Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. References: - https://git.kernel.org/stable/c/fdd43fe6d286f27b826572457a89c926f97e2d3a - https://git.kernel.org/stable/c/1198077606aeffb102587c6ea079ce99641c99d4 - https://git.kernel.org/stable/c/1857cdca12c4aff58bf26a7005a4d02850c29927 - https://git.kernel.org/stable/c/91eda032eb16e5d2be27c95584665bc555bb5a90 - https://git.kernel.org/stable/c/dc766c4830a7e1e1ee9d7f77d4ab344f2eb23c8e - https://git.kernel.org/stable/c/5ef9c94d7110e90260c06868cf1dcf899b9f25ee - https://git.kernel.org/stable/c/e50377c6b3f278c9f3ef017ffce17f5fcc9dace4 - https://git.kernel.org/stable/c/47b49c06eb62504075f0f2e2227aee2e2
rg/stable/c/e50377c6b3f278c9f3ef017ffce17f5fcc9dace4 - https://git.kernel.org/stable/c/47b49c06eb62504075f0f2e2227aee2e2c2a58b3
CVE ID: CVE-2025-40125 State: PUBLISHED Published: 2025-11-12T10:23:20.180Z Last Updated: 2025-11-12T10:23:20.180Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx In __blk_mq_update_nr_hw_queues() the return value of blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx fails, later changing the number of hw_queues or removing disk will trigger the following warning: kernfs: can not remove 'nr_tags', no directory WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160 Call Trace: remove_files.isra.1+0x3
ARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160 Call Trace: remove_files.isra.1+0x38/0xb0 sysfs_remove_group+0x4d/0x100 sysfs_remove_groups+0x31/0x60 __kobject_del+0x23/0xf0 kobject_del+0x17/0x40 blk_mq_unregister_hctx+0x5d/0x80 blk_mq_sysfs_unregister_hctxs+0x94/0xd0 blk_mq_update_nr_hw_queues+0x124/0x760 nullb_update_nr_hw_queues+0x71/0xf0 [null_blk] nullb_device_submit_queues_store+0x92/0x120 [null_blk] kobjct_del() was called unconditionally even if sysfs creation failed. Fix it by checkig the kobject creation statusbefore deleting it. References: - https://git.kernel.org/stable/c/a8c53553f1833cc2d14175d2d72cf37193a01898 - https://git.kernel.org/stabl
t. References: - https://git.kernel.org/stable/c/a8c53553f1833cc2d14175d2d72cf37193a01898 - https://git.kernel.org/stable/c/cc14ea21c4e658814d737ed4dedde6cd626a15ad - https://git.kernel.org/stable/c/4b97e99b87a773d52699521d40864f3ec888e9a6 - https://git.kernel.org/stable/c/6e7dadc5763c48eb3b9b91265a21f312599ebb2c - https://git.kernel.org/stable/c/06c4826b1d900611096e4621e93133db57e13911 - https://git.kernel.org/stable/c/babc634e9fe2803962dba98a07587e835dbc0731 - https://git.kernel.org/stable/c/d5ddd76ee52bdc16e9f8b1e7791291e785dab032 - https://git.kernel.org/stable/c/4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed
CVE ID: CVE-2025-40126 State: PUBLISHED Published: 2025-11-12T10:23:20.460Z Last Updated: 2025-11-12T10:23:20.460Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. This commit fixes a couple of bad calculations. This will fix the return value of copy_from_user and copy_to_user in the faulting case. The
couple of bad calculations. This will fix the return value of copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. References: - https://git.kernel.org/stable/c/0bf3dc3a2156f1c5ddaba4b85d09767874634114 - https://git.kernel.org/stable/c/41c18baee66134e6ef786eb075c1b6adb22432b0 - https://git.kernel.org/stable/c/59424dc0d0e044b2eb007686a4724ddd91d57db5 - https://git.kernel.org/stable/c/9b137f277cc3297044aabd950f589e505d30104c - https://git.kernel.org/stable/c/674ff598148a28bae0b5372339de56f2abf0b1d1 - https://git.kernel.org/stable/c/7de3a75bbc8465d816336c74d50109e73501efab - https://git.kernel.org/stable/c/57c278500fce3cd4e1c540700c0b05426a958393 - http
