Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
/git.kernel.org/stable/c/73e36a699b9f46322ffb81f072a24e64f728dba7 - https://git.kernel.org/stable/c/0b43d98ff29be3144e86294486b1373b5df74c0e
CVE ID: CVE-2025-21795 State: PUBLISHED Published: 2025-02-27T02:18:31.538Z Last Updated: 2025-11-03T20:59:38.867Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: NFSD: fix hang in nfsd4_shutdown_callback If nfs4_client is in courtesy state then there is no point to send the callback. This causes nfsd4_shutdown_callback to hang since cl_cb_inflight is not 0. This hang lasts about 15 minutes until TCP notifies NFSD that the connection was dropped. This patch modifies nfsd4_run_cb_work to skip the RPC call if nfs4_client is in courtesy state. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/s
4_client is in courtesy state. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/abed68027ea3ab893ac85cc46a00e2e64a324239 - https://git.kernel.org/stable/c/efa8a261c575f816c7e79a87aeb3ef8a0bd6b221 - https://git.kernel.org/stable/c/38d345f612503b850c2973e5a879f88e441b34d7 - https://git.kernel.org/stable/c/23ad7797c74cd8f7f90617f1e59a8703e2b43908 - https://git.kernel.org/stable/c/cedfbb92cf97a6bff3d25633001d9c44442ee854 - https://git.kernel.org/stable/c/e88d2451cd42e025465d6b51fd716a47b0b3800d - https://git.kernel.org/stable/c/036ac2778f7b28885814c6fbc07e156ad1624d03
CVE ID: CVE-2025-21796 State: PUBLISHED Published: 2025-02-27T02:18:32.191Z Last Updated: 2025-11-03T20:59:40.254Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfsd: clear acl_access/acl_default after releasing them If getting acl_default fails, acl_access and acl_default will be released simultaneously. However, acl_access will still retain a pointer pointing to the released posix_acl, which will trigger a WARNING in nfs3svc_release_getacl like this: ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 26 PID: 3199 at lib/refcount.c:28 refcount_warn_saturate+0xb5/0x170 Modules linked in:
w; use-after-free. WARNING: CPU: 26 PID: 3199 at lib/refcount.c:28 refcount_warn_saturate+0xb5/0x170 Modules linked in: CPU: 26 UID: 0 PID: 3199 Comm: nfsd Not tainted 6.12.0-rc6-00079-g04ae226af01f-dirty #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:refcount_warn_saturate+0xb5/0x170 Code: cc cc 0f b6 1d b3 20 a5 03 80 fb 01 0f 87 65 48 d8 00 83 e3 01 75 e4 48 c7 c7 c0 3b 9b 85 c6 05 97 20 a5 03 01 e8 fb 3e 30 ff <0f> 0b eb cd 0f b6 1d 8a3 RSP: 0018:ffffc90008637cd8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff83904fde RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88871ed36380 RBP: ffff888158beeb40 R08: 0
000 RCX: ffffffff83904fde RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88871ed36380 RBP: ffff888158beeb40 R08: 0000000000000001 R09: fffff520010c6f56 R10: ffffc90008637ab7 R11: 0000000000000001 R12: 0000000000000001 R13: ffff888140e77400 R14: ffff888140e77408 R15: ffffffff858b42c0 FS: 0000000000000000(0000) GS:ffff88871ed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000562384d32158 CR3: 000000055cc6a000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? refcount_warn_saturate+0xb5/0x170 ? __warn+0xa5/0x140 ? refcount_w
00fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? refcount_warn_saturate+0xb5/0x170 ? __warn+0xa5/0x140 ? refcount_warn_saturate+0xb5/0x170 ? report_bug+0x1b1/0x1e0 ? handle_bug+0x53/0xa0 ? exc_invalid_op+0x17/0x40 ? asm_exc_invalid_op+0x1a/0x20 ? tick_nohz_tick_stopped+0x1e/0x40 ? refcount_warn_saturate+0xb5/0x170 ? refcount_warn_saturate+0xb5/0x170 nfs3svc_release_getacl+0xc9/0xe0 svc_process_common+0x5db/0xb60 ? __pfx_svc_process_common+0x10/0x10 ? __rcu_read_unlock+0x69/0xa0 ? __pfx_nfsd_dispatch+0x10/0x10 ? svc_xprt_received+0xa1/0x120 ? xdr_init_decode+0x11d/0x190 svc_process+0x2a7/0x330 svc_handle_xprt+0x69d/0x940 svc_recv+0x180/0x2d0 nfsd+0x168/0x200 ? __pfx_nfsd+0x10/0x10 kthrea
svc_process+0x2a7/0x330 svc_handle_xprt+0x69d/0x940 svc_recv+0x180/0x2d0 nfsd+0x168/0x200 ? __pfx_nfsd+0x10/0x10 kthread+0x1a2/0x1e0 ? kthread+0xf4/0x1e0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Kernel panic - not syncing: kernel: panic_on_warn set ... Clear acl_access/acl_default after posix_acl_release is called to prevent UAF from being triggered. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/8a1737ae42c928384ab6447f6ee1a882510e85fa - https://git.kernel.org/stable/c/6f7cfee1a316891890c505563aa54f3476db52fd - https://git.kernel.org/stable/c/2e5
10e85fa - https://git.kernel.org/stable/c/6f7cfee1a316891890c505563aa54f3476db52fd - https://git.kernel.org/stable/c/2e59b2b68782519560b3d6a41dd66a3d01a01cd3 - https://git.kernel.org/stable/c/55d947315fb5f67a35e4e1d3e01bb886b9c6decf - https://git.kernel.org/stable/c/f8d871523142f7895f250a856f8c4a4181614510 - https://git.kernel.org/stable/c/1fd94884174bd20beb1773990fd3b1aa877688d9 - https://git.kernel.org/stable/c/7faf14a7b0366f153284db0ad3347c457ea70136
CVE ID: CVE-2025-21797 State: PUBLISHED Published: 2025-02-27T02:18:32.855Z Last Updated: 2025-05-04T07:21:26.205Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Add missing delayed work cancel for headset status The cancel_delayed_work_sync() call was missed, causing a use-after-free in corsair_void_remove(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/2dcb56a0a4da6946f6c18288da595c13e0d2af86 - https://git.kernel.org/stable/c/48e487b002891eb0aeaec704c9bed51f028deff1
CVE ID: CVE-2025-21798 State: PUBLISHED Published: 2025-02-27T20:00:53.557Z Last Updated: 2025-10-01T19:36:38.768Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: firewire: test: Fix potential null dereference in firewire kunit test kunit_kzalloc() may return a NULL pointer, dereferencing it without NULL check may lead to NULL dereference. Add a NULL check for test_state. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/c6896bf4c611c3dd126f3e03685f2360a18b3d6f - https://git.kernel.org/stable/c/70fcb25472d90dd3b87cbee74b9eb68670b0c7b8 - https://git.kernel.org/stable/c/352fafe97784e8
ttps://git.kernel.org/stable/c/70fcb25472d90dd3b87cbee74b9eb68670b0c7b8 - https://git.kernel.org/stable/c/352fafe97784e81a10a7c74bd508f71a19b53c2a
CVE ID: CVE-2025-21799 State: PUBLISHED Published: 2025-02-27T20:00:54.223Z Last Updated: 2025-11-03T20:59:41.641Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns() When getting the IRQ we use k3_udma_glue_tx_get_irq() which returns negative error value on error. So not NULL check is not sufficient to deteremine if IRQ is valid. Check that IRQ is greater then zero to ensure it is valid. There is no issue at probe time but at runtime user can invoke .set_channels which results in the following call chain. am65_cpsw_set_channels() am65_cpsw_nuss_update_
