huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2025-39757: kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-09-11T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Validate UAC3 cluster segment descriptors

UAC3 class segment descriptors need to be verified whether their sizes
match with the declared lengths and whether they fit with the
allocated buffer sizes, too.  Otherwise malicious firmware may lead to
the unexpected OOB accesses.


Affected upstream versions: 4.19
Fixed upstream versions: 0, 5.10.241, 5.15.190, 5.4.297, 6.1.149, 6.12.43, 6.15.11, 6.16.2, 6.17, 6.6.103
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 799c06ad4c9c790c265e8b6b94947213f1fb389c
CVE-2025-39760: kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-09-11T00:00:00+00:00

A flaw was found in the Linux kernel's USB core configuration parsing. Specifically, the `usb_parse_ss_endpoint_companion()` function incorrectly checks the descriptor type before its length, which can lead to reading data beyond the intended buffer. This out-of-bounds read vulnerability could allow a local attacker to cause a system crash, resulting in a Denial of Service (DoS).

Statement: This Moderate impact flaw in the Linux kernel's USB core configuration parsing allows a local attacker with some special group privilege to trigger an out-of-bounds read by manipulating USB device core configuration options. This can lead to a system crash, resulting in a Denial of Service.

Affected upstream versions: 2.6.35
Fixed upstream versions: 0, 5.10.241, 5.15.190, 6.1.149, 6.12.43, 6.15.11, 6.16.2, 6.17, 6.6.103
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5c3097ede7835d3caf6543eb70ff689af4550cd2
CVE-2025-39761: kernel: wifi: ath12k: Decrement TID on RX peer frag setup error handling
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-09-11T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: Decrement TID on RX peer frag setup error handling

Currently, TID is not decremented before peer cleanup, during error
handling path of ath12k_dp_rx_peer_frag_setup(). This could lead to
out-of-bounds access in peer->rx_tid[].

Hence, add a decrement operation for TID, before peer cleanup to
ensures proper cleanup and prevents out-of-bounds access issues when
the RX peer frag setup fails.

Found during code review. Compile tested only.


Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.12.43, 6.15.11, 6.16.2, 6.17, 6.6.103
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: eb1e1526b82b8cf31f1ef9ca86a2647fb6cd89c6
CVE-2025-39766: kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
Component: kernel
Severity: Moderate
CWE: CWE-390 (Detection of Error Condition Without Action)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2025-09-11T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit

The following setup can trigger a WARNING in htb_activate due to
the condition: !cl->leaf.q->q.qlen

tc qdisc del dev lo root
tc qdisc add dev lo root handle 1: htb default 1
tc class add dev lo parent 1: classid 1:1 \
       htb rate 64bit
tc qdisc add dev lo parent 1:1 handle f: \
       cake memlimit 1b
ping -I lo -f -c1 -s64 -W0.001 127.0.0.1

This is because the low memlimit leads to a low buffer_limit, which
causes packet dropping. However, cake_enqueue still returns
NET_XMIT_SUCCESS, causing htb_enqueue to call htb_activate with an
empty child qdisc. We should return NET_XMIT_CN when packets are
dropped from the same tin and flow.

I do not believe return value of NET_XMIT_CN is necessary for packet
drops in the case of ack filtering, as that is meant to optimize
performance, not to signal congestion.


Affected upstream versions: 4.19
Fixed upstream versions: 0, 5.10.241, 5.15.190, 5.4.297, 6.1.149, 6.12.44, 6.16.4, 6.17, 6.6.103
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7689ab22de36f8db19095f6bdf11f28cfde92f5c
CVE-2025-39806: kernel: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-09-16T00:00:00+00:00

A flaw exists in the Linux kernel’s HID multitouch driver (function mt_report_fixup() in drivers/hid/hid-multitouch.c). A malicious HID device may supply a report descriptor smaller than 607 bytes; the function then attempts to access and patch byte offset 607 without first verifying the descriptor length. This can lead to a slab out-of-bounds access, potentially resulting in memory corruption or a denial of service


Affected upstream versions: 5.15.168 < 5.15.191, 6.1.111 < 6.1.150, 6.6.52 < 6.6.104, 6.10.11 < 6.11, 6.11
Fixed upstream versions: 0, 5.15.191, 6.1.150, 6.11, 6.12.45, 6.16.5, 6.17, 6.6.104
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4263e5851779f7d8ebfbc9cc7d2e9b0217adba8d
CVE-2025-39817: kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-09-16T00:00:00+00:00

A slab-out-of-bounds exists in the linux kernel in efivarfs_d_compare, such that the issue can be triggered by parallel lookups using an invalid filename due to an incorrect memcmp function.


