Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
pm_run_callback from device_resume+0xc0/0x324 [ 14.588776] r9:c24f8054 r8:c24f80a0 r7:00000000 r6:00000000 r5:00000010 r4:c24f8010 [ 14.588779] device_resume from dpm_resume+0x130/0x160 [ 14.588799] r9:c22539e4 r8:00000010 r7:c22bebb0 r6:c24f8010 r5:c22539dc r4:c22539b0 [ 14.588802] dpm_resume from dpm_resume_end+0x14/0x20 [ 14.588822] r10:c2204e40 r9:00000000 r8:c228a3fc r7:00000000 r6:00000003 r5:c228a414 [ 14.588826] r4:00000010 [ 14.588828] dpm_resume_end from suspend_devices_and_enter+0x274/0x6f8 [ 14.588848] r5:c228a414 r4:00000000 [ 14.588851] suspend_devices_and_enter from pm_suspend+0x228/0x2bc [ 14.588868] r10:c3502910 r9:c3501f40 r8:00000004 r7:c228a438 r6:c0f95e18 r5:00000000 [ 1
er from pm_suspend+0x228/0x2bc [ 14.588868] r10:c3502910 r9:c3501f40 r8:00000004 r7:c228a438 r6:c0f95e18 r5:00000000 [ 14.588871] r4:00000003 [ 14.588874] pm_suspend from state_store+0x74/0xd0 [ 14.588889] r7:c228a438 r6:c0f934c8 r5:00000003 r4:00000003 [ 14.588892] state_store from kobj_attr_store+0x1c/0x28 [ 14.588913] r9:00000000 r8:00000000 r7:f09f9f08 r6:00000004 r5:c3502900 r4:c0283250 [ 14.588916] kobj_attr_store from sysfs_kf_write+0x40/0x4c [ 14.588936] r5:c3502900 r4:c0d92a48 [ 14.588939] sysfs_kf_write from kernfs_fop_write_iter+0x104/0x1f0 [ 14.588956] r5:c3502900 r4:c3501f40 [ 14.588960] kernfs_fop_write_iter from vfs_write+0x250/0x420 [ 14.588980] r10:c0e14b48 r9:00000000 r8:c2
00 r4:c3501f40 [ 14.588960] kernfs_fop_write_iter from vfs_write+0x250/0x420 [ 14.588980] r10:c0e14b48 r9:00000000 r8:c25f5780 r7:00443398 r6:f09f9f68 r5:c34f7f00 [ 14.588983] r4:c042a88c [ 14.588987] vfs_write from ksys_write+0x74/0xe4 [ 14.589005] r10:00000004 r9:c25f5780 r8:c02002fA0 r7:00000000 r6:00000000 r5:c34f7f00 [ 14.589008] r4:c34f7f00 [ 14.589011] ksys_write from sys_write+0x10/0x14 [ 14.589029] r7:00000004 r6:004421c0 r5:00443398 r4:00000004 [ 14.589032] sys_write from ret_fast_syscall+0x0/0x5c [ 14.589044] Exception stack(0xf09f9fa8 to 0xf09f9ff0) [ 14.589050] 9fa0: 00000004 00443398 00000004 00443398 00000004 00000001 [ 14.589056] 9fc0: 00000004 00443398 004421c0 00000004 b6ec
9fa0: 00000004 00443398 00000004 00443398 00000004 00000001 [ 14.589056] 9fc0: 00000004 00443398 004421c0 00000004 b6ecbd58 00000008 bebfbc38 0043eb78 [ 14.589062] 9fe0: 00440eb0 bebfbaf8 b6de18a0 b6e579e8 [ 14.589065] ---[ end trace 0000000000000000 ]--- The fix uses the higher level nand_reset(chip, chipnr); where chipnr = 0, when doing PM resume operation in compliance with the controller support for single die nand chip. Switching from nand_reset_op() to nan ---truncated--- Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/6f567c6a5250e3531cfd9c7ff254ecc2650464fa - https://git.kernel.org/stable/c/8775581e1c48e1bdd04a893d6f6bbe5128ad0ea7 - h
/6f567c6a5250e3531cfd9c7ff254ecc2650464fa - https://git.kernel.org/stable/c/8775581e1c48e1bdd04a893d6f6bbe5128ad0ea7 - https://git.kernel.org/stable/c/fbcb584efa5cd912ff8a151d67b8fe22f4162a85 - https://git.kernel.org/stable/c/9dd161f707ecb7db38e5f529e979a5b6eb565b2d - https://git.kernel.org/stable/c/9bd51723ab51580e077c91d494c37e80703b8524 - https://git.kernel.org/stable/c/7266066b9469f04ed1d4c0fdddaea1425835eb55 - https://git.kernel.org/stable/c/c2eb3cffb0d972c5503e4d48921971c81def0fe5 - https://git.kernel.org/stable/c/659b1f29f3e2fd5d751fdf35c5526d1f1c9b3dd2 - https://git.kernel.org/stable/c/ddc210cf8b8a8be68051ad958bf3e2cef6b681c2
