Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-38723 State: PUBLISHED Published: 2025-09-04T15:33:16.547Z Last Updated: 2025-11-03T17:41:51.527Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix jump offset calculation in tailcall The extra pass of bpf_int_jit_compile() skips JIT context initialization which essentially skips offset calculation leaving out_offset = -1, so the jmp_offset in emit_bpf_tail_call is calculated by "#define jmp_offset (out_offset - (cur_offset))" is a negative number, which is wrong. The final generated assembly are as follow. 54: bgeu $a2, $t1, -8 # 0x0000004c 58: addi.d $a6, $s5, -1 5c: bltz $a6, -16 # 0x0000004
nerated assembly are as follow. 54: bgeu $a2, $t1, -8 # 0x0000004c 58: addi.d $a6, $s5, -1 5c: bltz $a6, -16 # 0x0000004c 60: alsl.d $t2, $a2, $a1, 0x3 64: ld.d $t2, $t2, 264 68: beq $t2, $zero, -28 # 0x0000004c Before apply this patch, the follow test case will reveal soft lock issues. cd tools/testing/selftests/bpf/ ./test_progs --allow=tailcalls/tailcall_bpf2bpf_1 dmesg: watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [test_progs:25056] Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/1a782fa32e644aa9fbae6c8488f3e61221ac96e1 - https://git.kernel.org/stable/c/17c010fe45def335fe03a0718935416b04c7f349 - https://git.kernel.org/stable/c/f83d469
6e1 - https://git.kernel.org/stable/c/17c010fe45def335fe03a0718935416b04c7f349 - https://git.kernel.org/stable/c/f83d469e16bb1f75991ca67c56786fb2aaa42bea - https://git.kernel.org/stable/c/f2b5e50cc04d7a049b385bc1c93b9cbf5f10c94f - https://git.kernel.org/stable/c/9262e3e04621558e875eb5afb5e726b648cd5949 - https://git.kernel.org/stable/c/cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3
CVE ID: CVE-2025-38724 State: PUBLISHED Published: 2025-09-04T15:33:22.370Z Last Updated: 2025-11-03T17:41:53.468Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lead to a UAF. Fix this by getting a reference early in the case where there is an extant confirmed client. If that fails then treat it as if there were no confirmed client f
n the case where there is an extant confirmed client. If that fails then treat it as if there were no confirmed client found at all. In the case where the unconfirmed client is expiring, just fail and return the result from get_client_locked(). Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/3f252a73e81aa01660cb426735eab932e6182e8d - https://git.kernel.org/stable/c/d35ac850410966010e92f401f4e21868a9ea4d8b - https://git.kernel.org/stable/c/f3aac6cf390d8b80e1d82975faf4ac61175519c0 - https://git.kernel.org/stable/c/22f45cedf281e6171817c8a3432c44d788c550e1 - https://git.kernel.org/stable/c/d71abd1ae4e0413707cd42b10c24a11d1aa71772 - https://git.ker
6171817c8a3432c44d788c550e1 - https://git.kernel.org/stable/c/d71abd1ae4e0413707cd42b10c24a11d1aa71772 - https://git.kernel.org/stable/c/74ad36ed60df561a303a19ecef400c7096b20306 - https://git.kernel.org/stable/c/36e83eda90e0e4ac52f259f775b40b2841f8a0a3 - https://git.kernel.org/stable/c/571a5e46c71490285d2d8c06f6b5a7cbf6c7edd1 - https://git.kernel.org/stable/c/908e4ead7f757504d8b345452730636e298cbf68
CVE ID: CVE-2025-38725 State: PUBLISHED Published: 2025-09-04T15:33:23.468Z Last Updated: 2025-11-03T17:41:54.427Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: add phy_mask for ax88772 mdio bus Without setting phy_mask for ax88772 mdio bus, current driver may create at most 32 mdio phy devices with phy address range from 0x00 ~ 0x1f. DLink DUB-E100 H/W Ver B1 is such a device. However, only one main phy device will bind to net phy driver. This is creating issue during system suspend/resume since phy_polling_mode() in phy_state_machine() will directly deference member of phydev->drv for non-main phy dev
