Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-21753 State: PUBLISHED Published: 2025-02-27T02:12:23.235Z Last Updated: 2025-11-03T19:36:58.333Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free when attempting to join an aborted transaction When we are trying to join the current transaction and if it's aborted, we read its 'aborted' field after unlocking fs_info->trans_lock and without holding any extra reference count on it. This means that a concurrent task that is aborting the transaction may free the transaction before we read its 'aborted' field, leading to a use-after-free. Fix this by reading the 'aborted' field while holding
before we read its 'aborted' field, leading to a use-after-free. Fix this by reading the 'aborted' field while holding fs_info->trans_lock since any freeing task must first acquire that lock and set fs_info->running_transaction to NULL before freeing the transaction. This was reported by syzbot and Dmitry with the following stack traces from KASAN: ================================================================== BUG: KASAN: slab-use-after-free in join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278 Read of size 4 at addr ffff888011839024 by task kworker/u4:9/1128 CPU: 0 UID: 0 PID: 1128 Comm: kworker/u4:9 Not tainted 6.13.0-rc7-syzkaller-00019-gc45323b7560e #0 Hardware name: QEMU Stand
0 UID: 0 PID: 1128 Comm: kworker/u4:9 Not tainted 6.13.0-rc7-syzkaller-00019-gc45323b7560e #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: events_unbound btrfs_async_reclaim_data_space Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278 start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697 flush_space+0x448/0xcf0 fs/btrfs/space-info.c:803 btrfs_async_reclaim_data_
tion+0xaf8/0x1670 fs/btrfs/transaction.c:697 flush_space+0x448/0xcf0 fs/btrfs/space-info.c:803 btrfs_async_reclaim_data_space+0x159/0x510 fs/btrfs/space-info.c:1321 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated by task 5315: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/commo
0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329 kmalloc_noprof include/linux/slab.h:901 [inline] join_transaction+0x144/0xda0 fs/btrfs/transaction.c:308 start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697 btrfs_create_common+0x1b2/0x2e0 fs/btrfs/inode.c:6572 lookup_open fs/namei.c:3649 [inline] open_last_lookups fs/namei.c:3748 [inline] path_openat+0x1c03/0x3590 fs/namei.c:3984 do_filp_open+0x27f/0x4e0 fs/namei.c:4014 do_sys_openat2+0x13e/0x1d0 fs/open.c:1402 do_sys_open fs/open.c:1417 [inline] __do_sys_creat
x27f/0x4e0 fs/namei.c:4014 do_sys_openat2+0x13e/0x1d0 fs/open.c:1402 do_sys_open fs/open.c:1417 [inline] __do_sys_creat fs/open.c:1495 [inline] __se_sys_creat fs/open.c:1489 [inline] __x64_sys_creat+0x123/0x170 fs/open.c:1489 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5336: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_
[inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2353 [inline] slab_free mm/slub.c:4613 [inline] kfree+0x196/0x430 mm/slub.c:4761 cleanup_transaction fs/btrfs/transaction.c:2063 [inline] btrfs_commit_transaction+0x2c97/0x3720 fs/btrfs/transaction.c:2598 insert_balance_item+0x1284/0x20b0 fs/btrfs/volumes.c:3757 btrfs_balance+0x992/ ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/cee55b1219568c80bf0d5dc55066e4a859baf753 - https://git.kernel.org/stable/c/c7a53757717e68af94a56929d57f1e6daff220ec - https://git.kernel.org/st