CVE ID: CVE-2025-37841 State: PUBLISHED Published: 2025-05-09T06:41:50.684Z Last Updated: 2025-11-03T19:56:17.871Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: pm: cpupower: bench: Prevent NULL dereference on malloc failure If malloc returns NULL due to low memory, 'config' pointer can be NULL. Add a check to prevent NULL dereference. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/34a9394794b0f97af6afedc0c9ee2012c24b28ed - https://git.kernel.org/stable/c/79bded9d70142d2a11d931fc029afece471641db - https://git.kernel.org/stable/c/0e297a02e03dceb2874789ca40bd4e65c5371704 - https:
ed9d70142d2a11d931fc029afece471641db - https://git.kernel.org/stable/c/0e297a02e03dceb2874789ca40bd4e65c5371704 - https://git.kernel.org/stable/c/87b9f0867c0afa7e892f4b30c36cff6bf2707f85 - https://git.kernel.org/stable/c/942a4b97fc77516678b1d8af1521ff9a94c13b3e - https://git.kernel.org/stable/c/f8d28fa305b78c5d1073b63f26db265ba8291ae1 - https://git.kernel.org/stable/c/ceec06f464d5cfc0ba966225f7d50506ceb62242 - https://git.kernel.org/stable/c/5e38122aa3fd0f9788186e86a677925bfec0b2d1 - https://git.kernel.org/stable/c/208baa3ec9043a664d9acfb8174b332e6b17fb69
CVE ID: CVE-2025-37842 State: PUBLISHED Published: 2025-05-09T06:41:51.310Z Last Updated: 2025-09-09T17:05:56.648Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: spi: fsl-qspi: use devm function instead of driver remove Driver use devm APIs to manage clk/irq/resources and register the spi controller, but the legacy remove function will be called first during device detach and trigger kernel panic. Drop the remove function and use devm_add_action_or_reset() for driver cleanup to ensure the release sequence. Trigger kernel panic on i.MX8MQ by echo 30bb0000.spi >/sys/bus/platform/drivers/fsl-quadspi/unbind References: - https://gi
gger kernel panic on i.MX8MQ by echo 30bb0000.spi >/sys/bus/platform/drivers/fsl-quadspi/unbind References: - https://git.kernel.org/stable/c/50ae352c1848cab408fb4f7d7f50c71f818bbdbf - https://git.kernel.org/stable/c/f68b27d82a749117d9c7d7f33fa53f46373e38e2 - https://git.kernel.org/stable/c/439688dbe82baa10d4430dc3252bb5ef1183a171 - https://git.kernel.org/stable/c/f9bfb3a5f6f616f3eb7665c8ff3bcb9760ae33c8 - https://git.kernel.org/stable/c/40369bfe717e96e26650eeecfa5a6363563df6e4
CVE ID: CVE-2025-37843 State: PUBLISHED Published: 2025-05-09T06:41:52.160Z Last Updated: 2025-05-26T05:22:07.043Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: PCI: pciehp: Avoid unnecessary device replacement check Hot-removal of nested PCI hotplug ports suffers from a long-standing race condition which can lead to a deadlock: A parent hotplug port acquires pci_lock_rescan_remove(), then waits for pciehp to unbind from a child hotplug port. Meanwhile that child hotplug port tries to acquire pci_lock_rescan_remove() as well in order to remove its own children. The deadlock only occurs if the parent acquires pci_lock_rescan_re
remove() as well in order to remove its own children. The deadlock only occurs if the parent acquires pci_lock_rescan_remove() first, not if the child happens to acquire it first. Several workarounds to avoid the issue have been proposed and discarded over the years, e.g.: https://lore.kernel.org/r/4c882e25194ba8282b78fe963fec8faae7cf23eb.1529173804.git.lukas@wunner.de/ A proper fix is being worked on, but needs more time as it is nontrivial and necessarily intrusive. Recent commit 9d573d19547b ("PCI: pciehp: Detect device replacement during system sleep") provokes more frequent occurrence of the deadlock when removing more than one Thunderbolt device during system sleep. The commit sought t
