Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
itialized or incomplete element, resulting in data corruption. Invoke the buffer write before updating rd_offset to ensure the element is fully written before signaling its availability. References: - https://git.kernel.org/stable/c/44b9620e82bbec2b9a6ac77f63913636d84f96dc - https://git.kernel.org/stable/c/f704a80d9fa268e51a6cc5242714502c3c1fa605 - https://git.kernel.org/stable/c/0007ef098dab48f1ba58364c40b4809f1e21b130 - https://git.kernel.org/stable/c/6f18d174b73d0ceeaa341f46c0986436b3aefc9a
CVE ID: CVE-2025-38430 State: PUBLISHED Published: 2025-07-25T14:16:49.443Z Last Updated: 2025-11-03T17:37:59.266Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request If the request being processed is not a v4 compound request, then examining the cstate can have undefined results. This patch adds a check that the rpc procedure being executed (rq_procinfo) is the NFSPROC4_COMPOUND procedure. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/bf78a2706ce975981eb5167f2d3b609eb5d24c19 - https://git.kernel.org/stable/c/b1d0
ences: - https://git.kernel.org/stable/c/bf78a2706ce975981eb5167f2d3b609eb5d24c19 - https://git.kernel.org/stable/c/b1d0323a09a29f81572c7391e0d80d78724729c9 - https://git.kernel.org/stable/c/425efc6b3292a3c79bfee4a1661cf043dcd9cf2f - https://git.kernel.org/stable/c/64a723b0281ecaa59d31aad73ef8e408a84cb603 - https://git.kernel.org/stable/c/e7e943ddd1c6731812357a28e7954ade3a7d8517 - https://git.kernel.org/stable/c/7a75a956692aa64211a9e95781af1ec461642de4 - https://git.kernel.org/stable/c/2c54bd5a380ebf646fb9efbc4ae782ff3a83a5af - https://git.kernel.org/stable/c/1244f0b2c3cecd3f349a877006e67c9492b41807
CVE ID: CVE-2025-38431 State: PUBLISHED Published: 2025-07-25T14:22:34.363Z Last Updated: 2025-07-28T04:22:03.224Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix regression with native SMB symlinks Some users and customers reported that their backup/copy tools started to fail when the directory being copied contained symlink targets that the client couldn't parse - even when those symlinks weren't followed. Fix this by allowing lstat(2) and readlink(2) to succeed even when the client can't resolve the symlink target, restoring old behavior. References: - https://git.kernel.org/stable/c/6ddaf7567080c7de2e0c99efc
olve the symlink target, restoring old behavior. References: - https://git.kernel.org/stable/c/6ddaf7567080c7de2e0c99efca2ee1e6b79beea5 - https://git.kernel.org/stable/c/ff8abbd248c1f52df0c321690b88454b13ff54b2
CVE ID: CVE-2025-38432 State: PUBLISHED Published: 2025-07-25T14:24:13.766Z Last Updated: 2025-07-28T04:22:04.875Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: netpoll: Initialize UDP checksum field before checksumming commit f1fce08e63fe ("netpoll: Eliminate redundant assignment") removed the initialization of the UDP checksum, which was wrong and broke netpoll IPv6 transmission due to bad checksumming. udph->check needs to be set before calling csum_ipv6_magic(). References: - https://git.kernel.org/stable/c/353016ec159f939a380ff6746476a779367ba9a3 - https://git.kernel.org/stable/c/f5990207026987a353d5a95204c4d9cb72563
table/c/353016ec159f939a380ff6746476a779367ba9a3 - https://git.kernel.org/stable/c/f5990207026987a353d5a95204c4d9cb725637fd
CVE ID: CVE-2025-38433 State: PUBLISHED Published: 2025-07-25T14:32:07.122Z Last Updated: 2025-07-28T04:22:06.009Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: riscv: fix runtime constant support for nommu kernels the `__runtime_fixup_32` function does not handle the case where `val` is zero correctly (as might occur when patching a nommu kernel and referring to a physical address below the 4GiB boundary whose upper 32 bits are all zero) because nothing in the existing logic prevents the code from taking the `else` branch of both nop-checks and emitting two `nop` instructions. This leaves random garbage in the register that i
