Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
: - https://git.kernel.org/stable/c/1f053d82e59c785b2b939cbed12f13657f84b296 - https://git.kernel.org/stable/c/4eeafff163e80d576c5efc1360ae310c0ceedd02 - https://git.kernel.org/stable/c/80eaf32672871bd2623ce6ba13ffc1f018756580
CVE ID: CVE-2025-40016 State: PUBLISHED Published: 2025-10-20T15:29:10.376Z Last Updated: 2025-10-20T15:29:10.376Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID Per UVC 1.1+ specification 3.7.2, units and terminals must have a non-zero unique ID. ``` Each Unit and Terminal within the video function is assigned a unique identification number, the Unit ID (UID) or Terminal ID (TID), contained in the bUnitID or bTerminalID field of the descriptor. The value 0x00 is reserved for undefined ID, ``` If we add a new entity with id 0 or a duplicated ID, it will be mar
or. The value 0x00 is reserved for undefined ID, ``` If we add a new entity with id 0 or a duplicated ID, it will be marked as UVC_INVALID_ENTITY_ID. In a previous attempt commit 3dd075fe8ebb ("media: uvcvideo: Require entities to have a non-zero unique ID"), we ignored all the invalid units, this broke a lot of non-compatible cameras. Hopefully we are more lucky this time. This also prevents some syzkaller reproducers from triggering warnings due to a chain of entities referring to themselves. In one particular case, an Output Unit is connected to an Input Unit, both with the same ID of 1. But when looking up for the source ID of the Output Unit, that same entity is found instead of the inp
the same ID of 1. But when looking up for the source ID of the Output Unit, that same entity is found instead of the input entity, which leads to such warnings. In another case, a backward chain was considered finished as the source ID was 0. Later on, that entity was found, but its pads were not valid. Here is a sample stack trace for one of those cases. [ 20.650953] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 20.830206] usb 1-1: Using ep0 maxpacket: 8 [ 20.833501] usb 1-1: config 0 descriptor?? [ 21.038518] usb 1-1: string descriptor 0 read error: -71 [ 21.038893] usb 1-1: Found UVC 0.00 device <unnamed> (2833:0201) [ 21.039299] uvcvideo 1-1:0.0: Entity type for entity Ou
21.038893] usb 1-1: Found UVC 0.00 device <unnamed> (2833:0201) [ 21.039299] uvcvideo 1-1:0.0: Entity type for entity Output 1 was not initialized! [ 21.041583] uvcvideo 1-1:0.0: Entity type for entity Input 1 was not initialized! [ 21.042218] ------------[ cut here ]------------ [ 21.042536] WARNING: CPU: 0 PID: 9 at drivers/media/mc/mc-entity.c:1147 media_create_pad_link+0x2c4/0x2e0 [ 21.043195] Modules linked in: [ 21.043535] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.11.0-rc7-00030-g3480e43aeccf #444 [ 21.044101] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 21.044639] Workqueue: usb_hub_wq hub_event [ 21.045100] RIP: 0010:media_create_pad_link+
09), BIOS 1.15.0-1 04/01/2014 [ 21.044639] Workqueue: usb_hub_wq hub_event [ 21.045100] RIP: 0010:media_create_pad_link+0x2c4/0x2e0 [ 21.045508] Code: fe e8 20 01 00 00 b8 f4 ff ff ff 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 0f 0b eb e9 0f 0b eb 0a 0f 0b eb 06 <0f> 0b eb 02 0f 0b b8 ea ff ff ff eb d4 66 2e 0f 1f 84 00 00 00 00 [ 21.046801] RSP: 0018:ffffc9000004b318 EFLAGS: 00010246 [ 21.047227] RAX: ffff888004e5d458 RBX: 0000000000000000 RCX: ffffffff818fccf1 [ 21.047719] RDX: 000000000000007b RSI: 0000000000000000 RDI: ffff888004313290 [ 21.048241] RBP: ffff888004313290 R08: 0001ffffffffffff R09: 0000000000000000 [ 21.048701] R10: 0000000000000013 R11: 0001888004313290 R12:
