CVSS: -EPSS: %CPEs: 5EXPL: 0CVE-2025-38131 – coresight: prevent deactivate active config while enabling the config
https://notcve.org/view.php?id=CVE-2025-38131
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: coresight: prevent deactivate active config while enabling the config While enable active config via cscfg_csdev_enable_active_config(), active config could be deactivated via configfs' sysfs interface. This could make UAF issue in below scenario: CPU0 CPU1 (sysfs enable) load module cscfg_load_config_sets() activate config. // sysfs (sys_active_cnt == 1) ... cscfg_csdev_enable_active_config() lock(csdev->cscfg_csdev_lock) // here load conf... • https://git.kernel.org/stable/c/f8cce2ff3c04361b8843d8489620fda8880f668b •
CVSS: -EPSS: %CPEs: 3EXPL: 0CVE-2025-38129 – page_pool: Fix use-after-free in page_pool_recycle_in_ring
https://notcve.org/view.php?id=CVE-2025-38129
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: page_pool: Fix use-after-free in page_pool_recycle_in_ring syzbot reported a uaf in page_pool_recycle_in_ring: BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862 Read of size 8 at addr ffff8880286045a0 by task syz.0.284/6943 CPU: 0 UID: 0 PID: 6943 Comm: syz.0.284 Not tainted 6.13.0-rc3-syzkaller-gdfa94ce54f41 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 ... • https://git.kernel.org/stable/c/ff7d6b27f894f1469dc51ccb828b7363ccd9799f •
CVSS: -EPSS: %CPEs: 4EXPL: 0CVE-2025-38127 – ice: fix Tx scheduler error handling in XDP callback
https://notcve.org/view.php?id=CVE-2025-38127
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: ice: fix Tx scheduler error handling in XDP callback When the XDP program is loaded, the XDP callback adds new Tx queues. This means that the callback must update the Tx scheduler with the new queue number. In the event of a Tx scheduler failure, the XDP callback should also fail and roll back any changes previously made for XDP preparation. The previous implementation had a bug that not all changes made by the XDP callback were rolled back... • https://git.kernel.org/stable/c/efc2214b6047b6f5b4ca53151eba62521b9452d6 •
CVSS: -EPSS: %CPEs: 5EXPL: 0CVE-2025-38126 – net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping
https://notcve.org/view.php?id=CVE-2025-38126
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping The stmmac platform drivers that do not open-code the clk_ptp_rate value after having retrieved the default one from the device-tree can end up with 0 in clk_ptp_rate (as clk_get_rate can return 0). It will eventually propagate up to PTP initialization when bringing up the interface, leading to a divide by 0: Division by zero in kernel. CPU: 1 UID: 0 PID: 1 Comm: ... • https://git.kernel.org/stable/c/19d857c9038e5c07db8f8cc02b5ad0cd0098714f •
CVSS: -EPSS: %CPEs: 3EXPL: 0CVE-2025-38125 – net: stmmac: make sure that ptp_rate is not 0 before configuring EST
https://notcve.org/view.php?id=CVE-2025-38125
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: net: stmmac: make sure that ptp_rate is not 0 before configuring EST If the ptp_rate recorded earlier in the driver happens to be 0, this bogus value will propagate up to EST configuration, where it will trigger a division by 0. Prevent this division by 0 by adding the corresponding check and error code. • https://git.kernel.org/stable/c/8572aec3d0dc43045254fd1bf581fb980bfdbc4b •
CVSS: -EPSS: %CPEs: 6EXPL: 0CVE-2025-38122 – gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO
https://notcve.org/view.php?id=CVE-2025-38122
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO gve_alloc_pending_packet() can return NULL, but gve_tx_add_skb_dqo() did not check for this case before dereferencing the returned pointer. Add a missing NULL check to prevent a potential NULL pointer dereference when allocation fails. This improves robustness in low-memory scenarios. • https://git.kernel.org/stable/c/a57e5de476be0b4b7f42beb6a21c19ad9c577aa3 •
CVSS: -EPSS: %CPEs: 7EXPL: 0CVE-2025-38120 – netfilter: nf_set_pipapo_avx2: fix initial map fill
https://notcve.org/view.php?id=CVE-2025-38120
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_set_pipapo_avx2: fix initial map fill If the first field doesn't cover the entire start map, then we must zero out the remainder, else we leak those bits into the next match round map. The early fix was incomplete and did only fix up the generic C implementation. A followup patch adds a test case to nft_concat_range.sh. • https://git.kernel.org/stable/c/957a4d1c4c5849e4515c9fb4db21bf85318103dc •
CVSS: -EPSS: %CPEs: 6EXPL: 0CVE-2025-38119 – scsi: core: ufs: Fix a hang in the error handler
https://notcve.org/view.php?id=CVE-2025-38119
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: scsi: core: ufs: Fix a hang in the error handler ufshcd_err_handling_prepare() calls ufshcd_rpm_get_sync(). The latter function can only succeed if UFSHCD_EH_IN_PROGRESS is not set because resuming involves submitting a SCSI command and ufshcd_queuecommand() returns SCSI_MLQUEUE_HOST_BUSY if UFSHCD_EH_IN_PROGRESS is set. Fix this hang by setting UFSHCD_EH_IN_PROGRESS after ufshcd_rpm_get_sync() has been called instead of before. Backtrace: ... • https://git.kernel.org/stable/c/62694735ca95c74dac4eb9068d59801ac0ddebaf •
CVSS: -EPSS: %CPEs: 5EXPL: 0CVE-2025-38118 – Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete
https://notcve.org/view.php?id=CVE-2025-38118
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete This reworks MGMT_OP_REMOVE_ADV_MONITOR to not use mgmt_pending_add to avoid crashes like bellow: ================================================================== BUG: KASAN: slab-use-after-free in mgmt_remove_adv_monitor_complete+0xe5/0x540 net/bluetooth/mgmt.c:5406 Read of size 8 at addr ffff88801c53f318 by task kworker/u5:5/5341 CPU: 0 UID: 0 PID: 5341 Comm: kworker/u5:5 Not ... • https://git.kernel.org/stable/c/66bd095ab5d408af106808cce302406542f70f65 •
CVSS: -EPSS: %CPEs: 4EXPL: 0CVE-2025-38117 – Bluetooth: MGMT: Protect mgmt_pending list with its own lock
https://notcve.org/view.php?id=CVE-2025-38117
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Protect mgmt_pending list with its own lock This uses a mutex to protect from concurrent access of mgmt_pending list which can cause crashes like: ================================================================== BUG: KASAN: slab-use-after-free in hci_sock_get_channel+0x60/0x68 net/bluetooth/hci_sock.c:91 Read of size 2 at addr ffff0000c48885b2 by task syz.4.334/7318 CPU: 0 UID: 0 PID: 7318 Comm: syz.4.334 Not tainted 6.15... • https://git.kernel.org/stable/c/a380b6cff1a2d2139772e88219d08330f84d0381 •