Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-38525 State: PUBLISHED Published: 2025-08-16T11:12:19.191Z Last Updated: 2025-08-16T11:12:19.191Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix irq-disabled in local_bh_enable() The rxrpc_assess_MTU_size() function calls down into the IP layer to find out the MTU size for a route. When accepting an incoming call, this is called from rxrpc_new_incoming_call() which holds interrupts disabled across the code that calls down to it. Unfortunately, the IP layer uses local_bh_enable() which, config dependent, throws a warning if IRQs are enabled: WARNING: CPU: 1 PID: 5544 at kernel/softirq.c:387 __local_bh
ch, config dependent, throws a warning if IRQs are enabled: WARNING: CPU: 1 PID: 5544 at kernel/softirq.c:387 __local_bh_enable_ip+0x43/0xd0 ... RIP: 0010:__local_bh_enable_ip+0x43/0xd0 ... Call Trace: <TASK> rt_cache_route+0x7e/0xa0 rt_set_nexthop.isra.0+0x3b3/0x3f0 __mkroute_output+0x43a/0x460 ip_route_output_key_hash+0xf7/0x140 ip_route_output_flow+0x1b/0x90 rxrpc_assess_MTU_size.isra.0+0x2a0/0x590 rxrpc_new_incoming_peer+0x46/0x120 rxrpc_alloc_incoming_call+0x1b1/0x400 rxrpc_new_incoming_call+0x1da/0x5e0 rxrpc_input_packet+0x827/0x900 rxrpc_io_thread+0x403/0xb60 kthread+0x2f7/0x310 ret_from_fork+0x2a/0x230 ret_from_fork_asm+0x1a/0x30 ... hardirqs last enabled at (23): _raw_spin_unlock_ir
+0x2f7/0x310 ret_from_fork+0x2a/0x230 ret_from_fork_asm+0x1a/0x30 ... hardirqs last enabled at (23): _raw_spin_unlock_irq+0x24/0x50 hardirqs last disabled at (24): _raw_read_lock_irq+0x17/0x70 softirqs last enabled at (0): copy_process+0xc61/0x2730 softirqs last disabled at (25): rt_add_uncached_list+0x3c/0x90 Fix this by moving the call to rxrpc_assess_MTU_size() out of rxrpc_init_peer() and further up the stack where it can be done without interrupts disabled. It shouldn't be a problem for rxrpc_new_incoming_call() to do it after the locks are dropped as pmtud is going to be performed by the I/O thread - and we're in the I/O thread at this point. References: - https://git.kernel.org/stable
be performed by the I/O thread - and we're in the I/O thread at this point. References: - https://git.kernel.org/stable/c/2029f21f10dedb88c0f86abffcf8d6c21dcf6040 - https://git.kernel.org/stable/c/e4d2878369d590bf8455e3678a644e503172eafa
CVE ID: CVE-2025-38526 State: PUBLISHED Published: 2025-08-16T11:12:20.036Z Last Updated: 2025-08-16T11:12:20.036Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ice: add NULL check in eswitch lag check The function ice_lag_is_switchdev_running() is being called from outside of the LAG event handler code. This results in the lag->upper_netdev being NULL sometimes. To avoid a NULL-pointer dereference, there needs to be a check before it is dereferenced. References: - https://git.kernel.org/stable/c/27591d926191e42b2332e4bad3bcd3a49def393b - https://git.kernel.org/stable/c/5a5d64f0eec82076b2c09fee2195d640cfbe3379 - https://git.ke
e42b2332e4bad3bcd3a49def393b - https://git.kernel.org/stable/c/5a5d64f0eec82076b2c09fee2195d640cfbe3379 - https://git.kernel.org/stable/c/245917d3c5ed7c6ae720302b64eac5c6f0c85177 - https://git.kernel.org/stable/c/3ce58b01ada408b372f15b7c992ed0519840e3cf
CVE ID: CVE-2025-38527 State: PUBLISHED Published: 2025-08-16T11:12:20.843Z Last Updated: 2025-11-03T17:39:23.898Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifs_oplock_break A race condition can occur in cifs_oplock_break() leading to a use-after-free of the cinode structure when unmounting: cifs_oplock_break() _cifsFileInfo_put(cfile) cifsFileInfo_put_final() cifs_sb_deactive() [last ref, start releasing sb] kill_sb() kill_anon_super() generic_shutdown_super() evict_inodes() dispose_list() evict() destroy_inode() call_rcu(&inode->i_rcu, i_callback) spin_lock(&cinode->open_file_lock) <-
odes() dispose_list() evict() destroy_inode() call_rcu(&inode->i_rcu, i_callback) spin_lock(&cinode->open_file_lock) <- OK [later] i_callback() cifs_free_inode() kmem_cache_free(cinode) spin_unlock(&cinode->open_file_lock) <- UAF cifs_done_oplock_break(cinode) <- UAF The issue occurs when umount has already released its reference to the superblock. When _cifsFileInfo_put() calls cifs_sb_deactive(), this releases the last reference, triggering the immediate cleanup of all inodes under RCU. However, cifs_oplock_break() continues to access the cinode after this point, resulting in use-after-free. Fix this by holding an extra reference to the superblock during the entire oplock break operation.