ff888004313290 R08: 0001ffffffffffff R09: 0000000000000000 [ 21.048701] R10: 0000000000000013 R11: 0001888004313290 R12: 0000000000000003 [ 21.049138] R13: ffff888004313080 R14: ffff888004313080 R15: 0000000000000000 [ 21.049648] FS: 0000000000000000(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000 [ 21.050271] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 21.050688] CR2: 0000592cc27635b0 CR3: 000000000431c000 CR4: 0000000000750ef0 [ 21.051136] PKRU: 55555554 [ 21.051331] Call Trace: [ 21.051480] <TASK> [ 21.051611] ? __warn+0xc4/0x210 [ 21.051861] ? media_create_pad_link+0x2c4/0x2e0 [ 21.052252] ? report_bug+0x11b/0x1a0 [ 21.052540] ? trace_hardirqs_on+0x31/0x40 [ 21.052901] ? ha
_pad_link+0x2c4/0x2e0 [ 21.052252] ? report_bug+0x11b/0x1a0 [ 21.052540] ? trace_hardirqs_on+0x31/0x40 [ 21.052901] ? handle_bug+0x3d/0x70 [ 21.053197] ? exc_invalid_op+0x1a/0x50 [ 21.053511] ? asm_exc_invalid_op+0x1a/0x20 [ 21.053924] ? media_create_pad_link+0x91/0x2e0 [ 21.054364] ? media_create_pad_link+0x2c4/0x2e0 [ 21.054834] ? media_create_pad_link+0x91/0x2e0 [ 21.055131] ? _raw_spin_unlock+0x1e/0x40 [ 21.055441] ? __v4l2_device_register_subdev+0x202/0x210 [ 21.055837] uvc_mc_register_entities+0x358/0x400 [ 21.056144] uvc_register_chains+0x1 ---truncated--- References: - https://git.kernel.org/stable/c/f617d515d66c05e9aebc787a8fe48b7163fc7b70 - https://git.kernel.org/stable/c/000b2a6be
: - https://git.kernel.org/stable/c/f617d515d66c05e9aebc787a8fe48b7163fc7b70 - https://git.kernel.org/stable/c/000b2a6bed7f30e0aadfb19bce9af6458d879304 - https://git.kernel.org/stable/c/15c0e136bd8cd70a1136a11c7876d6aae0eef8c8 - https://git.kernel.org/stable/c/0f140cede24334b3ee55e3e1127071266cbb8287 - https://git.kernel.org/stable/c/0e2ee70291e64a30fe36960c85294726d34a103e
CVE ID: CVE-2025-40017 State: PUBLISHED Published: 2025-10-20T15:30:43.085Z Last Updated: 2025-10-20T15:30:43.085Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: iris: Fix memory leak by freeing untracked persist buffer One internal buffer which is allocated only once per session was not being freed during session close because it was not being tracked as part of internal buffer list which resulted in a memory leak. Add the necessary logic to explicitly free the untracked internal buffer during session close to ensure all allocated memory is released properly. References: - https://git.kernel.org/stable/c/c9e024e907cafaf
close to ensure all allocated memory is released properly. References: - https://git.kernel.org/stable/c/c9e024e907cafafd6b094f69a0d0f5d18fd28876 - https://git.kernel.org/stable/c/ec2f87ad035e8d1ad67567542842f1f23a4dbde2 - https://git.kernel.org/stable/c/02a24f13b3a1d9da9f3de56aa5fdb7cc1fe167a2
CVE ID: CVE-2025-40018 State: PUBLISHED Published: 2025-10-24T11:44:28.955Z Last Updated: 2025-10-29T13:19:22.888Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leading to a use-after-free. Fix this by introducing a global `exiting_module` flag, set to true in ip_vs_ftp_exit() before unregistering the pernet subsystem. In __ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns cleanup (when exiting_module is false) and defer it to _
vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns cleanup (when exiting_module is false) and defer it to __ip_vs_cleanup_batch(), which unregisters all apps after all connections are flushed. If called during module exit, unregister ip_vs_ftp immediately. References: - https://git.kernel.org/stable/c/8a6ecab3847c213ce2855b0378e63ce839085de3 - https://git.kernel.org/stable/c/421b1ae1574dfdda68b835c15ac4921ec0030182 - https://git.kernel.org/stable/c/1d79471414d7b9424d699afff2aa79fff322f52d - https://git.kernel.org/stable/c/53717f8a4347b78eac6488072ad8e5adbaff38d9 - https://git.kernel.org/stable/c/8cbe2a21d85727b66d7c591fd5d83df0d8c4f757 - https://git.kernel.org/stable/c/dc1a48135
9 - https://git.kernel.org/stable/c/8cbe2a21d85727b66d7c591fd5d83df0d8c4f757 - https://git.kernel.org/stable/c/dc1a481359a72ee7e548f1f5da671282a7c13b8f - https://git.kernel.org/stable/c/a343811ef138a265407167294275201621e9ebb2 - https://git.kernel.org/stable/c/134121bfd99a06d44ef5ba15a9beb075297c0821
