start_xmit+0x74/0xc0 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-Q
ac80211] netdev_start_xmit+0x150/0x18c dev_hard_start_xmit+0x74/0xc0 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 References: - https://git.kernel.org/stable/c/b508f370f88f277c95e2bd3bc47217a96d668cee - https://git.kernel.org/stable/c/ee4f8e7fa578f9f28cef5f409677db25f4f83d7e - https://git.kernel.org/stable/c/05062834350f0bf7ad1abcebc2807220e90220eb
CVE ID: CVE-2025-38606 State: PUBLISHED Published: 2025-08-19T17:03:50.189Z Last Updated: 2025-09-29T05:54:40.540Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Avoid accessing uninitialized arvif->ar during beacon miss During beacon miss handling, ath12k driver iterates over active virtual interfaces (vifs) and attempts to access the radio object (ar) via arvif->deflink->ar. However, after commit aa80f12f3bed ("wifi: ath12k: defer vdev creation for MLO"), arvif is linked to a radio only after vdev creation, typically when a channel is assigned or a scan is requested. For P2P capable devices, a default P2P interf
dev creation, typically when a channel is assigned or a scan is requested. For P2P capable devices, a default P2P interface is created by wpa_supplicant along with regular station interfaces, these serve as dummy interfaces for P2P-capable stations, lack an associated netdev and initiate frequent scans to discover neighbor p2p devices. When a scan is initiated on such P2P vifs, driver selects destination radio (ar) based on scan frequency, creates a scan vdev, and attaches arvif to the radio. Once the scan completes or is aborted, the scan vdev is deleted, detaching arvif from the radio and leaving arvif->ar uninitialized. While handling beacon miss for station interfaces, P2P interface is a
rom the radio and leaving arvif->ar uninitialized. While handling beacon miss for station interfaces, P2P interface is also encountered in the vif iteration and ath12k_mac_handle_beacon_miss_iter() tries to dereference the uninitialized arvif->deflink->ar. Fix this by verifying that vdev is created for the arvif before accessing its ar during beacon miss handling and similar vif iterator callbacks. ========================================================================== wlp6s0: detected beacon loss from AP (missed 7 beacons) - probing KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 5 UID: 0 PID: 0 Comm: swapper/5 Not tainted 6.16.0-rc1-wt-ath+ #2 PREEMPT(full) R
0000000000010-0x0000000000000017] CPU: 5 UID: 0 PID: 0 Comm: swapper/5 Not tainted 6.16.0-rc1-wt-ath+ #2 PREEMPT(full) RIP: 0010:ath12k_mac_handle_beacon_miss_iter+0xb5/0x1a0 [ath12k] Call Trace: __iterate_interfaces+0x11a/0x410 [mac80211] ieee80211_iterate_active_interfaces_atomic+0x61/0x140 [mac80211] ath12k_mac_handle_beacon_miss+0xa1/0xf0 [ath12k] ath12k_roam_event+0x393/0x560 [ath12k] ath12k_wmi_op_rx+0x1486/0x28c0 [ath12k] ath12k_htc_process_trailer.isra.0+0x2fb/0x620 [ath12k] ath12k_htc_rx_completion_handler+0x448/0x830 [ath12k] ath12k_ce_recv_process_cb+0x549/0x9e0 [ath12k] ath12k_ce_per_engine_service+0xbe/0xf0 [ath12k] ath12k_pci_ce_workqueue+0x69/0x120 [ath12k] process_one_work+0x
[ath12k] ath12k_ce_per_engine_service+0xbe/0xf0 [ath12k] ath12k_pci_ce_workqueue+0x69/0x120 [ath12k] process_one_work+0xe3a/0x1430 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 References: - https://git.kernel.org/stable/c/9b861dfc5c07defd0191fd3e7288a3179cd9a02e - https://git.kernel.org/stable/c/1259b6da8303f70fef6ed4aef8ae3dedfecb0f27 - https://git.kernel.org/stable/c/36670b67de18f1e5d34900c5d2ac60a8970c293c
CVE ID: CVE-2025-38607 State: PUBLISHED Published: 2025-08-19T17:03:50.947Z Last Updated: 2025-09-29T05:54:41.668Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: handle jset (if a & b ...) as a jump in CFG computation BPF_JSET is a conditional jump and currently verifier.c:can_jump() does not know about that. This can lead to incorrect live registers and SCC computation. E.g. in the following example: 1: r0 = 1; 2: r2 = 2; 3: if r1 & 0x7 goto +1; 4: exit; 5: r0 = r2; 6: exit; W/o this fix insn_successors(3) will return only (4), a jump to (5) would be missed and r2 won't be marked as alive at (3). References: - https://git
3) will return only (4), a jump to (5) would be missed and r2 won't be marked as alive at (3). References: - https://git.kernel.org/stable/c/65eb166b8636365ad3d6e36d50a7c5edfe6cc66e - https://git.kernel.org/stable/c/261b30ad1516f4b9edd500aa6e8d6315c8fc109a - https://git.kernel.org/stable/c/3157f7e2999616ac91f4d559a8566214f74000a5
CVE ID: CVE-2025-38608 State: PUBLISHED Published: 2025-08-19T17:03:51.688Z Last Updated: 2025-11-03T17:40:21.692Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls When sending plaintext data, we initially calculated the corresponding ciphertext length. However, if we later reduced the plaintext data length via socket policy, we failed to recalculate the ciphertext length. This results in transmitting buffers containing uninitialized data during ciphertext transmission. This causes uninitialized bytes to be appended after a complete "Application Data" packet, le
