Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
a90 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:218 ksys_unshare+0x45b/0xa40 kernel/fork.c:3121 __do_sys_unshare kernel/fork.c:3192 [inline] __se_sys_unshare kernel/fork.c:3190 [inline] __x64_sys_unshare+0x31/0x40 kernel/fork.c:3190 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa1a6b8e929 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c ---truncated--- Additional Analyst Notes: - CVE Program Container: References: - https://git.kerne
d 01 f0 ff ff 73 01 c ---truncated--- Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/8785701fd7cd52ae74c0d2b35b82568df74e9dbb - https://git.kernel.org/stable/c/412534a1fb76958b88dca48360c6f3ad4f3390f4 - https://git.kernel.org/stable/c/b92397ce96743e4cc090207e2df2a856cb4cef08 - https://git.kernel.org/stable/c/7701c245ff1ac1a126bf431e72b24547519046ff - https://git.kernel.org/stable/c/d0877c479f44fe475f4c8c02c88ce9ad43e90298 - https://git.kernel.org/stable/c/3c94212b57bedec3a386ef3da1ef00602f5c3d1d - https://git.kernel.org/stable/c/6acf340f8c1d296bcf535986175f5d0d6f2aab09 - https://git.kernel.org/stable/c/e8d6f3ab59468e230f3253efe5cb63efa35289f7
CVE ID: CVE-2025-38401 State: PUBLISHED Published: 2025-07-25T12:53:44.961Z Last Updated: 2025-11-03T17:37:35.519Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mtk-sd: Prevent memory corruption from DMA map failure If msdc_prepare_data() fails to map the DMA region, the request is not prepared for data receiving, but msdc_start_data() proceeds the DMA with previous setting. Since this will lead a memory corruption, we have to stop the request operation soon after the msdc_prepare_data() fails to prepare it. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/5ac9e9e2e9cd6247d8c2d99
Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/5ac9e9e2e9cd6247d8c2d99780eae4556049e1cc - https://git.kernel.org/stable/c/d54771571f74a82c59830a32e76af78a8e57ac69 - https://git.kernel.org/stable/c/48bf4f3dfcdab02b22581d8e350a2d23130b72c0 - https://git.kernel.org/stable/c/63e8953f16acdcb23e2d4dd8a566d3c34df3e200 - https://git.kernel.org/stable/c/61cdd663564674ea21ceb50aa9d3697cbe9e45f9 - https://git.kernel.org/stable/c/3419bc6a7b65cbbb91417bb9970208478e034c79 - https://git.kernel.org/stable/c/a5f5f67b284d81776d4a3eb1f8607e4b7f91f11c - https://git.kernel.org/stable/c/f5de469990f19569627ea0dd56536ff5a13beaa3
CVE ID: CVE-2025-38402 State: PUBLISHED Published: 2025-07-25T12:53:45.677Z Last Updated: 2025-07-28T04:21:11.005Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: idpf: return 0 size for RSS key if not supported Returning -EOPNOTSUPP from function returning u32 is leading to cast and invalid size value as a result. -EOPNOTSUPP as a size probably will lead to allocation fail. Command: ethtool -x eth0 It is visible on all devices that don't have RSS caps set. [ 136.615917] Call Trace: [ 136.615921] <TASK> [ 136.615927] ? __warn+0x89/0x130 [ 136.615942] ? __alloc_frozen_pages_noprof+0x322/0x330 [ 136.615953] ? report_bug+0x164/0x19