esume since phy_polling_mode() in phy_state_machine() will directly deference member of phydev->drv for non-main phy devices. Then NULL pointer dereference issue will occur. Due to only external phy or internal phy is necessary, add phy_mask for ax88772 mdio bus to workarnoud the issue. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/75947d3200de98a9ded9ad8972e02f1a177097fe - https://git.kernel.org/stable/c/59ed6fbdb1bc03316e09493ffde7066f031c7524 - https://git.kernel.org/stable/c/ccef5ee4adf56472aa26bdd1f821a6d0cd06089a - https://git.kernel.org/stable/c/ee2cd40b0bb46056949a2319084a729d95389386 - https://git.kernel.org/stable/c/a754ab53993b158
tps://git.kernel.org/stable/c/ee2cd40b0bb46056949a2319084a729d95389386 - https://git.kernel.org/stable/c/a754ab53993b1585132e871c5d811167ad3c52ff - https://git.kernel.org/stable/c/ad1f8313aeec0115f9978bd2d002ef4a8d96c773 - https://git.kernel.org/stable/c/4faff70959d51078f9ee8372f8cff0d7045e4114
CVE ID: CVE-2025-38726 State: PUBLISHED Published: 2025-09-04T15:33:24.527Z Last Updated: 2025-09-29T05:56:52.401Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect After the call to phy_disconnect() netdev->phydev is reset to NULL. So fixed_phy_unregister() would be called with a NULL pointer as argument. Therefore cache the phy_device before this call. References: - https://git.kernel.org/stable/c/ae59ec969c07c73f0610f8bd7e648f01e798d222 - https://git.kernel.org/stable/c/44bcd397ad9cd1a6b25fabb7f5edbee4fb0cfc2e - https://git.kernel.org/stable/c/9ad90dd
222 - https://git.kernel.org/stable/c/44bcd397ad9cd1a6b25fabb7f5edbee4fb0cfc2e - https://git.kernel.org/stable/c/9ad90dd34b4e8e5be1e45a4559f4de0f14e53af2 - https://git.kernel.org/stable/c/e88fbc30dda1cb7438515303704ceddb3ade4ecd
CVE ID: CVE-2025-38727 State: PUBLISHED Published: 2025-09-04T15:33:25.286Z Last Updated: 2025-11-03T17:41:56.297Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netlink: avoid infinite retry looping in netlink_unicast() netlink_attachskb() checks for the socket's read memory allocation constraints. Firstly, it has: rmem < READ_ONCE(sk->sk_rcvbuf) to check if the just increased rmem value fits into the socket's receive buffer. If not, it proceeds and tries to wait for the memory under: rmem + skb->truesize > READ_ONCE(sk->sk_rcvbuf) The checks don't cover the case when skb->truesize + sk->sk_rmem_alloc is equal to sk->sk_rcvbuf
EAD_ONCE(sk->sk_rcvbuf) The checks don't cover the case when skb->truesize + sk->sk_rmem_alloc is equal to sk->sk_rcvbuf. Thus the function neither successfully accepts these conditions, nor manages to reschedule the task - and is called in retry loop for indefinite time which is caught as: rcu: INFO: rcu_sched self-detected stall on CPU rcu: 0-....: (25999 ticks this GP) idle=ef2/1/0x4000000000000000 softirq=262269/262269 fqs=6212 (t=26000 jiffies g=230833 q=259957) NMI backtrace for cpu 0 CPU: 0 PID: 22 Comm: kauditd Not tainted 5.10.240 #68 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc42 04/01/2014 Call Trace: <IRQ> dump_stack lib/dump_stack.c:120 nmi_cpu_backtra
C (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc42 04/01/2014 Call Trace: <IRQ> dump_stack lib/dump_stack.c:120 nmi_cpu_backtrace.cold lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace lib/nmi_backtrace.c:62 rcu_dump_cpu_stacks kernel/rcu/tree_stall.h:335 rcu_sched_clock_irq.cold kernel/rcu/tree.c:2590 update_process_times kernel/time/timer.c:1953 tick_sched_handle kernel/time/tick-sched.c:227 tick_sched_timer kernel/time/tick-sched.c:1399 __hrtimer_run_queues kernel/time/hrtimer.c:1652 hrtimer_interrupt kernel/time/hrtimer.c:1717 __sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1113 asm_call_irq_on_stack arch/x86/entry/entry_64.S:808 </IRQ> netlink_attachskb net/netlink/af_netlink.c:1