user can invoke .set_channels which results in the following call chain. am65_cpsw_set_channels() am65_cpsw_nuss_update_tx_rx_chns() am65_cpsw_nuss_remove_tx_chns() am65_cpsw_nuss_init_tx_chns() At this point if am65_cpsw_nuss_init_tx_chns() fails due to k3_udma_glue_tx_get_irq() then tx_chn->irq will be set to a negative value. Then, at subsequent .set_channels with higher channel count we will attempt to free an invalid IRQ in am65_cpsw_nuss_remove_tx_chns() leading to a kernel warning. The issue is present in the original commit that introduced this driver, although there, am65_cpsw_nuss_update_tx_rx_chns() existed as am65_cpsw_nuss_update_tx_chns(). Additional Analyst Notes: - CVE Progra
e, am65_cpsw_nuss_update_tx_rx_chns() existed as am65_cpsw_nuss_update_tx_chns(). Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/321990fdf4f1bb64e818c7140688bf33d129e48d - https://git.kernel.org/stable/c/ed8c0300f302338c36edb06bca99051e5be6fb2f - https://git.kernel.org/stable/c/aea5cca681d268f794fa2385f9ec26a5cce025cd - https://git.kernel.org/stable/c/88fd5db8c0073bd91d18391feb5741aeb0a2b475 - https://git.kernel.org/stable/c/8448c87b3af68bebca21e3136913f7f77e363515 - https://git.kernel.org/stable/c/8aae91ae1c65782a169ec070e023d4d269e5d6e6 - https://git.kernel.org/stable/c/4395a44acb15850e492dd1de9ec4b6479d96bc80
CVE ID: CVE-2025-21800 State: PUBLISHED Published: 2025-02-27T20:00:54.884Z Last Updated: 2025-05-04T07:21:29.606Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, fix definer's HWS_SET32 macro for negative offset When bit offset for HWS_SET32 macro is negative, UBSAN complains about the shift-out-of-bounds: UBSAN: shift-out-of-bounds in drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c:177:2 shift exponent -8 is negative References: - https://git.kernel.org/stable/c/92cff996624c4757d5bbace3dfa3f1567ba94143 - https://git.kernel.org/stable/c/69c676c0ded472713e6d1b3a456b3c4f52f66f0e - https://git.kernel.
5bbace3dfa3f1567ba94143 - https://git.kernel.org/stable/c/69c676c0ded472713e6d1b3a456b3c4f52f66f0e - https://git.kernel.org/stable/c/be482f1d10da781db9445d2753c1e3f1fd82babf
CVE ID: CVE-2025-21801 State: PUBLISHED Published: 2025-02-27T20:00:55.572Z Last Updated: 2025-05-04T07:21:30.922Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: ravb: Fix missing rtnl lock in suspend/resume path Fix the suspend/resume path by ensuring the rtnl lock is held where required. Calls to ravb_open, ravb_close and wol operations must be performed under the rtnl lock to prevent conflicts with ongoing ndo operations. Without this fix, the following warning is triggered: [ 39.032969] ============================= [ 39.032983] WARNING: suspicious RCU usage [ 39.033019] ----------------------------- [ 39.033033] drive
