Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-39807 State: PUBLISHED Published: 2025-09-16T13:00:10.408Z Last Updated: 2025-09-29T05:59:49.845Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add error handling for old state CRTC in atomic_disable Introduce error handling to address an issue where, after a hotplug event, the cursor continues to update. This situation can lead to a kernel panic due to accessing the NULL `old_state->crtc`. E,g. Unable to handle kernel NULL pointer dereference at virtual address Call trace: mtk_crtc_plane_disable+0x24/0x140 mtk_plane_atomic_update+0x8c/0xa8 drm_atomic_helper_commit_planes+0x114/0x2c8 drm_atomic_h
crtc_plane_disable+0x24/0x140 mtk_plane_atomic_update+0x8c/0xa8 drm_atomic_helper_commit_planes+0x114/0x2c8 drm_atomic_helper_commit_tail_rpm+0x4c/0x158 commit_tail+0xa0/0x168 drm_atomic_helper_commit+0x110/0x120 drm_atomic_commit+0x8c/0xe0 drm_atomic_helper_update_plane+0xd4/0x128 __setplane_atomic+0xcc/0x110 drm_mode_cursor_common+0x250/0x440 drm_mode_cursor_ioctl+0x44/0x70 drm_ioctl+0x264/0x5d8 __arm64_sys_ioctl+0xd8/0x510 invoke_syscall+0x6c/0xe0 do_el0_svc+0x68/0xe8 el0_svc+0x34/0x60 el0t_64_sync_handler+0x1c/0xf8 el0t_64_sync+0x180/0x188 Adding NULL pointer checks to ensure stability by preventing operations on an invalid CRTC state. References: - https://git.kernel.org/stable/c/7d5cc2
ensure stability by preventing operations on an invalid CRTC state. References: - https://git.kernel.org/stable/c/7d5cc22efa44e0fe321ce195c71c3d7da211fbb2 - https://git.kernel.org/stable/c/9a94e9d8b50bcfe89693bc899a54d3866d86e973 - https://git.kernel.org/stable/c/0c6b24d70da21201ed009a2aca740d2dfddc7ab5
CVE ID: CVE-2025-39808 State: PUBLISHED Published: 2025-09-16T13:00:11.242Z Last Updated: 2025-11-03T17:43:34.626Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() in ntrig_report_version(), hdev parameter passed from hid_probe(). sending descriptor to /dev/uhid can make hdev->dev.parent->parent to null if hdev->dev.parent->parent is null, usb_dev has invalid address(0xffffffffffffff58) that hid_to_usb_dev(hdev) returned when usb_rcvctrlpipe() use usb_dev,it trigger page fault error for address(0xffffffffffffff58) add null check logic to ntrig_report_versio
pe() use usb_dev,it trigger page fault error for address(0xffffffffffffff58) add null check logic to ntrig_report_version() before calling hid_to_usb_dev() Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/22ddb5eca4af5e69dffe2b54551d2487424448f1 - https://git.kernel.org/stable/c/019c34ca11372de891c06644846eb41fca7c890c - https://git.kernel.org/stable/c/4338b0f6544c3ff042bfbaf40bc9afe531fb08c7 - https://git.kernel.org/stable/c/6070123d5344d0950f10ef6a5fdc3f076abb7ad2 - https://git.kernel.org/stable/c/e422370e6ab28478872b914cee5d49a9bdfae0c6 - https://git.kernel.org/stable/c/98520a9a3d69a530dd1ee280cbe0abc232a35bff - https://git.kernel.org/stable
d49a9bdfae0c6 - https://git.kernel.org/stable/c/98520a9a3d69a530dd1ee280cbe0abc232a35bff - https://git.kernel.org/stable/c/183def8e4d786e50165e5d992df6a3083e45e16c - https://git.kernel.org/stable/c/185c926283da67a72df20a63a5046b3b4631b7d9
CVE ID: CVE-2025-39809 State: PUBLISHED Published: 2025-09-16T13:00:11.977Z Last Updated: 2025-09-29T05:59:52.360Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length The QuickI2C ACPI _DSD methods return ICRS and ISUB data with a trailing byte, making the actual length is one more byte than the structs defined. It caused stack-out-of-bounds and kernel crash: kernel: BUG: KASAN: stack-out-of-bounds in quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: Write of size 12 at addr ffff888106d1f900 by task kworker/u33:2/75 kernel: kernel: CPU: 3