g in use-after-free. Fix this by holding an extra reference to the superblock during the entire oplock break operation. This ensures that the superblock and its inodes remain valid until the oplock break completes. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/4256a483fe58af66a46cbf3dc48ff26e580d3308 - https://git.kernel.org/stable/c/0a4eec84d4d2c4085d4ed8630fd74e4b39033c1b - https://git.kernel.org/stable/c/2baaf5bbab2ac474c4f92c10fcb3310f824db995 - https://git.kernel.org/stable/c/09bce2138a30ef10d8821c8c3f73a4ab7a5726bc - https://git.kernel.org/stable/c/da11bd4b697b393a207f19a2ed7d382a811a3ddc - https://git.kernel.org/stable/c/705c79101ccf9
https://git.kernel.org/stable/c/da11bd4b697b393a207f19a2ed7d382a811a3ddc - https://git.kernel.org/stable/c/705c79101ccf9edea5a00d761491a03ced314210
CVE ID: CVE-2025-38528 State: PUBLISHED Published: 2025-08-16T11:12:21.667Z Last Updated: 2025-11-03T17:39:24.864Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: Reject %p% format string in bprintf-like helpers static const char fmt[] = "%p%"; bpf_trace_printk(fmt, sizeof(fmt)); The above BPF program isn't rejected and causes a kernel warning at runtime: Please remove unsupported %\x00 in format string WARNING: CPU: 1 PID: 7244 at lib/vsprintf.c:2680 format_decode+0x49c/0x5d0 This happens because bpf_bprintf_prepare skips over the second %, detected as punctuation, while processing %p. This patch fixes it by not skipping o
ntf_prepare skips over the second %, detected as punctuation, while processing %p. This patch fixes it by not skipping over punctuation. %\x00 is then processed in the next iteration and rejected. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/97303e541e12f1fea97834ec64b98991e8775f39 - https://git.kernel.org/stable/c/61d5fa45ed13e42af14c7e959baba9908b8ee6d4 - https://git.kernel.org/stable/c/e7be679124bae8cf4fa6e40d7e1661baddfb3289 - https://git.kernel.org/stable/c/6952aeace93f8c9ea01849efecac24dd3152c9c9 - https://git.kernel.org/stable/c/1c5f5fd47bbda17cb885fe6f03730702cd53d3f8 - https://git.kernel.org/stable/c/f8242745871f81a3ac37f9f51853d12
.org/stable/c/1c5f5fd47bbda17cb885fe6f03730702cd53d3f8 - https://git.kernel.org/stable/c/f8242745871f81a3ac37f9f51853d12854fd0b58
CVE ID: CVE-2025-38529 State: PUBLISHED Published: 2025-08-16T11:12:22.447Z Last Updated: 2025-11-03T17:39:26.794Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: comedi: aio_iiro_16: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: if ((1 << it->options[1]) & 0xdcfc) { However, `it->options[i]` is an unchecked `int` value from userspace, so the shift amount could be negative or out of bounds. Fix the test by requiring `it->options[1]` to be within bounds before proceeding with the original test. Valid `it->options[1]` values that select the IRQ will be in the range [1,15]. The va
proceeding with the original test. Valid `it->options[1]` values that select the IRQ will be in the range [1,15]. The value 0 explicitly disables the use of interrupts. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/a88692245c315bf8e225f205297a6f4b13d6856a - https://git.kernel.org/stable/c/5ac7c60439236fb691b8c7987390e2327bbf18fa - https://git.kernel.org/stable/c/c593215385f0c0163015cca4512ed3ff42875d19 - https://git.kernel.org/stable/c/ff30dd3f15f443d2a0085b12ec2cc95d44f35fa7 - https://git.kernel.org/stable/c/955e8835855fed8e87f7d8c8075564a1746c1b4c - https://git.kernel.org/stable/c/e0f3c0867d7d231c70984f05c97752caacd0daba - https://git.kern
8e87f7d8c8075564a1746c1b4c - https://git.kernel.org/stable/c/e0f3c0867d7d231c70984f05c97752caacd0daba - https://git.kernel.org/stable/c/43ddd82e6a91913cea1c078e782afd8de60c3a53 - https://git.kernel.org/stable/c/66acb1586737a22dd7b78abc63213b1bcaa100e4
