{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/habanalabs/common/memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c07886761fd6251db6938d4e747002e3d150d231",
              "status": "affected",
              "version": "db1a8dd916aac986871f6b873a3aefad906f383a",
              "versionType": "git"
            },
            {
              "lessThan": "40deceb38f9db759772d1c289c28fd2a543f57fc",
              "status": "affected",
              "version": "db1a8dd916aac986871f6b873a3aefad906f383a",
              "versionType": "git"
            },
            {
              "lessThan": "55c232d7e0241f1d5120b595e7a9de24c75ed3d8",
              "status": "affected",
              "version": "db1a8dd916aac986871f6b873a3aefad906f383a",
              "versionType": "git"
            },
            {
              "lessThan": "33927f3d0ecdcff06326d6e4edb6166aed42811c",
              "status": "affected",
              "version": "db1a8dd916aac986871f6b873a3aefad906f383a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/habanalabs/common/memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.43",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhabanalabs: fix UAF in export_dmabuf()\n\nAs soon as we\u0027d inserted a file reference into descriptor table, another\nthread could close it.  That\u0027s fine for the case when all we are doing is\nreturning that descriptor to userland (it\u0027s a race, but it\u0027s a userland\nrace and there\u0027s nothing the kernel can do about it).  However, if we\nfollow fd_install() with any kind of access to objects that would be\ndestroyed on close (be it the struct file itself or anything destroyed\nby its -\u003erelease()), we have a UAF.\n\ndma_buf_fd() is a combination of reserving a descriptor and fd_install().\nhabanalabs export_dmabuf() calls it and then proceeds to access the\nobjects destroyed on close.  In particular, it grabs an extra reference to\nanother struct file that will be dropped as part of -\u003erelease() for ours;\nthat \"will be\" is actually \"might have already been\".\n\nFix that by reserving descriptor before anything else and do fd_install()\nonly when everything had been set up.  As a side benefit, we no longer\nhave the failure exit with file already created, but reference to\nunderlying file (as well as -\u003edmabuf_export_cnt, etc.) not grabbed yet;\nunlike dma_buf_fd(), fd_install() can\u0027t fail."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through the DRM_IOCTL_HL_MEMORY ioctl (HL_MEM_OP_EXPORT_DMABUF_FD) on the local /dev/accel/accelN character device, requiring local system access. No network or physical vector is involved.\nAC:L - The attacker owns both sides of the race \u2014 one thread issues the export ioctl while a sibling thread spins on close() of the deterministically-numbered fd in the same process\u0027s fd table \u2014 and the ioctl can be retried indefinitely until the window is won. No condition depends on external state the attacker cannot influence.\nPR:L - The ioctl is registered with flags 0, so drm_ioctl_permit(), accel_open(), hl_device_open() and hl_mem_ioctl() perform no capability, root, or DRM-auth check; only an open fd on the accel node is required, which unprivileged compute users and containerized AI workloads normally have.\nUI:N - The attacking process triggers the race entirely on its own with two of its own threads. No victim action, mount, or file open is needed.\nS:U - The premature reference drops corrupt kernel objects (struct hl_ctx, struct file) within the same kernel security authority. No IOMMU, hypervisor, or sandbox boundary is crossed.\nC:H - The use-after-free lets the attacker reclaim the freed hl_ctx/struct file slab objects with controlled content and have the kernel dereference them (ctx-\u003ehdev, ctx-\u003ehpriv-\u003efile_priv-\u003efilp), and the premature fput() on the accel device file yields a DirtyCred-style file UAF enabling arbitrary kernel memory disclosure.\nI:H - The exporting thread performs atomic refcount increments (hl_ctx_get, atomic_inc, get_file) through pointers read out of freed, attacker-reclaimable memory, giving a write primitive at an influenceable address; a dangling struct file reference is a well-established path to control-flow hijack and privilege escalation.\nA:H - Losing the race yields a NULL pointer dereference in memhash_node_export_put() (ctx is still NULL) or refcount underflow and use-after-free on the context and device file, causing an immediate kernel oops/panic that any local user can trigger repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:04:17.161Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c07886761fd6251db6938d4e747002e3d150d231"
        },
        {
          "url": "https://git.kernel.org/stable/c/40deceb38f9db759772d1c289c28fd2a543f57fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/55c232d7e0241f1d5120b595e7a9de24c75ed3d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/33927f3d0ecdcff06326d6e4edb6166aed42811c"
        }
      ],
      "title": "habanalabs: fix UAF in export_dmabuf()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38722",
    "datePublished": "2025-09-04T15:33:15.641Z",
    "dateReserved": "2025-04-16T04:51:24.033Z",
    "dateUpdated": "2026-08-05T12:04:17.161Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:34:44.423Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/skmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4edb40b05cb6a261775abfd8046804ca139a5546",
              "status": "affected",
              "version": "4959ffc65a0e94f8acaac20deac49f89e6ded52d",
              "versionType": "git"
            },
            {
              "lessThan": "b19cbf0b9a91f5a0d93fbcd761ff71c48ab40ed9",
              "status": "affected",
              "version": "5eabdf17fed2ad41b836bb4055ec36d95e512c50",
              "versionType": "git"
            },
            {
              "lessThan": "4c6fa65ab2aec7df94809478c8d28ef38676a1b7",
              "status": "affected",
              "version": "e946428439a0d2079959f5603256ac51b6047017",
              "versionType": "git"
            },
            {
              "lessThan": "15c0250dae3b48a398447d2b364603821ed4ed90",
              "status": "affected",
              "version": "4b4647add7d3c8530493f7247d11e257ee425bf0",
              "versionType": "git"
            },
            {
              "lessThan": "7c0a16f6ea2b1c82a03bccd5d1bdb4a7bbd4d987",
              "status": "affected",
              "version": "4b4647add7d3c8530493f7247d11e257ee425bf0",
              "versionType": "git"
            },
            {
              "lessThan": "8259eb0e06d8f64c700f5fbdb28a5c18e10de291",
              "status": "affected",
              "version": "4b4647add7d3c8530493f7247d11e257ee425bf0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3627605de498639a3c586c8684d12c89cba11073",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.186",
              "status": "affected",
              "version": "5.15.162",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.142",
              "status": "affected",
              "version": "6.1.95",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.94",
              "status": "affected",
              "version": "6.6.35",
              "versionType": "semver"
            },
            {
              "lessThan": "6.10",
              "status": "affected",
              "version": "6.9.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/skmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.186",
                  "versionStartIncluding": "5.15.162",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "6.1.95",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.94",
                  "versionStartIncluding": "6.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.9.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Avoid using sk_socket after free when sending\n\nThe sk-\u003esk_socket is not locked or referenced in backlog thread, and\nduring the call to skb_send_sock(), there is a race condition with\nthe release of sk_socket. All types of sockets(tcp/udp/unix/vsock)\nwill be affected.\n\nRace conditions:\n\u0027\u0027\u0027\nCPU0                               CPU1\n\nbacklog::skb_send_sock\n  sendmsg_unlocked\n    sock_sendmsg\n      sock_sendmsg_nosec\n                                   close(fd):\n                                     ...\n                                     ops-\u003erelease() -\u003e sock_map_close()\n                                     sk_socket-\u003eops = NULL\n                                     free(socket)\n      sock-\u003eops-\u003esendmsg\n            ^\n            panic here\n\u0027\u0027\u0027\n\nThe ref of psock become 0 after sock_map_close() executed.\n\u0027\u0027\u0027\nvoid sock_map_close()\n{\n    ...\n    if (likely(psock)) {\n    ...\n    // !! here we remove psock and the ref of psock become 0\n    sock_map_remove_links(sk, psock)\n    psock = sk_psock_get(sk);\n    if (unlikely(!psock))\n        goto no_psock; \u003c=== Control jumps here via goto\n        ...\n        cancel_delayed_work_sync(\u0026psock-\u003ework); \u003c=== not executed\n        sk_psock_put(sk, psock);\n        ...\n}\n\u0027\u0027\u0027\n\nBased on the fact that we already wait for the workqueue to finish in\nsock_map_close() if psock is held, we simply increase the psock\nreference count to avoid race conditions.\n\nWith this patch, if the backlog thread is running, sock_map_close() will\nwait for the backlog thread to complete and cancel all pending work.\n\nIf no backlog running, any pending work that hasn\u0027t started by then will\nfail when invoked by sk_psock_get(), as the psock reference count have\nbeen zeroed, and sk_psock_drop() will cancel all jobs via\ncancel_delayed_work_sync().\n\nIn summary, we require synchronization to coordinate the backlog thread\nand close() thread.\n\nThe panic I catched:\n\u0027\u0027\u0027\nWorkqueue: events sk_psock_backlog\nRIP: 0010:sock_sendmsg+0x21d/0x440\nRAX: 0000000000000000 RBX: ffffc9000521fad8 RCX: 0000000000000001\n...\nCall Trace:\n \u003cTASK\u003e\n ? die_addr+0x40/0xa0\n ? exc_general_protection+0x14c/0x230\n ? asm_exc_general_protection+0x26/0x30\n ? sock_sendmsg+0x21d/0x440\n ? sock_sendmsg+0x3e0/0x440\n ? __pfx_sock_sendmsg+0x10/0x10\n __skb_send_sock+0x543/0xb70\n sk_psock_backlog+0x247/0xb80\n...\n\u0027\u0027\u0027"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is closed by a local `close(fd)` on a sockmap-enrolled socket concurrent with the BPF backlog worker; while remote peer data drives the backlog side, the attacker must be local to control the socket lifetime. BPF/sockmap is Local per kernel scoring guidance.\nAC:L - The attacker controls both sides of the race \u2014 it generates the redirected traffic that schedules `sk_psock_backlog()` and picks the `close()` timing \u2014 and can repeat the attempt in a tight loop until it wins. No condition outside its influence is required.\nPR:L - An unprivileged local process suffices in the real deployments of this feature (Cilium/Istio sockops redirect, BPF-token-delegated containers), where a privileged agent enrols workload sockets into the sockmap and the attacker only needs to send/redirect data and close its own fd.\nUI:N - No victim action is needed; the attacker drives both the traffic and the close from its own process.\nS:U - The use-after-free and any resulting corruption remain within the kernel\u0027s own security authority, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - Use-after-free on `struct socket` \u2014 the freed object can be resprayed from `sock_inode_cachep`, causing redirected payload to be transmitted through a stale/attacker-influenced socket and permitting kernel memory disclosure.\nI:H - `security_socket_sendmsg()` and `READ_ONCE(sock-\u003eops)-\u003esendmsg` dereference and indirect-call through a pointer loaded from freed memory, giving a control-flow hijack primitive once the freed `struct socket` is reclaimed with attacker-groomed contents.\nA:H - The maintainer reproduced a general-protection fault in `sock_sendmsg()` from the `sk_psock_backlog` workqueue; the NULLed `sock-\u003eops` alone guarantees a fatal kernel oops in worker context."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:59:54.410Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4edb40b05cb6a261775abfd8046804ca139a5546"
        },
        {
          "url": "https://git.kernel.org/stable/c/b19cbf0b9a91f5a0d93fbcd761ff71c48ab40ed9"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c6fa65ab2aec7df94809478c8d28ef38676a1b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/15c0250dae3b48a398447d2b364603821ed4ed90"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c0a16f6ea2b1c82a03bccd5d1bdb4a7bbd4d987"
        },
        {
          "url": "https://git.kernel.org/stable/c/8259eb0e06d8f64c700f5fbdb28a5c18e10de291"
        }
      ],
      "title": "bpf, sockmap: Avoid using sk_socket after free when sending",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38154",
    "datePublished": "2025-07-03T08:35:57.188Z",
    "dateReserved": "2025-04-16T04:51:23.990Z",
    "dateUpdated": "2026-08-05T11:59:54.410Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:42:48.789Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-39730",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:41:59.038817Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:18.274Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/export.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7f8eca87fef7519e9c41f3258f25ebc2752247ee",
              "status": "affected",
              "version": "20fa19027286983ab2734b5910c4a687436e0c31",
              "versionType": "git"
            },
            {
              "lessThan": "cb09afa0948d96b1e385d609ed044bb1aa043536",
              "status": "affected",
              "version": "20fa19027286983ab2734b5910c4a687436e0c31",
              "versionType": "git"
            },
            {
              "lessThan": "3570ef5c31314c13274c935a20b91768ab5bf412",
              "status": "affected",
              "version": "20fa19027286983ab2734b5910c4a687436e0c31",
              "versionType": "git"
            },
            {
              "lessThan": "763810bb883cb4de412a72f338d80947d97df67b",
              "status": "affected",
              "version": "20fa19027286983ab2734b5910c4a687436e0c31",
              "versionType": "git"
            },
            {
              "lessThan": "12ad3def2e5e0b120e3d0cb6ce8b7b796819ad40",
              "status": "affected",
              "version": "20fa19027286983ab2734b5910c4a687436e0c31",
              "versionType": "git"
            },
            {
              "lessThan": "2ad40b7992aa26bc631afc1a995b0e3ddc30de3f",
              "status": "affected",
              "version": "20fa19027286983ab2734b5910c4a687436e0c31",
              "versionType": "git"
            },
            {
              "lessThan": "b7f7866932466332a2528fda099000b035303485",
              "status": "affected",
              "version": "20fa19027286983ab2734b5910c4a687436e0c31",
              "versionType": "git"
            },
            {
              "lessThan": "7dd36f7477d1e03a1fcf8d13531ca326c4fb599f",
              "status": "affected",
              "version": "20fa19027286983ab2734b5910c4a687436e0c31",
              "versionType": "git"
            },
            {
              "lessThan": "ef93a685e01a281b5e2a25ce4e3428cf9371a205",
              "status": "affected",
              "version": "20fa19027286983ab2734b5910c4a687436e0c31",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/export.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.102",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix filehandle bounds checking in nfs_fh_to_dentry()\n\nThe function needs to check the minimal filehandle length before it can\naccess the embedded filehandle."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:35:09.757Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7f8eca87fef7519e9c41f3258f25ebc2752247ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb09afa0948d96b1e385d609ed044bb1aa043536"
        },
        {
          "url": "https://git.kernel.org/stable/c/3570ef5c31314c13274c935a20b91768ab5bf412"
        },
        {
          "url": "https://git.kernel.org/stable/c/763810bb883cb4de412a72f338d80947d97df67b"
        },
        {
          "url": "https://git.kernel.org/stable/c/12ad3def2e5e0b120e3d0cb6ce8b7b796819ad40"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ad40b7992aa26bc631afc1a995b0e3ddc30de3f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7f7866932466332a2528fda099000b035303485"
        },
        {
          "url": "https://git.kernel.org/stable/c/7dd36f7477d1e03a1fcf8d13531ca326c4fb599f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef93a685e01a281b5e2a25ce4e3428cf9371a205"
        }
      ],
      "title": "NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39730",
    "datePublished": "2025-09-07T15:16:19.377Z",
    "dateReserved": "2025-04-16T07:20:57.118Z",
    "dateUpdated": "2026-06-11T18:44:18.274Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:40:19.561Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e64732ebff9e24258e7326f07adbe2f2b990daf8",
              "status": "affected",
              "version": "c1db52b9d27ee6e15a7136e67e4a21dc916cd07f",
              "versionType": "git"
            },
            {
              "lessThan": "789415771422f4fb9f444044f86ecfaec55df1bd",
              "status": "affected",
              "version": "c1db52b9d27ee6e15a7136e67e4a21dc916cd07f",
              "versionType": "git"
            },
            {
              "lessThan": "c73c773b09e313278f9b960303a2809b8440bac6",
              "status": "affected",
              "version": "c1db52b9d27ee6e15a7136e67e4a21dc916cd07f",
              "versionType": "git"
            },
            {
              "lessThan": "8c767727f331fb9455b0f81daad832b5925688cb",
              "status": "affected",
              "version": "c1db52b9d27ee6e15a7136e67e4a21dc916cd07f",
              "versionType": "git"
            },
            {
              "lessThan": "14ca6952691fa8cc91e7644512e6ff24a595283f",
              "status": "affected",
              "version": "c1db52b9d27ee6e15a7136e67e4a21dc916cd07f",
              "versionType": "git"
            },
            {
              "lessThan": "7858a95566f4ebf59524666683d2dcdba3fca968",
              "status": "affected",
              "version": "c1db52b9d27ee6e15a7136e67e4a21dc916cd07f",
              "versionType": "git"
            },
            {
              "lessThan": "c51a45ad9070a6d296174fcbe5c466352836c12b",
              "status": "affected",
              "version": "c1db52b9d27ee6e15a7136e67e4a21dc916cd07f",
              "versionType": "git"
            },
            {
              "lessThan": "81cfe34d0630de4e23ae804dcc08fb6f861dc37d",
              "status": "affected",
              "version": "c1db52b9d27ee6e15a7136e67e4a21dc916cd07f",
              "versionType": "git"
            },
            {
              "lessThan": "16d8fd74dbfca0ea58645cd2fca13be10cae3cdd",
              "status": "affected",
              "version": "c1db52b9d27ee6e15a7136e67e4a21dc916cd07f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.29"
            },
            {
              "lessThan": "2.6.29",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.102",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtl818x: Kill URBs before clearing tx status queue\n\nIn rtl8187_stop() move the call of usb_kill_anchored_urbs() before clearing\nb_tx_status.queue. This change prevents callbacks from using already freed\nskb due to anchor was not killed before freeing such skb.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000080\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: Oops: 0000 [#1] SMP NOPTI\n CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Not tainted 6.15.0 #8 PREEMPT(voluntary)\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015\n RIP: 0010:ieee80211_tx_status_irqsafe+0x21/0xc0 [mac80211]\n Call Trace:\n  \u003cIRQ\u003e\n  rtl8187_tx_cb+0x116/0x150 [rtl8187]\n  __usb_hcd_giveback_urb+0x9d/0x120\n  usb_giveback_urb_bh+0xbb/0x140\n  process_one_work+0x19b/0x3c0\n  bh_worker+0x1a7/0x210\n  tasklet_action+0x10/0x30\n  handle_softirqs+0xf0/0x340\n  __irq_exit_rcu+0xcd/0xf0\n  common_interrupt+0x85/0xa0\n  \u003c/IRQ\u003e\n\nTested on RTL8187BvE device.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is armed by locally bringing the wireless interface down (`ip link set wlan0 down` \u2192 `ieee80211_stop()` \u2192 `ieee80211_do_stop()` \u2192 `drv_stop()` \u2192 `rtl8187_stop()`) while local TX traffic keeps URBs in flight; no received 802.11 frame or routable packet can invoke the driver\u0027s stop callback, so an adjacent or remote peer cannot reach the vulnerable path.\nAC:L - The attacker owns both sides of the race \u2014 they flood the TX path to keep more than five entries in `b_tx_status.queue` (the exact precondition for the racing `skb_dequeue()` in `rtl8187_tx_cb()`\u0027s drain loop) and then issue the interface-down, repeating the up/down cycle indefinitely until the window between the drain loop and `usb_kill_anchored_urbs()` is hit; `CONFIG_RTL8187` is a stock distro module, so no rare configuration is required.\nPR:L - Bringing the interface down requires CAP_NET_ADMIN over the network namespace owning the netdev, which an unprivileged user holds via `unshare -Ur` once the wiphy has been delegated into a container netns \u2014 the same reasoning applied to mac80211 configuration paths in CVE-2025-38642; on desktop deployments polkit additionally lets an active unprivileged session toggle WiFi through NetworkManager.\nUI:N - The attacker performs both the traffic generation and the interface down/up cycle themselves; no victim needs to open a file, mount anything, or take any other action.\nS:U - The freed/NULL sk_buff is dereferenced in the host kernel\u0027s own driver and mac80211 context, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - The fix exists to stop URB completion callbacks from consuming skbs already released by `dev_kfree_skb_any()`; a freed `struct sk_buff` reallocated by a concurrent attacker-controlled allocation supplies the `ieee80211_hw *` read from `info-\u003erate_driver_data[0]` and is then relinked into mac80211\u0027s status queues, yielding a controlled kernel-pointer dereference and read primitive.\nI:H - The same use-after-free window lets a sprayed replacement object drive `hw-\u003epriv` and the subsequent `ieee80211_tx_status_irqsafe()` queueing, and skbs re-queued by `rtl8187_tx_cb()` after the drain are later freed again, giving double-free and heap-corruption primitives exploitable for control-flow hijack.\nA:H - The reproduced impact on real RTL8187BvE hardware is a kernel oops from `ieee80211_tx_status_irqsafe()` dereferencing a NULL skb inside the USB giveback BH, which kills the softirq worker and wedges the WLAN device, and becomes a full panic on systems with `panic_on_oops`; the attacker can re-trigger it at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:03:25.920Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e64732ebff9e24258e7326f07adbe2f2b990daf8"
        },
        {
          "url": "https://git.kernel.org/stable/c/789415771422f4fb9f444044f86ecfaec55df1bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/c73c773b09e313278f9b960303a2809b8440bac6"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c767727f331fb9455b0f81daad832b5925688cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/14ca6952691fa8cc91e7644512e6ff24a595283f"
        },
        {
          "url": "https://git.kernel.org/stable/c/7858a95566f4ebf59524666683d2dcdba3fca968"
        },
        {
          "url": "https://git.kernel.org/stable/c/c51a45ad9070a6d296174fcbe5c466352836c12b"
        },
        {
          "url": "https://git.kernel.org/stable/c/81cfe34d0630de4e23ae804dcc08fb6f861dc37d"
        },
        {
          "url": "https://git.kernel.org/stable/c/16d8fd74dbfca0ea58645cd2fca13be10cae3cdd"
        }
      ],
      "title": "wifi: rtl818x: Kill URBs before clearing tx status queue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38604",
    "datePublished": "2025-08-19T17:03:43.358Z",
    "dateReserved": "2025-04-16T04:51:24.028Z",
    "dateUpdated": "2026-08-05T12:03:25.920Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/qcom/qdsp6/q6apm-lpass-dais.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "01d1ba106c9e02a2e7d41e07be49031a0ff0ecaa",
              "status": "affected",
              "version": "30ad723b93ade607a678698e5947a55a4375c3a1",
              "versionType": "git"
            },
            {
              "lessThan": "411f7d4f7038200cdf6d4f71ee31026ebf2dfedb",
              "status": "affected",
              "version": "30ad723b93ade607a678698e5947a55a4375c3a1",
              "versionType": "git"
            },
            {
              "lessThan": "9c534dbfd1726502abcf0bd393a04214f62c050b",
              "status": "affected",
              "version": "30ad723b93ade607a678698e5947a55a4375c3a1",
              "versionType": "git"
            },
            {
              "lessThan": "cc336b242ea7e7a09b3ab9f885341455ca0a3bdb",
              "status": "affected",
              "version": "30ad723b93ade607a678698e5947a55a4375c3a1",
              "versionType": "git"
            },
            {
              "lessThan": "68f27f7c7708183e7873c585ded2f1b057ac5b97",
              "status": "affected",
              "version": "30ad723b93ade607a678698e5947a55a4375c3a1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/qcom/qdsp6/q6apm-lpass-dais.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.154",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.108",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.49",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.9",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed\n\nIf earlier opening of source graph fails (e.g. ADSP rejects due to\nincorrect audioreach topology), the graph is closed and\n\"dai_data-\u003egraph[dai-\u003eid]\" is assigned NULL.  Preparing the DAI for sink\ngraph continues though and next call to q6apm_lpass_dai_prepare()\nreceives dai_data-\u003egraph[dai-\u003eid]=NULL leading to NULL pointer\nexception:\n\n  qcom-apm gprsvc:service:2:1: Error (1) Processing 0x01001002 cmd\n  qcom-apm gprsvc:service:2:1: DSP returned error[1001002] 1\n  q6apm-lpass-dais 30000000.remoteproc:glink-edge:gpr:service@1:bedais: fail to start APM port 78\n  q6apm-lpass-dais 30000000.remoteproc:glink-edge:gpr:service@1:bedais: ASoC: error at snd_soc_pcm_dai_prepare on TX_CODEC_DMA_TX_3: -22\n  Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a8\n  ...\n  Call trace:\n   q6apm_graph_media_format_pcm+0x48/0x120 (P)\n   q6apm_lpass_dai_prepare+0x110/0x1b4\n   snd_soc_pcm_dai_prepare+0x74/0x108\n   __soc_pcm_prepare+0x44/0x160\n   dpcm_be_dai_prepare+0x124/0x1c0"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:39:19.660Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/01d1ba106c9e02a2e7d41e07be49031a0ff0ecaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/411f7d4f7038200cdf6d4f71ee31026ebf2dfedb"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c534dbfd1726502abcf0bd393a04214f62c050b"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc336b242ea7e7a09b3ab9f885341455ca0a3bdb"
        },
        {
          "url": "https://git.kernel.org/stable/c/68f27f7c7708183e7873c585ded2f1b057ac5b97"
        }
      ],
      "title": "ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39938",
    "datePublished": "2025-10-04T07:31:01.736Z",