`else` branch of both nop-checks and emitting two `nop` instructions. This leaves random garbage in the register that is supposed to receive the upper 32 bits of the pointer instead of zero that when combined with the value for the lower 32 bits yields an invalid pointer and causes a kernel panic when that pointer is eventually accessed. The author clearly considered the fact that if the `lui` is converted into a `nop` that the second instruction needs to be adjusted to become an `li` instead of an `addi`, hence introducing the `addi_insn_mask` variable, but didn't follow that logic through fully to the case where the `else` branch executes. To fix it just adjust the logic to ensure that th
that logic through fully to the case where the `else` branch executes. To fix it just adjust the logic to ensure that the second `else` branch is not taken if the first instruction will be patched to a `nop`. References: - https://git.kernel.org/stable/c/0a24b00dcde83934a3cc13e4c6b775522903496b - https://git.kernel.org/stable/c/8d90d9872edae7e78c3a12b98e239bfaa66f3639
CVE ID: CVE-2025-38434 State: PUBLISHED Published: 2025-07-25T14:32:08.089Z Last Updated: 2025-07-28T04:22:07.336Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" This reverts commit ad5643cf2f69 ("riscv: Define TASK_SIZE_MAX for __access_ok()"). This commit changes TASK_SIZE_MAX to be LONG_MAX to optimize access_ok(), because the previous TASK_SIZE_MAX (default to TASK_SIZE) requires some computation. The reasoning was that all user addresses are less than LONG_MAX, and all kernel addresses are greater than LONG_MAX. Therefore access_ok() can filter kernel addresses. Addres
LONG_MAX, and all kernel addresses are greater than LONG_MAX. Therefore access_ok() can filter kernel addresses. Addresses between TASK_SIZE and LONG_MAX are not valid user addresses, but access_ok() let them pass. That was thought to be okay, because they are not valid addresses at hardware level. Unfortunately, one case is missed: get_user_pages_fast() happily accepts addresses between TASK_SIZE and LONG_MAX. futex(), for instance, uses get_user_pages_fast(). This causes the problem reported by Robert [1]. Therefore, revert this commit. TASK_SIZE_MAX is changed to the default: TASK_SIZE. This unfortunately reduces performance, because TASK_SIZE is more expensive to compute compared to LON
fault: TASK_SIZE. This unfortunately reduces performance, because TASK_SIZE is more expensive to compute compared to LONG_MAX. But correctness first, we can think about optimization later, if required. References: - https://git.kernel.org/stable/c/fe30c30bf3bb68d4a4d8c7c814769857b5c973e6 - https://git.kernel.org/stable/c/f8b1898748dfeb4f9b67b6a6d661f354b9de3523 - https://git.kernel.org/stable/c/890ba5be6335dbbbc99af14ea007befb5f83f174
CVE ID: CVE-2025-38435 State: PUBLISHED Published: 2025-07-25T14:32:09.136Z Last Updated: 2025-07-28T04:22:08.782Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: riscv: vector: Fix context save/restore with xtheadvector Previously only v0-v7 were correctly saved/restored, and the context of v8-v31 are damanged. Correctly save/restore v8-v31 to avoid breaking userspace. References: - https://git.kernel.org/stable/c/dd5ceea8d50e9e108a10d1e0d89fa2c9ff442ca2 - https://git.kernel.org/stable/c/4262bd0d9cc704ea1365ac00afc1272400c2cbef