15927] ? __warn+0x89/0x130 [ 136.615942] ? __alloc_frozen_pages_noprof+0x322/0x330 [ 136.615953] ? report_bug+0x164/0x190 [ 136.615968] ? handle_bug+0x58/0x90 [ 136.615979] ? exc_invalid_op+0x17/0x70 [ 136.615987] ? asm_exc_invalid_op+0x1a/0x20 [ 136.616001] ? rss_prepare_get.constprop.0+0xb9/0x170 [ 136.616016] ? __alloc_frozen_pages_noprof+0x322/0x330 [ 136.616028] __alloc_pages_noprof+0xe/0x20 [ 136.616038] ___kmalloc_large_node+0x80/0x110 [ 136.616072] __kmalloc_large_node_noprof+0x1d/0xa0 [ 136.616081] __kmalloc_noprof+0x32c/0x4c0 [ 136.616098] ? rss_prepare_get.constprop.0+0xb9/0x170 [ 136.616105] rss_prepare_get.constprop.0+0xb9/0x170 [ 136.616114] ethnl_default_doit+0x107/0x3d0 [ 136
rop.0+0xb9/0x170 [ 136.616105] rss_prepare_get.constprop.0+0xb9/0x170 [ 136.616114] ethnl_default_doit+0x107/0x3d0 [ 136.616131] genl_family_rcv_msg_doit+0x100/0x160 [ 136.616147] genl_rcv_msg+0x1b8/0x2c0 [ 136.616156] ? __pfx_ethnl_default_doit+0x10/0x10 [ 136.616168] ? __pfx_genl_rcv_msg+0x10/0x10 [ 136.616176] netlink_rcv_skb+0x58/0x110 [ 136.616186] genl_rcv+0x28/0x40 [ 136.616195] netlink_unicast+0x19b/0x290 [ 136.616206] netlink_sendmsg+0x222/0x490 [ 136.616215] __sys_sendto+0x1fd/0x210 [ 136.616233] __x64_sys_sendto+0x24/0x30 [ 136.616242] do_syscall_64+0x82/0x160 [ 136.616252] ? __sys_recvmsg+0x83/0xe0 [ 136.616265] ? syscall_exit_to_user_mode+0x10/0x210 [ 136.616275] ? do_syscall_64
136.616252] ? __sys_recvmsg+0x83/0xe0 [ 136.616265] ? syscall_exit_to_user_mode+0x10/0x210 [ 136.616275] ? do_syscall_64+0x8e/0x160 [ 136.616282] ? __count_memcg_events+0xa1/0x130 [ 136.616295] ? count_memcg_events.constprop.0+0x1a/0x30 [ 136.616306] ? handle_mm_fault+0xae/0x2d0 [ 136.616319] ? do_user_addr_fault+0x379/0x670 [ 136.616328] ? clear_bhb_loop+0x45/0xa0 [ 136.616340] ? clear_bhb_loop+0x45/0xa0 [ 136.616349] ? clear_bhb_loop+0x45/0xa0 [ 136.616359] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 136.616369] RIP: 0033:0x7fd30ba7b047 [ 136.616376] Code: 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 80 3d bd d5 0c 00 00 41 89 ca 74 10 b8 2c 00 00 00 0f 05 <48> 3d 00
9 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 80 3d bd d5 0c 00 00 41 89 ca 74 10 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 71 c3 55 48 83 ec 30 44 89 4c 24 2c 4c 89 44 [ 136.616381] RSP: 002b:00007ffde1796d68 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 136.616388] RAX: ffffffffffffffda RBX: 000055d7bd89f2a0 RCX: 00007fd30ba7b047 [ 136.616392] RDX: 0000000000000028 RSI: 000055d7bd89f3b0 RDI: 0000000000000003 [ 136.616396] RBP: 00007ffde1796e10 R08: 00007fd30bb4e200 R09: 000000000000000c [ 136.616399] R10: 0000000000000000 R11: 0000000000000202 R12: 000055d7bd89f340 [ 136.616403] R13: 000055d7bd89f3b0 R14: 000055d78943f200 R15: 0000000000000000 References: - https://git.kernel.org/
40 [ 136.616403] R13: 000055d7bd89f3b0 R14: 000055d78943f200 R15: 0000000000000000 References: - https://git.kernel.org/stable/c/018ff57fd79c38be989b8b3248bbe69bcfb77160 - https://git.kernel.org/stable/c/326e384ee7acbebf0541ac064ac7a4dd1f1dde1d - https://git.kernel.org/stable/c/f77bf1ebf8ff6301ccdbc346f7b52db928f9cbf8