e3a75bbc8465d816336c74d50109e73501efab - https://git.kernel.org/stable/c/57c278500fce3cd4e1c540700c0b05426a958393 - https://git.kernel.org/stable/c/4fba1713001195e59cfc001ff1f2837dab877efb
CVE ID: CVE-2025-40127 State: PUBLISHED Published: 2025-11-12T10:23:20.775Z Last Updated: 2025-11-12T10:23:20.775Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: hwrng: ks-sa - fix division by zero in ks_sa_rng_init Fix division by zero in ks_sa_rng_init caused by missing clock pointer initialization. The clk_get_rate() call is performed on an uninitialized clk pointer, resulting in division by zero when calculating delay values. Add clock initialization code before using the clock. drivers/char/hw_random/ks-sa-rng.c | 7 +++++++ 1 file changed, 7 insertions(+) References: - https://git.kernel.org/stable/c/692a04a1e0cde1d80a33df
a-rng.c | 7 +++++++ 1 file changed, 7 insertions(+) References: - https://git.kernel.org/stable/c/692a04a1e0cde1d80a33df0078c755cf02cd7268 - https://git.kernel.org/stable/c/d76b099011fa056950f63d05ebb6160991242f6a - https://git.kernel.org/stable/c/eec7e0e19c1fa75dc65e25aa6a21ef24a03849af - https://git.kernel.org/stable/c/f4238064379a91e71a9c258996acac43c50c2094 - https://git.kernel.org/stable/c/2b6bcce32cb5aff84588a844a4d3f6dd5353b8e2 - https://git.kernel.org/stable/c/55a70e1de75e5ff5f961c79a2cdc6a4468cc2bf2 - https://git.kernel.org/stable/c/612b1dfeb414dfa780a6316014ceddf9a74ff5c0
CVE ID: CVE-2025-40128 State: REJECTED Published: 2025-11-12T10:23:21.061Z Last Updated: 2025-11-13T17:37:15.477Z Description: No description available.
CVE ID: CVE-2025-40129 State: PUBLISHED Published: 2025-11-12T10:23:21.327Z Last Updated: 2025-11-12T10:23:21.327Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix null pointer dereference on zero-length checksum In xdr_stream_decode_opaque_auth(), zero-length checksum.len causes checksum.data to be set to NULL. This triggers a NPD when accessing checksum.data in gss_krb5_verify_mic_v2(). This patch ensures that the value of checksum.len is not less than XDR_UNIT. References: - https://git.kernel.org/stable/c/81cec07d303186d0d8c623ef8b5ecd3b81e94cf6 - https://git.kernel.org/stable/c/affc03d44921f493deaae1d33151e3067a6
/stable/c/81cec07d303186d0d8c623ef8b5ecd3b81e94cf6 - https://git.kernel.org/stable/c/affc03d44921f493deaae1d33151e3067a6f9f8f - https://git.kernel.org/stable/c/ab9a70cd2386a0d70c164b0905dd66bc9af52e77 - https://git.kernel.org/stable/c/6df164e29bd4e6505c5a2e0e5f1e1f6957a16a42
CVE ID: CVE-2025-40130 State: PUBLISHED Published: 2025-11-12T10:23:21.605Z Last Updated: 2025-11-12T10:23:21.605Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling The cpu_latency_qos_add/remove/update_request interfaces lack internal synchronization by design, requiring the caller to ensure thread safety. The current implementation relies on the 'pm_qos_enabled' flag, which is insufficient to prevent concurrent access and cannot serve as a proper synchronization mechanism. This has led to data races and list corruption issues. A typical race condition call tra
