CVSS: 7.1EPSS: 0%CPEs: 8EXPL: 0CVE-2025-21708 – net: usb: rtl8150: enable basic endpoint checking
https://notcve.org/view.php?id=CVE-2025-21708
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: enable basic endpoint checking Syzkaller reports [1] encountering a common issue of utilizing a wrong usb endpoint type during URB submitting stage. This, in turn, triggers a warning shown below. For now, enable simple endpoint checking (specifically, bulk and interrupt eps, testing control one is not essential) to mitigate the issue with a view to do other related cosmetic changes later, if they are necessary. [1] Syzkal... • https://git.kernel.org/stable/c/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 •
CVSS: 7.1EPSS: 0%CPEs: 8EXPL: 0CVE-2024-57986 – HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections
https://notcve.org/view.php?id=CVE-2024-57986
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections A report in 2019 by the syzbot fuzzer was found to be connected to two errors in the HID core associated with Resolution Multipliers. One of the errors was fixed by commit ea427a222d8b ("HID: core: Fix deadloop in hid_apply_multiplier."), but the other has not been fixed. This error arises because hid_apply_multipler() assumes that every Resolution Multipli... • https://git.kernel.org/stable/c/5a4abb36f312cf83206b1b7d1308ba47cba0b3cc •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2024-57981 – usb: xhci: Fix NULL pointer dereference on certain command aborts
https://notcve.org/view.php?id=CVE-2024-57981
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix NULL pointer dereference on certain command aborts If a command is queued to the final usable TRB of a ring segment, the enqueue pointer is advanced to the subsequent link TRB and no further. If the command is later aborted, when the abort completion is handled the dequeue pointer is advanced to the first TRB of the next segment. If no further commands are queued, xhci_handle_stopped_cmd_ring() sees the ring pointers unequal ... • https://git.kernel.org/stable/c/c311e391a7efd101250c0e123286709b7e736249 •
CVSS: 7.8EPSS: 0%CPEs: 11EXPL: 0CVE-2024-57979 – pps: Fix a use-after-free
https://notcve.org/view.php?id=CVE-2024-57979
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: pps: Fix a use-after-free On a board running ntpd and gpsd, I'm seeing a consistent use-after-free in sys_exit() from gpsd when rebooting: pps pps1: removed ------------[ cut here ]------------ kobject: '(null)' (00000000db4bec24): is not initialized, yet kobject_put() is being called. WARNING: CPU: 2 PID: 440 at lib/kobject.c:734 kobject_put+0x120/0x150 CPU: 2 UID: 299 PID: 440 Comm: gpsd Not tainted 6.11.0-rc6-00308-gb31c44928842 #1 Hardw... • https://git.kernel.org/stable/c/d953e0e837e65ecc1ddaa4f9560f7925878a0de6 • CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2024-57978 – media: imx-jpeg: Fix potential error pointer dereference in detach_pm()
https://notcve.org/view.php?id=CVE-2024-57978
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Fix potential error pointer dereference in detach_pm() The proble is on the first line: if (jpeg->pd_dev[i] && !pm_runtime_suspended(jpeg->pd_dev[i])) If jpeg->pd_dev[i] is an error pointer, then passing it to pm_runtime_suspended() will lead to an Oops. The other conditions check for both error pointers and NULL, but it would be more clear to use the IS_ERR_OR_NULL() check for that. In the Linux kernel, the following vulne... • https://git.kernel.org/stable/c/f3c4e088ec01cae45931a18ddf7cae0f4d72e1c5 •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2021-4453 – drm/amd/pm: fix a potential gpu_metrics_table memory leak
https://notcve.org/view.php?id=CVE-2021-4453
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix a potential gpu_metrics_table memory leak Memory is allocated for gpu_metrics_table in renoir_init_smc_tables(), but not freed in int smu_v12_0_fini_smc_tables(). Free it! • https://git.kernel.org/stable/c/95868b85764aff2dcbf78d3054076df75446ad15 •
CVSS: 7.1EPSS: 0%CPEs: 7EXPL: 0CVE-2022-49444 – module: fix [e_shstrndx].sh_size=0 OOB access
https://notcve.org/view.php?id=CVE-2022-49444
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: module: fix [e_shstrndx].sh_size=0 OOB access It is trivial to craft a module to trigger OOB access in this line: if (info->secstrings[strhdr->sh_size - 1] != '\0') { BUG: unable to handle page fault for address: ffffc90000aa0fff PGD 100000067 P4D 100000067 PUD 100066067 PMD 10436f067 PTE 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 7 PID: 1215 Comm: insmod Not tainted 5.18.0-rc5-00007-g9bf578647087-dirty #10 Hardware name: QEMU Standard PC (i440... • https://git.kernel.org/stable/c/ec2a29593c83ed71a7f16e3243941ebfcf75fdf6 •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-49376 – scsi: sd: Fix potential NULL pointer dereference
https://notcve.org/view.php?id=CVE-2022-49376
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix potential NULL pointer dereference If sd_probe() sees an early error before sdkp->device is initialized, sd_zbc_release_disk() is called. This causes a NULL pointer dereference when sd_is_zoned() is called inside that function. Avoid this by removing the call to sd_zbc_release_disk() in sd_probe() error path. This change is safe and does not result in zone information memory leakage because the zone information for a zoned dis... • https://git.kernel.org/stable/c/89d9475610771b5e5fe1879075f0fc9ba6e3755f • CWE-476: NULL Pointer Dereference •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2021-47660 – fs/ntfs3: Fix some memory leaks in an error handling path of 'log_replay()'
https://notcve.org/view.php?id=CVE-2021-47660
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix some memory leaks in an error handling path of 'log_replay()' All error handling paths lead to 'out' where many resources are freed. Do it as well here instead of a direct return, otherwise 'log', 'ra' and 'log->one_page_buf' (at least) will leak. • https://git.kernel.org/stable/c/b46acd6a6a627d876898e1c84d3f84902264b445 •
CVSS: -EPSS: 0%CPEs: 7EXPL: 0CVE-2021-47659 – drm/plane: Move range check for format_count earlier
https://notcve.org/view.php?id=CVE-2021-47659
26 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/plane: Move range check for format_count earlier While the check for format_count > 64 in __drm_universal_plane_init() shouldn't be hit (it's a WARN_ON), in its current position it will then leak the plane->format_types array and fail to call drm_mode_object_unregister() leaking the modeset identifier. Move it to the start of the function to avoid allocating those resources in the first place. • https://git.kernel.org/stable/c/e6fc3b68558e4c6d8d160b5daf2511b99afa8814 •