Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
f the blocking switchdev notification chain, recursive notifications are possible which leads to the semaphore being acquired twice for reading and to lockdep warnings being generated [1]. Specifically, this can happen when the bridge driver processes a SWITCHDEV_BRPORT_UNOFFLOADED event which causes it to emit notifications about deferred events when calling switchdev_deferred_process(). Fix this by converting the notification chain to a raw notification chain in a similar fashion to the netdev notification chain. Protect the chain using the RTNL mutex by acquiring it when modifying the chain. Events are always informed under the RTNL mutex, but add an assertion in call_switchdev_blocking_n
modifying the chain. Events are always informed under the RTNL mutex, but add an assertion in call_switchdev_blocking_notifiers() to make sure this is not violated in the future. Maintain the "blocking" prefix as events are always emitted from process context and listeners are allowed to block. [1]: WARNING: possible recursive locking detected 6.14.0-rc4-custom-g079270089484 #1 Not tainted -------------------------------------------- ip/52731 is trying to acquire lock: ffffffff850918d8 ((switchdev_blocking_notif_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x58/0xa0 but task is already holding lock: ffffffff850918d8 ((switchdev_blocking_notif_chain).rwsem){++++}-{4:4}, at: bl
x58/0xa0 but task is already holding lock: ffffffff850918d8 ((switchdev_blocking_notif_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x58/0xa0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock((switchdev_blocking_notif_chain).rwsem); lock((switchdev_blocking_notif_chain).rwsem); *** DEADLOCK *** May be due to missing lock nesting notation 3 locks held by ip/52731: #0: ffffffff84f795b0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x727/0x1dc0 #1: ffffffff8731f628 (&net->rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x790/0x1dc0 #2: ffffffff850918d8 ((switchdev_blocking_notif_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x58/0xa0
0 #2: ffffffff850918d8 ((switchdev_blocking_notif_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x58/0xa0 stack backtrace: ... ? __pfx_down_read+0x10/0x10 ? __pfx_mark_lock+0x10/0x10 ? __pfx_switchdev_port_attr_set_deferred+0x10/0x10 blocking_notifier_call_chain+0x58/0xa0 switchdev_port_attr_notify.constprop.0+0xb3/0x1b0 ? __pfx_switchdev_port_attr_notify.constprop.0+0x10/0x10 ? mark_held_locks+0x94/0xe0 ? switchdev_deferred_process+0x11a/0x340 switchdev_port_attr_set_deferred+0x27/0xd0 switchdev_deferred_process+0x164/0x340 br_switchdev_port_unoffload+0xc8/0x100 [bridge] br_switchdev_blocking_event+0x29f/0x580 [bridge] notifier_call_chain+0xa2/0x440 blocking_notifier_call_chai
100 [bridge] br_switchdev_blocking_event+0x29f/0x580 [bridge] notifier_call_chain+0xa2/0x440 blocking_notifier_call_chain+0x6e/0xa0 switchdev_bridge_port_unoffload+0xde/0x1a0 ... Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/af757f5ee3f754c5dceefb05c12ff37cb46fc682 - https://git.kernel.org/stable/c/1f7d051814e7a0cb1f0717ed5527c1059992129d - https://git.kernel.org/stable/c/a597d4b75669ec82c72cbee9fe75a15d04b35b2b - https://git.kernel.org/stable/c/f9ed3fb50b872bd78bcb01f25087f9e4e25085d8 - https://git.kernel.org/stable/c/62531a1effa87bdab12d5104015af72e60d926ff
CVE ID: CVE-2025-21987 State: PUBLISHED Published: 2025-04-02T12:30:11.811Z Last Updated: 2025-05-04T07:26:45.231Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: init return value in amdgpu_ttm_clear_buffer Otherwise an uninitialized value can be returned if amdgpu_res_cleared returns true for all regions. Possibly closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3812 (cherry picked from commit 7c62aacc3b452f73a1284198c81551035fac6d71) References: - https://git.kernel.org/stable/c/d2c9625b0ade41f9917875d88173a0cc802b95fc - https://git.kernel.org/stable/c/5bd98c2df4a0f2e2dcbdf563feb8d348406377b5 - https://git.