oper synchronization mechanism. This has led to data races and list corruption issues. A typical race condition call trace is: [Thread A] ufshcd_pm_qos_exit() --> cpu_latency_qos_remove_request() --> cpu_latency_qos_apply(); --> pm_qos_update_target() --> plist_del <--(1) delete plist node --> memset(req, 0, sizeof(*req)); --> hba->pm_qos_enabled = false; [Thread B] ufshcd_devfreq_target --> ufshcd_devfreq_scale --> ufshcd_scale_clks --> ufshcd_pm_qos_update <--(2) pm_qos_enabled is true --> cpu_latency_qos_update_request --> pm_qos_update_target --> plist_del <--(3) plist node use-after-free Introduces a dedicated mutex to serialize PM QoS operations, preventing data races and ensuring safe
node use-after-free Introduces a dedicated mutex to serialize PM QoS operations, preventing data races and ensuring safe access to PM QoS resources, including sysfs interface reads. References: - https://git.kernel.org/stable/c/d9df61afb8d23c475f1be3c714da2c34c156ab01 - https://git.kernel.org/stable/c/79dde5f7dc7c038eec903745dc1550cd4139980e
CVE ID: CVE-2025-40131 State: PUBLISHED Published: 2025-11-12T10:23:21.879Z Last Updated: 2025-11-12T10:23:21.879Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu() In ath12k_dp_mon_rx_deliver_msdu(), peer lookup fails because rxcb->peer_id is not updated with a valid value. This is expected in monitor mode, where RX frames bypass the regular RX descriptor path that typically sets rxcb->peer_id. As a result, the peer is NULL, and link_id and link_valid fields in the RX status are not populated. This leads to a WARN_ON in mac80211 when it receives data frame from an a
lid fields in the RX status are not populated. This leads to a WARN_ON in mac80211 when it receives data frame from an associated station with invalid link_id. Fix this potential issue by using ppduinfo->peer_id, which holds the correct peer id for the received frame. This ensures that the peer is correctly found and the associated link metadata is updated accordingly. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 References: - https://git.kernel.org/stable/c/da64eb2da76ce5626238a951fdf3e81810454427 - https://git.kernel.org/stable/c/7ca61ed8b3f3fc9a7decd68039cb1d7d1238c566
CVE ID: CVE-2025-40132 State: PUBLISHED Published: 2025-11-12T10:23:22.195Z Last Updated: 2025-11-12T10:23:22.195Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback In create_sdw_dailink() check that sof_end->codec_info->add_sidecar is not NULL before calling it. The original code assumed that if include_sidecar is true, the codec on that link has an add_sidecar callback. But there could be other codecs on the same link that do not have an add_sidecar callback. References: - https://git.kernel.org/stable/c/aea038062edfca9c6e5ddcecd4611d5a80113b4e - https://git.kernel.
r callback. References: - https://git.kernel.org/stable/c/aea038062edfca9c6e5ddcecd4611d5a80113b4e - https://git.kernel.org/stable/c/a5416c0fc9e77b69f853dfb1e78bc05a7c06a789 - https://git.kernel.org/stable/c/87cab86925b7fa4c1c977bc191ac549a3b23f0ea
CVE ID: CVE-2025-40133 State: PUBLISHED Published: 2025-11-12T10:23:22.498Z Last Updated: 2025-11-12T10:23:22.498Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). mptcp_active_enable() is called from subflow_finish_connect(), which is icsk->icsk_af_ops->sk_rx_dst_set() and it's not always under RCU. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dst_dev_rcu(). References: - https://git.kernel.org/stable/c/ad16235c9d3ef7ec17c109ff39b7504f49d17072 - https://git.kernel.org/stable/c/cc976ec9e38bb79409de3261ba1dbb6868e2a53e - https://git.