55066e4a859baf753 - https://git.kernel.org/stable/c/c7a53757717e68af94a56929d57f1e6daff220ec - https://git.kernel.org/stable/c/7e954b6bb95d67ae4d1a20e9cfd83c182cf929bc - https://git.kernel.org/stable/c/6ba4663ada6c6315af23a6669d386146634808ec - https://git.kernel.org/stable/c/8f5cff471039caa2b088060c074c2bf2081bcb01 - https://git.kernel.org/stable/c/86d71a026a7f63da905db9add845c8ee88801eca - https://git.kernel.org/stable/c/ce628048390dad80320d5a1f74de6ca1e1be91e7 - https://git.kernel.org/stable/c/e2f0943cf37305dbdeaf9846e3c941451bcdef63
CVE ID: CVE-2025-21754 State: PUBLISHED Published: 2025-02-27T02:12:23.738Z Last Updated: 2025-05-04T07:20:27.815Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix assertion failure when splitting ordered extent after transaction abort If while we are doing a direct IO write a transaction abort happens, we mark all existing ordered extents with the BTRFS_ORDERED_IOERR flag (done at btrfs_destroy_ordered_extents()), and then after that if we enter btrfs_split_ordered_extent() and the ordered extent has bytes left (meaning we have a bio that doesn't cover the whole ordered extent, see details at btrfs_extract_ordered_ext
bytes left (meaning we have a bio that doesn't cover the whole ordered extent, see details at btrfs_extract_ordered_extent()), we will fail on the following assertion at btrfs_split_ordered_extent(): ASSERT(!(flags & ~BTRFS_ORDERED_TYPE_FLAGS)); because the BTRFS_ORDERED_IOERR flag is set and the definition of BTRFS_ORDERED_TYPE_FLAGS is just the union of all flags that identify the type of write (regular, nocow, prealloc, compressed, direct IO, encoded). Fix this by returning an error from btrfs_extract_ordered_extent() if we find the BTRFS_ORDERED_IOERR flag in the ordered extent. The error will be the error that resulted in the transaction abort or -EIO if no transaction abort happened.
ed extent. The error will be the error that resulted in the transaction abort or -EIO if no transaction abort happened. This was recently reported by syzbot with the following trace: FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted 6.13.0-rc5-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 fail_dump lib/fault-inject.c:53 [inline] should_fail_ex+0x3b0/0x4e0 lib/fault-inject.c:154 should_failslab+0xac/0x100 mm/failslab.c:46 slab_
inject.c:53 [inline] should_fail_ex+0x3b0/0x4e0 lib/fault-inject.c:154 should_failslab+0xac/0x100 mm/failslab.c:46 slab_pre_alloc_hook mm/slub.c:4072 [inline] slab_alloc_node mm/slub.c:4148 [inline] __do_kmalloc_node mm/slub.c:4297 [inline] __kmalloc_noprof+0xdd/0x4c0 mm/slub.c:4310 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] btrfs_chunk_alloc_add_chunk_item+0x244/0x1100 fs/btrfs/volumes.c:5742 reserve_chunk_space+0x1ca/0x2c0 fs/btrfs/block-group.c:4292 check_system_chunk fs/btrfs/block-group.c:4319 [inline] do_chunk_alloc fs/btrfs/block-group.c:3891 [inline] btrfs_chunk_alloc+0x77b/0xf80 fs/btrfs/block-group.c:4187 find_free_extent_upda