de41f9917875d88173a0cc802b95fc - https://git.kernel.org/stable/c/5bd98c2df4a0f2e2dcbdf563feb8d348406377b5 - https://git.kernel.org/stable/c/d3c7059b6a8600fc62cd863f1ea203b8675e63e1
CVE ID: CVE-2025-21988 State: PUBLISHED Published: 2025-04-02T12:53:12.170Z Last Updated: 2025-10-10T16:45:43.112Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fs/netfs/read_collect: add to next->prev_donated If multiple subrequests donate data to the same "next" request (depending on the subrequest completion order), each of them would overwrite the `prev_donated` field, causing data corruption and a BUG() crash ("Can't donate prior to front"). References: - https://git.kernel.org/stable/c/62b9ad7e52d4777f7e775ee1f0ad2452f6041024 - https://git.kernel.org/stable/c/e25cec3b76aba47a49138d2162fc809c6cd49c9e - https://git.kernel.
e775ee1f0ad2452f6041024 - https://git.kernel.org/stable/c/e25cec3b76aba47a49138d2162fc809c6cd49c9e - https://git.kernel.org/stable/c/e2d46f2ec332533816417b60933954173f602121
CVE ID: CVE-2025-21989 State: PUBLISHED Published: 2025-04-02T12:53:12.956Z Last Updated: 2025-10-01T17:14:12.545Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix missing .is_two_pixels_per_container Starting from 6.11, AMDGPU driver, while being loaded with amdgpu.dc=1, due to lack of .is_two_pixels_per_container function in dce60_tg_funcs, causes a NULL pointer dereference on PCs with old GPUs, such as R9 280X. So this fix adds missing .is_two_pixels_per_container to dce60_tg_funcs. (cherry picked from commit bd4b125eb949785c6f8a53b0494e32795421209d) Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
ry picked from commit bd4b125eb949785c6f8a53b0494e32795421209d) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/fefa811e616b5d0b555ed65743e528a0a8a0b377 - https://git.kernel.org/stable/c/36d04c9313d8d83ead92242f037099ac73e02120 - https://git.kernel.org/stable/c/e204aab79e01bc8ff750645666993ed8b719de57
CVE ID: CVE-2025-21990 State: PUBLISHED Published: 2025-04-02T12:53:13.590Z Last Updated: 2025-10-01T17:13:53.014Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: NULL-check BO's backing store when determining GFX12 PTE flags PRT BOs may not have any backing store, so bo->tbo.resource will be NULL. Check for that before dereferencing. (cherry picked from commit 3e3fcd29b505cebed659311337ea03b7698767fc) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/72235808eabea93055b459a63443bd9cd6b08aa4 - https://git.kernel.org/stable/c/af23e39b9e9280b1f6299b6f2fa090a1694240ad - htt
2235808eabea93055b459a63443bd9cd6b08aa4 - https://git.kernel.org/stable/c/af23e39b9e9280b1f6299b6f2fa090a1694240ad - https://git.kernel.org/stable/c/6cc30748e17ea2a64051ceaf83a8372484e597f1
CVE ID: CVE-2025-21991 State: PUBLISHED Published: 2025-04-02T12:53:14.230Z Last Updated: 2025-11-03T19:40:28.243Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes Currently, load_microcode_amd() iterates over all NUMA nodes, retrieves their CPU masks and unconditionally accesses per-CPU data for the first CPU of each mask. According to Documentation/admin-guide/mm/numaperf.rst: "Some memory may share the same node as a CPU, and others are provided as memory only nodes." Therefore, some node CPU masks may be empty and wouldn't have a "first CPU". On a machin
provided as memory only nodes." Therefore, some node CPU masks may be empty and wouldn't have a "first CPU". On a machine with far memory (and therefore CPU-less NUMA nodes): - cpumask_of_node(nid) is 0 - cpumask_first(0) is CONFIG_NR_CPUS - cpu_data(CONFIG_NR_CPUS) accesses the cpu_info per-CPU array at an index that is 1 out of bounds This does not have any security implications since flashing microcode is a privileged operation but I believe this has reliability implications by potentially corrupting memory while flashing a microcode update. When booting with CONFIG_UBSAN_BOUNDS=y on an AMD machine that flashes a microcode update. I get the following splat: UBSAN: array-index-out-of-bound
N_BOUNDS=y on an AMD machine that flashes a microcode update. I get the following splat: UBSAN: array-index-out-of-bounds in arch/x86/kernel/cpu/microcode/amd.c:X:Y index 512 is out of range for type 'unsigned long[512]' [...] Call Trace: dump_stack __ubsan_handle_out_of_bounds load_microcode_amd request_microcode_amd reload_store kernfs_fop_write_iter vfs_write ksys_write do_syscall_64 entry_SYSCALL_64_after_hwframe Change the loop to go over only NUMA nodes which have CPUs before determining whether the first CPU on the respective node needs microcode update. [ bp: Massage commit message, fix typo. ] Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: -
