Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
f` functionality, so add Adva-specific callbacks `ptp_ocp_sma_adva_set_outputs()` and `ptp_ocp_sma_adva_set_inputs()` that avoid invoking `irig` or `dcf` input/output routines. References: - https://git.kernel.org/stable/c/8a543d825e78b8d680d8f891381b83fbffdb0bb6 - https://git.kernel.org/stable/c/5b349f9cdb4a9daa133bea267dfc0c383628387a - https://git.kernel.org/stable/c/e98386d79a23c57cf179fe4138322e277aa3aa74
CVE ID: CVE-2025-37911 State: PUBLISHED Published: 2025-05-20T15:21:43.278Z Last Updated: 2025-11-03T19:57:12.296Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix out-of-bound memcpy() during ethtool -w When retrieving the FW coredump using ethtool, it can sometimes cause memory corruption: BUG: KFENCE: memory corruption in __bnxt_get_coredump+0x3ef/0x670 [bnxt_en] Corrupted memory at 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (in kfence-#45): __bnxt_get_coredump+0x3ef/0x670 [bnxt_en] ethtool_get_dump_data+0xdc/0x1a0 __dev_ethtool+0xa1e/0x1af0 dev_ethtool+0xa8/0x170 dev_ioctl+0x1b5/0x580 sock_do_ioctl+0x
thtool_get_dump_data+0xdc/0x1a0 __dev_ethtool+0xa1e/0x1af0 dev_ethtool+0xa8/0x170 dev_ioctl+0x1b5/0x580 sock_do_ioctl+0xab/0xf0 sock_ioctl+0x1ce/0x2e0 __x64_sys_ioctl+0x87/0xc0 do_syscall_64+0x5c/0xf0 entry_SYSCALL_64_after_hwframe+0x78/0x80 ... This happens when copying the coredump segment list in bnxt_hwrm_dbg_dma_data() with the HWRM_DBG_COREDUMP_LIST FW command. The info->dest_buf buffer is allocated based on the number of coredump segments returned by the FW. The segment list is then DMA'ed by the FW and the length of the DMA is returned by FW. The driver then copies this DMA'ed segment list to info->dest_buf. In some cases, this DMA length may exceed the info->dest_buf length and caus
this DMA'ed segment list to info->dest_buf. In some cases, this DMA length may exceed the info->dest_buf length and cause the above BUG condition. Fix it by capping the copy length to not exceed the length of info->dest_buf. The extra DMA data contains no useful information. This code path is shared for the HWRM_DBG_COREDUMP_LIST and the HWRM_DBG_COREDUMP_RETRIEVE FW commands. The buffering is different for these 2 FW commands. To simplify the logic, we need to move the line to adjust the buffer length for HWRM_DBG_COREDUMP_RETRIEVE up, so that the new check to cap the copy length will work for both commands. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel
length will work for both commands. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/69b10dd23ab826d0c7f2d9ab311842251978d0c1 - https://git.kernel.org/stable/c/43292b83424158fa6ec458799f3cb9c54d18c484 - https://git.kernel.org/stable/c/4d69864915a3a052538e4ba76cd6fd77cfc64ebe - https://git.kernel.org/stable/c/44807af79efd0d78fa36383dd865ddfe7992c0a6 - https://git.kernel.org/stable/c/44d81a9ebf0cad92512e0ffdf7412bfe20db66ec - https://git.kernel.org/stable/c/6b87bd94f34370bbf1dfa59352bed8efab5bf419
CVE ID: CVE-2025-37912 State: PUBLISHED Published: 2025-05-20T15:21:44.062Z Last Updated: 2025-11-03T19:57:13.684Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() As mentioned in the commit baeb705fd6a7 ("ice: always check VF VSI pointer values"), we need to perform a null pointer check on the return value of ice_get_vf_vsi() before using it. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/a32dcc3b8293600ddc4024731b4d027d4de061a4 - https://git.kernel.org/stable/c/0561f2e374c3732b90e50f0a244791a4308ec67e - https://git.kernel
