CVSS: -EPSS: %CPEs: 5EXPL: 0CVE-2025-38062 – genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie
https://notcve.org/view.php?id=CVE-2025-38062
18 Jun 2025 — In the Linux kernel, the following vulnerability has been resolved: genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie The IOMMU translation for MSI message addresses has been a 2-step process, separated in time: 1) iommu_dma_prepare_msi(): A cookie pointer containing the IOVA address is stored in the MSI descriptor when an MSI interrupt is allocated. 2) iommu_dma_compose_msi_msg(): this cookie pointer is used to compute a translated message address. This has an inherent lifetime ... • https://git.kernel.org/stable/c/e4d3763223c7b72ded53425207075e7453b4e3d5 •
CVSS: -EPSS: %CPEs: 8EXPL: 0CVE-2025-38061 – net: pktgen: fix access outside of user given buffer in pktgen_thread_write()
https://notcve.org/view.php?id=CVE-2025-38061
18 Jun 2025 — In the Linux kernel, the following vulnerability has been resolved: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() Honour the user given buffer size for the strn_len() calls (otherwise strn_len() will access memory outside of the user given buffer). • https://git.kernel.org/stable/c/a3d89f1cfe1e6d4bb164db2595511fd33db21900 •
CVSS: -EPSS: %CPEs: 3EXPL: 0CVE-2025-38060 – bpf: copy_verifier_state() should copy 'loop_entry' field
https://notcve.org/view.php?id=CVE-2025-38060
18 Jun 2025 — In the Linux kernel, the following vulnerability has been resolved: bpf: copy_verifier_state() should copy 'loop_entry' field The bpf_verifier_state.loop_entry state should be copied by copy_verifier_state(). Otherwise, .loop_entry values from unrelated states would poison env->cur_state. Additionally, env->stack should not contain any states with .loop_entry != NULL. The states in env->stack are yet to be verified, while .loop_entry is set for states that reached an equivalent state. This means that env->c... • https://git.kernel.org/stable/c/46ba5757a7a4714e7d3f68cfe118208822cb3d78 •
CVSS: -EPSS: %CPEs: 4EXPL: 0CVE-2025-38059 – btrfs: avoid NULL pointer dereference if no valid csum tree
https://notcve.org/view.php?id=CVE-2025-38059
18 Jun 2025 — In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid NULL pointer dereference if no valid csum tree [BUG] When trying read-only scrub on a btrfs with rescue=idatacsums mount option, it will crash with the following call trace: BUG: kernel NULL pointer dereference, address: 0000000000000208 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page CPU: 1 UID: 0 PID: 835 Comm: btrfs Tainted: G O 6.15.0-rc3-custom+ #236 PREEMPT(full) Hardware name: QEMU S... • https://git.kernel.org/stable/c/50d0de59f66cbe6d597481e099bf1c70fd07e0a9 •
CVSS: -EPSS: %CPEs: 8EXPL: 0CVE-2025-38058 – __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
https://notcve.org/view.php?id=CVE-2025-38058
18 Jun 2025 — In the Linux kernel, the following vulnerability has been resolved: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock ... or we risk stealing final mntput from sync umount - raising mnt_count after umount(2) has verified that victim is not busy, but before it has set MNT_SYNC_UMOUNT; in that case __legitimize_mnt() doesn't see that it's safe to quietly undo mnt_count increment and leaves dropping the reference to caller, where it'll be a full-blown mntput(). Check under mount_lock is ... • https://git.kernel.org/stable/c/628fb00195ce21a90cf9e4e3d105cd9e58f77b40 •
CVSS: -EPSS: %CPEs: 3EXPL: 0CVE-2025-38057 – espintcp: fix skb leaks
https://notcve.org/view.php?id=CVE-2025-38057
18 Jun 2025 — In the Linux kernel, the following vulnerability has been resolved: espintcp: fix skb leaks A few error paths are missing a kfree_skb. • https://git.kernel.org/stable/c/e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 •
CVSS: -EPSS: %CPEs: 3EXPL: 0CVE-2025-38056 – ASoC: SOF: Intel: hda: Fix UAF when reloading module
https://notcve.org/view.php?id=CVE-2025-38056
18 Jun 2025 — In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Fix UAF when reloading module hda_generic_machine_select() appends -idisp to the tplg filename by allocating a new string with devm_kasprintf(), then stores the string right back into the global variable snd_soc_acpi_intel_hda_machines. When the module is unloaded, this memory is freed, resulting in a global variable pointing to freed memory. Reloading the module then triggers a use-after-free: BUG: KFENCE: use-after-... • https://git.kernel.org/stable/c/5458411d75947a4212e50a401ec0a98d4c6c931b •
CVSS: -EPSS: %CPEs: 4EXPL: 0CVE-2025-38055 – perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq
https://notcve.org/view.php?id=CVE-2025-38055
18 Jun 2025 — In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq Currently, using PEBS-via-PT with a sample frequency instead of a sample period, causes a segfault. For example: BUG: kernel NULL pointer dereference, address: 0000000000000195 <NMI> ? __die_body.cold+0x19/0x27 ? page_fault_oops+0xca/0x290 ? exc_page_fault+0x7e/0x1b0 ? • https://git.kernel.org/stable/c/722e42e45c2f1c6d1adec7813651dba5139f52f4 •
CVSS: -EPSS: %CPEs: 3EXPL: 0CVE-2025-38054 – ptp: ocp: Limit signal/freq counts in summary output functions
https://notcve.org/view.php?id=CVE-2025-38054
18 Jun 2025 — In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: Limit signal/freq counts in summary output functions The debugfs summary output could access uninitialized elements in the freq_in[] and signal_out[] arrays, causing NULL pointer dereferences and triggering a kernel Oops (page_fault_oops). This patch adds u8 fields (nr_freq_in, nr_signal_out) to track the number of initialized elements, with a maximum of 4 per array. The summary output functions are updated to respect these limits... • https://git.kernel.org/stable/c/ef61f5528fca6c3bbb2f8bc002fd1949c9d1f9b9 •
CVSS: -EPSS: %CPEs: 3EXPL: 0CVE-2025-38053 – idpf: fix null-ptr-deref in idpf_features_check
https://notcve.org/view.php?id=CVE-2025-38053
18 Jun 2025 — In the Linux kernel, the following vulnerability has been resolved: idpf: fix null-ptr-deref in idpf_features_check idpf_features_check is used to validate the TX packet. skb header length is compared with the hardware supported value received from the device control plane. The value is stored in the adapter structure and to access it, vport pointer is used. During reset all the vports are released and the vport pointer that the netdev private structure points to is NULL. To avoid null-ptr-deref, store the ... • https://git.kernel.org/stable/c/a251eee62133774cf35ff829041377e721ef9c8c •