huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2025-38109: kernel: Linux kernel (net/mlx5): Use-after-free in ECVF vports unload leads to denial of service
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2025-07-03T00:00:00+00:00

A flaw was found in the Linux kernel's net/mlx5 component. A local user could exploit a use-after-free vulnerability during the shutdown process when embedded chip virtual function (ECVF) vports are unloaded. This occurs because the vport access control list (ACL) ingress table is not properly destroyed when a virtual function is created on a BlueField device's embedded chip. Successful exploitation of this flaw could lead to a system crash, resulting in a denial of service.

Statement: A use-after-free flaw was found while ECVF vports unload on shutdown code flow in Network Mellanox subsystem in the Linux Kernel. This flaw could allow a special grouped user to crash the system. This vulnerability could even lead to a kernel information leak problem. This flaw is treated as a moderate impact.

Affected upstream versions: 6.5
Fixed upstream versions: 0, 6.12.34, 6.15.3, 6.16, 6.6.94
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5953ae44dfe5dbad374318875be834c3b7b71ee6
CVE-2025-38110: kernel: net/mdiobus: Fix potential out-of-bounds clause 45 read/write access
Component: kernel
Severity: Moderate
CWE: CWE-1284 (Improper Validation of Specified Quantity in Input)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N)
Public date: 2025-07-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/mdiobus: Fix potential out-of-bounds clause 45 read/write access

When using publicly available tools like 'mdio-tools' to read/write data
from/to network interface and its PHY via C45 (clause 45) mdiobus,
there is no verification of parameters passed to the ioctl and
it accepts any mdio address.
Currently there is support for 32 addresses in kernel via PHY_MAX_ADDR define,
but it is possible to pass higher value than that via ioctl.
While read/write operation should generally fail in this case,
mdiobus provides stats array, where wrong address may allow out-of-bounds
read/write.

Fix that by adding address verification before C45 read/write operation.
While this excludes this access from any statistics, it improves security of
read/write operation.

Statement: A bounds check was missing in the __mdiobus_c45_read() and __mdiobus_c45_write() functions, allowing out-of-bounds access to the stats array in the kernel if a user supplied an invalid PHY address via an ioctl. Although the read/write would typically fail on hardware, the statistics array was still accessed, potentially leading to an out-of-bounds memory read/write in kernel space. This patch adds a check that ensures the PHY address does not exceed PHY_MAX_ADDR, mitigating the risk. The Privileges required for the CVSS is High (PR: H), because requires administrative privileges to issue raw ioctl commands to a network interface (typically CAP_NET_ADMIN). Potential memory corruption could happen inside the firmware of the networking hardware, but not for the memory of the Linux Kernel, and this is the reason why no Kernel Crash could be (and A:N for CVSS).

Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.12.34, 6.15.3, 6.16, 6.6.94
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: abb0605ca00979a49572a6516f6db22c3dc57223
CVE-2025-38116: kernel: wifi: ath12k: fix uaf in ath12k_core_init()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-07-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix uaf in ath12k_core_init()

When the execution of ath12k_core_hw_group_assign() or
ath12k_core_hw_group_create() fails, the registered notifier chain is not
unregistered properly. Its memory is freed after rmmod, which may trigger
to a use-after-free (UAF) issue if there is a subsequent access to this
notifier chain.

Fixes the issue by calling ath12k_core_panic_notifier_unregister() in
failure cases.

Call trace:
 notifier_chain_register+0x4c/0x1f0 (P)
 atomic_notifier_chain_register+0x38/0x68
 ath12k_core_init+0x50/0x4e8 [ath12k]
 ath12k_pci_probe+0x5f8/0xc28 [ath12k]
 pci_device_probe+0xbc/0x1a8
 really_probe+0xc8/0x3a0
 __driver_probe_device+0x84/0x1b0
 driver_probe_device+0x44/0x130
 __driver_attach+0xcc/0x208
 bus_for_each_dev+0x84/0x100
 driver_attach+0x2c/0x40
 bus_add_driver+0x130/0x260
 driver_register+0x70/0x138
 __pci_register_driver+0x68/0x80
 ath12k_pci_init+0x30/0x68 [ath12k]
 ath12k_init+0x28/0x78 [ath12k]

Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3

Statement: The vulnerability is classified as a use-after-free in the ath12k_core_init() function. It occurs when the notifier chain is not properly unregistered upon initialization failure, potentially leading to kernel crashes upon later access. For the CVSS the Privileges Required (PR) metric is set to High, as exploitation requires the ability to load and unload kernel modules (e.g., insmod/rmmod), which is restricted to privileged users with CAP_SYS_MODULE or root access. The bug is relevant only for the latest version of Red Hat Enterprise Linux 9 (and newer), because in earlier versions the Linux kernel config option CONFIG_ATH12K was disabled.

Affected upstream versions: 6.14
Fixed upstream versions: 0, 6.15.3, 6.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 65e1b3404c211dcfaea02698539cdcd26647130f
CVE-2025-38124: kernel: net: fix udp gso skb_segment after pull from frag_list
Component: kernel
Severity: Moderate
CWE: CWE-704 (Incorrect Type Conversion or Cast)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-07-03T00:00:00+00:00

A denial of service vulnerability has been discovered in the Linux kernel's UDP Generic Segmentation Offload (GSO) functionality. This flaw allows a local, unprivileged user to trigger a kernel crash by generating UDP packets with a specially malformed frag_list geometry. Successful exploitation of this vulnerability could lead to a system crash, severely impacting the availability and stability of the affected system.

Statement: This vulnerability in the Linux kernel's UDP Generic Segmentation Offload (GSO) path allows specially crafted packets with malformed frag_list geometry to trigger a kernel BUG within the skb_segment() function. This occurs when only a portion of the packet data is pulled into the linear part of the SKB (Socket Buffer), violating assumptions made by the segmentation logic. If these malformed SKBs are not linearized, the kernel will crash due to invariant violations, leading to a denial-of-service.

While the CVSS privileges are rated as Low, meaning unprivileged users can potentially construct such malicious SKBs via AF_PACKET sockets, BPF hooks, or containerized networking interfaces, the impact remains a system-level denial of service.

Affected upstream versions: 6.1.113 < 6.1.142, 6.6.55 < 6.6.94, 6.10.14 < 6.11, 6.11.3 < 6.12, 6.12
Fixed upstream versions: 0, 6.1.142, 6.11, 6.12, 6.12.34, 6.15.3, 6.16, 6.6.94
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0e65f38bd1aa14ea86e221b7bb814d38278d86c3
CVE-2025-38127: kernel: ice: fix Tx scheduler error handling in XDP callback
Component: kernel
Severity: Moderate
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-07-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ice: fix Tx scheduler error handling in XDP callback

When the XDP program is loaded, the XDP callback adds new Tx queues.
This means that the callback must update the Tx scheduler with the new
queue number. In the event of a Tx scheduler failure, the XDP callback
should also fail and roll back any changes previously made for XDP
preparation.

The previous implementation had a bug that not all changes made by the
XDP callback were rolled back. This caused the crash with the following
call trace:

[  +9.549584] ice 0000:ca:00.0: Failed VSI LAN queue config for XDP, error: -5
[  +0.382335] Oops: general protection fault, probably for non-canonical address 0x50a2250a90495525: 0000 [#1] SMP NOPTI
[  +0.010710] CPU: 103 UID: 0 PID: 0 Comm: swapper/103 Not tainted 6.14.0-net-next-mar-31+ #14 PREEMPT(voluntary)
[  +0.010175] Hardware name: Intel Corporation M50CYP2SBSTD/M50CYP2SBSTD, BIOS SE5C620.86B.01.01.0005.2202160810 02/16/2022
[  +0.010946] RIP: 0010:__ice_update_sample+0x39/0xe0 [ice]

[...]