apic/apic.c:1113 asm_call_irq_on_stack arch/x86/entry/entry_64.S:808 </IRQ> netlink_attachskb net/netlink/af_netlink.c:1234 netlink_unicast net/netlink/af_netlink.c:1349 kauditd_send_queue kernel/audit.c:776 kauditd_thread kernel/audit.c:897 kthread kernel/kthread.c:328 ret_from_fork arch/x86/entry/entry_64.S:304 Restore the original behavior of the check which commit in Fixes accidentally missed when restructuring the code. Found by Linux Verification Center (linuxtesting.org). Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/47d49fd07f86d1f55ea1083287303d237e9e0922 - https://git.kernel.org/stable/c/6bee383ff83352a693d03efdf27cdd80742f71b2 - h
/47d49fd07f86d1f55ea1083287303d237e9e0922 - https://git.kernel.org/stable/c/6bee383ff83352a693d03efdf27cdd80742f71b2 - https://git.kernel.org/stable/c/f324959ad47e62e3cadaffa65d3cff790fb48529 - https://git.kernel.org/stable/c/d42b71a34f6b8a2d5c53df81169b03b8d8b5cf4e - https://git.kernel.org/stable/c/346c820ef5135cf062fa3473da955ef8c5fb6929 - https://git.kernel.org/stable/c/44ddd7b1ae0b7edb2c832eb16798c827a05e58f0 - https://git.kernel.org/stable/c/78fcd69d55c5f11d7694c547eca767a1cfd38ec4 - https://git.kernel.org/stable/c/e8edc7de688791a337c068693f22e8d8b869df71 - https://git.kernel.org/stable/c/759dfc7d04bab1b0b86113f1164dc1fec192b859
CVE ID: CVE-2025-38728 State: PUBLISHED Published: 2025-09-04T15:33:26.039Z Last Updated: 2025-11-03T17:41:57.246Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb3: fix for slab out of bounds on mount to ksmbd With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parse_server_interfaces() (see below): BUG: KASAN: slab-out-of-bounds in parse_server_interfaces+0x14ee/0x1880 [cifs] Read of size 4 at addr ffff8881433dba98 by task mount/9827 CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G OE 6.16.0-rc2-kasan #2 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Ha
D: 9827 Comm: mount Tainted: G OE 6.16.0-rc2-kasan #2 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. Precision Tower 3620/0MWYPT, BIOS 2.13.1 06/14/2019 Call Trace: <TASK> dump_stack_lvl+0x9f/0xf0 print_report+0xd1/0x670 __virt_addr_valid+0x22c/0x430 ? parse_server_interfaces+0x14ee/0x1880 [cifs] ? kasan_complete_mode_report_info+0x2a/0x1f0 ? parse_server_interfaces+0x14ee/0x1880 [cifs] kasan_report+0xd6/0x110 parse_server_interfaces+0x14ee/0x1880 [cifs] __asan_report_load_n_noabort+0x13/0x20 parse_server_interfaces+0x14ee/0x1880 [cifs] ? __pfx_parse_server_interfaces+0x10/0x10 [cifs] ? trace_hardirqs_on+0x51/0x60 SMB3_request_interfaces+0x1ad/0x3f0
ifs] ? __pfx_parse_server_interfaces+0x10/0x10 [cifs] ? trace_hardirqs_on+0x51/0x60 SMB3_request_interfaces+0x1ad/0x3f0 [cifs] ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs] ? SMB2_tcon+0x23c/0x15d0 [cifs] smb3_qfs_tcon+0x173/0x2b0 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] ? cifs_get_tcon+0x105d/0x2120 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_get_tcon+0x105d/0x2120 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] cifs_mount_get_tcon+0x369/0xb90 [cifs] ? dfs_cache_find+0xe7/0x150 [cifs] dfs_mount_share+0x985/0x2970 [cifs] ? check_path.constprop.0+0x28/0x50 ? save_trace+0x54/0x370 ? __pfx_dfs_mount_share+0x10/0x10 [cifs] ? __lock_acquire+0xb82/0x2ba0 ? __kasan_check_write+0x18/0x20 cif
ce+0x54/0x370 ? __pfx_dfs_mount_share+0x10/0x10 [cifs] ? __lock_acquire+0xb82/0x2ba0 ? __kasan_check_write+0x18/0x20 cifs_mount+0xbc/0x9e0 [cifs] ? __pfx_cifs_mount+0x10/0x10 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_setup_cifs_sb+0x29d/0x810 [cifs] cifs_smb3_do_mount+0x263/0x1990 [cifs] Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/9bdb8e98a0073c73ab3e6c631ec78877ceb64565 - https://git.kernel.org/stable/c/a0620e1525663edd8c4594f49fb75fe5be4724b0 - https://git.kernel.org/stable/c/8de33d4d72e8fae3502ec3850bd7b14e7c7328b6 - https://git.kernel.org/stable/c/a542f93a123555d09c3ce8bc947f7b56ad8e6463 - https://git.kernel.org/stable/c/f6eda5b0e8