dc4024731b4d027d4de061a4 - https://git.kernel.org/stable/c/0561f2e374c3732b90e50f0a244791a4308ec67e - https://git.kernel.org/stable/c/eae60cfe25d022d7f0321dba4cc23ad8e87ade48 - https://git.kernel.org/stable/c/073791e9cfe6e4a11a6d85816ba87b1aa207493e - https://git.kernel.org/stable/c/f68237982dc012230550f4ecf7ce286a9c37ddc9 - https://git.kernel.org/stable/c/425c5f266b2edeee0ce16fedd8466410cdcfcfe3
CVE ID: CVE-2025-37913 State: PUBLISHED Published: 2025-05-20T15:21:44.793Z Last Updated: 2025-11-03T19:57:15.106Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net_sched: qfq: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of qfq, there won't be a UAF, but the code will add the same classifier to the list twice, which will cause memory corruption. This patch checks whether the class was already added to the agg->active list (cl_is_active) before doing the addition to
is patch checks whether the class was already added to the agg->active list (cl_is_active) before doing the addition to cater for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/ Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/041f410aec2c1751ee22b8b73ba05d38c3a6a602 - https://git.kernel.org/stable/c/005a479540478a820c52de098e5e767e63e36f0a - https://git.kernel.org/stable/c/0bf32d6fb1fcbf841bb9945570e0e2a70072c00f - https://git.kernel.org/stable/c/0aa23e0856b7cedb3c88d8e3d281c212c7e4fbeb - https://git.kernel.org/stable/c/a43783119e01849fbf2fe8855634e8989b240cb4 - https:/
e0856b7cedb3c88d8e3d281c212c7e4fbeb - https://git.kernel.org/stable/c/a43783119e01849fbf2fe8855634e8989b240cb4 - https://git.kernel.org/stable/c/53bc0b55178bd59bdd4bcd16349505cabf54b1a2 - https://git.kernel.org/stable/c/370218e8ce711684acc4cdd3cc3c6dd7956bc165 - https://git.kernel.org/stable/c/f139f37dcdf34b67f5bf92bc8e0f7f6b3ac63aa4
CVE ID: CVE-2025-37914 State: PUBLISHED Published: 2025-05-20T15:21:45.796Z Last Updated: 2025-11-03T19:57:16.482Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of ets, there won't be a UAF, but the code will add the same classifier to the list twice, which will cause memory corruption. In addition to checking for qlen being zero, this patch checks whether the class was already added to the active_list (cl_
addition to checking for qlen being zero, this patch checks whether the class was already added to the active_list (cl_is_active) before doing the addition to cater for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/ Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/24388ba0a1b1b6d4af1b205927ac7f7b119ee4ea - https://git.kernel.org/stable/c/554acc5a2ea9703e08023eb9a003f9e5a830a502 - https://git.kernel.org/stable/c/9efb6a0fa88e0910d079fdfeb4f7ce4d4ac6c990 - https://git.kernel.org/stable/c/72c3da7e6ceb74e74ddbb5a305a35c9fdfcac6e3 - https://git.kernel.org/stable/c/1f01e9f961
- https://git.kernel.org/stable/c/72c3da7e6ceb74e74ddbb5a305a35c9fdfcac6e3 - https://git.kernel.org/stable/c/1f01e9f961605eb397c6ecd1d7b0233dfbf9077c - https://git.kernel.org/stable/c/bc321f714de693aae06e3786f88df2975376d996 - https://git.kernel.org/stable/c/1a6d0c00fa07972384b0c308c72db091d49988b6
CVE ID: CVE-2025-37915 State: PUBLISHED Published: 2025-05-20T15:21:46.440Z Last Updated: 2025-11-03T19:57:17.858Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net_sched: drr: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of drr, there won't be a UAF, but the code will add the same classifier to the list twice, which will cause memory corruption. In addition to checking for qlen being zero, this patch checks whether the class was already added to the active_list (cl_