e commit message, fix typo. ] Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d509c4731090ebd9bbdb72c70a2d70003ae81f4f - https://git.kernel.org/stable/c/985a536e04bbfffb1770df43c6470f635a6b1073 - https://git.kernel.org/stable/c/18b5d857c6496b78ead2fd10001b81ae32d30cac - https://git.kernel.org/stable/c/ec52240622c4d218d0240079b7c1d3ec2328a9f4 - https://git.kernel.org/stable/c/e686349cc19e800dac8971929089ba5ff59abfb0 - https://git.kernel.org/stable/c/488ffc0cac38f203979f83634236ee53251ce593 - https://git.kernel.org/stable/c/5ac295dfccb5b015493f86694fa13a0dde4d3665 - https://git.kernel.org/stable/c/e3e89178a9f4a80092578af
t.kernel.org/stable/c/5ac295dfccb5b015493f86694fa13a0dde4d3665 - https://git.kernel.org/stable/c/e3e89178a9f4a80092578af3ff3c8478f9187d59
CVE ID: CVE-2025-21992 State: PUBLISHED Published: 2025-04-02T12:53:14.833Z Last Updated: 2025-11-03T19:40:30.985Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: HID: ignore non-functional sensor in HP 5MP Camera The HP 5MP Camera (USB ID 0408:5473) reports a HID sensor interface that is not actually implemented. Attempting to access this non-functional sensor via iio_info causes system hangs as runtime PM tries to wake up an unresponsive sensor. [453] hid-sensor-hub 0003:0408:5473.0003: Report latency attributes: ffffffff:ffffffff [453] hid-sensor-hub 0003:0408:5473.0003: common attributes: 5:1, 2:1, 3:1 ffffffff:ffffffff Add
tes: ffffffff:ffffffff [453] hid-sensor-hub 0003:0408:5473.0003: common attributes: 5:1, 2:1, 3:1 ffffffff:ffffffff Add this device to the HID ignore list since the sensor interface is non-functional by design and should not be exposed to userspace. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/9af297aea8f76a0ad21f2de5f2cd6401a748b9c3 - https://git.kernel.org/stable/c/b6c6c2d8ab4932e5d6d439f514276cb3d257b8fe - https://git.kernel.org/stable/c/007a849126ef7907761af6a1379400558a72e703 - https://git.kernel.org/stable/c/9acdb0059fb6b82158e15adae91e629cb5974564 - https://git.kernel.org/stable/c/7a7ada33879a631b05b536e66d1c5b1219d3bade - https://gi
9fb6b82158e15adae91e629cb5974564 - https://git.kernel.org/stable/c/7a7ada33879a631b05b536e66d1c5b1219d3bade - https://git.kernel.org/stable/c/6ca3d4d87af406a390a34ea924ab65c517e6e132 - https://git.kernel.org/stable/c/920ea73215dbf948b661b88a79cb47b7f96adfbd - https://git.kernel.org/stable/c/363236d709e75610b628c2a4337ccbe42e454b6d
CVE ID: CVE-2025-21993 State: PUBLISHED Published: 2025-04-02T12:53:15.513Z Last Updated: 2025-11-03T19:40:33.731Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() When performing an iSCSI boot using IPv6, iscsistart still reads the /sys/firmware/ibft/ethernetX/subnet-mask entry. Since the IPv6 prefix length is 64, this causes the shift exponent to become negative, triggering a UBSAN warning. As the concept of a subnet mask does not apply to IPv6, the value is set to ~0 to suppress the warning message. Additional Analyst Notes: - CISA ADP Vulnrichment: - CV
to IPv6, the value is set to ~0 to suppress the warning message. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/a858cd58dea06cf85b142673deea8c5d87f11e70 - https://git.kernel.org/stable/c/f763c82db8166e28f45b7cc4a5398a7859665940 - https://git.kernel.org/stable/c/b388e185bfad32bfed6a97a6817f74ca00a4318f - https://git.kernel.org/stable/c/9bfa80c8aa4e06dff55a953c3fffbfc68a3a3b1c - https://git.kernel.org/stable/c/2d1eef248107bdf3d5a69d0fde04c30a79a7bf5d - https://git.kernel.org/stable/c/b253660fac5e0e9080d2c95e3a029e1898d49afb - https://git.kernel.org/stable/c/c1c6e527470e5eab0b2d57bd073530fbace39eab - https://git.kernel.o
d2c95e3a029e1898d49afb - https://git.kernel.org/stable/c/c1c6e527470e5eab0b2d57bd073530fbace39eab - https://git.kernel.org/stable/c/07e0d99a2f701123ad3104c0f1a1e66bce74d6e5
CVE ID: CVE-2025-21994 State: PUBLISHED Published: 2025-04-02T14:00:37.407Z Last Updated: 2025-11-03T19:40:35.107Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix incorrect validation for num_aces field of smb_acl parse_dcal() validate num_aces to allocate posix_ace_state_array. if (num_aces > ULONG_MAX / sizeof(struct smb_ace *)) It is an incorrect validation that we can create an array of size ULONG_MAX. smb_acl has ->size field to calculate actual number of aces in request buffer size. Use this to check invalid num_aces. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/