- https://git.kernel.org/stable/c/a542f93a123555d09c3ce8bc947f7b56ad8e6463 - https://git.kernel.org/stable/c/f6eda5b0e8f8123564c5b34f5801d63243032eac - https://git.kernel.org/stable/c/7d34ec36abb84fdfb6632a0f2cbda90379ae21fc
CVE ID: CVE-2025-38729 State: PUBLISHED Published: 2025-09-04T15:33:26.896Z Last Updated: 2025-11-03T17:41:59.112Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/1666207ba0a5973735ef010812536adde6174e81 - https://git.kernel.org/stable/c/ebc9e06b6ea978a20abf9b87d41afc51b2d745ac - https://git.kernel.org/stable/c/f03418bb9d542f44df78
/git.kernel.org/stable/c/ebc9e06b6ea978a20abf9b87d41afc51b2d745ac - https://git.kernel.org/stable/c/f03418bb9d542f44df78eec2eff4ac83c0a8ac0d - https://git.kernel.org/stable/c/40714daf4d0448e1692c78563faf0ed0f9d9b5c7 - https://git.kernel.org/stable/c/07c8d78dbb5e0ff8b23f7fd69cd1d4e2ba22b3dc - https://git.kernel.org/stable/c/cd08d390d15b204cac1d3174f5f149a20c52e61a - https://git.kernel.org/stable/c/29b415ec09f5b9d1dfa2423b826725a8c8796b9a - https://git.kernel.org/stable/c/452ad54f432675982cc0d6eb6c40a6c86ac61dbd - https://git.kernel.org/stable/c/d832ccbc301fbd9e5a1d691bdcf461cdb514595f
CVE ID: CVE-2025-38730 State: PUBLISHED Published: 2025-09-04T15:33:27.691Z Last Updated: 2025-09-29T05:56:57.382Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: io_uring/net: commit partial buffers on retry Ring provided buffers are potentially only valid within the single execution context in which they were acquired. io_uring deals with this and invalidates them on retry. But on the networking side, if MSG_WAITALL is set, or if the socket is of the streaming type and too little was processed, then it will hang on to the buffer rather than recycle or commit it. This is problematic for two reasons: 1) If someone unregisters th
ang on to the buffer rather than recycle or commit it. This is problematic for two reasons: 1) If someone unregisters the provided buffer ring before a later retry, then the req->buf_list will no longer be valid. 2) If multiple sockers are using the same buffer group, then multiple receives can consume the same memory. This can cause data corruption in the application, as either receive could land in the same userspace buffer. Fix this by disallowing partial retries from pinning a provided buffer across multiple executions, if ring provided buffers are used. References: - https://git.kernel.org/stable/c/3b53dc1c641f2884d4750fc25aaf6c36b90db606 - https://git.kernel.org/stable/c/fe9da1812f8697
ttps://git.kernel.org/stable/c/3b53dc1c641f2884d4750fc25aaf6c36b90db606 - https://git.kernel.org/stable/c/fe9da1812f8697a38f7e30991d568ec199e16059 - https://git.kernel.org/stable/c/21a4ddb0f5e933f372808c10b9ac704505751bb1 - https://git.kernel.org/stable/c/2eb7937b5fc7fcd90eab7bebb0181214b61b9283 - https://git.kernel.org/stable/c/41b70df5b38bc80967d2e0ed55cc3c3896bba781
CVE ID: CVE-2025-38731 State: PUBLISHED Published: 2025-09-05T17:20:30.618Z Last Updated: 2025-09-29T05:56:58.641Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix vm_bind_ioctl double free bug If the argument check during an array bind fails, the bind_ops are freed twice as seen below. Fix this by setting bind_ops to NULL after freeing. ================================================================== BUG: KASAN: double-free in xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] Free of addr ffff88813bb9b800 by task xe_vm/14198 CPU: 5 UID: 0 PID: 14198 Comm: xe_vm Not tainted 6.16.0-xe-eudebug-cmanszew+ #520 PREEMPT(full) Hardware n