CVE ID: CVE-2025-38436 State: PUBLISHED Published: 2025-07-25T14:32:09.945Z Last Updated: 2025-07-28T11:16:59.090Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/scheduler: signal scheduled fence when kill job When an entity from application B is killed, drm_sched_entity_kill() removes all jobs belonging to that entity through drm_sched_entity_kill_jobs_work(). If application A's job depends on a scheduled fence from application B's job, and that fence is not properly signaled during the killing process, application A's dependency cannot be cleared. This leads to application A hanging indefinitely while waiting for a depend
pplication A's dependency cannot be cleared. This leads to application A hanging indefinitely while waiting for a dependency that will never be resolved. Fix this issue by ensuring that scheduled fences are properly signaled when an entity is killed, allowing dependent applications to continue execution. References: - https://git.kernel.org/stable/c/c5734f9bab6f0d40577ad0633af4090a5fda2407 - https://git.kernel.org/stable/c/aefd0a935625165a6ca36d0258d2d053901555df - https://git.kernel.org/stable/c/aa382a8b6ed483e9812d0e63b6d1bdcba0186f29 - https://git.kernel.org/stable/c/471db2c2d4f80ee94225a1ef246e4f5011733e50
CVE ID: CVE-2025-38437 State: PUBLISHED Published: 2025-07-25T15:27:16.995Z Last Updated: 2025-11-03T17:38:00.632Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potential use-after-free in oplock/lease break ack If ksmbd_iov_pin_rsp return error, use-after-free can happen by accessing opinfo->state and opinfo_put and ksmbd_fd_put could called twice. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/e38ec88a2b42c494601b1213816d75f0b54d9bf0 - https://git.kernel.org/stable/c/97c355989928a5f60b228ef5266c1be67a46cdf9 - https://git.kernel.org/stable/c/815f1161d6dbc4c54ccf94b7
.kernel.org/stable/c/97c355989928a5f60b228ef5266c1be67a46cdf9 - https://git.kernel.org/stable/c/815f1161d6dbc4c54ccf94b7d3fdeab34b4d7477 - https://git.kernel.org/stable/c/8106adc21a2270c16abf69cd74ccd7c79c6e7acd - https://git.kernel.org/stable/c/50f930db22365738d9387c974416f38a06e8057e
CVE ID: CVE-2025-38438 State: PUBLISHED Published: 2025-07-25T15:27:17.917Z Last Updated: 2025-07-28T11:17:02.383Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. sof_pdata->tplg_filename can have address allocated by kstrdup() and can be overwritten. Memory leak was detected with kmemleak: unreferenced object 0xffff88812391ff60 (size 16): comm "kworker/4:1", pid 161, jiffies 4294802931 hex dump (first 16 bytes): 73 6f 66 2d 68 64 61 2d 67 65 6e 65 72 69 63 00 sof-hda-generic. backtrace (crc 4bf1675c): __kmalloc_node_track_caller_noprof+0x49c/0x6b0 kstrdup+0x46/0xc0 hda
69 63 00 sof-hda-generic. backtrace (crc 4bf1675c): __kmalloc_node_track_caller_noprof+0x49c/0x6b0 kstrdup+0x46/0xc0 hda_machine_select.cold+0x1de/0x12cf [snd_sof_intel_hda_generic] sof_init_environment+0x16f/0xb50 [snd_sof] sof_probe_continue+0x45/0x7c0 [snd_sof] sof_probe_work+0x1e/0x40 [snd_sof] process_one_work+0x894/0x14b0 worker_thread+0x5e5/0xfb0 kthread+0x39d/0x760 ret_from_fork+0x31/0x70 ret_from_fork_asm+0x1a/0x30 References: - https://git.kernel.org/stable/c/68397fda2caa90e99a7c0bcb2cf604e42ef3b91f - https://git.kernel.org/stable/c/58ecf51af12cb32b890858b52b2c34e80590c74a - https://git.kernel.org/stable/c/6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e
CVE ID: CVE-2025-38439 State: PUBLISHED Published: 2025-07-25T15:27:18.640Z Last Updated: 2025-11-03T17:38:02.718Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT When transmitting an XDP_REDIRECT packet, call dma_unmap_len_set() with the proper length instead of 0. This bug triggers this warning on a system with IOMMU enabled: WARNING: CPU: 36 PID: 0 at drivers/iommu/dma-iommu.c:842 __iommu_dma_unmap+0x159/0x170 RIP: 0010:__iommu_dma_unmap+0x159/0x170 Code: a8 00 00 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 c8 00 00 00 00 48 c7 45 a0 ff ff ff ff 4c 89 45 b8 4c 89 45 c0 e9 77 ff