0x1b0 [intel_quicki2c] kernel: Write of size 12 at addr ffff888106d1f900 by task kworker/u33:2/75 kernel: kernel: CPU: 3 UID: 0 PID: 75 Comm: kworker/u33:2 Not tainted 6.16.0+ #3 PREEMPT(voluntary) kernel: Workqueue: async async_run_entry_fn kernel: Call Trace: kernel: <TASK> kernel: dump_stack_lvl+0x76/0xa0 kernel: print_report+0xd1/0x660 kernel: ? __pfx__raw_spin_lock_irqsave+0x10/0x10 kernel: ? __kasan_slab_free+0x5d/0x80 kernel: ? kasan_addr_to_slab+0xd/0xb0 kernel: kasan_report+0xe1/0x120 kernel: ? quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: ? quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: kasan_check_range+0x11c/0x200
kernel: ? quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: kasan_check_range+0x11c/0x200 kernel: __asan_memcpy+0x3b/0x80 kernel: quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: ? __pfx_quicki2c_acpi_get_dsd_property.constprop.0+0x10/0x10 [intel_quicki2c] kernel: quicki2c_get_acpi_resources+0x237/0x730 [intel_quicki2c] [...] kernel: </TASK> kernel: kernel: The buggy address belongs to stack of task kworker/u33:2/75 kernel: and is located at offset 48 in frame: kernel: quicki2c_get_acpi_resources+0x0/0x730 [intel_quicki2c] kernel: kernel: This frame has 3 objects: kernel: [32, 36) 'hid_desc_addr' kernel: [48, 59) 'i2c_param' kerne
_quicki2c] kernel: kernel: This frame has 3 objects: kernel: [32, 36) 'hid_desc_addr' kernel: [48, 59) 'i2c_param' kernel: [80, 224) 'i2c_config' ACPI DSD methods return: \_SB.PC00.THC0.ICRS Buffer 000000003fdc947b 001 Len 0C = 0A 00 80 1A 06 00 00 00 00 00 00 00 \_SB.PC00.THC0.ISUB Buffer 00000000f2fcbdc4 001 Len 91 = 00 00 00 00 00 00 00 00 00 00 00 00 Adding reserved padding to quicki2c_subip_acpi_parameter/config. References: - https://git.kernel.org/stable/c/4adce86d4b13d15dec7810967839b931b1598700 - https://git.kernel.org/stable/c/1db9df89a213318a48d958385dc1b17b379dc32b
CVE ID: CVE-2025-39810 State: PUBLISHED Published: 2025-09-16T13:00:12.677Z Last Updated: 2025-09-29T05:59:53.627Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix memory corruption when FW resources change during ifdown bnxt_set_dflt_rings() assumes that it is always called before any TC has been created. So it doesn't take bp->num_tc into account and assumes that it is always 0 or 1. In the FW resource or capability change scenario, the FW will return flags in bnxt_hwrm_if_change() that will cause the driver to reinitialize and call bnxt_cancel_reservations(). This will lead to bnxt_init_dflt_ring_mode() calling bn
the driver to reinitialize and call bnxt_cancel_reservations(). This will lead to bnxt_init_dflt_ring_mode() calling bnxt_set_dflt_rings() and bp->num_tc may be greater than 1. This will cause bp->tx_ring[] to be sized too small and cause memory corruption in bnxt_alloc_cp_rings(). Fix it by properly scaling the TX rings by bp->num_tc in the code paths mentioned above. Add 2 helper functions to determine bp->tx_nr_rings and bp->tx_nr_rings_per_tc. References: - https://git.kernel.org/stable/c/d00e98977ef519280b075d783653e2c492fffbb6 - https://git.kernel.org/stable/c/9ab6a9950f152e094395d2e3967f889857daa185 - https://git.kernel.org/stable/c/2747328ba2714f1a7454208dbbc1dc0631990b4a
