huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2025-39946: kernel: tls: make sure to abort the stream if headers are bogus
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.4 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-10-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tls: make sure to abort the stream if headers are bogus

Normally we wait for the socket to buffer up the whole record
before we service it. If the socket has a tiny buffer, however,
we read out the data sooner, to prevent connection stalls.
Make sure that we abort the connection when we find out late
that the record is actually invalid. Retrying the parsing is
fine in itself but since we copy some more data each time
before we parse we can overflow the allocated skb space.

Constructing a scenario in which we're under pressure without
enough data in the socket to parse the length upfront is quite
hard. syzbot figured out a way to do this by serving us the header
in small OOB sends, and then filling in the recvbuf with a large
normal send.

Make sure that tls_rx_msg_size() aborts strp, if we reach
an invalid record there's really no way to recover.

Statement: Malformed TLS records could be fed to kTLS so that parsing happened only after incremental copy, risking an out-of-bounds write in the skb.
Exploitation requires kTLS to be enabled on the target system.
For the Red Hat Enterprise Linux the kTLS available, but disabled by default.

Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.154, 6.12.49, 6.16.9, 6.17, 6.6.108
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b36462146d86b1f22e594fe4dae611dffacfb203
CVE-2025-39955: kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect()
Component: kernel
Severity: Moderate
CWE: CWE-213 (Exposure of Sensitive Information Due to Incompatible Policies)
CVSS v3: 7.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-10-09T00:00:00+00:00

A flaw was found in the TCP subsystem in tcp_disconnect of the Linux kernel.The server-side TCP Fast Open socket was reused as a new client before the TFO socket completes, leading to an information leak.

Statement: tcp_disconnect() failed to clear tcp_sk(sk)->fastopen_rsk when reusing a TFO socket (e.g., after accept() → connect(AF_UNSPEC) → connect() sequence).
This left a stale reference, allowing the retransmit timer to access a freed request_sock, triggering a kernel warning or potential UAF.
Triggering requires local access and the ability to create and manipulate TCP Fast Open sockets (often through privileged or test contexts).

Affected upstream versions: 3.7
Fixed upstream versions: 0, 5.10.245, 5.15.194, 5.4.300, 6.1.154, 6.12.49, 6.16.9, 6.17, 6.6.108
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7ec092a91ff351dcde89c23e795b73a328274db6
CVE-2025-39966: kernel: iommufd: Fix race during abort for file descriptors
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.4 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-10-15T00:00:00+00:00

A flaw was found in the Linux kernel such that the IOMMU file-descriptor subsystem, when aborting the allocation of a new object before installing the file descriptor, the code calls fput() on the file and then immediately frees the associated object (kfree()), but the object is still referenced by the file descriptor on a deferred workqueue. This results in a use-after-free (UAF) condition which may lead to memory corruption or system instability


Affected upstream versions: 6.11
Fixed upstream versions: 0, 6.12.50, 6.16.10, 6.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 17195a7d754a5c6a31888702ca93f6f08f3383ad
CVE-2025-39971: kernel: i40e: fix idx validation in config queues msg
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-10-15T00:00:00+00:00

A flaw was found in the Linux kernel in the Intel i40e network driver such that in the function i40e_vc_config_queues_msg(), when iterating over vf->ch[idx], the idx value is not properly validated against the range of active/initialized traffic classes (TCs). An attacker with local privileges could supply a malformed value causing an out-of-bounds access, potentially leading to memory corruption, system crash, or possible arbitrary code execution.


Affected upstream versions: 4.17
Fixed upstream versions: 0, 5.10.245, 5.15.194, 5.4.300, 6.1.155, 6.12.50, 6.16.10, 6.17, 6.6.109
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a6ff2af78343eceb0f77ab1a2fe802183bc21648
CVE-2025-39979: kernel: net/mlx5: fs, fix UAF in flow counter release
Component: kernel
Severity: Moderate
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 7.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-10-15T00:00:00+00:00

A use-after-free flaw was discovered in the Linux kernel’s mlx5 (Net/MLX5) subsystem: within the function mlx5_cmd_hws_delete_fte() the HWS action reference count and mutex for a local flow counter were not initialized, meaning the flow-counter structure could already be freed while deleting the rule. This may lead to memory corruption or kernel instability.


Affected upstream versions: 6.14
Fixed upstream versions: 0, 6.16.10, 6.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3c77f6d244188c3fb11f6aec40bbfe884f1803b5
CVE-2025-39981: kernel: Bluetooth: MGMT: Fix possible UAFs
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H)
Public date: 2025-10-15T00:00:00+00:00

A flaw was found in the Linux kernel’s Bluetooth management subsystem (net/bluetooth/mgmt*.c). The mgmt_pending structure may be freed while still being processed, or remain on the pending command list, which allows a use-after-free or double-free scenario. An attacker with local access to the system and the ability to interact with the Bluetooth subsystem could exploit this to trigger memory corruption, potentially leading to elevated privileges or denial of service.