loc fs/btrfs/block-group.c:3891 [inline] btrfs_chunk_alloc+0x77b/0xf80 fs/btrfs/block-group.c:4187 find_free_extent_update_loop fs/btrfs/extent-tree.c:4166 [inline] find_free_extent+0x42d1/0x5810 fs/btrfs/extent-tree.c:4579 btrfs_reserve_extent+0x422/0x810 fs/btrfs/extent-tree.c:4672 btrfs_new_extent_direct fs/btrfs/direct-io.c:186 [inline] btrfs_get_blocks_direct_write+0x706/0xfa0 fs/btrfs/direct-io.c:321 btrfs_dio_iomap_begin+0xbb7/0x1180 fs/btrfs/direct-io.c:525 iomap_iter+0x697/0xf60 fs/iomap/iter.c:90 __iomap_dio_rw+0xeb9/0x25b0 fs/iomap/direct-io.c:702 btrfs_dio_write fs/btrfs/direct-io.c:775 [inline] btrfs_direct_write+0x610/0xa30 fs/btrfs/direct-io.c:880 btrfs_do_write_iter+0x2a0/0x7
fs/btrfs/direct-io.c:775 [inline] btrfs_direct_write+0x610/0xa30 fs/btrfs/direct-io.c:880 btrfs_do_write_iter+0x2a0/0x760 fs/btrfs/file.c:1397 do_iter_readv_writev+0x600/0x880 vfs_writev+0x376/0xba0 fs/read_write.c:1050 do_pwritev fs/read_write.c:1146 [inline] __do_sys_pwritev2 fs/read_write.c:1204 [inline] __se_sys_pwritev2+0x196/0x2b0 fs/read_write.c:1195 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1281f85d29 RSP: 002b:00007f12819fe038 EFLAGS: 00000246 ORIG_RAX: 0000000000000148 RAX: ffffffffffffffda RBX: 00007f1282176080 RCX: 00007f1281f85d29 RDX: 0000000000000001 RSI: 000000
AX: 0000000000000148 RAX: ffffffffffffffda RBX: 00007f1282176080 RCX: 00007f1281f85d29 RDX: 0000000000000001 RSI: 0000000020000240 RDI: 0000000000000005 RBP: 00007f12819fe090 R08: 0000000000000000 R09: 0000000000000003 R10: 0000000000007000 R11: 0000000000000246 R12: 0000000000000002 R13: 0000000000000000 R14: 00007f1282176080 R15: 00007ffcb9e23328 </TASK> BTRFS error (device loop0 state A): Transaction aborted (error -12) BTRFS: error (device loop0 state A ---truncated--- References: - https://git.kernel.org/stable/c/927b930f117bbae730a853c1dc43da8afe8380fa - https://git.kernel.org/stable/c/0ff88c2a742a7cbaa4d08507d864737d099b435a - https://git.kernel.org/stable/c/8ea8db4216d1029527ab4666f7
ernel.org/stable/c/0ff88c2a742a7cbaa4d08507d864737d099b435a - https://git.kernel.org/stable/c/8ea8db4216d1029527ab4666f730650419451e32 - https://git.kernel.org/stable/c/0d85f5c2dd91df6b5da454406756f463ba923b69
CVE ID: CVE-2025-21755 State: REJECTED Published: 2025-02-27T02:18:11.055Z Last Updated: 2025-03-27T13:48:12.158Z Description: No description available.
CVE ID: CVE-2025-21756 State: PUBLISHED Published: 2025-02-27T02:18:11.547Z Last Updated: 2025-11-03T19:37:01.186Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: vsock: Keep the binding until socket destruction Preserve sockets bindings; this includes both resulting from an explicit bind() and those implicitly bound through autobind during connect(). Prevents socket unbinding during a transport reassignment, which fixes a use-after-free: 1. vsock_create() (refcnt=1) calls vsock_insert_unbound() (refcnt=2) 2. transport->release() calls vsock_remove_bound() without checking if sk was bound and moved to bound list (refcnt=1) 3. vs
ransport->release() calls vsock_remove_bound() without checking if sk was bound and moved to bound list (refcnt=1) 3. vsock_bind() assumes sk is in unbound list and before __vsock_insert_bound(vsock_bound_sockets()) calls __vsock_remove_bound() which does: list_del_init(&vsk->bound_table); // nop sock_put(&vsk->sk); // refcnt=0 BUG: KASAN: slab-use-after-free in __vsock_bind+0x62e/0x730 Read of size 4 at addr ffff88816b46a74c by task a.out/2057 dump_stack_lvl+0x68/0x90 print_report+0x174/0x4f6 kasan_report+0xb9/0x190 __vsock_bind+0x62e/0x730 vsock_bind+0x97/0xe0 __sys_bind+0x154/0x1f0 __x64_sys_bind+0x6e/0xb0 do_syscall_64+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Allocated by task