    "dateReserved": "2025-04-16T07:20:57.148Z",
    "dateUpdated": "2026-05-11T21:39:19.660Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/fprobe.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ce3ec57faff559ccae1e0150c1f077eb2df648a4",
              "status": "affected",
              "version": "5b0ab78998e32564a011b14c4c7f9c81e2d42b9d",
              "versionType": "git"
            },
            {
              "lessThan": "03d63255a5783243c110aec5e6ae2f1475c3be76",
              "status": "affected",
              "version": "5b0ab78998e32564a011b14c4c7f9c81e2d42b9d",
              "versionType": "git"
            },
            {
              "lessThan": "5f81018753dfd4989e33ece1f0cb6b8aae498b82",
              "status": "affected",
              "version": "5b0ab78998e32564a011b14c4c7f9c81e2d42b9d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/fprobe.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.40",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.5",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfprobe: Release rethook after the ftrace_ops is unregistered\n\nWhile running bpf selftests it\u0027s possible to get following fault:\n\n  general protection fault, probably for non-canonical address \\\n  0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC NOPTI\n  ...\n  Call Trace:\n   \u003cTASK\u003e\n   fprobe_handler+0xc1/0x270\n   ? __pfx_bpf_testmod_init+0x10/0x10\n   ? __pfx_bpf_testmod_init+0x10/0x10\n   ? bpf_fentry_test1+0x5/0x10\n   ? bpf_fentry_test1+0x5/0x10\n   ? bpf_testmod_init+0x22/0x80\n   ? do_one_initcall+0x63/0x2e0\n   ? rcu_is_watching+0xd/0x40\n   ? kmalloc_trace+0xaf/0xc0\n   ? do_init_module+0x60/0x250\n   ? __do_sys_finit_module+0xac/0x120\n   ? do_syscall_64+0x37/0x90\n   ? entry_SYSCALL_64_after_hwframe+0x72/0xdc\n   \u003c/TASK\u003e\n\nIn unregister_fprobe function we can\u0027t release fp-\u003erethook while it\u0027s\npossible there are some of its users still running on another cpu.\n\nMoving rethook_free call after fp-\u003eops is unregistered with\nunregister_ftrace_function call."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through the local `bpf()` syscall \u2014 attaching a `kprobe_multi` return link and then closing its fd (`bpf_kprobe_multi_link_release()` \u2192 `unregister_fprobe()`). There is no network-facing path into fprobe/rethook.\nAC:L - The attacker controls both sides of the race: they pick which functions are traced (choosing hot paths, or calling them in tight loops on other CPUs), choose when to close the link fd, and can widen the window arbitrarily by contending `ftrace_lock`, which `unregister_ftrace_function()` blocks on before the ops is ever removed, so an RCU grace period reliably elapses while the handler is still live.\nPR:L - Attaching a `kprobe_multi` return probe needs CAP_BPF+CAP_PERFMON, which are delegatable non-root capabilities routinely granted to unprivileged observability/tracing daemons and containers (Cilium, Falco, profilers) rather than full administrative control of the system. Compromise of any such non-root component yields the primitive.\nUI:N - The attacker performs the entire sequence \u2014 attach the fprobe, close the link, keep the traced functions hot \u2014 with no action from any other user or victim process.\nS:U - The use-after-free corrupts kernel heap and kernel control flow within the same security authority; there is no crossing of a VM, IOMMU, or hypervisor boundary.\nC:H - The freed `struct rethook` is dereferenced after reallocation, giving an arbitrary read via `READ_ONCE(head-\u003enext)` in `freelist_try_get()`, and `arch_rethook_prepare()` plus `fpr-\u003eentry_ip` writes leak live kernel text/return addresses into attacker-observable memory, defeating KASLR and enabling broad memory disclosure.\nI:H - The UAF yields an atomic RMW write at an attacker-chosen address (`atomic_try_cmpxchg_acquire(\u0026head-\u003erefs, ...)`), controlled pointer writes via `fpr-\u003eentry_ip`/`entry_parent_ip`, and ultimately an indirect call through the attacker-controlled `rhn-\u003erethook-\u003ehandler` in `rethook_trampoline_handler()` \u2014 a direct kernel control-flow hijack and privilege escalation.\nA:H - Even unweaponized, the bug produces an immediate general protection fault on a non-canonical poisoned pointer inside `fprobe_handler()`, as shown in the commit\u0027s oops, panicking the kernel; it can be re-triggered at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:14:48.968Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ce3ec57faff559ccae1e0150c1f077eb2df648a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/03d63255a5783243c110aec5e6ae2f1475c3be76"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f81018753dfd4989e33ece1f0cb6b8aae498b82"
        }
      ],
      "title": "fprobe: Release rethook after the ftrace_ops is unregistered",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53557",
    "datePublished": "2025-10-04T15:17:02.077Z",
    "dateReserved": "2025-10-04T15:14:15.923Z",
    "dateUpdated": "2026-08-05T09:14:48.968Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/pci/b2c2/flexcop-pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "607010d07b8a509b01ed15ea12744acac6536a98",
              "status": "affected",
              "version": "382c5546d618f24dc7d6ae7ca33412083720efbf",
              "versionType": "git"
            },
            {
              "lessThan": "bde8173def374230226e8554efb51b271f4066ec",
              "status": "affected",
              "version": "382c5546d618f24dc7d6ae7ca33412083720efbf",
              "versionType": "git"
            },
            {
              "lessThan": "120e221b4bbe9d0f6c09b5c4dc53ca4ad91d956b",
              "status": "affected",
              "version": "382c5546d618f24dc7d6ae7ca33412083720efbf",
              "versionType": "git"
            },
            {
              "lessThan": "d502df8a716d993fa0f9d8c00684f1190750e28e",
              "status": "affected",
              "version": "382c5546d618f24dc7d6ae7ca33412083720efbf",
              "versionType": "git"
            },
            {
              "lessThan": "bb10a9ddc8d6c5dbf098f21eb1055a652652e524",
              "status": "affected",
              "version": "382c5546d618f24dc7d6ae7ca33412083720efbf",
              "versionType": "git"
            },
            {
              "lessThan": "514a519baa9e2be7ddc2714bd730bc5a883e1244",
              "status": "affected",
              "version": "382c5546d618f24dc7d6ae7ca33412083720efbf",
              "versionType": "git"
            },
            {
              "lessThan": "3ffabc79388e68877d9c02f724a0b7a38d519daf",
              "status": "affected",
              "version": "382c5546d618f24dc7d6ae7ca33412083720efbf",
              "versionType": "git"
            },
            {
              "lessThan": "6a92f5796880f5aa345f0fed53ef511e3fd6f706",
              "status": "affected",
              "version": "382c5546d618f24dc7d6ae7ca33412083720efbf",
              "versionType": "git"
            },
            {
              "lessThan": "01e03fb7db419d39e18d6090d4873c1bff103914",
              "status": "affected",
              "version": "382c5546d618f24dc7d6ae7ca33412083720efbf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/pci/b2c2/flexcop-pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.29"
            },
            {
              "lessThan": "2.6.29",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.301",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.246",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.301",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.246",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.195",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.156",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.110",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.51",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.11",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.1",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove\n\nThe original code uses cancel_delayed_work() in flexcop_pci_remove(), which\ndoes not guarantee that the delayed work item irq_check_work has fully\ncompleted if it was already running. This leads to use-after-free scenarios\nwhere flexcop_pci_remove() may free the flexcop_device while irq_check_work\nis still active and attempts to dereference the device.\n\nA typical race condition is illustrated below:\n\nCPU 0 (remove)                         | CPU 1 (delayed work callback)\nflexcop_pci_remove()                   | flexcop_pci_irq_check_work()\n  cancel_delayed_work()                |\n  flexcop_device_kfree(fc_pci-\u003efc_dev) |\n                                       |   fc = fc_pci-\u003efc_dev; // UAF\n\nThis is confirmed by a KASAN report:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0\nWrite of size 8 at addr ffff8880093aa8c8 by task bash/135\n...\nCall Trace:\n \u003cIRQ\u003e\n dump_stack_lvl+0x55/0x70\n print_report+0xcf/0x610\n ? __run_timer_base.part.0+0x7d7/0x8c0\n kasan_report+0xb8/0xf0\n ? __run_timer_base.part.0+0x7d7/0x8c0\n __run_timer_base.part.0+0x7d7/0x8c0\n ? __pfx___run_timer_base.part.0+0x10/0x10\n ? __pfx_read_tsc+0x10/0x10\n ? ktime_get+0x60/0x140\n ? lapic_next_event+0x11/0x20\n ? clockevents_program_event+0x1d4/0x2a0\n run_timer_softirq+0xd1/0x190\n handle_softirqs+0x16a/0x550\n irq_exit_rcu+0xaf/0xe0\n sysvec_apic_timer_interrupt+0x70/0x80\n \u003c/IRQ\u003e\n...\n\nAllocated by task 1:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x7f/0x90\n __kmalloc_noprof+0x1be/0x460\n flexcop_device_kmalloc+0x54/0xe0\n flexcop_pci_probe+0x1f/0x9d0\n local_pci_probe+0xdc/0x190\n pci_device_probe+0x2fe/0x470\n really_probe+0x1ca/0x5c0\n __driver_probe_device+0x248/0x310\n driver_probe_device+0x44/0x120\n __driver_attach+0xd2/0x310\n bus_for_each_dev+0xed/0x170\n bus_add_driver+0x208/0x500\n driver_register+0x132/0x460\n do_one_initcall+0x89/0x300\n kernel_init_freeable+0x40d/0x720\n kernel_init+0x1a/0x150\n ret_from_fork+0x10c/0x1a0\n ret_from_fork_asm+0x1a/0x30\n\nFreed by task 135:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3a/0x60\n __kasan_slab_free+0x3f/0x50\n kfree+0x137/0x370\n flexcop_device_kfree+0x32/0x50\n pci_device_remove+0xa6/0x1d0\n device_release_driver_internal+0xf8/0x210\n pci_stop_bus_device+0x105/0x150\n pci_stop_and_remove_bus_device_locked+0x15/0x30\n remove_store+0xcc/0xe0\n kernfs_fop_write_iter+0x2c3/0x440\n vfs_write+0x871/0xd70\n ksys_write+0xee/0x1c0\n do_syscall_64+0xac/0x280\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n...\n\nReplace cancel_delayed_work() with cancel_delayed_work_sync() to ensure\nthat the delayed work item is properly canceled and any executing delayed\nwork has finished before the device memory is deallocated.\n\nThis bug was initially identified through static analysis. To reproduce\nand test it, I simulated the B2C2 FlexCop PCI device in QEMU and introduced\nartificial delays within the flexcop_pci_irq_check_work() function to\nincrease the likelihood of triggering the bug."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:40:27.487Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/607010d07b8a509b01ed15ea12744acac6536a98"
        },
        {
          "url": "https://git.kernel.org/stable/c/bde8173def374230226e8554efb51b271f4066ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/120e221b4bbe9d0f6c09b5c4dc53ca4ad91d956b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d502df8a716d993fa0f9d8c00684f1190750e28e"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb10a9ddc8d6c5dbf098f21eb1055a652652e524"
        },
        {
          "url": "https://git.kernel.org/stable/c/514a519baa9e2be7ddc2714bd730bc5a883e1244"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ffabc79388e68877d9c02f724a0b7a38d519daf"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a92f5796880f5aa345f0fed53ef511e3fd6f706"
        },
        {
          "url": "https://git.kernel.org/stable/c/01e03fb7db419d39e18d6090d4873c1bff103914"
        }
      ],
      "title": "media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39996",
    "datePublished": "2025-10-15T07:58:21.049Z",
    "dateReserved": "2025-04-16T07:20:57.151Z",
    "dateUpdated": "2026-05-11T21:40:27.487Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/card.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "736159f7b296d7a95f7208eb4799639b1f8b16a0",
              "status": "affected",
              "version": "28787ff9fbeaf57684eb64cc33e2ec8ceedf21b5",
              "versionType": "git"
            },
            {
              "lessThan": "8d19a7ab28c7b9c207db5c5282afa8cc8595bcdb",
              "status": "affected",
              "version": "39efc9c8a973ddff5918191525d1679d0fb368ea",
              "versionType": "git"
            },
            {
              "lessThan": "576312eb436326b44b7010f4d9ae2b698df075ea",
              "status": "affected",
              "version": "39efc9c8a973ddff5918191525d1679d0fb368ea",
              "versionType": "git"
            },
            {
              "lessThan": "bba7208765d26e5e36b87f21dacc2780b064f41f",
              "status": "affected",
              "version": "39efc9c8a973ddff5918191525d1679d0fb368ea",
              "versionType": "git"
            },
            {
              "lessThan": "8503ac1a62075a085402e42a386b5c627c821a51",
              "status": "affected",
              "version": "39efc9c8a973ddff5918191525d1679d0fb368ea",
              "versionType": "git"
            },
            {
              "lessThan": "28412b489b088fb88dff488305fd4e56bd47f6e4",
              "status": "affected",
              "version": "39efc9c8a973ddff5918191525d1679d0fb368ea",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9d4f4dc3cd38e412c29a7626489fe48b79ebbf6c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "52076a41c128146c9df4a157e972cb17019313b1",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.196",
              "status": "affected",
              "version": "5.15.75",
              "versionType": "semver"
            },
            {
              "lessThan": "5.20",
              "status": "affected",
              "version": "5.19.17",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1",
              "status": "affected",
              "version": "6.0.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/card.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.196",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.196",
                  "versionStartIncluding": "5.15.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.158",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.114",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.55",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.5",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.19.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.0.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix NULL pointer deference in try_to_register_card\n\nIn try_to_register_card(), the return value of usb_ifnum_to_if() is\npassed directly to usb_interface_claimed() without a NULL check, which\nwill lead to a NULL pointer dereference when creating an invalid\nUSB audio device. Fix this by adding a check to ensure the interface\npointer is valid before passing it to usb_interface_claimed()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:01:24.342Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/736159f7b296d7a95f7208eb4799639b1f8b16a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d19a7ab28c7b9c207db5c5282afa8cc8595bcdb"
        },
        {
          "url": "https://git.kernel.org/stable/c/576312eb436326b44b7010f4d9ae2b698df075ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/bba7208765d26e5e36b87f21dacc2780b064f41f"
        },
        {
          "url": "https://git.kernel.org/stable/c/8503ac1a62075a085402e42a386b5c627c821a51"
        },
        {
          "url": "https://git.kernel.org/stable/c/28412b489b088fb88dff488305fd4e56bd47f6e4"
        }
      ],
      "title": "ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40085",
    "datePublished": "2025-10-29T13:37:04.707Z",
    "dateReserved": "2025-04-16T07:20:57.161Z",
    "dateUpdated": "2026-05-23T16:01:24.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/boot/vmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "30bf5728bb217a6d1ba73f44094c9b9c6bc9a567",
              "status": "affected",
              "version": "32db401965f165f7c44447d0508097f070c8f576",
              "versionType": "git"
            },
            {
              "lessThan": "1d7864acd497cb468a998d44631f84896f885e85",
              "status": "affected",
              "version": "32db401965f165f7c44447d0508097f070c8f576",
              "versionType": "git"
            },
            {
              "lessThan": "93f616ff870a1fb7e84d472cad0af651b18f9f87",
              "status": "affected",
              "version": "32db401965f165f7c44447d0508097f070c8f576",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0b99d0e17d6a73a0526f92bc6b54b2b95e67a31d",
              "versionType": "git"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/boot/vmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.44",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/mm: Do not map lowcore with identity mapping\n\nSince the identity mapping is pinned to address zero the lowcore is always\nalso mapped to address zero, this happens regardless of the relocate_lowcore\ncommand line option. If the option is specified the lowcore is mapped\ntwice, instead of only once.\n\nThis means that NULL pointer accesses will succeed instead of causing an\nexception (low address protection still applies, but covers only parts).\nTo fix this never map the first two pages of physical memory with the\nidentity mapping."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The defective mapping is created by the s390 boot-time page table setup and is leveraged by triggering a kernel NULL pointer dereference, which requires the ability to execute code/syscalls on the affected system. No network protocol handler is involved in the flawed mapping itself.\nAC:L - The identity base is pinned to zero in all default (non-DEBUG_VM) builds, and the lowcore layout at virtual address 0 is a fixed, publicly documented ABI, so the read/write offsets are fully deterministic with no race or memory-layout uncertainty for the attacker to lose.\nPR:L - An ordinary unprivileged local user can reach kernel code paths containing NULL-dereference bugs (many via syscalls, ioctls, or user namespaces); no capability or administrative privilege is needed to convert those into lowcore accesses.\nUI:N - The mapping is established unconditionally at boot and the dereference is triggered directly by the attacker\u0027s own syscall; no action by any other user is required.\nS:U - The corrupted resource is the kernel\u0027s own per-CPU lowcore within the same security authority as the kernel; no hypervisor, IOMMU, or guest/host boundary is crossed.\nC:H - NULL reads now succeed and return lowcore contents, disclosing the stack canary (0x240), current_task (0x340), kernel_stack (0x348), kernel_asce (0x388), and percpu_offset (0x3b8); a large identity page at address 0 additionally exposes the first megabyte of physical memory, and hijacking user_asce or current_task escalates this to arbitrary kernel memory read.\nI:H - Writes to offsets outside low address protection\u0027s 0-511/4096-4607 windows silently corrupt return_psw (0x290), current_task (0x340), the kernel/async/nodat/mcck stack pointers, restart_fn (0x370), and kernel_asce/user_asce, giving kernel control-flow hijack and full privilege escalation instead of a fault.\nA:H - Silent corruption of the lowcore \u2014 the CPU\u0027s PSW, stack pointer, ASCE, and current-task state \u2014 produces immediate kernel panics or undefined CPU behavior, and the missing exception means faults that would have been a contained oops instead destabilize the whole system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:04:23.788Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/30bf5728bb217a6d1ba73f44094c9b9c6bc9a567"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d7864acd497cb468a998d44631f84896f885e85"
        },
        {
          "url": "https://git.kernel.org/stable/c/93f616ff870a1fb7e84d472cad0af651b18f9f87"
        }
      ],
      "title": "s390/mm: Do not map lowcore with identity mapping",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38733",
    "datePublished": "2025-09-05T17:20:33.075Z",
    "dateReserved": "2025-04-16T04:51:24.033Z",
    "dateUpdated": "2026-08-05T12:04:23.788Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:49.707Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/remoteproc/remoteproc_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c56d6ef2711ee51b54f160ad0f25a381561f0287",
              "status": "affected",
              "version": "10a3d4079eaea06472f1981152e2840e7232ffa9",
              "versionType": "git"
            },
            {
              "lessThan": "82208ce9505abb057afdece7c62a14687c52c9ca",
              "status": "affected",
              "version": "10a3d4079eaea06472f1981152e2840e7232ffa9",
              "versionType": "git"
            },
            {
              "lessThan": "9515d74c9d1ae7308a02e8bd4f894eb8137cf8df",
              "status": "affected",
              "version": "10a3d4079eaea06472f1981152e2840e7232ffa9",
              "versionType": "git"
            },
            {
              "lessThan": "92776ca0ccfe78b9bfe847af206bad641fb11121",
              "status": "affected",
              "version": "10a3d4079eaea06472f1981152e2840e7232ffa9",
              "versionType": "git"
            },
            {
              "lessThan": "5434d9f2fd68722b514c14b417b53a8af02c4d24",
              "status": "affected",
              "version": "10a3d4079eaea06472f1981152e2840e7232ffa9",
              "versionType": "git"
            },
            {
              "lessThan": "7692c9fbedd9087dc9050903f58095915458d9b1",
              "status": "affected",
              "version": "10a3d4079eaea06472f1981152e2840e7232ffa9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/remoteproc/remoteproc_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.186",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.95",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach()\n\nWhen rproc-\u003estate = RPROC_DETACHED and rproc_attach() is used\nto attach to the remote processor, if rproc_handle_resources()\nreturns a failure, the resources allocated by imx_rproc_prepare()\nshould be released, otherwise the following memory leak will occur.\n\nSince almost the same thing is done in imx_rproc_prepare() and\nrproc_resource_cleanup(), Function rproc_resource_cleanup() is able\nto deal with empty lists so it is better to fix the \"goto\" statements\nin rproc_attach(). replace the \"unprepare_device\" goto statement with\n\"clean_up_resources\" and get rid of the \"unprepare_device\" label.\n\nunreferenced object 0xffff0000861c5d00 (size 128):\ncomm \"kworker/u12:3\", pid 59, jiffies 4294893509 (age 149.220s)\nhex dump (first 32 bytes):\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n00 00 02 88 00 00 00 00 00 00 10 00 00 00 00 00 ............\nbacktrace:\n [\u003c00000000f949fe18\u003e] slab_post_alloc_hook+0x98/0x37c\n [\u003c00000000adbfb3e7\u003e] __kmem_cache_alloc_node+0x138/0x2e0\n [\u003c00000000521c0345\u003e] kmalloc_trace+0x40/0x158\n [\u003c000000004e330a49\u003e] rproc_mem_entry_init+0x60/0xf8\n [\u003c000000002815755e\u003e] imx_rproc_prepare+0xe0/0x180\n [\u003c0000000003f61b4e\u003e] rproc_boot+0x2ec/0x528\n [\u003c00000000e7e994ac\u003e] rproc_add+0x124/0x17c\n [\u003c0000000048594076\u003e] imx_rproc_probe+0x4ec/0x5d4\n [\u003c00000000efc298a1\u003e] platform_probe+0x68/0xd8\n [\u003c00000000110be6fe\u003e] really_probe+0x110/0x27c\n [\u003c00000000e245c0ae\u003e] __driver_probe_device+0x78/0x12c\n [\u003c00000000f61f6f5e\u003e] driver_probe_device+0x3c/0x118\n [\u003c00000000a7874938\u003e] __device_attach_driver+0xb8/0xf8\n [\u003c0000000065319e69\u003e] bus_for_each_drv+0x84/0xe4\n [\u003c00000000db3eb243\u003e] __device_attach+0xfc/0x18c\n [\u003c0000000072e4e1a4\u003e] device_initial_probe+0x14/0x20"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:27:37.284Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c56d6ef2711ee51b54f160ad0f25a381561f0287"
        },
        {
          "url": "https://git.kernel.org/stable/c/82208ce9505abb057afdece7c62a14687c52c9ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/9515d74c9d1ae7308a02e8bd4f894eb8137cf8df"
        },
        {
          "url": "https://git.kernel.org/stable/c/92776ca0ccfe78b9bfe847af206bad641fb11121"
        },
        {
          "url": "https://git.kernel.org/stable/c/5434d9f2fd68722b514c14b417b53a8af02c4d24"
        },
        {
          "url": "https://git.kernel.org/stable/c/7692c9fbedd9087dc9050903f58095915458d9b1"
        }
      ],
      "title": "remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38419",
    "datePublished": "2025-07-25T14:05:43.741Z",
    "dateReserved": "2025-04-16T04:51:24.014Z",
