CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2025-38146 – net: openvswitch: Fix the dead loop of MPLS parse
https://notcve.org/view.php?id=CVE-2025-38146
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix the dead loop of MPLS parse The unexpected MPLS packet may not end with the bottom label stack. When there are many stacks, The label count value has wrapped around. A dead loop occurs, soft lockup/CPU stuck finally. stack backtrace: UBSAN: array-index-out-of-bounds in /build/linux-0Pa0xK/linux-5.15.0/net/openvswitch/flow.c:662:26 index -1 is out of range for type '__be32 [3]' CPU: 34 PID: 0 Comm: swapper/34 Kdump: loa... • https://git.kernel.org/stable/c/fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3 •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2025-38145 – soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
https://notcve.org/view.php?id=CVE-2025-38145
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() devm_kasprintf() returns NULL when memory allocation fails. Currently, aspeed_lpc_enable_snoop() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this issue. [arj: Fix Fixes: tag to use subject from 3772e5da4454] In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: Add NULL check in ... • https://git.kernel.org/stable/c/3772e5da445420543b25825ac2b5971f3743f6e8 •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2025-38144 – watchdog: lenovo_se30_wdt: Fix possible devm_ioremap() NULL pointer dereference in lenovo_se30_wdt_probe()
https://notcve.org/view.php?id=CVE-2025-38144
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: watchdog: lenovo_se30_wdt: Fix possible devm_ioremap() NULL pointer dereference in lenovo_se30_wdt_probe() devm_ioremap() returns NULL on error. Currently, lenovo_se30_wdt_probe() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_ioremap() to prevent this issue. In the Linux kernel, the following vulnerability has been resolved: watchdog: lenovo_se30_wdt: Fix possible devm_ioremap() NULL po... • https://git.kernel.org/stable/c/c284153a2c5537db4fec51ac850c17d2eb1ffcfe •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2025-38143 – backlight: pm8941: Add NULL check in wled_configure()
https://notcve.org/view.php?id=CVE-2025-38143
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: backlight: pm8941: Add NULL check in wled_configure() devm_kasprintf() returns NULL when memory allocation fails. Currently, wled_configure() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this issue. In the Linux kernel, the following vulnerability has been resolved: backlight: pm8941: Add NULL check in wled_configure() devm_kasprintf() returns NULL when memory al... • https://git.kernel.org/stable/c/f86b77583d88c8402e8d89a339d96f847318f8a8 •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38142 – hwmon: (asus-ec-sensors) check sensor index in read_string()
https://notcve.org/view.php?id=CVE-2025-38142
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus-ec-sensors) check sensor index in read_string() Prevent a potential invalid memory access when the requested sensor is not found. find_ec_sensor_index() may return a negative value (e.g. -ENOENT), but its result was used without checking, which could lead to undefined behavior when passed to get_sensor_info(). Add a proper check to return -EINVAL if sensor_index is negative. Found by Linux Verification Center (linuxtesting.org)... • https://git.kernel.org/stable/c/d0ddfd241e5719d696bc0b081e260db69d368668 •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-38141 – dm: fix dm_blk_report_zones
https://notcve.org/view.php?id=CVE-2025-38141
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: dm: fix dm_blk_report_zones If dm_get_live_table() returned NULL, dm_put_live_table() was never called. Also, it is possible that md->zone_revalidate_map will change while calling this function. Only read it once, so that we are always using the same value. Otherwise we might miss a call to dm_put_live_table(). Finally, while md->zone_revalidate_map is set and a process is calling blk_revalidate_disk_zones() to set up the zone append emulat... • https://git.kernel.org/stable/c/f211268ed1f9bdf48f06a3ead5f5d88437450579 •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2025-38140 – dm: limit swapping tables for devices with zone write plugs
https://notcve.org/view.php?id=CVE-2025-38140
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: dm: limit swapping tables for devices with zone write plugs dm_revalidate_zones() only allowed new or previously unzoned devices to call blk_revalidate_disk_zones(). If the device was already zoned, disk->nr_zones would always equal md->nr_zones, so dm_revalidate_zones() returned without doing any work. This would make the zoned settings for the device not match the new table. If the device had zone write plug resources, it could run into e... • https://git.kernel.org/stable/c/bb37d77239af25cde59693dbe3fac04dd17d7b29 •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2025-38139 – netfs: Fix oops in write-retry from mis-resetting the subreq iterator
https://notcve.org/view.php?id=CVE-2025-38139
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: netfs: Fix oops in write-retry from mis-resetting the subreq iterator Fix the resetting of the subrequest iterator in netfs_retry_write_stream() to use the iterator-reset function as the iterator may have been shortened by a previous retry. In such a case, the amount of data to be written by the subrequest is not "subreq->len" but "subreq->len - subreq->transferred". Without this, KASAN may see an error in iov_iter_revert(): BUG: KASAN: sla... • https://git.kernel.org/stable/c/cd0277ed0c188dd40e7744e89299af7b78831ca4 •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2025-38138 – dmaengine: ti: Add NULL check in udma_probe()
https://notcve.org/view.php?id=CVE-2025-38138
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: Add NULL check in udma_probe() devm_kasprintf() returns NULL when memory allocation fails. Currently, udma_probe() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this issue. In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: Add NULL check in udma_probe() devm_kasprintf() returns NULL when memory allocation fails. Curr... • https://git.kernel.org/stable/c/25dcb5dd7b7ce5587c1df18f584ff78f51a68a94 •
CVSS: 5.6EPSS: 0%CPEs: 2EXPL: 0CVE-2025-38137 – PCI/pwrctrl: Cancel outstanding rescan work when unregistering
https://notcve.org/view.php?id=CVE-2025-38137
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: Cancel outstanding rescan work when unregistering It's possible to trigger use-after-free here by: (a) forcing rescan_work_func() to take a long time and (b) utilizing a pwrctrl driver that may be unloaded for some reason Cancel outstanding work to ensure it is finished before we allow our data structures to be cleaned up. [bhelgaas: tidy commit log] In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctr... • https://git.kernel.org/stable/c/8f62819aaace77dd85037ae766eb767f8c4417ce •