CVE ID: CVE-2025-40019 State: PUBLISHED Published: 2025-10-24T11:44:29.864Z Last Updated: 2025-10-29T13:19:25.376Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption. References: - https://git.kernel.org/stable/c/29294dd6f1e7acf527255fb136ffde6602c3a129 - https://git.kernel.org/stable/c/71f03f8f72d9c70ffba76980e78b38c180e61589 - https://git.kernel.org/stable/c/df58651968f82344a0ed2afdafd20ecfc55ff548 - https://git.kernel.org/stable/c/248ff2797ff52a8
tps://git.kernel.org/stable/c/df58651968f82344a0ed2afdafd20ecfc55ff548 - https://git.kernel.org/stable/c/248ff2797ff52a8cbf86507f9583437443bf7685 - https://git.kernel.org/stable/c/f37e7860dc5e94c70b4a3e38a5809181310ea9ac - https://git.kernel.org/stable/c/dc4c854a5e7453c465fa73b153eba4ef2a240abe - https://git.kernel.org/stable/c/da7afb01ba05577ba3629f7f4824205550644986 - https://git.kernel.org/stable/c/6bb73db6948c2de23e407fe1b7ef94bf02b7529f
CVE ID: CVE-2025-40020 State: PUBLISHED Published: 2025-10-24T12:24:56.311Z Last Updated: 2025-10-24T12:24:56.311Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: fix shift-out-of-bounds issue Explicitly uses a 64-bit constant when the number of bits used for its shifting is 32 (which is the case for PC CAN FD interfaces supported by this driver). [mkl: update subject, apply manually] References: - https://git.kernel.org/stable/c/572c656802781cc57f4a3231eefa83547e75ed78 - https://git.kernel.org/stable/c/61b1dd4c614935169d12bdecc26906e37b508618 - https://git.kernel.org/stable/c/48822a59ecc47d353400d38b1941d3ae7591f
table/c/61b1dd4c614935169d12bdecc26906e37b508618 - https://git.kernel.org/stable/c/48822a59ecc47d353400d38b1941d3ae7591ffff - https://git.kernel.org/stable/c/176c81cbf9c4e348610a421aad800087c0401f60 - https://git.kernel.org/stable/c/17edec1830e48c0becd61642d0e40bc753243b16 - https://git.kernel.org/stable/c/eb79ed970670344380e77d62f8188e8015648d94 - https://git.kernel.org/stable/c/394c58017e5f41043584c345106cae16a4613710 - https://git.kernel.org/stable/c/c443be70aaee42c2d1d251e0329e0a69dd96ae54
CVE ID: CVE-2025-40021 State: PUBLISHED Published: 2025-10-24T12:24:57.107Z Last Updated: 2025-10-24T12:24:57.107Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tracing: dynevent: Add a missing lockdown check on dynevent Since dynamic_events interface on tracefs is compatible with kprobe_events and uprobe_events, it should also check the lockdown status and reject if it is set. References: - https://git.kernel.org/stable/c/f3ac1f4eaba58e57943efa3e8b8d71fa7aab0abf - https://git.kernel.org/stable/c/0d41604d2d53c1abe27fefb54b37a8f6642a4d74 - https://git.kernel.org/stable/c/07b1f63b5f86765793fab44d3d4c2be681cddafb - https://git.ke
c1abe27fefb54b37a8f6642a4d74 - https://git.kernel.org/stable/c/07b1f63b5f86765793fab44d3d4c2be681cddafb - https://git.kernel.org/stable/c/3887f3814c0e770e6b73567fe0f83a2c01a6470c - https://git.kernel.org/stable/c/573b1e39edfcb7b4eecde0f1664455a1f4462eee - https://git.kernel.org/stable/c/b47c4e06687a5a7b6c6ef4bd303fcfe4430b26bb - https://git.kernel.org/stable/c/456c32e3c4316654f95f9d49c12cbecfb77d5660
CVE ID: CVE-2025-40022 State: PUBLISHED Published: 2025-10-24T12:24:57.875Z Last Updated: 2025-10-24T12:24:57.875Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx Commit 1b34cbbf4f01 ("crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg") changed some fields from bool to 1-bit bitfields of type u32. However, some assignments to these fields, specifically 'more' and 'merge', assign values greater than 1. These relied on C's implicit conversion to bool, such that zero becomes false and nonzero becomes true. With a 1-bit bitfields of type u32 instead, mod 2 of th
to bool, such that zero becomes false and nonzero becomes true. With a 1-bit bitfields of type u32 instead, mod 2 of the value is taken instead, resulting in 0 being assigned in some cases when 1 was intended. Fix this by restoring the bool type. References: - https://git.kernel.org/stable/c/3a21698ace915a445bce2d0dcfc84b6d2199baf7 - https://git.kernel.org/stable/c/d382d6daf0184490f366562469a5673f65ee2662 - https://git.kernel.org/stable/c/54506c6335690f4ef1b9f154e34f5a604c72c1ed - https://git.kernel.org/stable/c/8703940bd30b5ad94408d28d7192db2491cd3592 - https://git.kernel.org/stable/c/316b090c2fee964c307a634fecc7df269664b158 - https://git.kernel.org/stable/c/fbe96bd25423e61273d8831e995260b
