Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-38648 State: PUBLISHED Published: 2025-08-22T16:00:52.825Z Last Updated: 2025-09-29T05:55:28.653Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: spi: stm32: Check for cfg availability in stm32_spi_probe The stm32_spi_probe function now includes a check to ensure that the pointer returned by of_device_get_match_data is not NULL before accessing its members. This resolves a warning where a potential NULL pointer dereference could occur when accessing cfg->has_device_mode. Before accessing the 'has_device_mode' member, we verify that 'cfg' is not NULL. If 'cfg' is NULL, an error message is logged. This change ensu
as_device_mode' member, we verify that 'cfg' is not NULL. If 'cfg' is NULL, an error message is logged. This change ensures that the driver does not attempt to access configuration data if it is not available, thus preventing a potential system crash due to a NULL pointer dereference. References: - https://git.kernel.org/stable/c/6031a54f4eac921efe6122a561d44df89b37f2d4 - https://git.kernel.org/stable/c/a7645815edf4478f3258bb0db95a08986a77f5c0 - https://git.kernel.org/stable/c/3a571a8d52272cc26858ab1bc83d0f66e5dee938 - https://git.kernel.org/stable/c/cc063d23ad80ef7d201c41b2716b1bae7c662cf9 - https://git.kernel.org/stable/c/21f1c800f6620e43f31dfd76709dbac8ebaa5a16
CVE ID: CVE-2025-38649 State: PUBLISHED Published: 2025-08-22T16:00:53.731Z Last Updated: 2025-09-29T05:55:29.788Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: qcs615: fix a crash issue caused by infinite loop for Coresight An infinite loop has been created by the Coresight devices. When only a source device is enabled, the coresight_find_activated_sysfs_sink function is recursively invoked in an attempt to locate an active sink device, ultimately leading to a stack overflow and system crash. Therefore, disable the replicator1 to break the infinite loop and prevent a potential stack overflow. replicator1_out
h. Therefore, disable the replicator1 to break the infinite loop and prevent a potential stack overflow. replicator1_out -> funnel_swao_in6 -> tmc_etf_swao_in -> tmc_etf_swao_out | | replicator1_in replicator_swao_in | | replicator0_out1 replicator_swao_out0 | | replicator0_in funnel_in1_in3 | | tmc_etf_out <- tmc_etf_in <- funnel_merg_out <- funnel_merg_in1 <- funnel_in1_out [call trace] dump_backtrace+0x9c/0x128 show_stack+0x20/0x38 dump_stack_lvl+0x48/0x60 dump_stack+0x18/0x28 panic+0x340/0x3b0 nmi_panic+0x94/0xa0 panic_bad_stack+0x114/0x138 handle_bad_stack+0x34/0xb8 __bad_stack+0x78/0x80 coresight_find_activated_sysfs_sink+0x28/0xa0 [coresight] coresight_find_activated_sysfs_sink+0x5c/0
bad_stack+0x78/0x80 coresight_find_activated_sysfs_sink+0x28/0xa0 [coresight] coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight] coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight] coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight] coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight] ... coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight] coresight_enable_sysfs+0x80/0x2a0 [coresight] side effect after the change: Only trace data originating from AOSS can reach the ETF_SWAO and EUD sinks. References: - https://git.kernel.org/stable/c/a9aaadcb0a6ce0c19616c46525112bc947c6f2b1 - https://git.kernel.org/stable/c/fbe5be7893b8c7f58c999a26839cd30bc07654c6 - https://git.