    "dateUpdated": "2026-05-11T21:27:37.284Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:41:44.035Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:05:48.205Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/hfsplus/unicode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "73f7da507d787b489761a0fa280716f84fa32b2f",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "76a4c6636a69d69409aa253b049b1be717a539c5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "ccf0ad56a779e6704c0b27f555dec847f50c7557",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "13604b1d7e7b125fb428cddbec6b8d92baad25d5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "291bb5d931c6f3cd7227b913302a17be21cf53b0",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "f7534cbfac0a9ffa4fa17cacc6e8b6446dae24ee",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6f93694bcbc2c2ab3e01cd8fba2f296faf34e6b9",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "1ca69007e52a73bd8b84b988b61b319816ca8b01",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "94458781aee6045bd3d0ad4b80b02886b9e2219b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/hfsplus/unicode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.43",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()\n\nThe hfsplus_readdir() method is capable to crash by calling\nhfsplus_uni2asc():\n\n[  667.121659][ T9805] ==================================================================\n[  667.122651][ T9805] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x902/0xa10\n[  667.123627][ T9805] Read of size 2 at addr ffff88802592f40c by task repro/9805\n[  667.124578][ T9805]\n[  667.124876][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: repro Not tainted 6.16.0-rc3 #1 PREEMPT(full)\n[  667.124886][ T9805] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[  667.124890][ T9805] Call Trace:\n[  667.124893][ T9805]  \u003cTASK\u003e\n[  667.124896][ T9805]  dump_stack_lvl+0x10e/0x1f0\n[  667.124911][ T9805]  print_report+0xd0/0x660\n[  667.124920][ T9805]  ? __virt_addr_valid+0x81/0x610\n[  667.124928][ T9805]  ? __phys_addr+0xe8/0x180\n[  667.124934][ T9805]  ? hfsplus_uni2asc+0x902/0xa10\n[  667.124942][ T9805]  kasan_report+0xc6/0x100\n[  667.124950][ T9805]  ? hfsplus_uni2asc+0x902/0xa10\n[  667.124959][ T9805]  hfsplus_uni2asc+0x902/0xa10\n[  667.124966][ T9805]  ? hfsplus_bnode_read+0x14b/0x360\n[  667.124974][ T9805]  hfsplus_readdir+0x845/0xfc0\n[  667.124984][ T9805]  ? __pfx_hfsplus_readdir+0x10/0x10\n[  667.124994][ T9805]  ? stack_trace_save+0x8e/0xc0\n[  667.125008][ T9805]  ? iterate_dir+0x18b/0xb20\n[  667.125015][ T9805]  ? trace_lock_acquire+0x85/0xd0\n[  667.125022][ T9805]  ? lock_acquire+0x30/0x80\n[  667.125029][ T9805]  ? iterate_dir+0x18b/0xb20\n[  667.125037][ T9805]  ? down_read_killable+0x1ed/0x4c0\n[  667.125044][ T9805]  ? putname+0x154/0x1a0\n[  667.125051][ T9805]  ? __pfx_down_read_killable+0x10/0x10\n[  667.125058][ T9805]  ? apparmor_file_permission+0x239/0x3e0\n[  667.125069][ T9805]  iterate_dir+0x296/0xb20\n[  667.125076][ T9805]  __x64_sys_getdents64+0x13c/0x2c0\n[  667.125084][ T9805]  ? __pfx___x64_sys_getdents64+0x10/0x10\n[  667.125091][ T9805]  ? __x64_sys_openat+0x141/0x200\n[  667.125126][ T9805]  ? __pfx_filldir64+0x10/0x10\n[  667.125134][ T9805]  ? do_user_addr_fault+0x7fe/0x12f0\n[  667.125143][ T9805]  do_syscall_64+0xc9/0x480\n[  667.125151][ T9805]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[  667.125158][ T9805] RIP: 0033:0x7fa8753b2fc9\n[  667.125164][ T9805] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48\n[  667.125172][ T9805] RSP: 002b:00007ffe96f8e0f8 EFLAGS: 00000217 ORIG_RAX: 00000000000000d9\n[  667.125181][ T9805] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa8753b2fc9\n[  667.125185][ T9805] RDX: 0000000000000400 RSI: 00002000000063c0 RDI: 0000000000000004\n[  667.125190][ T9805] RBP: 00007ffe96f8e110 R08: 00007ffe96f8e110 R09: 00007ffe96f8e110\n[  667.125195][ T9805] R10: 0000000000000000 R11: 0000000000000217 R12: 0000556b1e3b4260\n[  667.125199][ T9805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n[  667.125207][ T9805]  \u003c/TASK\u003e\n[  667.125210][ T9805]\n[  667.145632][ T9805] Allocated by task 9805:\n[  667.145991][ T9805]  kasan_save_stack+0x20/0x40\n[  667.146352][ T9805]  kasan_save_track+0x14/0x30\n[  667.146717][ T9805]  __kasan_kmalloc+0xaa/0xb0\n[  667.147065][ T9805]  __kmalloc_noprof+0x205/0x550\n[  667.147448][ T9805]  hfsplus_find_init+0x95/0x1f0\n[  667.147813][ T9805]  hfsplus_readdir+0x220/0xfc0\n[  667.148174][ T9805]  iterate_dir+0x296/0xb20\n[  667.148549][ T9805]  __x64_sys_getdents64+0x13c/0x2c0\n[  667.148937][ T9805]  do_syscall_64+0xc9/0x480\n[  667.149291][ T9805]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[  667.149809][ T9805]\n[  667.150030][ T9805] The buggy address belongs to the object at ffff88802592f000\n[  667.150030][ T9805]  which belongs to the cache kmalloc-2k of size 2048\n[  667.151282][ T9805] The buggy address is located 0 bytes to the right of\n[  667.151282][ T9805]  allocated 1036-byte region [ffff88802592f000, ffff88802592f40c)\n[  667.1\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only by mounting an attacker-authored HFS+ volume (loop-backed image or removable media) and then issuing ordinary local syscalls \u2014 `getdents64(2)` via `hfsplus_readdir()` or `listxattr(2)` via `hfsplus_listxattr()`. There is no network-facing consumer of fs/hfsplus/unicode.c.\nAC:L - The overread length is the raw 16-bit `hfsplus_unistr.length` field the attacker writes into the Catalog/Attributes b-tree node, so a single purpose-built image triggers it deterministically on the first `readdir`, with no race, timing window, or memory-layout precondition outside the attacker\u0027s control. Adjacent kmalloc-2k contents can be groomed by repeated allocations before the directory read.\nPR:L - hfsplus is FS_REQUIRES_DEV without FS_USERNS_MOUNT, so a bare mount(2) needs CAP_SYS_ADMIN, but in the most severe reasonable deployment an unprivileged local user routinely gets a crafted HFS+ image mounted through udisks2 loop-setup, desktop/kiosk removable-media automounters, or `user`/autofs fstab delegation. Once mounted, the getdents64 or listxattr that fires the overread requires no privilege at all.\nUI:N - The attacker performs every step personally \u2014 presents the crafted volume, which an automounter consumes with no human action, and then runs the directory read itself. No second victim user has to be induced into any action.\nS:U - The out-of-bounds access occurs in HFS+ unicode conversion inside the kernel and its effects remain within that same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The loop stops only when the 1530-byte output buffer fills, so it reads up to ~3 KB past the 1036-byte `hfs_find_init()` key allocation \u2014 through the object tail and into neighbouring kmalloc-2k objects \u2014 and every harvested byte is handed to `dir_emit()`/`copy_name()` and returned to userspace as a filename or xattr name. That is a repeatable, attacker-length-controlled kernel heap disclosure primitive suitable for defeating KASLR and lifting secrets from groomed adjacent slab objects.\nI:N - The defect is strictly a read overrun; every store through `op` remains bounded by the remaining output length enforced by `nls-\u003euni2char`, and the `-EINVAL` fallback stays inside the `+1` slack of `strbuf`. No kernel memory is modified.\nA:H - The multi-kilobyte overread can walk off the end of the slab page into unmapped memory, faulting in the middle of `iterate_dir()` while the btree mutex and inode lock are held, which oopses and wedges the filesystem; under KASAN, SLUB_DEBUG, or debug_pagealloc \u2014 common in hardened, appliance, and embedded builds \u2014 it faults immediately, and with panic_on_oops it is a full system panic the attacker can repeat at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:04:11.569Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/73f7da507d787b489761a0fa280716f84fa32b2f"
        },
        {
          "url": "https://git.kernel.org/stable/c/76a4c6636a69d69409aa253b049b1be717a539c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/ccf0ad56a779e6704c0b27f555dec847f50c7557"
        },
        {
          "url": "https://git.kernel.org/stable/c/13604b1d7e7b125fb428cddbec6b8d92baad25d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/291bb5d931c6f3cd7227b913302a17be21cf53b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/f7534cbfac0a9ffa4fa17cacc6e8b6446dae24ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f93694bcbc2c2ab3e01cd8fba2f296faf34e6b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ca69007e52a73bd8b84b988b61b319816ca8b01"
        },
        {
          "url": "https://git.kernel.org/stable/c/94458781aee6045bd3d0ad4b80b02886b9e2219b"
        }
      ],
      "title": "hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38713",
    "datePublished": "2025-09-04T15:33:03.464Z",
    "dateReserved": "2025-04-16T04:51:24.033Z",
    "dateUpdated": "2026-08-05T12:04:11.569Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvmem/zynqmp_nvmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c8bb1bcea877446f86922a8fd1661b8c07d90e5c",
              "status": "affected",
              "version": "29be47fcd6a06ea2e79eeeca6e69ad1e23254a69",
              "versionType": "git"
            },
            {
              "lessThan": "3728101f56ef54425a11027a3ddc2c3941d60b71",
              "status": "affected",
              "version": "29be47fcd6a06ea2e79eeeca6e69ad1e23254a69",
              "versionType": "git"
            },
            {
              "lessThan": "fe8abdd175d7b547ae1a612757e7902bcd62e9cf",
              "status": "affected",
              "version": "29be47fcd6a06ea2e79eeeca6e69ad1e23254a69",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvmem/zynqmp_nvmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmem: zynqmp_nvmem: unbreak driver after cleanup\n\nCommit 29be47fcd6a0 (\"nvmem: zynqmp_nvmem: zynqmp_nvmem_probe cleanup\")\nchanged the driver to expect the device pointer to be passed as the\n\"context\", but in nvmem the context parameter comes from nvmem_config.priv\nwhich is never set - Leading to null pointer exceptions when the device is\naccessed."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:25:19.836Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c8bb1bcea877446f86922a8fd1661b8c07d90e5c"
        },
        {
          "url": "https://git.kernel.org/stable/c/3728101f56ef54425a11027a3ddc2c3941d60b71"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe8abdd175d7b547ae1a612757e7902bcd62e9cf"
        }
      ],
      "title": "nvmem: zynqmp_nvmem: unbreak driver after cleanup",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38301",
    "datePublished": "2025-07-10T07:42:13.455Z",
    "dateReserved": "2025-04-16T04:51:24.002Z",
    "dateUpdated": "2026-05-11T21:25:19.836Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-39895",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T19:28:09.814347Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T19:33:13.717Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/topology.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f9b8d4dba8e78c1887fecd81ba0d8204d6ff05fc",
              "status": "affected",
              "version": "cd7f55359c90a4108e6528e326b8623fce1ad72a",
              "versionType": "git"
            },
            {
              "lessThan": "b3ec50cc5eb5ca84256ca701d28b137a6036c412",
              "status": "affected",
              "version": "cd7f55359c90a4108e6528e326b8623fce1ad72a",
              "versionType": "git"
            },
            {
              "lessThan": "b921c288cd8abef9af5b59e056a63cc2c263a9e3",
              "status": "affected",
              "version": "cd7f55359c90a4108e6528e326b8623fce1ad72a",
              "versionType": "git"
            },
            {
              "lessThan": "5ebf512f335053a42482ebff91e46c6dc156bf8c",
              "status": "affected",
              "version": "cd7f55359c90a4108e6528e326b8623fce1ad72a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/topology.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.105",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.46",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.6",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched: Fix sched_numa_find_nth_cpu() if mask offline\n\nsched_numa_find_nth_cpu() uses a bsearch to look for the \u0027closest\u0027\nCPU in sched_domains_numa_masks and given cpus mask. However they\nmight not intersect if all CPUs in the cpus mask are offline. bsearch\nwill return NULL in that case, bail out instead of dereferencing a\nbogus pointer.\n\nThe previous behaviour lead to this bug when using maxcpus=4 on an\nrk3399 (LLLLbb) (i.e. booting with all big CPUs offline):\n\n[    1.422922] Unable to handle kernel paging request at virtual address ffffff8000000000\n[    1.423635] Mem abort info:\n[    1.423889]   ESR = 0x0000000096000006\n[    1.424227]   EC = 0x25: DABT (current EL), IL = 32 bits\n[    1.424715]   SET = 0, FnV = 0\n[    1.424995]   EA = 0, S1PTW = 0\n[    1.425279]   FSC = 0x06: level 2 translation fault\n[    1.425735] Data abort info:\n[    1.425998]   ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000\n[    1.426499]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[    1.426952]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[    1.427428] swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000004a9f000\n[    1.428038] [ffffff8000000000] pgd=18000000f7fff403, p4d=18000000f7fff403, pud=18000000f7fff403, pmd=0000000000000000\n[    1.429014] Internal error: Oops: 0000000096000006 [#1]  SMP\n[    1.429525] Modules linked in:\n[    1.429813] CPU: 3 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.0-rc4-dirty #343 PREEMPT\n[    1.430559] Hardware name: Pine64 RockPro64 v2.1 (DT)\n[    1.431012] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[    1.431634] pc : sched_numa_find_nth_cpu+0x2a0/0x488\n[    1.432094] lr : sched_numa_find_nth_cpu+0x284/0x488\n[    1.432543] sp : ffffffc084e1b960\n[    1.432843] x29: ffffffc084e1b960 x28: ffffff80078a8800 x27: ffffffc0846eb1d0\n[    1.433495] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000\n[    1.434144] x23: 0000000000000000 x22: fffffffffff7f093 x21: ffffffc081de6378\n[    1.434792] x20: 0000000000000000 x19: 0000000ffff7f093 x18: 00000000ffffffff\n[    1.435441] x17: 3030303866666666 x16: 66663d736b73616d x15: ffffffc104e1b5b7\n[    1.436091] x14: 0000000000000000 x13: ffffffc084712860 x12: 0000000000000372\n[    1.436739] x11: 0000000000000126 x10: ffffffc08476a860 x9 : ffffffc084712860\n[    1.437389] x8 : 00000000ffffefff x7 : ffffffc08476a860 x6 : 0000000000000000\n[    1.438036] x5 : 000000000000bff4 x4 : 0000000000000000 x3 : 0000000000000000\n[    1.438683] x2 : 0000000000000000 x1 : ffffffc0846eb000 x0 : ffffff8000407b68\n[    1.439332] Call trace:\n[    1.439559]  sched_numa_find_nth_cpu+0x2a0/0x488 (P)\n[    1.440016]  smp_call_function_any+0xc8/0xd0\n[    1.440416]  armv8_pmu_init+0x58/0x27c\n[    1.440770]  armv8_cortex_a72_pmu_init+0x20/0x2c\n[    1.441199]  arm_pmu_device_probe+0x1e4/0x5e8\n[    1.441603]  armv8_pmu_device_probe+0x1c/0x28\n[    1.442007]  platform_probe+0x5c/0xac\n[    1.442347]  really_probe+0xbc/0x298\n[    1.442683]  __driver_probe_device+0x78/0x12c\n[    1.443087]  driver_probe_device+0xdc/0x160\n[    1.443475]  __driver_attach+0x94/0x19c\n[    1.443833]  bus_for_each_dev+0x74/0xd4\n[    1.444190]  driver_attach+0x24/0x30\n[    1.444525]  bus_add_driver+0xe4/0x208\n[    1.444874]  driver_register+0x60/0x128\n[    1.445233]  __platform_driver_register+0x24/0x30\n[    1.445662]  armv8_pmu_driver_init+0x28/0x4c\n[    1.446059]  do_one_initcall+0x44/0x25c\n[    1.446416]  kernel_init_freeable+0x1dc/0x3bc\n[    1.446820]  kernel_init+0x20/0x1d8\n[    1.447151]  ret_from_fork+0x10/0x20\n[    1.447493] Code: 90022e21 f000e5f5 910de2b5 2a1703e2 (f8767803)\n[    1.448040] ---[ end trace 0000000000000000 ]---\n[    1.448483] note: swapper/0[1] exited with preempt_count 1\n[    1.449047] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b\n[    1.449741] SMP: stopping secondary CPUs\n[    1.450105] Kernel Offset: disabled\n[    1.450419] CPU features: 0x000000,00080000,20002001,0400421b\n[    \n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:38:30.167Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f9b8d4dba8e78c1887fecd81ba0d8204d6ff05fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3ec50cc5eb5ca84256ca701d28b137a6036c412"
        },
        {
          "url": "https://git.kernel.org/stable/c/b921c288cd8abef9af5b59e056a63cc2c263a9e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ebf512f335053a42482ebff91e46c6dc156bf8c"
        }
      ],
      "title": "sched: Fix sched_numa_find_nth_cpu() if mask offline",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39895",
    "datePublished": "2025-10-01T07:42:43.920Z",
    "dateReserved": "2025-04-16T07:20:57.146Z",
    "dateUpdated": "2026-05-11T21:38:30.167Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:35:57.073Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/stream.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "24ff7d465c4284529bbfa207757bffb6f44b6403",
              "status": "affected",
              "version": "9a2fe9b801f585baccf8352d82839dcd54b300cf",
              "versionType": "git"
            },
            {
              "lessThan": "2dc1c3edf67abd30c757f8054a5da61927cdda21",
              "status": "affected",
              "version": "9a2fe9b801f585baccf8352d82839dcd54b300cf",
              "versionType": "git"
            },
            {
              "lessThan": "c3fb926abe90d86f5e3055e0035f04d9892a118b",
              "status": "affected",
              "version": "9a2fe9b801f585baccf8352d82839dcd54b300cf",
              "versionType": "git"
            },
            {
              "lessThan": "6eb211788e1370af52a245d4d7da35c374c7b401",
              "status": "affected",
              "version": "9a2fe9b801f585baccf8352d82839dcd54b300cf",
              "versionType": "git"
            },
            {
              "lessThan": "74fcb3852a2f579151ce80b9ed96cd916ba0d5d8",
              "status": "affected",
              "version": "9a2fe9b801f585baccf8352d82839dcd54b300cf",
              "versionType": "git"
            },
            {
              "lessThan": "0ee87c2814deb5e42921281116ac3abcb326880b",
              "status": "affected",
              "version": "9a2fe9b801f585baccf8352d82839dcd54b300cf",
              "versionType": "git"
            },
            {
              "lessThan": "11e740dc1a2c8590eb7074b5c4ab921bb6224c36",
              "status": "affected",
              "version": "9a2fe9b801f585baccf8352d82839dcd54b300cf",
              "versionType": "git"
            },
            {
              "lessThan": "fb4e2a6e8f28a3c0ad382e363aeb9cd822007b8a",
              "status": "affected",
              "version": "9a2fe9b801f585baccf8352d82839dcd54b300cf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/stream.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.296",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.240",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.296",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.240",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.187",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.143",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.96",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.36",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.5",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()\n\nIn snd_usb_get_audioformat_uac3(), the length value returned from\nsnd_usb_ctl_msg() is used directly for memory allocation without\nvalidation. This length is controlled by the USB device.\n\nThe allocated buffer is cast to a uac3_cluster_header_descriptor\nand its fields are accessed without verifying that the buffer\nis large enough. If the device returns a smaller than expected\nlength, this leads to an out-of-bounds read.\n\nAdd a length check to ensure the buffer is large enough for\nuac3_cluster_header_descriptor."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:24:08.873Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/24ff7d465c4284529bbfa207757bffb6f44b6403"
        },
        {
          "url": "https://git.kernel.org/stable/c/2dc1c3edf67abd30c757f8054a5da61927cdda21"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3fb926abe90d86f5e3055e0035f04d9892a118b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6eb211788e1370af52a245d4d7da35c374c7b401"
        },
        {
          "url": "https://git.kernel.org/stable/c/74fcb3852a2f579151ce80b9ed96cd916ba0d5d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ee87c2814deb5e42921281116ac3abcb326880b"
        },
        {
          "url": "https://git.kernel.org/stable/c/11e740dc1a2c8590eb7074b5c4ab921bb6224c36"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb4e2a6e8f28a3c0ad382e363aeb9cd822007b8a"
        }
      ],
      "title": "ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38249",
    "datePublished": "2025-07-09T10:42:29.704Z",
    "dateReserved": "2025-04-16T04:51:23.997Z",
    "dateUpdated": "2026-05-11T21:24:08.873Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi-cadence-quadspi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8ce3ebbe5c718940b4e94f5c25f5720223f893f8",
              "status": "affected",
              "version": "a314f6367787ee1d767df9a2120f17e4511144d0",
              "versionType": "git"
            },
            {
              "lessThan": "56787f4a75907ae99b5f5842b756fa68e2482f6d",
              "status": "affected",
              "version": "a314f6367787ee1d767df9a2120f17e4511144d0",
              "versionType": "git"
            },
            {
              "lessThan": "8df235f768cea7a5829cb02525622646eb0df5f5",
              "status": "affected",
              "version": "a314f6367787ee1d767df9a2120f17e4511144d0",
              "versionType": "git"
            },
            {
              "lessThan": "65ed52200080eafce3eead05cf22ce01238defca",
              "status": "affected",
              "version": "a314f6367787ee1d767df9a2120f17e4511144d0",
              "versionType": "git"
            },
            {
              "lessThan": "b7ec8a2b094a33d0464958c2cbf75b8f229098b0",
              "status": "affected",
              "version": "a314f6367787ee1d767df9a2120f17e4511144d0",
              "versionType": "git"
            },
            {
              "lessThan": "7446284023e8ef694fb392348185349c773eefb3",
              "status": "affected",
              "version": "a314f6367787ee1d767df9a2120f17e4511144d0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi-cadence-quadspi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.125",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.125",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.10",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: cadence-quadspi: Implement refcount to handle unbind during busy\n\ndriver support indirect read and indirect write operation with\nassumption no force device removal(unbind) operation. However\nforce device removal(removal) is still available to root superuser.\n\nUnbinding driver during operation causes kernel crash. This changes\nensure driver able to handle such operation for indirect read and\nindirect write by implementing refcount to track attached devices\nto the controller and gracefully wait and until attached devices\nremove operation completed before proceed with removal operation."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T16:05:33.466Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8ce3ebbe5c718940b4e94f5c25f5720223f893f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/56787f4a75907ae99b5f5842b756fa68e2482f6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/8df235f768cea7a5829cb02525622646eb0df5f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/65ed52200080eafce3eead05cf22ce01238defca"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7ec8a2b094a33d0464958c2cbf75b8f229098b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/7446284023e8ef694fb392348185349c773eefb3"
        }
      ],
      "title": "spi: cadence-quadspi: Implement refcount to handle unbind during busy",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40005",
    "datePublished": "2025-10-20T15:26:52.315Z",
    "dateReserved": "2025-04-16T07:20:57.151Z",
    "dateUpdated": "2026-06-01T16:05:33.466Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:34:07.793Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-hyperv.c",
            "drivers/hid/usbhid/hid-core.c",
            "drivers/usb/gadget/function/f_hid.c",
            "include/linux/hid.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7a6d6b68db128da2078ccd9a751dfa3f75c9cf5b",
              "status": "affected",
              "version": "f043bfc98c193c284e2cd768fefabe18ac2fed9b",
              "versionType": "git"
            },
            {
              "lessThan": "41827a2dbdd7880df9881506dee13bc88d4230bb",
              "status": "affected",
              "version": "f043bfc98c193c284e2cd768fefabe18ac2fed9b",
              "versionType": "git"
            },
            {
              "lessThan": "1df80d748f984290c895e843401824215dcfbfb0",
              "status": "affected",
              "version": "f043bfc98c193c284e2cd768fefabe18ac2fed9b",
              "versionType": "git"
            },
            {
              "lessThan": "a8f842534807985d3a676006d140541b87044345",
              "status": "affected",
              "version": "f043bfc98c193c284e2cd768fefabe18ac2fed9b",
              "versionType": "git"
            },
            {
              "lessThan": "4fa7831cf0ac71a0a345369d1a6084f2b096e55e",
              "status": "affected",
              "version": "f043bfc98c193c284e2cd768fefabe18ac2fed9b",
              "versionType": "git"
            },
            {
              "lessThan": "74388368927e9c52a69524af5bbd6c55eb4690de",
              "status": "affected",
              "version": "f043bfc98c193c284e2cd768fefabe18ac2fed9b",
              "versionType": "git"
            },
            {
              "lessThan": "485e1b741eb838cbe1d6b0e81e5ab62ae6c095cf",
              "status": "affected",
              "version": "f043bfc98c193c284e2cd768fefabe18ac2fed9b",
              "versionType": "git"
            },
            {
              "lessThan": "fe7f7ac8e0c708446ff017453add769ffc15deed",
              "status": "affected",
              "version": "f043bfc98c193c284e2cd768fefabe18ac2fed9b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "99de0781e0de7c866f762b931351c2a501c3074f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8d675aa967d3927ac100f7af48f2a2af8a041d2d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f4cf5d75416ae3d79e03179fe6f4b9f1231ae42c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "439f76690d7d5dd212ea7bebc1f2fa077e3d645d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2929cb995378205bceda86d6fd3cbc22e522f97f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "57265cddde308292af881ce634a5378dd4e25900",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "984154e7eef1f9e543dabd7422cfc99015778732",
              "versionType": "git"
            },
            {
              "lessThan": "3.3",
              "status": "affected",
              "version": "3.2.95",
              "versionType": "semver"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.50",
              "versionType": "semver"
            },
            {
              "lessThan": "3.19",
              "status": "affected",
              "version": "3.18.76",
              "versionType": "semver"
            },
            {
              "lessThan": "4.2",
              "status": "affected",
              "version": "4.1.46",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.93",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.57",
              "versionType": "semver"
            },
            {
              "lessThan": "4.14",
              "status": "affected",
              "version": "4.13.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-hyperv.c",
            "drivers/hid/usbhid/hid-core.c",
            "drivers/usb/gadget/function/f_hid.c",
            "include/linux/hid.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.295",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.239",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.295",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.239",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.186",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.94",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.2.95",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.16.50",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.18.76",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.1.46",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.93",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.57",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.13.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()\n\nUpdate struct hid_descriptor to better reflect the mandatory and\noptional parts of the HID Descriptor as per USB HID 1.11 specification.\nNote: the kernel currently does not parse any optional HID class\ndescriptors, only the mandatory report descriptor.\n\nUpdate all references to member element desc[0] to rpt_desc.\n\nAdd test to verify bLength and bNumDescriptors values are valid.\n\nReplace the for loop with direct access to the mandatory HID class\ndescriptor member for the report descriptor. This eliminates the\npossibility of getting an out-of-bounds fault.\n\nAdd a warning message if the HID descriptor contains any unsupported\noptional HID class descriptors."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:58:59.055Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7a6d6b68db128da2078ccd9a751dfa3f75c9cf5b"
        },
        {
          "url": "https://git.kernel.org/stable/c/41827a2dbdd7880df9881506dee13bc88d4230bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/1df80d748f984290c895e843401824215dcfbfb0"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8f842534807985d3a676006d140541b87044345"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fa7831cf0ac71a0a345369d1a6084f2b096e55e"