3ef7ec17c109ff39b7504f49d17072 - https://git.kernel.org/stable/c/cc976ec9e38bb79409de3261ba1dbb6868e2a53e - https://git.kernel.org/stable/c/893c49a78d9f85e4b8081b908fb7c407d018106a
CVE ID: CVE-2025-40134 State: PUBLISHED Published: 2025-11-12T10:23:22.771Z Last Updated: 2025-11-12T10:23:22.771Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dm: fix NULL pointer dereference in __dm_suspend() There is a race condition between dm device suspend and table load that can lead to null pointer dereference. The issue occurs when suspend is invoked before table load completes: BUG: kernel NULL pointer dereference, address: 0000000000000054 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 6 PID: 6798 Comm: dmsetup Not tainted 6.6.0-g7e52f5f0ca9b #62 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01
etup Not tainted 6.6.0-g7e52f5f0ca9b #62 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:blk_mq_wait_quiesce_done+0x0/0x50 Call Trace: <TASK> blk_mq_quiesce_queue+0x2c/0x50 dm_stop_queue+0xd/0x20 __dm_suspend+0x130/0x330 dm_suspend+0x11a/0x180 dev_suspend+0x27e/0x560 ctl_ioctl+0x4cf/0x850 dm_ctl_ioctl+0xd/0x20 vfs_ioctl+0x1d/0x50 __se_sys_ioctl+0x9b/0xc0 __x64_sys_ioctl+0x19/0x30 x64_sys_call+0x2c4a/0x4620 do_syscall_64+0x9e/0x1b0 The issue can be triggered as below: T1 T2 dm_suspend table_load __dm_suspend dm_setup_md_queue dm_mq_init_request_queue blk_mq_init_allocated_queue => q->mq_ops = set->ops; (1) dm_stop_queue / dm_wait_for_completion =
_mq_init_request_queue blk_mq_init_allocated_queue => q->mq_ops = set->ops; (1) dm_stop_queue / dm_wait_for_completion => q->tag_set NULL pointer! (2) => q->tag_set = set; (3) Fix this by checking if a valid table (map) exists before performing request-based suspend and waiting for target I/O. When map is NULL, skip these table-dependent suspend steps. Even when map is NULL, no I/O can reach any target because there is no table loaded; I/O submitted in this state will fail early in the DM layer. Skipping the table-dependent suspend logic in this case is safe and avoids NULL pointer dereferences. References: - https://git.kernel.org/stable/c/9dc43ea6a20ff83fe9a5fe4be47ae0fbf2409b98 - https://
pointer dereferences. References: - https://git.kernel.org/stable/c/9dc43ea6a20ff83fe9a5fe4be47ae0fbf2409b98 - https://git.kernel.org/stable/c/30f95b7eda5966b81cb221bd569c0f095a068cf6 - https://git.kernel.org/stable/c/a0e54bd8d7ea79127fe9920df3ae36f85e79ac7c - https://git.kernel.org/stable/c/a802901b75e13cc306f1b7ab0f062135c8034e9e - https://git.kernel.org/stable/c/846cafc4725ca727d94f9c4b5f789c1a7c8fb6fe - https://git.kernel.org/stable/c/19ca4528666990be376ac3eb6fe667b03db5324d - https://git.kernel.org/stable/c/331c2dd8ca8bad1a3ac10cce847ffb76158eece4 - https://git.kernel.org/stable/c/8d33a030c566e1f105cd5bf27f37940b6367f3be
CVE ID: CVE-2025-40135 State: PUBLISHED Published: 2025-11-12T10:23:23.051Z Last Updated: 2025-11-12T10:23:23.051Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_xmit() Use RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent possible UAF. References: - https://git.kernel.org/stable/c/f7f9e924f23684b4b23cd9f976cceab24a968e34 - https://git.kernel.org/stable/c/9085e56501d93af9f2d7bd16f7fcfacdde47b99c
CVE ID: CVE-2025-40136 State: PUBLISHED Published: 2025-11-12T10:23:23.330Z Last Updated: 2025-11-12T10:23:23.330Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - request reserved interrupt for virtual function The device interrupt vector 3 is an error interrupt for physical function and a reserved interrupt for virtual function. However, the driver has not registered the reserved interrupt for virtual function. When allocating interrupts, the number of interrupts is allocated based on powers of two, which includes this interrupt. When the system enables GICv4 and the virtual function passthrough to the vi