6ce0c19616c46525112bc947c6f2b1 - https://git.kernel.org/stable/c/fbe5be7893b8c7f58c999a26839cd30bc07654c6 - https://git.kernel.org/stable/c/bd4f35786d5f0798cc1f8c187a81a7c998e6c58f
CVE ID: CVE-2025-38650 State: PUBLISHED Published: 2025-08-22T16:00:54.556Z Last Updated: 2025-11-03T17:40:43.767Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: hfsplus: remove mutex_lock check in hfsplus_free_extents Syzbot reported an issue in hfsplus filesystem: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 4400 at fs/hfsplus/extents.c:346 hfsplus_free_extents+0x700/0xad0 Call Trace: <TASK> hfsplus_file_truncate+0x768/0xbb0 fs/hfsplus/extents.c:606 hfsplus_write_begin+0xc2/0xd0 fs/hfsplus/inode.c:56 cont_expand_zero fs/buffer.c:2383 [inline] cont_write_begin+0x2cf/0x860 fs/buffer.c:2446 hfsplus_write_begin+0x86/
.c:56 cont_expand_zero fs/buffer.c:2383 [inline] cont_write_begin+0x2cf/0x860 fs/buffer.c:2446 hfsplus_write_begin+0x86/0xd0 fs/hfsplus/inode.c:52 generic_cont_expand_simple+0x151/0x250 fs/buffer.c:2347 hfsplus_setattr+0x168/0x280 fs/hfsplus/inode.c:263 notify_change+0xe38/0x10f0 fs/attr.c:420 do_truncate+0x1fb/0x2e0 fs/open.c:65 do_sys_ftruncate+0x2eb/0x380 fs/open.c:193 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd To avoid deadlock, Commit 31651c607151 ("hfsplus: avoid deadlock on file truncation") unlock extree before hfsplus_free_extents(), and add check wheather extree is locked in hfsplus_
ck on file truncation") unlock extree before hfsplus_free_extents(), and add check wheather extree is locked in hfsplus_free_extents(). However, when operations such as hfsplus_file_release, hfsplus_setattr, hfsplus_unlink, and hfsplus_get_block are executed concurrently in different files, it is very likely to trigger the WARN_ON, which will lead syzbot and xfstest to consider it as an abnormality. The comment above this warning also describes one of the easy triggering situations, which can easily trigger and cause xfstest&syzbot to report errors. [task A] [task B] ->hfsplus_file_release ->hfsplus_file_truncate ->hfs_find_init ->mutex_lock ->mutex_unlock ->hfsplus_write_begin ->hfsplus_get
lus_file_release ->hfsplus_file_truncate ->hfs_find_init ->mutex_lock ->mutex_unlock ->hfsplus_write_begin ->hfsplus_get_block ->hfsplus_file_extend ->hfsplus_ext_read_extent ->hfs_find_init ->mutex_lock ->hfsplus_free_extents WARN_ON(mutex_is_locked) !!! Several threads could try to lock the shared extents tree. And warning can be triggered in one thread when another thread has locked the tree. This is the wrong behavior of the code and we need to remove the warning. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/0807e4ac59a546f2346961c5e26a98901594b205 - https://git.kernel.org/stable/c/fdd6aca652122d6e97787e88d7dd53ddc8b74e7e - https://git.
a546f2346961c5e26a98901594b205 - https://git.kernel.org/stable/c/fdd6aca652122d6e97787e88d7dd53ddc8b74e7e - https://git.kernel.org/stable/c/14922f0cc92e010b160121679c0a6ca072f4e975 - https://git.kernel.org/stable/c/a19ce9230b22a0866313932e7964cf05557a6008 - https://git.kernel.org/stable/c/084933961ecda7561dedfb78c4676ccb90c91ada - https://git.kernel.org/stable/c/5055b7db94110f228961dea6b74eed0a93a50b01 - https://git.kernel.org/stable/c/9764b8bb9f5f94df105cd2ac43829dd0d2c82b9f - https://git.kernel.org/stable/c/314310166ba1fdff7660dfd9d18ea42d7058f7ae - https://git.kernel.org/stable/c/fcb96956c921f1aae7e7b477f2435c56f77a31b4
CVE ID: CVE-2025-38651 State: PUBLISHED Published: 2025-08-22T16:00:55.579Z Last Updated: 2025-09-29T05:55:32.200Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: landlock: Fix warning from KUnit tests get_id_range() expects a positive value as first argument but get_random_u8() can return 0. Fix this by clamping it. Validated by running the test in a for loop for 1000 times. Note that MAX() is wrong as it is only supposed to be used for constants, but max() is good here. [..] ok 9 test_range2_rand1 [..] ok 10 test_range2_rand2 [..] ok 11 test_range2_rand15 [..] ------------[ cut here ]------------ [..] WARNING: CPU: 6 PID: 104
