CVSS: 6.9EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38477 – net/sched: sch_qfq: Fix race condition on qfq_aggregate
https://notcve.org/view.php?id=CVE-2025-38477
28 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix race condition on qfq_aggregate A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurrently. For example, qfq_dump_class may trigger a NULL dereference, and qfq_delete_class may cause a use-after-free. This patch addresses the issue by: 1. Moved qfq_destroy_class into the critical section. 2. Added sch_tree_lock protection to qfq_dump_clas... • https://git.kernel.org/stable/c/462dbc9101acd38e92eda93c0726857517a24bbd •
CVSS: 7.1EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38476 – rpl: Fix use-after-free in rpl_do_srh_inline().
https://notcve.org/view.php?id=CVE-2025-38476
28 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: rpl: Fix use-after-free in rpl_do_srh_inline(). Running lwt_dst_cache_ref_loop.sh in selftest with KASAN triggers the splat below [0]. rpl_do_srh_inline() fetches ipv6_hdr(skb) and accesses it after skb_cow_head(), which is illegal as the header could be freed then. Let's fix it by making oldhdr to a local struct instead of a pointer. [0]: [root@fedora net]# ./lwt_dst_cache_ref_loop.sh ... TEST: rpl (input) [ 57.631529] ====================... • https://git.kernel.org/stable/c/a7a29f9c361f8542604ef959ae6627f423b7a412 •
CVSS: 5.6EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38474 – usb: net: sierra: check for no status endpoint
https://notcve.org/view.php?id=CVE-2025-38474
28 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: usb: net: sierra: check for no status endpoint The driver checks for having three endpoints and having bulk in and out endpoints, but not that the third endpoint is interrupt input. Rectify the omission. In the Linux kernel, the following vulnerability has been resolved: usb: net: sierra: check for no status endpoint The driver checks for having three endpoints and having bulk in and out endpoints, but not that the third endpoint is interru... • https://git.kernel.org/stable/c/eb4fd8cd355c8ec425a12ec6cbdac614e8a4819d •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38473 – Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
https://notcve.org/view.php?id=CVE-2025-38473
28 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() syzbot reported null-ptr-deref in l2cap_sock_resume_cb(). [0] l2cap_sock_resume_cb() has a similar problem that was fixed by commit 1bff51ea59a9 ("Bluetooth: fix use-after-free error in lock_sock_nested()"). Since both l2cap_sock_kill() and l2cap_sock_resume_cb() are executed under l2cap_sock_resume_cb(), we can avoid the issue simply by checking if chan->data is NULL. Let's not access... • https://git.kernel.org/stable/c/d97c899bde330cd1c76c3a162558177563a74362 •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38470 – net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
https://notcve.org/view.php?id=CVE-2025-38470
28 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime Assuming the "rx-vlan-filter" feature is enabled on a net device, the 8021q module will automatically add or remove VLAN 0 when the net device is put administratively up or down, respectively. There are a couple of problems with the above scheme. The first problem is a memory leak that can happen if the "rx-vlan-filter" feature is disabled while the device is runn... • https://git.kernel.org/stable/c/ad1afb00393915a51c21b1ae8704562bf036855f •
CVSS: 7.2EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38468 – net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
https://notcve.org/view.php?id=CVE-2025-38468
28 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree htb_lookup_leaf has a BUG_ON that can trigger with the following: tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 htb rate 64bit tc qdisc add dev lo parent 1:1 handle 2: netem tc qdisc add dev lo parent 2:1 handle 3: blackhole ping -I lo -c1 -W0.001 127.0.0.1 The root cause is the following: 1. htb_deque... • https://git.kernel.org/stable/c/512bb43eb5422ee69a1be05ea0d89dc074fac9a2 •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2025-38467 – drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
https://notcve.org/view.php?id=CVE-2025-38467
25 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling If there's support for another console device (such as a TTY serial), the kernel occasionally panics during boot. The panic message and a relevant snippet of the call stack is as follows: Unable to handle kernel NULL pointer dereference at virtual address 000000000000000 Call trace: drm_crtc_handle_vblank+0x10/0x30 (P) decon_irq_handler+0x88/0xb4 [...] Otherwise, the panics don... • https://git.kernel.org/stable/c/96976c3d9aff4e1387c30f6356ac01fa6f72ef46 •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2025-38466 – perf: Revert to requiring CAP_SYS_ADMIN for uprobes
https://notcve.org/view.php?id=CVE-2025-38466
25 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: perf: Revert to requiring CAP_SYS_ADMIN for uprobes Jann reports that uprobes can be used destructively when used in the middle of an instruction. The kernel only verifies there is a valid instruction at the requested offset, but due to variable instruction length cannot determine if this is an instruction as seen by the intended execution stream. Additionally, Mark Rutland notes that on architectures that mix data in the text segment (like... • https://git.kernel.org/stable/c/c9e0924e5c2b59365f9c0d43ff8722e79ecf4088 •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2025-38465 – netlink: Fix wraparounds of sk->sk_rmem_alloc.
https://notcve.org/view.php?id=CVE-2025-38465
25 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: netlink: Fix wraparounds of sk->sk_rmem_alloc. Netlink has this pattern in some places if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf) atomic_add(skb->truesize, &sk->sk_rmem_alloc); , which has the same problem fixed by commit 5a465a0da13e ("udp: Fix multiple wraparounds of sk->sk_rmem_alloc."). For example, if we set INT_MAX to SO_RCVBUFFORCE, the condition is always false as the two operands are of int. Then, a single socket can eat ... • https://git.kernel.org/stable/c/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 •
CVSS: 7.2EPSS: 0%CPEs: 8EXPL: 0CVE-2025-38464 – tipc: Fix use-after-free in tipc_conn_close().
https://notcve.org/view.php?id=CVE-2025-38464
25 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free in tipc_conn_close(). syzbot reported a null-ptr-deref in tipc_conn_close() during netns dismantle. [0] tipc_topsrv_stop() iterates tipc_net(net)->topsrv->conn_idr and calls tipc_conn_close() for each tipc_conn. The problem is that tipc_conn_close() is called after releasing the IDR lock. At the same time, there might be tipc_conn_recv_work() running and it could call tipc_conn_close() for the same tipc_conn and rel... • https://git.kernel.org/stable/c/c5fa7b3cf3cb22e4ac60485fc2dc187fe012910f •