quent occurrence of the deadlock when removing more than one Thunderbolt device during system sleep. The commit sought to detect device replacement, but also triggered on device removal. Differentiating reliably between replacement and removal is impossible because pci_get_dsn() returns 0 both if the device was removed, as well as if it was replaced with one lacking a Device Serial Number. Avoid the more frequent occurrence of the deadlock by checking whether the hotplug port itself was hot-removed. If so, there's no sense in checking whether its child device was replaced. This works because the ->resume_noirq() callback is invoked in top-down order for the entire hierarchy: A parent hotplug
This works because the ->resume_noirq() callback is invoked in top-down order for the entire hierarchy: A parent hotplug port detecting device replacement (or removal) marks all children as removed using pci_dev_set_disconnected() and a child hotplug port can then reliably detect being removed. References: - https://git.kernel.org/stable/c/e4a1d7defbc2d806540720a5adebe24ec3488683 - https://git.kernel.org/stable/c/0d0bbd01f7c0ac7d1be9f85aaf2cd0baec34655f - https://git.kernel.org/stable/c/7535d10a2c61baeff493300070cf04d9ddda216b - https://git.kernel.org/stable/c/e3260237aaadc9799107ccb940c6688195c4518d
CVE ID: CVE-2025-37844 State: PUBLISHED Published: 2025-05-09T06:41:53.224Z Last Updated: 2025-11-03T19:56:20.631Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cifs: avoid NULL pointer dereference in dbg call cifs_server_dbg() implies server to be non-NULL so move call under condition to avoid NULL pointer dereference. Found by Linux Verification Center (linuxtesting.org) with SVACE. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/ba3ce6c60cd5db258687dfeba9fc608f5e7cadf3 - https://git.kernel.org/stable/c/9c9000cb91b986eb7f75835340c67857ab97c09b - https://git.kernel.org/stable/c
08f5e7cadf3 - https://git.kernel.org/stable/c/9c9000cb91b986eb7f75835340c67857ab97c09b - https://git.kernel.org/stable/c/b2a1833e1c63e2585867ebeaf4dd41494dcede4b - https://git.kernel.org/stable/c/864ba5c651b03830f36f0906c21af05b15c1aaa6 - https://git.kernel.org/stable/c/e0717385f5c51e290c2cd2ad4699a778316b5132 - https://git.kernel.org/stable/c/20048e658652e731f5cadf4a695925e570ca0ff9 - https://git.kernel.org/stable/c/6c14ee6af8f1f188b668afd6d003f7516a507b08 - https://git.kernel.org/stable/c/b4885bd5935bb26f0a414ad55679a372e53f9b9b
CVE ID: CVE-2025-37845 State: PUBLISHED Published: 2025-05-09T06:41:54.022Z Last Updated: 2025-05-26T05:22:09.545Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tracing: fprobe events: Fix possible UAF on modules Commit ac91052f0ae5 ("tracing: tprobe-events: Fix leakage of module refcount") moved try_module_get() from __find_tracepoint_module_cb() to find_tracepoint() caller, but that introduced a possible UAF because the module can be unloaded before try_module_get(). In this case, the module object should be freed too. Thus, try_module_get() does not only fail but may access to the freed object. To avoid that, try_module_get
e freed too. Thus, try_module_get() does not only fail but may access to the freed object. To avoid that, try_module_get() in __find_tracepoint_module_cb() again. References: - https://git.kernel.org/stable/c/868df4eb784c3ccc7e4340a9ea993cbbedca167e - https://git.kernel.org/stable/c/a27d2de2472b1cc7d582ab405d1d5832a80481de - https://git.kernel.org/stable/c/626f01f4d26e8cf92e69c1df53036153c8e98a20 - https://git.kernel.org/stable/c/dd941507a9486252d6fcf11814387666792020f3