test_range2_rand2 [..] ok 11 test_range2_rand15 [..] ------------[ cut here ]------------ [..] WARNING: CPU: 6 PID: 104 at security/landlock/id.c:99 test_range2_rand16 (security/landlock/id.c:99 (discriminator 1) security/landlock/id.c:234 (discriminator 1)) [..] Modules linked in: [..] CPU: 6 UID: 0 PID: 104 Comm: kunit_try_catch Tainted: G N 6.16.0-rc1-dev-00001-g314a2f98b65f #1 PREEMPT(undef) [..] Tainted: [N]=TEST [..] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [..] RIP: 0010:test_range2_rand16 (security/landlock/id.c:99 (discriminator 1) security/landlock/id.c:234 (discriminator 1)) [..] Code: 49 c7 c0 10 70 30 82 4c 89 ff 48 c7 c6 a0 63 1
discriminator 1) security/landlock/id.c:234 (discriminator 1)) [..] Code: 49 c7 c0 10 70 30 82 4c 89 ff 48 c7 c6 a0 63 1e 83 49 c7 45 a0 e0 63 1e 83 e8 3f 95 17 00 e9 1f ff ff ff 0f 0b e9 df fd ff ff <0f> 0b ba 01 00 00 00 e9 68 fe ff ff 49 89 45 a8 49 8d 4d a0 45 31 [..] RSP: 0000:ffff888104eb7c78 EFLAGS: 00010246 [..] RAX: 0000000000000000 RBX: 000000000870822c RCX: 0000000000000000 ^^^^^^^^^^^^^^^^ [..] [..] Call Trace: [..] [..] ---[ end trace 0000000000000000 ]--- [..] ok 12 test_range2_rand16 [..] # landlock_id: pass:12 fail:0 skip:0 total:12 [..] # Totals: pass:12 fail:0 skip:0 total:12 [..] ok 1 landlock_id [mic: Minor cosmetic improvements] References: - https://git.kernel.org/stabl
il:0 skip:0 total:12 [..] ok 1 landlock_id [mic: Minor cosmetic improvements] References: - https://git.kernel.org/stable/c/127183361b69dbb7ac3246ad4726f93400481249 - https://git.kernel.org/stable/c/7d9ec2cfe12dd0d7c1a58213b9bef1bec66a3189 - https://git.kernel.org/stable/c/e0a69cf2c03e61bd8069becb97f66c173d0d1fa1
CVE ID: CVE-2025-38652 State: PUBLISHED Published: 2025-08-22T16:00:56.445Z Last Updated: 2025-11-03T17:40:45.643Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid out-of-boundary access in devs.path - touch /mnt/f2fs/012345678901234567890123456789012345678901234567890123 - truncate -s $((1024*1024*1024)) \ /mnt/f2fs/012345678901234567890123456789012345678901234567890123 - touch /mnt/f2fs/file - truncate -s $((1024*1024*1024)) /mnt/f2fs/file - mkfs.f2fs /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \ -c /mnt/f2fs/file - mount /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \
012345678901234567890123 \ -c /mnt/f2fs/file - mount /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \ /mnt/f2fs/loop [16937.192225] F2FS-fs (loop0): Mount Device [ 0]: /mnt/f2fs/012345678901234567890123456789012345678901234567890123\xff\x01, 511, 0 - 3ffff [16937.192268] F2FS-fs (loop0): Failed to find devices If device path length equals to MAX_PATH_LEN, sbi->devs.path[] may not end up w/ null character due to path array is fully filled, So accidently, fields locate after path[] may be treated as part of device path, result in parsing wrong device path. struct f2fs_dev_info { ... char path[MAX_PATH_LEN]; ... }; Let's add one byte space for sbi->devs.path[] to store null ch
truct f2fs_dev_info { ... char path[MAX_PATH_LEN]; ... }; Let's add one byte space for sbi->devs.path[] to store null character of device path string. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/dc0172c74bd9edaee7bea2ebb35f3dbd37a8ae80 - https://git.kernel.org/stable/c/1cf1ff15f262e8baf12201b270b6a79f9d119b2d - https://git.kernel.org/stable/c/666b7cf6ac9aa074b8319a2b68cba7f2c30023f0 - https://git.kernel.org/stable/c/3466721f06edff834f99d9f49f23eabc6b2cb78e - https://git.kernel.org/stable/c/345fc8d1838f3f8be7c8ed08d86a13dedef67136 - https://git.kernel.org/stable/c/70849d33130a2cf1d6010069ed200669c8651fbd - https://git.kernel.org/stable/c/75