check invalid num_aces. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/c3a3484d9d31b27a3db0fab91fcf191132d65236 - https://git.kernel.org/stable/c/9c4e202abff45f8eac17989e549fc7a75095f675 - https://git.kernel.org/stable/c/d0f87370622a853b57e851f7d5a5452b72300f19 - https://git.kernel.org/stable/c/a4cb17797a5d241f1e509cb5b46ed95a80c2f5fd - https://git.kernel.org/stable/c/f6a6721802ac2f12f4c1bbe839a4c229b61866f2 - https://git.kernel.org/stable/c/1b8b67f3c5e5169535e26efedd3e422172e2db64
CVE ID: CVE-2025-21995 State: PUBLISHED Published: 2025-04-03T07:18:59.178Z Last Updated: 2025-10-01T18:15:29.450Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix fence reference count leak The last_scheduled fence leaks when an entity is being killed and adding the cleanup callback fails. Decrement the reference count of prev when dma_fence_add_callback() fails, ensuring proper balance. [phasta: add git tag info for stable kernel] Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/c76bd3c99293834de7d1dca5de536616d5655e38 - https://git.kernel.org/stable/c/1135a94311605
https://git.kernel.org/stable/c/c76bd3c99293834de7d1dca5de536616d5655e38 - https://git.kernel.org/stable/c/1135a9431160575466ea9ac37ebd756ecbe35fff - https://git.kernel.org/stable/c/35399c84dcedd6d31448fb9e1336ef52673f2882 - https://git.kernel.org/stable/c/a952f1ab696873be124e31ce5ef964d36bce817f
CVE ID: CVE-2025-21996 State: PUBLISHED Published: 2025-04-03T07:18:59.933Z Last Updated: 2025-11-03T19:40:37.900Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() On the off chance that command stream passed from userspace via ioctl() call to radeon_vce_cs_parse() is weirdly crafted and first command to execute is to encode (case 0x03000001), the function in question will attempt to call radeon_vce_cs_reloc() with size argument that has not been properly initialized. Specifically, 'size' will point to 'tmp' variable before the latter had a chance to be assigned an
properly initialized. Specifically, 'size' will point to 'tmp' variable before the latter had a chance to be assigned any value. Play it safe and init 'tmp' with 0, thus ensuring that radeon_vce_cs_reloc() will catch an early error in cases like these. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. (cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/0effb378ebce52b897f85cd7f828854b8c7cb636 - https://git.kernel.org/stable/c/5b4d9d20fd455a97920cf158dd19163b879cf65d - https://git.kernel.org/stable/c/9b2da9c673a0da1359a
//git.kernel.org/stable/c/5b4d9d20fd455a97920cf158dd19163b879cf65d - https://git.kernel.org/stable/c/9b2da9c673a0da1359a2151f7ce773e2f77d71a9 - https://git.kernel.org/stable/c/78b07dada3f02f77762d0755a96d35f53b02be69 - https://git.kernel.org/stable/c/3ce08215cad55c10a6eeeb33d3583b6cfffe3ab8 - https://git.kernel.org/stable/c/dd1801aa01bba1760357f2a641346ae149686713 - https://git.kernel.org/stable/c/f5e049028124f755283f2c07e7a3708361ed1dc8 - https://git.kernel.org/stable/c/dd8689b52a24807c2d5ce0a17cb26dc87f75235c
CVE ID: CVE-2025-21997 State: PUBLISHED Published: 2025-04-03T07:19:00.583Z Last Updated: 2025-11-03T19:40:39.282Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: xsk: fix an integer overflow in xp_create_and_assign_umem() Since the i and pool->chunk_size variables are of type 'u32', their product can wrap around and then be cast to 'u64'. This can lead to two different XDP buffers pointing to the same memory area. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/205649d
l Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/205649d642a5b376724f04f3a5b3586815e43d3b - https://git.kernel.org/stable/c/b7b4be1fa43294b50b22e812715198629806678a - https://git.kernel.org/stable/c/130290f44bce0eead2b827302109afc3fe189ddd - https://git.kernel.org/stable/c/c7670c197b0f1a8726ad5c87bc2bf001a1fc1bbd - https://git.kernel.org/stable/c/559847f56769037e5b2e0474d3dbff985b98083d
