Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
cond remove list_del(&req->req_list); spin_unlock(&m->req_lock) ... Commit 74d6a5d56629 ("9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work") fixes a concurrency issue in the 9p filesystem client where the req_list could be deleted simultaneously by both p9_read_work and p9_fd_cancelled functions, but for the case where req->status equals REQ_STATUS_RCVD. Update the check for req->status in p9_fd_cancelled to skip processing not just received requests, but anything that is not SENT, as whatever changed the state from SENT also removed the request from its list. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. [updated the check from status == R
from its list. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. [updated the check from status == RECV || status == ERROR to status != SENT] References: - https://git.kernel.org/stable/c/a5901a0dfb5964525990106706ae8b98db098226 - https://git.kernel.org/stable/c/5c64c0b7b3446f7ed088a13bc8d7487d66534cbb - https://git.kernel.org/stable/c/c1db864270eb7fea94a9ef201da0c9dc1cbab7b8 - https://git.kernel.org/stable/c/0e0097005abc02c9f262370674f855625f4f3fb4 - https://git.kernel.org/stable/c/284e67a93b8c48952b6fc82129a8d3eb9dc73b06 - https://git.kernel.org/stable/c/716dceb19a9f8ff6c9d3aee5a771a93d6a47a0b6 - https://git.kernel.org/stable/c/448db01a48e1cdbbc31c995716a5dac1e52ba036 -
/c/716dceb19a9f8ff6c9d3aee5a771a93d6a47a0b6 - https://git.kernel.org/stable/c/448db01a48e1cdbbc31c995716a5dac1e52ba036 - https://git.kernel.org/stable/c/94797b84cb9985022eb9cb3275c9497fbc883bb6 - https://git.kernel.org/stable/c/674b56aa57f9379854cb6798c3bbcef7e7b51ab7
CVE ID: CVE-2025-40028 State: PUBLISHED Published: 2025-10-28T09:32:35.681Z Last Updated: 2025-10-28T09:32:35.681Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: binder: fix double-free in dbitmap A process might fail to allocate a new bitmap when trying to expand its proc->dmap. In that case, dbitmap_grow() fails and frees the old bitmap via dbitmap_free(). However, the driver calls dbitmap_free() again when the same process terminates, leading to a double-free error: ================================================================== BUG: KASAN: double-free in binder_proc_dec_tmpref+0x2e0/0x55c Free of addr ffff00000b7c1420 by
========================= BUG: KASAN: double-free in binder_proc_dec_tmpref+0x2e0/0x55c Free of addr ffff00000b7c1420 by task kworker/9:1/209 CPU: 9 UID: 0 PID: 209 Comm: kworker/9:1 Not tainted 6.17.0-rc6-dirty #5 PREEMPT Hardware name: linux,dummy-virt (DT) Workqueue: events binder_deferred_func Call trace: kfree+0x164/0x31c binder_proc_dec_tmpref+0x2e0/0x55c binder_deferred_func+0xc24/0x1120 process_one_work+0x520/0xba4 [...] Allocated by task 448: __kmalloc_noprof+0x178/0x3c0 bitmap_zalloc+0x24/0x30 binder_open+0x14c/0xc10 [...] Freed by task 449: kfree+0x184/0x31c binder_inc_ref_for_node+0xb44/0xe44 binder_transaction+0x29b4/0x7fbc binder_thread_write+0x1708/0x442c binder_ioctl+0x1b50/0
er_inc_ref_for_node+0xb44/0xe44 binder_transaction+0x29b4/0x7fbc binder_thread_write+0x1708/0x442c binder_ioctl+0x1b50/0x2900 [...] ================================================================== Fix this issue by marking proc->map NULL in dbitmap_free(). References: - https://git.kernel.org/stable/c/c301ec61ce6f16e21a36b99225ca8a20c1591e10 - https://git.kernel.org/stable/c/0390633979969c54c0ce6a198d6f45cdbe2c84b1 - https://git.kernel.org/stable/c/b781e5635a3398e2b64440371233c2c5102cd6cb - https://git.kernel.org/stable/c/3ebcd3460cad351f198c39c6edb4af519a0ed934