CVE ID: CVE-2025-38403 State: PUBLISHED Published: 2025-07-25T13:08:09.954Z Last Updated: 2025-11-03T17:37:37.415Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: Clear the vmci transport packet properly when initializing it In vmci_transport_packet_init memset the vmci_transport_packet before populating the fields to avoid any uninitialised data being left in the structure. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/19c2cc01ff9a8031398a802676ffb0f4692dd95d - https://git.kernel.org/stable/c/1c1bcb0e78230f533b4103e8cf271d17c3f469f0 - https://git.kernel.org/stable/c
0f4692dd95d - https://git.kernel.org/stable/c/1c1bcb0e78230f533b4103e8cf271d17c3f469f0 - https://git.kernel.org/stable/c/2d44723a091bc853272e1a51a488a3d22b80be5e - https://git.kernel.org/stable/c/0a01021317375b8d1895152f544421ce49299eb1 - https://git.kernel.org/stable/c/94d0c326cb3ee6b0f8bd00e209550b93fcc5c839 - https://git.kernel.org/stable/c/75705b44e0b9aaa74f4c163d93d388bcba9e386a - https://git.kernel.org/stable/c/e9a673153d578fd439919a24e99851b2f87ecbce - https://git.kernel.org/stable/c/223e2288f4b8c262a864e2c03964ffac91744cd5
CVE ID: CVE-2025-38404 State: PUBLISHED Published: 2025-07-25T13:09:25.822Z Last Updated: 2025-11-03T17:37:39.276Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: typec: displayport: Fix potential deadlock The deadlock can occur due to a recursive lock acquisition of `cros_typec_altmode_data::mutex`. The call chain is as follows: 1. cros_typec_altmode_work() acquires the mutex 2. typec_altmode_vdm() -> dp_altmode_vdm() -> 3. typec_altmode_exit() -> cros_typec_altmode_exit() 4. cros_typec_altmode_exit() attempts to acquire the mutex again To prevent this, defer the `typec_altmode_exit()` call by scheduling it rather than cal
empts to acquire the mutex again To prevent this, defer the `typec_altmode_exit()` call by scheduling it rather than calling it directly from within the mutex-protected context. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/749d9076735fb497aae60fbea9fff563f9ea3254 - https://git.kernel.org/stable/c/eb08fca56f1f39e4038cb9bac9864464b13b00aa - https://git.kernel.org/stable/c/7be0d1ea71f52595499da39cea484a895e8ed042 - https://git.kernel.org/stable/c/76cf1f33e7319fe74c94ac92f9814094ee8cc84b - https://git.kernel.org/stable/c/63cff9f57e86b2dc25d7487ca0118df89a665296 - https://git.kernel.org/stable/c/c782f98eef14197affa8a7b91e6981420f109ea9 - https:/
9f57e86b2dc25d7487ca0118df89a665296 - https://git.kernel.org/stable/c/c782f98eef14197affa8a7b91e6981420f109ea9 - https://git.kernel.org/stable/c/80c25d7916a44715338d4f8924c8e52af50d0b9f - https://git.kernel.org/stable/c/099cf1fbb8afc3771f408109f62bdec66f85160e
CVE ID: CVE-2025-38405 State: PUBLISHED Published: 2025-07-25T13:12:07.926Z Last Updated: 2025-07-28T04:21:15.215Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nvmet: fix memory leak of bio integrity If nvmet receives commands with metadata there is a continuous memory leak of kmalloc-128 slab or more precisely bio->bi_integrity. Since commit bf4c89fc8797 ("block: don't call bio_uninit from bio_endio") each user of bio_init has to use bio_uninit as well. Otherwise the bio integrity is not getting free. Nvmet uses bio_init for inline bios. Uninit the inline bio to complete deallocation of integrity in bio. References: - https:
uses bio_init for inline bios. Uninit the inline bio to complete deallocation of integrity in bio. References: - https://git.kernel.org/stable/c/431e58d56fcb5ff1f9eb630724a922e0d2a941df - https://git.kernel.org/stable/c/2e2028fcf924d1c6df017033c8d6e28b735a0508 - https://git.kernel.org/stable/c/190f4c2c863af7cc5bb354b70e0805f06419c038