.org/stable/c/316b090c2fee964c307a634fecc7df269664b158 - https://git.kernel.org/stable/c/fbe96bd25423e61273d8831e995260b429d850b6 - https://git.kernel.org/stable/c/d0ca0df179c4b21e2a6c4a4fb637aa8fa14575cb
CVE ID: CVE-2025-40023 State: PUBLISHED Published: 2025-10-24T12:24:58.554Z Last Updated: 2025-10-24T12:24:58.554Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Don't expose sysfs attributes not applicable for VFs VFs can't read BMG_PCIE_CAP(0x138340) register nor access PCODE (already guarded by the info.skip_pcode flag) so we shouldn't expose attributes that require any of them to avoid errors like: [] xe 0000:03:00.1: [drm] Tile0: GT0: VF is trying to read an \ inaccessible register 0x138340+0x0 [] RIP: 0010:xe_gt_sriov_vf_read32+0x6c2/0x9a0 [xe] [] Call Trace: [] xe_mmio_read32+0x110/0x280 [xe] [] auto_link_down
[] RIP: 0010:xe_gt_sriov_vf_read32+0x6c2/0x9a0 [xe] [] Call Trace: [] xe_mmio_read32+0x110/0x280 [xe] [] auto_link_downgrade_capable_show+0x2e/0x70 [xe] [] dev_attr_show+0x1a/0x70 [] sysfs_kf_seq_show+0xaa/0x120 [] kernfs_seq_show+0x41/0x60 (cherry picked from commit a2d6223d224f333f705ed8495bf8bebfbc585c35) References: - https://git.kernel.org/stable/c/bacbadedbba737da8ae6e0464bc0971c30cda4cb - https://git.kernel.org/stable/c/500dad428e5b0de4c1bdfa893822a6e06ddad0b5
CVE ID: CVE-2025-40024 State: PUBLISHED Published: 2025-10-24T12:24:59.199Z Last Updated: 2025-10-24T12:24:59.199Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: vhost: Take a reference on the task in struct vhost_task. vhost_task_create() creates a task and keeps a reference to its task_struct. That task may exit early via a signal and its task_struct will be released. A pending vhost_task_wake() will then attempt to wake the task and access a task_struct which is no longer there. Acquire a reference on the task_struct while creating the thread and release the reference while the struct vhost_task itself is removed. If the tas
ask_struct while creating the thread and release the reference while the struct vhost_task itself is removed. If the task exits early due to a signal, then the vhost_task_wake() will still access a valid task_struct. The wake is safe and will be skipped in this case. References: - https://git.kernel.org/stable/c/82a1463c968b1a6ae598a4f2fcef17b71bb7d3a0 - https://git.kernel.org/stable/c/d2be773a92874a070215b51b730cb2b1eaa8fae2 - https://git.kernel.org/stable/c/7ce635b3d3aba43296b62b5a2d97c008bc51cbd2 - https://git.kernel.org/stable/c/afe16653e05db07d658b55245c7a2e0603f136c0
CVE ID: CVE-2025-40025 State: PUBLISHED Published: 2025-10-28T09:32:31.806Z Last Updated: 2025-10-28T09:32:31.806Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on node footer for non inode dnode As syzbot reported below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/file.c:1243! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5354 Comm: syz.0.0 Not tainted 6.17.0-rc1-syzkaller-00211-g90d970cade8e #0 PREEMPT(full) RIP: 0010:f2fs_truncate_hole+0x69e/0x6c0 fs/f2fs/file.c:1243 Call Trace: <TASK> f2fs_punch_hole+0x2db/0x330 fs/f2fs/file.c:1306 f2fs_fallocate+0x546/0x990
0x6c0 fs/f2fs/file.c:1243 Call Trace: <TASK> f2fs_punch_hole+0x2db/0x330 fs/f2fs/file.c:1306 f2fs_fallocate+0x546/0x990 fs/f2fs/file.c:2018 vfs_fallocate+0x666/0x7e0 fs/open.c:342 ksys_fallocate fs/open.c:366 [inline] __do_sys_fallocate fs/open.c:371 [inline] __se_sys_fallocate fs/open.c:369 [inline] __x64_sys_fallocate+0xc0/0x110 fs/open.c:369 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1e65f8ebe9 w/ a fuzzed image, f2fs may encounter panic due to it detects inconsistent truncation range in direct node in f2fs_truncate_hole(). The root cause is: a non-inode dnode may has