Affected upstream versions: 5.17
Fixed upstream versions: 0, 6.12.59, 6.16.10, 6.17, 6.6.140
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a
CVE-2025-39982: kernel: Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-10-15T00:00:00+00:00

A flaw was found in the Linux kernel’s Bluetooth subsystem (HCI). Specifically, in the function hci_acl_create_conn_sync() (and related path hci_le_create_conn_sync()), a connection object in state BT_OPEN that is still pending command submission may be freed prematurely, leading to a use-after-free condition. An attacker with network privileges could exploit this to trigger memory corruption, a denial of service, or a potential escalation of privileges.


Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.1.155, 6.12.50, 6.16.10, 6.17, 6.6.109
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6243bda271a628c48875e3e473206e7f584892ce
CVE-2025-39983: kernel: Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.4 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-10-15T00:00:00+00:00

A flaw was discovered in the Bluetooth subsystem of the Linux kernel. When processing a HCI_EV_NUM_COMP_PKTS event, the function hci_conn_tx_dequeue() did not properly hold or release the hdev device lock, which may lead to a use-after-free of the connection structure.


Affected upstream versions: 6.15
Fixed upstream versions: 0, 6.16.10, 6.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: dde33124f17cf3bab4dc5e18d1b4dee128361061
CVE-2025-39984: kernel: net: tun: Update napi->skb after XDP process
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2025-10-15T00:00:00+00:00

A use-after-free flaw was found in tun_get_user in drivers/net/tun.c in  network TUNnel module in Linux kernel. This flaw could allow an attacker to crash the system at device disconnect. This vulnerability could even lead to a kernel information leak problem.


Affected upstream versions: 6.9
Fixed upstream versions: 0, 6.12.50, 6.16.10, 6.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 953200d56fc23eebf80a5ad9eed6e2e8a3065093
CVE-2025-39993: kernel: media: rc: fix races with imon_disconnect()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-10-15T00:00:00+00:00

A use-after-free flaw exists in the Linux kernel’s media/rc subsystem. When the device is disconnected via imon_disconnect(), the driver may unconditionally release a usb_device reference (via usb_put_dev) even while other operations (such as vfd_write, send_packet, display_open, lcd_write) are still in progress. Because the pointers usbdev_intf0/usbdev_intf1 are not properly protected by a users-counter or locking, this situation can lead to a use-after-free of the usb_device pointer and therefore memory corruption or kernel stability issues


Affected upstream versions: 2.6.35
Fixed upstream versions: 0, 5.10.246, 5.15.195, 5.4.301, 6.1.156, 6.12.51, 6.16.11, 6.17.1, 6.18, 6.6.110
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9348976003e39754af344949579e824a0a210fc4
CVE-2025-40026: kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
Component: kernel
Severity: Moderate
CWE: CWE-754 (Improper Check for Unusual or Exceptional Conditions)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-28T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

When completing emulation of instruction that generated a userspace exit
for I/O, don't recheck L1 intercepts as KVM has already finished that
phase of instruction execution, i.e. has already committed to allowing L2
to perform I/O.  If L1 (or host userspace) modifies the I/O permission
bitmaps during the exit to userspace,  KVM will treat the access as being
intercepted despite already having emulated the I/O access.

Pivot on EMULTYPE_NO_DECODE to detect that KVM is completing emulation.
Of the three users of EMULTYPE_NO_DECODE, only complete_emulated_io() (the
intended "recipient") can reach the code in question.  gp_interception()'s
use is mutually exclusive with is_guest_mode(), and
complete_emulated_insn_gp() unconditionally pairs EMULTYPE_NO_DECODE with
EMULTYPE_SKIP.

The bad behavior was detected by a syzkaller program that toggles port I/O
interception during the userspace I/O exit, ultimately resulting in a WARN
on vcpu->arch.pio.count being non-zero due to KVM no completing emulation
of the I/O instruction.