wers of two, which includes this interrupt. When the system enables GICv4 and the virtual function passthrough to the virtual machine, releasing the interrupt in the driver triggers a warning. The WARNING report is: WARNING: CPU: 62 PID: 14889 at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4 Therefore, register a reserved interrupt for VF and set the IRQF_NO_AUTOEN flag to avoid that warning. References: - https://git.kernel.org/stable/c/854da2b0df1654d63963d587b12fec6068d89643 - https://git.kernel.org/stable/c/9228facb308157ac0bdd264b873187896f7a9c7a
CVE ID: CVE-2025-40137 State: PUBLISHED Published: 2025-11-12T10:23:23.624Z Last Updated: 2025-11-12T10:23:23.624Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to truncate first page in error path of f2fs_truncate() syzbot reports a bug as below: loop0: detected capacity change from 0 to 40427 F2FS-fs (loop0): Wrong SSA boundary, start(3584) end(4096) blocks(3072) F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock F2FS-fs (loop0): invalid crc value F2FS-fs (loop0): f2fs_convert_inline_folio: corrupted inline inode ino=3, i_addr[0]:0x1601, run fsck to fix. ------------[ cut here ]------------ kernel
ine_folio: corrupted inline inode ino=3, i_addr[0]:0x1601, run fsck to fix. ------------[ cut here ]------------ kernel BUG at fs/inode.c:753! RIP: 0010:clear_inode+0x169/0x190 fs/inode.c:753 Call Trace: <TASK> evict+0x504/0x9c0 fs/inode.c:810 f2fs_fill_super+0x5612/0x6fa0 fs/f2fs/super.c:5047 get_tree_bdev_flags+0x40e/0x4d0 fs/super.c:1692 vfs_get_tree+0x8f/0x2b0 fs/super.c:1815 do_new_mount+0x2a2/0x9e0 fs/namespace.c:3808 do_mount fs/namespace.c:4136 [inline] __do_sys_mount fs/namespace.c:4347 [inline] __se_sys_mount+0x317/0x410 fs/namespace.c:4324 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0
/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f During f2fs_evict_inode(), clear_inode() detects that we missed to truncate all page cache before destorying inode, that is because in below path, we will create page #0 in cache, but missed to drop it in error path, let's fix it. - evict - f2fs_evict_inode - f2fs_truncate - f2fs_convert_inline_inode - f2fs_grab_cache_folio : create page #0 in cache - f2fs_convert_inline_folio : sanity check failed, return -EFSCORRUPTED - clear_inode detects that inode->i_data.nrpages is not zero References: - https://git.kernel.org/stable/c/83a8e4efea022506a0e049e7206bdf8be9f78148
inode->i_data.nrpages is not zero References: - https://git.kernel.org/stable/c/83a8e4efea022506a0e049e7206bdf8be9f78148 - https://git.kernel.org/stable/c/a7b7ebdd7045a36454b3e388a2ecf50344fad9e6 - https://git.kernel.org/stable/c/3b0c8908faa18cded84d64822882a830ab1f4d26 - https://git.kernel.org/stable/c/9251a9e6e871cb03c4714a18efa8f5d4a8818450
CVE ID: CVE-2025-40138 State: PUBLISHED Published: 2025-11-12T10:23:23.912Z Last Updated: 2025-11-12T10:23:23.912Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid NULL pointer dereference in f2fs_check_quota_consistency() syzbot reported a f2fs bug as below: Oops: gen[ 107.736417][ T5848] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 UID: 0 PID: 5848 Comm: syz-executor263 Tainted: G W 6.17.0-rc1-syzkaller-00014-g0e39a731820a #0 PREEMPT_{RT,(full)} RIP: 0010:strcmp+0x3c/