0x154/0x1f0 __x64_sys_bind+0x6e/0xb0 do_syscall_64+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Allocated by task 2057: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 __kasan_slab_alloc+0x85/0x90 kmem_cache_alloc_noprof+0x131/0x450 sk_prot_alloc+0x5b/0x220 sk_alloc+0x2c/0x870 __vsock_create.constprop.0+0x2e/0xb60 vsock_create+0xe4/0x420 __sock_create+0x241/0x650 __sys_socket+0xf2/0x1a0 __x64_sys_socket+0x6e/0xb0 do_syscall_64+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 2057: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x60 __kasan_slab_free+0x4b/0x70 kmem_cache_free+0x1a1/0x590 __sk_destruct+0x388/0x5a0 __vsock_bind+0x5e
_free_info+0x37/0x60 __kasan_slab_free+0x4b/0x70 kmem_cache_free+0x1a1/0x590 __sk_destruct+0x388/0x5a0 __vsock_bind+0x5e1/0x730 vsock_bind+0x97/0xe0 __sys_bind+0x154/0x1f0 __x64_sys_bind+0x6e/0xb0 do_syscall_64+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e refcount_t: addition on 0; use-after-free. WARNING: CPU: 7 PID: 2057 at lib/refcount.c:25 refcount_warn_saturate+0xce/0x150 RIP: 0010:refcount_warn_saturate+0xce/0x150 __vsock_bind+0x66d/0x730 vsock_bind+0x97/0xe0 __sys_bind+0x154/0x1f0 __x64_sys_bind+0x6e/0xb0 do_syscall_64+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e refcount_t: underflow; use-after-free. WARNING: CPU: 7 PID: 2057 at lib/refcount.c:28 refcount_warn_saturate+
+0x76/0x7e refcount_t: underflow; use-after-free. WARNING: CPU: 7 PID: 2057 at lib/refcount.c:28 refcount_warn_saturate+0xee/0x150 RIP: 0010:refcount_warn_saturate+0xee/0x150 vsock_remove_bound+0x187/0x1e0 __vsock_release+0x383/0x4a0 vsock_release+0x90/0x120 __sock_release+0xa3/0x250 sock_close+0x14/0x20 __fput+0x359/0xa80 task_work_run+0x107/0x1d0 do_exit+0x847/0x2560 do_group_exit+0xb8/0x250 __x64_sys_exit_group+0x3a/0x50 x64_sys_call+0xfec/0x14f0 do_syscall_64+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e7754d564579a5db9c5c9f74228df5d6dd6f1173 - https://git.ker
gram Container: References: - https://git.kernel.org/stable/c/e7754d564579a5db9c5c9f74228df5d6dd6f1173 - https://git.kernel.org/stable/c/e48fcb403c2d0e574c19683f09399ab4cf67809c - https://git.kernel.org/stable/c/42b33381e5e1f2b967dc4fb4221ddb9aaf10d197 - https://git.kernel.org/stable/c/3f43540166128951cc1be7ab1ce6b7f05c670d8b - https://git.kernel.org/stable/c/645ce25aa0e67895b11d89f27bb86c9d444c40f8 - https://git.kernel.org/stable/c/b1afd40321f1c243cffbcf40ea7ca41aca87fa5e - https://git.kernel.org/stable/c/fcdd2242c0231032fc84e1404315c245ae56322a
CVE ID: CVE-2025-21757 State: REJECTED Published: 2025-02-27T02:18:12.006Z Last Updated: 2025-03-25T01:09:11.303Z Description: No description available.
CVE ID: CVE-2025-21758 State: PUBLISHED Published: 2025-02-27T02:18:12.496Z Last Updated: 2025-11-03T19:37:03.144Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: add RCU protection to mld_newpack() mld_newpack() can be called without RTNL or RCU being held. Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep. Instead use alloc_skb() and charge the net->ipv6.igmp_sk socket under RCU protection. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/29fa42197f26a97cde29fa8c40beddf44ea5c8f3 - https://git.kernel.