CVE ID: CVE-2025-39811 State: PUBLISHED Published: 2025-09-16T13:00:13.395Z Last Updated: 2025-09-29T05:59:54.870Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: Clear the scratch_pt pointer on error Avoid triggering a dereference of an error pointer on cleanup in xe_vm_free_scratch() by clearing any scratch_pt error pointer. (cherry picked from commit 358ee50ab565f3c8ea32480e9d03127a81ba32f8) References: - https://git.kernel.org/stable/c/c8277d229c7840e8090d4704e50f2ca014d194c7 - https://git.kernel.org/stable/c/84603ed1d73ebb8de856dc11f4f5d3541c48f7a2 - https://git.kernel.org/stable/c/2b55ddf36229e0278c956215784ab1f
.org/stable/c/84603ed1d73ebb8de856dc11f4f5d3541c48f7a2 - https://git.kernel.org/stable/c/2b55ddf36229e0278c956215784ab1feeff510aa
CVE ID: CVE-2025-39812 State: PUBLISHED Published: 2025-09-16T13:00:14.103Z Last Updated: 2025-11-03T17:43:36.526Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sctp: initialize more fields in sctp_v6_from_sk() syzbot found that sin6_scope_id was not properly initialized, leading to undefined behavior. Clear sin6_scope_id and sin6_flowinfo. BUG: KMSAN: uninit-value in __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 sctp_inet6_cmp_addr+0x4f2/0x510 net/sctp/ipv6.c:983 sctp_bind_addr_conflict+0x22a/0x3b0 net/sctp/bind_addr.c:390 sctp_get_port_local+0x21eb/0x2440 net/sctp/socke
ipv6.c:983 sctp_bind_addr_conflict+0x22a/0x3b0 net/sctp/bind_addr.c:390 sctp_get_port_local+0x21eb/0x2440 net/sctp/socket.c:8452 sctp_get_port net/sctp/socket.c:8523 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x710/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930 x64_sys_call+0x271d/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:51 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_
ll_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Local variable addr.i.i created at: sctp_get_port net/sctp/socket.c:8515 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x650/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930 Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/45e4b36593edffb7bbee5828ae820bc10a9fa0f3 - https://git.
Program Container: References: - https://git.kernel.org/stable/c/45e4b36593edffb7bbee5828ae820bc10a9fa0f3 - https://git.kernel.org/stable/c/9546934c2054bba1bd605c44e936619159a34027 - https://git.kernel.org/stable/c/17d6c7747045e9b802c2f5dfaba260d309d831ae - https://git.kernel.org/stable/c/65b4693d8bab5370cfcb44a275b4d8dcb06e56bf - https://git.kernel.org/stable/c/463aa96fca6209bb205f49f7deea3817d7ddaa3a - https://git.kernel.org/stable/c/1bbc0c02aea1f1c405bd1271466889c25a1fe01b - https://git.kernel.org/stable/c/f6c2cc99fc2387ba6499facd6108f6543382792d - https://git.kernel.org/stable/c/2e8750469242cad8f01f320131fd5a6f540dbb99
CVE ID: CVE-2025-39813 State: PUBLISHED Published: 2025-09-16T13:00:14.846Z Last Updated: 2025-11-03T17:43:38.484Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump When calling ftrace_dump_one() concurrently with reading trace_pipe, a WARN_ON_ONCE() in trace_printk_seq() can be triggered due to a race condition. The issue occurs because: CPU0 (ftrace_dump) CPU1 (reader) echo z > /proc/sysrq-trigger !trace_empty(&iter) trace_iterator_reset(&iter) <- len = size = 0 cat /sys/kernel/tracing/trace_pipe trace_find_next_entry_inc(&iter) __find_next_entry ring_buffer_em
) <- len = size = 0 cat /sys/kernel/tracing/trace_pipe trace_find_next_entry_inc(&iter) __find_next_entry ring_buffer_empty_cpu <- all empty return NULL trace_printk_seq(&iter.seq) WARN_ON_ONCE(s->seq.len >= s->seq.size) In the context between trace_empty() and trace_find_next_entry_inc() during ftrace_dump, the ring buffer data was consumed by other readers. This caused trace_find_next_entry_inc to return NULL, failing to populate `iter.seq`. At this point, due to the prior trace_iterator_reset, both `iter.seq.len` and `iter.seq.size` were set to 0. Since they are equal, the WARN_ON_ONCE condition is triggered. Move the trace_printk_seq() into the if block that checks to make sure the retur
