CVSS: 9.0EPSS: %CPEs: 2EXPL: 0CVE-2025-22107 – net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry()
https://notcve.org/view.php?id=CVE-2025-22107
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() There are actually 2 problems: - deleting the last element doesn't require the memmove of elements [i + 1, end) over it. Actually, element i+1 is out of bounds. - The memmove itself should move size - i - 1 elements, because the last element is out of bounds. The out-of-bounds element still remains out of bounds after being accessed, so the problem is only th... • https://git.kernel.org/stable/c/6666cebc5e306f49a25bd20aa8c1cb8ef8950df5 •
CVSS: 7.1EPSS: %CPEs: 2EXPL: 0CVE-2025-22104 – ibmvnic: Use kernel helpers for hex dumps
https://notcve.org/view.php?id=CVE-2025-22104
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Use kernel helpers for hex dumps Previously, when the driver was printing hex dumps, the buffer was cast to an 8 byte long and printed using string formatters. If the buffer size was not a multiple of 8 then a read buffer overflow was possible. Therefore, create a new ibmvnic function that loops over a buffer and calls hex_dump_to_buffer instead. This patch address KASAN reports like the one below: ibmvnic 30000003 env3: Login Buff... • https://git.kernel.org/stable/c/032c5e82847a2214c3196a90f0aeba0ce252de58 •
CVSS: 5.5EPSS: %CPEs: 2EXPL: 0CVE-2025-22103 – net: fix NULL pointer dereference in l3mdev_l3_rcv
https://notcve.org/view.php?id=CVE-2025-22103
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: net: fix NULL pointer dereference in l3mdev_l3_rcv When delete l3s ipvlan: ip link del link eth0 ipvlan1 type ipvlan mode l3s This may cause a null pointer dereference: Call trace: ip_rcv_finish+0x48/0xd0 ip_rcv+0x5c/0x100 __netif_receive_skb_one_core+0x64/0xb0 __netif_receive_skb+0x20/0x80 process_backlog+0xb4/0x204 napi_poll+0xe8/0x294 net_rx_action+0xd8/0x22c __do_softirq+0x12c/0x354 This is because l3mdev_l3_rcv() visit dev->l3mdev_ops ... • https://git.kernel.org/stable/c/c675e06a98a474f7ad0af32ce467613da818da52 •
CVSS: 7.8EPSS: %CPEs: 7EXPL: 0CVE-2025-22097 – drm/vkms: Fix use after free and double free on init error
https://notcve.org/view.php?id=CVE-2025-22097
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Fix use after free and double free on init error If the driver initialization fails, the vkms_exit() function might access an uninitialized or freed default_config pointer and it might double free it. Fix both possible errors by initializing default_config only when the driver initialization succeeded. In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Fix use after free and double free on init error If ... • https://git.kernel.org/stable/c/2df7af93fdadb9ba8226fe443fae15ecdefda2a6 •
CVSS: 5.5EPSS: %CPEs: 5EXPL: 0CVE-2025-22090 – x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()
https://notcve.org/view.php?id=CVE-2025-22090
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() If track_pfn_copy() fails, we already added the dst VMA to the maple tree. As fork() fails, we'll cleanup the maple tree, and stumble over the dst VMA for which we neither performed any reservation nor copied any page tables. Consequently untrack_pfn() will see VM_PAT and try obtaining the PAT information from the page table -- which fails because the page table was not ... • https://git.kernel.org/stable/c/2ab640379a0ab4cef746ced1d7e04a0941774bcb •
CVSS: 5.5EPSS: %CPEs: 9EXPL: 0CVE-2025-22086 – RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
https://notcve.org/view.php?id=CVE-2025-22086
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow When cur_qp isn't NULL, in order to avoid fetching the QP from the radix tree again we check if the next cqe QP is identical to the one we already have. The bug however is that we are checking if the QP is identical by checking the QP number inside the CQE against the QP number inside the mlx5_ib_qp, but that's wrong since the QP number from the CQE is from FW so it should be matched against... • https://git.kernel.org/stable/c/e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c •
CVSS: 5.5EPSS: %CPEs: 5EXPL: 0CVE-2025-22083 – vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint
https://notcve.org/view.php?id=CVE-2025-22083
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint If vhost_scsi_set_endpoint is called multiple times without a vhost_scsi_clear_endpoint between them, we can hit multiple bugs found by Haoran Zhang: 1. Use-after-free when no tpgs are found: This fixes a use after free that occurs when vhost_scsi_set_endpoint is called more than once and calls after the first call do not find any tpgs to add to the vs_tpg. When vhost_scs... • https://git.kernel.org/stable/c/4f7f46d32c9875004fae1d57ae3c02cc2e6cd6a3 •
CVSS: 7.1EPSS: %CPEs: 9EXPL: 0CVE-2025-22079 – ocfs2: validate l_tree_depth to avoid out-of-bounds access
https://notcve.org/view.php?id=CVE-2025-22079
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate l_tree_depth to avoid out-of-bounds access The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is limited to OCFS2_MAX_PATH_DEPTH. Add a check to prevent out-of-bounds access if l_tree_depth has an invalid value, which may occur when reading from a corrupted mounted disk [1]. In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate l_tree_depth to avoid out-of-bounds access The ... • https://git.kernel.org/stable/c/ccd979bdbce9fba8412beb3f1de68a9d0171b12c •
CVSS: 5.5EPSS: %CPEs: 8EXPL: 0CVE-2025-22075 – rtnetlink: Allocate vfinfo size for VF GUIDs when supported
https://notcve.org/view.php?id=CVE-2025-22075
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Allocate vfinfo size for VF GUIDs when supported Commit 30aad41721e0 ("net/core: Add support for getting VF GUIDs") added support for getting VF port and node GUIDs in netlink ifinfo messages, but their size was not taken into consideration in the function that allocates the netlink message, causing the following warning when a netlink message is filled with many VF port and node GUIDs: # echo 64 > /sys/bus/pci/devices/0000\:08\:... • https://git.kernel.org/stable/c/30aad41721e087babcf27c5192474724d555936c •
CVSS: 7.1EPSS: %CPEs: 9EXPL: 0CVE-2025-22073 – spufs: fix a leak on spufs_new_file() failure
https://notcve.org/view.php?id=CVE-2025-22073
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: spufs: fix a leak on spufs_new_file() failure It's called from spufs_fill_dir(), and caller of that will do spufs_rmdir() in case of failure. That does remove everything we'd managed to create, but... the problem dentry is still negative. IOW, it needs to be explicitly dropped. In the Linux kernel, the following vulnerability has been resolved: spufs: fix a leak on spufs_new_file() failure It's called from spufs_fill_dir(), and caller of th... • https://git.kernel.org/stable/c/3f51dd91c80746a5cf76f8c4a77bfc88aa82bb9e •