CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2025-21810 – driver core: class: Fix wild pointer dereferences in API class_dev_iter_next()
https://notcve.org/view.php?id=CVE-2025-21810
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: driver core: class: Fix wild pointer dereferences in API class_dev_iter_next() There are a potential wild pointer dereferences issue regarding APIs class_dev_iter_(init|next|exit)(), as explained by below typical usage: // All members of @iter are wild pointers. struct class_dev_iter iter; // class_dev_iter_init(@iter, @class, ...) checks parameter @class for // potential class_to_subsys() error, and it returns void type and does // not ini... • https://git.kernel.org/stable/c/7b884b7f24b42fa25e92ed724ad82f137610afaf •
CVSS: 6.3EPSS: 0%CPEs: 4EXPL: 0CVE-2025-21808 – net: xdp: Disallow attaching device-bound programs in generic mode
https://notcve.org/view.php?id=CVE-2025-21808
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: net: xdp: Disallow attaching device-bound programs in generic mode Device-bound programs are used to support RX metadata kfuncs. These kfuncs are driver-specific and rely on the driver context to read the metadata. This means they can't work in generic XDP mode. However, there is no check to disallow such programs from being attached in generic mode, in which case the metadata kfuncs will be called in an invalid context, leading to crashes.... • https://git.kernel.org/stable/c/2b3486bc2d237ec345b3942b7be5deabf8c8fed1 •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2025-21806 – net: let net.core.dev_weight always be non-zero
https://notcve.org/view.php?id=CVE-2025-21806
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: net: let net.core.dev_weight always be non-zero The following problem was encountered during stability test: (NULL net_device): NAPI poll function process_backlog+0x0/0x530 \ returned 1, exceeding its budget of 0. ------------[ cut here ]------------ list_add double add: new=ffff88905f746f48, prev=ffff88905f746f48, \ next=ffff88905f746e40. WARNING: CPU: 18 PID: 5462 at lib/list_debug.c:35 \ __list_add_valid_or_report+0xf3/0x130 CPU: 18 UID:... • https://git.kernel.org/stable/c/e3876605450979fe52a1a03e7eb78a89bf59e76a •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2025-21804 – PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region()
https://notcve.org/view.php?id=CVE-2025-21804
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region() The rcar_pcie_parse_outbound_ranges() uses the devm_request_mem_region() macro to request a needed resource. A string variable that lives on the stack is then used to store a dynamically computed resource name, which is then passed on as one of the macro arguments. This can lead to undefined behavior. Depending on the current contents of the memory, the manifes... • https://git.kernel.org/stable/c/2a6d0d63d99956a66f6605832f11755d74a41951 •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2025-21803 – LoongArch: Fix warnings during S3 suspend
https://notcve.org/view.php?id=CVE-2025-21803
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix warnings during S3 suspend The enable_gpe_wakeup() function calls acpi_enable_all_wakeup_gpes(), and the later one may call the preempt_schedule_common() function, resulting in a thread switch and causing the CPU to be in an interrupt enabled state after the enable_gpe_wakeup() function returns, leading to the warnings as follow. [ C0] WARNING: ... at kernel/time/timekeeping.c:845 ktime_get+0xbc/0xc8 [ C0] ... [ C0] Call Trac... • https://git.kernel.org/stable/c/366bb35a8e48198cefcd3484ac6b2374d1347873 •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2025-21802 – net: hns3: fix oops when unload drivers paralleling
https://notcve.org/view.php?id=CVE-2025-21802
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix oops when unload drivers paralleling When unload hclge driver, it tries to disable sriov first for each ae_dev node from hnae3_ae_dev_list. If user unloads hns3 driver at the time, because it removes all the ae_dev nodes, and it may cause oops. But we can't simply use hnae3_common_lock for this. Because in the process flow of pci_disable_sriov(), it will trigger the remove flow of VF, which will also take hnae3_common_lock. T... • https://git.kernel.org/stable/c/0dd8a25f355b4df2d41c08df1716340854c7d4c5 •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2025-21801 – net: ravb: Fix missing rtnl lock in suspend/resume path
https://notcve.org/view.php?id=CVE-2025-21801
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: net: ravb: Fix missing rtnl lock in suspend/resume path Fix the suspend/resume path by ensuring the rtnl lock is held where required. Calls to ravb_open, ravb_close and wol operations must be performed under the rtnl lock to prevent conflicts with ongoing ndo operations. Without this fix, the following warning is triggered: [ 39.032969] ============================= [ 39.032983] WARNING: suspicious RCU usage [ 39.033019] -------------------... • https://git.kernel.org/stable/c/0184165b2f42c4b032da9dd11546bfbaeb5afd4e •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2025-21799 – net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns()
https://notcve.org/view.php?id=CVE-2025-21799
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns() When getting the IRQ we use k3_udma_glue_tx_get_irq() which returns negative error value on error. So not NULL check is not sufficient to deteremine if IRQ is valid. Check that IRQ is greater then zero to ensure it is valid. There is no issue at probe time but at runtime user can invoke .set_channels which results in the following call chain. am65_cpsw_set_chan... • https://git.kernel.org/stable/c/93a76530316a3d8cc2d82c3deca48424fee92100 •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2024-58034 – memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()
https://notcve.org/view.php?id=CVE-2024-58034
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code() As of_find_node_by_name() release the reference of the argument device node, tegra_emc_find_node_by_ram_code() releases some device nodes while still in use, resulting in possible UAFs. According to the bindings and the in-tree DTS files, the "emc-tables" node is always device's child node with the property "nvidia,use-ram-code", and the "lpddr2" node is ... • https://git.kernel.org/stable/c/96e5da7c842424bcf64afe1082b960b42b96190b •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2025-21796 – nfsd: clear acl_access/acl_default after releasing them
https://notcve.org/view.php?id=CVE-2025-21796
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: nfsd: clear acl_access/acl_default after releasing them If getting acl_default fails, acl_access and acl_default will be released simultaneously. However, acl_access will still retain a pointer pointing to the released posix_acl, which will trigger a WARNING in nfs3svc_release_getacl like this: ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 26 PID: 3199 at lib/refcount.c:28 refcount_warn_saturate+0... • https://git.kernel.org/stable/c/a257cdd0e2179630d3201c32ba14d7fcb3c3a055 • CWE-416: Use After Free •