[  +0.002715] Call Trace:
[  +0.002452]  <IRQ>
[  +0.002021]  ? __die_body.cold+0x19/0x29
[  +0.003922]  ? die_addr+0x3c/0x60
[  +0.003319]  ? exc_general_protection+0x17c/0x400
[  +0.004707]  ? asm_exc_general_protection+0x26/0x30
[  +0.004879]  ? __ice_update_sample+0x39/0xe0 [ice]
[  +0.004835]  ice_napi_poll+0x665/0x680 [ice]
[  +0.004320]  __napi_poll+0x28/0x190
[  +0.003500]  net_rx_action+0x198/0x360
[  +0.003752]  ? update_rq_clock+0x39/0x220
[  +0.004013]  handle_softirqs+0xf1/0x340
[  +0.003840]  ? sched_clock_cpu+0xf/0x1f0
[  +0.003925]  __irq_exit_rcu+0xc2/0xe0
[  +0.003665]  common_interrupt+0x85/0xa0
[  +0.003839]  </IRQ>
[  +0.002098]  <TASK>
[  +0.002106]  asm_common_interrupt+0x26/0x40
[  +0.004184] RIP: 0010:cpuidle_enter_state+0xd3/0x690

Fix this by performing the missing unmapping of XDP queues from
q_vectors and setting the XDP rings pointer back to NULL after all those
queues are released.
Also, add an immediate exit from the XDP callback in case of ring
preparation failure.


Affected upstream versions: 5.5
Fixed upstream versions: 0, 6.12.34, 6.15.3, 6.16, 6.6.94
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1d3c5d0dec6797eca3a861dab0816fa9505d9c3e
CVE-2025-38129: kernel: Linux kernel: Use-after-free vulnerability in page_pool_recycle_in_ring can lead to arbitrary code execution
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2025-07-03T00:00:00+00:00

A flaw was found in the Linux kernel. This vulnerability, known as a use-after-free (UAF), occurs in the `page_pool_recycle_in_ring` function. A local attacker could exploit this by manipulating the system's memory management, causing a freed memory region to be improperly accessed. This can lead to system instability, unauthorized access to sensitive information, or potentially allow an attacker to execute malicious code.

Statement: Moderate impact. A use-after-free vulnerability in the Linux kernel's `page_pool_recycle_in_ring` function allows a local attacker to cause a denial-of-service or a kernel information leak problem. This flaw affects Red Hat Enterprise Linux 8, 9, and 10, as well as Red Hat In-Vehicle OS 1. Red Hat Enterprise Linux 6 and 7 are not affected as the vulnerable code is not present.

Affected upstream versions: 4.18
Fixed upstream versions: 0, 5.10.259, 5.15.198, 6.1.160, 6.12.34, 6.15.3, 6.16, 6.6.120
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c2c906142293931e33ef4be79ebc36c25c4e21dd
CVE-2025-38137: kernel: PCI/pwrctrl: Cancel outstanding rescan work when unregistering
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H)
Public date: 2025-07-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

PCI/pwrctrl: Cancel outstanding rescan work when unregistering

It's possible to trigger use-after-free here by:

  (a) forcing rescan_work_func() to take a long time and
  (b) utilizing a pwrctrl driver that may be unloaded for some reason

Cancel outstanding work to ensure it is finished before we allow our data
structures to be cleaned up.

[bhelgaas: tidy commit log]

Statement: Fixes a use-after-free vulnerability in the PCI/pwrctrl subsystem. If rescan_work_func() is still executing when the pwrctrl structure is freed (e.g., upon driver removal), the system may crash or exhibit undefined behavior. The vulnerability can potentially be triggered by a local attacker with limited privileges by forcing long-running rescan work and unloading the related driver concurrently. This bug not introduced yet in any version of the Red Hat Enterprise Linux, so not affected for all versions (apart from latest Red Hat Enterprise Linux 10 where going to check this additionally).

Affected upstream versions: 6.11
Fixed upstream versions: 0, 6.15.3, 6.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b3ad6d23fec23fbef382ce9ea640c37446593cf5
CVE-2025-38141: kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting
Component: kernel
Severity: Moderate
CWE: CWE-364 (Signal Handler Race Condition)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-07-03T00:00:00+00:00

A flaw was found in the Linux kernel's device mapper (dm) component. When setting up zone append emulation resources, a race condition can occur if the `blk_revalidate_disk_zones()` function fails while another process simultaneously calls `dm_blk_report_zones()`. This timing issue can lead to a use-after-free error, potentially allowing a local attacker to achieve privilege escalation or cause a denial of service.


