Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rcuwait_wait_event() in T3 does not block because refcount was already dropped by T1. At this point T3 can exit and free the mm causing UAF in T1. To avoid this we move vma->vm_mm verification into vma_start_read() and grab vma->vm_mm to stabilize it before vma_refcount_put() operation. [surenb@google.com: v3] References: - https://git.kernel.org/stable/c/6e88fe54721dee17d3496bc998f0c7d243896348 - https://git.kernel.org/stable/c/1bcd236a2536a451e385f8d6d2bb589689ec812f - https://git.kernel.org/stable/c/9bbffee67ffd16360179327b57f3b1245579ef08
CVE ID: CVE-2025-38555 State: PUBLISHED Published: 2025-08-19T17:02:34.110Z Last Updated: 2025-11-03T17:39:48.711Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: gadget : fix use-after-free in composite_dev_cleanup() 1. In func configfs_composite_bind() -> composite_os_desc_req_prepare(): if kmalloc fails, the pointer cdev->os_desc_req will be freed but not set to NULL. Then it will return a failure to the upper-level function. 2. in func configfs_composite_bind() -> composite_dev_cleanup(): it will checks whether cdev->os_desc_req is NULL. If it is not NULL, it will attempt to use it.This will lead to a use-after-free iss
s whether cdev->os_desc_req is NULL. If it is not NULL, it will attempt to use it.This will lead to a use-after-free issue. BUG: KASAN: use-after-free in composite_dev_cleanup+0xf4/0x2c0 Read of size 8 at addr 0000004827837a00 by task init/1 CPU: 10 PID: 1 Comm: init Tainted: G O 5.10.97-oh #1 kasan_report+0x188/0x1cc __asan_load8+0xb4/0xbc composite_dev_cleanup+0xf4/0x2c0 configfs_composite_bind+0x210/0x7ac udc_bind_to_driver+0xb4/0x1ec usb_gadget_probe_driver+0xec/0x21c gadget_dev_desc_UDC_store+0x264/0x27c Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/dba96dfa5a0f685b959dd28a52ac8dab0b805204 - https://git.kernel.org/stable/c/2db29235e900a
https://git.kernel.org/stable/c/dba96dfa5a0f685b959dd28a52ac8dab0b805204 - https://git.kernel.org/stable/c/2db29235e900a084a656dea7e0939b0abb7bb897 - https://git.kernel.org/stable/c/8afb22aa063f706f3343707cdfb8cda4d021dd33 - https://git.kernel.org/stable/c/e624bf26127645a2f7821e73fdf6dc64bad07835 - https://git.kernel.org/stable/c/aada327a9f8028c573636fa60c0abc80fb8135c9 - https://git.kernel.org/stable/c/5f06ee9f9a3665d43133f125c17e5258a13f3963 - https://git.kernel.org/stable/c/bd3c4ef60baf7f65c963f3e12d9d7b2b091e20ba - https://git.kernel.org/stable/c/e1be1f380c82a69f80c68c96a7cfe8759fb30355 - https://git.kernel.org/stable/c/151c0aa896c47a4459e07fee7d4843f44c1bb18e
CVE ID: CVE-2025-38556 State: PUBLISHED Published: 2025-08-19T17:02:34.929Z Last Updated: 2025-09-29T05:53:43.421Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: HID: core: Harden s32ton() against conversion to 0 bits Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity to a 0-bit quantity. Ideally this should never occur, but there are buggy devices and some might have a report field with size set to zero; we shouldn't reject the report or the device just because of that. Instead, harden the s32ton() routine so that it returns a reasonable result
report or the device just because of that. Instead, harden the s32ton() routine so that it returns a reasonable result instead of crashing when it is called with the number of bits set to 0 -- the same as what snto32() does. References: - https://git.kernel.org/stable/c/d3b504146c111548ab60b6ef7aad00bfb1db05a2 - https://git.kernel.org/stable/c/8b4a94b1510f6a46ec48494b52ee8f67eb4fc836 - https://git.kernel.org/stable/c/865ad8469fa24de1559f247d9426ab01e5ce3a56 - https://git.kernel.org/stable/c/a6b87bfc2ab5bccb7ad953693c85d9062aef3fdd