CVE ID: CVE-2025-38406 State: PUBLISHED Published: 2025-07-25T13:13:29.646Z Last Updated: 2025-11-03T17:37:41.135Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: remove WARN on bad firmware input If the firmware gives bad input, that's nothing to do with the driver's stack at this point etc., so the WARN_ON() doesn't add any value. Additionally, this is one of the top syzbot reports now. Just print a message, and as an added bonus, print the sizes too. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/7a2afdc5af3b82b601f6a2f0d1c90d5f0bc27aeb - https://git.kernel.org/s
ainer: References: - https://git.kernel.org/stable/c/7a2afdc5af3b82b601f6a2f0d1c90d5f0bc27aeb - https://git.kernel.org/stable/c/e6c49f0b203a987c306676d241066451b74db1a5 - https://git.kernel.org/stable/c/46b47d4b06fa7f234d93f0f8ac43798feafcff89 - https://git.kernel.org/stable/c/89bd133529a4d2d68287128b357e49adc00ec690 - https://git.kernel.org/stable/c/347827bd0c5680dac2dd59674616840c4d5154f1 - https://git.kernel.org/stable/c/327997afbb5e62532c28c1861ab5534c01969c9a - https://git.kernel.org/stable/c/27d07deea35ae67f2e75913242e25bdb7e1114e5 - https://git.kernel.org/stable/c/e7417421d89358da071fd2930f91e67c7128fbff
CVE ID: CVE-2025-38407 State: PUBLISHED Published: 2025-07-25T13:20:12.200Z Last Updated: 2025-07-28T04:21:18.004Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: riscv: cpu_ops_sbi: Use static array for boot_data Since commit 6b9f29b81b15 ("riscv: Enable pcpu page first chunk allocator"), if NUMA is enabled, the page percpu allocator may be used on very sparse configurations, or when requested on boot with percpu_alloc=page. In that case, percpu data gets put in the vmalloc area. However, sbi_hsm_hart_start() needs the physical address of a sbi_hart_boot_data, and simply assumes that __pa() would work. This causes the just star
needs the physical address of a sbi_hart_boot_data, and simply assumes that __pa() would work. This causes the just started hart to immediately access an invalid address and hang. Fortunately, struct sbi_hart_boot_data is not too large, so we can simply allocate an array for boot_data statically, putting it in the kernel image. This fixes NUMA=y SMP boot on Sophgo SG2042. To reproduce on QEMU: Set CONFIG_NUMA=y and CONFIG_DEBUG_VIRTUAL=y, then run with: qemu-system-riscv64 -M virt -smp 2 -nographic \ -kernel arch/riscv/boot/Image \ -append "percpu_alloc=page" Kernel output: [ 0.000000] Booting Linux on hartid 0 [ 0.000000] Linux version 6.16.0-rc1 (dram@sakuya) (riscv64-unknown-linux-gnu-gcc
[ 0.000000] Booting Linux on hartid 0 [ 0.000000] Linux version 6.16.0-rc1 (dram@sakuya) (riscv64-unknown-linux-gnu-gcc (GCC) 14.2.1 20250322, GNU ld (GNU Binutils) 2.44) #11 SMP Tue Jun 24 14:56:22 CST 2025 ... [ 0.000000] percpu: 28 4K pages/cpu s85784 r8192 d20712 ... [ 0.083192] smp: Bringing up secondary CPUs ... [ 0.086722] ------------[ cut here ]------------ [ 0.086849] virt_to_phys used for non-linear address: (____ptrval____) (0xff2000000001d080) [ 0.088001] WARNING: CPU: 0 PID: 1 at arch/riscv/mm/physaddr.c:14 __virt_to_phys+0xae/0xe8 [ 0.088376] Modules linked in: [ 0.088656] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.16.0-rc1 #11 NONE [ 0.088833] Hardware name: riscv-vi