        },
        {
          "url": "https://git.kernel.org/stable/c/74388368927e9c52a69524af5bbd6c55eb4690de"
        },
        {
          "url": "https://git.kernel.org/stable/c/485e1b741eb838cbe1d6b0e81e5ab62ae6c095cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe7f7ac8e0c708446ff017453add769ffc15deed"
        }
      ],
      "title": "HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38103",
    "datePublished": "2025-07-03T08:35:13.941Z",
    "dateReserved": "2025-04-16T04:51:23.985Z",
    "dateUpdated": "2026-05-23T15:58:59.055Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/typec/tcpm/tcpm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7bdd712abefbec79176ab412d8c623e755c5d0ba",
              "status": "affected",
              "version": "cdc9946ea6377e8e214b135ccc308c5e514ba25f",
              "versionType": "git"
            },
            {
              "lessThan": "1970d34b48cbeceb0c765984c9a6bb204c77f16a",
              "status": "affected",
              "version": "cdc9946ea6377e8e214b135ccc308c5e514ba25f",
              "versionType": "git"
            },
            {
              "lessThan": "324d45e53f1a36c88bc649dc39e0c8300a41be0a",
              "status": "affected",
              "version": "cdc9946ea6377e8e214b135ccc308c5e514ba25f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/typec/tcpm/tcpm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work\n\nA state check was previously added to tcpm_queue_vdm_unlocked to\nprevent a deadlock where the DisplayPort Alt Mode driver would be\nexecuting work and attempting to grab the tcpm_lock while the TCPM\nwas holding the lock and attempting to unregister the altmode, blocking\non the altmode driver\u0027s cancel_work_sync call.\n\nBecause the state check isn\u0027t protected, there is a small window\nwhere the Alt Mode driver could determine that the TCPM is\nin a ready state and attempt to grab the lock while the\nTCPM grabs the lock and changes the TCPM state to one that\ncauses the deadlock. The callstack is provided below:\n\n[110121.667392][    C7] Call trace:\n[110121.667396][    C7]  __switch_to+0x174/0x338\n[110121.667406][    C7]  __schedule+0x608/0x9f0\n[110121.667414][    C7]  schedule+0x7c/0xe8\n[110121.667423][    C7]  kernfs_drain+0xb0/0x114\n[110121.667431][    C7]  __kernfs_remove+0x16c/0x20c\n[110121.667436][    C7]  kernfs_remove_by_name_ns+0x74/0xe8\n[110121.667442][    C7]  sysfs_remove_group+0x84/0xe8\n[110121.667450][    C7]  sysfs_remove_groups+0x34/0x58\n[110121.667458][    C7]  device_remove_groups+0x10/0x20\n[110121.667464][    C7]  device_release_driver_internal+0x164/0x2e4\n[110121.667475][    C7]  device_release_driver+0x18/0x28\n[110121.667484][    C7]  bus_remove_device+0xec/0x118\n[110121.667491][    C7]  device_del+0x1e8/0x4ac\n[110121.667498][    C7]  device_unregister+0x18/0x38\n[110121.667504][    C7]  typec_unregister_altmode+0x30/0x44\n[110121.667515][    C7]  tcpm_reset_port+0xac/0x370\n[110121.667523][    C7]  tcpm_snk_detach+0x84/0xb8\n[110121.667529][    C7]  run_state_machine+0x4c0/0x1b68\n[110121.667536][    C7]  tcpm_state_machine_work+0x94/0xe4\n[110121.667544][    C7]  kthread_worker_fn+0x10c/0x244\n[110121.667552][    C7]  kthread+0x104/0x1d4\n[110121.667557][    C7]  ret_from_fork+0x10/0x20\n\n[110121.667689][    C7] Workqueue: events dp_altmode_work\n[110121.667697][    C7] Call trace:\n[110121.667701][    C7]  __switch_to+0x174/0x338\n[110121.667710][    C7]  __schedule+0x608/0x9f0\n[110121.667717][    C7]  schedule+0x7c/0xe8\n[110121.667725][    C7]  schedule_preempt_disabled+0x24/0x40\n[110121.667733][    C7]  __mutex_lock+0x408/0xdac\n[110121.667741][    C7]  __mutex_lock_slowpath+0x14/0x24\n[110121.667748][    C7]  mutex_lock+0x40/0xec\n[110121.667757][    C7]  tcpm_altmode_enter+0x78/0xb4\n[110121.667764][    C7]  typec_altmode_enter+0xdc/0x10c\n[110121.667769][    C7]  dp_altmode_work+0x68/0x164\n[110121.667775][    C7]  process_one_work+0x1e4/0x43c\n[110121.667783][    C7]  worker_thread+0x25c/0x430\n[110121.667789][    C7]  kthread+0x104/0x1d4\n[110121.667794][    C7]  ret_from_fork+0x10/0x20\n\nChange tcpm_queue_vdm_unlocked to queue for tcpm_queue_vdm_work,\nwhich can perform the state check while holding the TCPM lock\nwhile the Alt Mode lock is no longer held. This requires a new\nstruct to hold the vdm data, altmode_vdm_event."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:24:35.303Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7bdd712abefbec79176ab412d8c623e755c5d0ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/1970d34b48cbeceb0c765984c9a6bb204c77f16a"
        },
        {
          "url": "https://git.kernel.org/stable/c/324d45e53f1a36c88bc649dc39e0c8300a41be0a"
        }
      ],
      "title": "usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38268",
    "datePublished": "2025-07-10T07:41:51.217Z",
    "dateReserved": "2025-04-16T04:51:23.998Z",
    "dateUpdated": "2026-05-11T21:24:35.303Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/sched/signal.h",
            "kernel/time/posix-timers.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8dc52c200b889bc1cb34288fbf623d4ff381d2ae",
              "status": "affected",
              "version": "5ed67f05f66c41e39880a6d61358438a25f9fee5",
              "versionType": "git"
            },
            {
              "lessThan": "9ea26a8494a0a9337e7415eafd6f3ed940327dc5",
              "status": "affected",
              "version": "5ed67f05f66c41e39880a6d61358438a25f9fee5",
              "versionType": "git"
            },
            {
              "lessThan": "8ad6679a5bb97cdb3e14942729292b4bfcc0e223",
              "status": "affected",
              "version": "5ed67f05f66c41e39880a6d61358438a25f9fee5",
              "versionType": "git"
            },
            {
              "lessThan": "322377cc909defcca9451487484845e7e1d20d1b",
              "status": "affected",
              "version": "5ed67f05f66c41e39880a6d61358438a25f9fee5",
              "versionType": "git"
            },
            {
              "lessThan": "ef535e0315afd098c4beb1da364847eca4b56a20",
              "status": "affected",
              "version": "5ed67f05f66c41e39880a6d61358438a25f9fee5",
              "versionType": "git"
            },
            {
              "lessThan": "6a0ac84501b4fec73a1a823c55cf13584c43f418",
              "status": "affected",
              "version": "5ed67f05f66c41e39880a6d61358438a25f9fee5",
              "versionType": "git"
            },
            {
              "lessThan": "37175e25edf7cc0d5a2cd2c2a1cbe2dcbf4a1937",
              "status": "affected",
              "version": "5ed67f05f66c41e39880a6d61358438a25f9fee5",
              "versionType": "git"
            },
            {
              "lessThan": "8ce8849dd1e78dadcee0ec9acbd259d239b7069f",
              "status": "affected",
              "version": "5ed67f05f66c41e39880a6d61358438a25f9fee5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/sched/signal.h",
            "kernel/time/posix-timers.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            },
            {
              "lessThan": "3.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.322",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.291",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.251",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.150",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.107",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.322",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.291",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.251",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.188",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.150",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.107",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.7",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nposix-timers: Ensure timer ID search-loop limit is valid\n\nposix_timer_add() tries to allocate a posix timer ID by starting from the\ncached ID which was stored by the last successful allocation.\n\nThis is done in a loop searching the ID space for a free slot one by\none. The loop has to terminate when the search wrapped around to the\nstarting point.\n\nBut that\u0027s racy vs. establishing the starting point. That is read out\nlockless, which leads to the following problem:\n\nCPU0\t  \t      \t     \t   CPU1\nposix_timer_add()\n  start = sig-\u003eposix_timer_id;\n  lock(hash_lock);\n  ...\t\t\t\t   posix_timer_add()\n  if (++sig-\u003eposix_timer_id \u003c 0)\n      \t\t\t             start = sig-\u003eposix_timer_id;\n     sig-\u003eposix_timer_id = 0;\n\nSo CPU1 can observe a negative start value, i.e. -1, and the loop break\nnever happens because the condition can never be true:\n\n  if (sig-\u003eposix_timer_id == start)\n     break;\n\nWhile this is unlikely to ever turn into an endless loop as the ID space is\nhuge (INT_MAX), the racy read of the start value caught the attention of\nKCSAN and Dmitry unearthed that incorrectness.\n\nRewrite it so that all id operations are under the hash lock."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:50:42.429Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8dc52c200b889bc1cb34288fbf623d4ff381d2ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ea26a8494a0a9337e7415eafd6f3ed940327dc5"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ad6679a5bb97cdb3e14942729292b4bfcc0e223"
        },
        {
          "url": "https://git.kernel.org/stable/c/322377cc909defcca9451487484845e7e1d20d1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef535e0315afd098c4beb1da364847eca4b56a20"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a0ac84501b4fec73a1a823c55cf13584c43f418"
        },
        {
          "url": "https://git.kernel.org/stable/c/37175e25edf7cc0d5a2cd2c2a1cbe2dcbf4a1937"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ce8849dd1e78dadcee0ec9acbd259d239b7069f"
        }
      ],
      "title": "posix-timers: Ensure timer ID search-loop limit is valid",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53728",
    "datePublished": "2025-10-22T13:23:57.127Z",
    "dateReserved": "2025-10-22T13:21:37.348Z",
    "dateUpdated": "2026-05-11T19:50:42.429Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/host/multipath.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a432383e6cd86d9fda00a6073ed35c1067a836d6",
              "status": "affected",
              "version": "4dbd2b2ebe4cc5f101881e2c091a70ccd38db7ee",
              "versionType": "git"
            },
            {
              "lessThan": "d6811074203b13f715ce2480ac64c5b1c773f2a5",
              "status": "affected",
              "version": "4dbd2b2ebe4cc5f101881e2c091a70ccd38db7ee",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/host/multipath.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-multipath: fix suspicious RCU usage warning\n\nWhen I run the NVME over TCP test in virtme-ng, I get the following\n\"suspicious RCU usage\" warning in nvme_mpath_add_sysfs_link():\n\n\u0027\u0027\u0027\n[    5.024557][   T44] nvmet: Created nvm controller 1 for subsystem nqn.2025-06.org.nvmexpress.mptcp for NQN nqn.2014-08.org.nvmexpress:uuid:f7f6b5e0-ff97-4894-98ac-c85309e0bc77.\n[    5.027401][  T183] nvme nvme0: creating 2 I/O queues.\n[    5.029017][  T183] nvme nvme0: mapped 2/0/0 default/read/poll queues.\n[    5.032587][  T183] nvme nvme0: new ctrl: NQN \"nqn.2025-06.org.nvmexpress.mptcp\", addr 127.0.0.1:4420, hostnqn: nqn.2014-08.org.nvmexpress:uuid:f7f6b5e0-ff97-4894-98ac-c85309e0bc77\n[    5.042214][   T25]\n[    5.042440][   T25] =============================\n[    5.042579][   T25] WARNING: suspicious RCU usage\n[    5.042705][   T25] 6.16.0-rc3+ #23 Not tainted\n[    5.042812][   T25] -----------------------------\n[    5.042934][   T25] drivers/nvme/host/multipath.c:1203 RCU-list traversed in non-reader section!!\n[    5.043111][   T25]\n[    5.043111][   T25] other info that might help us debug this:\n[    5.043111][   T25]\n[    5.043341][   T25]\n[    5.043341][   T25] rcu_scheduler_active = 2, debug_locks = 1\n[    5.043502][   T25] 3 locks held by kworker/u9:0/25:\n[    5.043615][   T25]  #0: ffff888008730948 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work+0x7ed/0x1350\n[    5.043830][   T25]  #1: ffffc900001afd40 ((work_completion)(\u0026entry-\u003ework)){+.+.}-{0:0}, at: process_one_work+0xcf3/0x1350\n[    5.044084][   T25]  #2: ffff888013ee0020 (\u0026head-\u003esrcu){.+.+}-{0:0}, at: nvme_mpath_add_sysfs_link.part.0+0xb4/0x3a0\n[    5.044300][   T25]\n[    5.044300][   T25] stack backtrace:\n[    5.044439][   T25] CPU: 0 UID: 0 PID: 25 Comm: kworker/u9:0 Not tainted 6.16.0-rc3+ #23 PREEMPT(full)\n[    5.044441][   T25] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n[    5.044442][   T25] Workqueue: async async_run_entry_fn\n[    5.044445][   T25] Call Trace:\n[    5.044446][   T25]  \u003cTASK\u003e\n[    5.044449][   T25]  dump_stack_lvl+0x6f/0xb0\n[    5.044453][   T25]  lockdep_rcu_suspicious.cold+0x4f/0xb1\n[    5.044457][   T25]  nvme_mpath_add_sysfs_link.part.0+0x2fb/0x3a0\n[    5.044459][   T25]  ? queue_work_on+0x90/0xf0\n[    5.044461][   T25]  ? lockdep_hardirqs_on+0x78/0x110\n[    5.044466][   T25]  nvme_mpath_set_live+0x1e9/0x4f0\n[    5.044470][   T25]  nvme_mpath_add_disk+0x240/0x2f0\n[    5.044472][   T25]  ? __pfx_nvme_mpath_add_disk+0x10/0x10\n[    5.044475][   T25]  ? add_disk_fwnode+0x361/0x580\n[    5.044480][   T25]  nvme_alloc_ns+0x81c/0x17c0\n[    5.044483][   T25]  ? kasan_quarantine_put+0x104/0x240\n[    5.044487][   T25]  ? __pfx_nvme_alloc_ns+0x10/0x10\n[    5.044495][   T25]  ? __pfx_nvme_find_get_ns+0x10/0x10\n[    5.044496][   T25]  ? rcu_read_lock_any_held+0x45/0xa0\n[    5.044498][   T25]  ? validate_chain+0x232/0x4f0\n[    5.044503][   T25]  nvme_scan_ns+0x4c8/0x810\n[    5.044506][   T25]  ? __pfx_nvme_scan_ns+0x10/0x10\n[    5.044508][   T25]  ? find_held_lock+0x2b/0x80\n[    5.044512][   T25]  ? ktime_get+0x16d/0x220\n[    5.044517][   T25]  ? kvm_clock_get_cycles+0x18/0x30\n[    5.044520][   T25]  ? __pfx_nvme_scan_ns_async+0x10/0x10\n[    5.044522][   T25]  async_run_entry_fn+0x97/0x560\n[    5.044523][   T25]  ? rcu_is_watching+0x12/0xc0\n[    5.044526][   T25]  process_one_work+0xd3c/0x1350\n[    5.044532][   T25]  ? __pfx_process_one_work+0x10/0x10\n[    5.044536][   T25]  ? assign_work+0x16c/0x240\n[    5.044539][   T25]  worker_thread+0x4da/0xd50\n[    5.044545][   T25]  ? __pfx_worker_thread+0x10/0x10\n[    5.044546][   T25]  kthread+0x356/0x5c0\n[    5.044548][   T25]  ? __pfx_kthread+0x10/0x10\n[    5.044549][   T25]  ? ret_from_fork+0x1b/0x2e0\n[    5.044552][   T25]  ? __lock_release.isra.0+0x5d/0x180\n[    5.044553][   T25]  ? ret_from_fork+0x1b/0x2e0\n[    5.044555][   T25]  ? rcu_is_watching+0x12/0xc0\n[    5.044557][   T25]  ? __pfx_kthread+0x10/0x10\n[    5.04\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:27:11.550Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a432383e6cd86d9fda00a6073ed35c1067a836d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/d6811074203b13f715ce2480ac64c5b1c773f2a5"
        }
      ],
      "title": "nvme-multipath: fix suspicious RCU usage warning",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38397",
    "datePublished": "2025-07-25T12:53:41.566Z",
    "dateReserved": "2025-04-16T04:51:24.012Z",
    "dateUpdated": "2026-05-11T21:27:11.550Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/hisilicon/debugfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a7836260d5121949ba734e840d42a86ab4a32fcc",
              "status": "affected",
              "version": "eda60520cfe3aba9f088c68ebd5bcbca9fc6ac3c",
              "versionType": "git"
            },
            {
              "lessThan": "1750f1ec143ebabdbdfa013668665c9d5042c430",
              "status": "affected",
              "version": "7fc8d9a525b5c3f8dfa5ed50901e764d8ede7e1e",
              "versionType": "git"
            },
            {
              "lessThan": "a87a21a56244b8f4eb357f6bad879247005bbe38",
              "status": "affected",
              "version": "8be0913389718e8d27c4f1d4537b5e1b99ed7739",
              "versionType": "git"
            },
            {
              "lessThan": "7226a0650ad5705bd8d39a11be270fa21ed1e6a5",
              "status": "affected",
              "version": "8be0913389718e8d27c4f1d4537b5e1b99ed7739",
              "versionType": "git"
            },
            {
              "lessThan": "f0cafb02de883b3b413d34eb079c9680782a9cc1",
              "status": "affected",
              "version": "8be0913389718e8d27c4f1d4537b5e1b99ed7739",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e0a2d2df9ba7bd6bd7e0a9b6a5e3894f7e8445b3",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.156",
              "status": "affected",
              "version": "6.1.98",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.112",
              "status": "affected",
              "version": "6.6.39",
              "versionType": "semver"
            },
            {
              "lessThan": "6.10",
              "status": "affected",
              "version": "6.9.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/hisilicon/debugfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.156",
                  "versionStartIncluding": "6.1.98",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.112",
                  "versionStartIncluding": "6.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.53",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.9.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/qm - set NULL to qm-\u003edebug.qm_diff_regs\n\nWhen the initialization of qm-\u003edebug.acc_diff_reg fails,\nthe probe process does not exit. However, after qm-\u003edebug.qm_diff_regs is\nfreed, it is not set to NULL. This can lead to a double free when the\nremove process attempts to free it again. Therefore, qm-\u003edebug.qm_diff_regs\nshould be set to NULL after it is freed."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:01:17.923Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a7836260d5121949ba734e840d42a86ab4a32fcc"
        },
        {
          "url": "https://git.kernel.org/stable/c/1750f1ec143ebabdbdfa013668665c9d5042c430"
        },
        {
          "url": "https://git.kernel.org/stable/c/a87a21a56244b8f4eb357f6bad879247005bbe38"
        },
        {
          "url": "https://git.kernel.org/stable/c/7226a0650ad5705bd8d39a11be270fa21ed1e6a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0cafb02de883b3b413d34eb079c9680782a9cc1"
        }
      ],
      "title": "crypto: hisilicon/qm - set NULL to qm-\u003edebug.qm_diff_regs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40062",
    "datePublished": "2025-10-28T11:48:33.961Z",
    "dateReserved": "2025-04-16T07:20:57.158Z",
    "dateUpdated": "2026-05-23T16:01:17.923Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:38:03.697Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_flow_table.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a3aea97d55964e70a1e6426aa4cafdc036e8a2dd",
              "status": "affected",
              "version": "d06977b9a4109f8738bb276125eb6a0b772bc433",
              "versionType": "git"
            },
            {
              "lessThan": "eed8960b289327235185b7c32649c3470a3e969b",
              "status": "affected",
              "version": "8bf7c76a2a207ca2b4cfda0a279192adf27678d7",
              "versionType": "git"
            },
            {
              "lessThan": "9fbc49429a23b02595ba82536c5ea425fdabb221",
              "status": "affected",
              "version": "a2471d271042ea18e8a6babc132a8716bb2f08b9",
              "versionType": "git"
            },
            {
              "lessThan": "e0dd2e9729660f3f4fcb16e0aef87342911528ef",
              "status": "affected",
              "version": "87b3593bed1868b2d9fe096c01bcdf0ea86cbebf",
              "versionType": "git"
            },
            {
              "lessThan": "cfbf0665969af2c69d10c377d4c3d306e717efb4",
              "status": "affected",
              "version": "87b3593bed1868b2d9fe096c01bcdf0ea86cbebf",
              "versionType": "git"
            },
            {
              "lessThan": "18cdb3d982da8976b28d57691eb256ec5688fad2",
              "status": "affected",
              "version": "87b3593bed1868b2d9fe096c01bcdf0ea86cbebf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cf366ee3bc1b7d1c76a882640ba3b3f8f1039163",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.189",
              "status": "affected",
              "version": "5.15.157",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.146",
              "status": "affected",
              "version": "6.1.88",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.99",
              "status": "affected",
              "version": "6.6.29",
              "versionType": "semver"
            },
            {
              "lessThan": "6.9",
              "status": "affected",
              "version": "6.8.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_flow_table.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.146",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.99",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.189",
                  "versionStartIncluding": "5.15.157",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.146",
                  "versionStartIncluding": "6.1.88",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.99",
                  "versionStartIncluding": "6.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.39",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.7",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.8.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()\n\nsyzbot found a potential access to uninit-value in nf_flow_pppoe_proto()\n\nBlamed commit forgot the Ethernet header.\n\nBUG: KMSAN: uninit-value in nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27\n  nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27\n  nf_hook_entry_hookfn include/linux/netfilter.h:157 [inline]\n  nf_hook_slow+0xe1/0x3d0 net/netfilter/core.c:623\n  nf_hook_ingress include/linux/netfilter_netdev.h:34 [inline]\n  nf_ingress net/core/dev.c:5742 [inline]\n  __netif_receive_skb_core+0x4aff/0x70c0 net/core/dev.c:5837\n  __netif_receive_skb_one_core net/core/dev.c:5975 [inline]\n  __netif_receive_skb+0xcc/0xac0 net/core/dev.c:6090\n  netif_receive_skb_internal net/core/dev.c:6176 [inline]\n  netif_receive_skb+0x57/0x630 net/core/dev.c:6235\n  tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485\n  tun_get_user+0x4ee0/0x6b40 drivers/net/tun.c:1938\n  tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1984\n  new_sync_write fs/read_write.c:593 [inline]\n  vfs_write+0xb4b/0x1580 fs/read_write.c:686\n  ksys_write fs/read_write.c:738 [inline]\n  __do_sys_write fs/read_write.c:749 [inline]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:59:44.778Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a3aea97d55964e70a1e6426aa4cafdc036e8a2dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/eed8960b289327235185b7c32649c3470a3e969b"
        },
        {
          "url": "https://git.kernel.org/stable/c/9fbc49429a23b02595ba82536c5ea425fdabb221"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0dd2e9729660f3f4fcb16e0aef87342911528ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfbf0665969af2c69d10c377d4c3d306e717efb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/18cdb3d982da8976b28d57691eb256ec5688fad2"
        }
      ],
      "title": "netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38441",
    "datePublished": "2025-07-25T15:27:20.276Z",
    "dateReserved": "2025-04-16T04:51:24.016Z",
    "dateUpdated": "2026-05-23T15:59:44.778Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:41:07.659Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:42:18.052Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/mm/ptdump_debugfs.c",
            "arch/riscv/mm/ptdump.c",
            "arch/s390/mm/dump_pagetables.c",
            "mm/ptdump.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3ee9a8c27bfd72c3f465004fa8455785d61be5e8",
              "status": "affected",
              "version": "bbd6ec605c0fc286c3f8ce60b4ed44635361d58b",
              "versionType": "git"
            },
            {
              "lessThan": "69bea84b06b5e779627e7afdbf4b60a7d231c76f",
              "status": "affected",
              "version": "bbd6ec605c0fc286c3f8ce60b4ed44635361d58b",
              "versionType": "git"
            },
            {
              "lessThan": "ac25ec5fa2bf6e606dc7954488e4dded272fa9cd",
              "status": "affected",
              "version": "bbd6ec605c0fc286c3f8ce60b4ed44635361d58b",
              "versionType": "git"
            },
            {
              "lessThan": "1636b5e9c3543b87d673e32a47e7c18698882425",
              "status": "affected",
              "version": "bbd6ec605c0fc286c3f8ce60b4ed44635361d58b",
              "versionType": "git"
            },
            {
              "lessThan": "ff40839e018b82c4d756d035f34a63aa2d93be83",
              "status": "affected",
              "version": "bbd6ec605c0fc286c3f8ce60b4ed44635361d58b",
              "versionType": "git"
            },
            {
              "lessThan": "67995d4244694928ce701928e530b5b4adeb17b4",
              "status": "affected",
              "version": "bbd6ec605c0fc286c3f8ce60b4ed44635361d58b",
              "versionType": "git"
            },
            {
              "lessThan": "ca8c414499f2e5337a95a76be0d21b728ee31c6b",
              "status": "affected",
              "version": "bbd6ec605c0fc286c3f8ce60b4ed44635361d58b",
              "versionType": "git"
            },
            {
              "lessThan": "59305202c67fea50378dcad0cc199dbc13a0e99a",
              "status": "affected",
              "version": "bbd6ec605c0fc286c3f8ce60b4ed44635361d58b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/mm/ptdump_debugfs.c",
            "arch/riscv/mm/ptdump.c",
            "arch/s390/mm/dump_pagetables.c",
            "mm/ptdump.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.43",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd()\n\nMemory hot remove unmaps and tears down various kernel page table regions\nas required.  The ptdump code can race with concurrent modifications of\nthe kernel page tables.  When leaf entries are modified concurrently, the\ndump code may log stale or inconsistent information for a VA range, but\nthis is otherwise not harmful.\n\nBut when intermediate levels of kernel page table are freed, the dump code\nwill continue to use memory that has been freed and potentially\nreallocated for another purpose.  In such cases, the ptdump code may\ndereference bogus addresses, leading to a number of potential problems.\n\nTo avoid the above mentioned race condition, platforms such as arm64,\nriscv and s390 take memory hotplug lock, while dumping kernel page table\nvia the sysfs interface /sys/kernel/debug/kernel_page_tables.\n\nSimilar race condition exists while checking for pages that might have\nbeen marked W+X via /sys/kernel/debug/kernel_page_tables/check_wx_pages\nwhich in turn calls ptdump_check_wx().  Instead of solving this race\ncondition again, let\u0027s just move the memory hotplug lock inside generic\nptdump_check_wx() which will benefit both the scenarios.\n\nDrop get_online_mems() and put_online_mems() combination from all existing\nplatform ptdump code paths."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:32:55.304Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3ee9a8c27bfd72c3f465004fa8455785d61be5e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/69bea84b06b5e779627e7afdbf4b60a7d231c76f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac25ec5fa2bf6e606dc7954488e4dded272fa9cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/1636b5e9c3543b87d673e32a47e7c18698882425"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff40839e018b82c4d756d035f34a63aa2d93be83"