=============== [ 39.032983] WARNING: suspicious RCU usage [ 39.033019] ----------------------------- [ 39.033033] drivers/net/phy/phy_device.c:2004 suspicious rcu_dereference_protected() usage! ... [ 39.033597] stack backtrace: [ 39.033613] CPU: 0 UID: 0 PID: 174 Comm: python3 Not tainted 6.13.0-rc7-next-20250116-arm64-renesas-00002-g35245dfdc62c #7 [ 39.033623] Hardware name: Renesas SMARC EVK version 2 based on r9a08g045s33 (DT) [ 39.033628] Call trace: [ 39.033633] show_stack+0x14/0x1c (C) [ 39.033652] dump_stack_lvl+0xb4/0xc4 [ 39.033664] dump_stack+0x14/0x1c [ 39.033671] lockdep_rcu_suspicious+0x16c/0x22c [ 39.033682] phy_detach+0x160/0x190 [ 39.033694] phy_disconnect+0x40/0x54 [ 39.03
71] lockdep_rcu_suspicious+0x16c/0x22c [ 39.033682] phy_detach+0x160/0x190 [ 39.033694] phy_disconnect+0x40/0x54 [ 39.033703] ravb_close+0x6c/0x1cc [ 39.033714] ravb_suspend+0x48/0x120 [ 39.033721] dpm_run_callback+0x4c/0x14c [ 39.033731] device_suspend+0x11c/0x4dc [ 39.033740] dpm_suspend+0xdc/0x214 [ 39.033748] dpm_suspend_start+0x48/0x60 [ 39.033758] suspend_devices_and_enter+0x124/0x574 [ 39.033769] pm_suspend+0x1ac/0x274 [ 39.033778] state_store+0x88/0x124 [ 39.033788] kobj_attr_store+0x14/0x24 [ 39.033798] sysfs_kf_write+0x48/0x6c [ 39.033808] kernfs_fop_write_iter+0x118/0x1a8 [ 39.033817] vfs_write+0x27c/0x378 [ 39.033825] ksys_write+0x64/0xf4 [ 39.033833] __arm64_sys_write+0x18/0x20
118/0x1a8 [ 39.033817] vfs_write+0x27c/0x378 [ 39.033825] ksys_write+0x64/0xf4 [ 39.033833] __arm64_sys_write+0x18/0x20 [ 39.033841] invoke_syscall+0x44/0x104 [ 39.033852] el0_svc_common.constprop.0+0xb4/0xd4 [ 39.033862] do_el0_svc+0x18/0x20 [ 39.033870] el0_svc+0x3c/0xf0 [ 39.033880] el0t_64_sync_handler+0xc0/0xc4 [ 39.033888] el0t_64_sync+0x154/0x158 [ 39.041274] ravb 11c30000.ethernet eth0: Link is Down References: - https://git.kernel.org/stable/c/0296981941cf291edfbc318d3255a93439f368e4 - https://git.kernel.org/stable/c/ad19522c007bb24ed874468f8baa1503c4662cf4 - https://git.kernel.org/stable/c/2c2ebb2b49573e5f8726112ad06b1dffc3c9ea03
CVE ID: CVE-2025-21802 State: PUBLISHED Published: 2025-02-27T20:00:56.292Z Last Updated: 2025-11-03T20:59:43.044Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix oops when unload drivers paralleling When unload hclge driver, it tries to disable sriov first for each ae_dev node from hnae3_ae_dev_list. If user unloads hns3 driver at the time, because it removes all the ae_dev nodes, and it may cause oops. But we can't simply use hnae3_common_lock for this. Because in the process flow of pci_disable_sriov(), it will trigger the remove flow of VF, which will also take hnae3_common_lock. To fixes it, introduce a new m
e_sriov(), it will trigger the remove flow of VF, which will also take hnae3_common_lock. To fixes it, introduce a new mutex to protect the unload process. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/622d92a67656e5c4d2d6ccac02d688ed995418c6 - https://git.kernel.org/stable/c/8c640dd3d900cc8988a39c007591f1deee776df4 - https://git.kernel.org/stable/c/e876522659012ef2e73834a0b9f1cbe3f74d5fad - https://git.kernel.org/stable/c/b5a8bc47aa0a4aa8bca5466dfa2d12dbb5b3cd0c - https://git.kernel.org/stable/c/82736bb83fb0221319c85c2e9917d0189cd84e1e - https://git.kernel.org/stable/c/cafe9a27e22736d4a01b3933e36225f9857c7988 - https://git.kernel.org/stable
7d0189cd84e1e - https://git.kernel.org/stable/c/cafe9a27e22736d4a01b3933e36225f9857c7988 - https://git.kernel.org/stable/c/92e5995773774a3e70257e9c95ea03518268bea5