CVE ID: CVE-2025-40029 State: PUBLISHED Published: 2025-10-28T11:48:00.679Z Last Updated: 2025-10-29T13:19:32.136Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: Check return value of platform_get_resource() platform_get_resource() returns NULL in case of failure, so check its return value and propagate the error in order to prevent NULL pointer dereference. References: - https://git.kernel.org/stable/c/58dd05070b57a20f22ff35a34ef9846bdf49a1d0 - https://git.kernel.org/stable/c/8a4dd74fe413d4a278e649be1d22d028e1667116 - https://git.kernel.org/stable/c/e60d55692e6c8e951000343c39f3fc92cab57efc - https://git.kernel.org
49be1d22d028e1667116 - https://git.kernel.org/stable/c/e60d55692e6c8e951000343c39f3fc92cab57efc - https://git.kernel.org/stable/c/78e87b8a3cf8a59671ea25c87192d16e8d710e1c - https://git.kernel.org/stable/c/84ec0482ed9c9ed0aee553a5e7e7458ad79c021f - https://git.kernel.org/stable/c/2ead548473f58c7960b6b939b79503c4a0a2c0bd - https://git.kernel.org/stable/c/25f526507b8ccc6ac3a43bc094d09b1f9b0b90ae
CVE ID: CVE-2025-40030 State: PUBLISHED Published: 2025-10-28T11:48:01.608Z Last Updated: 2025-10-29T13:19:34.573Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: pinctrl: check the return value of pinmux_ops::get_function_name() While the API contract in docs doesn't specify it explicitly, the generic implementation of the get_function_name() callback from struct pinmux_ops - pinmux_generic_get_function_name() - can fail and return NULL. This is already checked in pinmux_check_ops() so add a similar check in pinmux_func_name_to_selector() instead of passing the returned pointer right down to strcmp() where the NULL can get dere
inmux_func_name_to_selector() instead of passing the returned pointer right down to strcmp() where the NULL can get dereferenced. This is normal operation when adding new pinfunctions. References: - https://git.kernel.org/stable/c/1a7fc8fed2bb2e113604fde7a45432ace2056b97 - https://git.kernel.org/stable/c/e7265dc4c670b89611bcf5fe33acf99bc0aa294f - https://git.kernel.org/stable/c/d77ef2f621cd1d605372c4c6ce667c496f6990c3 - https://git.kernel.org/stable/c/ba7f7c2b2b3261e7def67018c38c69b626e0e66e - https://git.kernel.org/stable/c/1a2ea887a5cd7d47bab599f733d89444df018b1a - https://git.kernel.org/stable/c/688c688e0bf55824f4a38f8c2180046f089a3e3b - https://git.kernel.org/stable/c/b7e0535060a60cc99ea
//git.kernel.org/stable/c/688c688e0bf55824f4a38f8c2180046f089a3e3b - https://git.kernel.org/stable/c/b7e0535060a60cc99eafc19cc665d979714cd73a - https://git.kernel.org/stable/c/4002ee98c022d671ecc1e4a84029e9ae7d8a5603
CVE ID: CVE-2025-40031 State: PUBLISHED Published: 2025-10-28T11:48:13.644Z Last Updated: 2025-10-28T11:48:13.644Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tee: fix register_shm_helper() In register_shm_helper(), fix incorrect error handling for a call to iov_iter_extract_pages(). A case is missing for when iov_iter_extract_pages() only got some pages and return a number larger than 0, but not the requested amount. This fixes a possible NULL pointer dereference following a bad input from ioctl(TEE_IOC_SHM_REGISTER) where parts of the buffer isn't mapped. References: - https://git.kernel.org/stable/c/9338093db954918558677a