CVE ID: CVE-2025-38557 State: PUBLISHED Published: 2025-08-19T17:02:35.641Z Last Updated: 2025-09-29T05:53:44.556Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: HID: apple: validate feature-report field count to prevent NULL pointer dereference A malicious HID device with quirk APPLE_MAGIC_BACKLIGHT can trigger a NULL pointer dereference whilst the power feature-report is toggled and sent to the device in apple_magic_backlight_report_set(). The power feature-report is expected to have two data fields, but if the descriptor declares one field then accessing field[1] and dereferencing it in apple_magic_backlight_report_set() bec
the descriptor declares one field then accessing field[1] and dereferencing it in apple_magic_backlight_report_set() becomes invalid since field[1] will be NULL. An example of a minimal descriptor which can cause the crash is something like the following where the report with ID 3 (power report) only references a single 1-byte field. When hid core parses the descriptor it will encounter the final feature tag, allocate a hid_report (all members of field[] will be zeroed out), create field structure and populate it, increasing the maxfield to 1. The subsequent field[1] access and dereference causes the crash. Usage Page (Vendor Defined 0xFF00) Usage (0x0F) Collection (Application) Report ID (1
and dereference causes the crash. Usage Page (Vendor Defined 0xFF00) Usage (0x0F) Collection (Application) Report ID (1) Usage (0x01) Logical Minimum (0) Logical Maximum (255) Report Size (8) Report Count (1) Feature (Data,Var,Abs) Usage (0x02) Logical Maximum (32767) Report Size (16) Report Count (1) Feature (Data,Var,Abs) Report ID (3) Usage (0x03) Logical Minimum (0) Logical Maximum (1) Report Size (8) Report Count (1) Feature (Data,Var,Abs) End Collection Here we see the KASAN splat when the kernel dereferences the NULL pointer and crashes: [ 15.164723] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN NOPTI [ 15.165691] KASAN: nu
rotection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN NOPTI [ 15.165691] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [ 15.165691] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0 #31 PREEMPT(voluntary) [ 15.165691] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 15.165691] RIP: 0010:apple_magic_backlight_report_set+0xbf/0x210 [ 15.165691] Call Trace: [ 15.165691] <TASK> [ 15.165691] apple_probe+0x571/0xa20 [ 15.165691] hid_device_probe+0x2e2/0x6f0 [ 15.165691] really_probe+0x1ca/0x5c0 [ 15.165691] __driver_probe_device+0x24f/0x310 [ 15.165691] driver_probe_device+0x4a/0x
165691] really_probe+0x1ca/0x5c0 [ 15.165691] __driver_probe_device+0x24f/0x310 [ 15.165691] driver_probe_device+0x4a/0xd0 [ 15.165691] __device_attach_driver+0x169/0x220 [ 15.165691] bus_for_each_drv+0x118/0x1b0 [ 15.165691] __device_attach+0x1d5/0x380 [ 15.165691] device_initial_probe+0x12/0x20 [ 15.165691] bus_probe_device+0x13d/0x180 [ 15.165691] device_add+0xd87/0x1510 [...] To fix this issue we should validate the number of fields that the backlight and power reports have and if they do not have the required number of fields then bail. References: - https://git.kernel.org/stable/c/ba08cc6801ec5fb98f2d02b5f0c614c931845325 - https://git.kernel.org/stable/c/7e15d1eaa88179c5185e57a38ab05fe
.org/stable/c/ba08cc6801ec5fb98f2d02b5f0c614c931845325 - https://git.kernel.org/stable/c/7e15d1eaa88179c5185e57a38ab05fe852d0cb8d - https://git.kernel.org/stable/c/00896c3f41cb6b74fec853386076115ba50baf0a - https://git.kernel.org/stable/c/1bb3363da862e0464ec050eea2fb5472a36ad86b
CVE ID: CVE-2025-38558 State: PUBLISHED Published: 2025-08-19T17:02:36.355Z Last Updated: 2025-09-29T05:53:45.730Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Initialize frame-based format color matching descriptor Fix NULL pointer crash in uvcg_framebased_make due to uninitialized color matching descriptor for frame-based format which was added in commit f5e7bdd34aca ("usb: gadget: uvc: Allow creating new color matching descriptors") that added handling for uncompressed and mjpeg format. Crash is seen when userspace configuration (via configfs) does not explicitly define the color matching descriptor. If c