  WARNING: CPU: 23 PID: 1083 at arch/x86/kvm/x86.c:8039 emulator_pio_in_out+0x154/0x170 [kvm]
  Modules linked in: kvm_intel kvm irqbypass
  CPU: 23 UID: 1000 PID: 1083 Comm: repro Not tainted 6.16.0-rc5-c1610d2d66b1-next-vm #74 NONE
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
  RIP: 0010:emulator_pio_in_out+0x154/0x170 [kvm]
  PKRU: 55555554
  Call Trace:
   <TASK>
   kvm_fast_pio+0xd6/0x1d0 [kvm]
   vmx_handle_exit+0x149/0x610 [kvm_intel]
   kvm_arch_vcpu_ioctl_run+0xda8/0x1ac0 [kvm]
   kvm_vcpu_ioctl+0x244/0x8c0 [kvm]
   __x64_sys_ioctl+0x8a/0xd0
   do_syscall_64+0x5d/0xc60
   entry_SYSCALL_64_after_hwframe+0x4b/0x53
   </TASK>

Statement: KVM x86 was re-checking L1 instruction intercepts while completing a userspace I/O emulation for an L2 instruction. If L1 (or host userspace) modified I/O interception during the exit, KVM could wrongly treat the already-emulated I/O as intercepted and leave vcpu->arch.pio.count non-zero, triggering a WARN and potentially disrupting the guest.
Practical exploitation requires local access to /dev/kvm and the ability to run nested virtualization or manipulate I/O bitmaps.

Affected upstream versions: 3.0
Fixed upstream versions: 0, 5.10.246, 5.15.195, 5.4.301, 6.1.157, 6.12.52, 6.16.12, 6.17.2, 6.18, 6.6.111
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a908eca437789589dd4624da428614c1275064dc
CVE-2025-40034: kernel: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit()
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 6.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-10-28T00:00:00+00:00

A flaw was found in the Linux kernel PCI/AER (Advanced Error Reporting) subsystem. When platform firmware reports error information via the ACPI APEI GHES mechanism for a device that does not advertise an AER capability, dev->aer_info remains NULL. The function aer_ratelimit() does not check for this condition, leading to a NULL pointer dereference.


Affected upstream versions: 6.16
Fixed upstream versions: 0, 6.17.3, 6.18
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 41683624cbff0a26bb7e0627f4a7e1b51a8779a8
CVE-2025-40047: kernel: io_uring/waitid: always prune wait queue entry in io_waitid_wait()
Component: kernel
Severity: Moderate
CWE: CWE-662 (Improper Synchronization)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-10-28T00:00:00+00:00

A flaw use after free in the Linux kernel IO_URING subsystem was found in the way local user uses io_uring interface (using IORING_OP_WAITID).
A local user could use this flaw to crash the system or potentially escalate their privileges on the system.

Statement: io_waitid_wait() didn’t always prune the wait-queue entry on success when a cancellation was in progress, leaving the entry on the list and racing with another callback, which could lead to double callbacks and list corruption (potential UAF).
The IO_URING enabled only in latest versions of Red Hat Enterprise Linux (from 9.3).

Affected upstream versions: 6.7
Fixed upstream versions: 0, 6.12.53, 6.17.3, 6.18
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 696ba6032081e617564a8113a001b8d7943cb928
CVE-2025-40058: kernel: iommu/vt-d: Disallow dirty tracking if incoherent page walk
Component: kernel
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-10-28T00:00:00+00:00

A flaw was found in the Intel VT-d IOMMU support in the Linux kernel. When an IOMMU is configured to perform dirty-page tracking, but the page-walk memory region is incoherent between the IOMMU and CPU, the hardware may attempt to atomically update the bits in a paging-structure entry that is not properly snooped. The resulting fault could lead to a system hang and a non-recoverable state.


Affected upstream versions: 6.7
Fixed upstream versions: 0, 6.12.53, 6.17.3, 6.18
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ebe16d245a00626bb87163862a1b07daf5475a3e
CVE-2025-40096: kernel: drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies
Component: kernel
Severity: Moderate
CWE: CWE-415 (Double Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-10-30T00:00:00+00:00

A flaw was found in the kernel subsystem handling of the DRM scheduler. Under certain error conditions, the function drm_sched_job_add_dependency() consumes a fence reference and then later erroneously attempts to free it again (double free). This may lead to memory corruption and, in some configurations, escalation of privileges.


Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.1.158, 6.12.55, 6.17.5, 6.18, 6.6.114
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4c38a63ae12ecc9370a7678077bde2d61aa80e9c
CVE-2025-40133: kernel: mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable()
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-11-12T00:00:00+00:00

A use-after-free flaw was found in Multipath TCP in the Linux kernel in net/mptcp/ctrl.c:mptcp_active_enablecode due to concurrency problem. This flaw could allow an attacker to crash the system at device disconnect. This vulnerability could even lead to a kernel information leak problem.