def67136 - https://git.kernel.org/stable/c/70849d33130a2cf1d6010069ed200669c8651fbd - https://git.kernel.org/stable/c/755427093e4294ac111c3f9e40d53f681a0fbdaa - https://git.kernel.org/stable/c/1b1efa5f0e878745e94a98022e8edc675a87d78e - https://git.kernel.org/stable/c/5661998536af52848cc4d52a377e90368196edea
CVE ID: CVE-2025-38653 State: PUBLISHED Published: 2025-08-22T16:00:57.413Z Last Updated: 2025-11-03T17:40:46.576Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al Check pde->proc_ops->proc_lseek directly may cause UAF in rmmod scenario. It's a gap in proc_reg_open() after commit 654b33ada4ab("proc: fix UAF in proc_get_inode()"). Followed by AI Viro's suggestion, fix it in same manner. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/c35b0feb80b48720dfbbf4e33759c7be3faaebb6 - https://git.kernel.org/sta
ner: References: - https://git.kernel.org/stable/c/c35b0feb80b48720dfbbf4e33759c7be3faaebb6 - https://git.kernel.org/stable/c/33c778ea0bd0fa62ff590497e72562ff90f82b13 - https://git.kernel.org/stable/c/fc1072d934f687e1221d685cf1a49a5068318f34 - https://git.kernel.org/stable/c/d136502e04d8853a9aecb335d07bbefd7a1519a8 - https://git.kernel.org/stable/c/1fccbfbae1dd36198dc47feac696563244ad81d3 - https://git.kernel.org/stable/c/ff7ec8dc1b646296f8d94c39339e8d3833d16c05
CVE ID: CVE-2025-38654 State: PUBLISHED Published: 2025-08-22T16:00:58.153Z Last Updated: 2025-09-29T05:55:35.625Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: pinctrl: canaan: k230: Fix order of DT parse and pinctrl register Move DT parse before pinctrl register. This ensures that device tree parsing is done before calling devm_pinctrl_register() to prevent using uninitialized pin resources. References: - https://git.kernel.org/stable/c/02c1deb1bff2b6d242e29a51e56107495979a2b8 - https://git.kernel.org/stable/c/0ec03251d01494ef207089b5bd626becfd05fd86 - https://git.kernel.org/stable/c/d94a32ac688f953dc9a9f12b5b4139ecad841bbb
CVE ID: CVE-2025-38655 State: PUBLISHED Published: 2025-08-22T16:00:58.839Z Last Updated: 2025-09-29T05:55:36.904Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: pinctrl: canaan: k230: add NULL check in DT parse Add a NULL check for the return value of of_get_property() when retrieving the "pinmux" property in the group parser. This avoids a potential NULL pointer dereference if the property is missing from the device tree node. Also fix a typo ("sintenel") in the device ID match table comment, correcting it to "sentinel". References: - https://git.kernel.org/stable/c/b5ae84aeff60b8819e8568ff0c57590caed9e6d3 - https://git.kerne
o "sentinel". References: - https://git.kernel.org/stable/c/b5ae84aeff60b8819e8568ff0c57590caed9e6d3 - https://git.kernel.org/stable/c/5d324b262c0ff256b8d603596574d66267b6394f - https://git.kernel.org/stable/c/65bd0be486390fc12a84eafaad78758c5e5a55e6
CVE ID: CVE-2025-38656 State: PUBLISHED Published: 2025-08-22T16:00:59.678Z Last Updated: 2025-08-28T14:44:29.601Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() Preserve the error code if iwl_setup_deferred_work() fails. The current code returns ERR_PTR(0) (which is NULL) on this path. I believe the missing error code potentially leads to a use after free involving debugfs. References: - https://git.kernel.org/stable/c/991e2066f6009d3cb898413058c62dbcc92bd6d2 - https://git.kernel.org/stable/c/1d068272c21d886d06526454b68368100ba0a720 - https://git.kernel.org/stable/c/cf80
2bd6d2 - https://git.kernel.org/stable/c/1d068272c21d886d06526454b68368100ba0a720 - https://git.kernel.org/stable/c/cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6