Crash is seen when userspace configuration (via configfs) does not explicitly define the color matching descriptor. If color_matching is not found, config_group_find_item() returns NULL. The code then jumps to out_put_cm, where it calls config_item_put(color_matching);. If color_matching is NULL, this will dereference a null pointer, leading to a crash. [ 2.746440] Unable to handle kernel NULL pointer dereference at virtual address 000000000000008c [ 2.756273] Mem abort info: [ 2.760080] ESR = 0x0000000096000005 [ 2.764872] EC = 0x25: DABT (current EL), IL = 32 bits [ 2.771068] SET = 0, FnV = 0 [ 2.771069] EA = 0, S1PTW = 0 [ 2.771070] FSC = 0x05: level 1 translation fault [ 2.771071] Data a
068] SET = 0, FnV = 0 [ 2.771069] EA = 0, S1PTW = 0 [ 2.771070] FSC = 0x05: level 1 translation fault [ 2.771071] Data abort info: [ 2.771072] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 2.771073] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 2.771074] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 2.771075] user pgtable: 4k pages, 39-bit VAs, pgdp=00000000a3e59000 [ 2.771077] [000000000000008c] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 2.771081] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [ 2.771084] Dumping ftrace buffer: [ 2.771085] (ftrace buffer empty) [ 2.771138] CPU: 7 PID: 486 Comm: ln Tainted: G W E 6.6.58-android15 [ 2.771139] Hardware name: Qualco
ace buffer empty) [ 2.771138] CPU: 7 PID: 486 Comm: ln Tainted: G W E 6.6.58-android15 [ 2.771139] Hardware name: Qualcomm Technologies, Inc. SunP QRD HDK (DT) [ 2.771140] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 2.771141] pc : __uvcg_fill_strm+0x198/0x2cc [ 2.771145] lr : __uvcg_iter_strm_cls+0xc8/0x17c [ 2.771146] sp : ffffffc08140bbb0 [ 2.771146] x29: ffffffc08140bbb0 x28: ffffff803bc81380 x27: ffffff8023bbd250 [ 2.771147] x26: ffffff8023bbd250 x25: ffffff803c361348 x24: ffffff803d8e6768 [ 2.771148] x23: 0000000000000004 x22: 0000000000000003 x21: ffffffc08140bc48 [ 2.771149] x20: 0000000000000000 x19: ffffffc08140bc48 x18: ffffffe9f8cf4a00 [ 2.771150] x17: 000000
: ffffffc08140bc48 [ 2.771149] x20: 0000000000000000 x19: ffffffc08140bc48 x18: ffffffe9f8cf4a00 [ 2.771150] x17: 000000001bf64ec3 x16: 000000001bf64ec3 x15: ffffff8023bbd250 [ 2.771151] x14: 000000000000000f x13: 004c4b40000f4240 x12: 000a2c2a00051615 [ 2.771152] x11: 000000000000004f x10: ffffffe9f76b40ec x9 : ffffffe9f7e389d0 [ 2.771153] x8 : ffffff803d0d31ce x7 : 000f4240000a2c2a x6 : 0005161500028b0a [ 2.771154] x5 : ffffff803d0d31ce x4 : 0000000000000003 x3 : 0000000000000000 [ 2.771155] x2 : ffffffc08140bc50 x1 : ffffffc08140bc48 x0 : 0000000000000000 [ 2.771156] Call trace: [ 2.771157] __uvcg_fill_strm+0x198/0x2cc [ 2.771157] __uvcg_iter_strm_cls+0xc8/0x17c [ 2.771158] uvcg_streaming
l trace: [ 2.771157] __uvcg_fill_strm+0x198/0x2cc [ 2.771157] __uvcg_iter_strm_cls+0xc8/0x17c [ 2.771158] uvcg_streaming_class_allow_link+0x240/0x290 [ 2.771159] configfs_symlink+0x1f8/0x630 [ 2.771161] vfs_symlink+0x114/0x1a0 [ 2.771163] do_symlinkat+0x94/0x28c [ 2.771164] __arm64_sys_symlinkat+0x54/0x70 [ 2.771164] invoke_syscall+0x58/0x114 [ 2.771166] el0_svc_common+0x80/0xe0 [ 2.771168] do_el0_svc+0x1c/0x28 [ 2.771169] el0_svc+0x3c/0x70 [ 2.771172] el0t_64_sync_handler+0x68/0xbc [ 2.771173] el0t_64_sync+0x1a8/0x1ac Initialize color matching descriptor for frame-based format to prevent NULL pointer crash by mirroring the handling done for uncompressed and mjpeg formats. References: - http
