CVSS: 6.6EPSS: 0%CPEs: 5EXPL: 0CVE-2025-21907 – mm: memory-failure: update ttu flag inside unmap_poisoned_folio
https://notcve.org/view.php?id=CVE-2025-21907
01 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: mm: memory-failure: update ttu flag inside unmap_poisoned_folio Patch series "mm: memory_failure: unmap poisoned folio during migrate properly", v3. Fix two bugs during folio migration if the folio is poisoned. This patch (of 3): Commit 6da6b1d4a7df ("mm/hwpoison: convert TTU_IGNORE_HWPOISON to TTU_HWPOISON") introduce TTU_HWPOISON to replace TTU_IGNORE_HWPOISON in order to stop send SIGBUS signal when accessing an error page after a memory... • https://git.kernel.org/stable/c/6da6b1d4a7df8c35770186b53ef65d388398e139 •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2025-21906 – wifi: iwlwifi: mvm: clean up ROC on failure
https://notcve.org/view.php?id=CVE-2025-21906
01 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: clean up ROC on failure If the firmware fails to start the session protection, then we do call iwl_mvm_roc_finished() here, but that won't do anything at all because IWL_MVM_STATUS_ROC_P2P_RUNNING was never set. Set IWL_MVM_STATUS_ROC_P2P_RUNNING in the failure/stop path. If it started successfully before, it's already set, so that doesn't matter, and if it didn't start it needs to be set to clean up. Not doing so will l... • https://git.kernel.org/stable/c/35c1bbd93c4e6969b3ac238b48a8bdff3e223ed8 •
CVSS: 7.1EPSS: 0%CPEs: 8EXPL: 0CVE-2025-21905 – wifi: iwlwifi: limit printed string from FW file
https://notcve.org/view.php?id=CVE-2025-21905
01 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: limit printed string from FW file There's no guarantee here that the file is always with a NUL-termination, so reading the string may read beyond the end of the TLV. If that's the last TLV in the file, it can perhaps even read beyond the end of the file buffer. Fix that by limiting the print format to the size of the buffer we have. In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: limit print... • https://git.kernel.org/stable/c/aee1b6385e29e472ae5592b9652b750a29bf702e •
CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 0CVE-2025-21904 – caif_virtio: fix wrong pointer check in cfv_probe()
https://notcve.org/view.php?id=CVE-2025-21904
01 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: caif_virtio: fix wrong pointer check in cfv_probe() del_vqs() frees virtqueues, therefore cfv->vq_tx pointer should be checked for NULL before calling it, not cfv->vdev. Also the current implementation is redundant because the pointer cfv->vdev is dereferenced before it is checked for NULL. Fix this by checking cfv->vq_tx for NULL instead of cfv->vdev before calling del_vqs(). In the Linux kernel, the following vulnerability has been resolv... • https://git.kernel.org/stable/c/0d2e1a2926b1839a4b74519e660739b2566c9386 •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-21903 – mctp i3c: handle NULL header address
https://notcve.org/view.php?id=CVE-2025-21903
01 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: mctp i3c: handle NULL header address daddr can be NULL if there is no neighbour table entry present, in that case the tx packet should be dropped. saddr will usually be set by MCTP core, but check for NULL in case a packet is transmitted by a different protocol. In the Linux kernel, the following vulnerability has been resolved: mctp i3c: handle NULL header address daddr can be NULL if there is no neighbour table entry present, in that case... • https://git.kernel.org/stable/c/c8755b29b58ec65be17bcb8c40763d2dcb1f1db5 •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-21902 – acpi: typec: ucsi: Introduce a ->poll_cci method
https://notcve.org/view.php?id=CVE-2025-21902
01 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: acpi: typec: ucsi: Introduce a ->poll_cci method For the ACPI backend of UCSI the UCSI "registers" are just a memory copy of the register values in an opregion. The ACPI implementation in the BIOS ensures that the opregion contents are synced to the embedded controller and it ensures that the registers (in particular CCI) are synced back to the opregion on notifications. While there is an ACPI call that syncs the actual registers to the opr... • https://git.kernel.org/stable/c/c0ca6fd5f6ebde8fc0df8bb5c32629d1284f60d0 •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-21901 – RDMA/bnxt_re: Add sanity checks on rdev validity
https://notcve.org/view.php?id=CVE-2025-21901
01 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Add sanity checks on rdev validity There is a possibility that ulp_irq_stop and ulp_irq_start callbacks will be called when the device is in detached state. This can cause a crash due to NULL pointer dereference as the rdev is already freed. In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Add sanity checks on rdev validity There is a possibility that ulp_irq_stop and ulp_irq_start callbacks wi... • https://git.kernel.org/stable/c/cc5b9b48d44756a87170f3901c6c2fd99e6b89b2 •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2025-21900 – NFSv4: Fix a deadlock when recovering state on a sillyrenamed file
https://notcve.org/view.php?id=CVE-2025-21900
01 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix a deadlock when recovering state on a sillyrenamed file If the file is sillyrenamed, and slated for delete on close, it is possible for a server reboot to triggeer an open reclaim, with can again race with the application call to close(). When that happens, the call to put_nfs_open_context() can trigger a synchronous delegreturn call which deadlocks because it is not marked as privileged. Instead, ensure that the call to nfs4_ino... • https://git.kernel.org/stable/c/adb4b42d19aea91826621a8d0bac94cf2c08f8bc •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2025-21899 – tracing: Fix bad hist from corrupting named_triggers list
https://notcve.org/view.php?id=CVE-2025-21899
01 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: tracing: Fix bad hist from corrupting named_triggers list The following commands causes a crash: ~# cd /sys/kernel/tracing/events/rcu/rcu_callback ~# echo 'hist:name=bad:keys=common_pid:onmax(bogus).save(common_pid)' > trigger bash: echo: write error: Invalid argument ~# echo 'hist:name=bad:keys=common_pid' > trigger Because the following occurs: event_trigger_write() { trigger_process_regex() { event_hist_trigger_parse() { data = event_tri... • https://git.kernel.org/stable/c/067fe038e70f6e64960d26a79c4df5f1413d0f13 •
CVSS: 9.8EPSS: 0%CPEs: 13EXPL: 0CVE-2025-21898 – ftrace: Avoid potential division by zero in function_stat_show()
https://notcve.org/view.php?id=CVE-2025-21898
01 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: ftrace: Avoid potential division by zero in function_stat_show() Check whether denominator expression x * (x - 1) * 1000 mod {2^32, 2^64} produce zero and skip stddev computation in that case. For now don't care about rec->counter * rec->counter overflow because rec->time * rec->time overflow will likely happen earlier. In the Linux kernel, the following vulnerability has been resolved: ftrace: Avoid potential division by zero in function_s... • https://git.kernel.org/stable/c/f0629ee3922f10112584b1898491fecc74d98b3b •