CVSS: 7.1EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38552 – mptcp: plug races between subflow fail and subflow creation
https://notcve.org/view.php?id=CVE-2025-38552
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: mptcp: plug races between subflow fail and subflow creation We have races similar to the one addressed by the previous patch between subflow failing and additional subflow creation. They are just harder to trigger. The solution is similar. Use a separate flag to track the condition 'socket state prevent any additional subflow creation' protected by the fallback lock. The socket fallback makes such flag true, and also receiving or sending an... • https://git.kernel.org/stable/c/478d770008b03ed9d74bdc8add2315b7fd124ecc •
CVSS: 7.1EPSS: 0%CPEs: 6EXPL: 0CVE-2025-38550 – ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
https://notcve.org/view.php?id=CVE-2025-38550
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec() does, the reference should be put after ip6_mc_clear_src() return. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ipv6: mcast: Retraso en la colocación de pmc->idev en mld_del_delrec() pmc->idev todavía se usa en ip6_mc_clear_src(), por lo que, como lo hace mld_clear_delrec(), la referencia s... • https://git.kernel.org/stable/c/63ed8de4be81b699ca727e9f8e3344bd487806d7 •
CVSS: 7.2EPSS: 0%CPEs: 7EXPL: 0CVE-2025-38548 – hwmon: (corsair-cpro) Validate the size of the received input buffer
https://notcve.org/view.php?id=CVE-2025-38548
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Validate the size of the received input buffer Add buffer_recv_size to store the size of the received bytes. Validate buffer_recv_size in send_usb_cmd(). En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: hwmon: (corsair-cpro) Validar el tamaño del búfer de entrada recibido. Añadir buffer_recv_size para almacenar el tamaño de los bytes recibidos. Validar buffer_recv_size en send_usb_cmd(). In the Linux ... • https://git.kernel.org/stable/c/40c3a445422579db8ad96c234dbe6c0ab3f6b936 •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2025-38546 – atm: clip: Fix memory leak of struct clip_vcc.
https://notcve.org/view.php?id=CVE-2025-38546
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix memory leak of struct clip_vcc. ioctl(ATMARP_MKIP) allocates struct clip_vcc and set it to vcc->user_back. The code assumes that vcc_destroy_socket() passes NULL skb to vcc->push() when the socket is close()d, and then clip_push() frees clip_vcc. However, ioctl(ATMARPD_CTRL) sets NULL to vcc->push() in atm_init_atmarp(), resulting in memory leak. Let's serialise two ioctl() by lock_sock() and check vcc->push() in atm_init_atm... • https://git.kernel.org/stable/c/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2025-38544 – rxrpc: Fix bug due to prealloc collision
https://notcve.org/view.php?id=CVE-2025-38544
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix bug due to prealloc collision When userspace is using AF_RXRPC to provide a server, it has to preallocate incoming calls and assign to them call IDs that will be used to thread related recvmsg() and sendmsg() together. The preallocated call IDs will automatically be attached to calls as they come in until the pool is empty. To the kernel, the call IDs are just arbitrary numbers, but userspace can use the call ID to hold a pointer... • https://git.kernel.org/stable/c/00e907127e6f86d0f9b122d9b4347a8aa09a8b61 •
CVSS: 6.6EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38543 – drm/tegra: nvdec: Fix dma_alloc_coherent error check
https://notcve.org/view.php?id=CVE-2025-38543
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/tegra: nvdec: Fix dma_alloc_coherent error check Check for NULL return value with dma_alloc_coherent, in line with Robin's fix for vic.c in 'drm/tegra: vic: Fix DMA API misuse'. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/tegra: nvdec: Corregir el error dma_alloc_coherent Compruebe si hay un valor de retorno NULL con dma_alloc_coherent, en línea con la corrección de Robin para vic.c en 'drm/tegra: vic: Corregi... • https://git.kernel.org/stable/c/46f226c93d35b936aeec6eb31da932dc2e86f413 •
CVSS: 6.6EPSS: 0%CPEs: 8EXPL: 0CVE-2025-38542 – net: appletalk: Fix device refcount leak in atrtr_create()
https://notcve.org/view.php?id=CVE-2025-38542
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: net: appletalk: Fix device refcount leak in atrtr_create() When updating an existing route entry in atrtr_create(), the old device reference was not being released before assigning the new device, leading to a device refcount leak. Fix this by calling dev_put() to release the old device reference before holding the new one. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: appletalk: Se corrige la fuga de referencia de... • https://git.kernel.org/stable/c/c7f905f0f6d49ed8c1aa4566c31f0383a0ba0c9d •
CVSS: 7.1EPSS: 0%CPEs: 8EXPL: 0CVE-2025-38540 – HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
https://notcve.org/view.php?id=CVE-2025-38540
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras The Chicony Electronics HP 5MP Cameras (USB ID 04F2:B824 & 04F2:B82C) report a HID sensor interface that is not actually implemented. Attempting to access this non-functional sensor via iio_info causes system hangs as runtime PM tries to wake up an unresponsive sensor. Add these 2 devices to the HID ignore list since the sensor interface is non-functional by design and should n... • https://git.kernel.org/stable/c/83499b52c61f50292f0aae36499de8a8fc3e37c3 •
CVSS: 7.1EPSS: 0%CPEs: 8EXPL: 0CVE-2025-38539 – tracing: Add down_write(trace_event_sem) when adding trace event
https://notcve.org/view.php?id=CVE-2025-38539
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: tracing: Add down_write(trace_event_sem) when adding trace event When a module is loaded, it adds trace events defined by the module. It may also need to modify the modules trace printk formats to replace enum names with their values. If two modules are loaded at the same time, the adding of the event to the ftrace_events list can corrupt the walking of the list in the code that is modifying the printk format strings and crash the kernel. T... • https://git.kernel.org/stable/c/110bf2b764eb6026b868d84499263cb24b1bcc8d •
CVSS: 7.1EPSS: 0%CPEs: 8EXPL: 0CVE-2025-38538 – dmaengine: nbpfaxi: Fix memory corruption in probe()
https://notcve.org/view.php?id=CVE-2025-38538
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: dmaengine: nbpfaxi: Fix memory corruption in probe() The nbpf->chan[] array is allocated earlier in the nbpf_probe() function and it has "num_channels" elements. These three loops iterate one element farther than they should and corrupt memory. The changes to the second loop are more involved. In this case, we're copying data from the irqbuf[] array into the nbpf->chan[] array. If the data in irqbuf[i] is the error IRQ then we skip it, so t... • https://git.kernel.org/stable/c/b45b262cefd5b8eb2ba88d20e5bd295881293894 •