rmat to prevent NULL pointer crash by mirroring the handling done for uncompressed and mjpeg formats. References: - https://git.kernel.org/stable/c/6db61c1aa23075eeee90e083ca3f6567a5635da6 - https://git.kernel.org/stable/c/7f8576fc9d1a203d12474bf52710c7af68cae490 - https://git.kernel.org/stable/c/323a80a1a5ace319a722909c006d5bdb2a35d273
CVE ID: CVE-2025-38559 State: PUBLISHED Published: 2025-08-19T17:02:37.020Z Last Updated: 2025-09-29T05:53:46.873Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/pmt: fix a crashlog NULL pointer access Usage of the intel_pmt_read() for binary sysfs, requires a pcidev. The current use of the endpoint value is only valid for telemetry endpoint usage. Without the ep, the crashlog usage causes the following NULL pointer exception: BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:intel_pmt_read+0x3b/0x70 [pmt_class] Code: Call Trace: <TASK> ? sysfs_kf_bin_re
ops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:intel_pmt_read+0x3b/0x70 [pmt_class] Code: Call Trace: <TASK> ? sysfs_kf_bin_read+0xc0/0xe0 kernfs_fop_read_iter+0xac/0x1a0 vfs_read+0x26d/0x350 ksys_read+0x6b/0xe0 __x64_sys_read+0x1d/0x30 x64_sys_call+0x1bc8/0x1d70 do_syscall_64+0x6d/0x110 Augment struct intel_pmt_entry with a pointer to the pcidev to avoid the NULL pointer exception. References: - https://git.kernel.org/stable/c/860d93bd6a21f08883711196344c353bc3936a2b - https://git.kernel.org/stable/c/18d53b543b5447478e259c96ca4688393f327c98 - https://git.kernel.org/stable/c/089d05266b2caf020ac2ae2cd2be78f580268f5d - https://git.kernel.org/stable/c/54d5cd4719c5e87f33d271c9ac2e393147d934f8
CVE ID: CVE-2025-38560 State: PUBLISHED Published: 2025-08-19T17:02:37.792Z Last Updated: 2025-11-03T17:39:49.648Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: x86/sev: Evict cache lines during SNP memory validation An SNP cache coherency vulnerability requires a cache line eviction mitigation when validating memory after a page state change to private. The specific mitigation is to touch the first and last byte of each 4K page that is being validated. There is no need to perform the mitigation when performing a page state change to shared and rescinding validation. CPUID bit Fn8000001F_EBX[31] defines the COHERENCY_SFW_NO CP
ng a page state change to shared and rescinding validation. CPUID bit Fn8000001F_EBX[31] defines the COHERENCY_SFW_NO CPUID bit that, when set, indicates that the software mitigation for this vulnerability is not needed. Implement the mitigation and invoke it when validating memory (making it private) and the COHERENCY_SFW_NO bit is not set, indicating the SNP guest is vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/1fec416c03d0a64cc21aa04ce4aa14254b017e6a - https://git.kernel.org/stable/c/1fb873971e23c35c53823c62809a474a92bc3022 - https://git.kernel.org/stable/c/aed15fc08f15dbb15822b2a0b653f67e76aa0fdf - https://git.kernel.org/sta
809a474a92bc3022 - https://git.kernel.org/stable/c/aed15fc08f15dbb15822b2a0b653f67e76aa0fdf - https://git.kernel.org/stable/c/a762a4c8d9e768b538b3cc60615361a8cf377de8 - https://git.kernel.org/stable/c/f92af52e6dbd8d066d77beba451e0230482dc45b - https://git.kernel.org/stable/c/7b306dfa326f70114312b320d083b21fa9481e1e
CVE ID: CVE-2025-38561 State: PUBLISHED Published: 2025-08-19T17:02:38.719Z Last Updated: 2025-11-03T17:39:50.588Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix Preauh_HashValue race condition If client send multiple session setup requests to ksmbd, Preauh_HashValue race condition could happen. There is no need to free sess->Preauh_HashValue at session setup phase. It can be freed together with session at connection termination phase. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/fbf5c0845ed15122a770bca9be1d9b60b470d3aa - https://git.kernel.