Container: References: - https://git.kernel.org/stable/c/29fa42197f26a97cde29fa8c40beddf44ea5c8f3 - https://git.kernel.org/stable/c/e8af3632a7f2da83e27b083f787bced1faba00b1 - https://git.kernel.org/stable/c/1b91c597b0214b1b462eb627ec02658c944623f2 - https://git.kernel.org/stable/c/25195f9d5ffcc8079ad743a50c0409dbdc48d98a - https://git.kernel.org/stable/c/d60d493b0e65647e0335e6a7c4547abcea7df8e9 - https://git.kernel.org/stable/c/a527750d877fd334de87eef81f1cb5f0f0ca3373
CVE ID: CVE-2025-21759 State: PUBLISHED Published: 2025-02-27T02:18:12.994Z Last Updated: 2025-05-04T07:20:31.433Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: extend RCU protection in igmp6_send() igmp6_send() can be called without RTNL or RCU being held. Extend RCU protection so that we can safely fetch the net pointer and avoid a potential UAF. Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep. Instead use alloc_skb() and charge the net->ipv6.igmp_sk socket under RCU protection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
rge the net->ipv6.igmp_sk socket under RCU protection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/81b25a07ebf53f9ef4ca8f3d96a8ddb94561dd5a - https://git.kernel.org/stable/c/0bf8e2f3768629d437a32cb824149e6e98254381 - https://git.kernel.org/stable/c/8e92d6a413feaf968a33f0b439ecf27404407458 - https://git.kernel.org/stable/c/087c1faa594fa07a66933d750c0b2610aa1a2946
CVE ID: CVE-2025-21760 State: PUBLISHED Published: 2025-02-27T02:18:13.496Z Last Updated: 2025-11-03T19:37:05.973Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ndisc: extend RCU protection in ndisc_send_skb() ndisc_send_skb() can be called without RTNL or RCU held. Acquire rcu_read_lock() earlier, so that we can use dev_net_rcu() and avoid a potential UAF. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/10a1f3fece2f0d23a3a618b72b2b4e6f408ef7d1 - https://git.kernel.org/stable/c/4d576202b90b1b95a7c428a80b536f91b8201bcc - https://git.kernel.org/stable/c/e2
408ef7d1 - https://git.kernel.org/stable/c/4d576202b90b1b95a7c428a80b536f91b8201bcc - https://git.kernel.org/stable/c/e24d225e4cb8cf108bde00b76594499b98f0a74d - https://git.kernel.org/stable/c/a9319d800b5701e7f5e3fa71a5b7c4831fc20d6d - https://git.kernel.org/stable/c/ae38982f521621c216fc2f5182cd091f4734641d - https://git.kernel.org/stable/c/789230e5a8c1097301afc802e242c79bc8835c67 - https://git.kernel.org/stable/c/04e05112f10354ffc3bb6cc796d553bab161594c - https://git.kernel.org/stable/c/ed6ae1f325d3c43966ec1b62ac1459e2b8e45640
CVE ID: CVE-2025-21761 State: PUBLISHED Published: 2025-02-27T02:18:14.054Z Last Updated: 2025-11-03T19:37:08.745Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() ovs_vport_cmd_fill_info() can be called without RTNL or RCU. Use RCU protection and dev_net_rcu() to avoid potential UAF. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e85a25d1a9985645e796039e843d1de581d2de1e - https://git.kernel.org/stable/c/a8816b3f1f151373fd30f1996f00480126c8bb11 - https://git.kernel.org/stable/c/a884f57600e463f69d
://git.kernel.org/stable/c/a8816b3f1f151373fd30f1996f00480126c8bb11 - https://git.kernel.org/stable/c/a884f57600e463f69d7b279c4598b865260b62a1 - https://git.kernel.org/stable/c/7e01abc34e87abd091e619161a20f54ed4e3e2da - https://git.kernel.org/stable/c/8ec57509c36c8b9a23e50b7858dda0c520a2d074 - https://git.kernel.org/stable/c/a849a10de5e04d798f7f286a2f1ca174719a617a - https://git.kernel.org/stable/c/5828937742af74666192835d657095d95c53dbd0 - https://git.kernel.org/stable/c/90b2f49a502fa71090d9f4fe29a2f51fe5dff76d
CVE ID: CVE-2025-21762 State: PUBLISHED Published: 2025-02-27T02:18:14.600Z Last Updated: 2025-11-03T19:37:11.540Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: arp: use RCU protection in arp_xmit() arp_xmit() can be called without RTNL or RCU protection. Use RCU protection to avoid potential UAF. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/10f555e3f573d004ae9d89b3276abb58c4ede5c3 - https://git.kernel.org/stable/c/307cd1e2d3cb1cbc6c40c679cada6d7168b18431 - https://git.kernel.org/stable/c/d9366ac2f956a1948b68c0500f84a3462ff2ed8a - https://git.kernel.o