Affected upstream versions: 6.10
Fixed upstream versions: 0, 6.12.34, 6.15.3, 6.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f9c1bdf24615303d48a2d0fd629c88f3189563aa
CVE-2025-38148: kernel: net: phy: mscc: Fix memory leak when using one step timestamping
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-07-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: phy: mscc: Fix memory leak when using one step timestamping

Fix memory leak when running one-step timestamping. When running
one-step sync timestamping, the HW is configured to insert the TX time
into the frame, so there is no reason to keep the skb anymore. As in
this case the HW will never generate an interrupt to say that the frame
was timestamped, then the frame will never released.
Fix this by freeing the frame in case of one-step timestamping.


Affected upstream versions: 5.9
Fixed upstream versions: 0, 5.15.192, 6.1.142, 6.12.34, 6.15.3, 6.16, 6.6.94
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 24b24295464f25fb771d36ed558c7cd942119361
CVE-2025-38154: kernel: Linux kernel: Use-after-free in BPF sockmap can lead to denial of service and privilege escalation
Component: kernel
Severity: Moderate
CWE: CWE-821 (Incorrect Synchronization)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-07-03T00:00:00+00:00

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) sockmap subsystem. A race condition exists where the `sk_socket` is not properly locked or referenced during the `skb_send_sock()` function call, allowing for a use-after-free vulnerability. This can be exploited by a local attacker, leading to a system crash (Denial of Service) and potentially enabling information disclosure or privilege escalation.

Statement: The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space.

For the Red Hat Enterprise Linux 9 to confirm the current state, inspect the sysctl with the command:

    cat /proc/sys/kernel/unprivileged_bpf_disabled

The setting of 1 would mean that unprivileged users can not use eBPF, mitigating the flaw.

Affected upstream versions: 5.15.162 < 5.15.186, 6.1.95 < 6.1.142, 6.6.35 < 6.6.94, 6.9.6 < 6.10, 6.10
Fixed upstream versions: 0, 5.15.186, 6.1.142, 6.10, 6.12.34, 6.15.3, 6.16, 6.6.94
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4edb40b05cb6a261775abfd8046804ca139a5546
CVE-2025-38159: kernel: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
Component: kernel
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-07-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds

Set the size to 6 instead of 2, since 'para' array is passed to
'rtw_fw_bt_wifi_control(rtwdev, para[0], &para[1])', which reads
5 bytes:

void rtw_fw_bt_wifi_control(struct rtw_dev *rtwdev, u8 op_code, u8 *data)
{
    ...
    SET_BT_WIFI_CONTROL_DATA1(h2c_pkt, *data);
    SET_BT_WIFI_CONTROL_DATA2(h2c_pkt, *(data + 1));
    ...
    SET_BT_WIFI_CONTROL_DATA5(h2c_pkt, *(data + 4));

Detected using the static analysis tool - Svace.

Statement: The bug in the rtw88 driver causes an out-of-bounds read due to incorrect buffer size (para[2] instead of the required para[6]). Since the buffer is passed to rtw_fw_bt_wifi_control(), which accesses up to 5 additional bytes, this can lead to memory disclosure or a kernel crash. This issue can be triggered by local users with the ability to manipulate Bluetooth/Wi-Fi coexistence settings.

Affected upstream versions: 5.4
Fixed upstream versions: 0, 5.15.186, 6.1.142, 6.12.34, 6.15.3, 6.16, 6.6.94
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1ee8ea6937d13b20f90ff35d71ccc03ba448182d
CVE-2025-38172: kernel: Linux kernel erofs: Use-After-Free due to device type mismatch
Component: kernel
Severity: Moderate
CWE: CWE-390 (Detection of Error Condition Without Action)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2025-07-03T00:00:00+00:00

A flaw was found in the Linux kernel's erofs filesystem. A local attacker could exploit a use-after-free (UAF) vulnerability by mounting an erofs filesystem with a specific configuration where the primary and extra devices have mismatched types. This improper handling of device initialization errors could lead to a system crash (denial of service) or potentially allow a local attacker to execute arbitrary code, thereby gaining full control over the affected system.