        },
        {
          "url": "https://git.kernel.org/stable/c/67995d4244694928ce701928e530b5b4adeb17b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca8c414499f2e5337a95a76be0d21b728ee31c6b"
        },
        {
          "url": "https://git.kernel.org/stable/c/59305202c67fea50378dcad0cc199dbc13a0e99a"
        }
      ],
      "title": "mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38681",
    "datePublished": "2025-09-04T15:32:36.681Z",
    "dateReserved": "2025-04-16T04:51:24.031Z",
    "dateUpdated": "2026-07-14T12:42:18.052Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ixgbe/ixgbe_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "df445969aa727cd64f3f29dc1f85fb60aca238d1",
              "status": "affected",
              "version": "a0285236ab93fdfdd1008afaa04561d142d6c276",
              "versionType": "git"
            },
            {
              "lessThan": "5feef67b646d8f5064bac288e22204ffba2b9a4a",
              "status": "affected",
              "version": "a0285236ab93fdfdd1008afaa04561d142d6c276",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ixgbe/ixgbe_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.5",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nixgbe: fix too early devlink_free() in ixgbe_remove()\n\nSince ixgbe_adapter is embedded in devlink, calling devlink_free()\nprematurely in the ixgbe_remove() path can lead to UAF. Move devlink_free()\nto the end.\n\nKASAN report:\n\n BUG: KASAN: use-after-free in ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]\n Read of size 8 at addr ffff0000adf813e0 by task bash/2095\n CPU: 1 UID: 0 PID: 2095 Comm: bash Tainted: G S  6.17.0-rc2-tnguy.net-queue+ #1 PREEMPT(full)\n [...]\n Call trace:\n  show_stack+0x30/0x90 (C)\n  dump_stack_lvl+0x9c/0xd0\n  print_address_description.constprop.0+0x90/0x310\n  print_report+0x104/0x1f0\n  kasan_report+0x88/0x180\n  __asan_report_load8_noabort+0x20/0x30\n  ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]\n  ixgbe_clear_interrupt_scheme+0xf8/0x130 [ixgbe]\n  ixgbe_remove+0x2d0/0x8c0 [ixgbe]\n  pci_device_remove+0xa0/0x220\n  device_remove+0xb8/0x170\n  device_release_driver_internal+0x318/0x490\n  device_driver_detach+0x40/0x68\n  unbind_store+0xec/0x118\n  drv_attr_store+0x64/0xb8\n  sysfs_kf_write+0xcc/0x138\n  kernfs_fop_write_iter+0x294/0x440\n  new_sync_write+0x1fc/0x588\n  vfs_write+0x480/0x6a0\n  ksys_write+0xf0/0x1e0\n  __arm64_sys_write+0x70/0xc0\n  invoke_syscall.constprop.0+0xcc/0x280\n  el0_svc_common.constprop.0+0xa8/0x248\n  do_el0_svc+0x44/0x68\n  el0_svc+0x54/0x160\n  el0t_64_sync_handler+0xa0/0xe8\n  el0t_64_sync+0x1b0/0x1b8"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:42:20.367Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/df445969aa727cd64f3f29dc1f85fb60aca238d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/5feef67b646d8f5064bac288e22204ffba2b9a4a"
        }
      ],
      "title": "ixgbe: fix too early devlink_free() in ixgbe_remove()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40091",
    "datePublished": "2025-10-30T09:47:59.253Z",
    "dateReserved": "2025-04-16T07:20:57.162Z",
    "dateUpdated": "2026-05-11T21:42:20.367Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/proc/task_mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2a1f3663974162b8f1e098196f557cfc1d160138",
              "status": "affected",
              "version": "25ee01a2fca02dfb5a3ce316e77910c468108199",
              "versionType": "git"
            },
            {
              "lessThan": "09fc018f48871123ad5dbd7b03c956580232ed76",
              "status": "affected",
              "version": "25ee01a2fca02dfb5a3ce316e77910c468108199",
              "versionType": "git"
            },
            {
              "lessThan": "b625883ccbcc2b57808db51d1375b1d7b9bcb3e5",
              "status": "affected",
              "version": "25ee01a2fca02dfb5a3ce316e77910c468108199",
              "versionType": "git"
            },
            {
              "lessThan": "45d19b4b6c2d422771c29b83462d84afcbb33f01",
              "status": "affected",
              "version": "25ee01a2fca02dfb5a3ce316e77910c468108199",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/proc/task_mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "lessThan": "4.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.43",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/smaps: fix race between smaps_hugetlb_range and migration\n\nsmaps_hugetlb_range() handles the pte without holdling ptl, and may be\nconcurrenct with migration, leaing to BUG_ON in pfn_swap_entry_to_page(). \nThe race is as follows.\n\nsmaps_hugetlb_range              migrate_pages\n  huge_ptep_get\n                                   remove_migration_ptes\n\t\t\t\t   folio_unlock\n  pfn_swap_entry_folio\n    BUG_ON\n\nTo fix it, hold ptl lock in smaps_hugetlb_range()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:35:36.743Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2a1f3663974162b8f1e098196f557cfc1d160138"
        },
        {
          "url": "https://git.kernel.org/stable/c/09fc018f48871123ad5dbd7b03c956580232ed76"
        },
        {
          "url": "https://git.kernel.org/stable/c/b625883ccbcc2b57808db51d1375b1d7b9bcb3e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/45d19b4b6c2d422771c29b83462d84afcbb33f01"
        }
      ],
      "title": "mm/smaps: fix race between smaps_hugetlb_range and migration",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39754",
    "datePublished": "2025-09-11T16:52:24.763Z",
    "dateReserved": "2025-04-16T07:20:57.125Z",
    "dateUpdated": "2026-05-11T21:35:36.743Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2025-10-06T09:54:34.568Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39751",
    "datePublished": "2025-09-11T16:52:22.651Z",
    "dateRejected": "2025-10-06T09:54:34.568Z",
    "dateReserved": "2025-04-16T07:20:57.125Z",
    "dateUpdated": "2025-10-06T09:54:34.568Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nilfs2/the_nilfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6b0ea3df56cccd53398d0289f399f19d43136b2e",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            },
            {
              "lessThan": "a6f89b10042baca218c8598d6db5a44c7e32625f",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            },
            {
              "lessThan": "9b3ba54025357440d6c4414c670984f628c6f6bf",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            },
            {
              "lessThan": "d706485dffbbbf848e681edda29c7a46ac55698c",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            },
            {
              "lessThan": "d464b035c0613856d012cf1704879d3ff3f057fb",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            },
            {
              "lessThan": "b47f5c579c8186f7f5ab5e4254e0734ea5b7bf7a",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            },
            {
              "lessThan": "1012ff77284e3bec0ec0a35a820b03ec43dec2cc",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            },
            {
              "lessThan": "62d11ec205ef14d8acf172cfc9904fdbf200025a",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            },
            {
              "lessThan": "610a2a3d7d8be3537458a378ec69396a76c385b6",
              "status": "affected",
              "version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nilfs2/the_nilfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.337",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.303",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.229",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.337",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.303",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.270",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.229",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.163",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.86",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.16",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.2",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()\n\nPatch series \"nilfs2: fix UBSAN shift-out-of-bounds warnings on mount\ntime\".\n\nThe first patch fixes a bug reported by syzbot, and the second one fixes\nthe remaining bug of the same kind.  Although they are triggered by the\nsame super block data anomaly, I divided it into the above two because the\ndetails of the issues and how to fix it are different.\n\nBoth are required to eliminate the shift-out-of-bounds issues at mount\ntime.\n\n\nThis patch (of 2):\n\nIf the block size exponent information written in an on-disk superblock is\ncorrupted, nilfs_sb2_bad_offset helper function can trigger\nshift-out-of-bounds warning followed by a kernel panic (if panic_on_warn\nis set):\n\n shift exponent 38983 is too large for 64-bit type \u0027unsigned long long\u0027\n Call Trace:\n  \u003cTASK\u003e\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106\n  ubsan_epilogue lib/ubsan.c:151 [inline]\n  __ubsan_handle_shift_out_of_bounds+0x33d/0x3b0 lib/ubsan.c:322\n  nilfs_sb2_bad_offset fs/nilfs2/the_nilfs.c:449 [inline]\n  nilfs_load_super_block+0xdf5/0xe00 fs/nilfs2/the_nilfs.c:523\n  init_nilfs+0xb7/0x7d0 fs/nilfs2/the_nilfs.c:577\n  nilfs_fill_super+0xb1/0x5d0 fs/nilfs2/super.c:1047\n  nilfs_mount+0x613/0x9b0 fs/nilfs2/super.c:1317\n  ...\n\nIn addition, since nilfs_sb2_bad_offset() performs multiplication without\nconsidering the upper bound, the computation may overflow if the disk\nlayout parameters are not normal.\n\nThis fixes these issues by inserting preliminary sanity checks for those\nparameters and by converting the comparison from one involving\nmultiplication and left bit-shifting to one using division and right\nbit-shifting."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:20:16.210Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6b0ea3df56cccd53398d0289f399f19d43136b2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6f89b10042baca218c8598d6db5a44c7e32625f"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b3ba54025357440d6c4414c670984f628c6f6bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/d706485dffbbbf848e681edda29c7a46ac55698c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d464b035c0613856d012cf1704879d3ff3f057fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/b47f5c579c8186f7f5ab5e4254e0734ea5b7bf7a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1012ff77284e3bec0ec0a35a820b03ec43dec2cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/62d11ec205ef14d8acf172cfc9904fdbf200025a"
        },
        {
          "url": "https://git.kernel.org/stable/c/610a2a3d7d8be3537458a378ec69396a76c385b6"
        }
      ],
      "title": "nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50478",
    "datePublished": "2025-10-04T15:16:38.346Z",
    "dateReserved": "2025-10-04T15:13:33.467Z",
    "dateUpdated": "2026-05-11T19:20:16.210Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:19.069Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/acpi/acpica/dsmethod.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b49d224d1830c46e20adce2a239c454cdab426f1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2219e49857ffd6aea1b1ca5214d3270f84623a16",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "ab1e8491c19eb2ea0fda81ef28e841c7cb6399f5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "4305d936abde795c2ef6ba916de8f00a50f64d2d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d547779e72cea9865b732cd45393c4cd02b3598e",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "18ff4ed6a33a7e3f2097710eacc96bea7696e803",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "c9e4da550ae196132b990bd77ed3d8f2d9747f87",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6fcab2791543924d438e7fa49276d0998b0a069f",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/acpi/acpica/dsmethod.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.296",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.240",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.296",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.240",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.187",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.144",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.97",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Refuse to evaluate a method if arguments are missing\n\nAs reported in [1], a platform firmware update that increased the number\nof method parameters and forgot to update a least one of its callers,\ncaused ACPICA to crash due to use-after-free.\n\nSince this a result of a clear AML issue that arguably cannot be fixed\nup by the interpreter (it cannot produce missing data out of thin air),\naddress it by making ACPICA refuse to evaluate a method if the caller\nattempts to pass fewer arguments than expected to it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is the ACPICA AML interpreter, reachable only through control-method evaluation on the local machine (sysfs/procfs ACPI attributes, thermal/battery/EC paths, device init, suspend/resume); there is no network or adjacent-network path to AML execution.\nAC:L - On an affected system the defect triggers deterministically whenever the mismatched method invocation is evaluated \u2014 no race to win, no memory-layout condition to guess, and the stale operand slots are populated by the same walk state\u0027s normal expression evaluation.\nPR:L - Many ACPI control methods are evaluated in response to reads of world-accessible sysfs attributes (thermal zone temperature, power-supply uevent, backlight), so an unprivileged local user can repeatedly drive the vulnerable nested-method path without any capability.\nUI:N - Triggering requires only the attacker\u0027s own read of an ACPI-backed sysfs attribute or normal runtime ACPI activity; no action by another user or administrator is needed.\nS:U - The use-after-free corrupts kernel heap objects in the ACPICA operand cache, staying entirely within the kernel\u0027s own security authority with no crossing into a hypervisor, IOMMU, or other security scope.\nC:H - This is a use-after-free: acpi_ut_update_object_reference() reads the type, package count, and element pointers out of freed, potentially reallocated slab memory, and the resulting premature frees leave live AML-visible buffer/string objects dangling, giving a path to disclose arbitrary kernel memory contents.\nI:H - Decrementing reference counts through stale pointers yields refcount underflow, double-free, and an arbitrary-decrement primitive against reclaimed slab memory \u2014 a classic heap-corruption route to control-flow hijack and arbitrary write.\nA:H - The reported real-world symptom was a kernel crash from the use-after-free, and refcount corruption of ACPICA operand objects reliably produces oops/panic, which an unprivileged user can trigger repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:30.990Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b49d224d1830c46e20adce2a239c454cdab426f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/2219e49857ffd6aea1b1ca5214d3270f84623a16"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab1e8491c19eb2ea0fda81ef28e841c7cb6399f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/4305d936abde795c2ef6ba916de8f00a50f64d2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d547779e72cea9865b732cd45393c4cd02b3598e"
        },
        {
          "url": "https://git.kernel.org/stable/c/18ff4ed6a33a7e3f2097710eacc96bea7696e803"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9e4da550ae196132b990bd77ed3d8f2d9747f87"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fcab2791543924d438e7fa49276d0998b0a069f"
        }
      ],
      "title": "ACPICA: Refuse to evaluate a method if arguments are missing",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38386",
    "datePublished": "2025-07-25T12:53:27.229Z",
    "dateReserved": "2025-04-16T04:51:24.010Z",
    "dateUpdated": "2026-08-05T12:01:30.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/caam/ctrl.c",
            "drivers/crypto/caam/intern.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f9534674ce53f133c91c272f091f0242932574ae",
              "status": "affected",
              "version": "d2835701d93cae6d597672ef9dc3fa889867031a",
              "versionType": "git"
            },
            {
              "lessThan": "488ed465e579a20485f38080e4ef8b90b69ef7c0",
              "status": "affected",
              "version": "d2835701d93cae6d597672ef9dc3fa889867031a",
              "versionType": "git"
            },
            {
              "lessThan": "5ffc47feddcf8eb4d8ac7b42111a02c8e8146512",
              "status": "affected",
              "version": "d2835701d93cae6d597672ef9dc3fa889867031a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/caam/ctrl.c",
            "drivers/crypto/caam/intern.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.44",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP\n\nSince the CAAM on these SoCs is managed by another ARM core, called the\nSECO (Security Controller) on iMX8QM and Secure Enclave on iMX8ULP, which\nalso reserves access to register page 0 suspend operations cannot touch\nthis page.\n\nThis is similar to when running OPTEE, where OPTEE will reserve page 0.\n\nTrack this situation using a new state variable no_page0, reflecting if\npage 0 is reserved elsewhere, either by other management cores in SoC or\nby OPTEE.\n\nReplace the optee_en check in suspend/resume with the new check.\n\noptee_en cannot go away as it\u0027s needed elsewhere to gate OPTEE specific\nsituations.\n\nFixes the following splat at suspend:\n\n    Internal error: synchronous external abort: 0000000096000010 [#1] SMP\n    Hardware name: Freescale i.MX8QXP ACU6C (DT)\n    pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n    pc : readl+0x0/0x18\n    lr : rd_reg32+0x18/0x3c\n    sp : ffffffc08192ba20\n    x29: ffffffc08192ba20 x28: ffffff8025190000 x27: 0000000000000000\n    x26: ffffffc0808ae808 x25: ffffffc080922338 x24: ffffff8020e89090\n    x23: 0000000000000000 x22: ffffffc080922000 x21: ffffff8020e89010\n    x20: ffffffc080387ef8 x19: ffffff8020e89010 x18: 000000005d8000d5\n    x17: 0000000030f35963 x16: 000000008f785f3f x15: 000000003b8ef57c\n    x14: 00000000c418aef8 x13: 00000000f5fea526 x12: 0000000000000001\n    x11: 0000000000000002 x10: 0000000000000001 x9 : 0000000000000000\n    x8 : ffffff8025190870 x7 : ffffff8021726880 x6 : 0000000000000002\n    x5 : ffffff80217268f0 x4 : ffffff8021726880 x3 : ffffffc081200000\n    x2 : 0000000000000001 x1 : ffffff8020e89010 x0 : ffffffc081200004\n    Call trace:\n     readl+0x0/0x18\n     caam_ctrl_suspend+0x30/0xdc\n     dpm_run_callback.constprop.0+0x24/0x5c\n     device_suspend+0x170/0x2e8\n     dpm_suspend+0xa0/0x104\n     dpm_suspend_start+0x48/0x50\n     suspend_devices_and_enter+0x7c/0x45c\n     pm_suspend+0x148/0x160\n     state_store+0xb4/0xf8\n     kobj_attr_store+0x14/0x24\n     sysfs_kf_write+0x38/0x48\n     kernfs_fop_write_iter+0xb4/0x178\n     vfs_write+0x118/0x178\n     ksys_write+0x6c/0xd0\n     __arm64_sys_write+0x14/0x1c\n     invoke_syscall.constprop.0+0x64/0xb0\n     do_el0_svc+0x90/0xb0\n     el0_svc+0x18/0x44\n     el0t_64_sync_handler+0x88/0x124\n     el0t_64_sync+0x150/0x154\n    Code: 88dffc21 88dffc21 5ac00800 d65f03c0 (b9400000)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:34:59.798Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f9534674ce53f133c91c272f091f0242932574ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/488ed465e579a20485f38080e4ef8b90b69ef7c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ffc47feddcf8eb4d8ac7b42111a02c8e8146512"
        }
      ],
      "title": "crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39722",
    "datePublished": "2025-09-05T17:21:29.924Z",
    "dateReserved": "2025-04-16T07:20:57.117Z",
    "dateUpdated": "2026-05-11T21:34:59.798Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-39946",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T16:09:56.692660Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T16:11:14.264Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls.h",
            "net/tls/tls_strp.c",
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b36462146d86b1f22e594fe4dae611dffacfb203",
              "status": "affected",
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "versionType": "git"
            },
            {
              "lessThan": "4cefe5be73886f383639fe0850bb72d5b568a7b9",
              "status": "affected",
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "versionType": "git"
            },
            {
              "lessThan": "208640e6225cc929a05adbf79d1df558add3e231",
              "status": "affected",
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "versionType": "git"
            },
            {
              "lessThan": "61ca2da5fb8f433ce8bbd1657c84a86272133e6b",
              "status": "affected",
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "versionType": "git"
            },
            {
              "lessThan": "0aeb54ac4cd5cf8f60131b4d9ec0b6dc9c27b20d",
              "status": "affected",
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls.h",
            "net/tls/tls_strp.c",
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.154",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.108",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.49",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.9",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: make sure to abort the stream if headers are bogus\n\nNormally we wait for the socket to buffer up the whole record\nbefore we service it. If the socket has a tiny buffer, however,\nwe read out the data sooner, to prevent connection stalls.\nMake sure that we abort the connection when we find out late\nthat the record is actually invalid. Retrying the parsing is\nfine in itself but since we copy some more data each time\nbefore we parse we can overflow the allocated skb space.\n\nConstructing a scenario in which we\u0027re under pressure without\nenough data in the socket to parse the length upfront is quite\nhard. syzbot figured out a way to do this by serving us the header\nin small OOB sends, and then filling in the recvbuf with a large\nnormal send.\n\nMake sure that tls_rx_msg_size() aborts strp, if we reach\nan invalid record there\u0027s really no way to recover."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "Remote TLS peer can overflow kernel skb by sending crafted TLS record headers via small OOB sends followed by large normal send. The kTLS receive path in tls_strp_copyin_frag() writes past allocated skb fragments. Network-reachable, no authentication required."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:21.386Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b36462146d86b1f22e594fe4dae611dffacfb203"
        },
        {
          "url": "https://git.kernel.org/stable/c/4cefe5be73886f383639fe0850bb72d5b568a7b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/208640e6225cc929a05adbf79d1df558add3e231"
        },
        {
          "url": "https://git.kernel.org/stable/c/61ca2da5fb8f433ce8bbd1657c84a86272133e6b"
        },
        {
          "url": "https://git.kernel.org/stable/c/0aeb54ac4cd5cf8f60131b4d9ec0b6dc9c27b20d"
        }
      ],
      "title": "tls: make sure to abort the stream if headers are bogus",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39946",
    "datePublished": "2025-10-04T07:31:07.871Z",
    "dateReserved": "2025-04-16T07:20:57.148Z",
    "dateUpdated": "2026-08-05T12:06:21.386Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:35:33.497Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:41:41.730Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/core/fbmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ee20216f12d9482cd70e44dae5e7fabb38367c71",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "fab201d72fde38d081e2c5d4ad25595c535b7b22",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "1a10d91766eb6ddfd5414e4785611e33a4fe0f9b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "ff0e037241173b574b385bff53d67567b9816db5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "3ca78032a388a0795201792b36e6fc9b6e6e8eed",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b3071bb463ea1e6c686d0dc9638fc940f2f5cf17",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "8a3a2887794b2c8e78b3e5d6e3de724527c9f41b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "05f6e183879d9785a3cdf2f08a498bc31b7a20aa",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/core/fbmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.295",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.239",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.295",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.239",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.186",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.95",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var\n\nIf fb_add_videomode() in fb_set_var() fails to allocate memory for\nfb_videomode, later it may lead to a null-ptr dereference in\nfb_videomode_to_var(), as the fb_info is registered while not having the\nmode in modelist that is expected to be there, i.e. the one that is\ndescribed in fb_info-\u003evar.\n\n================================================================\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nCPU: 1 PID: 30371 Comm: syz-executor.1 Not tainted 5.10.226-syzkaller #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nRIP: 0010:fb_videomode_to_var+0x24/0x610 drivers/video/fbdev/core/modedb.c:901\nCall Trace:\n display_to_var+0x3a/0x7c0 drivers/video/fbdev/core/fbcon.c:929\n fbcon_resize+0x3e2/0x8f0 drivers/video/fbdev/core/fbcon.c:2071\n resize_screen drivers/tty/vt/vt.c:1176 [inline]\n vc_do_resize+0x53a/0x1170 drivers/tty/vt/vt.c:1263\n fbcon_modechanged+0x3ac/0x6e0 drivers/video/fbdev/core/fbcon.c:2720\n fbcon_update_vcs+0x43/0x60 drivers/video/fbdev/core/fbcon.c:2776\n do_fb_ioctl+0x6d2/0x740 drivers/video/fbdev/core/fbmem.c:1128\n fb_ioctl+0xe7/0x150 drivers/video/fbdev/core/fbmem.c:1203\n vfs_ioctl fs/ioctl.c:48 [inline]\n __do_sys_ioctl fs/ioctl.c:753 [inline]\n __se_sys_ioctl fs/ioctl.c:739 [inline]\n __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739\n do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x67/0xd1\n================================================================\n\nThe reason is that fb_info-\u003evar is being modified in fb_set_var(), and\nthen fb_videomode_to_var() is called. If it fails to add the mode to\nfb_info-\u003emodelist, fb_set_var() returns error, but does not restore the\nold value of fb_info-\u003evar. Restore fb_info-\u003evar on failure the same way\nit is done earlier in the function.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:23:26.706Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ee20216f12d9482cd70e44dae5e7fabb38367c71"
        },
        {
          "url": "https://git.kernel.org/stable/c/fab201d72fde38d081e2c5d4ad25595c535b7b22"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a10d91766eb6ddfd5414e4785611e33a4fe0f9b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff0e037241173b574b385bff53d67567b9816db5"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ca78032a388a0795201792b36e6fc9b6e6e8eed"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3071bb463ea1e6c686d0dc9638fc940f2f5cf17"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a3a2887794b2c8e78b3e5d6e3de724527c9f41b"
