CVSS: 7.1EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38535 – phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode
https://notcve.org/view.php?id=CVE-2025-38535
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode When transitioning from USB_ROLE_DEVICE to USB_ROLE_NONE, the code assumed that the regulator should be disabled. However, if the regulator is marked as always-on, regulator_is_enabled() continues to return true, leading to an incorrect attempt to disable a regulator which is not enabled. This can result in warnings such as: [ 250.155624] WARNING: CPU: 1 PID: 7326 at driver... • https://git.kernel.org/stable/c/49d46e3c7e597e8b00c6fc16e6fd7a92044f4371 •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2025-38534 – netfs: Fix copy-to-cache so that it performs collection with ceph+fscache
https://notcve.org/view.php?id=CVE-2025-38534
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: netfs: Fix copy-to-cache so that it performs collection with ceph+fscache The netfs copy-to-cache that is used by Ceph with local caching sets up a new request to write data just read to the cache. The request is started and then left to look after itself whilst the app continues. The request gets notified by the backing fs upon completion of the async DIO write, but then tries to wake up the app because NETFS_RREQ_OFFLOAD_COLLECTION isn't ... • https://git.kernel.org/stable/c/e2d46f2ec332533816417b60933954173f602121 •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2025-38533 – net: libwx: fix the using of Rx buffer DMA
https://notcve.org/view.php?id=CVE-2025-38533
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix the using of Rx buffer DMA The wx_rx_buffer structure contained two DMA address fields: 'dma' and 'page_dma'. However, only 'page_dma' was actually initialized and used to program the Rx descriptor. But 'dma' was uninitialized and used in some paths. This could lead to undefined behavior, including DMA errors or use-after-free, if the uninitialized 'dma' was used. Althrough such error has not yet occurred, it is worth fixing... • https://git.kernel.org/stable/c/3c47e8ae113a68da47987750d9896e325d0aeedd •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2025-38532 – net: libwx: properly reset Rx ring descriptor
https://notcve.org/view.php?id=CVE-2025-38532
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: net: libwx: properly reset Rx ring descriptor When device reset is triggered by feature changes such as toggling Rx VLAN offload, wx->do_reset() is called to reinitialize Rx rings. The hardware descriptor ring may retain stale values from previous sessions. And only set the length to 0 in rx_desc[0] would result in building malformed SKBs. Fix it to ensure a clean slate after device reset. [ 549.186435] [ C16] ------------[ cut here ]------... • https://git.kernel.org/stable/c/3c47e8ae113a68da47987750d9896e325d0aeedd •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-38531 – iio: common: st_sensors: Fix use of uninitialize device structs
https://notcve.org/view.php?id=CVE-2025-38531
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: iio: common: st_sensors: Fix use of uninitialize device structs Throughout the various probe functions &indio_dev->dev is used before it is initialized. This caused a kernel panic in st_sensors_power_enable() when the call to devm_regulator_bulk_get_enable() fails and then calls dev_err_probe() with the uninitialized device. This seems to only cause a panic with dev_err_probe(), dev_err(), dev_warn() and dev_info() don't seem to cause a pan... • https://git.kernel.org/stable/c/610615c9668037e3eca11132063b93b2d945af13 •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38530 – comedi: pcl812: Fix bit shift out of bounds
https://notcve.org/view.php?id=CVE-2025-38530
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: comedi: pcl812: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: if ((1 << it->options[1]) & board->irq_bits) { However, `it->options[i]` is an unchecked `int` value from userspace, so the shift amount could be negative or out of bounds. Fix the test by requiring `it->options[1]` to be within bounds before proceeding with the original test. Valid `it->options[1]` values that select the IRQ wi... • https://git.kernel.org/stable/c/fcdb427bc7cf5e9e5d7280cf09c08dec49b49432 •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38529 – comedi: aio_iiro_16: Fix bit shift out of bounds
https://notcve.org/view.php?id=CVE-2025-38529
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: comedi: aio_iiro_16: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: if ((1 << it->options[1]) & 0xdcfc) { However, `it->options[i]` is an unchecked `int` value from userspace, so the shift amount could be negative or out of bounds. Fix the test by requiring `it->options[1]` to be within bounds before proceeding with the original test. Valid `it->options[1]` values that select the IRQ will b... • https://git.kernel.org/stable/c/ad7a370c8be47247f68f7187cc82f4f25a347116 •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38528 – bpf: Reject %p% format string in bprintf-like helpers
https://notcve.org/view.php?id=CVE-2025-38528
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: bpf: Reject %p% format string in bprintf-like helpers static const char fmt[] = "%p%"; bpf_trace_printk(fmt, sizeof(fmt)); The above BPF program isn't rejected and causes a kernel warning at runtime: Please remove unsupported %\x00 in format string WARNING: CPU: 1 PID: 7244 at lib/vsprintf.c:2680 format_decode+0x49c/0x5d0 This happens because bpf_bprintf_prepare skips over the second %, detected as punctuation, while processing %p. This pat... • https://git.kernel.org/stable/c/48cac3f4a96ddf08df8e53809ed066de0dc93915 •
CVSS: 7.0EPSS: 0%CPEs: 10EXPL: 0CVE-2025-38527 – smb: client: fix use-after-free in cifs_oplock_break
https://notcve.org/view.php?id=CVE-2025-38527
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifs_oplock_break A race condition can occur in cifs_oplock_break() leading to a use-after-free of the cinode structure when unmounting: cifs_oplock_break() _cifsFileInfo_put(cfile) cifsFileInfo_put_final() cifs_sb_deactive() [last ref, start releasing sb] kill_sb() kill_anon_super() generic_shutdown_super() evict_inodes() dispose_list() evict() destroy_inode() call_rcu(&inode->i_rcu, i_callback) spin_lock... • https://git.kernel.org/stable/c/b98749cac4a695f084a5ff076f4510b23e353ecd •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2025-38526 – ice: add NULL check in eswitch lag check
https://notcve.org/view.php?id=CVE-2025-38526
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: ice: add NULL check in eswitch lag check The function ice_lag_is_switchdev_running() is being called from outside of the LAG event handler code. This results in the lag->upper_netdev being NULL sometimes. To avoid a NULL-pointer dereference, there needs to be a check before it is dereferenced. In the Linux kernel, the following vulnerability has been resolved: ice: add NULL check in eswitch lag check The function ice_lag_is_switchdev_runnin... • https://git.kernel.org/stable/c/776fe19953b0e0af00399e50fb3b205101d4b3c1 •