CVSS: 7.3EPSS: 0%CPEs: 8EXPL: 0CVE-2025-37780 – isofs: Prevent the use of too small fid
https://notcve.org/view.php?id=CVE-2025-37780
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: isofs: Prevent the use of too small fid syzbot reported a slab-out-of-bounds Read in isofs_fh_to_parent. [1] The handle_bytes value passed in by the reproducing program is equal to 12. In handle_to_path(), only 12 bytes of memory are allocated for the structure file_handle->f_handle member, which causes an out-of-bounds access when accessing the member parent_block of the structure isofs_fid in isofs, because accessing parent_block requires... • https://git.kernel.org/stable/c/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 •
CVSS: 5.6EPSS: 0%CPEs: 5EXPL: 0CVE-2025-37778 – ksmbd: Fix dangling pointer in krb_authenticate
https://notcve.org/view.php?id=CVE-2025-37778
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix dangling pointer in krb_authenticate krb_authenticate frees sess->user and does not set the pointer to NULL. It calls ksmbd_krb5_authenticate to reinitialise sess->user but that function may return without doing so. If that happens then smb2_sess_setup, which calls krb_authenticate, will be accessing free'd memory when it later uses sess->user. In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix danglin... • https://git.kernel.org/stable/c/d5b554bc8d554ed6ddf443d3db2fad9f665cec10 •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2025-37777 – ksmbd: fix use-after-free in __smb2_lease_break_noti()
https://notcve.org/view.php?id=CVE-2025-37777
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __smb2_lease_break_noti() Move tcp_transport free to ksmbd_conn_free. If ksmbd connection is referenced when ksmbd server thread terminates, It will not be freed, but conn->tcp_transport is freed. __smb2_lease_break_noti can be performed asynchronously when the connection is disconnected. __smb2_lease_break_noti calls ksmbd_conn_write, which can cause use-after-free when conn->ksmbd_transport is already freed. I... • https://git.kernel.org/stable/c/1aec4d14cf81b7b3e7b69eb1cfa94144eed7138e •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2025-37776 – ksmbd: fix use-after-free in smb_break_all_levII_oplock()
https://notcve.org/view.php?id=CVE-2025-37776
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb_break_all_levII_oplock() There is a room in smb_break_all_levII_oplock that can cause racy issues when unlocking in the middle of the loop. This patch use read lock to protect whole loop. In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb_break_all_levII_oplock() There is a room in smb_break_all_levII_oplock that can cause racy issues when unlocking in the mi... • https://git.kernel.org/stable/c/296cb5457cc6f4a754c4ae29855f8a253d52bcc6 •
CVSS: 7.1EPSS: 0%CPEs: 5EXPL: 0CVE-2025-37775 – ksmbd: fix the warning from __kernel_write_iter
https://notcve.org/view.php?id=CVE-2025-37775
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix the warning from __kernel_write_iter [ 2110.972290] ------------[ cut here ]------------ [ 2110.972301] WARNING: CPU: 3 PID: 735 at fs/read_write.c:599 __kernel_write_iter+0x21b/0x280 This patch doesn't allow writing to directory. In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix the warning from __kernel_write_iter [ 2110.972290] ------------[ cut here ]------------ [ 2110.972301] WARNING: CPU: 3 PID... • https://git.kernel.org/stable/c/44079e544c9f6e3e9fb43a16ddf8b08cf686d657 •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-37774 – slab: ensure slab->obj_exts is clear in a newly allocated slab page
https://notcve.org/view.php?id=CVE-2025-37774
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: slab: ensure slab->obj_exts is clear in a newly allocated slab page ktest recently reported crashes while running several buffered io tests with __alloc_tagging_slab_alloc_hook() at the top of the crash call stack. The signature indicates an invalid address dereference with low bits of slab->obj_exts being set. The bits were outside of the range used by page_memcg_data_flags and objext_flags and hence were not masked out by slab_obj_exts() ... • https://git.kernel.org/stable/c/21c690a349baab895dc68ab70d291e1598d7109d •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2025-37773 – virtiofs: add filesystem context source name check
https://notcve.org/view.php?id=CVE-2025-37773
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: virtiofs: add filesystem context source name check In certain scenarios, for example, during fuzz testing, the source name may be NULL, which could lead to a kernel panic. Therefore, an extra check for the source name should be added. In the Linux kernel, the following vulnerability has been resolved: virtiofs: add filesystem context source name check In certain scenarios, for example, during fuzz testing, the source name may be NULL, which... • https://git.kernel.org/stable/c/a62a8ef9d97da23762a588592c8b8eb50a8deb6a •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2025-37772 – RDMA/cma: Fix workqueue crash in cma_netevent_work_handler
https://notcve.org/view.php?id=CVE-2025-37772
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix workqueue crash in cma_netevent_work_handler struct rdma_cm_id has member "struct work_struct net_work" that is reused for enqueuing cma_netevent_work_handler()s onto cma_wq. Below crash[1] can occur if more than one call to cma_netevent_callback() occurs in quick succession, which further enqueues cma_netevent_work_handler()s for the same rdma_cm_id, overwriting any previously queued work-item(s) that was just scheduled to ru... • https://git.kernel.org/stable/c/925d046e7e52c71c3531199ce137e141807ef740 •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2025-37771 – drm/amd/pm: Prevent division by zero
https://notcve.org/view.php?id=CVE-2025-37771
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Prevent division by zero The user can set any speed value. If speed is greater than UINT_MAX/8, division by zero is possible. Found by Linux Verification Center (linuxtesting.org) with SVACE. In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Prevent division by zero The user can set any speed value. If speed is greater than UINT_MAX/8, division by zero is possible. Found by Linux Verification Center... • https://git.kernel.org/stable/c/b64625a303de727498f80f8cb9833fc615c0a90f •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2025-37770 – drm/amd/pm: Prevent division by zero
https://notcve.org/view.php?id=CVE-2025-37770
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Prevent division by zero The user can set any speed value. If speed is greater than UINT_MAX/8, division by zero is possible. Found by Linux Verification Center (linuxtesting.org) with SVACE. In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Prevent division by zero The user can set any speed value. If speed is greater than UINT_MAX/8, division by zero is possible. Found by Linux Verification Center... • https://git.kernel.org/stable/c/c52dcf49195d06319189c7f1dd8b62bfca545197 •