CVE ID: CVE-2025-38657 State: PUBLISHED Published: 2025-08-22T16:01:00.512Z Last Updated: 2025-09-29T05:55:38.043Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: mcc: prevent shift wrapping in rtw89_core_mlsr_switch() The "link_id" value comes from the user via debugfs. If it's larger than BITS_PER_LONG then that would result in shift wrapping and potentially an out of bounds access later. In fact, we can limit it to IEEE80211_MLD_MAX_NUM_LINKS (15). Fortunately, only root can write to debugfs files so the security impact is minimal. References: - https://git.kernel.org/stable/c/417cfa9cc44fbe6bceab786f9a4ee5a210f1
es so the security impact is minimal. References: - https://git.kernel.org/stable/c/417cfa9cc44fbe6bceab786f9a4ee5a210f1288e - https://git.kernel.org/stable/c/53cf488927a0f79968f9c03c4d1e00d2a79731c3
CVE ID: CVE-2025-38658 State: PUBLISHED Published: 2025-08-22T16:01:01.651Z Last Updated: 2025-09-29T05:55:39.448Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: Do not complete commands twice if nvmet_req_init() fails Have nvmet_req_init() and req->execute() complete failed commands. Description of the problem: nvmet_req_init() calls __nvmet_req_complete() internally upon failure, e.g., unsupported opcode, which calls the "queue_response" callback, this results in nvmet_pci_epf_queue_response() being called, which will call nvmet_pci_epf_complete_iod() if data_len is 0 or if dma_dir is different from DMA_TO_DEV
) being called, which will call nvmet_pci_epf_complete_iod() if data_len is 0 or if dma_dir is different from DMA_TO_DEVICE. This results in a double completion as nvmet_pci_epf_exec_iod_work() also calls nvmet_pci_epf_complete_iod() when nvmet_req_init() fails. Steps to reproduce: On the host send a command with an unsupported opcode with nvme-cli, For example the admin command "security receive" $ sudo nvme security-recv /dev/nvme0n1 -n1 -x4096 This triggers a double completion as nvmet_req_init() fails and nvmet_pci_epf_queue_response() is called, here iod->dma_dir is still in the default state of "DMA_NONE" as set by default in nvmet_pci_epf_alloc_iod(), so nvmet_pci_epf_complete_iod() i
ill in the default state of "DMA_NONE" as set by default in nvmet_pci_epf_alloc_iod(), so nvmet_pci_epf_complete_iod() is called. Because nvmet_req_init() failed nvmet_pci_epf_complete_iod() is also called in nvmet_pci_epf_exec_iod_work() leading to a double completion. This not only sends two completions to the host but also corrupts the state of the PCI NVMe target leading to kernel oops. This patch lets nvmet_req_init() and req->execute() complete all failed commands, and removes the double completion case in nvmet_pci_epf_exec_iod_work() therefore fixing the edge cases where double completions occurred. References: - https://git.kernel.org/stable/c/a535c0b10060bc8c174a7964b0f98064ee0c477
where double completions occurred. References: - https://git.kernel.org/stable/c/a535c0b10060bc8c174a7964b0f98064ee0c4774 - https://git.kernel.org/stable/c/746d0ac5a07d5da952ef258dd4d75f0b26c96476
CVE ID: CVE-2025-38659 State: PUBLISHED Published: 2025-08-22T16:01:02.448Z Last Updated: 2025-09-29T05:55:41.837Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: gfs2: No more self recovery When a node withdraws and it turns out that it is the only node that has the filesystem mounted, gfs2 currently tries to replay the local journal to bring the filesystem back into a consistent state. Not only is that a very bad idea, it has also never worked because gfs2_recover_func() will refuse to do anything during a withdraw. However, before even getting to this point, gfs2_recover_func() dereferences sdp->sd_jdesc->jd_inode. This was a
thdraw. However, before even getting to this point, gfs2_recover_func() dereferences sdp->sd_jdesc->jd_inode. This was a use-after-free before commit 04133b607a78 ("gfs2: Prevent double iput for journal on error") and is a NULL pointer dereference since then. Simply get rid of self recovery to fix that. References: - https://git.kernel.org/stable/c/1a91ba12abef628b43cada87478328274d988e88 - https://git.kernel.org/stable/c/f5426ffbec971a8f7346a57392d3a901bdee5a9b - https://git.kernel.org/stable/c/6784367b2f3cd7b89103de35764f37f152590dbd - https://git.kernel.org/stable/c/97c94c7dbddc34d353c83b541b3decabf98d04af - https://git.kernel.org/stable/c/deb016c1669002e48c431d6fd32ea1c20ef41756