he WARN_ON_ONCE condition is triggered. Move the trace_printk_seq() into the if block that checks to make sure the return value of trace_find_next_entry_inc() is non-NULL in ftrace_dump_one(), ensuring the 'iter.seq' is properly populated before subsequent operations. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/f299353e7ccbcc5c2ed8993c48fbe7609cbe729a - https://git.kernel.org/stable/c/5ab0ec206deb99eb3baf8f1d7602aeaa91dbcc85 - https://git.kernel.org/stable/c/a6f0f8873cc30fd4543b09adf03f7f51d293f0e6 - https://git.kernel.org/stable/c/e80ff23ba8bdb0f41a1afe2657078e4097d13a9a - https://git.kernel.org/stable/c/28c8fb7ae2ad27d81c8de3c4fe608c509f
g/stable/c/e80ff23ba8bdb0f41a1afe2657078e4097d13a9a - https://git.kernel.org/stable/c/28c8fb7ae2ad27d81c8de3c4fe608c509f6a18aa - https://git.kernel.org/stable/c/ced94e137e6cd5e79c65564841d3b7695d0f5fa3 - https://git.kernel.org/stable/c/fbd4cf7ee4db65ef36796769fe978e9eba6f0de4 - https://git.kernel.org/stable/c/4013aef2ced9b756a410f50d12df9ebe6a883e4a
CVE ID: CVE-2025-39814 State: PUBLISHED Published: 2025-09-16T13:00:15.552Z Last Updated: 2025-09-29T05:59:58.675Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL pointer dereference in ice_unplug_aux_dev() on reset Issuing a reset when the driver is loaded without RDMA support, will results in a crash as it attempts to remove RDMA's non-existent auxbus device: echo 1 > /sys/class/net/<if>/device/reset BUG: kernel NULL pointer dereference, address: 0000000000000008 ... RIP: 0010:ice_unplug_aux_dev+0x29/0x70 [ice] ... Call Trace: <TASK> ice_prepare_for_reset+0x77/0x260 [ice] pci_dev_save_and_disable+0x2c/0x70 pci_re
+0x29/0x70 [ice] ... Call Trace: <TASK> ice_prepare_for_reset+0x77/0x260 [ice] pci_dev_save_and_disable+0x2c/0x70 pci_reset_function+0x88/0x130 reset_store+0x5a/0xa0 kernfs_fop_write_iter+0x15e/0x210 vfs_write+0x273/0x520 ksys_write+0x6b/0xe0 do_syscall_64+0x79/0x3b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e ice_unplug_aux_dev() checks pf->cdev_info->adev for NULL pointer, but pf->cdev_info will also be NULL, leading to the deref in the trace above. Introduce a flag to be set when the creation of the auxbus device is successful, to avoid multiple NULL pointer checks in ice_unplug_aux_dev(). References: - https://git.kernel.org/stable/c/db783756a7d7cfaea039411971d0dc0a374e85cb - https://git.ke
nplug_aux_dev(). References: - https://git.kernel.org/stable/c/db783756a7d7cfaea039411971d0dc0a374e85cb - https://git.kernel.org/stable/c/60dfe2434eed13082f26eb7409665dfafb38fa51
CVE ID: CVE-2025-39815 State: PUBLISHED Published: 2025-09-16T13:00:16.250Z Last Updated: 2025-09-29T05:59:59.910Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: fix stack overrun when loading vlenb The userspace load can put up to 2048 bits into an xlen bit stack buffer. We want only xlen bits, so check the size beforehand. References: - https://git.kernel.org/stable/c/c76bf8359188a11f8fd790e5bbd6077894a245cc - https://git.kernel.org/stable/c/6d28659b692a0212f360f8bd8a58712b339f9aac - https://git.kernel.org/stable/c/799766208f09f95677a9ab111b93872d414fbad7
CVE ID: CVE-2025-39816 State: PUBLISHED Published: 2025-09-16T13:00:17.026Z Last Updated: 2025-09-29T06:00:14.095Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths Since the buffers are mapped from userspace, it is prudent to use READ_ONCE() to read the value into a local variable, and use that for any other actions taken. Having a stable read of the buffer length avoids worrying about it changing after checking, or being read multiple times. Similarly, the buffer may well change in between it being picked and being committed. Ensure the looping for increm