a8 00 00 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 c8 00 00 00 00 48 c7 45 a0 ff ff ff ff 4c 89 45 b8 4c 89 45 c0 e9 77 ff ff ff <0f> 0b e9 60 ff ff ff e8 8b bf 6a 00 66 66 2e 0f 1f 84 00 00 00 00 RSP: 0018:ff22d31181150c88 EFLAGS: 00010206 RAX: 0000000000002000 RBX: 00000000e13a0000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ff22d31181150cf0 R08: ff22d31181150ca8 R09: 0000000000000000 R10: 0000000000000000 R11: ff22d311d36c9d80 R12: 0000000000001000 R13: ff13544d10645010 R14: ff22d31181150c90 R15: ff13544d0b2bac00 FS: 0000000000000000(0000) GS:ff13550908a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0
000000000(0000) GS:ff13550908a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005be909dacff8 CR3: 0008000173408003 CR4: 0000000000f71ef0 PKRU: 55555554 Call Trace: <IRQ> ? show_regs+0x6d/0x80 ? __warn+0x89/0x160 ? __iommu_dma_unmap+0x159/0x170 ? report_bug+0x17e/0x1b0 ? handle_bug+0x46/0x90 ? exc_invalid_op+0x18/0x80 ? asm_exc_invalid_op+0x1b/0x20 ? __iommu_dma_unmap+0x159/0x170 ? __iommu_dma_unmap+0xb3/0x170 iommu_dma_unmap_page+0x4f/0x100 dma_unmap_page_attrs+0x52/0x220 ? srso_alias_return_thunk+0x5/0xfbef5 ? xdp_return_frame+0x2e/0xd0 bnxt_tx_int_xdp+0xdf/0x440 [bnxt_en] __bnxt_poll_work_done+0x81/0x1e0 [bnxt_en] bnxt_poll+0xd3/0x1e0 [bnxt_en] Ad
e/0xd0 bnxt_tx_int_xdp+0xdf/0x440 [bnxt_en] __bnxt_poll_work_done+0x81/0x1e0 [bnxt_en] bnxt_poll+0xd3/0x1e0 [bnxt_en] Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/e260f4d49370c85a4701d43c6d16b8c39f8b605f - https://git.kernel.org/stable/c/16ae306602163fcb7ae83f2701b542e43c100cee - https://git.kernel.org/stable/c/8d672a1a6bfc81fef9151925c9c0481f4acf4bec - https://git.kernel.org/stable/c/f9eaf6d036075dc820520e1194692c0619b7297b - https://git.kernel.org/stable/c/5909679a82cd74cf0343d9e3ddf4b6931aa7e613 - https://git.kernel.org/stable/c/f154e41e1d9d15ab21300ba7bbf0ebb5cb3b9c2a - https://git.kernel.org/stable/c/50dad9909715094e7d9ca25e9e0412b8759
/stable/c/f154e41e1d9d15ab21300ba7bbf0ebb5cb3b9c2a - https://git.kernel.org/stable/c/50dad9909715094e7d9ca25e9e0412b875987519 - https://git.kernel.org/stable/c/3cdf199d4755d477972ee87110b2aebc88b3cfad
CVE ID: CVE-2025-38440 State: PUBLISHED Published: 2025-07-25T15:27:19.447Z Last Updated: 2025-07-28T04:22:15.952Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix race between DIM disable and net_dim() There's a race between disabling DIM and NAPI callbacks using the dim pointer on the RQ or SQ. If NAPI checks the DIM state bit and sees it still set, it assumes `rq->dim` or `sq->dim` is valid. But if DIM gets disabled right after that check, the pointer might already be set to NULL, leading to a NULL pointer dereference in net_dim(). Fix this by calling `synchronize_net()` before freeing the DIM context. This ensu
NULL pointer dereference in net_dim(). Fix this by calling `synchronize_net()` before freeing the DIM context. This ensures all in-progress NAPI callbacks are finished before the pointer is cleared. Kernel log: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... RIP: 0010:net_dim+0x23/0x190 ... Call Trace: <TASK> ? __die+0x20/0x60 ? page_fault_oops+0x150/0x3e0 ? common_interrupt+0xf/0xa0 ? sysvec_call_function_single+0xb/0x90 ? exc_page_fault+0x74/0x130 ? asm_exc_page_fault+0x22/0x30 ? net_dim+0x23/0x190 ? mlx5e_poll_ico_cq+0x41/0x6f0 [mlx5_core] ? sysvec_apic_timer_interrupt+0xb/0x90 mlx5e_handle_rx_dim+0x92/0xd0 [mlx5_core] mlx5e_napi_poll+0x2cd/0xac0 [mlx5_core] ? mlx5e_po