g ciphertext transmission. This causes uninitialized bytes to be appended after a complete "Application Data" packet, leading to errors on the receiving end when parsing TLS record. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/6ba20ff3cdb96a908b9dc93cf247d0b087672e7c - https://git.kernel.org/stable/c/849d24dc5aed45ebeb3490df429356739256ac40 - https://git.kernel.org/stable/c/73fc5d04009d3969ff8e8574f0fd769f04124e59 - https://git.kernel.org/stable/c/16aca8bb4ad0d8a13c8b6da4007f4e52d53035bb - https://git.kernel.org/stable/c/0e853c1464bcf61207f8b5c32d2ac5ee495e859d - https://git.kernel.org/stable/c/ee03766d79de0f61ea29ffb6ab1c7b196ea1b02e - htt
e853c1464bcf61207f8b5c32d2ac5ee495e859d - https://git.kernel.org/stable/c/ee03766d79de0f61ea29ffb6ab1c7b196ea1b02e - https://git.kernel.org/stable/c/90d6ef67440cec2a0aad71a0108c8f216437345c - https://git.kernel.org/stable/c/1e480387d4b42776f8957fb148af9d75ce93b96d - https://git.kernel.org/stable/c/178f6a5c8cb3b6be1602de0964cd440243f493c9
CVE ID: CVE-2025-38609 State: PUBLISHED Published: 2025-08-19T17:03:52.542Z Last Updated: 2025-11-03T17:40:22.664Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Check governor before using governor->name Commit 96ffcdf239de ("PM / devfreq: Remove redundant governor_name from struct devfreq") removes governor_name and uses governor->name to replace it. But devfreq->governor may be NULL and directly using devfreq->governor->name may cause null pointer exception. Move the check of governor to before using governor->name. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c
e using governor->name. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/f0479e878d4beb45e73c03e574c59f0a23ccd176 - https://git.kernel.org/stable/c/631e101728df2a86b8fb761b49fad9712c651f8a - https://git.kernel.org/stable/c/81f50619370045120c133bfdda5b320c8c97d41e - https://git.kernel.org/stable/c/d5632359dbc44862fc1ed04093c1f57529830261 - https://git.kernel.org/stable/c/2731c68f536fddcb71332db7f8d78c5eb4684c04 - https://git.kernel.org/stable/c/75323a49aa603cf5484a6d74d0d329e86d756e11 - https://git.kernel.org/stable/c/bab7834c03820eb11269bc48f07c3800192460d2
CVE ID: CVE-2025-38610 State: PUBLISHED Published: 2025-08-19T17:03:53.255Z Last Updated: 2025-11-03T17:40:23.677Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() The get_pd_power_uw() function can crash with a NULL pointer dereference when em_cpu_get() returns NULL. This occurs when a CPU becomes impossible during runtime, causing get_cpu_device() to return NULL, which propagates through em_cpu_get() and leads to a crash when em_span_cpus() dereferences the NULL pointer. Add a NULL check after em_cpu_get() and return 0 if unavailable, matching the existing fa
dereferences the NULL pointer. Add a NULL check after em_cpu_get() and return 0 if unavailable, matching the existing fallback behavior in __dtpm_cpu_setup(). [ rjw: Drop an excess empty code line ] Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/27914f2b795e2b58e9506f281dcdd98fef09d3c2 - https://git.kernel.org/stable/c/c6ec27091cf5ac05094c1fe3a6ce914cf711a37c - https://git.kernel.org/stable/c/8374ac7d69a57d737e701a851ffe980a0d27d3ad - https://git.kernel.org/stable/c/27e0318f0ea69fcfa32228847debc384ade14578 - https://git.kernel.org/stable/c/2fd001a0075ac01dc64a28a8e21226b3d989a91d - https://git.kernel.org/stable/c/46dc57406887dd02565cb26422419
el.org/stable/c/2fd001a0075ac01dc64a28a8e21226b3d989a91d - https://git.kernel.org/stable/c/46dc57406887dd02565cb264224194a6776d882b
CVE ID: CVE-2025-38611 State: REJECTED Published: 2025-08-19T17:03:53.978Z Last Updated: 2025-09-05T19:57:43.346Z Description: No description available.
CVE ID: CVE-2025-38612 State: PUBLISHED Published: 2025-08-19T17:03:54.797Z Last Updated: 2025-11-03T17:40:25.546Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() In the error paths after fb_info structure is successfully allocated, the memory allocated in fb_deferred_io_init() for info->pagerefs is not freed. Fix that by adding the cleanup function on the error path. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/83ea0c7b8d12c67f6c4703d6c458627a7fc45fc0 - https://git.kernel.org/stable/c/c3b1c45c48117ed4d8797e
it.kernel.org/stable/c/83ea0c7b8d12c67f6c4703d6c458627a7fc45fc0 - https://git.kernel.org/stable/c/c3b1c45c48117ed4d8797ee89d1155f16b72d490 - https://git.kernel.org/stable/c/3290f62f23fae05f2ec34085eb86dfb3648ef91f - https://git.kernel.org/stable/c/6f9e2cf9e9c1a891a683329af35bb33ed9d38b5f - https://git.kernel.org/stable/c/b31cf6f7716a5d3e4461763f32d812acdaec6e74 - https://git.kernel.org/stable/c/a3177955f8da3c826a18b75e54881e2e9a9c96f1 - https://git.kernel.org/stable/c/6771f121ae87490ddc19eabb7450383af9e01b6d - https://git.kernel.org/stable/c/47b3d6e8921bbb7b65c2dab8eaa8864901848c1c - https://git.kernel.org/stable/c/eb2cb7dab60f9be0b435ac4a674255429a36d72c