in: [ 0.088656] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.16.0-rc1 #11 NONE [ 0.088833] Hardware name: riscv-virtio,qemu (DT) [ 0.088948] epc : __virt_to_phys+0xae/0xe8 [ 0.089001] ra : __virt_to_phys+0xae/0xe8 [ 0.089037] epc : ffffffff80021eaa ra : ffffffff80021eaa sp : ff2000000004bbc0 [ 0.089057] gp : ffffffff817f49c0 tp : ff60000001d60000 t0 : 5f6f745f74726976 [ 0.089076] t1 : 0000000000000076 t2 : 705f6f745f747269 s0 : ff2000000004bbe0 [ 0.089095] s1 : ff2000000001d080 a0 : 0000000000000000 a1 : 0000000000000000 [ 0.089113] a2 : 0000000000000000 a3 : 0000000000000000 a4 : 0000000000000000 [ 0.089131] a5 : 0000000000000000 a6 : 0000000000000000 a7 : 0000000000000000 [ 0.089155]
00000000 a4 : 0000000000000000 [ 0.089131] a5 : 0000000000000000 a6 : 0000000000000000 a7 : 0000000000000000 [ 0.089155] s2 : ffffffff8130dc00 s3 : 0000000000000001 s4 : 0000000000000001 [ 0.089174] s5 : ffffffff8185eff8 s6 : ff2000007f1eb000 s7 : ffffffff8002a2ec [ 0.089193] s8 : 0000000000000001 s9 : 0000000000000001 s10: 0000000000000000 [ 0.089211] s11: 0000000000000000 t3 : ffffffff8180a9f7 t4 : ffffffff8180a9f7 [ 0.089960] t5 : ffffffff8180a9f8 t6 : ff2000000004b9d8 [ 0.089984] status: 0000000200000120 badaddr: ffffffff80021eaa cause: 0000000000000003 [ 0.090101] [<ffffffff80021eaa>] __virt_to_phys+0xae/0xe8 [ 0.090228] [<ffffffff8001d796>] sbi_cpu_start+0x6e/0xe8 [ 0.090247] [<fffffff
ffffff80021eaa>] __virt_to_phys+0xae/0xe8 [ 0.090228] [<ffffffff8001d796>] sbi_cpu_start+0x6e/0xe8 [ 0.090247] [<ffffffff8001a5da>] __cpu_up+0x1e/0x8c [ 0.090260] [<ffffffff8002a32e>] bringup_cpu+0x42/0x258 [ 0.090277] [<ffffffff8002914c>] cpuhp_invoke_callback+0xe0/0x40c [ 0.090292] [<ffffffff800294e0>] __cpuhp_invoke_callback_range+0x68/0xfc [ 0.090320] [<ffffffff8002a96a>] _cpu_up+0x11a/0x244 [ 0.090334] [<ffffffff8002aae6>] cpu_up+0x52/0x90 [ 0.090384] [<ffffffff80c09350>] bringup_nonboot_cpus+0x78/0x118 [ 0.090411] [<ffffffff80c11060>] smp_init+0x34/0xb8 [ 0.090425] [<ffffffff80c01220>] kernel_init_freeable+0x148/0x2e4 [ 0.090442] [<ffffffff80b83802>] kernel_init+0x1e/0x14c [ 0.090455]
ffffffff80c01220>] kernel_init_freeable+0x148/0x2e4 [ 0.090442] [<ffffffff80b83802>] kernel_init+0x1e/0x14c [ 0.090455] [<ffffffff800124ca>] ret_from_fork_kernel+0xe/0xf0 [ 0.090471] [<ffffffff80b8d9c2>] ret_from_fork_kernel_asm+0x16/0x18 [ 0.090560] ---[ end trace 0000000000000000 ]--- [ 1.179875] CPU1: failed to come online [ 1.190324] smp: Brought up 1 node, 1 CPU References: - https://git.kernel.org/stable/c/f5fe094f35a37adea40b2fd52c99bb1333be9b07 - https://git.kernel.org/stable/c/02c725cd55eb5052b88eeaa3f60a391ef4dcaec5 - https://git.kernel.org/stable/c/2b29be967ae456fc09c320d91d52278cf721be1e
CVE ID: CVE-2025-38408 State: PUBLISHED Published: 2025-07-25T13:20:13.253Z Last Updated: 2025-07-28T11:16:51.729Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: genirq/irq_sim: Initialize work context pointers properly Initialize `ops` member's pointers properly by using kzalloc() instead of kmalloc() when allocating the simulation work context. Otherwise the pointers contain random content leading to invalid dereferencing. References: - https://git.kernel.org/stable/c/19bd7597858dd15802c1d99fcc38e528f469080a - https://git.kernel.org/stable/c/7f73d1def72532bac4d55ea8838f457a6bed955c - https://git.kernel.org/stable/c/8a2277a3c9