        },
        {
          "url": "https://git.kernel.org/stable/c/05f6e183879d9785a3cdf2f08a498bc31b7a20aa"
        }
      ],
      "title": "fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38214",
    "datePublished": "2025-07-04T13:37:32.410Z",
    "dateReserved": "2025-04-16T04:51:23.995Z",
    "dateUpdated": "2026-07-14T12:41:41.730Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_mode_config.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5ae70041a6d7de62a0cdb2bbcfe0c9cf753035d0",
              "status": "affected",
              "version": "6b4959f43a04e12d39c5700607727f2cbcfeac31",
              "versionType": "git"
            },
            {
              "lessThan": "d06e827a65a6bcd2e329045d891d0739cec1cf4a",
              "status": "affected",
              "version": "6b4959f43a04e12d39c5700607727f2cbcfeac31",
              "versionType": "git"
            },
            {
              "lessThan": "b14147464251f66e38fa39f0aae9780466db8610",
              "status": "affected",
              "version": "6b4959f43a04e12d39c5700607727f2cbcfeac31",
              "versionType": "git"
            },
            {
              "lessThan": "961620ad67611a7320a49f4b6f3c5e2906833a03",
              "status": "affected",
              "version": "6b4959f43a04e12d39c5700607727f2cbcfeac31",
              "versionType": "git"
            },
            {
              "lessThan": "834c23e4f798dcdc8af251b3c428ceef94741991",
              "status": "affected",
              "version": "6b4959f43a04e12d39c5700607727f2cbcfeac31",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_mode_config.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.173",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.99",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.173",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.99",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.16",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.3",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: Fix potential null-ptr-deref due to drmm_mode_config_init()\n\ndrmm_mode_config_init() will call drm_mode_create_standard_properties()\nand won\u0027t check the ret value. When drm_mode_create_standard_properties()\nfailed due to alloc, property will be a NULL pointer and may causes the\nnull-ptr-deref. Fix the null-ptr-deref by adding the ret value check.\n\nFound null-ptr-deref while testing insert module bochs:\ngeneral protection fault, probably for non-canonical address\n    0xdffffc000000000c: 0000 [#1] SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]\nCPU: 3 PID: 249 Comm: modprobe Not tainted 6.1.0-rc1+ #364\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\nrel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014\nRIP: 0010:drm_object_attach_property+0x73/0x3c0 [drm]\nCall Trace:\n \u003cTASK\u003e\n __drm_connector_init+0xb6c/0x1100 [drm]\n bochs_pci_probe.cold.11+0x4cb/0x7fe [bochs]\n pci_device_probe+0x17d/0x340\n really_probe+0x1db/0x5d0\n __driver_probe_device+0x1e7/0x250\n driver_probe_device+0x4a/0x120\n __driver_attach+0xcd/0x2c0\n bus_for_each_dev+0x11a/0x1b0\n bus_add_driver+0x3d7/0x500\n driver_register+0x18e/0x320\n do_one_initcall+0xc4/0x3e0\n do_init_module+0x1b4/0x630\n load_module+0x5dca/0x7230\n __do_sys_finit_module+0x100/0x170\n do_syscall_64+0x3f/0x90\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7ff65af9f839"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:21:42.566Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5ae70041a6d7de62a0cdb2bbcfe0c9cf753035d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/d06e827a65a6bcd2e329045d891d0739cec1cf4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b14147464251f66e38fa39f0aae9780466db8610"
        },
        {
          "url": "https://git.kernel.org/stable/c/961620ad67611a7320a49f4b6f3c5e2906833a03"
        },
        {
          "url": "https://git.kernel.org/stable/c/834c23e4f798dcdc8af251b3c428ceef94741991"
        }
      ],
      "title": "drm: Fix potential null-ptr-deref due to drmm_mode_config_init()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50556",
    "datePublished": "2025-10-22T13:23:17.527Z",
    "dateReserved": "2025-10-22T13:20:23.758Z",
    "dateUpdated": "2026-05-11T19:21:42.566Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/nfc/nci/ntf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8fcc7315a10a84264e55bb65ede10f0af20a983f",
              "status": "affected",
              "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
              "versionType": "git"
            },
            {
              "lessThan": "bfdda0123dde406dbff62e7e9136037e97998a15",
              "status": "affected",
              "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
              "versionType": "git"
            },
            {
              "lessThan": "0ba68bea1e356f466ad29449938bea12f5f3711f",
              "status": "affected",
              "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
              "versionType": "git"
            },
            {
              "lessThan": "74837bca0748763a77f77db47a0bdbe63b347628",
              "status": "affected",
              "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
              "versionType": "git"
            },
            {
              "lessThan": "c395d1e548cc68e84584ffa2e3ca9796a78bf7b9",
              "status": "affected",
              "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
              "versionType": "git"
            },
            {
              "lessThan": "9c328f54741bd5465ca1dc717c84c04242fac2e1",
              "status": "affected",
              "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/nfc/nci/ntf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "lessThan": "3.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.195",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.156",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.112",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.53",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: nfc: nci: Add parameter validation for packet data\n\nSyzbot reported an uninitialized value bug in nci_init_req, which was\nintroduced by commit 5aca7966d2a7 (\"Merge tag\n\u0027perf-tools-fixes-for-v6.17-2025-09-16\u0027 of\ngit://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools\").\n\nThis bug arises due to very limited and poor input validation\nthat was done at nic_valid_size(). This validation only\nvalidates the skb-\u003elen (directly reflects size provided at the\nuserspace interface) with the length provided in the buffer\nitself (interpreted as NCI_HEADER). This leads to the processing\nof memory content at the address assuming the correct layout\nper what opcode requires there. This leads to the accesses to\nbuffer of `skb_buff-\u003edata` which is not assigned anything yet.\n\nFollowing the same silent drop of packets of invalid sizes at\n`nic_valid_size()`, add validation of the data in the respective\nhandlers and return error values in case of failure. Release\nthe skb if error values are returned from handlers in\n`nci_nft_packet` and effectively do a silent drop\n\nPossible TODO: because we silently drop the packets, the\ncall to `nci_request` will be waiting for completion of request\nand will face timeouts. These timeouts can get excessively logged\nin the dmesg. A proper handling of them may require to export\n`nci_request_cancel` (or propagate error handling from the\nnft packets handlers)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The parsed data is NCI notification payload whose RF-specific and activation parameters (ATS/RATS length byte, ATR_RES length, tech-specific params) originate from the contactless peer, so an attacker with a spoofed card or NFC emulator in proximity of a phone/POS/embedded reader supplies the malformed lengths. NFC proximity is Adjacent per kernel scoring guidance (a local unprivileged N_NCI-ldisc path also exists, but is strictly lower severity).\nAC:L - The attacker directly controls the length byte versus actual payload length and can present the malformed card/frame repeatedly until the target polls it; no race, no unpredictable memory-layout precondition is required.\nPR:N - No credentials or account on the target are needed \u2014 NFC polling activates and parses the notification automatically, and on the local variant `NCIUARTSETDRIVER` in nci_uart_tty_ioctl() has no capability check at all.\nUI:N - The NFC stack polls and processes discovery/activation notifications autonomously; the attacker brings the hostile device into range and the victim performs no action.\nS:U - The over-read, the write-back in the credits handler, and the leaked data all stay within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Tens of bytes past the payload \u2014 uninitialized slab tailroom and skb_shared_info, which holds kernel pointers \u2014 are copied into nfcid1/sens_res/ATS and exported to userspace via NFC netlink attributes, yielding stale-heap and kernel-pointer disclosure usable for KASLR defeat.\nI:H - `nci_core_conn_credits_ntf_packet()` writes masked bytes back into memory beyond the validated payload for up to 10 entries and adds an out-of-bounds byte into conn_info-\u003ecredits_cnt, and unvalidated data populates ndev state (nci_ver, manufact_id, remote_gb, credits), giving attacker-shapeable kernel memory/state corruption.\nA:H - Out-of-bounds slab reads can hit a redzone/adjacent object and oops (KASAN/panic_on_oops), and the commit itself notes the resulting dropped packets leave nci_request() blocking until timeout with repeated dmesg flooding, degrading the NFC stack."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:16.234Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8fcc7315a10a84264e55bb65ede10f0af20a983f"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfdda0123dde406dbff62e7e9136037e97998a15"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ba68bea1e356f466ad29449938bea12f5f3711f"
        },
        {
          "url": "https://git.kernel.org/stable/c/74837bca0748763a77f77db47a0bdbe63b347628"
        },
        {
          "url": "https://git.kernel.org/stable/c/c395d1e548cc68e84584ffa2e3ca9796a78bf7b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c328f54741bd5465ca1dc717c84c04242fac2e1"
        }
      ],
      "title": "net: nfc: nci: Add parameter validation for packet data",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40043",
    "datePublished": "2025-10-28T11:48:22.230Z",
    "dateReserved": "2025-04-16T07:20:57.154Z",
    "dateUpdated": "2026-08-05T12:07:16.234Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_set_rbtree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b76db53ee8802ee5683f8cb401d7e2ec6f9b3d56",
              "status": "affected",
              "version": "7ab87a326f20c52ff4d9972052d085be951c704b",
              "versionType": "git"
            },
            {
              "lessThan": "899aa5638568abf5d69de7a7bb95e4615157375b",
              "status": "affected",
              "version": "181859bdfb9734aca449512fccaee4cacce64aed",
              "versionType": "git"
            },
            {
              "lessThan": "3fa13203b6d90cc3a33af47b058739f92ab82eef",
              "status": "affected",
              "version": "4aacf3d78424293e318c616016865380b37b9cc5",
              "versionType": "git"
            },
            {
              "lessThan": "ec5caa765f7f6960011c919c9aeb1467940421f6",
              "status": "affected",
              "version": "2bf1435fa19d2c58054391b3bba40d5510a5758c",
              "versionType": "git"
            },
            {
              "lessThan": "a836be60a3aabcedcd9c79f545d409ace1f20ba6",
              "status": "affected",
              "version": "318cb24a4c3fce8140afaf84e4d45fcb76fb280b",
              "versionType": "git"
            },
            {
              "lessThan": "a337706c1fb35aac3f26b48aca80421bdbe1d33a",
              "status": "affected",
              "version": "c9e6978e2725a7d4b6cd23b2facd3f11422c0643",
              "versionType": "git"
            },
            {
              "lessThan": "61ae320a29b0540c16931816299eb86bf2b66c08",
              "status": "affected",
              "version": "c9e6978e2725a7d4b6cd23b2facd3f11422c0643",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.181",
              "status": "affected",
              "version": "5.10.166",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.113",
              "status": "affected",
              "version": "5.15.91",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.30",
              "status": "affected",
              "version": "6.1.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_set_rbtree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.181",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.181",
                  "versionStartIncluding": "5.10.166",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.113",
                  "versionStartIncluding": "5.15.91",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.30",
                  "versionStartIncluding": "6.1.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.4",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_rbtree: fix null deref on element insertion\n\nThere is no guarantee that rb_prev() will not return NULL in nft_rbtree_gc_elem():\n\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN\nKASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]\n nft_add_set_elem+0x14b0/0x2990\n  nf_tables_newsetelem+0x528/0xb30\n\nFurthermore, there is a possible use-after-free while iterating,\n\u0027node\u0027 can be free\u0027d so we need to cache the next value to use."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through the nfnetlink/nftables netlink socket (NFT_MSG_NEWSETELEM), which requires local system access; there is no packet-processing path into nft_rbtree_gc_elem().\nAC:L - The attacker fully controls set contents, element timeouts, and insertion order, so making an expired element the leftmost rbtree node (rb_prev() == NULL) during the overlap walk is deterministic and needs no race or unpredictable memory layout.\nPR:L - Only CAP_NET_ADMIN in the network namespace is required, enforced via namespace-relative netlink_net_capable(), which any unprivileged user obtains with \"unshare -Urn\"; nftables and the rbtree set backend are fully netns-aware and autoloaded.\nUI:N - The attacker triggers the bug entirely from their own process by issuing netlink set-element operations; no victim action is involved.\nS:U - The corruption and crash occur within the kernel of the same host and security authority as the attacking task, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The fix addresses a use-after-free during the tree walk (an rb_erase()\u0027d, RCU-freed element is re-entered via rb_next()), and a UAF/double-free of nft_rbtree_elem objects gives the attacker control over reclaimed slab contents and thus a kernel memory read primitive.\nI:H - Beyond the crash, rb_erase() is invoked on an unvalidated rbe_prev (NULL or a wrong still-active element) and on already-erased nodes, producing attacker-influenced rbtree pointer writes and double nft_set_elem_destroy() \u2014 a classic heap-corruption primitive usable for control-flow hijack.\nA:H - The documented and readily reproducible outcome is a general protection fault / null-ptr-deref oops inside nft_add_set_elem() while holding the rbtree write lock and nftables commit mutex, panicking the kernel or wedging the netfilter subsystem."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:14:52.185Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b76db53ee8802ee5683f8cb401d7e2ec6f9b3d56"
        },
        {
          "url": "https://git.kernel.org/stable/c/899aa5638568abf5d69de7a7bb95e4615157375b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fa13203b6d90cc3a33af47b058739f92ab82eef"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec5caa765f7f6960011c919c9aeb1467940421f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/a836be60a3aabcedcd9c79f545d409ace1f20ba6"
        },
        {
          "url": "https://git.kernel.org/stable/c/a337706c1fb35aac3f26b48aca80421bdbe1d33a"
        },
        {
          "url": "https://git.kernel.org/stable/c/61ae320a29b0540c16931816299eb86bf2b66c08"
        }
      ],
      "title": "netfilter: nft_set_rbtree: fix null deref on element insertion",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53566",
    "datePublished": "2025-10-04T15:17:08.598Z",
    "dateReserved": "2025-10-04T15:14:15.924Z",
    "dateUpdated": "2026-08-05T09:14:52.185Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt7601u/dma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "67e4519afba215199b6dfa39ce5d7ea673ee4138",
              "status": "affected",
              "version": "c869f77d6abb5d5f9f2f1a661d5c53862a9cad34",
              "versionType": "git"
            },
            {
              "lessThan": "47dc1f425af57b71111d7b01ebd24e04e8d967ef",
              "status": "affected",
              "version": "c869f77d6abb5d5f9f2f1a661d5c53862a9cad34",
              "versionType": "git"
            },
            {
              "lessThan": "1a1f43059afae5cc9409e0c3bc63bfc09bc8facb",
              "status": "affected",
              "version": "c869f77d6abb5d5f9f2f1a661d5c53862a9cad34",
              "versionType": "git"
            },
            {
              "lessThan": "61d0163e2be7a439cf6f82e9ad7de563ecf41e7a",
              "status": "affected",
              "version": "c869f77d6abb5d5f9f2f1a661d5c53862a9cad34",
              "versionType": "git"
            },
            {
              "lessThan": "d0db59e2f718d1e2f1d2a2d8092168fdd2f3add0",
              "status": "affected",
              "version": "c869f77d6abb5d5f9f2f1a661d5c53862a9cad34",
              "versionType": "git"
            },
            {
              "lessThan": "803f3176c5df3b5582c27ea690f204abb60b19b9",
              "status": "affected",
              "version": "c869f77d6abb5d5f9f2f1a661d5c53862a9cad34",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt7601u/dma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.173",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.99",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.235",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.173",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.99",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.16",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.3",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt7601u: fix an integer underflow\n\nFix an integer underflow that leads to a null pointer dereference in\n\u0027mt7601u_rx_skb_from_seg()\u0027. The variable \u0027dma_len\u0027 in the URB packet\ncould be manipulated, which could trigger an integer underflow of\n\u0027seg_len\u0027 in \u0027mt7601u_rx_process_seg()\u0027. This underflow subsequently\ncauses the \u0027bad_frame\u0027 checks in \u0027mt7601u_rx_skb_from_seg()\u0027 to be\nbypassed, eventually leading to a dereference of the pointer \u0027p\u0027, which\nis a null pointer.\n\nEnsure that \u0027dma_len\u0027 is greater than \u0027min_seg_len\u0027.\n\nFound by a modified version of syzkaller.\n\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nCPU: 0 PID: 12 Comm: ksoftirqd/0 Tainted: G        W  O      5.14.0+\n#139\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\nrel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014\nRIP: 0010:skb_add_rx_frag+0x143/0x370\nCode: e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 8d 7d 08 44\n89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02\n00 0f 85 cd 01 00 00 48 8b 45 08 a8 01 0f 85 3d 01 00 00\nRSP: 0018:ffffc900000cfc90 EFLAGS: 00010202\nRAX: dffffc0000000000 RBX: ffff888115520dc0 RCX: 0000000000000000\nRDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8\nRBP: 0000000000000000 R08: 0000000000000e09 R09: 0000000000000010\nR10: ffff888111843017 R11: ffffed1022308602 R12: 0000000000000000\nR13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008\nFS:  0000000000000000(0000) GS:ffff88811a800000(0000)\nknlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000004035af40 CR3: 00000001157f2000 CR4: 0000000000750ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n mt7601u_rx_tasklet+0xc73/0x1270\n ? mt7601u_submit_rx_buf.isra.0+0x510/0x510\n ? tasklet_action_common.isra.0+0x79/0x2f0\n tasklet_action_common.isra.0+0x206/0x2f0\n __do_softirq+0x1b5/0x880\n ? tasklet_unlock+0x30/0x30\n run_ksoftirqd+0x26/0x50\n smpboot_thread_fn+0x34f/0x7d0\n ? smpboot_register_percpu_thread+0x370/0x370\n kthread+0x3a1/0x480\n ? set_kthread_struct+0x120/0x120\n ret_from_fork+0x1f/0x30\nModules linked in: 88XXau(O) 88x2bu(O)\n---[ end trace 57f34f93b4da0f9b ]---\nRIP: 0010:skb_add_rx_frag+0x143/0x370\nCode: e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 8d 7d 08 44\n89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02\n00 0f 85 cd 01 00 00 48 8b 45 08 a8 01 0f 85 3d 01 00 00\nRSP: 0018:ffffc900000cfc90 EFLAGS: 00010202\nRAX: dffffc0000000000 RBX: ffff888115520dc0 RCX: 0000000000000000\nRDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8\nRBP: 0000000000000000 R08: 0000000000000e09 R09: 0000000000000010\nR10: ffff888111843017 R11: ffffed1022308602 R12: 0000000000000000\nR13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008\nFS:  0000000000000000(0000) GS:ffff88811a800000(0000)\nknlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000004035af40 CR3: 00000001157f2000 CR4: 0000000000750ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The mt7601u is an 802.11 USB dongle and the vulnerable code is its RX completion tasklet, which parses frame descriptors fed by an untrusted external wireless adapter within radio range of the victim; this is the WiFi-frame-reception path, not a local syscall interface. This matches the CNA\u0027s treatment of equivalent USB-attached network device RX-framing bugs (CVE-2026-64540 gl620a, CVE-2026-64547 net1080, CVE-2025-37918 btusb) as Adjacent.\nAC:L - The trigger is a single malformed length field (`dma_len` \u003c 40) in a received segment; there is no race, no timing window, and no dependence on memory layout the attacker cannot influence, and it can be replayed indefinitely for a deterministic underflow.\nPR:N - `mt7601u_rx_process_entry()` runs in softirq context on every RX URB as soon as the interface is up, before mac80211 performs any authentication, association, or decryption validation, so no credentials or local account are required.\nUI:N - Frame processing is fully automatic in the RX tasklet; no victim action such as connecting to a network, mounting, or opening a file is needed.\nS:U - The underflow, the NULL dereference, and the out-of-bounds fragment all occur within the kernel\u0027s own security authority with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - With the length guard defeated, `skb_add_rx_frag()` attaches up to ~4 KB starting beyond the received data \u2014 past the end of the 32 KB RX page when the crafted segment is near the buffer tail \u2014 and that adjacent kernel memory is delivered up the mac80211/network stack as frame payload, an unbounded heap disclosure.\nI:L - There is no out-of-bounds write primitive (the linear copies stay within the skb\u0027s tailroom), but the driver builds an skb whose fragment descriptor points outside the valid buffer with a `truesize` of 12 for a multi-kilobyte fragment, corrupting skb memory accounting and injecting attacker-influenced kernel memory as a frame into the stack.\nA:H - The documented result is a KASAN-confirmed NULL pointer dereference at `skb_add_rx_frag+0x143` inside `mt7601u_rx_tasklet`, i.e. a kernel oops in softirq context, repeatable on every malformed segment."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:15:30.817Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/67e4519afba215199b6dfa39ce5d7ea673ee4138"
        },
        {
          "url": "https://git.kernel.org/stable/c/47dc1f425af57b71111d7b01ebd24e04e8d967ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a1f43059afae5cc9409e0c3bc63bfc09bc8facb"
        },
        {
          "url": "https://git.kernel.org/stable/c/61d0163e2be7a439cf6f82e9ad7de563ecf41e7a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0db59e2f718d1e2f1d2a2d8092168fdd2f3add0"
        },
        {
          "url": "https://git.kernel.org/stable/c/803f3176c5df3b5582c27ea690f204abb60b19b9"
        }
      ],
      "title": "wifi: mt7601u: fix an integer underflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53679",
    "datePublished": "2025-10-07T15:21:33.926Z",
    "dateReserved": "2025-10-07T15:16:59.664Z",
    "dateUpdated": "2026-08-05T09:15:30.817Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/intel/avs/debugfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cc03c899e6d9812b25c3754c9a95c3830c4aec26",
              "status": "affected",
              "version": "5a565ba23abe478f3d4c3b0c8798bcb5215b82f5",
              "versionType": "git"
            },
            {
              "lessThan": "18ff538aac63de1866e5a49d57e22788b5c21d12",
              "status": "affected",
              "version": "5a565ba23abe478f3d4c3b0c8798bcb5215b82f5",
              "versionType": "git"
            },
            {
              "lessThan": "2916794ffbce604cc2cda105f6b8a4a7c748dd7f",
              "status": "affected",
              "version": "5a565ba23abe478f3d4c3b0c8798bcb5215b82f5",
              "versionType": "git"
            },
            {
              "lessThan": "93e246b6769bdacb09cfff4ea0f00fe5ab4f0d7a",
              "status": "affected",
              "version": "5a565ba23abe478f3d4c3b0c8798bcb5215b82f5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/intel/avs/debugfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.94",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: avs: Verify content returned by parse_int_array()\n\nThe first element of the returned array stores its length. If it is 0,\nany manipulation beyond the element at index 0 ends with null-ptr-deref."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:25:26.708Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cc03c899e6d9812b25c3754c9a95c3830c4aec26"
        },
        {
          "url": "https://git.kernel.org/stable/c/18ff538aac63de1866e5a49d57e22788b5c21d12"
        },
        {
          "url": "https://git.kernel.org/stable/c/2916794ffbce604cc2cda105f6b8a4a7c748dd7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/93e246b6769bdacb09cfff4ea0f00fe5ab4f0d7a"
        }
      ],
      "title": "ASoC: Intel: avs: Verify content returned by parse_int_array()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38307",
    "datePublished": "2025-07-10T07:42:17.427Z",
    "dateReserved": "2025-04-16T04:51:24.003Z",
    "dateUpdated": "2026-05-11T21:25:26.708Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:41:53.468Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:42:28.849Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-38724",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:40:31.454640Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:02.473Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3f252a73e81aa01660cb426735eab932e6182e8d",
              "status": "affected",
              "version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
              "versionType": "git"
            },
            {
              "lessThan": "d35ac850410966010e92f401f4e21868a9ea4d8b",
              "status": "affected",
