CVSS: 5.5EPSS: %CPEs: 6EXPL: 0CVE-2025-71119 – powerpc/kexec: Enable SMT before waking offline CPUs
https://notcve.org/view.php?id=CVE-2025-71119
14 Jan 2026 — In the Linux kernel, the following vulnerability has been resolved: powerpc/kexec: Enable SMT before waking offline CPUs If SMT is disabled or a partial SMT state is enabled, when a new kernel image is loaded for kexec, on reboot the following warning is observed: kexec: Waking offline cpu 228. WARNING: CPU: 0 PID: 9062 at arch/powerpc/kexec/core_64.c:223 kexec_prepare_cpus+0x1b0/0x1bc [snip] NIP kexec_prepare_cpus+0x1b0/0x1bc LR kexec_prepare_cpus+0x1a0/0x1bc Call Trace: kexec_prepare_cpus+0x1a0/0x1bc (unr... • https://git.kernel.org/stable/c/482fa21635c8832db022cd2d649db26b8e6170ac •
CVSS: 5.5EPSS: %CPEs: 5EXPL: 0CVE-2025-71118 – ACPICA: Avoid walking the Namespace if start_node is NULL
https://notcve.org/view.php?id=CVE-2025-71118
14 Jan 2026 — In the Linux kernel, the following vulnerability has been resolved: ACPICA: Avoid walking the Namespace if start_node is NULL Although commit 0c9992315e73 ("ACPICA: Avoid walking the ACPI Namespace if it is not there") fixed the situation when both start_node and acpi_gbl_root_node are NULL, the Linux kernel mainline now still crashed on Honor Magicbook 14 Pro [1]. That happens due to the access to the member of parent_node in acpi_ns_get_next_node(). The NULL pointer dereference will always happen, no matt... • https://git.kernel.org/stable/c/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 •
CVSS: 7.5EPSS: %CPEs: 5EXPL: 0CVE-2025-71116 – libceph: make decode_pool() more resilient against corrupted osdmaps
https://notcve.org/view.php?id=CVE-2025-71116
14 Jan 2026 — In the Linux kernel, the following vulnerability has been resolved: libceph: make decode_pool() more resilient against corrupted osdmaps If the osdmap is (maliciously) corrupted such that the encoded length of ceph_pg_pool envelope is less than what is expected for a particular encoding version, out-of-bounds reads may ensue because the only bounds check that is there is based on that length value. This patch adds explicit bounds checks for each field that is decoded or skipped. In the Linux kernel, the fol... • https://git.kernel.org/stable/c/4f6a7e5ee1393ec4b243b39dac9f36992d161540 •
CVSS: 7.1EPSS: %CPEs: 5EXPL: 0CVE-2025-71114 – via_wdt: fix critical boot hang due to unnamed resource allocation
https://notcve.org/view.php?id=CVE-2025-71114
14 Jan 2026 — In the Linux kernel, the following vulnerability has been resolved: via_wdt: fix critical boot hang due to unnamed resource allocation The VIA watchdog driver uses allocate_resource() to reserve a MMIO region for the watchdog control register. However, the allocated resource was not given a name, which causes the kernel resource tree to contain an entry marked as "
CVSS: 6.4EPSS: %CPEs: 5EXPL: 0CVE-2025-71113 – crypto: af_alg - zero initialize memory allocated via sock_kmalloc
https://notcve.org/view.php?id=CVE-2025-71113
14 Jan 2026 — In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - zero initialize memory allocated via sock_kmalloc Several crypto user API contexts and requests allocated with sock_kmalloc() were left uninitialized, relying on callers to set fields explicitly. This resulted in the use of uninitialized data in certain error paths or when new fields are added in the future. The ACVP patches also contain two user-space interface files: algif_kpp.c and algif_akcipher.c. These too rely on pro... • https://git.kernel.org/stable/c/fe869cdb89c95d060c77eea20204d6c91f233b53 •
CVSS: 7.5EPSS: %CPEs: 5EXPL: 0CVE-2025-71112 – net: hns3: add VLAN id validation before using