CVE ID: CVE-2025-37846 State: PUBLISHED Published: 2025-05-09T06:41:54.648Z Last Updated: 2025-05-26T05:22:10.850Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: arm64: mops: Do not dereference src reg for a set operation The source register is not used for SET* and reading it can result in a UBSAN out-of-bounds array access error, specifically when the MOPS exception is taken from a SET* sequence with XZR (reg 31) as the source. Architecturally this is the only case where a src/dst/size field in the ESR can be reported as 31. Prior to 2de451a329cf662b the code in do_el0_mops() was benign as the use of pt_regs_read_reg() preven
e reported as 31. Prior to 2de451a329cf662b the code in do_el0_mops() was benign as the use of pt_regs_read_reg() prevented the out-of-bounds access. References: - https://git.kernel.org/stable/c/eec737e17e5567e08148550a7f1d94d495b9fb17 - https://git.kernel.org/stable/c/43267d934eacff6c70e15545d804ebbcab8a0bf5 - https://git.kernel.org/stable/c/5f6022a74147675124b781fdc056b291850e7786 - https://git.kernel.org/stable/c/a13bfa4fe0d6949cea14718df2d1fe84c38cd113
CVE ID: CVE-2025-37847 State: PUBLISHED Published: 2025-05-09T06:41:55.289Z Last Updated: 2025-05-26T05:22:12.157Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix deadlock in ivpu_ms_cleanup() Fix deadlock in ivpu_ms_cleanup() by preventing runtime resume after file_priv->ms_lock is acquired. During a failure in runtime resume, a cold boot is executed, which calls ivpu_ms_cleanup_all(). This function calls ivpu_ms_cleanup() that acquires file_priv->ms_lock and causes the deadlock. References: - https://git.kernel.org/stable/c/7d12a7d43c7bab9097ba466581d8db702e7908dc - https://git.kernel.org/stable/c/f996ecc789b5d
https://git.kernel.org/stable/c/7d12a7d43c7bab9097ba466581d8db702e7908dc - https://git.kernel.org/stable/c/f996ecc789b5dbaaf38b6ec0a1917821789cbd9c - https://git.kernel.org/stable/c/019634f27a16796eab749e8107dae32099945f29 - https://git.kernel.org/stable/c/9a6f56762d23a1f3af15e67901493c927caaf882
CVE ID: CVE-2025-37848 State: PUBLISHED Published: 2025-05-09T06:41:55.933Z Last Updated: 2025-05-26T05:22:13.437Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix PM related deadlocks in MS IOCTLs Prevent runtime resume/suspend while MS IOCTLs are in progress. Failed suspend will call ivpu_ms_cleanup() that would try to acquire file_priv->ms_lock, which is already held by the IOCTLs. References: - https://git.kernel.org/stable/c/afada73000bef7c79a22f0d7e93fac414eeff19e - https://git.kernel.org/stable/c/c3d9fc2f2746b52e9f820a13c53b4418bec04b48 - https://git.kernel.org/stable/c/84547128526441b45c3c241419dececf20c30
table/c/c3d9fc2f2746b52e9f820a13c53b4418bec04b48 - https://git.kernel.org/stable/c/84547128526441b45c3c241419dececf20c30104 - https://git.kernel.org/stable/c/d893da85e06edf54737bb80648bb58ba8fd56d9f
CVE ID: CVE-2025-37849 State: PUBLISHED Published: 2025-05-09T06:41:56.874Z Last Updated: 2025-11-03T19:56:22.007Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Tear down vGIC on failed vCPU creation If kvm_arch_vcpu_create() fails to share the vCPU page with the hypervisor, we propagate the error back to the ioctl but leave the vGIC vCPU data initialised. Note only does this leak the corresponding memory when the vCPU is destroyed but it can also lead to use-after-free if the redistributor device handling tries to walk into the vCPU. Add the missing cleanup to kvm_arch_vcpu_create(), ensuring that the vGIC vCPU st