CVE ID: CVE-2025-38530 State: PUBLISHED Published: 2025-08-16T11:12:23.368Z Last Updated: 2025-11-03T17:39:28.671Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: comedi: pcl812: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: if ((1 << it->options[1]) & board->irq_bits) { However, `it->options[i]` is an unchecked `int` value from userspace, so the shift amount could be negative or out of bounds. Fix the test by requiring `it->options[1]` to be within bounds before proceeding with the original test. Valid `it->options[1]` values that select the IRQ will be in the range [1,15]. Th
ore proceeding with the original test. Valid `it->options[1]` values that select the IRQ will be in the range [1,15]. The value 0 explicitly disables the use of interrupts. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/374d9b3eb4b08407997ef1fce96119d31e0c0bc4 - https://git.kernel.org/stable/c/0489c30d080f07cc7f09d04de723d8c2ccdb61ef - https://git.kernel.org/stable/c/29ef03e5b84431171d6b77b822985b54bc44b793 - https://git.kernel.org/stable/c/5bfa301e1e59a9b1a7b62a800b54852337c97416 - https://git.kernel.org/stable/c/7e470d8efd10725b189ca8951973a8425932398a - https://git.kernel.org/stable/c/a27e27eee313fe1c450b6af1e80e64412546cab4 - https://git.
10725b189ca8951973a8425932398a - https://git.kernel.org/stable/c/a27e27eee313fe1c450b6af1e80e64412546cab4 - https://git.kernel.org/stable/c/16c173abee315953fd17a279352fec4a1faee862 - https://git.kernel.org/stable/c/b14b076ce593f72585412fc7fd3747e03a5e3632
CVE ID: CVE-2025-38531 State: PUBLISHED Published: 2025-08-16T11:12:24.405Z Last Updated: 2025-08-16T11:12:24.405Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iio: common: st_sensors: Fix use of uninitialize device structs Throughout the various probe functions &indio_dev->dev is used before it is initialized. This caused a kernel panic in st_sensors_power_enable() when the call to devm_regulator_bulk_get_enable() fails and then calls dev_err_probe() with the uninitialized device. This seems to only cause a panic with dev_err_probe(), dev_err(), dev_warn() and dev_info() don't seem to cause a panic, but are fixed as well. Th
panic with dev_err_probe(), dev_err(), dev_warn() and dev_info() don't seem to cause a panic, but are fixed as well. The issue is reported and traced here: [1] References: - https://git.kernel.org/stable/c/610615c9668037e3eca11132063b93b2d945af13 - https://git.kernel.org/stable/c/3297a9016a45144883ec990bd4bd5b1d79cafb46 - https://git.kernel.org/stable/c/9f92e93e257b33e73622640a9205f8642ec16ddd
CVE ID: CVE-2025-38532 State: PUBLISHED Published: 2025-08-16T11:12:25.161Z Last Updated: 2025-08-16T11:12:25.161Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: libwx: properly reset Rx ring descriptor When device reset is triggered by feature changes such as toggling Rx VLAN offload, wx->do_reset() is called to reinitialize Rx rings. The hardware descriptor ring may retain stale values from previous sessions. And only set the length to 0 in rx_desc[0] would result in building malformed SKBs. Fix it to ensure a clean slate after device reset. [ 549.186435] [ C16] ------------[ cut here ]------------ [ 549.186457] [ C16] k
nsure a clean slate after device reset. [ 549.186435] [ C16] ------------[ cut here ]------------ [ 549.186457] [ C16] kernel BUG at net/core/skbuff.c:2814! [ 549.186468] [ C16] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 549.186472] [ C16] CPU: 16 UID: 0 PID: 0 Comm: swapper/16 Kdump: loaded Not tainted 6.16.0-rc4+ #23 PREEMPT(voluntary) [ 549.186476] [ C16] Hardware name: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING PLUS WIFI (MS-7E16), BIOS 1.90 12/31/2024 [ 549.186478] [ C16] RIP: 0010:__pskb_pull_tail+0x3ff/0x510 [ 549.186484] [ C16] Code: 06 f0 ff 4f 34 74 7b 4d 8b 8c 24 c8 00 00 00 45 8b 84 24 c0 00 00 00 e9 c8 fd ff ff 48 c7 44 24 08 00 00 00 00 e9 5e fe ff ff <0f> 0b 31 c