https://notcve.org/view.php?id=CVE-2025-71112
14 Jan 2026 — In the Linux kernel, the following vulnerability has been resolved: net: hns3: add VLAN id validation before using Currently, the VLAN id may be used without validation when receive a VLAN configuration mailbox from VF. The length of vlan_del_fail_bmap is BITS_TO_LONGS(VLAN_N_VID). It may cause out-of-bounds memory access once the VLAN id is bigger than or equal to VLAN_N_VID. Therefore, VLAN id needs to be checked to ensure it is within the range of VLAN_N_VID. In the Linux kernel, the following vulnerabil... • https://git.kernel.org/stable/c/fe4144d47eef8453459c53a34e9d5940a3e6c219 •
CVSS: 6.9EPSS: %CPEs: 5EXPL: 0CVE-2025-71111 – hwmon: (w83791d) Convert macros to functions to avoid TOCTOU
https://notcve.org/view.php?id=CVE-2025-71111
14 Jan 2026 — In the Linux kernel, the following vulnerability has been resolved: hwmon: (w83791d) Convert macros to functions to avoid TOCTOU The macro FAN_FROM_REG evaluates its arguments multiple times. When used in lockless contexts involving shared driver data, this leads to Time-of-Check to Time-of-Use (TOCTOU) race conditions, potentially causing divide-by-zero errors. Convert the macro to a static function. This guarantees that arguments are evaluated only once (pass-by-value), preventing the race conditions. Add... • https://git.kernel.org/stable/c/9873964d6eb24bd0205394f9b791de9eddbcb855 •
CVSS: 7.8EPSS: %CPEs: 3EXPL: 0CVE-2025-71109 – MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits
https://notcve.org/view.php?id=CVE-2025-71109
14 Jan 2026 — In the Linux kernel, the following vulnerability has been resolved: MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits Since commit e424054000878 ("MIPS: Tracing: Reduce the overhead of dynamic Function Tracer"), the macro UASM_i_LA_mostly has been used, and this macro can generate more than 2 instructions. At the same time, the code in ftrace assumes that no more than 2 instructions can be generated, which is why it stores them in an int[2] array. However, as previously noted, the ma... • https://git.kernel.org/stable/c/e424054000878d7eb11e44289242886d6e219d22 •
CVSS: 6.6EPSS: %CPEs: 5EXPL: 0CVE-2025-71108 – usb: typec: ucsi: Handle incorrect num_connectors capability
https://notcve.org/view.php?id=CVE-2025-71108
14 Jan 2026 — In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Handle incorrect num_connectors capability The UCSI spec states that the num_connectors field is 7 bits, and the 8th bit is reserved and should be set to zero. Some buggy FW has been known to set this bit, and it can lead to a system not booting. Flag that the FW is not behaving correctly, and auto-fix the value so that the system boots correctly. Found on Lenovo P1 G8 during Linux enablement program. The FW will be fixed,... • https://git.kernel.org/stable/c/f72f97d0aee4a993a35f2496bca5efd24827235d •
CVSS: 5.5EPSS: %CPEs: 5EXPL: 0CVE-2025-71107 – f2fs: ensure node page reads complete before f2fs_put_super() finishes
https://notcve.org/view.php?id=CVE-2025-71107
14 Jan 2026 — In the Linux kernel, the following vulnerability has been resolved: f2fs: ensure node page reads complete before f2fs_put_super() finishes Xfstests generic/335, generic/336 sometimes crash with the following message: F2FS-fs (dm-0): detect filesystem reference count leak during umount, type: 9, count: 1 ------------[ cut here ]------------ kernel BUG at fs/f2fs/super.c:1939! Oops: invalid opcode: 0000 [#1] SMP NOPTI CPU: 1 UID: 0 PID: 609351 Comm: umount Tainted: G W 6.17.0-rc5-xfstests-g9dd1835ecda5 #1 PRE... • https://git.kernel.org/stable/c/20872584b8c0b006c007da9588a272c9e28d2e18 •