handling tries to walk into the vCPU. Add the missing cleanup to kvm_arch_vcpu_create(), ensuring that the vGIC vCPU structures are destroyed on error. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/07476e0d932afc53c05468076393ac35d0b4999e - https://git.kernel.org/stable/c/5085e02362b9948f82fceca979b8f8e12acb1cc5 - https://git.kernel.org/stable/c/c322789613407647a05ff5c451a7bf545fb34e73 - https://git.kernel.org/stable/c/2480326eba8ae9ccc5e4c3c2dc8d407db68e3c52 - https://git.kernel.org/stable/c/f1e9087abaeedec9bf2894a282ee4f0d8383f299 - https://git.kernel.org/stable/c/250f25367b58d8c65a1b060a2dda037eea09a672
CVE ID: CVE-2025-37850 State: PUBLISHED Published: 2025-05-09T06:41:57.784Z Last Updated: 2025-11-03T19:56:24.773Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() With CONFIG_COMPILE_TEST && !CONFIG_HAVE_CLK, pwm_mediatek_config() has a divide-by-zero in the following line: do_div(resolution, clk_get_rate(pc->clk_pwms[pwm->hwpwm])); due to the fact that the !CONFIG_HAVE_CLK version of clk_get_rate() returns zero. This is presumably just a theoretical problem: COMPILE_TEST overrides the dependency on RALINK which would select COMMON_CLK. Regardless it's a good idea to
l problem: COMPILE_TEST overrides the dependency on RALINK which would select COMMON_CLK. Regardless it's a good idea to check for the error explicitly to avoid divide-by-zero. Fixes the following warning: drivers/pwm/pwm-mediatek.o: warning: objtool: .text: unexpected end of section [ukleinek: s/CONFIG_CLK/CONFIG_HAVE_CLK/] Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/8b9f60725d74b72c238e4437c957d0217746b506 - https://git.kernel.org/stable/c/e1206d8e1651c9f62e5640b69b14d925b1a0a00a - https://git.kernel.org/stable/c/e3cf0c38d3ce754ad63005102fcfeb0b7ff3290b - https://git.kernel.org/stable/c/f3e9cf266c2c103cf071e15d7a17e2c699fff3c5 - https://
38d3ce754ad63005102fcfeb0b7ff3290b - https://git.kernel.org/stable/c/f3e9cf266c2c103cf071e15d7a17e2c699fff3c5 - https://git.kernel.org/stable/c/8ddbec73ea2598d8414e8f7103241b55cf877010 - https://git.kernel.org/stable/c/4cb15042b5f3ec0474e91cf379120cc597625dbb - https://git.kernel.org/stable/c/c343856ff2689ce0afef823592732fc178ef4aac - https://git.kernel.org/stable/c/77fb96dbe350e8a5ae4965ff9f6e7049f3966a6b - https://git.kernel.org/stable/c/7ca59947b5fcf94e7ea4029d1bd0f7c41500a161
CVE ID: CVE-2025-37851 State: PUBLISHED Published: 2025-05-09T06:41:58.466Z Last Updated: 2025-11-03T19:56:27.631Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: Add 'plane' value check Function dispc_ovl_setup is not intended to work with the value OMAP_DSS_WB of the enum parameter plane. The value of this parameter is initialized in dss_init_overlays and in the current state of the code it cannot take this value so it's not a real problem. For the purposes of defensive coding it wouldn't be superfluous to check the parameter value, because some functions down the call stack process this value correctly and some
perfluous to check the parameter value, because some functions down the call stack process this value correctly and some not. For example, in dispc_ovl_setup_global_alpha it may lead to buffer overflow. Add check for this value. Found by Linux Verification Center (linuxtesting.org) with SVACE static analysis tool. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/a570efb4d877adbf3db2dc95487f2ba6bfdd148a - https://git.kernel.org/stable/c/cdf41d72e8b015d9ea68f5a1c0a79624e7c312aa - https://git.kernel.org/stable/c/09dbf22fd68c2f1a81ab89670ffa1ec3033436c4 - https://git.kernel.org/stable/c/660a53a0694d1f3789802509fe729dd4656fc5e0 - https://git.kernel.
