CVSS: 5.5EPSS: %CPEs: 1EXPL: 0CVE-2025-37976 – wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process
https://notcve.org/view.php?id=CVE-2025-37976
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process [ Upstream commit 63fdc4509bcf483e79548de6bc08bf3c8e504bb3 ] Currently, ath12k_dp_mon_srng_process uses ath12k_hal_srng_src_get_next_entry to fetch the next entry from the destination ring. This is incorrect because ath12k_hal_srng_src_get_next_entry is intended for source rings, not destination rings. This leads to invalid entry fetches, causing potential data corruption o... • https://git.kernel.org/stable/c/0c1015493f0e3979bcbd3a12ebc0977578c87f21 •
CVSS: 5.5EPSS: %CPEs: 5EXPL: 0CVE-2025-37972 – Input: mtk-pmic-keys - fix possible null pointer dereference
https://notcve.org/view.php?id=CVE-2025-37972
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: Input: mtk-pmic-keys - fix possible null pointer dereference In mtk_pmic_keys_probe, the regs parameter is only set if the button is parsed in the device tree. However, on hardware where the button is left floating, that node will most likely be removed not to enable that input. In that case the code will try to dereference a null pointer. Let's use the regs struct instead as it is defined for all supported platforms. Note that it is ok set... • https://git.kernel.org/stable/c/b581acb49aec5c3b0af9ab1c537fb73481b79069 •
CVSS: 5.5EPSS: %CPEs: 6EXPL: 0CVE-2025-37970 – iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo
https://notcve.org/view.php?id=CVE-2025-37970
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo Prevent st_lsm6dsx_read_fifo from falling in an infinite loop in case pattern_len is equal to zero and the device FIFO is not empty. In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo Prevent st_lsm6dsx_read_fifo from falling in an infinite loop in case pattern_len is equal to zero and the devi... • https://git.kernel.org/stable/c/290a6ce11d938be52634b3ce1bbc6b78be4d23c1 •
CVSS: 5.5EPSS: %CPEs: 6EXPL: 0CVE-2025-37969 – iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo
https://notcve.org/view.php?id=CVE-2025-37969
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo Prevent st_lsm6dsx_read_tagged_fifo from falling in an infinite loop in case pattern_len is equal to zero and the device FIFO is not empty. In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo Prevent st_lsm6dsx_read_tagged_fifo from falling in an infinite loop in case pattern_len i... • https://git.kernel.org/stable/c/801a6e0af0c6cedca2e99155e343ad385a50f08e •
CVSS: 7.1EPSS: %CPEs: 2EXPL: 0CVE-2025-37968 – iio: light: opt3001: fix deadlock due to concurrent flag access
https://notcve.org/view.php?id=CVE-2025-37968
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: iio: light: opt3001: fix deadlock due to concurrent flag access The threaded IRQ function in this driver is reading the flag twice: once to lock a mutex and once to unlock it. Even though the code setting the flag is designed to prevent it, there are subtle cases where the flag could be true at the mutex_lock stage and false at the mutex_unlock stage. This results in the mutex not being unlocked, resulting in a deadlock. Fix it by making th... • https://git.kernel.org/stable/c/94a9b7b1809f56cfaa080e70ec49b6979563a237 •
CVSS: 5.5EPSS: %CPEs: 2EXPL: 0CVE-2025-37967 – usb: typec: ucsi: displayport: Fix deadlock
https://notcve.org/view.php?id=CVE-2025-37967
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix deadlock This patch introduces the ucsi_con_mutex_lock / ucsi_con_mutex_unlock functions to the UCSI driver. ucsi_con_mutex_lock ensures the connector mutex is only locked if a connection is established and the partner pointer is valid. This resolves a deadlock scenario where ucsi_displayport_remove_partner holds con->mutex waiting for dp_altmode_work to complete while dp_altmode_work attempts to acquire i... • https://git.kernel.org/stable/c/af8622f6a585d8d82b11cd7987e082861fd0edd3 •
CVSS: 7.1EPSS: %CPEs: 7EXPL: 0CVE-2025-37964 – x86/mm: Eliminate window where TLB flushes may be inadvertently skipped
https://notcve.org/view.php?id=CVE-2025-37964
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: x86/mm: Eliminate window where TLB flushes may be inadvertently skipped tl;dr: There is a window in the mm switching code where the new CR3 is set and the CPU should be getting TLB flushes for the new mm. But should_flush_tlb() has a bug and suppresses the flush. Fix it by widening the window where should_flush_tlb() sends an IPI. Long Version: === History === There were a few things leading up to this. First, updating mm_cpumask() was obse... • https://git.kernel.org/stable/c/848b5815177582de0e1d0118725378e0fbadca20 •
CVSS: 7.2EPSS: %CPEs: 5EXPL: 0CVE-2025-37963 – arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users
https://notcve.org/view.php?id=CVE-2025-37963
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users Support for eBPF programs loaded by unprivileged users is typically disabled. This means only cBPF programs need to be mitigated for BHB. In addition, only mitigate cBPF programs that were loaded by an unprivileged user. Privileged users can also load the same program via eBPF, making the mitigation pointless. In the Linux kernel, the following vulnerability has been resol... • https://git.kernel.org/stable/c/6e52d043f7dbf1839a24a3fab2b12b0d3839de7a •
CVSS: 7.1EPSS: %CPEs: 10EXPL: 0CVE-2025-37961 – ipvs: fix uninit-value for saddr in do_output_route4
https://notcve.org/view.php?id=CVE-2025-37961
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: ipvs: fix uninit-value for saddr in do_output_route4 syzbot reports for uninit-value for the saddr argument [1]. commit 4754957f04f5 ("ipvs: do not use random local source address for tunnels") already implies that the input value of saddr should be ignored but the code is still reading it which can prevent to connect the route. Fix it by changing the argument to ret_saddr. [1] BUG: KMSAN: uninit-value in do_output_route4+0x42c/0x4d0 net/ne... • https://git.kernel.org/stable/c/4754957f04f5f368792a0eb7dab0ae89fb93dcfd •
CVSS: 7.3EPSS: %CPEs: 5EXPL: 0CVE-2025-37959 – bpf: Scrub packet on bpf_redirect_peer
https://notcve.org/view.php?id=CVE-2025-37959
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: bpf: Scrub packet on bpf_redirect_peer When bpf_redirect_peer is used to redirect packets to a device in another network namespace, the skb isn't scrubbed. That can lead skb information from one namespace to be "misused" in another namespace. As one example, this is causing Cilium to drop traffic when using bpf_redirect_peer to redirect packets that just went through IPsec decryption to a container namespace. The following pwru trace shows ... • https://git.kernel.org/stable/c/9aa1206e8f48222f35a0c809f33b2f4aaa1e2661 •