CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2025-68223 – drm/radeon: delete radeon_fence_process in is_signaled, no deadlock
https://notcve.org/view.php?id=CVE-2025-68223
16 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/radeon: delete radeon_fence_process in is_signaled, no deadlock Delete the attempt to progress the queue when checking if fence is signaled. This avoids deadlock. dma-fence_ops::signaled can be called with the fence lock in unknown state. For radeon, the fence lock is also the wait queue lock. This can cause a self deadlock when signaled() tries to make forward progress on the wait queue. But advancing the queue is unneeded because inco... • https://git.kernel.org/stable/c/73bc12d6a547f9571ce4393acfd73c004e2df9e5 •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2025-68222 – pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc
https://notcve.org/view.php?id=CVE-2025-68222
16 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc s32_pinctrl_desc is allocated with devm_kmalloc(), but not all of its fields are initialized. Notably, num_custom_params is used in pinconf_generic_parse_dt_config(), resulting in intermittent allocation errors, such as the following splat when probing i2c-imx: WARNING: CPU: 0 PID: 176 at mm/page_alloc.c:4795 __alloc_pages_noprof+0x290/0x300 [...] Hardware name: NXP S32G3 Referenc... • https://git.kernel.org/stable/c/fd84aaa8173d3ff86f8df2009921336a1ea53a8a •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2025-68220 – net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error
https://notcve.org/view.php?id=CVE-2025-68220
16 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error Make knav_dma_open_channel consistently return NULL on error instead of ERR_PTR. Currently the header include/linux/soc/ti/knav_dma.h returns NULL when the driver is disabled, but the driver implementation does not even return NULL or ERR_PTR on failure, causing inconsistency in the users. This results in a crash in netcp_free_navigator_resources as followed... • https://git.kernel.org/stable/c/5b6cb43b4d625b04a4049d727a116edbfe5cf0f4 •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2025-68219 – cifs: fix memory leak in smb3_fs_context_parse_param error path
https://notcve.org/view.php?id=CVE-2025-68219
16 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: cifs: fix memory leak in smb3_fs_context_parse_param error path Add proper cleanup of ctx->source and fc->source to the cifs_parse_mount_err error handler. This ensures that memory allocated for the source strings is correctly freed on all error paths, matching the cleanup already performed in the success path by smb3_cleanup_fs_context_contents(). Pointers are also set to NULL after freeing to prevent potential double-free issues. This cha... • https://git.kernel.org/stable/c/24e0a1eff9e2b9835a6e7c17039dfb6ecfd81f1f •
CVSS: 5.6EPSS: 0%CPEs: 6EXPL: 0CVE-2025-68218 – nvme-multipath: fix lockdep WARN due to partition scan work
https://notcve.org/view.php?id=CVE-2025-68218
16 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix lockdep WARN due to partition scan work Blktests test cases nvme/014, 057 and 058 fail occasionally due to a lockdep WARN. As reported in the Closes tag URL, the WARN indicates that a deadlock can happen due to the dependency among disk->open_mutex, kblockd workqueue completion and partition_scan_work completion. To avoid the lockdep WARN and the potential deadlock, cut the dependency by running the partition_scan_work n... • https://git.kernel.org/stable/c/60de2e03f984cfbcdc12fa552f95087c35a05a98 •
CVSS: 7.1EPSS: 0%CPEs: 8EXPL: 0CVE-2025-68217 – Input: pegasus-notetaker - fix potential out-of-bounds access
https://notcve.org/view.php?id=CVE-2025-68217
16 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: Input: pegasus-notetaker - fix potential out-of-bounds access In the pegasus_notetaker driver, the pegasus_probe() function allocates the URB transfer buffer using the wMaxPacketSize value from the endpoint descriptor. An attacker can use a malicious USB descriptor to force the allocation of a very small buffer. Subsequently, if the device sends an interrupt packet with a specific pattern (e.g., where the first byte is 0x80 or 0x42), the pe... • https://git.kernel.org/stable/c/1afca2b66aac7ac262d3511c68725e9e7053b40f •
CVSS: 4.7EPSS: 0%CPEs: 5EXPL: 0CVE-2025-68214 – timers: Fix NULL function pointer race in timer_shutdown_sync()
https://notcve.org/view.php?id=CVE-2025-68214
16 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: timers: Fix NULL function pointer race in timer_shutdown_sync() There is a race condition between timer_shutdown_sync() and timer expiration that can lead to hitting a WARN_ON in expire_timers(). The issue occurs when timer_shutdown_sync() clears the timer function to NULL while the timer is still running on another CPU. The race scenario looks like this: CPU0 CPU1
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-68211 – ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
https://notcve.org/view.php?id=CVE-2025-68211
16 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item Currently, scan_get_next_rmap_item() walks every page address in a VMA to locate mergeable pages. This becomes highly inefficient when scanning large virtual memory areas that contain mostly unmapped regions, causing ksmd to use large amount of cpu without deduplicating much pages. This patch replaces the per-address lookup with a range walk using walk_page_range(). ... • https://git.kernel.org/stable/c/31dbd01f314364b70c2e026a5793a29a4da8a9dc •
CVSS: 6.6EPSS: 0%CPEs: 2EXPL: 0CVE-2025-68209 – mlx5: Fix default values in create CQ
https://notcve.org/view.php?id=CVE-2025-68209
16 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: mlx5: Fix default values in create CQ Currently, CQs without a completion function are assigned the mlx5_add_cq_to_tasklet function by default. This is problematic since only user CQs created through the mlx5_ib driver are intended to use this function. Additionally, all CQs that will use doorbells instead of polling for completions must call mlx5_cq_arm. However, the default CQ creation flow leaves a valid value in the CQ's arm_db field, a... • https://git.kernel.org/stable/c/cdd04f4d4d71cbf93d0d9abe63bc838f47c467fa •
CVSS: 8.5EPSS: 0%CPEs: 4EXPL: 0CVE-2025-68208 – bpf: account for current allocated stack depth in widen_imprecise_scalars()
https://notcve.org/view.php?id=CVE-2025-68208
16 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: bpf: account for current allocated stack depth in widen_imprecise_scalars() The usage pattern for widen_imprecise_scalars() looks as follows: prev_st = find_prev_entry(env, ...); queued_st = push_stack(...); widen_imprecise_scalars(env, prev_st, queued_st); Where prev_st is an ancestor of the queued_st in the explored states tree. This ancestor is not guaranteed to have same allocated stack depth as queued_st. E.g. in the following case: de... • https://git.kernel.org/stable/c/ab470fefce2837e66b771c60858118d50bb5bb10 •