CVSS: 7.1EPSS: 0%CPEs: 9EXPL: 0CVE-2025-39794 – ARM: tegra: Use I/O memcpy to write to IRAM
https://notcve.org/view.php?id=CVE-2025-39794
12 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: ARM: tegra: Use I/O memcpy to write to IRAM Kasan crashes the kernel trying to check boundaries when using the normal memcpy. In the Linux kernel, the following vulnerability has been resolved: ARM: tegra: Use I/O memcpy to write to IRAM Kasan crashes the kernel trying to check boundaries when using the normal memcpy. Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service ... • https://git.kernel.org/stable/c/b28c1a14accc79ead1e87bbdae53309da60be1e7 •
CVSS: 7.1EPSS: 0%CPEs: 4EXPL: 0CVE-2025-39792 – dm: Always split write BIOs to zoned device limits
https://notcve.org/view.php?id=CVE-2025-39792
12 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: dm: Always split write BIOs to zoned device limits Any zoned DM target that requires zone append emulation will use the block layer zone write plugging. In such case, DM target drivers must not split BIOs using dm_accept_partial_bio() as doing so can potentially lead to deadlocks with queue freeze operations. Regular write operations used to emulate zone append operations also cannot be split by the target driver as that would result in an ... • https://git.kernel.org/stable/c/f211268ed1f9bdf48f06a3ead5f5d88437450579 •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2025-39791 – dm: dm-crypt: Do not partially accept write BIOs with zoned targets
https://notcve.org/view.php?id=CVE-2025-39791
11 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: dm: dm-crypt: Do not partially accept write BIOs with zoned targets Read and write operations issued to a dm-crypt target may be split according to the dm-crypt internal limits defined by the max_read_size and max_write_size module parameters (default is 128 KB). The intent is to improve processing time of large BIOs by splitting them into smaller operations that can be parallelized on different CPUs. For zoned dm-crypt targets, this BIO sp... • https://git.kernel.org/stable/c/f211268ed1f9bdf48f06a3ead5f5d88437450579 •
CVSS: 7.1EPSS: 0%CPEs: 6EXPL: 0CVE-2025-39790 – bus: mhi: host: Detect events pointing to unexpected TREs
https://notcve.org/view.php?id=CVE-2025-39790
11 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Detect events pointing to unexpected TREs When a remote device sends a completion event to the host, it contains a pointer to the consumed TRE. The host uses this pointer to process all of the TREs between it and the host's local copy of the ring's read pointer. This works when processing completion for chained transactions, but can lead to nasty results if the device sends an event for a single-element transaction with a re... • https://git.kernel.org/stable/c/1d3173a3bae7039b765a0956e3e4bf846dbaacb8 •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2025-39789 – crypto: x86/aegis - Add missing error checks
https://notcve.org/view.php?id=CVE-2025-39789
11 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: crypto: x86/aegis - Add missing error checks The skcipher_walk functions can allocate memory and can fail, so checking for errors is necessary. In the Linux kernel, the following vulnerability has been resolved: crypto: x86/aegis - Add missing error checks The skcipher_walk functions can allocate memory and can fail, so checking for errors is necessary. • https://git.kernel.org/stable/c/1d373d4e8e15b358f08de52956b32e0e38a11f84 •
CVSS: 7.1EPSS: 0%CPEs: 7EXPL: 0CVE-2025-39788 – scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE
https://notcve.org/view.php?id=CVE-2025-39788
11 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE On Google gs101, the number of UTP transfer request slots (nutrs) is 32, and in this case the driver ends up programming the UTRL_NEXUS_TYPE incorrectly as 0. This is because the left hand side of the shift is 1, which is of type int, i.e. 31 bits wide. Shifting by more than that width results in undefined behaviour. Fix this by switching to the BIT() macro, which applies correct typ... • https://git.kernel.org/stable/c/55f4b1f73631a0817717fe6e98517de51b4c3527 •
CVSS: 7.1EPSS: 0%CPEs: 8EXPL: 0CVE-2025-39787 – soc: qcom: mdt_loader: Ensure we don't read past the ELF header
https://notcve.org/view.php?id=CVE-2025-39787
11 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: soc: qcom: mdt_loader: Ensure we don't read past the ELF header When the MDT loader is used in remoteproc, the ELF header is sanitized beforehand, but that's not necessary the case for other clients. Validate the size of the firmware buffer to ensure that we don't read past the end as we iterate over the header. e_phentsize and e_shentsize are validated as well, to ensure that the assumptions about step size in the traversal are valid. In t... • https://git.kernel.org/stable/c/2aad40d911eeb7dcac91c669f2762a28134f0eb1 •
CVSS: 7.1EPSS: 0%CPEs: 8EXPL: 0CVE-2025-39783 – PCI: endpoint: Fix configfs group list head handling
https://notcve.org/view.php?id=CVE-2025-39783
11 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix configfs group list head handling Doing a list_del() on the epf_group field of struct pci_epf_driver in pci_epf_remove_cfs() is not correct as this field is a list head, not a list entry. This list_del() call triggers a KASAN warning when an endpoint function driver which has a configfs attribute group is torn down: ================================================================== BUG: KASAN: slab-use-after-free in pci_e... • https://git.kernel.org/stable/c/ef1433f717a2c63747a519d86965d73ff9bd08b3 •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2025-39782 – jbd2: prevent softlockup in jbd2_log_do_checkpoint()
https://notcve.org/view.php?id=CVE-2025-39782
11 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: jbd2: prevent softlockup in jbd2_log_do_checkpoint() Both jbd2_log_do_checkpoint() and jbd2_journal_shrink_checkpoint_list() periodically release j_list_lock after processing a batch of buffers to avoid long hold times on the j_list_lock. However, since both functions contend for j_list_lock, the combined time spent waiting and processing can be significant. jbd2_journal_shrink_checkpoint_list() explicitly calls cond_resched() when need_res... • https://git.kernel.org/stable/c/f683d611518d30334813eecf9a8c687453e2800e •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2025-39781 – parisc: Drop WARN_ON_ONCE() from flush_cache_vmap
https://notcve.org/view.php?id=CVE-2025-39781
11 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: parisc: Drop WARN_ON_ONCE() from flush_cache_vmap I have observed warning to occassionally trigger. Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. For the stable distribution (trixie), these problems have been fixed in version 6.12.48-1. • https://git.kernel.org/stable/c/69cf90e5aa50fe3cb0c1a63cabc4761db44b0035 •