CVE ID: CVE-2025-21803 State: PUBLISHED Published: 2025-02-27T20:00:56.932Z Last Updated: 2025-05-04T07:21:33.121Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix warnings during S3 suspend The enable_gpe_wakeup() function calls acpi_enable_all_wakeup_gpes(), and the later one may call the preempt_schedule_common() function, resulting in a thread switch and causing the CPU to be in an interrupt enabled state after the enable_gpe_wakeup() function returns, leading to the warnings as follow. [ C0] WARNING: ... at kernel/time/timekeeping.c:845 ktime_get+0xbc/0xc8 [ C0] ... [ C0] Call Trace: [ C0] [<90000000002243b4>]
WARNING: ... at kernel/time/timekeeping.c:845 ktime_get+0xbc/0xc8 [ C0] ... [ C0] Call Trace: [ C0] [<90000000002243b4>] show_stack+0x64/0x188 [ C0] [<900000000164673c>] dump_stack_lvl+0x60/0x88 [ C0] [<90000000002687e4>] __warn+0x8c/0x148 [ C0] [<90000000015e9978>] report_bug+0x1c0/0x2b0 [ C0] [<90000000016478e4>] do_bp+0x204/0x3b8 [ C0] [<90000000025b1924>] exception_handlers+0x1924/0x10000 [ C0] [<9000000000343bbc>] ktime_get+0xbc/0xc8 [ C0] [<9000000000354c08>] tick_sched_timer+0x30/0xb0 [ C0] [<90000000003408e0>] __hrtimer_run_queues+0x160/0x378 [ C0] [<9000000000341f14>] hrtimer_interrupt+0x144/0x388 [ C0] [<9000000000228348>] constant_timer_interrupt+0x38/0x48 [ C0] [<90000000002feba4
4>] hrtimer_interrupt+0x144/0x388 [ C0] [<9000000000228348>] constant_timer_interrupt+0x38/0x48 [ C0] [<90000000002feba4>] __handle_irq_event_percpu+0x64/0x1e8 [ C0] [<90000000002fed48>] handle_irq_event_percpu+0x20/0x80 [ C0] [<9000000000306b9c>] handle_percpu_irq+0x5c/0x98 [ C0] [<90000000002fd4a0>] generic_handle_domain_irq+0x30/0x48 [ C0] [<9000000000d0c7b0>] handle_cpu_irq+0x70/0xa8 [ C0] [<9000000001646b30>] handle_loongarch_irq+0x30/0x48 [ C0] [<9000000001646bc8>] do_vint+0x80/0xe0 [ C0] [<90000000002aea1c>] finish_task_switch.isra.0+0x8c/0x2a8 [ C0] [<900000000164e34c>] __schedule+0x314/0xa48 [ C0] [<900000000164ead8>] schedule+0x58/0xf0 [ C0] [<9000000000294a2c>] worker_thread+0x224
4c>] __schedule+0x314/0xa48 [ C0] [<900000000164ead8>] schedule+0x58/0xf0 [ C0] [<9000000000294a2c>] worker_thread+0x224/0x498 [ C0] [<900000000029d2f0>] kthread+0xf8/0x108 [ C0] [<9000000000221f28>] ret_from_kernel_thread+0xc/0xa4 [ C0] [ C0] ---[ end trace 0000000000000000 ]--- The root cause is acpi_enable_all_wakeup_gpes() uses a mutex to protect acpi_hw_enable_all_wakeup_gpes(), and acpi_ut_acquire_mutex() may cause a thread switch. Since there is no longer concurrent execution during loongarch_acpi_suspend(), we can call acpi_hw_enable_all_wakeup_gpes() directly in enable_gpe_wakeup(). The solution is similar to commit 22db06337f590d01 ("ACPI: sleep: Avoid breaking S3 wakeup due to mig
able_gpe_wakeup(). The solution is similar to commit 22db06337f590d01 ("ACPI: sleep: Avoid breaking S3 wakeup due to might_sleep()"). References: - https://git.kernel.org/stable/c/d49ab6857d98266010f3446c9c2063014db5b654 - https://git.kernel.org/stable/c/194d26a5a43c26dc98a9b4e2c1d521dcb84dd1bf - https://git.kernel.org/stable/c/8682a71a7f6de7c683f31b4334b04e19685a05f9 - https://git.kernel.org/stable/c/26c0a2d93af55d30a46d5f45d3e9c42cde730168