40c679cada6d7168b18431 - https://git.kernel.org/stable/c/d9366ac2f956a1948b68c0500f84a3462ff2ed8a - https://git.kernel.org/stable/c/f189654459423d4d48bef2d120b4bfba559e6039 - https://git.kernel.org/stable/c/e9f4dee534eb1b225b0a120395ad9bc2afe164d3 - https://git.kernel.org/stable/c/01d1b5c9abcaff29a43f1d17a19c33eec92c7dbe - https://git.kernel.org/stable/c/2c331718d3389b6c5f6855078ab7171849e016bd - https://git.kernel.org/stable/c/a42b69f692165ec39db42d595f4f65a4c8f42e44
CVE ID: CVE-2025-21763 State: PUBLISHED Published: 2025-02-27T02:18:15.078Z Last Updated: 2025-11-03T19:37:14.329Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: neighbour: use RCU protection in __neigh_notify() __neigh_notify() can be called without RTNL or RCU protection. Use RCU protection to avoid potential UAF. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e1aed6be381bcd7f46d4ca9d7ef0f5f3d6a1be32 - https://git.kernel.org/stable/c/8666e9aab801328c1408a19fbf4070609dc0695a - https://git.kernel.org/stable/c/40d8f2f2a373b6c294ffac394d2bb814b572ead1 - ht
8666e9aab801328c1408a19fbf4070609dc0695a - https://git.kernel.org/stable/c/40d8f2f2a373b6c294ffac394d2bb814b572ead1 - https://git.kernel.org/stable/c/784eb2376270e086f7db136d154b8404edacf97b - https://git.kernel.org/stable/c/1cbb2aa90cd3fba15ad7efb5cdda28f3d1082379 - https://git.kernel.org/stable/c/cdd5c2a12ddad8a77ce1838ff9f29aa587de82df - https://git.kernel.org/stable/c/559307d25235e24b5424778c7332451b6c741159 - https://git.kernel.org/stable/c/becbd5850c03ed33b232083dd66c6e38c0c0e569
CVE ID: CVE-2025-21764 State: PUBLISHED Published: 2025-02-27T02:18:15.598Z Last Updated: 2025-11-03T19:37:17.328Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ndisc: use RCU protection in ndisc_alloc_skb() ndisc_alloc_skb() can be called without RTNL or RCU being held. Add RCU protection to avoid possible UAF. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/96fc896d0e5b37c12808df797397fb16f3080879 - https://git.kernel.org/stable/c/c30893ef3d9cde8e7e8e4fd06b53d2c935bbccb1 - https://git.kernel.org/stable/c/b870256dd2a5648d5ed2f22316b3ac29a7e5ed63 - https
893ef3d9cde8e7e8e4fd06b53d2c935bbccb1 - https://git.kernel.org/stable/c/b870256dd2a5648d5ed2f22316b3ac29a7e5ed63 - https://git.kernel.org/stable/c/3c2d705f5adf5d860aaef90cb4211c0fde2ba66d - https://git.kernel.org/stable/c/9e0ec817eb41a55327a46cd3ce331a9868d60304 - https://git.kernel.org/stable/c/bbec88e4108e8d6fb468d3817fa652140a44ff28 - https://git.kernel.org/stable/c/cd1065f92eb7ff21b9ba5308a86f33d1670bf926 - https://git.kernel.org/stable/c/628e6d18930bbd21f2d4562228afe27694f66da9
CVE ID: CVE-2025-21765 State: PUBLISHED Published: 2025-02-27T02:18:16.078Z Last Updated: 2025-11-03T19:37:20.115Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU protection in ip6_default_advmss() ip6_default_advmss() needs rcu protection to make sure the net structure it reads does not disappear. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/78ad057472d8c76e0602402269222f9f9c698790 - https://git.kernel.org/stable/c/d02f30d220ef9511568a48dba8a9004c65f8d904 - https://git.kernel.org/stable/c/28de355b63ad42309ed5a03ee7c436c90512265b - https://git.kernel.org/stable/c/
4c65f8d904 - https://git.kernel.org/stable/c/28de355b63ad42309ed5a03ee7c436c90512265b - https://git.kernel.org/stable/c/84212387caadb211cd9dadd6fd5563bd37dc1f5e - https://git.kernel.org/stable/c/4176a68b0db8fc74ac14fcd00ba8231371051dc2 - https://git.kernel.org/stable/c/713a40c892f40300d63691d9f85b2a23b48fe1e8 - https://git.kernel.org/stable/c/550ed693f47370502a71b85382e7f9e6417300b8 - https://git.kernel.org/stable/c/3c8ffcd248da34fc41e52a46e51505900115fc2a