ic_timer_interrupt+0xb/0x90 mlx5e_handle_rx_dim+0x92/0xd0 [mlx5_core] mlx5e_napi_poll+0x2cd/0xac0 [mlx5_core] ? mlx5e_poll_ico_cq+0xe5/0x6f0 [mlx5_core] busy_poll_stop+0xa2/0x200 ? mlx5e_napi_poll+0x1d9/0xac0 [mlx5_core] ? mlx5e_trigger_irq+0x130/0x130 [mlx5_core] __napi_busy_loop+0x345/0x3b0 ? sysvec_call_function_single+0xb/0x90 ? asm_sysvec_call_function_single+0x16/0x20 ? sysvec_apic_timer_interrupt+0xb/0x90 ? pcpu_free_area+0x1e4/0x2e0 napi_busy_loop+0x11/0x20 xsk_recvmsg+0x10c/0x130 sock_recvmsg+0x44/0x70 __sys_recvfrom+0xbc/0x130 ? __schedule+0x398/0x890 __x64_sys_recvfrom+0x20/0x30 do_syscall_64+0x4c/0x100 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ... ---[ end trace 0000000000000000 ]
cvfrom+0x20/0x30 do_syscall_64+0x4c/0x100 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ... ---[ end trace 0000000000000000 ]--- ... ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- References: - https://git.kernel.org/stable/c/7581afc051542e11ccf3ade68acd01b7fb1a3cde - https://git.kernel.org/stable/c/2bc6fb90486e42dd80e660ef7a40c02b2516c6d6 - https://git.kernel.org/stable/c/eb41a264a3a576dc040ee37c3d9d6b7e2d9be968
CVE ID: CVE-2025-38441 State: PUBLISHED Published: 2025-07-25T15:27:20.276Z Last Updated: 2025-11-03T17:38:03.697Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() syzbot found a potential access to uninit-value in nf_flow_pppoe_proto() Blamed commit forgot the Ethernet header. BUG: KMSAN: uninit-value in nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27 nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27 nf_hook_entry_hookfn include/linux/netfilter.h:157 [inline] nf_hook_slow+0xe1/0x3d0 net/netfilter/core.
_table_inet.c:27 nf_hook_entry_hookfn include/linux/netfilter.h:157 [inline] nf_hook_slow+0xe1/0x3d0 net/netfilter/core.c:623 nf_hook_ingress include/linux/netfilter_netdev.h:34 [inline] nf_ingress net/core/dev.c:5742 [inline] __netif_receive_skb_core+0x4aff/0x70c0 net/core/dev.c:5837 __netif_receive_skb_one_core net/core/dev.c:5975 [inline] __netif_receive_skb+0xcc/0xac0 net/core/dev.c:6090 netif_receive_skb_internal net/core/dev.c:6176 [inline] netif_receive_skb+0x57/0x630 net/core/dev.c:6235 tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485 tun_get_user+0x4ee0/0x6b40 drivers/net/tun.c:1938 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1984 new_sync_write fs/read_write.c:593 [inline] vf
vers/net/tun.c:1938 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1984 new_sync_write fs/read_write.c:593 [inline] vfs_write+0xb4b/0x1580 fs/read_write.c:686 ksys_write fs/read_write.c:738 [inline] __do_sys_write fs/read_write.c:749 [inline] Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/a3aea97d55964e70a1e6426aa4cafdc036e8a2dd - https://git.kernel.org/stable/c/eed8960b289327235185b7c32649c3470a3e969b - https://git.kernel.org/stable/c/9fbc49429a23b02595ba82536c5ea425fdabb221 - https://git.kernel.org/stable/c/e0dd2e9729660f3f4fcb16e0aef87342911528ef - https://git.kernel.org/stable/c/cfbf0665969af2c69d10c377d4c3d306e717efb4 - https://git.ker
f3f4fcb16e0aef87342911528ef - https://git.kernel.org/stable/c/cfbf0665969af2c69d10c377d4c3d306e717efb4 - https://git.kernel.org/stable/c/18cdb3d982da8976b28d57691eb256ec5688fad2
CVE ID: CVE-2025-38442 State: PUBLISHED Published: 2025-07-25T15:27:26.009Z Last Updated: 2025-07-28T04:22:24.032Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: block: reject bs > ps block devices when THP is disabled If THP is disabled and when a block device with logical block size > page size is present, the following null ptr deref panic happens during boot: [ [13.2 mK AOSAN: null-ptr-deref in range [0x0000000000000000-0x0000000000K0 0 0[07] [ 13.017749] RIP: 0010:create_empty_buffers+0x3b/0x380 <snip> [ 13.025448] Call Trace: [ 13.025692] <TASK> [ 13.025895] block_read_full_folio+0x610/0x780 [ 13.026379] ? __pfx_blkdev_ge