Container: References: - https://git.kernel.org/stable/c/fbf5c0845ed15122a770bca9be1d9b60b470d3aa - https://git.kernel.org/stable/c/b69fd87076daa66f3d186bd421a7b0ee0cb45829 - https://git.kernel.org/stable/c/edeecc7871e8fc0878d53ce286c75040a0e38f6c - https://git.kernel.org/stable/c/7d7c0c5304c88bcbd7a85e9bcd61d27e998ba5fc - https://git.kernel.org/stable/c/6613887da1d18dd2ecfd6c6148a873c4d903ebdc - https://git.kernel.org/stable/c/44a3059c4c8cc635a1fb2afd692d0730ca1ba4b6 - https://www.zerodayinitiative.com/advisories/ZDI-25-916/
CVE ID: CVE-2025-38562 State: PUBLISHED Published: 2025-08-19T17:02:39.450Z Last Updated: 2025-11-03T17:39:51.533Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference error in generate_encryptionkey If client send two session setups with krb5 authenticate to ksmbd, null pointer dereference error in generate_encryptionkey could happen. sess->Preauth_HashValue is set to NULL if session is valid. So this patch skip generate encryption key if session is valid. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/96a82e19434a2522525baab59c33332658bc7653 - htt
s: - CVE Program Container: References: - https://git.kernel.org/stable/c/96a82e19434a2522525baab59c33332658bc7653 - https://git.kernel.org/stable/c/d79c8bebaa622ee223128be7c66d8aaeeb634a57 - https://git.kernel.org/stable/c/2a30ed6428ce83afedca1a6c5c5c4247bcf12d0e - https://git.kernel.org/stable/c/015ef163d65496ae3ba6192c96140a22743f0353 - https://git.kernel.org/stable/c/9c2dbbc959e1fcc6f603a1a843e9cf743ba383bb - https://git.kernel.org/stable/c/9b493ab6f35178afd8d619800df9071992f715de - https://www.zerodayinitiative.com/advisories/ZDI-25-917/
CVE ID: CVE-2025-38563 State: PUBLISHED Published: 2025-08-19T17:02:40.249Z Last Updated: 2025-11-03T17:39:53.460Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: perf/core: Prevent VMA split of buffer mappings The perf mmap code is careful about mmap()'ing the user page with the ringbuffer and additionally the auxiliary buffer, when the event supports it. Once the first mapping is established, subsequent mapping have to use the same offset and the same size in both cases. The reference counting for the ringbuffer and the auxiliary buffer depends on this being correct. Though perf does not prevent that a related mapping is split
fer and the auxiliary buffer depends on this being correct. Though perf does not prevent that a related mapping is split via mmap(2), munmap(2) or mremap(2). A split of a VMA results in perf_mmap_open() calls, which take reference counts, but then the subsequent perf_mmap_close() calls are not longer fulfilling the offset and size checks. This leads to reference count leaks. As perf already has the requirement for subsequent mappings to match the initial mapping, the obvious consequence is that VMA splits, caused by resizing of a mapping or partial unmapping, have to be prevented. Implement the vm_operations_struct::may_split() callback and return unconditionally -EINVAL. That ensures that t
vented. Implement the vm_operations_struct::may_split() callback and return unconditionally -EINVAL. That ensures that the mapping offsets and sizes cannot be changed after the fact. Remapping to a different fixed address with the same size is still possible as it takes the references for the new mapping and drops those of the old mapping. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/e4346ffec2c44d6b0be834d59b20632b5bb5729e - https://git.kernel.org/stable/c/d52451a9210f2e5a079ba052918c93563518a9ff - https://git.kernel.org/stable/c/3bd518cc7ea61076bcd725e36ff0e690754977c0 - https://git.kernel.org/stable/c/7b84cb58d1f0aa07656802eae24689566e5f