M_REGISTER) where parts of the buffer isn't mapped. References: - https://git.kernel.org/stable/c/9338093db954918558677a468d32e77041c65167 - https://git.kernel.org/stable/c/6a7874ab814ce12003c46a92f7afc9b035c8e8e9 - https://git.kernel.org/stable/c/d5cf5b37064b1699d946e8b7ab4ac7d7d101814c
CVE ID: CVE-2025-40032 State: PUBLISHED Published: 2025-10-28T11:48:14.876Z Last Updated: 2025-10-28T11:48:14.876Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release The fields dma_chan_tx and dma_chan_rx of the struct pci_epf_test can be NULL even after EPF initialization. Then it is prudent to check that they have non-NULL values before releasing the channels. Add the checks in pci_epf_test_clean_dma_chan(). Without the checks, NULL pointer dereferences happen and they can lead to a kernel panic in some cases: Unable to handle kernel NULL pointer derefere
ter dereferences happen and they can lead to a kernel panic in some cases: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050 Call trace: dma_release_channel+0x2c/0x120 (P) pci_epf_test_epc_deinit+0x94/0xc0 [pci_epf_test] pci_epc_deinit_notify+0x74/0xc0 tegra_pcie_ep_pex_rst_irq+0x250/0x5d8 irq_thread_fn+0x34/0xb8 irq_thread+0x18c/0x2e8 kthread+0x14c/0x210 ret_from_fork+0x10/0x20 [mani: trimmed the stack trace] References: - https://git.kernel.org/stable/c/6411f840a9b5c47c00ca8e004733de232553870d - https://git.kernel.org/stable/c/0c5ce6b6ccc22d486cc7239ed908cb0ae5363a7b - https://git.kernel.org/stable/c/fb54ffd60064c4e5139a3eb216e877b1acae1c8b - https://git.
c22d486cc7239ed908cb0ae5363a7b - https://git.kernel.org/stable/c/fb54ffd60064c4e5139a3eb216e877b1acae1c8b - https://git.kernel.org/stable/c/57f7fb0d1ac28540c0f6405c829bb9c3b89d8dba - https://git.kernel.org/stable/c/85afa9ea122dd9d4a2ead104a951d318975dcd25
CVE ID: CVE-2025-40033 State: PUBLISHED Published: 2025-10-28T11:48:15.624Z Last Updated: 2025-10-28T11:48:15.624Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() pru_rproc_set_ctable() accessed rproc->priv before the IS_ERR_OR_NULL check, which could lead to a null pointer dereference. Move the pru assignment, ensuring we never dereference a NULL rproc pointer. References: - https://git.kernel.org/stable/c/66821fdb723d55b25482a76b92d17d416efeae6b - https://git.kernel.org/stable/c/c9b6d789591f2bd57b0cbd59592493e11e029ed4 - https://git.kernel.org/st
b92d17d416efeae6b - https://git.kernel.org/stable/c/c9b6d789591f2bd57b0cbd59592493e11e029ed4 - https://git.kernel.org/stable/c/f0164d89950120281f2446be9687cffa1e43dbcc - https://git.kernel.org/stable/c/d41e075b077142bb9ae5df40b9ddf9fd7821a811
CVE ID: CVE-2025-40034 State: PUBLISHED Published: 2025-10-28T11:48:16.335Z Last Updated: 2025-10-28T11:48:16.335Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() When platform firmware supplies error information to the OS, e.g., via the ACPI APEI GHES mechanism, it may identify an error source device that doesn't advertise an AER Capability and therefore dev->aer_info, which contains AER stats and ratelimiting data, is NULL. pci_dev_aer_stats_incr() already checks dev->aer_info for NULL, but aer_ratelimit() did not, leading to NULL pointer dereferences like this one fro
