CVSS: 7.1EPSS: 0%CPEs: 8EXPL: 0CVE-2025-68217 – Input: pegasus-notetaker - fix potential out-of-bounds access
https://notcve.org/view.php?id=CVE-2025-68217
16 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: Input: pegasus-notetaker - fix potential out-of-bounds access In the pegasus_notetaker driver, the pegasus_probe() function allocates the URB transfer buffer using the wMaxPacketSize value from the endpoint descriptor. An attacker can use a malicious USB descriptor to force the allocation of a very small buffer. Subsequently, if the device sends an interrupt packet with a specific pattern (e.g., where the first byte is 0x80 or 0x42), the pe... • https://git.kernel.org/stable/c/1afca2b66aac7ac262d3511c68725e9e7053b40f •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2025-68211 – ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
https://notcve.org/view.php?id=CVE-2025-68211
16 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item Currently, scan_get_next_rmap_item() walks every page address in a VMA to locate mergeable pages. This becomes highly inefficient when scanning large virtual memory areas that contain mostly unmapped regions, causing ksmd to use large amount of cpu without deduplicating much pages. This patch replaces the per-address lookup with a range walk using walk_page_range(). ... • https://git.kernel.org/stable/c/31dbd01f314364b70c2e026a5793a29a4da8a9dc •
CVSS: 9.4EPSS: 0%CPEs: 3EXPL: 0CVE-2025-68206 – netfilter: nft_ct: add seqadj extension for natted connections
https://notcve.org/view.php?id=CVE-2025-68206
16 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: add seqadj extension for natted connections Sequence adjustment may be required for FTP traffic with PASV/EPSV modes. due to need to re-write packet payload (IP, port) on the ftp control connection. This can require changes to the TCP length and expected seq / ack_seq. The easiest way to reproduce this issue is with PASV mode. Example ruleset: table inet ftp_nat { ct helper ftp_helper { type "ftp" protocol tcp l3proto ine... • https://git.kernel.org/stable/c/1a64edf54f55d7956cf5a0d95898bc1f84f9b818 •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2025-68204 – pmdomain: arm: scmi: Fix genpd leak on provider registration failure
https://notcve.org/view.php?id=CVE-2025-68204
16 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: pmdomain: arm: scmi: Fix genpd leak on provider registration failure If of_genpd_add_provider_onecell() fails during probe, the previously created generic power domains are not removed, leading to a memory leak and potential kernel crash later in genpd_debug_add(). Add proper error handling to unwind the initialized domains before returning from probe to ensure all resources are correctly released on failure. Example crash trace observed wi... • https://git.kernel.org/stable/c/898216c97ed2ebfffda659ce12388da43534de6c •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2025-68194 – media: imon: make send_packet() more robust
https://notcve.org/view.php?id=CVE-2025-68194
16 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: media: imon: make send_packet() more robust syzbot is reporting that imon has three problems which result in hung tasks due to forever holding device lock [1]. First problem is that when usb_rx_callback_intf0() once got -EPROTO error after ictx->dev_present_intf0 became true, usb_rx_callback_intf0() resubmits urb after printk(), and resubmitted urb causes usb_rx_callback_intf0() to again get -EPROTO error. This results in printk() flooding ... • https://git.kernel.org/stable/c/21677cfc562a27e099719d413287bc8d1d24deb7 •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2025-68192 – net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
https://notcve.org/view.php?id=CVE-2025-68192
16 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup Raw IP packets have no MAC header, leaving skb->mac_header uninitialized. This can trigger kernel panics on ARM64 when xfrm or other subsystems access the offset due to strict alignment checks. Initialize the MAC header to prevent such crashes. This can trigger kernel panics on ARM when running IPsec over the qmimux0 interface. Example trace: Internal error: Oops: 000000009... • https://git.kernel.org/stable/c/c6adf77953bcec0ad63d7782479452464e50f7a3 •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-68190 – drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked()
https://notcve.org/view.php?id=CVE-2025-68190
16 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() kcalloc() may fail. When WS is non-zero and allocation fails, ectx.ws remains NULL while ectx.ws_size is set, leading to a potential NULL pointer dereference in atom_get_src_int() when accessing WS entries. Return -ENOMEM on allocation failure to avoid the NULL dereference. In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/atom:... • https://git.kernel.org/stable/c/d38ceaf99ed015f2a0b9af3499791bd3a3daae21 •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2025-68188 – tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()
https://notcve.org/view.php?id=CVE-2025-68188
16 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() Use RCU to avoid a pair of atomic operations and a potential UAF on dst_dev()->flags. In the Linux kernel, the following vulnerability has been resolved: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() Use RCU to avoid a pair of atomic operations and a potential UAF on dst_dev()->flags. • https://git.kernel.org/stable/c/cf1ef3f0719b4dcb74810ed507e2a2540f9811b4 •
CVSS: 6.9EPSS: 0%CPEs: 8EXPL: 0CVE-2025-68185 – nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing
https://notcve.org/view.php?id=CVE-2025-68185
16 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing Theoretically it's an oopsable race, but I don't believe one can manage to hit it on real hardware; might become doable on a KVM, but it still won't be easy to attack. Anyway, it's easy to deal with - since xdr_encode_hyper() is just a call of put_unaligned_be64(), we can put that under ->d_lock and be done with that. In the Linux kernel, the following vulnerab... • https://git.kernel.org/stable/c/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2025-68177 – cpufreq/longhaul: handle NULL policy in longhaul_exit
https://notcve.org/view.php?id=CVE-2025-68177
16 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: cpufreq/longhaul: handle NULL policy in longhaul_exit longhaul_exit() was calling cpufreq_cpu_get(0) without checking for a NULL policy pointer. On some systems, this could lead to a NULL dereference and a kernel warning or panic. This patch adds a check using unlikely() and returns early if the policy is NULL. Bugzilla: #219962 In the Linux kernel, the following vulnerability has been resolved: cpufreq/longhaul: handle NULL policy in longh... • https://git.kernel.org/stable/c/b43a7ffbf33be7e4d3b10b7714ee663ea2c52fe2 •