Affected upstream versions: 6.12
Fixed upstream versions: 0, 6.12.55, 6.17.3, 6.18
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ad16235c9d3ef7ec17c109ff39b7504f49d17072
CVE-2025-40134: kernel: dm: fix NULL pointer dereference in __dm_suspend()
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-11-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

dm: fix NULL pointer dereference in __dm_suspend()

There is a race condition between dm device suspend and table load that
can lead to null pointer dereference. The issue occurs when suspend is
invoked before table load completes:

BUG: kernel NULL pointer dereference, address: 0000000000000054
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 6 PID: 6798 Comm: dmsetup Not tainted 6.6.0-g7e52f5f0ca9b #62
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014
RIP: 0010:blk_mq_wait_quiesce_done+0x0/0x50
Call Trace:
  <TASK>
  blk_mq_quiesce_queue+0x2c/0x50
  dm_stop_queue+0xd/0x20
  __dm_suspend+0x130/0x330
  dm_suspend+0x11a/0x180
  dev_suspend+0x27e/0x560
  ctl_ioctl+0x4cf/0x850
  dm_ctl_ioctl+0xd/0x20
  vfs_ioctl+0x1d/0x50
  __se_sys_ioctl+0x9b/0xc0
  __x64_sys_ioctl+0x19/0x30
  x64_sys_call+0x2c4a/0x4620
  do_syscall_64+0x9e/0x1b0

The issue can be triggered as below:

T1 						T2
dm_suspend					table_load
__dm_suspend					dm_setup_md_queue
						dm_mq_init_request_queue
						blk_mq_init_allocated_queue
						=> q->mq_ops = set->ops; (1)
dm_stop_queue / dm_wait_for_completion
=> q->tag_set NULL pointer!	(2)
						=> q->tag_set = set; (3)

Fix this by checking if a valid table (map) exists before performing
request-based suspend and waiting for target I/O. When map is NULL,
skip these table-dependent suspend steps.

Even when map is NULL, no I/O can reach any target because there is
no table loaded; I/O submitted in this state will fail early in the
DM layer. Skipping the table-dependent suspend logic in this case
is safe and avoids NULL pointer dereferences.


Affected upstream versions: 5.0
Fixed upstream versions: 0, 5.10.246, 5.15.195, 5.4.301, 6.1.156, 6.12.53, 6.17.3, 6.18, 6.6.112
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9dc43ea6a20ff83fe9a5fe4be47ae0fbf2409b98
CVE-2025-40135: kernel: ipv6: use RCU in ip6_xmit()
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-11-12T00:00:00+00:00

A use-after-free flaw was found in ip6_autoflowlabel in the Linux kernel's net/ipv6/ip6_output.c code. In this flaw an attacker can cause a denial of service (DoS) attack.


Affected upstream versions: 4.13
Fixed upstream versions: 0, 6.1.167, 6.12.78, 6.17.3, 6.18, 6.6.130
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f0a54d00d2f36de40266f47c27989853e8588656
CVE-2025-40141: kernel: Bluetooth: ISO: Fix possible UAF on iso_conn_free
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2025-11-12T00:00:00+00:00

A vulnerability was found in iso_sock_kill in net/bluetooth/iso.c in Bluetooth protocol stack in the Linux Kernel. In this flaw if the
conn->sk is not set to NULL may lead to UAF on iso_conn_free.


Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.156, 6.12.53, 6.17.3, 6.18, 6.6.112
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: eba6d787ec117a5d2c60f9644e0a39c18542b6be
CVE-2025-40154: kernel: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-11-12T00:00:00+00:00

A flaw was found in the Linux kernel’s ASoC Intel bytcr_rt5640 driver. When an invalid value is passed via the driver’s “quirk” input option, the driver merely logs an error and retains the invalid value, rather than correcting it. This can result in out-of-bounds (OOB) memory access.


Affected upstream versions: 4.18
Fixed upstream versions: 0, 5.10.246, 5.15.195, 5.4.301, 6.1.156, 6.12.53, 6.17.3, 6.18, 6.6.112
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2c27e047bdcba457ec953f7e90e4ed6d5f8aeb01
CVE-2025-40158: kernel: ipv6: use RCU in ip6_output()
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-11-12T00:00:00+00:00

A use-after-free flaw was found in ip6_finish_output2 in  net/ipv6/ip6_output.c in ipv6 access. This flaw could allow an attacker to crash the system at device disconnect. This vulnerability could even lead to a kernel information leak problem.


Affected upstream versions: 4.13
Fixed upstream versions: 0, 6.17.3, 6.18
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0393f85c3241c19ba8550f04a812e7d19f6b3082
CVE-2025-40168: kernel: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-11-12T00:00:00+00:00

A flaw was found in the Linux kernel’s SMC (Shared Memory Communication) module: in smc_clc_prfx_match(), the function is called from smc_listen_work() without proper RCU or RTNL protection. The code previously used sk_dst_get(sk)->dev, which can lead to a use-after-free (UAF) condition if the sk’s destination is freed concurrently.


Affected upstream versions: 4.11
Fixed upstream versions: 0, 6.17.3, 6.18
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d26e80f7fb62d77757b67a1b94e4ac756bc9c658