tects inconsistent truncation range in direct node in f2fs_truncate_hole(). The root cause is: a non-inode dnode may has the same footer.ino and footer.nid, so the dnode will be parsed as an inode, then ADDRS_PER_PAGE() may return wrong blkaddr count which may be 923 typically, by chance, dn.ofs_in_node is equal to 923, then count can be calculated to 0 in below statement, later it will trigger panic w/ f2fs_bug_on(, count == 0 || ...). count = min(end_offset - dn.ofs_in_node, pg_end - pg_start); This patch introduces a new node_type NODE_TYPE_NON_INODE, then allowing passing the new_type to sanity_check_node_footer in f2fs_get_node_folio() to detect corruption that a non-inode dnode has the
ng the new_type to sanity_check_node_footer in f2fs_get_node_folio() to detect corruption that a non-inode dnode has the same footer.ino and footer.nid. Scripts to reproduce: mkfs.f2fs -f /dev/vdb mount /dev/vdb /mnt/f2fs touch /mnt/f2fs/foo touch /mnt/f2fs/bar dd if=/dev/zero of=/mnt/f2fs/foo bs=1M count=8 umount /mnt/f2fs inject.f2fs --node --mb i_nid --nid 4 --idx 0 --val 5 /dev/vdb mount /dev/vdb /mnt/f2fs xfs_io /mnt/f2fs/foo -c "fpunch 6984k 4k" References: - https://git.kernel.org/stable/c/186098f34b8a5d65eb828f952c8cc56272c60ea0 - https://git.kernel.org/stable/c/c18ecd99e0c707ef8f83cace861cbc3162f4fdf1
CVE ID: CVE-2025-40026 State: PUBLISHED Published: 2025-10-28T09:32:33.075Z Last Updated: 2025-10-29T13:19:27.308Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instruction execution, i.e. has already committed to allowing L2 to perform I/O. If L1 (or host userspace) modifies the I/O permission bitmaps during the exit to userspace, KVM will treat the access as being intercepted despite already having emulated
ion bitmaps during the exit to userspace, KVM will treat the access as being intercepted despite already having emulated the I/O access. Pivot on EMULTYPE_NO_DECODE to detect that KVM is completing emulation. Of the three users of EMULTYPE_NO_DECODE, only complete_emulated_io() (the intended "recipient") can reach the code in question. gp_interception()'s use is mutually exclusive with is_guest_mode(), and complete_emulated_insn_gp() unconditionally pairs EMULTYPE_NO_DECODE with EMULTYPE_SKIP. The bad behavior was detected by a syzkaller program that toggles port I/O interception during the userspace I/O exit, ultimately resulting in a WARN on vcpu->arch.pio.count being non-zero due to KVM n
eption during the userspace I/O exit, ultimately resulting in a WARN on vcpu->arch.pio.count being non-zero due to KVM no completing emulation of the I/O instruction. WARNING: CPU: 23 PID: 1083 at arch/x86/kvm/x86.c:8039 emulator_pio_in_out+0x154/0x170 [kvm] Modules linked in: kvm_intel kvm irqbypass CPU: 23 UID: 1000 PID: 1083 Comm: repro Not tainted 6.16.0-rc5-c1610d2d66b1-next-vm #74 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:emulator_pio_in_out+0x154/0x170 [kvm] PKRU: 55555554 Call Trace: <TASK> kvm_fast_pio+0xd6/0x1d0 [kvm] vmx_handle_exit+0x149/0x610 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xda8/0x1ac0 [kvm] kvm_vcpu_ioctl+0x244/0x8c0 [kvm] __x
vmx_handle_exit+0x149/0x610 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xda8/0x1ac0 [kvm] kvm_vcpu_ioctl+0x244/0x8c0 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0x5d/0xc60 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> References: - https://git.kernel.org/stable/c/a908eca437789589dd4624da428614c1275064dc - https://git.kernel.org/stable/c/00338255bb1f422642fb2798ebe92e93b6e4209b - https://git.kernel.org/stable/c/e0ce3ed1048a47986d15aef1a98ebda25560d257 - https://git.kernel.org/stable/c/ba35a5d775799ce5ad60230be97336f2fefd518e - https://git.kernel.org/stable/c/3d3abf3f7e8b1abb082070a343de82d7efc80523 - https://git.kernel.org/stable/c/e7177c7e32cb806f348387b7f4faafd4a5b32054 - https://git.kernel.