CVE ID: CVE-2025-38660 State: PUBLISHED Published: 2025-08-22T16:01:03.686Z Last Updated: 2025-09-29T05:55:44.132Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: [ceph] parse_longname(): strrchr() expects NUL-terminated string ... and parse_longname() is not guaranteed that. That's the reason why it uses kmemdup_nul() to build the argument for kstrtou64(); the problem is, kstrtou64() is not the only thing that need it. Just get a NUL-terminated copy of the entire thing and be done with that... References: - https://git.kernel.org/stable/c/bb80f7618832d26f7e395f52f82b1dac76223e5f - https://git.kernel.org/stable/c/3145b2b11492d61
tps://git.kernel.org/stable/c/bb80f7618832d26f7e395f52f82b1dac76223e5f - https://git.kernel.org/stable/c/3145b2b11492d61c512bbc59660bb823bc757f48 - https://git.kernel.org/stable/c/493479af8af3ab907f49e99323777d498a4fbd2b - https://git.kernel.org/stable/c/101841c38346f4ca41dc1802c867da990ffb32eb
CVE ID: CVE-2025-38661 State: PUBLISHED Published: 2025-08-22T16:02:54.362Z Last Updated: 2025-08-22T16:02:54.362Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: platform/x86: alienware-wmi-wmax: Fix `dmi_system_id` array Add missing empty member to `awcc_dmi_table`. References: - https://git.kernel.org/stable/c/660bcd9f1f94e623e1316b869b2172b36eb516d7 - https://git.kernel.org/stable/c/8346c6af27f1c1410eb314f4be5875fdf1579a10
CVE ID: CVE-2025-38662 State: PUBLISHED Published: 2025-08-22T16:02:55.078Z Last Updated: 2025-08-22T16:02:55.078Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8365-dai-i2s: pass correct size to mt8365_dai_set_priv Given mt8365_dai_set_priv allocate priv_size space to copy priv_data which means we should pass mt8365_i2s_priv[i] or "struct mtk_afe_i2s_priv" instead of afe_priv which has the size of "struct mt8365_afe_private". Otherwise the KASAN complains about. [ 59.389765] BUG: KASAN: global-out-of-bounds in mt8365_dai_set_priv+0xc8/0x168 [snd_soc_mt8365_pcm] ... [ 59.394789] Call trace: [ 59.395167] dump_
bal-out-of-bounds in mt8365_dai_set_priv+0xc8/0x168 [snd_soc_mt8365_pcm] ... [ 59.394789] Call trace: [ 59.395167] dump_backtrace+0xa0/0x128 [ 59.395733] show_stack+0x20/0x38 [ 59.396238] dump_stack_lvl+0xe8/0x148 [ 59.396806] print_report+0x37c/0x5e0 [ 59.397358] kasan_report+0xac/0xf8 [ 59.397885] kasan_check_range+0xe8/0x190 [ 59.398485] asan_memcpy+0x3c/0x98 [ 59.399022] mt8365_dai_set_priv+0xc8/0x168 [snd_soc_mt8365_pcm] [ 59.399928] mt8365_dai_i2s_register+0x1e8/0x2b0 [snd_soc_mt8365_pcm] [ 59.400893] mt8365_afe_pcm_dev_probe+0x4d0/0xdf0 [snd_soc_mt8365_pcm] [ 59.401873] platform_probe+0xcc/0x228 [ 59.402442] really_probe+0x340/0x9e8 [ 59.402992] driver_probe_device+0x16c/0x3f8 [ 59.40
73] platform_probe+0xcc/0x228 [ 59.402442] really_probe+0x340/0x9e8 [ 59.402992] driver_probe_device+0x16c/0x3f8 [ 59.403638] driver_probe_device+0x64/0x1d8 [ 59.404256] driver_attach+0x1dc/0x4c8 [ 59.404840] bus_for_each_dev+0x100/0x190 [ 59.405442] driver_attach+0x44/0x68 [ 59.405980] bus_add_driver+0x23c/0x500 [ 59.406550] driver_register+0xf8/0x3d0 [ 59.407122] platform_driver_register+0x68/0x98 [ 59.407810] mt8365_afe_pcm_driver_init+0x2c/0xff8 [snd_soc_mt8365_pcm] References: - https://git.kernel.org/stable/c/1dc0ed16cfbc3c28a07a89904071cfa802fdcee1 - https://git.kernel.org/stable/c/6e621dd99c57db916842865debaa65f20bbd6d8e - https://git.kernel.org/stable/c/6bea85979d05470e6416a2bb504a9
el.org/stable/c/6e621dd99c57db916842865debaa65f20bbd6d8e - https://git.kernel.org/stable/c/6bea85979d05470e6416a2bb504a9bcd9178304c