13.025448] Call Trace: [ 13.025692] <TASK> [ 13.025895] block_read_full_folio+0x610/0x780 [ 13.026379] ? __pfx_blkdev_get_block+0x10/0x10 [ 13.027008] ? __folio_batch_add_and_move+0x1fa/0x2b0 [ 13.027548] ? __pfx_blkdev_read_folio+0x10/0x10 [ 13.028080] filemap_read_folio+0x9b/0x200 [ 13.028526] ? __pfx_filemap_read_folio+0x10/0x10 [ 13.029030] ? __filemap_get_folio+0x43/0x620 [ 13.029497] do_read_cache_folio+0x155/0x3b0 [ 13.029962] ? __pfx_blkdev_read_folio+0x10/0x10 [ 13.030381] read_part_sector+0xb7/0x2a0 [ 13.030805] read_lba+0x174/0x2c0 <snip> [ 13.045348] nvme_scan_ns+0x684/0x850 [nvme_core] [ 13.045858] ? __pfx_nvme_scan_ns+0x10/0x10 [nvme_core] [ 13.046414] ? _raw_spin_unlock+0x15/0
s+0x684/0x850 [nvme_core] [ 13.045858] ? __pfx_nvme_scan_ns+0x10/0x10 [nvme_core] [ 13.046414] ? _raw_spin_unlock+0x15/0x40 [ 13.046843] ? __switch_to+0x523/0x10a0 [ 13.047253] ? kvm_clock_get_cycles+0x14/0x30 [ 13.047742] ? __pfx_nvme_scan_ns_async+0x10/0x10 [nvme_core] [ 13.048353] async_run_entry_fn+0x96/0x4f0 [ 13.048787] process_one_work+0x667/0x10a0 [ 13.049219] worker_thread+0x63c/0xf60 As large folio support depends on THP, only allow bs > ps block devices if THP is enabled. References: - https://git.kernel.org/stable/c/b025d81b96bfe8a62b6e3e6ac776608206ccbf6d - https://git.kernel.org/stable/c/4cdf1bdd45ac78a088773722f009883af30ad318
CVE ID: CVE-2025-38443 State: PUBLISHED Published: 2025-07-25T15:27:26.671Z Last Updated: 2025-11-03T17:38:04.726Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nbd: fix uaf in nbd_genl_connect() error path There is a use-after-free issue in nbd: block nbd6: Receive control failed (result -104) block nbd6: shutting down sockets ================================================================== BUG: KASAN: slab-use-after-free in recv_work+0x694/0xa80 drivers/block/nbd.c:1022 Write of size 4 at addr ffff8880295de478 by task kworker/u33:0/67 CPU: 2 UID: 0 PID: 67 Comm: kworker/u33:0 Not tainted 6.15.0-rc5-syzkaller-00123-g2c89c1b
de478 by task kworker/u33:0/67 CPU: 2 UID: 0 PID: 67 Comm: kworker/u33:0 Not tainted 6.15.0-rc5-syzkaller-00123-g2c89c1b655c0 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: nbd6-recv recv_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:96 [inl
e] kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline] recv_work+0x694/0xa80 drivers/block/nbd.c:1022 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c2/0x780 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> nbd_genl_connect() does not properly stop the device on certain error paths after nbd_start_device() has been called. This causes the error
does not properly stop the device on certain error paths after nbd_start_device() has been called. This causes the error path to put nbd->config while recv_work continue to use the config after putting it, leading to use-after-free in recv_work. This patch moves nbd_start_device() after the backend file creation. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/cb121c47f364b51776c4db904a6a5a90ab0a7ec5 - https://git.kernel.org/stable/c/91fa560c73a8126868848ed6cd70607cbf8d87e2 - https://git.kernel.org/stable/c/d46186eb7bbd9a11c145120f2d77effa8d4d44c2 - https://git.kernel.org/stable/c/8586552df591e0a367eff44af0c586213eeecc3f - https://git.kernel.o
45120f2d77effa8d4d44c2 - https://git.kernel.org/stable/c/8586552df591e0a367eff44af0c586213eeecc3f - https://git.kernel.org/stable/c/002aca89753f666d878ca0eb8584c372684ac4ba - https://git.kernel.org/stable/c/aa9552438ebf015fc5f9f890dbfe39f0c53cf37e