82070a343de82d7efc80523 - https://git.kernel.org/stable/c/e7177c7e32cb806f348387b7f4faafd4a5b32054 - https://git.kernel.org/stable/c/3a062a5c55adc5507600b9ae6d911e247e2f1d6e - https://git.kernel.org/stable/c/7366830642505683bbe905a2ba5d18d6e4b512b8 - https://git.kernel.org/stable/c/e750f85391286a4c8100275516973324b621a269
CVE ID: CVE-2025-40027 State: PUBLISHED Published: 2025-10-28T09:32:34.162Z Last Updated: 2025-10-29T13:19:29.546Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/9p: fix double req put in p9_fd_cancelled Syzkaller reports a KASAN issue as below: general protection fault, probably for non-canonical address 0xfbd59c0000000021: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0xdead000000000108-0xdead00000000010f] CPU: 0 PID: 5083 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00037-g855bd1d7d838 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:__list_d
0037-g855bd1d7d838 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:__list_del include/linux/list.h:114 [inline] RIP: 0010:__list_del_entry include/linux/list.h:137 [inline] RIP: 0010:list_del include/linux/list.h:148 [inline] RIP: 0010:p9_fd_cancelled+0xe9/0x200 net/9p/trans_fd.c:734 Call Trace: <TASK> p9_client_flush+0x351/0x440 net/9p/client.c:614 p9_client_rpc+0xb6b/0xc70 net/9p/client.c:734 p9_client_version net/9p/client.c:920 [inline] p9_client_create+0xb51/0x1240 net/9p/client.c:1027 v9fs_session_init+0x1f0/0x18f0 fs/9p/v9fs.c:408 v9fs_mount+0xba/0xcb0 fs/9p/vfs_super.c:126 legacy_get_tree+0x108/0x220 fs/fs_context.c:632 vfs_get_tree+0x8e/0
fs.c:408 v9fs_mount+0xba/0xcb0 fs/9p/vfs_super.c:126 legacy_get_tree+0x108/0x220 fs/fs_context.c:632 vfs_get_tree+0x8e/0x300 fs/super.c:1573 do_new_mount fs/namespace.c:3056 [inline] path_mount+0x6a6/0x1e90 fs/namespace.c:3386 do_mount fs/namespace.c:3399 [inline] __do_sys_mount fs/namespace.c:3607 [inline] __se_sys_mount fs/namespace.c:3584 [inline] __x64_sys_mount+0x283/0x300 fs/namespace.c:3584 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 This happens because of a race condition between: - The 9p client sending an invalid flush request and later cleaning it up; - The 9p client in p9_read_work
tion between: - The 9p client sending an invalid flush request and later cleaning it up; - The 9p client in p9_read_work() canceled all pending requests. Thread 1 Thread 2 ... p9_client_create() ... p9_fd_create() ... p9_conn_create() ... // start Thread 2 INIT_WORK(&m->rq, p9_read_work); p9_read_work() ... p9_client_rpc() ... ... p9_conn_cancel() ... spin_lock(&m->req_lock); ... p9_fd_cancelled() ... ... spin_unlock(&m->req_lock); // status rewrite p9_client_cb(m->client, req, REQ_STATUS_ERROR) // first remove list_del(&req->req_list); ... spin_lock(&m->req_lock) ... // second remove list_del(&req->req_list); spin_unlock(&m->req_lock) ... Commit 74d6a5d56629 ("9p/trans_fd: Fix concurrency d