addition to checking for qlen being zero, this patch checks whether the class was already added to the active_list (cl_is_active) before adding to the list to cover for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/ Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/5da3aad1a13e7edb8ff0778a444ccf49930313e9 - https://git.kernel.org/stable/c/4b07ac06b0a712923255aaf2691637693fc7100d - https://git.kernel.org/stable/c/2968632880f1792007eedd12eeedf7f6e2b7e9f3 - https://git.kernel.org/stable/c/4f0ecf50cdf76da95828578a92f130b653ac2fcf - https://git.kernel.org/stable/c/db205b92df
- https://git.kernel.org/stable/c/4f0ecf50cdf76da95828578a92f130b653ac2fcf - https://git.kernel.org/stable/c/db205b92dfe0501e5b92fb7cf00971d0e44ba3eb - https://git.kernel.org/stable/c/26e75716b94d6ff9be5ea07d63675c4d189f30b4 - https://git.kernel.org/stable/c/ab2248110738d4429668140ad22f530a9ee730e1 - https://git.kernel.org/stable/c/f99a3fbf023e20b626be4b0f042463d598050c9a
CVE ID: CVE-2025-37916 State: PUBLISHED Published: 2025-05-20T15:21:47.088Z Last Updated: 2025-05-26T05:23:38.953Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: pds_core: remove write-after-free of client_id A use-after-free error popped up in stress testing: [Mon Apr 21 21:21:33 2025] BUG: KFENCE: use-after-free write in pdsc_auxbus_dev_del+0xef/0x160 [pds_core] [Mon Apr 21 21:21:33 2025] Use-after-free write at 0x000000007013ecd1 (in kfence-#47): [Mon Apr 21 21:21:33 2025] pdsc_auxbus_dev_del+0xef/0x160 [pds_core] [Mon Apr 21 21:21:33 2025] pdsc_remove+0xc0/0x1b0 [pds_core] [Mon Apr 21 21:21:33 2025] pci_device_remove+0x24/0
s_core] [Mon Apr 21 21:21:33 2025] pdsc_remove+0xc0/0x1b0 [pds_core] [Mon Apr 21 21:21:33 2025] pci_device_remove+0x24/0x70 [Mon Apr 21 21:21:33 2025] device_release_driver_internal+0x11f/0x180 [Mon Apr 21 21:21:33 2025] driver_detach+0x45/0x80 [Mon Apr 21 21:21:33 2025] bus_remove_driver+0x83/0xe0 [Mon Apr 21 21:21:33 2025] pci_unregister_driver+0x1a/0x80 The actual device uninit usually happens on a separate thread scheduled after this code runs, but there is no guarantee of order of thread execution, so this could be a problem. There's no actual need to clear the client_id at this point, so simply remove the offending code. References: - https://git.kernel.org/stable/c/9b467c5bcdb45a41d2a
id at this point, so simply remove the offending code. References: - https://git.kernel.org/stable/c/9b467c5bcdb45a41d2a49fbb9ffca73d1380e99b - https://git.kernel.org/stable/c/c649b9653ed09196e91d3f4b16b679041b3c42e6 - https://git.kernel.org/stable/c/26dc701021302f11c8350108321d11763bd81dfe - https://git.kernel.org/stable/c/dfd76010f8e821b66116dec3c7d90dd2403d1396
CVE ID: CVE-2025-37917 State: PUBLISHED Published: 2025-05-20T15:21:47.703Z Last Updated: 2025-11-03T19:57:19.232Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll Use spin_lock_irqsave and spin_unlock_irqrestore instead of spin_lock and spin_unlock in mtk_star_emac driver to avoid spinlock recursion occurrence that can happen when enabling the DMA interrupts again in rx/tx poll. ``` BUG: spinlock recursion on CPU#0, swapper/0/0 lock: 0xffff00000db9cf20, .magic: dead4ead, .owner: swapper/0/0, .owner_cpu: 0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.