- https://git.kernel.org/stable/c/7f73d1def72532bac4d55ea8838f457a6bed955c - https://git.kernel.org/stable/c/8a2277a3c9e4cc5398f80821afe7ecbe9bdf2819
CVE ID: CVE-2025-38409 State: PUBLISHED Published: 2025-07-25T13:20:14.229Z Last Updated: 2025-11-03T17:37:42.074Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix another leak in the submit error path put_unused_fd() doesn't free the installed file, if we've already done fd_install(). So we need to also free the sync_file. Patchwork: https://patchwork.freedesktop.org/patch/653583/ Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/00b3401f692082ddf6342500d1be25560bba46d4 - https://git.kernel.org/stable/c/c40ad1c04d306f7fde26337fdcf8a5979657d93f - https://git.kernel.org/s
00d1be25560bba46d4 - https://git.kernel.org/stable/c/c40ad1c04d306f7fde26337fdcf8a5979657d93f - https://git.kernel.org/stable/c/3f6ce8433a9035b0aa810e1f5b708e9dc1c367b0 - https://git.kernel.org/stable/c/30d3819b0b9173e31b84d662a592af8bad351427 - https://git.kernel.org/stable/c/f681c2aa8676a890eacc84044717ab0fd26e058f
CVE ID: CVE-2025-38410 State: PUBLISHED Published: 2025-07-25T13:20:15.184Z Last Updated: 2025-11-03T17:37:43.099Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix a fence leak in submit error path In error paths, we could unref the submit without calling drm_sched_entity_push_job(), so msm_job_free() will never get called. Since drm_sched_job_cleanup() will NULL out the s_fence, we can use that to detect this case. Patchwork: https://patchwork.freedesktop.org/patch/653584/ Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/5deab0fa6cfd0cd7def17598db15ceb84f950584 - https
- CVE Program Container: References: - https://git.kernel.org/stable/c/5deab0fa6cfd0cd7def17598db15ceb84f950584 - https://git.kernel.org/stable/c/201eba5c9652a900c0b248070263f9acd3735689 - https://git.kernel.org/stable/c/fe2695b2f63bd77e0e03bc0fc779164115bb4699 - https://git.kernel.org/stable/c/0eaa495b3d5710e5ba72051d2e01bb28292c625c - https://git.kernel.org/stable/c/0dc817f852e5f8ec8501d19ef7dcc01affa181d0 - https://git.kernel.org/stable/c/5d319f75ccf7f0927425a7545aa1a22b3eedc189
CVE ID: CVE-2025-38411 State: PUBLISHED Published: 2025-07-25T13:20:15.835Z Last Updated: 2025-07-28T04:21:23.680Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix double put of request If a netfs request finishes during the pause loop, it will have the ref that belongs to the IN_PROGRESS flag removed at that point - however, if it then goes to the final wait loop, that will *also* put the ref because it sees that the IN_PROGRESS flag is clear and incorrectly assumes that this happened when it called the collector. In fact, since IN_PROGRESS is clear, we shouldn't call the collector again since it's done all the cleanu