7b 4d 8b 8c 24 c8 00 00 00 45 8b 84 24 c0 00 00 00 e9 c8 fd ff ff 48 c7 44 24 08 00 00 00 00 e9 5e fe ff ff <0f> 0b 31 c0 e9 23 90 5b ff 41 f7 c6 ff 0f 00 00 75 bf 49 8b 06 a8 [ 549.186487] [ C16] RSP: 0018:ffffb391c0640d70 EFLAGS: 00010282 [ 549.186490] [ C16] RAX: 00000000fffffff2 RBX: ffff8fe7e4d40200 RCX: 00000000fffffff2 [ 549.186492] [ C16] RDX: ffff8fe7c3a4bf8e RSI: 0000000000000180 RDI: ffff8fe7c3a4bf40 [ 549.186494] [ C16] RBP: ffffb391c0640da8 R08: ffff8fe7c3a4c0c0 R09: 000000000000000e [ 549.186496] [ C16] R10: ffffb391c0640d88 R11: 000000000000000e R12: ffff8fe7e4d40200 [ 549.186497] [ C16] R13: 00000000fffffff2 R14: ffff8fe7fa01a000 R15: 00000000fffffff2 [ 549.186499] [ C16] FS:
e4d40200 [ 549.186497] [ C16] R13: 00000000fffffff2 R14: ffff8fe7fa01a000 R15: 00000000fffffff2 [ 549.186499] [ C16] FS: 0000000000000000(0000) GS:ffff8fef5ae40000(0000) knlGS:0000000000000000 [ 549.186502] [ C16] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 549.186503] [ C16] CR2: 00007f77d81d6000 CR3: 000000051a032000 CR4: 0000000000750ef0 [ 549.186505] [ C16] PKRU: 55555554 [ 549.186507] [ C16] Call Trace: [ 549.186510] [ C16] <IRQ> [ 549.186513] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5 [ 549.186517] [ C16] __skb_pad+0xc7/0xf0 [ 549.186523] [ C16] wx_clean_rx_irq+0x355/0x3b0 [libwx] [ 549.186533] [ C16] wx_poll+0x92/0x120 [libwx] [ 549.186540] [ C16] __napi_poll+0x28/0x190 [ 549
rq+0x355/0x3b0 [libwx] [ 549.186533] [ C16] wx_poll+0x92/0x120 [libwx] [ 549.186540] [ C16] __napi_poll+0x28/0x190 [ 549.186544] [ C16] net_rx_action+0x301/0x3f0 [ 549.186548] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5 [ 549.186551] [ C16] ? __raw_spin_lock_irqsave+0x1e/0x50 [ 549.186554] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5 [ 549.186557] [ C16] ? wake_up_nohz_cpu+0x35/0x160 [ 549.186559] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5 [ 549.186563] [ C16] handle_softirqs+0xf9/0x2c0 [ 549.186568] [ C16] __irq_exit_rcu+0xc7/0x130 [ 549.186572] [ C16] common_interrupt+0xb8/0xd0 [ 549.186576] [ C16] </IRQ> [ 549.186577] [ C16] <TASK> [ 549.186579] [ C16] asm_common_interrupt+0x22/0x40 [
0xb8/0xd0 [ 549.186576] [ C16] </IRQ> [ 549.186577] [ C16] <TASK> [ 549.186579] [ C16] asm_common_interrupt+0x22/0x40 [ 549.186582] [ C16] RIP: 0010:cpuidle_enter_state+0xc2/0x420 [ 549.186585] [ C16] Code: 00 00 e8 11 0e 5e ff e8 ac f0 ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 0d ed 5c ff 45 84 ff 0f 85 40 02 00 00 fb 0f 1f 44 00 00 <45> 85 f6 0f 88 84 01 00 00 49 63 d6 48 8d 04 52 48 8d 04 82 49 8d [ 549.186587] [ C16] RSP: 0018:ffffb391c0277e78 EFLAGS: 00000246 [ 549.186590] [ C16] RAX: ffff8fef5ae40000 RBX: 0000000000000003 RCX: 0000000000000000 [ 549.186591] [ C16] RDX: 0000007fde0faac5 RSI: ffffffff826e53f6 RDI: ffffffff826fa9b3 [ 549.186593] [ C16] RBP: ffff8fe7c3a20800 R08: 000000000000
000007fde0faac5 RSI: ffffffff826e53f6 RDI: ffffffff826fa9b3 [ 549.186593] [ C16] RBP: ffff8fe7c3a20800 R08: 0000000000000002 R09: 0000000000000000 [ 549.186595] [ C16] R10: 0000000000000000 R11: 000000000000ffff R12: ffffffff82ed7a40 [ 549.186596] [ C16] R13: 0000007fde0faac5 R14: 0000000000000003 R15: 0000000000000000 [ 549.186601] [ C16] ? cpuidle_enter_state+0xb3/0x420 [ 549.186605] [ C16] cpuidle_en ---truncated--- References: - https://git.kernel.org/stable/c/d510116c80b37efb100ce8d5ee326214b0157293 - https://git.kernel.org/stable/c/10e27b2a6ebeda49e9c2897a699d3ce1ded565ee - https://git.kernel.org/stable/c/ee527d3fba4dae1d619d2d0438624002c8e99e24 - https://git.kernel.org/stable/c/d992ed