k xe_vm/14198 CPU: 5 UID: 0 PID: 14198 Comm: xe_vm Not tainted 6.16.0-xe-eudebug-cmanszew+ #520 PREEMPT(full) Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR5 RVP, BIOS ADLPFWI1.R00.2411.A02.2110081023 10/08/2021 Call Trace: <TASK> dump_stack_lvl+0x82/0xd0 print_report+0xcb/0x610 ? __virt_addr_valid+0x19a/0x300 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] kasan_report_invalid_free+0xc8/0xf0 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] check_slab_allocation+0x102/0x130 kfree+0x10d/0x440 ? should_fail_ex+0x57/0x2f0 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] ? __lock_acquire+0xa
_ioctl+0x1b2/0x21f0 [xe] xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] ? __lock_acquire+0xab9/0x27f0 ? lock_acquire+0x165/0x300 ? drm_dev_enter+0x53/0xe0 [drm] ? find_held_lock+0x2b/0x80 ? drm_dev_exit+0x30/0x50 [drm] ? drm_ioctl_kernel+0x128/0x1c0 [drm] drm_ioctl_kernel+0x128/0x1c0 [drm] ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] ? find_held_lock+0x2b/0x80 ? __pfx_drm_ioctl_kernel+0x10/0x10 [drm] ? should_fail_ex+0x57/0x2f0 ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] drm_ioctl+0x352/0x620 [drm] ? __pfx_drm_ioctl+0x10/0x10 [drm] ? __pfx_rpm_resume+0x10/0x10 ? do_raw_spin_lock+0x11a/0x1b0 ? find_held_lock+0x2b/0x80 ? __pm_runtime_resume+0x61/0xc0 ? rcu_is_watching+0x20/0
/0x10 ? do_raw_spin_lock+0x11a/0x1b0 ? find_held_lock+0x2b/0x80 ? __pm_runtime_resume+0x61/0xc0 ? rcu_is_watching+0x20/0x50 ? trace_irq_enable.constprop.0+0xac/0xe0 xe_drm_ioctl+0x91/0xc0 [xe] __x64_sys_ioctl+0xb2/0x100 ? rcu_is_watching+0x20/0x50 do_syscall_64+0x68/0x2e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fa9acb24ded (cherry picked from commit a01b704527c28a2fd43a17a85f8996b75ec8492a) References: - https://git.kernel.org/stable/c/77a946bf1af0e8110ef6e243394217a17f9b7e33 - https://git.kernel.org/stable/c/111fb43a557726079a67ce3ab51f602ddbf7097e
CVE ID: CVE-2025-38732 State: PUBLISHED Published: 2025-09-05T17:20:31.934Z Last Updated: 2025-11-03T17:42:03.823Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject: don't leak dst refcount for loopback packets recent patches to add a WARN() when replacing skb dst entry found an old bug: WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline] WARNING: include/linux/skbuff.h:1165 skb_dst_set include/linux/skbuff.h:1210 [inline] WARNING: include/linux/skbuff.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234 [..] Call Trace: nf_send_unreach+0x1
f.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234 [..] Call Trace: nf_send_unreach+0x17b/0x6e0 net/ipv4/netfilter/nf_reject_ipv4.c:325 nft_reject_inet_eval+0x4bc/0x690 net/netfilter/nft_reject_inet.c:27 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] .. This is because blamed commit forgot about loopback packets. Such packets already have a dst_entry attached, even at PRE_ROUTING stage. Instead of checking hook just check if the skb already has a route attached to it. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/7b8b503c06274ef3c6c1a107743f1ec0d0a53ef8 - https://git.kernel.org/stable/c/82ef97
ces: - https://git.kernel.org/stable/c/7b8b503c06274ef3c6c1a107743f1ec0d0a53ef8 - https://git.kernel.org/stable/c/82ef97abf22790182f7d433c74960dfd61b99c33 - https://git.kernel.org/stable/c/b7a885ba25960c91db237c3f83b4285156789bce - https://git.kernel.org/stable/c/a0a3ace2a57887dac1e7c9a724846040c3e31868 - https://git.kernel.org/stable/c/51e8531371f90bee742c63775c9a568e5d6bf3c5 - https://git.kernel.org/stable/c/b32e1590a8d22cf7d7f965e46d5576051acf8e42 - https://git.kernel.org/stable/c/91a79b792204313153e1bdbbe5acbfc28903b3a5