the collector. In fact, since IN_PROGRESS is clear, we shouldn't call the collector again since it's done all the cleanup, such as calling ->ki_complete(). Fix this by making netfs_collect_in_app() just return, indicating that we're done if IN_PROGRESS is removed. References: - https://git.kernel.org/stable/c/d18facba5a5795ad44b2a00a052e3db2fa77ab12 - https://git.kernel.org/stable/c/9df7b5ebead649b00bf9a53a798e4bf83a1318fd
CVE ID: CVE-2025-38412 State: PUBLISHED Published: 2025-07-25T13:20:16.688Z Last Updated: 2025-11-03T17:37:44.050Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks After retrieving WMI data blocks in sysfs callbacks, check for the validity of them before dereferencing their content. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/92c2d914b5337431d885597a79a3a3d9d55e80b7 - https://git.kernel.org/stable/c/68e9963583d11963ceca5d276e9c44684509f759 - https://git.kernel.org/stable/c/0deb3eb78ebf225cb41aa9b2b21
rnel.org/stable/c/68e9963583d11963ceca5d276e9c44684509f759 - https://git.kernel.org/stable/c/0deb3eb78ebf225cb41aa9b2b2150f46cbfd359e - https://git.kernel.org/stable/c/5df3b870bc389a1767c72448a3ce1c576ef4deab - https://git.kernel.org/stable/c/aaf847dcb4114fe8b25d4c1c790bedcb6088cb3d - https://git.kernel.org/stable/c/eb617dd25ca176f3fee24f873f0fd60010773d67
CVE ID: CVE-2025-38413 State: PUBLISHED Published: 2025-07-25T13:20:17.394Z Last Updated: 2025-07-28T04:21:26.450Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: virtio-net: xsk: rx: fix the frame's length check When calling buf_to_xdp, the len argument is the frame data's length without virtio header's length (vi->hdr_len). We check that len with xsk_pool_get_rx_frame_size() + vi->hdr_len to ensure the provided len does not larger than the allocated chunk size. The additional vi->hdr_len is because in virtnet_add_recvbuf_xsk, we use part of XDP_PACKET_HEADROOM for virtio header and ask the vhost to start placing data from hard
_add_recvbuf_xsk, we use part of XDP_PACKET_HEADROOM for virtio header and ask the vhost to start placing data from hard_start + XDP_PACKET_HEADROOM - vi->hdr_len not hard_start + XDP_PACKET_HEADROOM But the first buffer has virtio_header, so the maximum frame's length in the first buffer can only be xsk_pool_get_rx_frame_size() not xsk_pool_get_rx_frame_size() + vi->hdr_len like in the current check. This commit adds an additional argument to buf_to_xdp differentiate between the first buffer and other ones to correctly calculate the maximum frame's length. References: - https://git.kernel.org/stable/c/892f6ed9a4a38bb3360fdff091b9241cfa105b61 - https://git.kernel.org/stable/c/6013bb6bc24c2ca
tps://git.kernel.org/stable/c/892f6ed9a4a38bb3360fdff091b9241cfa105b61 - https://git.kernel.org/stable/c/6013bb6bc24c2cac3f45b37a15b71b232a5b00ff - https://git.kernel.org/stable/c/5177373c31318c3c6a190383bfd232e6cf565c36
CVE ID: CVE-2025-38414 State: PUBLISHED Published: 2025-07-25T13:32:08.777Z Last Updated: 2025-07-28T04:21:27.806Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 GCC_GCC_PCIE_HOT_RST is wrongly defined for WCN7850, causing kernel crash on some specific platforms. Since this register is divergent for WCN7850 and QCN9274, move it to register table to allow different definitions. Then correct the register address for WCN7850 to fix this issue. Note IPQ5332 is not affected as it is not PCIe based device. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_