Affected upstream versions: 3.8.2 < 3.9, 3.9
Fixed upstream versions: 0, 3.9, 5.10.242, 5.15.191, 5.4.298, 6.1.150, 6.12.45, 6.16.5, 6.17, 6.6.104
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0f63fbabeaaaaaaf5b742a2f4c1b4590d50bf1f6
CVE-2025-39818: kernel: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save
Component: kernel
Severity: Moderate
CWE: CWE-763 (Release of Invalid Pointer or Reference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save

Improper use of secondary pointer (&dev->i2c_subip_regs) caused
kernel crash and out-of-bounds error:

 BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510
 Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107

 CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary)
 Workqueue: async async_run_entry_fn
 Call Trace:
  <TASK>
  dump_stack_lvl+0x76/0xa0
  print_report+0xd1/0x660
  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
  ? kasan_complete_mode_report_info+0x26/0x200
  kasan_report+0xe1/0x120
  ? _regmap_bulk_read+0x449/0x510
  ? _regmap_bulk_read+0x449/0x510
  __asan_report_store4_noabort+0x17/0x30
  _regmap_bulk_read+0x449/0x510
  ? __pfx__regmap_bulk_read+0x10/0x10
  regmap_bulk_read+0x270/0x3d0
  pio_complete+0x1ee/0x2c0 [intel_thc]
  ? __pfx_pio_complete+0x10/0x10 [intel_thc]
  ? __pfx_pio_wait+0x10/0x10 [intel_thc]
  ? regmap_update_bits_base+0x13b/0x1f0
  thc_i2c_subip_pio_read+0x117/0x270 [intel_thc]
  thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc]
  ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc]
[...]
 The buggy address belongs to the object at ffff888136005d00
  which belongs to the cache kmalloc-rnd-12-192 of size 192
 The buggy address is located 0 bytes to the right of
  allocated 192-byte region [ffff888136005d00, ffff888136005dc0)

Replaced with direct array indexing (&dev->i2c_subip_regs[i]) to ensure
safe memory access.


Affected upstream versions: 6.14
Fixed upstream versions: 0, 6.16.5, 6.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 78d4cf0466c79452e47aa6f720afbde63e709ccc
CVE-2025-39819: kernel: Linux kernel: Denial of Service via resource leak in SMB2 compound operations
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-16T00:00:00+00:00

A flaw was found in the Linux kernel. An inconsistent update of the reference count in the `smb2_compound_op` function, particularly during memory allocation failures, could lead to resource leaks. A local attacker could exploit this to cause a Denial of Service (DoS) by exhausting system resources.


Affected upstream versions: 5.8
Fixed upstream versions: 0, 6.1.150, 6.12.45, 6.16.5, 6.17, 6.6.104
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3fc11ff13fbc2749871d6ac2141685cf54699997
CVE-2025-39825: kernel: smb: client: fix race with concurrent opens in rename(2)
Component: kernel
Severity: Moderate
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-09-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix race with concurrent opens in rename(2)

Besides sending the rename request to the server, the rename process
also involves closing any deferred close, waiting for outstanding I/O
to complete as well as marking all existing open handles as deleted to
prevent them from deferring closes, which increases the race window
for potential concurrent opens on the target file.

Fix this by unhashing the dentry in advance to prevent any concurrent
opens on the target.


Affected upstream versions: 5.13
Fixed upstream versions: 0, 6.1.150, 6.12.45, 6.16.5, 6.17, 6.6.104
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c9e7de284da0be5b44dbe79d71573f9f7f9b144c
CVE-2025-39840: kernel: audit: fix out-of-bounds read in audit_compare_dname_path()
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-09-19T00:00:00+00:00

An out of bounds read exists in the linux kernel such that 
when a watch on dir=/ is combined with an fsnotify event for a
single-character name directly under root an
out-of-bounds read can occur in audit_compare_dname_path().


Affected upstream versions: 6.14
Fixed upstream versions: 0, 6.16.6, 6.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9735a9dcc307427e7d6336c54171682f1bac9789
CVE-2025-39841: kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-09-19T00:00:00+00:00

A use-after-free vulnerability exists in the linux kernel such that the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock.


Affected upstream versions: 5.1
Fixed upstream versions: 0, 5.10.243, 5.15.192, 5.4.299, 6.1.151, 6.12.46, 6.16.6, 6.17, 6.6.105
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ab34084f42ee06a9028d67c78feafb911d33d111
CVE-2025-39843: kernel: mm: slub: avoid wake up kswapd in set_track_prepare
Component: kernel
Severity: Moderate
CWE: CWE-833 (Deadlock)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-19T00:00:00+00:00

A deadlock lock recursion vulnerability exists in the linux kernel such that when CONFIG_DEBUG_OBJECTS_TIMERS is set, may wake up kswapd in set_track_prepare, and try to hold the per_cpu(hrtimer_bases) lock.