Affected upstream versions: 6.12
Fixed upstream versions: 0, 6.12.34, 6.15.3, 6.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 65115472f741ca000d7ea4a5922214f93cd1516e
CVE-2025-38177: kernel: sch_hfsc: make hfsc_qlen_notify() idempotent
Component: kernel
Severity: Moderate
CWE: CWE-459 (Incomplete Cleanup)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-07-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

sch_hfsc: make hfsc_qlen_notify() idempotent

hfsc_qlen_notify() is not idempotent either and not friendly
to its callers, like fq_codel_dequeue(). Let's make it idempotent
to ease qdisc_tree_reduce_backlog() callers' life:

1. update_vf() decreases cl->cl_nactive, so we can check whether it is
non-zero before calling it.

2. eltree_remove() always removes RB node cl->el_node, but we can use
   RB_EMPTY_NODE() + RB_CLEAR_NODE() to make it safe.


Affected upstream versions: 4.14
Fixed upstream versions: 0, 5.10.241, 5.15.190, 5.4.297, 6.1.138, 6.12.28, 6.14.6, 6.15, 6.6.90
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9a5fd5c2f4d4afdd5e405083ee53e0789ce76956
CVE-2025-38180: kernel: Linux kernel: Use-After-Free vulnerability in ATM subsystem
Component: kernel
Severity: Moderate
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-07-04T00:00:00+00:00

A flaw was found in the Linux kernel's Asynchronous Transfer Mode (ATM) subsystem. An authenticated local attacker could exploit a Use-After-Free (UAF) vulnerability in the /proc/net/atm/lec handling. This flaw occurs due to improper dev_put() calls without prior dev_hold() calls, leading to an imbalance in reference counting. Successful exploitation could allow the attacker to achieve privilege escalation or cause a denial of service.

Statement: Moderate: A Use-After-Free vulnerability in the Linux kernel's Asynchronous Transfer Mode (ATM) subsystem allows an authenticated local attacker to cause a denial of service or a leak in kernel internal information. This flaw affects Red Hat Enterprise Linux 7, 8, and 9. Exploitation requires the ATM subsystem to be active, which is not enabled by default in typical Red Hat Enterprise Linux installations.

Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 5.10.239, 5.15.186, 5.4.295, 6.1.142, 6.12.35, 6.15.4, 6.16, 6.6.95
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fcfccf56f4eba7d00aa2d33c7bb1b33083237742
CVE-2025-38200: kernel: i40e: fix MMIO write access to an invalid page in i40e_clear_hw
Component: kernel
Severity: Moderate
CWE: CWE-191 (Integer Underflow (Wrap or Wraparound))
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-07-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

i40e: fix MMIO write access to an invalid page in i40e_clear_hw

When the device sends a specific input, an integer underflow can occur, leading
to MMIO write access to an invalid page.

Prevent the integer underflow by changing the type of related variables.


Affected upstream versions: 3.12
Fixed upstream versions: 0, 5.10.239, 5.15.186, 5.4.295, 6.1.142, 6.12.35, 6.15.4, 6.16, 6.6.95
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 872607632c658d3739e4e7889e4f3c419ae2c193
CVE-2025-38202: kernel: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
Component: kernel
Severity: Low
CWE: CWE-414 (Missing Lock Check)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-07-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()

bpf_map_lookup_percpu_elem() helper is also available for sleepable bpf
program. When BPF JIT is disabled or under 32-bit host,
bpf_map_lookup_percpu_elem() will not be inlined. Using it in a
sleepable bpf program will trigger the warning in
bpf_map_lookup_percpu_elem(), because the bpf program only holds
rcu_read_lock_trace lock. Therefore, add the missed check.


Affected upstream versions: 5.19
Fixed upstream versions: 0, 6.1.142, 6.12.35, 6.15.4, 6.16, 6.6.95
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2f8c69a72e8ad87b36b8052f789da3cc2b2e186c