65ee - https://git.kernel.org/stable/c/ee527d3fba4dae1d619d2d0438624002c8e99e24 - https://git.kernel.org/stable/c/d992ed7e1b687ad7df0763d3e015a5358646210b
CVE ID: CVE-2025-38533 State: PUBLISHED Published: 2025-08-16T11:12:25.978Z Last Updated: 2025-08-16T11:12:25.978Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix the using of Rx buffer DMA The wx_rx_buffer structure contained two DMA address fields: 'dma' and 'page_dma'. However, only 'page_dma' was actually initialized and used to program the Rx descriptor. But 'dma' was uninitialized and used in some paths. This could lead to undefined behavior, including DMA errors or use-after-free, if the uninitialized 'dma' was used. Althrough such error has not yet occurred, it is worth fixing in the code. References: - h
uninitialized 'dma' was used. Althrough such error has not yet occurred, it is worth fixing in the code. References: - https://git.kernel.org/stable/c/027701180a7bcb64c42eab291133ef0c87b5b6c5 - https://git.kernel.org/stable/c/ba7c793f96c1c2b944bb6f423d7243f3afc30fe9 - https://git.kernel.org/stable/c/05c37b574997892a40a0e9b9b88a481566b2367d - https://git.kernel.org/stable/c/5fd77cc6bd9b368431a815a780e407b7781bcca0
CVE ID: CVE-2025-38534 State: PUBLISHED Published: 2025-08-16T11:12:27.014Z Last Updated: 2025-08-16T11:12:27.014Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix copy-to-cache so that it performs collection with ceph+fscache The netfs copy-to-cache that is used by Ceph with local caching sets up a new request to write data just read to the cache. The request is started and then left to look after itself whilst the app continues. The request gets notified by the backing fs upon completion of the async DIO write, but then tries to wake up the app because NETFS_RREQ_OFFLOAD_COLLECTION isn't set - but the app isn't waiti
c DIO write, but then tries to wake up the app because NETFS_RREQ_OFFLOAD_COLLECTION isn't set - but the app isn't waiting there, and so the request just hangs. Fix this by setting NETFS_RREQ_OFFLOAD_COLLECTION which causes the notification from the backing filesystem to put the collection onto a work queue instead. References: - https://git.kernel.org/stable/c/1ebe58cef84eab22b41b4d5e72c2051ebf00af50 - https://git.kernel.org/stable/c/4c238e30774e3022a505fa54311273add7570f13
CVE ID: CVE-2025-38535 State: PUBLISHED Published: 2025-08-16T11:12:27.873Z Last Updated: 2025-11-03T17:39:30.613Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode When transitioning from USB_ROLE_DEVICE to USB_ROLE_NONE, the code assumed that the regulator should be disabled. However, if the regulator is marked as always-on, regulator_is_enabled() continues to return true, leading to an incorrect attempt to disable a regulator which is not enabled. This can result in warnings such as: [ 250.155624] WARNING: CPU: 1 PID: 7326 at drivers/regulator/core.c:3004 _regu
led. This can result in warnings such as: [ 250.155624] WARNING: CPU: 1 PID: 7326 at drivers/regulator/core.c:3004 _regulator_disable+0xe4/0x1a0 [ 250.155652] unbalanced disables for VIN_SYS_5V0 To fix this, we move the regulator control logic into tegra186_xusb_padctl_id_override() function since it's directly related to the ID override state. The regulator is now only disabled when the role transitions from USB_ROLE_HOST to USB_ROLE_NONE, by checking the VBUS_ID register. This ensures that regulator enable/disable operations are properly balanced and only occur when actually transitioning to/from host mode. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel
lly transitioning to/from host mode. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/ceb645ac6ce052609ee5c8f819a80e8881789b04 - https://git.kernel.org/stable/c/cdcb0ffd6448f6be898956913a42bd08e59fb2ae - https://git.kernel.org/stable/c/1bb85b5c2bd43b687c3d54eb6328917f90dd38fc - https://git.kernel.org/stable/c/5367cdeb75cb6c687ca468450bceb2602ab239d8 - https://git.kernel.org/stable/c/ec7f98ff05f0649af0adeb4808c7ba23d6111ef9 - https://git.kernel.org/stable/c/eaa420339658615d26c1cc95cd6cf720b9aebfca - https://git.kernel.org/stable/c/cefc1caee9dd06c69e2d807edc5949b329f52b22
CVE ID: CVE-2025-38536 State: PUBLISHED Published: 2025-08-16T11:12:28.627Z Last Updated: 2025-08-16T11:12:28.627Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: airoha: fix potential use-after-free in airoha_npu_get() np->name was being used after calling of_node_put(np), which releases the node and can lead to a use-after-free bug. Previously, of_node_put(np) was called unconditionally after of_find_device_by_node(np), which could result in a use-after-free if pdev is NULL. This patch moves of_node_put(np) after the error check to ensure the node is only released after both the error and success cases are handled appropr
np) after the error check to ensure the node is only released after both the error and success cases are handled appropriately, preventing potential resource issues. References: - https://git.kernel.org/stable/c/df6bf96b41e547e350667bc4c143be53646d070d - https://git.kernel.org/stable/c/3cd582e7d0787506990ef0180405eb6224fa90a6
CVE ID: CVE-2025-38537 State: PUBLISHED Published: 2025-08-16T11:12:29.432Z Last Updated: 2025-08-16T11:12:29.432Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: phy: Don't register LEDs for genphy If a PHY has no driver, the genphy driver is probed/removed directly in phy_attach/detach. If the PHY's ofnode has an "leds" subnode, then the LEDs will be (un)registered when probing/removing the genphy driver. This could occur if the leds are for a non-generic driver that isn't loaded for whatever reason. Synchronously removing the PHY device in phy_detach leads to the following deadlock: rtnl_lock() ndo_close() ... phy_detach
chronously removing the PHY device in phy_detach leads to the following deadlock: rtnl_lock() ndo_close() ... phy_detach() phy_remove() phy_leds_unregister() led_classdev_unregister() led_trigger_set() netdev_trigger_deactivate() unregister_netdevice_notifier() rtnl_lock() There is a corresponding deadlock on the open/register side of things (and that one is reported by lockdep), but it requires a race while this one is deterministic. Generic PHYs do not support LEDs anyway, so don't bother registering them. References: - https://git.kernel.org/stable/c/ec158d05eaa91b2809cab65f8068290e3c05ebdd - https://git.kernel.org/stable/c/fd6493533af9e5d73d0d42ff2a8ded978a701dc6 - https://git.kernel.org
b65f8068290e3c05ebdd - https://git.kernel.org/stable/c/fd6493533af9e5d73d0d42ff2a8ded978a701dc6 - https://git.kernel.org/stable/c/75e1b2079ef0653a2f7aa69be515d86b7faf1908 - https://git.kernel.org/stable/c/f0f2b992d8185a0366be951685e08643aae17d6d
CVE ID: CVE-2025-38538 State: PUBLISHED Published: 2025-08-16T11:12:30.878Z Last Updated: 2025-11-03T17:39:32.538Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dmaengine: nbpfaxi: Fix memory corruption in probe() The nbpf->chan[] array is allocated earlier in the nbpf_probe() function and it has "num_channels" elements. These three loops iterate one element farther than they should and corrupt memory. The changes to the second loop are more involved. In this case, we're copying data from the irqbuf[] array into the nbpf->chan[] array. If the data in irqbuf[i] is the error IRQ then we skip it, so the iterators are not in sync.