mes. Similarly, the buffer may well change in between it being picked and being committed. Ensure the looping for incremental ring buffer commit stops if it hits a zero sized buffer, as no further progress can be made at that point. References: - https://git.kernel.org/stable/c/695673eb5711ee5eb1769481cf1503714716a7d1 - https://git.kernel.org/stable/c/390a61d284e1ced088d43928dfcf6f86fffdd780 - https://git.kernel.org/stable/c/98b6fa62c84f2e129161e976a5b9b3cb4ccd117b
CVE ID: CVE-2025-39817 State: PUBLISHED Published: 2025-09-16T13:00:17.776Z Last Updated: 2025-11-03T17:43:40.463Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on master as well): BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe8/0x190 __asan_loadN+0x1c/0x28 memcmp+0x98/0xd0 efivarfs_d_compare+0x68/0xd8 __d_lookup_rcu_op_compare+0x178/0x218 __d_lookup_rcu+0x1f8/0x228 d_alloc_parallel+0x150/0x648 lookup_open.isra.0+0x5f0/0x8d0 open_last_lookups+0x264/0x828 path_openat+0x130/0x3f8 do_filp_open+0x114/0x248 d
50/0x648 lookup_open.isra.0+0x5f0/0x8d0 open_last_lookups+0x264/0x828 path_openat+0x130/0x3f8 do_filp_open+0x114/0x248 do_sys_openat2+0x340/0x3c0 __arm64_sys_openat+0x120/0x1a0 If dentry->d_name.len < EFI_VARIABLE_GUID_LEN , 'guid' can become negative, leadings to oob. The issue can be triggered by parallel lookups using invalid filename: T1 T2 lookup_open ->lookup simple_lookup d_add // invalid dentry is added to hash list lookup_open d_alloc_parallel __d_lookup_rcu __d_lookup_rcu_op_compare hlist_bl_for_each_entry_rcu // invalid dentry can be retrieved ->d_compare efivarfs_d_compare // oob Fix it by checking 'guid' before cmp. Additional Analyst Notes: - CVE Program Container: References:
s_d_compare // oob Fix it by checking 'guid' before cmp. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/0f63fbabeaaaaaaf5b742a2f4c1b4590d50bf1f6 - https://git.kernel.org/stable/c/794399019301944fd6d2e0d7a51b3327e26c410e - https://git.kernel.org/stable/c/568e7761279b99c6daa3002290fd6d8047ddb6d2 - https://git.kernel.org/stable/c/d7f5e35e70507d10cbaff5f9e194ed54c4ee14f7 - https://git.kernel.org/stable/c/925599eba46045930b850a98ae594d2e3028ac40 - https://git.kernel.org/stable/c/c2925cd6207079c3f4d040d082515db78d63afbf - https://git.kernel.org/stable/c/71581a82f38e5a4d807d71fc1bb59aead80ccf95 - https://git.kernel.org/stable/c/a6358f8cf64850f3f2785
git.kernel.org/stable/c/71581a82f38e5a4d807d71fc1bb59aead80ccf95 - https://git.kernel.org/stable/c/a6358f8cf64850f3f27857b8ed8c1b08cfc4685c
CVE ID: CVE-2025-39818 State: PUBLISHED Published: 2025-09-16T13:00:18.490Z Last Updated: 2025-09-29T06:00:16.826Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save Improper use of secondary pointer (&dev->i2c_subip_regs) caused kernel crash and out-of-bounds error: BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510 Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107 CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary) Workqueue: async async_run_entry_fn Call Trace: <TASK> dump_stack_lvl+0x
u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary) Workqueue: async async_run_entry_fn Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 print_report+0xd1/0x660 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? kasan_complete_mode_report_info+0x26/0x200 kasan_report+0xe1/0x120 ? _regmap_bulk_read+0x449/0x510 ? _regmap_bulk_read+0x449/0x510 __asan_report_store4_noabort+0x17/0x30 _regmap_bulk_read+0x449/0x510 ? __pfx__regmap_bulk_read+0x10/0x10 regmap_bulk_read+0x270/0x3d0 pio_complete+0x1ee/0x2c0 [intel_thc] ? __pfx_pio_complete+0x10/0x10 [intel_thc] ? __pfx_pio_wait+0x10/0x10 [intel_thc] ? regmap_update_bits_base+0x13b/0x1f0 thc_i2c_subip_pio_read+0x117/0x270 [intel_thc] thc_i2c_subip_regs_save+0xc2/0x140 [