ready checks dev->aer_info for NULL, but aer_ratelimit() did not, leading to NULL pointer dereferences like this one from the URL below: {1}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 0 {1}[Hardware Error]: event severity: corrected {1}[Hardware Error]: device_id: 0000:00:00.0 {1}[Hardware Error]: vendor_id: 0x8086, device_id: 0x2020 {1}[Hardware Error]: aer_cor_status: 0x00001000, aer_cor_mask: 0x00002000 BUG: kernel NULL pointer dereference, address: 0000000000000264 RIP: 0010:___ratelimit+0xc/0x1b0 pci_print_aer+0x141/0x360 aer_recover_work_func+0xb5/0x130 [8086:2020] is an Intel "Sky Lake-E DMI3 Registers" device that claims to be a Root Port but does not ad
func+0xb5/0x130 [8086:2020] is an Intel "Sky Lake-E DMI3 Registers" device that claims to be a Root Port but does not advertise an AER Capability. Add a NULL check in aer_ratelimit() to avoid the NULL pointer dereference. Note that this also prevents ratelimiting these events from GHES. [bhelgaas: add crash details to commit log] References: - https://git.kernel.org/stable/c/41683624cbff0a26bb7e0627f4a7e1b51a8779a8 - https://git.kernel.org/stable/c/deb2f228388ff3a9d0623e3b59a053e9235c341d
CVE ID: CVE-2025-40035 State: PUBLISHED Published: 2025-10-28T11:48:17.030Z Last Updated: 2025-10-29T13:19:36.823Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak Struct ff_effect_compat is embedded twice inside uinput_ff_upload_compat, contains internal padding. In particular, there is a hole after struct ff_replay to satisfy alignment requirements for the following union member. Without clearing the structure, copy_to_user() may leak stack data to userspace. Initialize ff_up_compat to zero before filling valid fields. References: - https://git.kernel.or
tack data to userspace. Initialize ff_up_compat to zero before filling valid fields. References: - https://git.kernel.org/stable/c/1b317796013f666ae5040edbf0f230ec61496d42 - https://git.kernel.org/stable/c/877172b97786ed1678640dff0b2d35abb328844c - https://git.kernel.org/stable/c/e63aade22a33e77b93c98c9f02db504d897a76b4 - https://git.kernel.org/stable/c/933b87c4590b42500299f00ff55f555903056803 - https://git.kernel.org/stable/c/fd8a23ecbc602d00e47b27f20b07350867d0ebe5 - https://git.kernel.org/stable/c/48c96b7e9e03516936d6deba54b5553097eae817 - https://git.kernel.org/stable/c/f5e1f3b85aadce74268c46676772c3e9fa79897e - https://git.kernel.org/stable/c/d3366a04770eea807f2826cbdb96934dd8c9bf79
CVE ID: CVE-2025-40036 State: PUBLISHED Published: 2025-10-28T11:48:17.630Z Last Updated: 2025-10-28T11:48:17.630Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix possible map leak in fastrpc_put_args copy_to_user() failure would cause an early return without cleaning up the fdlist, which has been updated by the DSP. This could lead to map leak. Fix this by redirecting to a cleanup path on failure, ensuring that all mapped buffers are properly released before returning. References: - https://git.kernel.org/stable/c/a085658264d0c8d4f795d4631f77d7289a021de9 - https://git.kernel.org/stable/c/3ad42dc66445df6977cf4
git.kernel.org/stable/c/a085658264d0c8d4f795d4631f77d7289a021de9 - https://git.kernel.org/stable/c/3ad42dc66445df6977cf4be0c06f1a655299ce6c - https://git.kernel.org/stable/c/78d33a041555db03903e8037fd053ed74fbd88cb - https://git.kernel.org/stable/c/c000f65f0ac93d9f9cc69a230d372f6ca93e4879 - https://git.kernel.org/stable/c/da1ba64176e0138f2bfa96f9e43e8c3640d01e1e
