CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-21961 – eth: bnxt: fix truesize for mb-xdp-pass case
https://notcve.org/view.php?id=CVE-2025-21961
01 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix truesize for mb-xdp-pass case When mb-xdp is set and return is XDP_PASS, packet is converted from xdp_buff to sk_buff with xdp_update_skb_shared_info() in bnxt_xdp_build_skb(). bnxt_xdp_build_skb() passes incorrect truesize argument to xdp_update_skb_shared_info(). The truesize is calculated as BNXT_RX_PAGE_SIZE * sinfo->nr_frags but the skb_shared_info was wiped by napi_build_skb() before. So it stores sinfo->nr_frags before... • https://git.kernel.org/stable/c/1dc4c557bfedfcdf7fc0c46795857773b7ad66e7 •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2025-21960 – eth: bnxt: do not update checksum in bnxt_xdp_build_skb()
https://notcve.org/view.php?id=CVE-2025-21960
01 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: do not update checksum in bnxt_xdp_build_skb() The bnxt_rx_pkt() updates ip_summed value at the end if checksum offload is enabled. When the XDP-MB program is attached and it returns XDP_PASS, the bnxt_xdp_build_skb() is called to update skb_shared_info. The main purpose of bnxt_xdp_build_skb() is to update skb_shared_info, but it updates ip_summed value too if checksum offload is enabled. This is actually duplicate work. When th... • https://git.kernel.org/stable/c/1dc4c557bfedfcdf7fc0c46795857773b7ad66e7 •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2025-21959 – netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()
https://notcve.org/view.php?id=CVE-2025-21959
01 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() Since commit b36e4523d4d5 ("netfilter: nf_conncount: fix garbage collection confirm race"), `cpu` and `jiffies32` were introduced to the struct nf_conncount_tuple. The commit made nf_conncount_add() initialize `conn->cpu` and `conn->jiffies32` when allocating the struct. In contrast, count_tree() was not changed to initialize them. By commit 34848d5c896e ("... • https://git.kernel.org/stable/c/b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452 •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2025-21958 – Revert "openvswitch: switch to per-action label counting in conntrack"
https://notcve.org/view.php?id=CVE-2025-21958
01 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: Revert "openvswitch: switch to per-action label counting in conntrack" Currently, ovs_ct_set_labels() is only called for confirmed conntrack entries (ct) within ovs_ct_commit(). However, if the conntrack entry does not have the labels_ext extension, attempting to allocate it in ovs_ct_get_conn_labels() for a confirmed entry triggers a warning in nf_ct_ext_add(): WARN_ON(nf_ct_is_confirmed(ct)); This happens when the conntrack entry is creat... • https://git.kernel.org/stable/c/fcb1aa5163b1ae4cf2864b688b08927aac51f51e •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2025-21957 – scsi: qla1280: Fix kernel oops when debug level > 2
https://notcve.org/view.php?id=CVE-2025-21957
01 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: scsi: qla1280: Fix kernel oops when debug level > 2 A null dereference or oops exception will eventually occur when qla1280.c driver is compiled with DEBUG_QLA1280 enabled and ql_debug_level > 2. I think its clear from the code that the intention here is sg_dma_len(s) not length of sg_next(s) when printing the debug info. In the Linux kernel, the following vulnerability has been resolved: scsi: qla1280: Fix kernel oops when debug level > 2 ... • https://git.kernel.org/stable/c/afa27b7c17a48e01546ccaad0ab017ad0496a522 •
CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 0CVE-2025-21956 – drm/amd/display: Assign normalized_pix_clk when color depth = 14
https://notcve.org/view.php?id=CVE-2025-21956
01 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Assign normalized_pix_clk when color depth = 14 [WHY & HOW] A warning message "WARNING: CPU: 4 PID: 459 at ... /dc_resource.c:3397 calculate_phy_pix_clks+0xef/0x100 [amdgpu]" occurs because the display_color_depth == COLOR_DEPTH_141414 is not handled. This is observed in Radeon RX 6600 XT. It is fixed by assigning pix_clk * (14 * 3) / 24 - same as the rests. Also fixes the indentation in get_norm_pix_clk. • https://git.kernel.org/stable/c/cca3ab74f90176099b6392e8e894b52b27b3d080 •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2025-21955 – ksmbd: prevent connection release during oplock break notification
https://notcve.org/view.php?id=CVE-2025-21955
01 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent connection release during oplock break notification ksmbd_work could be freed when after connection release. Increment r_count of ksmbd_conn to indicate that requests are not finished yet and to not release the connection. In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent connection release during oplock break notification ksmbd_work could be freed when after connection release. Increment r_co... • https://git.kernel.org/stable/c/0626e6641f6b467447c81dd7678a69c66f7746cf •
CVSS: 7.9EPSS: 0%CPEs: 3EXPL: 0CVE-2025-21954 – netmem: prevent TX of unreadable skbs
https://notcve.org/view.php?id=CVE-2025-21954
01 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: netmem: prevent TX of unreadable skbs Currently on stable trees we have support for netmem/devmem RX but not TX. It is not safe to forward/redirect an RX unreadable netmem packet into the device's TX path, as the device may call dma-mapping APIs on dma addrs that should not be passed to it. Fix this by preventing the xmit of unreadable skbs. Tested by configuring tc redirect: sudo tc qdisc add dev eth1 ingress sudo tc filter add dev eth1 in... • https://git.kernel.org/stable/c/65249feb6b3df9e17bab5911ee56fa7b0971e231 •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2025-21953 – net: mana: cleanup mana struct after debugfs_remove()
https://notcve.org/view.php?id=CVE-2025-21953
01 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: net: mana: cleanup mana struct after debugfs_remove() When on a MANA VM hibernation is triggered, as part of hibernate_snapshot(), mana_gd_suspend() and mana_gd_resume() are called. If during this mana_gd_resume(), a failure occurs with HWC creation, mana_port_debugfs pointer does not get reinitialized and ends up pointing to older, cleaned-up dentry. Further in the hibernation path, as part of power_down(), mana_gd_shutdown() is triggered.... • https://git.kernel.org/stable/c/6607c17c6c5e029da03a90085db22daf518232bf •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2025-21952 – HID: corsair-void: Update power supply values with a unified work handler
https://notcve.org/view.php?id=CVE-2025-21952
01 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Update power supply values with a unified work handler corsair_void_process_receiver can be called from an interrupt context, locking battery_mutex in it was causing a kernel panic. Fix it by moving the critical section into its own work, sharing this work with battery_add_work and battery_remove_work to remove the need for any locking In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: ... • https://git.kernel.org/stable/c/6ea2a6fd3872e60a4d500b548ad65ed94e459ddd •