CVE ID: CVE-2025-21804 State: PUBLISHED Published: 2025-02-27T20:00:57.639Z Last Updated: 2025-11-03T20:59:44.459Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region() The rcar_pcie_parse_outbound_ranges() uses the devm_request_mem_region() macro to request a needed resource. A string variable that lives on the stack is then used to store a dynamically computed resource name, which is then passed on as one of the macro arguments. This can lead to undefined behavior. Depending on the current contents of the memory, the manifestations of errors may vary. O
an lead to undefined behavior. Depending on the current contents of the memory, the manifestations of errors may vary. One possible output may be as follows: $ cat /proc/iomem 30000000-37ffffff : 38000000-3fffffff : Sometimes, garbage may appear after the colon. In very rare cases, if no NULL-terminator is found in memory, the system might crash because the string iterator will overrun which can lead to access of unmapped memory above the stack. Thus, fix this by replacing outbound_name with the name of the previously requested resource. With the changes applied, the output will be as follows: $ cat /proc/iomem 30000000-37ffffff : memory2 38000000-3fffffff : memory3 [kwilczynski: commit log]
will be as follows: $ cat /proc/iomem 30000000-37ffffff : memory2 38000000-3fffffff : memory3 [kwilczynski: commit log] Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/7a47e14c5fb0b6dba7073be7b0119fb8fe864e01 - https://git.kernel.org/stable/c/6987e021b64cbb49981d140bb72d9d1466f191c4 - https://git.kernel.org/stable/c/24576899c49509c0d533bcf569139f691d8f7af7 - https://git.kernel.org/stable/c/2c54b9fca1755e80a343ccfde0652dc5ea4744b2 - https://git.kernel.org/stable/c/9ff46b0bfeb6e0724a4ace015aa7a0b887cdb7c1 - https://git.kernel.org/stable/c/44708208c2a4b828a57a2abe7799c9d3962e7eaa - https://git.kernel.org/stable/c/2d2da5a4c1b4509f6f7e5a8db015cd42
org/stable/c/44708208c2a4b828a57a2abe7799c9d3962e7eaa - https://git.kernel.org/stable/c/2d2da5a4c1b4509f6f7e5a8db015cd420144beb4
CVE ID: CVE-2025-21805 State: PUBLISHED Published: 2025-02-27T20:00:58.290Z Last Updated: 2025-05-04T07:21:35.428Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Add missing deinit() call A warning is triggered when repeatedly connecting and disconnecting the rnbd: list_add corruption. prev->next should be next (ffff88800b13e480), but was ffff88801ecd1338. (prev=ffff88801ecd1340). WARNING: CPU: 1 PID: 36562 at lib/list_debug.c:32 __list_add_valid_or_report+0x7f/0xa0 Workqueue: ib_cm cm_work_handler [ib_cm] RIP: 0010:__list_add_valid_or_report+0x7f/0xa0 ? __list_add_valid_or_report+0x7f/0xa0 ib_register_event_handler+
[ib_cm] RIP: 0010:__list_add_valid_or_report+0x7f/0xa0 ? __list_add_valid_or_report+0x7f/0xa0 ib_register_event_handler+0x65/0x93 [ib_core] rtrs_srv_ib_dev_init+0x29/0x30 [rtrs_server] rtrs_ib_dev_find_or_add+0x124/0x1d0 [rtrs_core] __alloc_path+0x46c/0x680 [rtrs_server] ? rtrs_rdma_connect+0xa6/0x2d0 [rtrs_server] ? rcu_is_watching+0xd/0x40 ? __mutex_lock+0x312/0xcf0 ? get_or_create_srv+0xad/0x310 [rtrs_server] ? rtrs_rdma_connect+0xa6/0x2d0 [rtrs_server] rtrs_rdma_connect+0x23c/0x2d0 [rtrs_server] ? __lock_release+0x1b1/0x2d0 cma_cm_event_handler+0x4a/0x1a0 [rdma_cm] cma_ib_req_handler+0x3a0/0x7e0 [rdma_cm] cm_process_work+0x28/0x1a0 [ib_cm] ? _raw_spin_unlock_irq+0x2f/0x50 cm_req_handler+