CVE ID: CVE-2025-40037 State: PUBLISHED Published: 2025-10-28T11:48:18.274Z Last Updated: 2025-10-28T11:48:18.274Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fbdev: simplefb: Fix use after free in simplefb_detach_genpds() The pm_domain cleanup can not be devres managed as it uses struct simplefb_par which is allocated within struct fb_info by framebuffer_alloc(). This allocation is explicitly freed by unregister_framebuffer() in simplefb_remove(). Devres managed cleanup runs after the device remove call and thus can no longer access struct simplefb_par. Call simplefb_detach_genpds() explicitly from simplefb_destroy() like t
d thus can no longer access struct simplefb_par. Call simplefb_detach_genpds() explicitly from simplefb_destroy() like the cleanup functions for clocks and regulators. Fixes an use after free on M2 Mac mini during aperture_remove_conflicting_devices() using the downstream asahi kernel with Debian's kernel config. For unknown reasons this started to consistently dereference an invalid pointer in v6.16.3 based kernels. [ 6.736134] BUG: KASAN: slab-use-after-free in simplefb_detach_genpds+0x58/0x220 [ 6.743545] Read of size 4 at addr ffff8000304743f0 by task (udev-worker)/227 [ 6.750697] [ 6.752182] CPU: 6 UID: 0 PID: 227 Comm: (udev-worker) Tainted: G S 6.16.3-asahi+ #16 PREEMPTLAZY [ 6.752186
[ 6.750697] [ 6.752182] CPU: 6 UID: 0 PID: 227 Comm: (udev-worker) Tainted: G S 6.16.3-asahi+ #16 PREEMPTLAZY [ 6.752186] Tainted: [S]=CPU_OUT_OF_SPEC [ 6.752187] Hardware name: Apple Mac mini (M2, 2023) (DT) [ 6.752189] Call trace: [ 6.752190] show_stack+0x34/0x98 (C) [ 6.752194] dump_stack_lvl+0x60/0x80 [ 6.752197] print_report+0x17c/0x4d8 [ 6.752201] kasan_report+0xb4/0x100 [ 6.752206] __asan_report_load4_noabort+0x20/0x30 [ 6.752209] simplefb_detach_genpds+0x58/0x220 [ 6.752213] devm_action_release+0x50/0x98 [ 6.752216] release_nodes+0xd0/0x2c8 [ 6.752219] devres_release_all+0xfc/0x178 [ 6.752221] device_unbind_cleanup+0x28/0x168 [ 6.752224] device_release_driver_internal+0x34c/0x470 [ 6
e_all+0xfc/0x178 [ 6.752221] device_unbind_cleanup+0x28/0x168 [ 6.752224] device_release_driver_internal+0x34c/0x470 [ 6.752228] device_release_driver+0x20/0x38 [ 6.752231] bus_remove_device+0x1b0/0x380 [ 6.752234] device_del+0x314/0x820 [ 6.752238] platform_device_del+0x3c/0x1e8 [ 6.752242] platform_device_unregister+0x20/0x50 [ 6.752246] aperture_detach_platform_device+0x1c/0x30 [ 6.752250] aperture_detach_devices+0x16c/0x290 [ 6.752253] aperture_remove_conflicting_devices+0x34/0x50 ... [ 6.752343] [ 6.967409] Allocated by task 62: [ 6.970724] kasan_save_stack+0x3c/0x70 [ 6.974560] kasan_save_track+0x20/0x40 [ 6.978397] kasan_save_alloc_info+0x40/0x58 [ 6.982670] __kasan_kmalloc+0xd4/0xd8
6.974560] kasan_save_track+0x20/0x40 [ 6.978397] kasan_save_alloc_info+0x40/0x58 [ 6.982670] __kasan_kmalloc+0xd4/0xd8 [ 6.986420] __kmalloc_noprof+0x194/0x540 [ 6.990432] framebuffer_alloc+0xc8/0x130 [ 6.994444] simplefb_probe+0x258/0x2378 ... [ 7.054356] [ 7.055838] Freed by task 227: [ 7.058891] kasan_save_stack+0x3c/0x70 [ 7.062727] kasan_save_track+0x20/0x40 [ 7.066565] kasan_save_free_info+0x4c/0x80 [ 7.070751] __kasan_slab_free+0x6c/0xa0 [ 7.074675] kfree+0x10c/0x380 [ 7.077727] framebuffer_release+0x5c/0x90 [ 7.081826] simplefb_destroy+0x1b4/0x2c0 [ 7.085837] put_fb_info+0x98/0x100 [ 7.089326] unregister_framebuffer+0x178/0x320 [ 7.093861] simplefb_remove+0x3c/0x60 [ 7.097611] platf