ff00000db9cf20, .magic: dead4ead, .owner: swapper/0/0, .owner_cpu: 0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.15.0-rc2-next-20250417-00001-gf6a27738686c-dirty #28 PREEMPT Hardware name: MediaTek MT8365 Open Platform EVK (DT) Call trace: show_stack+0x18/0x24 (C) dump_stack_lvl+0x60/0x80 dump_stack+0x18/0x24 spin_dump+0x78/0x88 do_raw_spin_lock+0x11c/0x120 _raw_spin_lock+0x20/0x2c mtk_star_handle_irq+0xc0/0x22c [mtk_star_emac] __handle_irq_event_percpu+0x48/0x140 handle_irq_event+0x4c/0xb0 handle_fasteoi_irq+0xa0/0x1bc handle_irq_desc+0x34/0x58 generic_handle_domain_irq+0x1c/0x28 gic_handle_irq+0x4c/0x120 do_interrupt_handler+0x50/0x84 el1_interrupt+0x34/0x68 el1h_64_irq_handler+0x18
_irq+0x1c/0x28 gic_handle_irq+0x4c/0x120 do_interrupt_handler+0x50/0x84 el1_interrupt+0x34/0x68 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x6c/0x70 regmap_mmio_read32le+0xc/0x20 (P) _regmap_bus_reg_read+0x6c/0xac _regmap_read+0x60/0xdc regmap_read+0x4c/0x80 mtk_star_rx_poll+0x2f4/0x39c [mtk_star_emac] __napi_poll+0x38/0x188 net_rx_action+0x164/0x2c0 handle_softirqs+0x100/0x244 __do_softirq+0x14/0x20 ____do_softirq+0x10/0x20 call_on_irq_stack+0x24/0x64 do_softirq_own_stack+0x1c/0x40 __irq_exit_rcu+0xd4/0x10c irq_exit_rcu+0x10/0x1c el1_interrupt+0x38/0x68 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x6c/0x70 cpuidle_enter_state+0xac/0x320 (P) cpuidle_enter+0x38/0x50 do_idle+0x1e4/0x260 cpu_start
0x18/0x24 el1h_64_irq+0x6c/0x70 cpuidle_enter_state+0xac/0x320 (P) cpuidle_enter+0x38/0x50 do_idle+0x1e4/0x260 cpu_startup_entry+0x34/0x3c rest_init+0xdc/0xe0 console_on_rootfs+0x0/0x6c __primary_switched+0x88/0x90 ``` Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/bedd287fdd3142dffad7ae2ac6ef15f4a2ad0629 - https://git.kernel.org/stable/c/94107259f972d2fd896dbbcaa176b3b2451ff9e5 - https://git.kernel.org/stable/c/7cb10f17bddc415f30fbc00a4e2b490e0d94c462 - https://git.kernel.org/stable/c/8d40bf73fa7f31eac2b0a7c9d85de67df82ee7f3 - https://git.kernel.org/stable/c/d886f8d85494d12b2752fd7c6c32162d982d5dd5 - https://git.kernel.org/stable/c/6fe086601
3 - https://git.kernel.org/stable/c/d886f8d85494d12b2752fd7c6c32162d982d5dd5 - https://git.kernel.org/stable/c/6fe0866014486736cc3ba1c6fd4606d3dbe55c9c
CVE ID: CVE-2025-37918 State: PUBLISHED Published: 2025-05-20T15:21:48.473Z Last Updated: 2025-05-26T05:23:41.659Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() A NULL pointer dereference can occur in skb_dequeue() when processing a QCA firmware crash dump on WCN7851 (0489:e0f3). [ 93.672166] Bluetooth: hci0: ACL memdump size(589824) [ 93.672475] BUG: kernel NULL pointer dereference, address: 0000000000000008 [ 93.672517] Workqueue: hci0 hci_devcd_rx [bluetooth] [ 93.672598] RIP: 0010:skb_dequeue+0x50/0x80 The issue stems from handle_dump_pkt_qca() returning 0 e
vcd_rx [bluetooth] [ 93.672598] RIP: 0010:skb_dequeue+0x50/0x80 The issue stems from handle_dump_pkt_qca() returning 0 even when a dump packet is successfully processed. This is because it incorrectly forwards the return value of hci_devcd_init() (which returns 0 on success). As a result, the caller (btusb_recv_acl_qca() or btusb_recv_evt_qca()) assumes the packet was not handled and passes it to hci_recv_frame(), leading to premature kfree() of the skb. Later, hci_devcd_rx() attempts to dequeue the same skb from the dump queue, resulting in a NULL pointer dereference. Fix this by: 1. Making handle_dump_pkt_qca() return 0 on success and negative errno on failure, consistent with kernel conve