1ab89670ffa1ec3033436c4 - https://git.kernel.org/stable/c/660a53a0694d1f3789802509fe729dd4656fc5e0 - https://git.kernel.org/stable/c/fda15c5b96b883d62fb2d84a3a1422aa87717897 - https://git.kernel.org/stable/c/52eafaa56f8f6d6a0cdff9282b25b4acbde34edc - https://git.kernel.org/stable/c/9b0a41589ee70529b20e1e0108d03f10c649bdc4 - https://git.kernel.org/stable/c/4efd8ef5e40f2c7a4a91a5a9f03140bfa827da89 - https://git.kernel.org/stable/c/3e411827f31db7f938a30a3c7a7599839401ec30
CVE ID: CVE-2025-37852 State: PUBLISHED Published: 2025-05-09T06:41:59.094Z Last Updated: 2025-11-03T19:56:29.052Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() Add error handling to propagate amdgpu_cgs_create_device() failures to the caller. When amdgpu_cgs_create_device() fails, release hwmgr and return -ENOMEM to prevent null pointer dereference. [v1]->[v2]: Change error code from -EINVAL to -ENOMEM. Free hwmgr. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/55ef52c30c3e747f145a64de96192e37a8fed6
yst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/55ef52c30c3e747f145a64de96192e37a8fed670 - https://git.kernel.org/stable/c/f8693e1bae9c08233a2f535c3f412e157df32b33 - https://git.kernel.org/stable/c/dc4380f34613eaae997b3ed263bd1cb3d0fd0075 - https://git.kernel.org/stable/c/22ea19cc089013b55c240134dbb2797700ff5a6a - https://git.kernel.org/stable/c/b784734811438f11533e2fb9e0deb327844bdb56 - https://git.kernel.org/stable/c/1435e895d4fc967d64e9f5bf81e992ac32f5ac76
CVE ID: CVE-2025-37853 State: PUBLISHED Published: 2025-05-09T06:41:59.713Z Last Updated: 2025-09-16T08:02:59.747Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: debugfs hang_hws skip GPU with MES debugfs hang_hws is used by GPU reset test with HWS, for MES this crash the kernel with NULL pointer access because dqm->packet_mgr is not setup for MES path. Skip GPU with MES for now, MES hang_hws debugfs interface will be supported later. References: - https://git.kernel.org/stable/c/a36f8d544522a19ef06ed9e84667d154dcb6be52 - https://git.kernel.org/stable/c/1a322b330dc0b775d1d7a84e55c752d9451bfe7d - https://git.kernel.o
6ed9e84667d154dcb6be52 - https://git.kernel.org/stable/c/1a322b330dc0b775d1d7a84e55c752d9451bfe7d - https://git.kernel.org/stable/c/f84c57906f0fd2185e557d2552b20aa8430a4677 - https://git.kernel.org/stable/c/24b9e0e2e6147314c22d821f0542c4dd9a320c40 - https://git.kernel.org/stable/c/fe9d0061c413f8fb8c529b18b592b04170850ded
CVE ID: CVE-2025-37854 State: PUBLISHED Published: 2025-05-09T06:42:00.663Z Last Updated: 2025-11-03T19:56:30.426Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix mode1 reset crash issue If HW scheduler hangs and mode1 reset is used to recover GPU, KFD signal user space to abort the processes. After process abort exit, user queues still use the GPU to access system memory before h/w is reset while KFD cleanup worker free system memory and free VRAM. There is use-after-free race bug that KFD allocate and reuse the freed system memory, and user queue write to the same system memory to corrupt the data structure and
cate and reuse the freed system memory, and user queue write to the same system memory to corrupt the data structure and cause driver crash. To fix this race, KFD cleanup worker terminate user queues, then flush reset_domain wq to wait for any GPU ongoing reset complete, and then free outstanding BOs. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/57c9dabda80ac167de8cd71231baae37cc2f442d - https://git.kernel.org/stable/c/89af6b39f028c130d4362f57042927f005423e6a - https://git.kernel.org/stable/c/ffd37d7d44d7e0b6e769d4fe6590e327f8cc3951 - https://git.kernel.org/stable/c/6f30a847432cae84c7428e9b684b3e3fa49b2391 - https://git.kernel.org/stable/c/
27f8cc3951 - https://git.kernel.org/stable/c/6f30a847432cae84c7428e9b684b3e3fa49b2391 - https://git.kernel.org/stable/c/9c4bcdf4068aae3e17e31c144300be405cfa03ff - https://git.kernel.org/stable/c/f0b4440cdc1807bb6ec3dce0d6de81170803569b
CVE ID: CVE-2025-37855 State: PUBLISHED Published: 2025-05-09T06:42:03.545Z Last Updated: 2025-06-19T12:56:48.089Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Guard Possible Null Pointer Dereference [WHY] In some situations, dc->res_pool may be null. [HOW] Check if pointer is null before dereference. References: - https://git.kernel.org/stable/c/dc2de1ac7145f882f3c03d2d6f84583ae7e35d41 - https://git.kernel.org/stable/c/c87d202692de34ee71d1fd4679a549a29095658a
CVE ID: CVE-2025-37856 State: PUBLISHED Published: 2025-05-09T06:42:04.315Z Last Updated: 2025-05-26T05:22:23.651Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: btrfs: harden block_group::bg_list against list_del() races As far as I can tell, these calls of list_del_init() on bg_list cannot run concurrently with btrfs_mark_bg_unused() or btrfs_mark_bg_to_reclaim(), as they are in transaction error paths and situations where the block group is readonly. However, if there is any chance at all of racing with mark_bg_unused(), or a different future user of bg_list, better to be safe than sorry. Otherwise we risk the following inte