ib_req_handler+0x3a0/0x7e0 [rdma_cm] cm_process_work+0x28/0x1a0 [ib_cm] ? _raw_spin_unlock_irq+0x2f/0x50 cm_req_handler+0x618/0xa60 [ib_cm] cm_work_handler+0x71/0x520 [ib_cm] Commit 667db86bcbe8 ("RDMA/rtrs: Register ib event handler") introduced a new element .deinit but never used it at all. Fix it by invoking the `deinit()` to appropriately unregister the IB event handler. References: - https://git.kernel.org/stable/c/5a79cc9bc961fafe90787f86e8f53ba6fad8d63b - https://git.kernel.org/stable/c/1af2c769032b6b334cd2a867d7d8c7cbbc527b2d - https://git.kernel.org/stable/c/81468c4058a62e84e475433b83b3edc613294f5e
CVE ID: CVE-2025-21806 State: PUBLISHED Published: 2025-02-27T20:00:58.918Z Last Updated: 2025-11-03T20:59:45.883Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: let net.core.dev_weight always be non-zero The following problem was encountered during stability test: (NULL net_device): NAPI poll function process_backlog+0x0/0x530 \ returned 1, exceeding its budget of 0. ------------[ cut here ]------------ list_add double add: new=ffff88905f746f48, prev=ffff88905f746f48, \ next=ffff88905f746e40. WARNING: CPU: 18 PID: 5462 at lib/list_debug.c:35 \ __list_add_valid_or_report+0xf3/0x130 CPU: 18 UID: 0 PID: 5462 Comm: ping Kdump
U: 18 PID: 5462 at lib/list_debug.c:35 \ __list_add_valid_or_report+0xf3/0x130 CPU: 18 UID: 0 PID: 5462 Comm: ping Kdump: loaded Not tainted 6.13.0-rc7+ RIP: 0010:__list_add_valid_or_report+0xf3/0x130 Call Trace: ? __warn+0xcd/0x250 ? __list_add_valid_or_report+0xf3/0x130 enqueue_to_backlog+0x923/0x1070 netif_rx_internal+0x92/0x2b0 __netif_rx+0x15/0x170 loopback_xmit+0x2ef/0x450 dev_hard_start_xmit+0x103/0x490 __dev_queue_xmit+0xeac/0x1950 ip_finish_output2+0x6cc/0x1620 ip_output+0x161/0x270 ip_push_pending_frames+0x155/0x1a0 raw_sendmsg+0xe13/0x1550 __sys_sendto+0x3bf/0x4e0 __x64_sys_sendto+0xdc/0x1b0 do_syscall_64+0x5b/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e The reproduction command
0 __x64_sys_sendto+0xdc/0x1b0 do_syscall_64+0x5b/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e The reproduction command is as follows: sysctl -w net.core.dev_weight=0 ping 127.0.0.1 This is because when the napi's weight is set to 0, process_backlog() may return 0 and clear the NAPI_STATE_SCHED bit of napi->state, causing this napi to be re-polled in net_rx_action() until __do_softirq() times out. Since the NAPI_STATE_SCHED bit has been cleared, napi_schedule_rps() can be retriggered in enqueue_to_backlog(), causing this issue. Making the napi's weight always non-zero solves this problem. Triggering this issue requires system-wide admin (setting is not namespaced). Additional Analyst Notes:
es this problem. Triggering this issue requires system-wide admin (setting is not namespaced). Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/d0e0f9c8218826926d7692980c98236d9f21fd3c - https://git.kernel.org/stable/c/c337c08819a4ec49edfdcd8fc46fbee120d8a5b2 - https://git.kernel.org/stable/c/0e2f1d93d287d544d26f8ff293ea820a8079b9f8 - https://git.kernel.org/stable/c/5860abbf15eeb61838b5e32e721ba67b0aa84450 - https://git.kernel.org/stable/c/6ce38b5a6a49e65bad163162a54cb3f104c40b48 - https://git.kernel.org/stable/c/33e2168788f8fb5cb8bd4f36cb1ef37d1d34dada - https://git.kernel.org/stable/c/1489824e5226a26841c70639ebd2d1aed390764b - https://git.ker