              "version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
              "versionType": "git"
            },
            {
              "lessThan": "f3aac6cf390d8b80e1d82975faf4ac61175519c0",
              "status": "affected",
              "version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
              "versionType": "git"
            },
            {
              "lessThan": "22f45cedf281e6171817c8a3432c44d788c550e1",
              "status": "affected",
              "version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
              "versionType": "git"
            },
            {
              "lessThan": "d71abd1ae4e0413707cd42b10c24a11d1aa71772",
              "status": "affected",
              "version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
              "versionType": "git"
            },
            {
              "lessThan": "74ad36ed60df561a303a19ecef400c7096b20306",
              "status": "affected",
              "version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
              "versionType": "git"
            },
            {
              "lessThan": "36e83eda90e0e4ac52f259f775b40b2841f8a0a3",
              "status": "affected",
              "version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
              "versionType": "git"
            },
            {
              "lessThan": "571a5e46c71490285d2d8c06f6b5a7cbf6c7edd1",
              "status": "affected",
              "version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
              "versionType": "git"
            },
            {
              "lessThan": "908e4ead7f757504d8b345452730636e298cbf68",
              "status": "affected",
              "version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.17"
            },
            {
              "lessThan": "3.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.43",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()\n\nLei Lu recently reported that nfsd4_setclientid_confirm() did not check\nthe return value from get_client_locked(). a SETCLIENTID_CONFIRM could\nrace with a confirmed client expiring and fail to get a reference. That\ncould later lead to a UAF.\n\nFix this by getting a reference early in the case where there is an\nextant confirmed client. If that fails then treat it as if there were no\nconfirmed client found at all.\n\nIn the case where the unconfirmed client is expiring, just fail and\nreturn the result from get_client_locked()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is the nfsd in-kernel NFSv4 server\u0027s SETCLIENTID_CONFIRM handler, reached directly from an NFSv4.0 COMPOUND sent over TCP/2049 by a remote peer. No local access to the server is needed.\nAC:L - The attacker controls its own side of the race and can issue unauthenticated SETCLIENTID_CONFIRM operations at arbitrary rate, and the vulnerable window (force_expire_client() parked in wait_event for cl_rpc_users to drain) stays open as long as the attacker keeps RPCs in flight, so the window is attacker-widened rather than narrow. The forced-expire trigger is an administrative action, but it is the documented response to exactly the kind of misbehaving client the attacker can pose as.\nPR:N - OP_SETCLIENTID_CONFIRM is ALLOWED_WITHOUT_FH/ALLOWED_ON_ABSENT_FS, so no filehandle or export access check is performed, and under the default AUTH_SYS/AUTH_NULL flavors the RPC credentials are self-asserted and never verified. Any host able to reach the NFS port can reach the bug.\nUI:N - The attack is completed entirely by the attacker\u0027s own NFS traffic; no victim opens a file, mounts a filesystem, or otherwise interacts. The concurrent client-expiry is a system/administrative state condition folded into Attack Complexity, not user interaction.\nS:U - The corrupted object (struct nfs4_client) and all consequences remain within the kernel of the NFS server; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed struct nfs4_client is used after free (fsnotify_dentry, nfsd4_probe_callback) and its slab can be re-occupied by attacker-groomed data, giving a path to disclose arbitrary kernel memory. Per kernel scoring guidance a UAF is scored C:H.\nI:H - The UAF yields concrete write primitives on freed memory \u2014 set_bit() on cl_flags, memcpy() into cl_cb_conn, and an unbalanced atomic_dec() in put_client_renew_locked() \u2014 plus a function-pointer dereference via nfsd4_run_cb(\u0026clp-\u003ecl_cb_null), which is exploitable for control-flow hijacking.\nA:H - The use-after-free reliably oopses or panics the NFS server; additionally renew_client_locked() hits WARN_ON(1) (fatal with panic_on_warn) and the cl_rpc_users underflow to -1 leaves force_expire_client() stuck forever in wait_event, producing an unkillable hung task."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:04:18.336Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3f252a73e81aa01660cb426735eab932e6182e8d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d35ac850410966010e92f401f4e21868a9ea4d8b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3aac6cf390d8b80e1d82975faf4ac61175519c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/22f45cedf281e6171817c8a3432c44d788c550e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/d71abd1ae4e0413707cd42b10c24a11d1aa71772"
        },
        {
          "url": "https://git.kernel.org/stable/c/74ad36ed60df561a303a19ecef400c7096b20306"
        },
        {
          "url": "https://git.kernel.org/stable/c/36e83eda90e0e4ac52f259f775b40b2841f8a0a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/571a5e46c71490285d2d8c06f6b5a7cbf6c7edd1"
        },
        {
          "url": "https://git.kernel.org/stable/c/908e4ead7f757504d8b345452730636e298cbf68"
        }
      ],
      "title": "nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38724",
    "datePublished": "2025-09-04T15:33:22.370Z",
    "dateReserved": "2025-04-16T04:51:24.033Z",
    "dateUpdated": "2026-08-05T12:04:18.336Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:42:13.673Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:06:08.852Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-39682",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:42:07.158655Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:19.531Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2902c3ebcca52ca845c03182000e8d71d3a5196f",
              "status": "affected",
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "versionType": "git"
            },
            {
              "lessThan": "c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677",
              "status": "affected",
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "versionType": "git"
            },
            {
              "lessThan": "3439c15ae91a517cf3c650ea15a8987699416ad9",
              "status": "affected",
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "versionType": "git"
            },
            {
              "lessThan": "29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e",
              "status": "affected",
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "versionType": "git"
            },
            {
              "lessThan": "62708b9452f8eb77513115b17c4f8d1a22ebf843",
              "status": "affected",
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.44",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix handling of zero-length records on the rx_list\n\nEach recvmsg() call must process either\n - only contiguous DATA records (any number of them)\n - one non-DATA record\n\nIf the next record has different type than what has already been\nprocessed we break out of the main processing loop. If the record\nhas already been decrypted (which may be the case for TLS 1.3 where\nwe don\u0027t know type until decryption) we queue the pending record\nto the rx_list. Next recvmsg() will pick it up from there.\n\nQueuing the skb to rx_list after zero-copy decrypt is not possible,\nsince in that case we decrypted directly to the user space buffer,\nand we don\u0027t have an skb to queue (darg.skb points to the ciphertext\nskb for access to metadata like length).\n\nOnly data records are allowed zero-copy, and we break the processing\nloop after each non-data record. So we should never zero-copy and\nthen find out that the record type has changed. The corner case\nwe missed is when the initial record comes from rx_list, and it\u0027s\nzero length."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is triggered entirely by the sequence and content of TLS records arriving from the remote peer on a kTLS-enabled TCP socket (net/tls RX path); no local access is needed. Any kTLS RX consumer \u2014 OpenSSL-with-kTLS servers/clients, NFS-over-TLS, SMB/RPC-over-TLS via net/handshake \u2014 is remotely reachable over the network.\nAC:L - The attacker sends three back-to-back records ([DATA][zero-length non-DATA][DATA]) and the corruption occurs deterministically on the victim\u0027s ordinary recvmsg() loop, with no race to win and no memory-layout dependency; the kernel selftest added with the fix reproduces it in one shot. TLS 1.2 is zero-copy-capable by default (zc_capable = rx_no_pad || version != TLS_1_3_VERSION), so no unusual kernel config or sockopt is required.\nPR:N - The attacker is the remote TLS peer, which holds no privileges on the target system \u2014 an anonymous client completing a server-authenticated TLS handshake with a kTLS server, or a malicious server that a kTLS client connects to, suffices. This matches the repo\u0027s PR:N scoring of the comparable remote-peer net/tls bug CVE-2025-39946.\nUI:N - The victim application only has to run its normal recvmsg() loop on an already-established kTLS socket; no click, mount, file open, or any other victim action is required. The attacker drives the entire trigger from the wire.\nS:U - The corruption is confined to kernel skb/slab state within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed. Standard in-kernel memory corruption is Scope:Unchanged.\nC:H - The strparser anchor is queued on rx_list after tcp_read_done() already released its backing TCP skbs, so the next recvmsg() copies freed kernel heap memory straight into the userspace buffer via skb_copy_datagram_msg(). This is a directly usable, repeatable kernel-memory disclosure primitive, not a bounded pointer leak.\nI:H - The live strp-\u003eanchor is consume_skb()\u0027d by process_rx_list() while the strparser still uses it, after which incoming attacker-controlled TCP data is written into the freed sk_buff/skb_shared_info (skb_fill_page_desc, tls_strp_load_anchor_with_queue), and socket teardown double-frees the anchor and its frag_list skbs. This yields attacker-controlled write-after-free and freelist corruption suitable for control-flow hijack.\nA:H - The use-after-free and double-free of the anchor and of already-released TCP receive-queue skbs reliably corrupt slab state, producing oopses/panics and list corruption. Any remote peer can repeat this on every connection, giving a trivial remote kernel-crash DoS."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:04:31.384Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f"
        },
        {
          "url": "https://git.kernel.org/stable/c/c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677"
        },
        {
          "url": "https://git.kernel.org/stable/c/3439c15ae91a517cf3c650ea15a8987699416ad9"
        },
        {
          "url": "https://git.kernel.org/stable/c/29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e"
        },
        {
          "url": "https://git.kernel.org/stable/c/62708b9452f8eb77513115b17c4f8d1a22ebf843"
        }
      ],
      "title": "tls: fix handling of zero-length records on the rx_list",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39682",
    "datePublished": "2025-09-05T17:20:48.657Z",
    "dateReserved": "2025-04-16T07:20:57.113Z",
    "dateUpdated": "2026-08-05T12:04:31.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:04.845Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "34d3e10ab905f06445f8dbd8a3d9697095e71bae",
              "status": "affected",
              "version": "2deade5ede56581722c0d7672f28b09548dc0fc4",
              "versionType": "git"
            },
            {
              "lessThan": "1ebcdf38887949def1a553ff3e45c98ed95a3cd0",
              "status": "affected",
              "version": "2deade5ede56581722c0d7672f28b09548dc0fc4",
              "versionType": "git"
            },
            {
              "lessThan": "5148c7ea69e9c5bf2f05081190f45ba96d3d1e7a",
              "status": "affected",
              "version": "2deade5ede56581722c0d7672f28b09548dc0fc4",
              "versionType": "git"
            },
            {
              "lessThan": "4ce9f2dc9ff7cc410e8c5d936ec551e26b9599a9",
              "status": "affected",
              "version": "2deade5ede56581722c0d7672f28b09548dc0fc4",
              "versionType": "git"
            },
            {
              "lessThan": "b3005145eab98d36777660b8893466e4f630ae1c",
              "status": "affected",
              "version": "2deade5ede56581722c0d7672f28b09548dc0fc4",
              "versionType": "git"
            },
            {
              "lessThan": "c3e9826a22027a21d998d3e64882fa377b613006",
              "status": "affected",
              "version": "2deade5ede56581722c0d7672f28b09548dc0fc4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.187",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.143",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.96",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.36",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.5",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null pointer check for get_first_active_display()\n\nThe function mod_hdcp_hdcp1_enable_encryption() calls the function\nget_first_active_display(), but does not check its return value.\nThe return value is a null pointer if the display list is empty.\nThis will lead to a null pointer dereference in\nmod_hdcp_hdcp2_enable_encryption().\n\nAdd a null pointer check for get_first_active_display() and return\nMOD_HDCP_STATUS_DISPLAY_NOT_FOUND if the function return null."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:26:31.259Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/34d3e10ab905f06445f8dbd8a3d9697095e71bae"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ebcdf38887949def1a553ff3e45c98ed95a3cd0"
        },
        {
          "url": "https://git.kernel.org/stable/c/5148c7ea69e9c5bf2f05081190f45ba96d3d1e7a"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ce9f2dc9ff7cc410e8c5d936ec551e26b9599a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3005145eab98d36777660b8893466e4f630ae1c"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3e9826a22027a21d998d3e64882fa377b613006"
        }
      ],
      "title": "drm/amd/display: Add null pointer check for get_first_active_display()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38362",
    "datePublished": "2025-07-25T12:47:33.035Z",
    "dateReserved": "2025-04-16T04:51:24.008Z",
    "dateUpdated": "2026-05-11T21:26:31.259Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-39896",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T19:28:28.158447Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T19:33:13.870Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/ivpu/ivpu_drv.c",
            "drivers/accel/ivpu/ivpu_pm.c",
            "drivers/accel/ivpu/ivpu_pm.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "54c49eca38dbd06913a696f6d7610937dcfad226",
              "status": "affected",
              "version": "58cde80f45a2b1683ea3c24a9a9a4b0e1005336b",
              "versionType": "git"
            },
            {
              "lessThan": "565d2c15b6c36c3250e694f7b9a86229c1787be5",
              "status": "affected",
              "version": "58cde80f45a2b1683ea3c24a9a9a4b0e1005336b",
              "versionType": "git"
            },
            {
              "lessThan": "69a79ada8eb034ce016b5b78fb7d08d8687223de",
              "status": "affected",
              "version": "58cde80f45a2b1683ea3c24a9a9a4b0e1005336b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/ivpu/ivpu_drv.c",
            "drivers/accel/ivpu/ivpu_pm.c",
            "drivers/accel/ivpu/ivpu_pm.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.46",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.6",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/ivpu: Prevent recovery work from being queued during device removal\n\nUse disable_work_sync() instead of cancel_work_sync() in ivpu_dev_fini()\nto ensure that no new recovery work items can be queued after device\nremoval has started. Previously, recovery work could be scheduled even\nafter canceling existing work, potentially leading to use-after-free\nbugs if recovery accessed freed resources.\n\nRename ivpu_pm_cancel_recovery() to ivpu_pm_disable_recovery() to better\nreflect its new behavior."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The Intel NPU is an integrated PCI device driven through local ioctls on /dev/accel/accel0 and local sysfs/module operations; there is no network or adjacent-network path into ivpu_pm_trigger_recovery() or ivpu_dev_fini().\nAC:L - The attacker fully controls the recovery-triggering side of the race and can arm it persistently \u2014 wedging the NPU firmware makes every subsequent JSM/IPC message time out, so once teardown starts, `ivpu_pm_trigger_recovery()` fires from context_abort_work, IRQ handlers, or IPC timeouts with near-certainty rather than as a low-probability window, and the attempt can be repeated indefinitely at no cost.\nPR:L - Reaching the recovery triggers only needs an open handle to the accel render node \u2014 all ivpu ioctls are declared with flags 0 (no DRM_ROOT_ONLY/DRM_AUTH), so any local user in the render/uaccess group can submit faulting jobs and hang the firmware.\nUI:N - No victim must open attacker-supplied content or perform an interactive action; device teardown also occurs from automated events such as package-driven driver reload, PCI error handling, and shutdown/unbind scripts.\nS:U - The use-after-free corrupts kernel-managed driver structures within the same security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The late-running recovery worker reads freed drmm/GEM allocations (fw-\u003emem, ipc-\u003emem_tx/rx, a destroyed context_xa) and drives ivpu_dev_coredump()/ivpu_jsm_state_dump() over them, and a freed-then-reallocated work_struct yields a controllable dispatch \u2014 usable for arbitrary kernel memory disclosure.\nI:H - ivpu_ipc_reset() memsets and ivpu_fw_load() memcpys directly into buffer objects already released by ivpu_ipc_fini()/ivpu_fw_mem_fini(), writing into freed pages that can be reallocated to other kernel objects; the freed work-\u003efunc dereference additionally gives control-flow hijack potential.\nA:H - The use-after-free reliably produces a kernel oops or panic \u2014 NULL/freed ivpu_bo_vaddr() dereferences, iteration of a destroyed xarray, and MMIO access to a powered-down D3hot device \u2014 taking down the whole system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:57.549Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/54c49eca38dbd06913a696f6d7610937dcfad226"
        },
        {
          "url": "https://git.kernel.org/stable/c/565d2c15b6c36c3250e694f7b9a86229c1787be5"
        },
        {
          "url": "https://git.kernel.org/stable/c/69a79ada8eb034ce016b5b78fb7d08d8687223de"
        }
      ],
      "title": "accel/ivpu: Prevent recovery work from being queued during device removal",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39896",
    "datePublished": "2025-10-01T07:42:44.714Z",
    "dateReserved": "2025-04-16T07:20:57.146Z",
    "dateUpdated": "2026-08-05T12:05:57.549Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-39816",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:15:57.258196Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T18:22:55.725Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "io_uring/kbuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "695673eb5711ee5eb1769481cf1503714716a7d1",
              "status": "affected",
              "version": "ae98dbf43d755b4e111fcd086e53939bef3e9a1a",
              "versionType": "git"
            },
            {
              "lessThan": "91f262ea2a76a02d9e37dba6637cfe6feebb20a8",
              "status": "affected",
              "version": "ae98dbf43d755b4e111fcd086e53939bef3e9a1a",
              "versionType": "git"
            },
            {
              "lessThan": "390a61d284e1ced088d43928dfcf6f86fffdd780",
              "status": "affected",
              "version": "ae98dbf43d755b4e111fcd086e53939bef3e9a1a",
              "versionType": "git"
            },
            {
              "lessThan": "98b6fa62c84f2e129161e976a5b9b3cb4ccd117b",
              "status": "affected",
              "version": "ae98dbf43d755b4e111fcd086e53939bef3e9a1a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "io_uring/kbuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.49",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.81",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.5",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths\n\nSince the buffers are mapped from userspace, it is prudent to use\nREAD_ONCE() to read the value into a local variable, and use that for\nany other actions taken. Having a stable read of the buffer length\navoids worrying about it changing after checking, or being read multiple\ntimes.\n\nSimilarly, the buffer may well change in between it being picked and\nbeing committed. Ensure the looping for incremental ring buffer commit\nstops if it hits a zero sized buffer, as no further progress can be made\nat that point."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:36:54.462Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/695673eb5711ee5eb1769481cf1503714716a7d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/91f262ea2a76a02d9e37dba6637cfe6feebb20a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/390a61d284e1ced088d43928dfcf6f86fffdd780"
        },
        {
          "url": "https://git.kernel.org/stable/c/98b6fa62c84f2e129161e976a5b9b3cb4ccd117b"
        }
      ],
      "title": "io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39816",
    "datePublished": "2025-09-16T13:00:17.026Z",
    "dateReserved": "2025-04-16T07:20:57.138Z",
    "dateUpdated": "2026-05-11T21:36:54.462Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:38:54.170Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/comedi/drivers/das16m1.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "539bdff832adac9ea653859fa0b6bc62e743329c",
              "status": "affected",
              "version": "729988507680b2ce934bce61d9ce0ea7b235914c",
              "versionType": "git"
            },
            {
              "lessThan": "d1291c69f46d6572b2cf75960dd8975d7ab2176b",
              "status": "affected",
              "version": "729988507680b2ce934bce61d9ce0ea7b235914c",
              "versionType": "git"
            },
            {
              "lessThan": "b3c95fa508e5dc3da60520eea92a5241095ceef1",
              "status": "affected",
              "version": "729988507680b2ce934bce61d9ce0ea7b235914c",
              "versionType": "git"
            },
            {
              "lessThan": "65c03e6fc524eb2868abedffd8a4613d78abc288",
              "status": "affected",
              "version": "729988507680b2ce934bce61d9ce0ea7b235914c",
              "versionType": "git"
            },
            {
              "lessThan": "adb7df8a8f9d788423e161b779764527dd3ec2d0",
              "status": "affected",
              "version": "729988507680b2ce934bce61d9ce0ea7b235914c",
              "versionType": "git"
            },
            {
              "lessThan": "076b13ee60eb01ed0d140ef261f95534562a3077",
              "status": "affected",
              "version": "729988507680b2ce934bce61d9ce0ea7b235914c",
              "versionType": "git"
            },
            {
              "lessThan": "f211572818ed5bec2b3f5d4e0719ef8699b3c269",
              "status": "affected",
              "version": "729988507680b2ce934bce61d9ce0ea7b235914c",
              "versionType": "git"
            },
            {
              "lessThan": "ed93c6f68a3be06e4e0c331c6e751f462dee3932",
              "status": "affected",
              "version": "729988507680b2ce934bce61d9ce0ea7b235914c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/comedi/drivers/das16m1.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.14"
            },
            {
              "lessThan": "3.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.147",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.100",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.147",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.100",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.40",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.8",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: das16m1: Fix bit shift out of bounds\n\nWhen checking for a supported IRQ number, the following test is used:\n\n\t/* only irqs 2, 3, 4, 5, 6, 7, 10, 11, 12, 14, and 15 are valid */\n\tif ((1 \u003c\u003c it-\u003eoptions[1]) \u0026 0xdcfc) {\n\nHowever, `it-\u003eoptions[i]` is an unchecked `int` value from userspace, so\nthe shift amount could be negative or out of bounds.  Fix the test by\nrequiring `it-\u003eoptions[1]` to be within bounds before proceeding with\nthe original test."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:28:53.213Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/539bdff832adac9ea653859fa0b6bc62e743329c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1291c69f46d6572b2cf75960dd8975d7ab2176b"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3c95fa508e5dc3da60520eea92a5241095ceef1"
        },
        {
          "url": "https://git.kernel.org/stable/c/65c03e6fc524eb2868abedffd8a4613d78abc288"
        },
        {
          "url": "https://git.kernel.org/stable/c/adb7df8a8f9d788423e161b779764527dd3ec2d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/076b13ee60eb01ed0d140ef261f95534562a3077"
        },
        {
          "url": "https://git.kernel.org/stable/c/f211572818ed5bec2b3f5d4e0719ef8699b3c269"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed93c6f68a3be06e4e0c331c6e751f462dee3932"
        }
      ],
      "title": "comedi: das16m1: Fix bit shift out of bounds",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38483",
    "datePublished": "2025-07-28T11:21:47.895Z",
    "dateReserved": "2025-04-16T04:51:24.021Z",
    "dateUpdated": "2026-05-11T21:28:53.213Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:41:33.622Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:42:21.974Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/inline.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8085a7324d8ec448c4a764af7853e19bbd64e17a",
              "status": "affected",
              "version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
              "versionType": "git"
            },
            {
              "lessThan": "1199a6399895f4767f0b9a68a6ff47c3f799b7c7",
              "status": "affected",
              "version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
              "versionType": "git"
            },
            {
              "lessThan": "7f322c12df7aeed1755acd3c6fab48c7807795fb",
              "status": "affected",
              "version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
              "versionType": "git"
            },
            {
              "lessThan": "2817ac83cb4732597bf36853fe13ca616f4ee4e2",