omm: syz-executor263 Tainted: G W 6.17.0-rc1-syzkaller-00014-g0e39a731820a #0 PREEMPT_{RT,(full)} RIP: 0010:strcmp+0x3c/0xc0 lib/string.c:284 Call Trace: <TASK> f2fs_check_quota_consistency fs/f2fs/super.c:1188 [inline] f2fs_check_opt_consistency+0x1378/0x2c10 fs/f2fs/super.c:1436 __f2fs_remount fs/f2fs/super.c:2653 [inline] f2fs_reconfigure+0x482/0x1770 fs/f2fs/super.c:5297 reconfigure_super+0x224/0x890 fs/super.c:1077 do_remount fs/namespace.c:3314 [inline] path_mount+0xd18/0xfe0 fs/namespace.c:4112 do_mount fs/namespace.c:4133 [inline] __do_sys_mount fs/namespace.c:4344 [inline] __se_sys_mount+0x317/0x410 fs/namespace.c:4321 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscal
[inline] __se_sys_mount+0x317/0x410 fs/namespace.c:4321 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The direct reason is f2fs_check_quota_consistency() may suffer null-ptr-deref issue in strcmp(). The bug can be reproduced w/ below scripts: mkfs.f2fs -f /dev/vdb mount -t f2fs -o usrquota /dev/vdb /mnt/f2fs quotacheck -uc /mnt/f2fs/ umount /mnt/f2fs mount -t f2fs -o usrjquota=aquota.user,jqfmt=vfsold /dev/vdb /mnt/f2fs mount -t f2fs -o remount,usrjquota=,jqfmt=vfsold /dev/vdb /mnt/f2fs umount /mnt/f2fs So, before old_qname and new_qname comparison, we need to check whether they are all
dev/vdb /mnt/f2fs umount /mnt/f2fs So, before old_qname and new_qname comparison, we need to check whether they are all valid pointers, fix it. References: - https://git.kernel.org/stable/c/3f3458852bbfe79c60f2412b8b04677b96688b6e - https://git.kernel.org/stable/c/930a9a6ee8e7ffa20af4bffbfc2bbd21d83bf81c
CVE ID: CVE-2025-40139 State: PUBLISHED Published: 2025-11-12T10:23:24.216Z Last Updated: 2025-11-12T10:23:24.216Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). smc_clc_prfx_set() is called during connect() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dev_dst_rcu() under rcu_read_lock() after kernel_getsockname(). Note that the returned value of smc_clc_prfx_set() is not used in the caller. While at it, we change the 1st arg of smc_clc_prfx_set[46]_rcu() not to touch dst there. References: - https://git.
ler. While at it, we change the 1st arg of smc_clc_prfx_set[46]_rcu() not to touch dst there. References: - https://git.kernel.org/stable/c/0736993bfe5c7a9c744ae3fac62d769dfdae54e1 - https://git.kernel.org/stable/c/935d783e5de9b64587f3adb25641dd8385e64ddb
CVE ID: CVE-2025-40140 State: PUBLISHED Published: 2025-11-12T10:23:24.586Z Last Updated: 2025-11-12T10:23:24.586Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. This is the sequence of events that leads to the warning: rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); } rtl8150_set_multicast() { netif_stop_queue(); netif_wake_queue(); <-- wakes up TX queue before URB is done } rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); <-- double submission } rtl8
efore URB is done } rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); <-- double submission } rtl8150_set_multicast being the ndo_set_rx_mode callback should not be calling netif_stop_queue and notif_start_queue as these handle TX queue synchronization. The net core function dev_set_rx_mode handles the synchronization for rtl8150_set_multicast making it safe to remove these locks. References: - https://git.kernel.org/stable/c/cce3c0e21cdd15bcba5c35d3af1700186de8f187 - https://git.kernel.org/stable/c/1a08a37ac03d07a1608a1592791041cac979fbc3 - https://git.kernel.org/stable/c/54f8ef1a970a8376e5846ed90854decf7c00555d - https://git.kernel.org/stable/c/114e05344763a102a8844ef
t.kernel.org/stable/c/54f8ef1a970a8376e5846ed90854decf7c00555d - https://git.kernel.org/stable/c/114e05344763a102a8844efd96ec06ba99293ccd - https://git.kernel.org/stable/c/6394bade9daab8e318c165fe43bba012bf13cd8e - https://git.kernel.org/stable/c/6053e47bbf212b93c051beb4261d7d5a409d0ce3 - https://git.kernel.org/stable/c/9d72df7f5eac946f853bf49c428c4e87a17d91da - https://git.kernel.org/stable/c/958baf5eaee394e5fd976979b0791a875f14a179