b_info+0x98/0x100 [ 7.089326] unregister_framebuffer+0x178/0x320 [ 7.093861] simplefb_remove+0x3c/0x60 [ 7.097611] platform_remove+0x60/0x98 [ 7.101361] device_remove+0xb8/0x160 [ 7.105024] device_release_driver_internal+0x2fc/0x470 [ 7.110256] device_release_driver+0x20/0x38 [ 7.114529] bus_remove_device+0x1b0/0x380 [ 7.118628] device_del+0x314/0x820 [ 7.122116] platform_device_del+0x3c/0x1e8 [ 7.126302] platform_device_unregister+0x20/0x50 [ 7.131012] aperture_detach_platform_device+0x1c/0x30 [ 7.136157] aperture_detach_devices+0x16c/0x290 [ 7.140779] aperture_remove_conflicting_devices+0x34/0x50 ... References: - https://git.kernel.org/stable/c/b1deb39cfd614fb2f278b71011692a8dbf0f05ba - h
licting_devices+0x34/0x50 ... References: - https://git.kernel.org/stable/c/b1deb39cfd614fb2f278b71011692a8dbf0f05ba - https://git.kernel.org/stable/c/b6ff0d8de8452ec0e18e5bd7394c2a23e7ff7353 - https://git.kernel.org/stable/c/da1bb9135213744e7ec398826c8f2e843de4fb94
CVE ID: CVE-2025-40038 State: PUBLISHED Published: 2025-10-28T11:48:18.889Z Last Updated: 2025-10-28T11:48:18.889Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid Skip the WRMSR and HLT fastpaths in SVM's VM-Exit handler if the next RIP isn't valid, e.g. because KVM is running with nrips=false. SVM must decode and emulate to skip the instruction if the CPU doesn't provide the next RIP, and getting the instruction bytes to decode requires reading guest memory. Reading guest memory through the emulator can fault, i.e. can sleep, which is disallowed since the fast
ng guest memory. Reading guest memory through the emulator can fault, i.e. can sleep, which is disallowed since the fastpath handlers run with IRQs disabled. BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:106 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 32611, name: qemu preempt_count: 1, expected: 0 INFO: lockdep is turned off. irq event stamp: 30580 hardirqs last enabled at (30579): [<ffffffffc08b2527>] vcpu_run+0x1787/0x1db0 [kvm] hardirqs last disabled at (30580): [<ffffffffb4f62e32>] __schedule+0x1e2/0xed0 softirqs last enabled at (30570): [<ffffffffb4247a64>] fpu_swap_kvm_fpstate+0x44/0x210 softirqs last disabled at (30568): [<ffffffffb4247a64
d at (30570): [<ffffffffb4247a64>] fpu_swap_kvm_fpstate+0x44/0x210 softirqs last disabled at (30568): [<ffffffffb4247a64>] fpu_swap_kvm_fpstate+0x44/0x210 CPU: 298 UID: 0 PID: 32611 Comm: qemu Tainted: G U 6.16.0-smp--e6c618b51cfe-sleep #782 NONE Tainted: [U]=USER Hardware name: Google Astoria-Turin/astoria, BIOS 0.20241223.2-0 01/17/2025 Call Trace: <TASK> dump_stack_lvl+0x7d/0xb0 __might_resched+0x271/0x290 __might_fault+0x28/0x80 kvm_vcpu_read_guest_page+0x8d/0xc0 [kvm] kvm_fetch_guest_virt+0x92/0xc0 [kvm] __do_insn_fetch_bytes+0xf3/0x1e0 [kvm] x86_decode_insn+0xd1/0x1010 [kvm] x86_emulate_instruction+0x105/0x810 [kvm] __svm_skip_emulated_instruction+0xc4/0x140 [kvm_amd] handle_fastpath_i
