CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2025-39952 – wifi: wilc1000: avoid buffer overflow in WID string configuration
https://notcve.org/view.php?id=CVE-2025-39952
04 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: avoid buffer overflow in WID string configuration Fix the following copy overflow warning identified by Smatch checker. drivers/net/wireless/microchip/wilc1000/wlan_cfg.c:184 wilc_wlan_parse_response_frame() error: '__memcpy()' 'cfg->s[i]->str' copy overflow (512 vs 65537) This patch introduces size check before accessing the memory buffer. The checks are base on the WID type of received data from the firmware. For WID strin... • https://git.kernel.org/stable/c/c5c77ba18ea66aa05441c71e38473efb787705a4 •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2025-39951 – um: virtio_uml: Fix use-after-free after put_device in probe
https://notcve.org/view.php?id=CVE-2025-39951
04 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: um: virtio_uml: Fix use-after-free after put_device in probe When register_virtio_device() fails in virtio_uml_probe(), the code sets vu_dev->registered = 1 even though the device was not successfully registered. This can lead to use-after-free or other issues. In the Linux kernel, the following vulnerability has been resolved: um: virtio_uml: Fix use-after-free after put_device in probe When register_virtio_device() fails in virtio_uml_pro... • https://git.kernel.org/stable/c/04e5b1fb01834a602acaae2276b67a783a8c6159 •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2025-39949 – qed: Don't collect too many protection override GRC elements
https://notcve.org/view.php?id=CVE-2025-39949
04 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: qed: Don't collect too many protection override GRC elements In the protection override dump path, the firmware can return far too many GRC elements, resulting in attempting to write past the end of the previously-kmalloc'ed dump buffer. This will result in a kernel panic with reason: BUG: unable to handle kernel paging request at ADDRESS where "ADDRESS" is just past the end of the protection override dump buffer. The start address of the b... • https://git.kernel.org/stable/c/d52c89f120de849575f6b2e5948038f2be12ce6f •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2025-39947 – net/mlx5e: Harden uplink netdev access against device unbind
https://notcve.org/view.php?id=CVE-2025-39947
04 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Harden uplink netdev access against device unbind The function mlx5_uplink_netdev_get() gets the uplink netdevice pointer from mdev->mlx5e_res.uplink_netdev. However, the netdevice can be removed and its pointer cleared when unbound from the mlx5_core.eth driver. This results in a NULL pointer, causing a kernel panic. BUG: unable to handle page fault for address: 0000000000001300 at RIP: 0010:mlx5e_vport_rep_load+0x22a/0x270 [mlx... • https://git.kernel.org/stable/c/7a9fb35e8c3a67145fca262c304de65cb2f83abf •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2025-39946 – tls: make sure to abort the stream if headers are bogus
https://notcve.org/view.php?id=CVE-2025-39946
04 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: tls: make sure to abort the stream if headers are bogus Normally we wait for the socket to buffer up the whole record before we service it. If the socket has a tiny buffer, however, we read out the data sooner, to prevent connection stalls. Make sure that we abort the connection when we find out late that the record is actually invalid. Retrying the parsing is fine in itself but since we copy some more data each time before we parse we can ... • https://git.kernel.org/stable/c/84c61fe1a75b4255df1e1e7c054c9e6d048da417 •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2025-39945 – cnic: Fix use-after-free bugs in cnic_delete_task
https://notcve.org/view.php?id=CVE-2025-39945
04 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: cnic: Fix use-after-free bugs in cnic_delete_task The original code uses cancel_delayed_work() in cnic_cm_stop_bnx2x_hw(), which does not guarantee that the delayed work item 'delete_task' has fully completed if it was already running. Additionally, the delayed work item is cyclic, the flush_workqueue() in cnic_cm_stop_bnx2x_hw() only blocks and waits for work items that were already queued to the workqueue prior to its invocation. Any work... • https://git.kernel.org/stable/c/fdf24086f4752aee5dfb40143c736250df017820 •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2025-39944 – octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
https://notcve.org/view.php?id=CVE-2025-39944
04 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() The original code relies on cancel_delayed_work() in otx2_ptp_destroy(), which does not ensure that the delayed work item synctstamp_work has fully completed if it was already running. This leads to use-after-free scenarios where otx2_ptp is deallocated by otx2_ptp_destroy(), while synctstamp_work remains active and attempts to dereference otx2_ptp in otx2_sync_tstamp(). Furthermor... • https://git.kernel.org/stable/c/2958d17a898416c6193431676f6130b68a2cb9fc •
CVSS: 7.1EPSS: 0%CPEs: 6EXPL: 0CVE-2025-39943 – ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer
https://notcve.org/view.php?id=CVE-2025-39943
04 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer If data_offset and data_length of smb_direct_data_transfer struct are invalid, out of bounds issue could happen. This patch validate data_offset and data_length field in recv_done. In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer If data_offset an... • https://git.kernel.org/stable/c/2ea086e35c3d726a3bacd0a971c1f02a50e98206 •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2025-39942 – ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size
https://notcve.org/view.php?id=CVE-2025-39942
04 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size This is inspired by the check for data_offset + data_length. Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. For the oldstable distribution (bookworm), these problems have been fixed in version 6.1.158-1. • https://git.kernel.org/stable/c/2ea086e35c3d726a3bacd0a971c1f02a50e98206 •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2025-39940 – dm-stripe: fix a possible integer overflow
https://notcve.org/view.php?id=CVE-2025-39940
04 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: dm-stripe: fix a possible integer overflow There's a possible integer overflow in stripe_io_hints if we have too large chunk size. Test if the overflow happened, and if it did, don't set limits->io_min and limits->io_opt; In the Linux kernel, the following vulnerability has been resolved: dm-stripe: fix a possible integer overflow There's a possible integer overflow in stripe_io_hints if we have too large chunk size. Test if the overflow ha... • https://git.kernel.org/stable/c/40bea431274c247425e7f5970d796ff7b37a2b22 •