              "status": "affected",
              "version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
              "versionType": "git"
            },
            {
              "lessThan": "d960f4b793912f35e9d72bd9d1e90553063fcbf1",
              "status": "affected",
              "version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
              "versionType": "git"
            },
            {
              "lessThan": "81e7e2e7ba07e7c8cdce43ccad2f91adbc5a919c",
              "status": "affected",
              "version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
              "versionType": "git"
            },
            {
              "lessThan": "279c87ef7b9da34f65c2e4db586e730b667a6fb9",
              "status": "affected",
              "version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
              "versionType": "git"
            },
            {
              "lessThan": "8a6f89d42e61788605722dd9faf98797c958a7e5",
              "status": "affected",
              "version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
              "versionType": "git"
            },
            {
              "lessThan": "099b847ccc6c1ad2f805d13cfbcc83f5b6d4bc42",
              "status": "affected",
              "version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/inline.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.8"
            },
            {
              "lessThan": "3.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.43",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: do not BUG when INLINE_DATA_FL lacks system.data xattr\n\nA syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data()\nwhen an inode had the INLINE_DATA_FL flag set but was missing the\nsystem.data extended attribute.\n\nSince this can happen due to a maiciouly fuzzed file system, we\nshouldn\u0027t BUG, but rather, report it as a corrupted file system.\n\nAdd similar replacements of BUG_ON with EXT4_ERROR_INODE() ii\next4_create_inline_data() and ext4_inline_data_truncate()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:33:18.961Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8085a7324d8ec448c4a764af7853e19bbd64e17a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1199a6399895f4767f0b9a68a6ff47c3f799b7c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f322c12df7aeed1755acd3c6fab48c7807795fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/2817ac83cb4732597bf36853fe13ca616f4ee4e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/d960f4b793912f35e9d72bd9d1e90553063fcbf1"
        },
        {
          "url": "https://git.kernel.org/stable/c/81e7e2e7ba07e7c8cdce43ccad2f91adbc5a919c"
        },
        {
          "url": "https://git.kernel.org/stable/c/279c87ef7b9da34f65c2e4db586e730b667a6fb9"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a6f89d42e61788605722dd9faf98797c958a7e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/099b847ccc6c1ad2f805d13cfbcc83f5b6d4bc42"
        }
      ],
      "title": "ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38701",
    "datePublished": "2025-09-04T15:32:53.071Z",
    "dateReserved": "2025-04-16T04:51:24.032Z",
    "dateUpdated": "2026-07-14T12:42:21.974Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_sched.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c886784000934d5486621106da0614c85bcd76a8",
              "status": "affected",
              "version": "09a93cc4f7d1893777f6b788bffe60d64e4d5df7",
              "versionType": "git"
            },
            {
              "lessThan": "4f4701489d0f768a232b10d281491184f34bacf0",
              "status": "affected",
              "version": "09a93cc4f7d1893777f6b788bffe60d64e4d5df7",
              "versionType": "git"
            },
            {
              "lessThan": "e1bc3a13bd775791cca0bb144d977b00f3598042",
              "status": "affected",
              "version": "09a93cc4f7d1893777f6b788bffe60d64e4d5df7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_sched.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`\n\nThe following kernel Oops was recently reported by Mesa CI:\n\n[  800.139824] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000588\n[  800.148619] Mem abort info:\n[  800.151402]   ESR = 0x0000000096000005\n[  800.155141]   EC = 0x25: DABT (current EL), IL = 32 bits\n[  800.160444]   SET = 0, FnV = 0\n[  800.163488]   EA = 0, S1PTW = 0\n[  800.166619]   FSC = 0x05: level 1 translation fault\n[  800.171487] Data abort info:\n[  800.174357]   ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000\n[  800.179832]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[  800.184873]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[  800.190176] user pgtable: 4k pages, 39-bit VAs, pgdp=00000001014c2000\n[  800.196607] [0000000000000588] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000\n[  800.205305] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP\n[  800.211564] Modules linked in: vc4 snd_soc_hdmi_codec drm_display_helper v3d cec gpu_sched drm_dma_helper drm_shmem_helper drm_kms_helper drm drm_panel_orientation_quirks snd_soc_core snd_compress snd_pcm_dmaengine snd_pcm i2c_brcmstb snd_timer snd backlight\n[  800.234448] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.25+rpt-rpi-v8 #1  Debian 1:6.12.25-1+rpt1\n[  800.244182] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT)\n[  800.250005] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[  800.256959] pc : v3d_job_update_stats+0x60/0x130 [v3d]\n[  800.262112] lr : v3d_job_update_stats+0x48/0x130 [v3d]\n[  800.267251] sp : ffffffc080003e60\n[  800.270555] x29: ffffffc080003e60 x28: ffffffd842784980 x27: 0224012000000000\n[  800.277687] x26: ffffffd84277f630 x25: ffffff81012fd800 x24: 0000000000000020\n[  800.284818] x23: ffffff8040238b08 x22: 0000000000000570 x21: 0000000000000158\n[  800.291948] x20: 0000000000000000 x19: ffffff8040238000 x18: 0000000000000000\n[  800.299078] x17: ffffffa8c1bd2000 x16: ffffffc080000000 x15: 0000000000000000\n[  800.306208] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n[  800.313338] x11: 0000000000000040 x10: 0000000000001a40 x9 : ffffffd83b39757c\n[  800.320468] x8 : ffffffd842786420 x7 : 7fffffffffffffff x6 : 0000000000ef32b0\n[  800.327598] x5 : 00ffffffffffffff x4 : 0000000000000015 x3 : ffffffd842784980\n[  800.334728] x2 : 0000000000000004 x1 : 0000000000010002 x0 : 000000ba4c0ca382\n[  800.341859] Call trace:\n[  800.344294]  v3d_job_update_stats+0x60/0x130 [v3d]\n[  800.349086]  v3d_irq+0x124/0x2e0 [v3d]\n[  800.352835]  __handle_irq_event_percpu+0x58/0x218\n[  800.357539]  handle_irq_event+0x54/0xb8\n[  800.361369]  handle_fasteoi_irq+0xac/0x240\n[  800.365458]  handle_irq_desc+0x48/0x68\n[  800.369200]  generic_handle_domain_irq+0x24/0x38\n[  800.373810]  gic_handle_irq+0x48/0xd8\n[  800.377464]  call_on_irq_stack+0x24/0x58\n[  800.381379]  do_interrupt_handler+0x88/0x98\n[  800.385554]  el1_interrupt+0x34/0x68\n[  800.389123]  el1h_64_irq_handler+0x18/0x28\n[  800.393211]  el1h_64_irq+0x64/0x68\n[  800.396603]  default_idle_call+0x3c/0x168\n[  800.400606]  do_idle+0x1fc/0x230\n[  800.403827]  cpu_startup_entry+0x40/0x50\n[  800.407742]  rest_init+0xe4/0xf0\n[  800.410962]  start_kernel+0x5e8/0x790\n[  800.414616]  __primary_switched+0x80/0x90\n[  800.418622] Code: 8b170277 8b160296 11000421 b9000861 (b9401ac1)\n[  800.424707] ---[ end trace 0000000000000000 ]---\n[  800.457313] ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]---\n\nThis issue happens when the file descriptor is closed before the jobs\nsubmitted by it are completed. When the job completes, we update the\nglobal GPU stats and the per-fd GPU stats, which are exposed through\nfdinfo. If the file descriptor was closed, then the struct `v3d_file_priv`\nand its stats were already freed and we can\u0027t update the per-fd stats.\n\nTherefore, if the file descriptor was already closed, don\u0027t u\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached by submitting GPU jobs via V3D_SUBMIT_CL/CSD/TFU/CPU ioctls on the local DRM render node /dev/dri/renderD*, then closing the fd. There is no remote or network-facing path to the v3d job scheduler.\nAC:L - The attacker controls both sides of the race \u2014 they choose the GPU job duration (a compute/render job can run for hundreds of ms up to the 500ms sched timeout) and choose when to close(2), and drm_sched_entity_destroy() provably returns without waiting on the hardware fence, so the free-before-IRQ ordering is deterministic. Heap grooming of the freed drm_file slab to control the read-back driver_priv value is likewise under attacker control.\nPR:L - All v3d submit ioctls are DRM_RENDER_ALLOW and render clients bypass the DRM_AUTH check in drm_ioctl(), so any unprivileged local user with render-node access can reach the path with no capabilities. This is the normal state for desktop/app users on Raspberry Pi 4/5 and Broadcom set-top SoCs, for Android-style GPU clients, and for containers/CI where renderD* is 0666 \u2014 the follow-up crash report shows UID 1000 running mpv.\nUI:N - The attacking process performs every step itself \u2014 submit a long GPU job, then close the file descriptor. No victim action or cooperation is required.\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - This is a use-after-free: the freed struct drm_file is read to obtain driver_priv, and the freed v3d_file_priv is read (start_ns, enabled_ns, jobs_completed) during the read-modify-write. Reclaiming those slabs with attacker-chosen objects yields an attacker-steered read primitive at a groomable kernel address, warranting High.\nI:H - v3d_stats_update() writes into freed memory \u2014 seqcount increments, a 64-bit accumulate, a counter increment, and an 8-byte zero store \u2014 at an address derived from a use-after-free read, i.e. writes at driver_priv+0x158/0x570 where driver_priv is heap-groomable. That is a use-after-free write primitive leverageable for control-flow hijack, so High.\nA:H - The reported trace is a fatal kernel Oops in hardirq context, which escalates unconditionally to \"Kernel panic - not syncing: Oops: Fatal exception in interrupt\". Even without exploitation, the wild pointer dereference reliably panics the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:00:14.943Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c886784000934d5486621106da0614c85bcd76a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f4701489d0f768a232b10d281491184f34bacf0"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1bc3a13bd775791cca0bb144d977b00f3598042"
        }
      ],
      "title": "drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38189",
    "datePublished": "2025-07-04T13:37:14.428Z",
    "dateReserved": "2025-04-16T04:51:23.992Z",
    "dateUpdated": "2026-08-05T12:00:14.943Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/gvt/debugfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "af90f8b36d78544433a48a3eda6a5faeafacd0a1",
              "status": "affected",
              "version": "bc7b0be316aebac42eb9e8e54c984609555944da",
              "versionType": "git"
            },
            {
              "lessThan": "f5a9bbf962e2c4b1d9addbfaf16d7ffcc2f63bde",
              "status": "affected",
              "version": "bc7b0be316aebac42eb9e8e54c984609555944da",
              "versionType": "git"
            },
            {
              "lessThan": "ffa83fba2a2ce8010eb106c779378cb3013362c7",
              "status": "affected",
              "version": "bc7b0be316aebac42eb9e8e54c984609555944da",
              "versionType": "git"
            },
            {
              "lessThan": "44c0e07e3972e3f2609d69ad873d4f342f8a68ec",
              "status": "affected",
              "version": "bc7b0be316aebac42eb9e8e54c984609555944da",
              "versionType": "git"
            },
            {
              "lessThan": "704f3384f322b40ba24d958473edfb1c9750c8fd",
              "status": "affected",
              "version": "bc7b0be316aebac42eb9e8e54c984609555944da",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/gvt/debugfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.163",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.87",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.19",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.5",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gvt: fix vgpu debugfs clean in remove\n\nCheck carefully on root debugfs available when destroying vgpu,\ne.g in remove case drm minor\u0027s debugfs root might already be destroyed,\nwhich led to kernel oops like below.\n\nConsole: switching to colour dummy device 80x25\ni915 0000:00:02.0: MDEV: Unregistering\nintel_vgpu_mdev b1338b2d-a709-4c23-b766-cc436c36cdf0: Removing from iommu group 14\nBUG: kernel NULL pointer dereference, address: 0000000000000150\nPGD 0 P4D 0\nOops: 0000 [#1] PREEMPT SMP\nCPU: 3 PID: 1046 Comm: driverctl Not tainted 6.1.0-rc2+ #6\nHardware name: HP HP ProDesk 600 G3 MT/829D, BIOS P02 Ver. 02.44 09/13/2022\nRIP: 0010:__lock_acquire+0x5e2/0x1f90\nCode: 87 ad 09 00 00 39 05 e1 1e cc 02 0f 82 f1 09 00 00 ba 01 00 00 00 48 83 c4 48 89 d0 5b 5d 41 5c 41 5d 41 5e 41 5f c3 45 31 ff \u003c48\u003e 81 3f 60 9e c2 b6 45 0f 45 f8 83 fe 01 0f 87 55 fa ff ff 89 f0\nRSP: 0018:ffff9f770274f948 EFLAGS: 00010046\nRAX: 0000000000000003 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000150\nRBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\nR10: ffff8895d1173300 R11: 0000000000000001 R12: 0000000000000000\nR13: 0000000000000150 R14: 0000000000000000 R15: 0000000000000000\nFS:  00007fc9b2ba0740(0000) GS:ffff889cdfcc0000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000150 CR3: 000000010fd93005 CR4: 00000000003706e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n lock_acquire+0xbf/0x2b0\n ? simple_recursive_removal+0xa5/0x2b0\n ? lock_release+0x13d/0x2d0\n down_write+0x2a/0xd0\n ? simple_recursive_removal+0xa5/0x2b0\n simple_recursive_removal+0xa5/0x2b0\n ? start_creating.part.0+0x110/0x110\n ? _raw_spin_unlock+0x29/0x40\n debugfs_remove+0x40/0x60\n intel_gvt_debugfs_remove_vgpu+0x15/0x30 [kvmgt]\n intel_gvt_destroy_vgpu+0x60/0x100 [kvmgt]\n intel_vgpu_release_dev+0xe/0x20 [kvmgt]\n device_release+0x30/0x80\n kobject_put+0x79/0x1b0\n device_release_driver_internal+0x1b8/0x230\n bus_remove_device+0xec/0x160\n device_del+0x189/0x400\n ? up_write+0x9c/0x1b0\n ? mdev_device_remove_common+0x60/0x60 [mdev]\n mdev_device_remove_common+0x22/0x60 [mdev]\n mdev_device_remove_cb+0x17/0x20 [mdev]\n device_for_each_child+0x56/0x80\n mdev_unregister_parent+0x5a/0x81 [mdev]\n intel_gvt_clean_device+0x2d/0xe0 [kvmgt]\n intel_gvt_driver_remove+0x2e/0xb0 [i915]\n i915_driver_remove+0xac/0x100 [i915]\n i915_pci_remove+0x1a/0x30 [i915]\n pci_device_remove+0x31/0xa0\n device_release_driver_internal+0x1b8/0x230\n unbind_store+0xd8/0x100\n kernfs_fop_write_iter+0x156/0x210\n vfs_write+0x236/0x4a0\n ksys_write+0x61/0xd0\n do_syscall_64+0x55/0x80\n ? find_held_lock+0x2b/0x80\n ? lock_release+0x13d/0x2d0\n ? up_read+0x17/0x20\n ? lock_is_held_type+0xe3/0x140\n ? asm_exc_page_fault+0x22/0x30\n ? lockdep_hardirqs_on+0x7d/0x100\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\nRIP: 0033:0x7fc9b2c9e0c4\nCode: 15 71 7d 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 80 3d 3d 05 0e 00 00 74 13 b8 01 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 48 89 54 24 18 48\nRSP: 002b:00007ffec29c81c8 EFLAGS: 00000202 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 000000000000000d RCX: 00007fc9b2c9e0c4\nRDX: 000000000000000d RSI: 0000559f8b5f48a0 RDI: 0000000000000001\nRBP: 0000559f8b5f48a0 R08: 0000559f8b5f3540 R09: 00007fc9b2d76d30\nR10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000d\nR13: 00007fc9b2d77780 R14: 000000000000000d R15: 00007fc9b2d72a00\n \u003c/TASK\u003e\nModules linked in: sunrpc intel_rapl_msr intel_rapl_common intel_pmc_core_pltdrv intel_pmc_core intel_tcc_cooling x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel ee1004 igbvf rapl vfat fat intel_cstate intel_uncore pktcdvd i2c_i801 pcspkr wmi_bmof i2c_smbus acpi_pad vfio_pci vfio_pci_core vfio_virqfd zram fuse dm\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:48:46.527Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/af90f8b36d78544433a48a3eda6a5faeafacd0a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5a9bbf962e2c4b1d9addbfaf16d7ffcc2f63bde"
        },
        {
          "url": "https://git.kernel.org/stable/c/ffa83fba2a2ce8010eb106c779378cb3013362c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/44c0e07e3972e3f2609d69ad873d4f342f8a68ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/704f3384f322b40ba24d958473edfb1c9750c8fd"
        }
      ],
      "title": "drm/i915/gvt: fix vgpu debugfs clean in remove",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53625",
    "datePublished": "2025-10-07T15:19:30.213Z",
    "dateReserved": "2025-10-07T15:16:59.655Z",
    "dateUpdated": "2026-05-11T19:48:46.527Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_mipi_dsi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c202cda08cd5693645d4990ad1eb2e8068a884ec",
              "status": "affected",
              "version": "068a00233969833f1ba925e7627797489efd6041",
              "versionType": "git"
            },
            {
              "lessThan": "262364574b05676d4b9ebde2ddd3588cd2efd8ce",
              "status": "affected",
              "version": "068a00233969833f1ba925e7627797489efd6041",
              "versionType": "git"
            },
            {
              "lessThan": "95ae458209f5a556bba98aff872f933694914eb7",
              "status": "affected",
              "version": "068a00233969833f1ba925e7627797489efd6041",
              "versionType": "git"
            },
            {
              "lessThan": "8242167cfc83dd7e4c96f44b45f108db9bb88146",
              "status": "affected",
              "version": "068a00233969833f1ba925e7627797489efd6041",
              "versionType": "git"
            },
            {
              "lessThan": "45120fa5e522d444e3fc1c5a9afc5d53eed91d00",
              "status": "affected",
              "version": "068a00233969833f1ba925e7627797489efd6041",
              "versionType": "git"
            },
            {
              "lessThan": "26c1b4cfe56f040f71a51c92da1f4cac2e3b9455",
              "status": "affected",
              "version": "068a00233969833f1ba925e7627797489efd6041",
              "versionType": "git"
            },
            {
              "lessThan": "353ab1c13fdd6e524edde780235a8ce9b892c81c",
              "status": "affected",
              "version": "068a00233969833f1ba925e7627797489efd6041",
              "versionType": "git"
            },
            {
              "lessThan": "6fc2cd40db1969ba372ce9536dcfcdb87271eac4",
              "status": "affected",
              "version": "068a00233969833f1ba925e7627797489efd6041",
              "versionType": "git"
            },
            {
              "lessThan": "668a8f17b5290d04ef7343636a5588a0692731a1",
              "status": "affected",
              "version": "068a00233969833f1ba925e7627797489efd6041",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_mipi_dsi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.14"
            },
            {
              "lessThan": "3.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.331",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.296",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.262",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.220",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.150",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.331",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.296",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.262",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.220",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.150",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.75",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.17",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.3",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mipi-dsi: Detach devices when removing the host\n\nWhenever the MIPI-DSI host is unregistered, the code of\nmipi_dsi_host_unregister() loops over every device currently found on that\nbus and will unregister it.\n\nHowever, it doesn\u0027t detach it from the bus first, which leads to all kind\nof resource leaks if the host wants to perform some clean up whenever a\ndevice is detached."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:20:27.824Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c202cda08cd5693645d4990ad1eb2e8068a884ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/262364574b05676d4b9ebde2ddd3588cd2efd8ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/95ae458209f5a556bba98aff872f933694914eb7"
        },
        {
          "url": "https://git.kernel.org/stable/c/8242167cfc83dd7e4c96f44b45f108db9bb88146"
        },
        {
          "url": "https://git.kernel.org/stable/c/45120fa5e522d444e3fc1c5a9afc5d53eed91d00"
        },
        {
          "url": "https://git.kernel.org/stable/c/26c1b4cfe56f040f71a51c92da1f4cac2e3b9455"
        },
        {
          "url": "https://git.kernel.org/stable/c/353ab1c13fdd6e524edde780235a8ce9b892c81c"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fc2cd40db1969ba372ce9536dcfcdb87271eac4"
        },
        {
          "url": "https://git.kernel.org/stable/c/668a8f17b5290d04ef7343636a5588a0692731a1"
        }
      ],
      "title": "drm/mipi-dsi: Detach devices when removing the host",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50489",
    "datePublished": "2025-10-04T15:43:43.124Z",
    "dateReserved": "2025-10-04T15:13:33.469Z",
    "dateUpdated": "2026-05-11T19:20:27.824Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-39851",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T19:21:10.346641Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T19:23:12.460Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/vxlan/vxlan_core.c",
            "drivers/net/vxlan/vxlan_private.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4ff4f3104da6507e0f118c63c4560dfdeb59dce3",
              "status": "affected",
              "version": "1274e1cc42264d4e629841e4f182795cb0becfd2",
              "versionType": "git"
            },
            {
              "lessThan": "0e8630f24c14d9c655d19eabe2e52a9e9f713307",
              "status": "affected",
              "version": "1274e1cc42264d4e629841e4f182795cb0becfd2",
              "versionType": "git"
            },
            {
              "lessThan": "6ead38147ebb813f08be6ea8ef547a0e4c09559a",
              "status": "affected",
              "version": "1274e1cc42264d4e629841e4f182795cb0becfd2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/vxlan/vxlan_core.c",
            "drivers/net/vxlan/vxlan_private.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.46",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.6",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: Fix NPD when refreshing an FDB entry with a nexthop object\n\nVXLAN FDB entries can point to either a remote destination or an FDB\nnexthop group. The latter is usually used in EVPN deployments where\nlearning is disabled.\n\nHowever, when learning is enabled, an incoming packet might try to\nrefresh an FDB entry that points to an FDB nexthop group and therefore\ndoes not have a remote. Such packets should be dropped, but they are\nonly dropped after dereferencing the non-existent remote, resulting in a\nNPD [1] which can be reproduced using [2].\n\nFix by dropping such packets earlier. Remove the misleading comment from\nfirst_remote_rcu().\n\n[1]\nBUG: kernel NULL pointer dereference, address: 0000000000000000\n[...]\nCPU: 13 UID: 0 PID: 361 Comm: mausezahn Not tainted 6.17.0-rc1-virtme-g9f6b606b6b37 #1 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014\nRIP: 0010:vxlan_snoop+0x98/0x1e0\n[...]\nCall Trace:\n \u003cTASK\u003e\n vxlan_encap_bypass+0x209/0x240\n encap_bypass_if_local+0xb1/0x100\n vxlan_xmit_one+0x1375/0x17e0\n vxlan_xmit+0x6b4/0x15f0\n dev_hard_start_xmit+0x5d/0x1c0\n __dev_queue_xmit+0x246/0xfd0\n packet_sendmsg+0x113a/0x1850\n __sock_sendmsg+0x38/0x70\n __sys_sendto+0x126/0x180\n __x64_sys_sendto+0x24/0x30\n do_syscall_64+0xa4/0x260\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n[2]\n #!/bin/bash\n\n ip address add 192.0.2.1/32 dev lo\n ip address add 192.0.2.2/32 dev lo\n\n ip nexthop add id 1 via 192.0.2.3 fdb\n ip nexthop add id 10 group 1 fdb\n\n ip link add name vx0 up type vxlan id 10010 local 192.0.2.1 dstport 12345 localbypass\n ip link add name vx1 up type vxlan id 10020 local 192.0.2.2 dstport 54321 learning\n\n bridge fdb add 00:11:22:33:44:55 dev vx0 self static dst 192.0.2.2 port 54321 vni 10020\n bridge fdb add 00:aa:bb:cc:dd:ee dev vx1 self static nhid 10\n\n mausezahn vx0 -a 00:aa:bb:cc:dd:ee -b 00:11:22:33:44:55 -c 1 -q"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - `vxlan_rcv` is the UDP tunnel `encap_rcv` handler, so a single crafted VXLAN datagram sent to the VTEP\u0027s UDP port from anywhere routable reaches `vxlan_set_mac` \u2192 `vxlan_snoop` with a fully attacker-chosen inner source MAC. VXLAN underlays are L3-routed, so the attacker is not confined to the local segment.\nAC:L - One unsolicited packet whose inner source MAC matches an nh-backed FDB entry triggers the NULL dereference deterministically \u2014 no race, no memory-layout grooming, no timing window. Learning is the kernel default for new VXLAN devices and nexthop-backed FDB entries are standard EVPN programming, so the required state is ordinary deployment configuration rather than a condition outside the attacker\u0027s control.\nPR:N - VXLAN carries no authentication and `vxlan_rcv` performs no source-address or peer validation before handing the inner frame to `vxlan_snoop`. An entirely unauthenticated off-box attacker needs no credentials or account on the target.\nUI:N - The crash happens during packet receive processing with no involvement from any local user or administrator. No victim action of any kind is required.\nS:U - The fault occurs in the kernel and its impact is confined to that same kernel\u0027s security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:N - The dereference is a read of `remote_ip` at offset 0 (and `remote_ifindex` nearby) from a NULL pointer, well inside the unmapped guard page, so no data is read or returned to the attacker. Nothing is disclosed before the fault aborts execution.\nI:N - Execution faults at the read in `vxlan_addr_equal()`, before the `rdst-\u003eremote_ip = *src_ip` assignment, so no write or state modification ever occurs. This is a pure NULL-pointer read with no corruption or control-flow primitive.\nA:H - The NULL dereference oopses in softirq/NAPI context, which takes the `in_interrupt()` path in `die()` and panics the machine (\"Fatal exception in interrupt\") rather than merely killing a task. A remote attacker can repeat the single triggering packet at will for a persistent whole-system denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:38.080Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4ff4f3104da6507e0f118c63c4560dfdeb59dce3"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e8630f24c14d9c655d19eabe2e52a9e9f713307"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ead38147ebb813f08be6ea8ef547a0e4c09559a"
        }
      ],
      "title": "vxlan: Fix NPD when refreshing an FDB entry with a nexthop object",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39851",
    "datePublished": "2025-09-19T15:26:23.576Z",
    "dateReserved": "2025-04-16T07:20:57.142Z",
    "dateUpdated": "2026-08-05T12:05:38.080Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}