CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2025-38136 – usb: renesas_usbhs: Reorder clock handling and power management in probe
https://notcve.org/view.php?id=CVE-2025-38136
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: usb: renesas_usbhs: Reorder clock handling and power management in probe Reorder the initialization sequence in `usbhs_probe()` to enable runtime PM before accessing registers, preventing potential crashes due to uninitialized clocks. Currently, in the probe path, registers are accessed before enabling the clocks, leading to a synchronous external abort on the RZ/V2H SoC. The problematic call flow is as follows: usbhs_probe() usbhs_sys_cloc... • https://git.kernel.org/stable/c/f1407d5c66240b33d11a7f1a41d55ccf6a9d7647 •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2025-38135 – serial: Fix potential null-ptr-deref in mlb_usio_probe()
https://notcve.org/view.php?id=CVE-2025-38135
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: serial: Fix potential null-ptr-deref in mlb_usio_probe() devm_ioremap() can return NULL on error. Currently, mlb_usio_probe() does not check for this case, which could result in a NULL pointer dereference. Add NULL check after devm_ioremap() to prevent this issue. In the Linux kernel, the following vulnerability has been resolved: serial: Fix potential null-ptr-deref in mlb_usio_probe() devm_ioremap() can return NULL on error. Currently, ml... • https://git.kernel.org/stable/c/ba44dc04300441b47618f9933bf36e75a280e5fe •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-38134 – usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink()
https://notcve.org/view.php?id=CVE-2025-38134
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() As demonstrated by the fix for update_port_device_state, commit 12783c0b9e2c ("usb: core: Prevent null pointer dereference in update_port_device_state"), usb_hub_to_struct_hub() can return NULL in certain scenarios, such as during hub driver unbind or teardown race conditions, even if the underlying usb_device structure exists. Plus, all other places that call usb_hu... • https://git.kernel.org/stable/c/f1bfb4a6fed64de1771b43a76631942279851744 •
CVSS: 8.5EPSS: 0%CPEs: 2EXPL: 0CVE-2025-38133 – iio: adc: ad4851: fix ad4858 chan pointer handling
https://notcve.org/view.php?id=CVE-2025-38133
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad4851: fix ad4858 chan pointer handling The pointer returned from ad4851_parse_channels_common() is incremented internally as each channel is populated. In ad4858_parse_channels(), the same pointer was further incremented while setting ext_scan_type fields for each channel. This resulted in indio_dev->channels being set to a pointer past the end of the allocated array, potentially causing memory corruption or undefined behavior. ... • https://git.kernel.org/stable/c/6250803fe2ec92be32a4df1c3a39c4a460d5bd58 •
CVSS: 6.3EPSS: 0%CPEs: 2EXPL: 0CVE-2025-38132 – coresight: holding cscfg_csdev_lock while removing cscfg from csdev
https://notcve.org/view.php?id=CVE-2025-38132
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: coresight: holding cscfg_csdev_lock while removing cscfg from csdev There'll be possible race scenario for coresight config: CPU0 CPU1 (perf enable) load module cscfg_load_config_sets() activate config. // sysfs (sys_active_cnt == 1) ... cscfg_csdev_enable_active_config() lock(csdev->cscfg_csdev_lock) deactivate config // sysfs (sys_activec_cnt == 0) cscfg_unload_config_sets()
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38131 – coresight: prevent deactivate active config while enabling the config
https://notcve.org/view.php?id=CVE-2025-38131
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: coresight: prevent deactivate active config while enabling the config While enable active config via cscfg_csdev_enable_active_config(), active config could be deactivated via configfs' sysfs interface. This could make UAF issue in below scenario: CPU0 CPU1 (sysfs enable) load module cscfg_load_config_sets() activate config. // sysfs (sys_active_cnt == 1) ... cscfg_csdev_enable_active_config() lock(csdev->cscfg_csdev_lock) // here load conf... • https://git.kernel.org/stable/c/f8cce2ff3c04361b8843d8489620fda8880f668b •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2025-38130 – drm/connector: only call HDMI audio helper plugged cb if non-null
https://notcve.org/view.php?id=CVE-2025-38130
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/connector: only call HDMI audio helper plugged cb if non-null On driver remove, sound/soc/codecs/hdmi-codec.c calls the plugged_cb with NULL as the callback function and codec_dev, as seen in its hdmi_remove function. The HDMI audio helper then happily tries calling said null function pointer, and produces an Oops as a result. Fix this by only executing the callback if fn is non-null. This means the .plugged_cb and .plugged_cb_dev membe... • https://git.kernel.org/stable/c/baf616647fe6f857a0cf2187197de31e9bb17a71 •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2025-38129 – page_pool: Fix use-after-free in page_pool_recycle_in_ring
https://notcve.org/view.php?id=CVE-2025-38129
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: page_pool: Fix use-after-free in page_pool_recycle_in_ring syzbot reported a uaf in page_pool_recycle_in_ring: BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862 Read of size 8 at addr ffff8880286045a0 by task syz.0.284/6943 CPU: 0 UID: 0 PID: 6943 Comm: syz.0.284 Not tainted 6.13.0-rc3-syzkaller-gdfa94ce54f41 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 ... • https://git.kernel.org/stable/c/ff7d6b27f894f1469dc51ccb828b7363ccd9799f •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2025-38128 – Bluetooth: MGMT: reject malformed HCI_CMD_SYNC commands
https://notcve.org/view.php?id=CVE-2025-38128
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject malformed HCI_CMD_SYNC commands In 'mgmt_hci_cmd_sync()', check whether the size of parameters passed in 'struct mgmt_cp_hci_cmd_sync' matches the total size of the data (i.e. 'sizeof(struct mgmt_cp_hci_cmd_sync)' plus trailing bytes). Otherwise, large invalid 'params_len' will cause 'hci_cmd_sync_alloc()' to do 'skb_put_data()' from an area beyond the one actually passed to 'mgmt_hci_cmd_sync()'. In the Linux kernel... • https://git.kernel.org/stable/c/827af4787e74e8df9e8e0677a69fbb15e0856d2f •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2025-38127 – ice: fix Tx scheduler error handling in XDP callback
https://notcve.org/view.php?id=CVE-2025-38127
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: ice: fix Tx scheduler error handling in XDP callback When the XDP program is loaded, the XDP callback adds new Tx queues. This means that the callback must update the Tx scheduler with the new queue number. In the event of a Tx scheduler failure, the XDP callback should also fail and roll back any changes previously made for XDP preparation. The previous implementation had a bug that not all changes made by the XDP callback were rolled back... • https://git.kernel.org/stable/c/efc2214b6047b6f5b4ca53151eba62521b9452d6 •