stable/c/3bd518cc7ea61076bcd725e36ff0e690754977c0 - https://git.kernel.org/stable/c/7b84cb58d1f0aa07656802eae24689566e5f5b1b - https://git.kernel.org/stable/c/6757a31a8e295ae4f01717a954afda173f25a121 - https://git.kernel.org/stable/c/e529888b7e8092912dd8789bdfc76685ccd2ff5f - https://git.kernel.org/stable/c/ff668930871e0198c7f4e325058b8b7c286787bd - https://git.kernel.org/stable/c/65311aad4c808bedad0c05d9bb8b06c47dae73eb - https://git.kernel.org/stable/c/b024d7b56c77191cde544f838debb7f8451cd0d6 - https://www.zerodayinitiative.com/advisories/ZDI-25-873/
CVE ID: CVE-2025-38564 State: PUBLISHED Published: 2025-08-19T17:02:40.942Z Last Updated: 2025-09-29T05:53:52.640Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: perf/core: Handle buffer mapping fail correctly in perf_mmap() After successful allocation of a buffer or a successful attachment to an existing buffer perf_mmap() tries to map the buffer read only into the page table. If that fails, the already set up page table entries are zapped, but the other perf specific side effects of that failure are not handled. The calling code just cleans up the VMA and does not invoke perf_mmap_close(). This leaks reference counts, corrupt
led. The calling code just cleans up the VMA and does not invoke perf_mmap_close(). This leaks reference counts, corrupts user->vm accounting and also results in an unbalanced invocation of event::event_mapped(). Cure this by moving the event::event_mapped() invocation before the map_range() call so that on map_range() failure perf_mmap_close() can be invoked without causing an unbalanced event::event_unmapped() call. perf_mmap_close() undoes the reference counts and eventually frees buffers. References: - https://git.kernel.org/stable/c/831e1c90a5d72e6977a57c44f47c46b73a438695 - https://git.kernel.org/stable/c/a9025f73c88d9d6e125743a43afc569da3ce5328 - https://git.kernel.org/stable/c/f74b9f
8695 - https://git.kernel.org/stable/c/a9025f73c88d9d6e125743a43afc569da3ce5328 - https://git.kernel.org/stable/c/f74b9f4ba63ffdf597aaaa6cad7e284cb8e04820
CVE ID: CVE-2025-38565 State: PUBLISHED Published: 2025-08-19T17:02:41.700Z Last Updated: 2025-11-03T17:39:55.357Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: perf/core: Exit early on perf_mmap() fail When perf_mmap() fails to allocate a buffer, it still invokes the event_mapped() callback of the related event. On X86 this might increase the perf_rdpmc_allowed reference counter. But nothing undoes this as perf_mmap_close() is never called in this case, which causes another reference count leak. Return early on failure to prevent that. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/sta
on failure to prevent that. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/5ffda7f3ed76ec8defc19d985e33b3b82ba07839 - https://git.kernel.org/stable/c/9b90a48c7de828a15c7a4fc565d46999c6e22d6b - https://git.kernel.org/stable/c/de85e72598d89880a02170a1cbc27b35a7d978a9 - https://git.kernel.org/stable/c/27d44145bd576bbef9bf6165bcd78128ec3e6cbd - https://git.kernel.org/stable/c/f41e9eba77bf97626e04296dc5677d02816d2432 - https://git.kernel.org/stable/c/92043120a2e992800580855498ab8507e1b22db9 - https://git.kernel.org/stable/c/163b0d1a209fe0df5476c1df2330ca12b55abf92 - https://git.kernel.org/stable/c/7ff8521f30c4c2fcd4e88bd7640486602bf8a650 - https:
0d1a209fe0df5476c1df2330ca12b55abf92 - https://git.kernel.org/stable/c/7ff8521f30c4c2fcd4e88bd7640486602bf8a650 - https://git.kernel.org/stable/c/07091aade394f690e7b655578140ef84d0e8d7b0
CVE ID: CVE-2025-38566 State: PUBLISHED Published: 2025-08-19T17:02:42.506Z Last Updated: 2025-09-29T05:53:54.931Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix handling of server side tls alerts Scott Mayhew discovered a security exploit in NFS over TLS in tls_alert_recv() due to its assumption it can read data from the msg iterator's kvec.. kTLS implementation splits TLS non-data record payload between the control message buffer (which includes the type such as TLS aler or TLS cipher change) and the rest of the payload (say TLS alert's level/description) which goes into the msg payload buffer. This patch proposes