Statement: This issue can only occur on debug kernel builds with specific configuration options enabled (e.g. CONFIG_SLUB_DEBUG, CONFIG_STACKDEPOT, SLAB_STORE_USER). It may lead to a deadlock (spinlock recursion) under rare timing conditions but cannot be triggered on standard production kernels. The impact is limited to a local denial of service.

Affected upstream versions: 5.19
Fixed upstream versions: 0, 6.1.151, 6.12.46, 6.16.6, 6.17, 6.6.105
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 994b03b9605d36d814c611385fbf90ca6db20aa8
CVE-2025-39849: kernel: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.5 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-09-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()

If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would
lead to memory corruption so add some bounds checking.

Statement: A bounds check was missing when copying the SSID IE in __cfg80211_connect_result(), allowing an over-length SSID element to overflow a fixed-size kernel buffer. A malicious AP or 802.11 frame injector in radio range could trigger kernel memory corruption during connection/auto-connect, leading to crash or potential code execution.

Affected upstream versions: 6.1.16 < 6.1.151, 6.2.3 < 6.3, 6.3
Fixed upstream versions: 0, 6.1.151, 6.12.46, 6.16.6, 6.17, 6.3, 6.6.105
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8e751d46336205abc259ed3990e850a9843fb649
CVE-2025-39864: kernel: wifi: cfg80211: fix use-after-free in cmp_bss()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-09-19T00:00:00+00:00

A use after free vulnerbility  exists in the linux kernel wifi module in the cmp_bss() function,an attacker could create a crafted payload to trigger, leading to damage availability and integrity of the system

Statement: A use-after-free issue was discovered in the cfg80211 subsystem, caused by freeing beacon_ies structures even when they were still referenced through hidden_beacon_bss.
Exploitation requires local access with capabilities to manage Wi-Fi interfaces (e.g., via nl80211) and is unlikely under normal conditions.
The vulnerability could theoretically lead to kernel memory corruption or privilege escalation, though the trigger is complex.

Affected upstream versions: 5.4
Fixed upstream versions: 0, 5.10.243, 5.15.192, 5.4.299, 6.1.151, 6.12.46, 6.16.6, 6.17, 6.6.105
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a8bb681e879ca3c9f722aa08d3d7ae41c42a8807
CVE-2025-39881: kernel: kernfs: Fix UAF in polling when open file is released
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H)
Public date: 2025-09-23T00:00:00+00:00

A use-after-free race condition exists in the linux kernel such that When cgroup.pressure is disabled, it releases PSI triggers via cgroup_file_release(), Frees of->priv through kernfs_drain_open_files()
leading to damage to the availability and integrity of the system.

Statement: A race in kernfs PSI polling allowed epoll() on a cgroup.*.pressure file to access freed state when the file was released during pressure toggling, leading to a kernel use-after-free and potential crash.

Affected upstream versions: 6.1
Fixed upstream versions: 0, 6.1.153, 6.12.48, 6.16.8, 6.17, 6.6.107
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 34d9cafd469c69ad85e6a36b4303c78382cf5c79
CVE-2025-39883: kernel: mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-09-23T00:00:00+00:00

A use-after-free memory bug exists in the linux kernel, such that unpoison_memory() tries to check the PG_HWPoison
flags of an uninitialized page.  So VM_BUG_ON_PAGE(PagePoisoned(page)) is triggered, leading to damage to the system availability and integrity.


Affected upstream versions: 4.13
Fixed upstream versions: 0, 5.10.245, 5.15.194, 5.4.300, 6.1.153, 6.12.48, 6.16.8, 6.17, 6.6.107
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8e01ea186a52c90694c08a9ff57bea1b0e78256a
CVE-2025-39903: kernel: of_numa: fix uninitialized memory nodes causing kernel panic
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-10-01T00:00:00+00:00

A flaw was found in the linux kernel of_numa subsystem fails to properly initialize memory‑only NUMA nodes (i.e., nodes without CPUs). When such nodes remain uninitialized, a subsequent call to free_area_init() may access NODE_DATA() for those nodes and trigger a kernel panic due to a NULL pointer dereference. This can lead to a denial of service (system crash) during boot on affected kernels.