this by: 1. Making handle_dump_pkt_qca() return 0 on success and negative errno on failure, consistent with kernel conventions. 2. Splitting dump packet detection into separate functions for ACL and event packets for better structure and readability. This ensures dump packets are properly identified and consumed, avoiding double handling and preventing NULL pointer access. References: - https://git.kernel.org/stable/c/2e8d44ebaa7babdd5c5ab50ca275826e241920d6 - https://git.kernel.org/stable/c/b70b41591ec48c78ec6a885e1f57bfc4029e5e13 - https://git.kernel.org/stable/c/8563d9fabd8a4b726ba7acab4737c438bf11a059 - https://git.kernel.org/stable/c/0317b033abcd1d8dd2798f0e2de5e84543d0bd22
CVE ID: CVE-2025-37919 State: PUBLISHED Published: 2025-05-20T15:21:49.079Z Last Updated: 2025-05-26T05:23:43.002Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot Update chip data using dev_get_drvdata(dev->parent) to fix NULL pointer deref in acp_i2s_set_tdm_slot. References: - https://git.kernel.org/stable/c/3104b7d559ffb28f34e55028ff55a475e26e2e1e - https://git.kernel.org/stable/c/fd4d8d139030dd2de97ef46d332673675ca8ad72 - https://git.kernel.org/stable/c/6d9b64156d849e358cb49b6b899fb0b7d262bda8
CVE ID: CVE-2025-37920 State: PUBLISHED Published: 2025-05-20T15:21:49.685Z Last Updated: 2025-05-26T05:23:44.292Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: xsk: Fix race condition in AF_XDP generic RX path Move rx_lock from xsk_socket to xsk_buff_pool. Fix synchronization for shared umem mode in generic RX path where multiple sockets share single xsk_buff_pool. RX queue is exclusive to xsk_socket, while FILL queue can be shared between multiple sockets. This could result in race condition where two CPU cores access RX path of two different sockets sharing the same umem. Protect both queues by acquiring spinlock in shared
ores access RX path of two different sockets sharing the same umem. Protect both queues by acquiring spinlock in shared xsk_buff_pool. Lock contention may be minimized in the future by some per-thread FQ buffering. It's safe and necessary to move spin_lock_bh(rx_lock) after xsk_rcv_check(): * xs->pool and spinlock_init is synchronized by xsk_bind() -> xsk_is_bound() memory barriers. * xsk_rcv_check() may return true at the moment of xsk_release() or xsk_unbind_dev(), however this will not cause any data races or race conditions. xsk_unbind_dev() removes xdp socket from all maps and waits for completion of all outstanding rx operations. Packets in RX path will either complete safely or drop.
maps and waits for completion of all outstanding rx operations. Packets in RX path will either complete safely or drop. References: - https://git.kernel.org/stable/c/65d3c570614b892257dc58a1b202908242ecf8fd - https://git.kernel.org/stable/c/75a240a3e8abf17b9e00b0ef0492b1bbaa932251 - https://git.kernel.org/stable/c/a1356ac7749cafc4e27aa62c0c4604b5dca4983e
CVE ID: CVE-2025-37921 State: PUBLISHED Published: 2025-05-20T15:21:50.410Z Last Updated: 2025-11-03T19:57:20.614Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: Fix unlocked deletion of default FDB entry When a VNI is deleted from a VXLAN device in 'vnifilter' mode, the FDB entry associated with the default remote (assuming one was configured) is deleted without holding the hash lock. This is wrong and will result in a warning [1] being generated by the lockdep annotation that was added by commit ebe642067455 ("vxlan: Create wrappers for FDB lookup"). Reproducer: # ip link add vx0 up type vxlan dstport 4789 e
ommit ebe642067455 ("vxlan: Create wrappers for FDB lookup"). Reproducer: # ip link add vx0 up type vxlan dstport 4789 external vnifilter local 192.0.2.1 # bridge vni add vni 10010 remote 198.51.100.1 dev vx0 # bridge vni del vni 10010 dev vx0 Fix by acquiring the hash lock before the deletion and releasing it afterwards. Blame the original commit that introduced the issue rather than the one that exposed it. [1] WARNING: CPU: 3 PID: 392 at drivers/net/vxlan/vxlan_core.c:417 vxlan_find_mac+0x17f/0x1a0 [...] RIP: 0010:vxlan_find_mac+0x17f/0x1a0 [...] Call Trace: <TASK> __vxlan_fdb_delete+0xbe/0x560 vxlan_vni_delete_group+0x2ba/0x940 vxlan_vni_del.isra.0+0x15f/0x580 vxlan_process_vni_filter+0x