CVE ID: CVE-2025-38733 State: PUBLISHED Published: 2025-09-05T17:20:33.075Z Last Updated: 2025-09-29T05:57:01.534Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: s390/mm: Do not map lowcore with identity mapping Since the identity mapping is pinned to address zero the lowcore is always also mapped to address zero, this happens regardless of the relocate_lowcore command line option. If the option is specified the lowcore is mapped twice, instead of only once. This means that NULL pointer accesses will succeed instead of causing an exception (low address protection still applies, but covers only parts). To fix this never map the
nstead of causing an exception (low address protection still applies, but covers only parts). To fix this never map the first two pages of physical memory with the identity mapping. References: - https://git.kernel.org/stable/c/30bf5728bb217a6d1ba73f44094c9b9c6bc9a567 - https://git.kernel.org/stable/c/1d7864acd497cb468a998d44631f84896f885e85 - https://git.kernel.org/stable/c/93f616ff870a1fb7e84d472cad0af651b18f9f87
CVE ID: CVE-2025-38734 State: PUBLISHED Published: 2025-09-05T17:20:34.126Z Last Updated: 2025-09-29T05:57:03.016Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on smcsk after smc_listen_out() BPF CI testing report a UAF issue: [ 16.446633] BUG: kernel NULL pointer dereference, address: 000000000000003 0 [ 16.447134] #PF: supervisor read access in kernel mod e [ 16.447516] #PF: error_code(0x0000) - not-present pag e [ 16.447878] PGD 0 P4D 0 [ 16.448063] Oops: Oops: 0000 [#1] PREEMPT SMP NOPT I [ 16.448409] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Tainted: G OE 6.13.0-rc3-g89e8a75fda73-dirty #4 2 [ 16.449124] Tai
I [ 16.448409] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Tainted: G OE 6.13.0-rc3-g89e8a75fda73-dirty #4 2 [ 16.449124] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODUL E [ 16.449502] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/201 4 [ 16.450201] Workqueue: smc_hs_wq smc_listen_wor k [ 16.450531] RIP: 0010:smc_listen_work+0xc02/0x159 0 [ 16.452158] RSP: 0018:ffffb5ab40053d98 EFLAGS: 0001024 6 [ 16.452526] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 000000000000030 0 [ 16.452994] RDX: 0000000000000280 RSI: 00003513840053f0 RDI: 000000000000000 0 [ 16.453492] RBP: ffffa097808e3800 R08: ffffa09782dba1e0 R09: 000000000000000 5 [ 16.453987] R10: 00000
00000000000000 0 [ 16.453492] RBP: ffffa097808e3800 R08: ffffa09782dba1e0 R09: 000000000000000 5 [ 16.453987] R10: 0000000000000000 R11: 0000000000000000 R12: ffffa0978274640 0 [ 16.454497] R13: 0000000000000000 R14: 0000000000000000 R15: ffffa09782d4092 0 [ 16.454996] FS: 0000000000000000(0000) GS:ffffa097bbc00000(0000) knlGS:000000000000000 0 [ 16.455557] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003 3 [ 16.455961] CR2: 0000000000000030 CR3: 0000000102788004 CR4: 0000000000770ef 0 [ 16.456459] PKRU: 5555555 4 [ 16.456654] Call Trace : [ 16.456832] <TASK > [ 16.456989] ? __die+0x23/0x7 0 [ 16.457215] ? page_fault_oops+0x180/0x4c 0 [ 16.457508] ? __lock_acquire+0x3e6/0x249 0 [ 16.457801] ?
__die+0x23/0x7 0 [ 16.457215] ? page_fault_oops+0x180/0x4c 0 [ 16.457508] ? __lock_acquire+0x3e6/0x249 0 [ 16.457801] ? exc_page_fault+0x68/0x20 0 [ 16.458080] ? asm_exc_page_fault+0x26/0x3 0 [ 16.458389] ? smc_listen_work+0xc02/0x159 0 [ 16.458689] ? smc_listen_work+0xc02/0x159 0 [ 16.458987] ? lock_is_held_type+0x8f/0x10 0 [ 16.459284] process_one_work+0x1ea/0x6d 0 [ 16.459570] worker_thread+0x1c3/0x38 0 [ 16.459839] ? __pfx_worker_thread+0x10/0x1 0 [ 16.460144] kthread+0xe0/0x11 0 [ 16.460372] ? __pfx_kthread+0x10/0x1 0 [ 16.460640] ret_from_fork+0x31/0x5 0 [ 16.460896] ? __pfx_kthread+0x10/0x1 0 [ 16.461166] ret_from_fork_asm+0x1a/0x3 0 [ 16.461453] </TASK > [ 16.461616] Modules linked