0 [kvm] x86_emulate_instruction+0x105/0x810 [kvm] __svm_skip_emulated_instruction+0xc4/0x140 [kvm_amd] handle_fastpath_invd+0xc4/0x1a0 [kvm] vcpu_run+0x11a1/0x1db0 [kvm] kvm_arch_vcpu_ioctl_run+0x5cc/0x730 [kvm] kvm_vcpu_ioctl+0x578/0x6a0 [kvm] __se_sys_ioctl+0x6d/0xb0 do_syscall_64+0x8a/0x2c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f479d57a94b </TASK> Note, this is essentially a reapply of commit 5c30e8101e8d ("KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid"), but with different justification (KVM now grabs SRCU when skipping the instruction for other reasons). References: - https://git.kernel.org/stable/c/cd3efb93677c4b0cf76348882fb429165fee33fd - https://gi
for other reasons). References: - https://git.kernel.org/stable/c/cd3efb93677c4b0cf76348882fb429165fee33fd - https://git.kernel.org/stable/c/f994e9c790ce97d3cf01af4d0a1b9add0c955aee - https://git.kernel.org/stable/c/da2a3c231f7f2a5ac146d972b8c1d7d84aff6d70 - https://git.kernel.org/stable/c/0910dd7c9ad45a2605c45fd2bf3d1bcac087687c
CVE ID: CVE-2025-40039 State: PUBLISHED Published: 2025-10-28T11:48:19.781Z Last Updated: 2025-10-28T11:48:19.781Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix race condition in RPC handle list access The 'sess->rpc_handle_list' XArray manages RPC handles within a ksmbd session. Access to this list is intended to be protected by 'sess->rpc_lock' (an rw_semaphore). However, the locking implementation was flawed, leading to potential race conditions. In ksmbd_session_rpc_open(), the code incorrectly acquired only a read lock before calling xa_store() and xa_erase(). Since these operations modify the XArray structure,
acquired only a read lock before calling xa_store() and xa_erase(). Since these operations modify the XArray structure, a write lock is required to ensure exclusive access and prevent data corruption from concurrent modifications. Furthermore, ksmbd_session_rpc_method() accessed the list using xa_load() without holding any lock at all. This could lead to reading inconsistent data or a potential use-after-free if an entry is concurrently removed and the pointer is dereferenced. Fix these issues by: 1. Using down_write() and up_write() in ksmbd_session_rpc_open() to ensure exclusive access during XArray modification, and ensuring the lock is correctly released on error paths. 2. Adding down_r
xclusive access during XArray modification, and ensuring the lock is correctly released on error paths. 2. Adding down_read() and up_read() in ksmbd_session_rpc_method() to safely protect the lookup. References: - https://git.kernel.org/stable/c/5cc679ba0f4505936124cd4179ba66bb0a4bd9f3 - https://git.kernel.org/stable/c/6bd7e0e55dcea2cf0d391bbc21c2eb069b4be3e1 - https://git.kernel.org/stable/c/305853cce379407090a73b38c5de5ba748893aee
CVE ID: CVE-2025-40040 State: PUBLISHED Published: 2025-10-28T11:48:20.395Z Last Updated: 2025-10-29T13:19:40.112Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mm/ksm: fix flag-dropping behavior in ksm_madvise syzkaller discovered the following crash: (kernel BUG) [ 44.607039] ------------[ cut here ]------------ [ 44.607422] kernel BUG at mm/userfaultfd.c:2067! [ 44.608148] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 44.608814] CPU: 1 UID: 0 PID: 2475 Comm: reproducer Not tainted 6.16.0-rc6 #1 PREEMPT(none) [ 44.609635] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f