an_fdb_delete+0xbe/0x560 vxlan_vni_delete_group+0x2ba/0x940 vxlan_vni_del.isra.0+0x15f/0x580 vxlan_process_vni_filter+0x38b/0x7b0 vxlan_vnifilter_process+0x3bb/0x510 rtnetlink_rcv_msg+0x2f7/0xb70 netlink_rcv_skb+0x131/0x360 netlink_unicast+0x426/0x710 netlink_sendmsg+0x75a/0xc20 __sock_sendmsg+0xc1/0x150 ____sys_sendmsg+0x5aa/0x7b0 ___sys_sendmsg+0xfc/0x180 __sys_sendmsg+0x121/0x1b0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/2d4a121296aa3940d2df9906f955c2b6b4e38bc3 - https://git.kernel.org/stable/c/3576e9a80b6c4381b01ce0cbaa07f5e92d4492ed - https://git.kernel.org/stable/c/5
6b4e38bc3 - https://git.kernel.org/stable/c/3576e9a80b6c4381b01ce0cbaa07f5e92d4492ed - https://git.kernel.org/stable/c/5cb9e07f84e527974b12e82e2549fa6c0cc6eef0 - https://git.kernel.org/stable/c/470206205588559e60035fceb5f256640cb45f99 - https://git.kernel.org/stable/c/087a9eb9e5978e3ba362e1163691e41097e8ca20
CVE ID: CVE-2025-37922 State: PUBLISHED Published: 2025-05-20T15:21:51.062Z Last Updated: 2025-05-26T05:23:46.967Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: book3s64/radix : Align section vmemmap start address to PAGE_SIZE A vmemmap altmap is a device-provided region used to provide backing storage for struct pages. For each namespace, the altmap should belong to that same namespace. If the namespaces are created unaligned, there is a chance that the section vmemmap start address could also be unaligned. If the section vmemmap start address is unaligned, the altmap page allocated from the current namespace might be used by
If the section vmemmap start address is unaligned, the altmap page allocated from the current namespace might be used by the previous namespace also. During the free operation, since the altmap is shared between two namespaces, the previous namespace may detect that the page does not belong to its altmap and incorrectly assume that the page is a normal page. It then attempts to free the normal page, which leads to a kernel crash. Kernel attempted to read user page (18) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x00000018 Faulting instruction address: 0xc000000000530c7c Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048
n address: 0xc000000000530c7c Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries CPU: 32 PID: 2104 Comm: ndctl Kdump: loaded Tainted: G W NIP: c000000000530c7c LR: c000000000530e00 CTR: 0000000000007ffe REGS: c000000015e57040 TRAP: 0300 Tainted: G W MSR: 800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 84482404 CFAR: c000000000530dfc DAR: 0000000000000018 DSISR: 40000000 IRQMASK: 0 GPR00: c000000000530e00 c000000015e572e0 c000000002c5cb00 c00c000101008040 GPR04: 0000000000000000 0000000000000007 0000000000000001 000000000000001f GPR08: 0000000000000005 0000000000000000 0000000000000018 0000000000002000 GPR12: c0000000001d2fb0 c0000060
00000000001f GPR08: 0000000000000005 0000000000000000 0000000000000018 0000000000002000 GPR12: c0000000001d2fb0 c0000060de6b0080 0000000000000000 c0000060dbf90020 GPR16: c00c000101008000 0000000000000001 0000000000000000 c000000125b20f00 GPR20: 0000000000000001 0000000000000000 ffffffffffffffff c00c000101007fff GPR24: 0000000000000001 0000000000000000 0000000000000000 0000000000000000 GPR28: 0000000004040201 0000000000000001 0000000000000000 c00c000101008040 NIP [c000000000530c7c] get_pfnblock_flags_mask+0x7c/0xd0 LR [c000000000530e00] free_unref_page_prepare+0x130/0x4f0 Call Trace: free_unref_page+0x50/0x1e0 free_reserved_page+0x40/0x68 free_vmemmap_pages+0x98/0xe0 remove_pte_table+0x164/0x