CVE ID: CVE-2025-21998 State: PUBLISHED Published: 2025-04-03T07:19:02.272Z Last Updated: 2025-10-01T17:11:00.349Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: uefisecapp: fix efivars registration race Since the conversion to using the TZ allocator, the efivars service is registered before the memory pool has been allocated, something which can lead to a NULL-pointer dereference in case of a racing EFI variable access. Make sure that all resources have been set up before registering the efivars. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/c4e37b381a7a243c298
rs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/c4e37b381a7a243c298a4858fc0a5a74e737c79a - https://git.kernel.org/stable/c/f15a2b96a0e41c426c63a932d0e63cde7b9784aa - https://git.kernel.org/stable/c/da8d493a80993972c427002684d0742560f3be4a
CVE ID: CVE-2025-21999 State: PUBLISHED Published: 2025-04-03T07:19:03.040Z Last Updated: 2025-11-03T19:40:42.019Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: proc: fix UAF in proc_get_inode() Fix race between rmmod and /proc/XXX's inode instantiation. The bug is that pde->proc_ops don't belong to /proc, it belongs to a module, therefore dereferencing it after /proc entry has been registered is a bug unless use_pde/unuse_pde() pair has been used. use_pde/unuse_pde can be avoided (2 atomic ops!) because pde->proc_ops never changes so information necessary for inode instantiation can be saved _before_ proc_register() in PDE it
>proc_ops never changes so information necessary for inode instantiation can be saved _before_ proc_register() in PDE itself and used later, avoiding pde->proc_ops->... dereference. rmmod lookup sys_delete_module proc_lookup_de pde_get(de); proc_get_inode(dir->i_sb, de); mod->exit() proc_remove remove_proc_subtree proc_entry_rundown(de); free_module(mod); if (S_ISREG(inode->i_mode)) if (de->proc_ops->proc_read_iter) --> As module is already freed, will trigger UAF BUG: unable to handle page fault for address: fffffbfff80a702b PGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G Hardware name: QE
2ef4067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:proc_get_inode+0x302/0x6e0 RSP: 0018:ffff88811c837998 EFLAGS: 00010a06 RAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007 RDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158 RBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20 R10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0 R13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001 FS: 00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ff
b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> proc_lookup_de+0x11f/0x2e0 __lookup_slow+0x188/0x350 walk_component+0x2ab/0x4f0 path_lookupat+0x120/0x660 filename_lookup+0x1ce/0x560 vfs_statx+0xac/0x150 __do_sys_newstat+0x96/0x110 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e [adobriyan@gmail.com: don't do 2 atomic ops on the common path] Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE
adobriyan@gmail.com: don't do 2 atomic ops on the common path] Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/eda279586e571b05dff44d48e05f8977ad05855d - https://git.kernel.org/stable/c/4b0b8445b6fd41e6f62ac90547a0ea9d348de3fa - https://git.kernel.org/stable/c/966f331403dc3ed04ff64eaf3930cf1267965e53 - https://git.kernel.org/stable/c/63b53198aff2e4e6c5866a4ff73c7891f958ffa4 - https://git.kernel.org/stable/c/ede3e8ac90ae106f0b29cd759aadebc1568f1308 - https://git.kernel.org/stable/c/64dc7c68e040251d9ec6e989acb69f8f6ae4a10b - https://git.kernel.org/stable/c/654b33ada4ab5e926cd9c570196fefa7bec7c1df
CVE ID: CVE-2025-22000 State: PUBLISHED Published: 2025-04-03T07:19:03.652Z Last Updated: 2025-10-01T17:10:44.113Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: drop beyond-EOF folios with the right number of refs When an after-split folio is large and needs to be dropped due to EOF, folio_put_refs(folio, folio_nr_pages(folio)) should be used to drop all page cache refs. Otherwise, the folio will not be freed, causing memory leak. This leak would happen on a filesystem with blocksize > page_size and a truncate is performed, where the blocksize makes folios split to >0 order ones, causing truncated folios not be
ze and a truncate is performed, where the blocksize makes folios split to >0 order ones, causing truncated folios not being freed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/86368616a9ce51f6b41efa251b6e066893851d67 - https://git.kernel.org/stable/c/92ad820a1f2d95d5a8d6c2bd3f391bbb068a5f9e - https://git.kernel.org/stable/c/14efb4793519d73fb2902bb0ece319b886e4b4b9