Affected upstream versions: 6.12
Fixed upstream versions: 0, 6.12.46, 6.16.6, 6.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c2daa6eb4740720b5bd0e06267d7c93a3eed844e
CVE-2025-39905: kernel: net: phylink: add lock for serializing concurrent pl->phydev writes with resolver
Component: kernel
Severity: Moderate
CWE: CWE-664 (Improper Control of a Resource Through its Lifetime)
CVSS v3: 6.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H)
Public date: 2025-10-01T00:00:00+00:00

A flaw was found in the Linux kernel’s phylink subsystem: when phylink_resolve() executes while pl->state_mutex is held, it may acquire pl->phydev->lock out of order relative to other paths (phylink_bringup_phy() or phylink_disconnect_phy()) that acquire pl->phydev->lock prior to pl->state_mutex. This lock inversion can result in a deadlock condition or other unexpected behaviour in PHY link management under concurrent operations


Affected upstream versions: 6.14
Fixed upstream versions: 0, 6.16.8, 6.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 56fe63b05ec84ae6674269d78397cec43a7a295a
CVE-2025-39918: kernel: wifi: mt76: fix linked list corruption
Component: kernel
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 7.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-10-01T00:00:00+00:00

A flaw was found in the linux kernal wifi subsystem mt76_txq_schedule_pending_wcid() and mt76_txq_schedule_pending() functions of the mt76 driver. Under certain conditions, scheduled wcid entries are left on a temporary on‑stack list, which may lead to linked‑list corruption and memory corruption, allowing a local attacker to cause a denial of service.


Affected upstream versions: 6.12
Fixed upstream versions: 0, 6.12.46, 6.16.6, 6.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e4d5a5fc61fdc65220a1ce078d24c1d20bbb0835
CVE-2025-39925: kernel: can: j1939: implement NETDEV_UNREGISTER notification handler
Component: kernel
Severity: Moderate
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 4.9 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2025-10-01T00:00:00+00:00

A flaw was discovered in the J1939 protocol implementation in the Linux kernel. The NETDEV_UNREGISTER notification handler was missing for undoing changes performed by j1939_sk_bind(). As a result, an extra reference remains on the j1939_priv structure when unregistering a network device, preventing its usage count from dropping and thus blocking the unregister_netdevice() call


Affected upstream versions: 5.4
Fixed upstream versions: 0, 6.16.8, 6.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: da9e8f429139928570407e8f90559b5d46c20262
CVE-2025-39927: kernel: ceph: fix race condition validating r_parent before applying state
Component: kernel
Severity: Moderate
CWE: CWE-364 (Signal Handler Race Condition)
CVSS v3: 6.4 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-10-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix race condition validating r_parent before applying state

Add validation to ensure the cached parent directory inode matches the
directory info in MDS replies. This prevents client-side race conditions
where concurrent operations (e.g. rename) cause r_parent to become stale
between request initiation and reply processing, which could lead to
applying state changes to incorrect directory inodes.

[ idryomov: folded a kerneldoc fixup and a follow-up fix from Alex to
  move CEPH_CAP_PIN reference when r_parent is updated:

  When the parent directory lock is not held, req->r_parent can become
  stale and is updated to point to the correct inode.  However, the
  associated CEPH_CAP_PIN reference was not being adjusted.  The
  CEPH_CAP_PIN is a reference on an inode that is tracked for
  accounting purposes.  Moving this pin is important to keep the
  accounting balanced. When the pin was not moved from the old parent
  to the new one, it created two problems: The reference on the old,
  stale parent was never released, causing a reference leak.
  A reference for the new parent was never acquired, creating the risk
  of a reference underflow later in ceph_mdsc_release_request().  This
  patch corrects the logic by releasing the pin from the old parent and
  acquiring it for the new parent when r_parent is switched.  This
  ensures reference accounting stays balanced. ]


Affected upstream versions: 2.6.34
Fixed upstream versions: 0, 6.12.48, 6.16.8, 6.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: db378e6f83ec705c6091c65d482d555edc2b0a72
CVE-2025-39933: kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.1 (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-10-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

smb: client: let recv_done verify data_offset, data_length and remaining_data_length

This is inspired by the related server fixes.

Statement: SMB Direct client failed to validate data_offset, data_length, and remaining_data_length in SMBD “data transfer” messages. A malicious server can craft values that cause out-of-bounds access in the kernel receive path, leading to memory corruption and potential code execution.
A malicious SMB Direct server can trigger a kernel crash on a connected and authenticated Linux client by sending malformed data transfer packets over an active RDMA session.

Affected upstream versions: 4.16
Fixed upstream versions: 0, 6.16.9, 6.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 581fb78e0388b78911b0c920e4073737090c8b5f