regmap_update_bits_base+0x13b/0x1f0 thc_i2c_subip_pio_read+0x117/0x270 [intel_thc] thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc] ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc] [...] The buggy address belongs to the object at ffff888136005d00 which belongs to the cache kmalloc-rnd-12-192 of size 192 The buggy address is located 0 bytes to the right of allocated 192-byte region [ffff888136005d00, ffff888136005dc0) Replaced with direct array indexing (&dev->i2c_subip_regs[i]) to ensure safe memory access. References: - https://git.kernel.org/stable/c/78d4cf0466c79452e47aa6f720afbde63e709ccc - https://git.kernel.org/stable/c/a7fc15ed629be89e51e09b743277c53e0a0168f5
CVE ID: CVE-2025-39819 State: PUBLISHED Published: 2025-09-16T13:00:19.320Z Last Updated: 2025-11-03T17:43:41.406Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fs/smb: Fix inconsistent refcnt update A possible inconsistent update of refcount was identified in `smb2_compound_op`. Such inconsistent update could lead to possible resource leaks. Why it is a possible bug: 1. In the comment section of the function, it clearly states that the reference to `cfile` should be dropped after calling this function. 2. Every control flow path would check and drop the reference to `cfile`, except the patched one. 3. Existing callers would n
ery control flow path would check and drop the reference to `cfile`, except the patched one. 3. Existing callers would not handle refcount update of `cfile` if -ENOMEM is returned. To fix the bug, an extra goto label "out" is added, to make sure that the cleanup logic would always be respected. As the problem is caused by the allocation failure of `vars`, the cleanup logic between label "finished" and "out" can be safely ignored. According to the definition of function `is_replayable_error`, the error code of "-ENOMEM" is not recoverable. Therefore, the replay logic also gets ignored. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/3fc11ff13fb
ts ignored. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/3fc11ff13fbc2749871d6ac2141685cf54699997 - https://git.kernel.org/stable/c/4191ea1f0bb3e27d65c5dcde7bd00e709ec67141 - https://git.kernel.org/stable/c/4735f5991f51468b85affb8366b7067248457a71 - https://git.kernel.org/stable/c/cc82c6dff548f0066a51a6e577c7454e7d26a968 - https://git.kernel.org/stable/c/ab529e6ca1f67bcf31f3ea80c72bffde2e9e053e
CVE ID: CVE-2025-39820 State: PUBLISHED Published: 2025-09-16T13:00:20.059Z Last Updated: 2025-09-29T06:00:19.646Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Add a null ptr check for dpu_encoder_needs_modeset The drm_atomic_get_new_connector_state() can return NULL if the connector is not part of the atomic state. Add a check to prevent a NULL pointer dereference. This follows the same pattern used in dpu_encoder_update_topology() within the same file, which checks for NULL before using conn_state. Patchwork: https://patchwork.freedesktop.org/patch/665188/ References: - https://git.kernel.org/stable/c/aaec54254
tate. Patchwork: https://patchwork.freedesktop.org/patch/665188/ References: - https://git.kernel.org/stable/c/aaec54254b02f5959c3670177037464d828b2140 - https://git.kernel.org/stable/c/abebfed208515726760d79cf4f9f1a76b9a10a84