CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2025-39781 – parisc: Drop WARN_ON_ONCE() from flush_cache_vmap
https://notcve.org/view.php?id=CVE-2025-39781
11 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: parisc: Drop WARN_ON_ONCE() from flush_cache_vmap I have observed warning to occassionally trigger. • https://git.kernel.org/stable/c/69cf90e5aa50fe3cb0c1a63cabc4761db44b0035 •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2025-39779 – btrfs: subpage: keep TOWRITE tag until folio is cleaned
https://notcve.org/view.php?id=CVE-2025-39779
11 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: btrfs: subpage: keep TOWRITE tag until folio is cleaned btrfs_subpage_set_writeback() calls folio_start_writeback() the first time a folio is written back, and it also clears the PAGECACHE_TAG_TOWRITE tag even if there are still dirty blocks in the folio. This can break ordering guarantees, such as those required by btrfs_wait_ordered_extents(). That ordering breakage leads to a real failure. For example, running generic/464 on a zoned setu... • https://git.kernel.org/stable/c/3470da3b7d87fde4b9729d4e29c2dc074cd59c10 •
CVSS: 7.1EPSS: 0%CPEs: 6EXPL: 0CVE-2025-39776 – mm/debug_vm_pgtable: clear page table entries at destroy_args()
https://notcve.org/view.php?id=CVE-2025-39776
11 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: mm/debug_vm_pgtable: clear page table entries at destroy_args() The mm/debug_vm_pagetable test allocates manually page table entries for the tests it runs, using also its manually allocated mm_struct. That in itself is ok, but when it exits, at destroy_args() it fails to clear those entries with the *_clear functions. The problem is that leaves stale entries. If another process allocates an mm_struct with a pgd at the same address, it may e... • https://git.kernel.org/stable/c/3c9b84f044a9e54cf56d1b2c9b80a2d2ce56d70a •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2025-39773 – net: bridge: fix soft lockup in br_multicast_query_expired()
https://notcve.org/view.php?id=CVE-2025-39773
11 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix soft lockup in br_multicast_query_expired() When set multicast_query_interval to a large value, the local variable 'time' in br_multicast_send_query() may overflow. If the time is smaller than jiffies, the timer will expire immediately, and then call mod_timer() again, which creates a loop and may trigger the following soft lockup issue. watchdog: BUG: soft lockup - CPU#1 stuck for 221s! [rb_consumer:66] CPU: 1 UID: 0 PID: ... • https://git.kernel.org/stable/c/d902eee43f1951b358d7347d9165c6af21cf7b1b •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2025-39772 – drm/hisilicon/hibmc: fix the hibmc loaded failed bug
https://notcve.org/view.php?id=CVE-2025-39772
11 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/hisilicon/hibmc: fix the hibmc loaded failed bug When hibmc loaded failed, the driver use hibmc_unload to free the resource, but the mutexes in mode.config are not init, which will access an NULL pointer. Just change goto statement to return, because hibnc_hw_init() doesn't need to free anything. In the Linux kernel, the following vulnerability has been resolved: drm/hisilicon/hibmc: fix the hibmc loaded failed bug When hibmc loaded fai... • https://git.kernel.org/stable/c/b3df5e65cc03696b0624a877d03a3ddf3ef43f52 •
CVSS: 6.5EPSS: 0%CPEs: 10EXPL: 0CVE-2025-39770 – net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
https://notcve.org/view.php?id=CVE-2025-39770
11 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM When performing Generic Segmentation Offload (GSO) on an IPv6 packet that contains extension headers, the kernel incorrectly requests checksum offload if the egress device only advertises NETIF_F_IPV6_CSUM feature, which has a strict contract: it supports checksum offload only for plain TCP or UDP over IPv6 and explicitly does not support packets with extension headers... • https://git.kernel.org/stable/c/a84978a9cda68f0afe3f01d476c68db21526baf1 •
CVSS: 3.3EPSS: 0%CPEs: 4EXPL: 0CVE-2025-39767 – LoongArch: Optimize module load time by optimizing PLT/GOT counting
https://notcve.org/view.php?id=CVE-2025-39767
11 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: LoongArch: Optimize module load time by optimizing PLT/GOT counting When enabling CONFIG_KASAN, CONFIG_PREEMPT_VOLUNTARY_BUILD and CONFIG_PREEMPT_VOLUNTARY at the same time, there will be soft deadlock, the relevant logs are as follows: rcu: INFO: rcu_sched self-detected stall on CPU ... Call Trace: [<900000000024f9e4>] show_stack+0x5c/0x180 [<90000000002482f4>] dump_stack_lvl+0x94/0xbc [<9000000000224544>] rcu_dump_cpu_stacks+0x1fc/0x280 [... • https://git.kernel.org/stable/c/fcdfe9d22bed08409968a751e93112f742208be6 •
CVSS: 7.2EPSS: 0%CPEs: 8EXPL: 0CVE-2025-39766 – net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
https://notcve.org/view.php?id=CVE-2025-39766
11 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit The following setup can trigger a WARNING in htb_activate due to the condition: !cl->leaf.q->q.qlen tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 \ htb rate 64bit tc qdisc add dev lo parent 1:1 handle f: \ cake memlimit 1b ping -I lo -f -c1 -s64 -W0.001 127.0.0.1 This is because the low memlimit leads ... • https://git.kernel.org/stable/c/046f6fd5daefac7f5abdafb436b30f63bc7c602b •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2025-39764 – netfilter: ctnetlink: remove refcounting in expectation dumpers
https://notcve.org/view.php?id=CVE-2025-39764
11 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: remove refcounting in expectation dumpers Same pattern as previous patch: do not keep the expectation object alive via refcount, only store a cookie value and then use that as the skip hint for dump resumption. AFAICS this has the same issue as the one resolved in the conntrack dumper, when we do if (!refcount_inc_not_zero(&exp->use)) to increment the refcount, there is a chance that exp == last, which causes a double-... • https://git.kernel.org/stable/c/cf6994c2b9812a9f02b99e89df411ffc5db9c779 •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2025-39763 – ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered
https://notcve.org/view.php?id=CVE-2025-39763
11 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered If a synchronous error is detected as a result of user-space process triggering a 2-bit uncorrected error, the CPU will take a synchronous error exception such as Synchronous External Abort (SEA) on Arm64. The kernel will queue a memory_failure() work which poisons the related page, unmaps the page, and then sends a SIGBUS to the process, so that a system wide... • https://git.kernel.org/stable/c/082735fbcdb6cd0cf20fbec94516ab2996f1cdd5 •