CVSS: -EPSS: %CPEs: 7EXPL: 0CVE-2025-22060 – net: mvpp2: Prevent parser TCAM memory corruption
https://notcve.org/view.php?id=CVE-2025-22060
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: Prevent parser TCAM memory corruption Protect the parser TCAM/SRAM memory, and the cached (shadow) SRAM information, from concurrent modifications. Both the TCAM and SRAM tables are indirectly accessed by configuring an index register that selects the row to read or write to. This means that operations must be atomic in order to, e.g., avoid spreading writes across multiple rows. Since the shadow SRAM array is used to find free ... • https://git.kernel.org/stable/c/3f518509dedc99f0b755d2ce68d24f610e3a005a •
CVSS: -EPSS: %CPEs: 6EXPL: 0CVE-2025-22058 – udp: Fix memory accounting leak.
https://notcve.org/view.php?id=CVE-2025-22058
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: udp: Fix memory accounting leak. Matt Dowling reported a weird UDP memory usage issue. Under normal operation, the UDP memory usage reported in /proc/net/sockstat remains close to zero. However, it occasionally spiked to 524,288 pages and never dropped. Moreover, the value doubled when the application was terminated. • https://git.kernel.org/stable/c/f970bd9e3a06f06df8d8ecf1f8ad2c8615cc17eb •
CVSS: -EPSS: %CPEs: 5EXPL: 0CVE-2025-22057 – net: decrease cached dst counters in dst_release
https://notcve.org/view.php?id=CVE-2025-22057
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: net: decrease cached dst counters in dst_release Upstream fix ac888d58869b ("net: do not delay dst_entries_add() in dst_release()") moved decrementing the dst count from dst_destroy to dst_release to avoid accessing already freed data in case of netns dismantle. However in case CONFIG_DST_CACHE is enabled and OvS+tunnels are used, this fix is incomplete as the same issue will be seen for cached dsts: Unable to handle kernel paging request a... • https://git.kernel.org/stable/c/d71785ffc7e7cae3fbdc4ea8a9d05b7a1c59f7b8 •
CVSS: -EPSS: %CPEs: 8EXPL: 0CVE-2025-22056 – netfilter: nft_tunnel: fix geneve_opt type confusion addition
https://notcve.org/view.php?id=CVE-2025-22056
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix geneve_opt type confusion addition When handling multiple NFTA_TUNNEL_KEY_OPTS_GENEVE attributes, the parsing logic should place every geneve_opt structure one by one compactly. Hence, when deciding the next geneve_opt position, the pointer addition should be in units of char *. However, the current implementation erroneously does type conversion before the addition, which will lead to heap out-of-bounds write. [ ... • https://git.kernel.org/stable/c/925d844696d9287f841d6b3e0ed62a35fb175970 •
CVSS: -EPSS: %CPEs: 8EXPL: 0CVE-2025-22055 – net: fix geneve_opt length integer overflow
https://notcve.org/view.php?id=CVE-2025-22055
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: net: fix geneve_opt length integer overflow struct geneve_opt uses 5 bit length for each single option, which means every vary size option should be smaller than 128 bytes. However, all current related Netlink policies cannot promise this length condition and the attacker can exploit a exact 128-byte size option to *fake* a zero length option and confuse the parsing logic, further achieve heap out-of-bounds read. One example crash log is li... • https://git.kernel.org/stable/c/0ed5269f9e41f495c8e9020c85f5e1644c1afc57 •
CVSS: -EPSS: %CPEs: 10EXPL: 0CVE-2025-22054 – arcnet: Add NULL check in com20020pci_probe()
https://notcve.org/view.php?id=CVE-2025-22054
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: arcnet: Add NULL check in com20020pci_probe() devm_kasprintf() returns NULL when memory allocation fails. Currently, com20020pci_probe() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this issue and ensure no resources are left allocated. • https://git.kernel.org/stable/c/e38cd53421ed4e37fc99662a0f2a0c567993844f •
CVSS: -EPSS: %CPEs: 5EXPL: 0CVE-2025-22053 – net: ibmveth: make veth_pool_store stop hanging
https://notcve.org/view.php?id=CVE-2025-22053
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: net: ibmveth: make veth_pool_store stop hanging v2: - Created a single error handling unlock and exit in veth_pool_store - Greatly expanded commit message with previous explanatory-only text Summary: Use rtnl_mutex to synchronize veth_pool_store with itself, ibmveth_close and ibmveth_open, preventing multiple calls in a row to napi_disable. Background: Two (or more) threads could call veth_pool_store through writing to /sys/devices/vio/3000... • https://git.kernel.org/stable/c/860f242eb5340d0b0cfe243cb86b2a98f92e8b91 •
CVSS: -EPSS: %CPEs: 9EXPL: 0CVE-2025-22050 – usbnet:fix NPE during rx_complete
https://notcve.org/view.php?id=CVE-2025-22050
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: usbnet:fix NPE during rx_complete Missing usbnet_going_away Check in Critical Path. The usb_submit_urb function lacks a usbnet_going_away validation, whereas __usbnet_queue_skb includes this check. This inconsistency creates a race condition where: A URB request may succeed, but the corresponding SKB data fails to be queued. Subsequent processes: (e.g., rx_complete → defer_bh → __skb_unlink(skb, list)) attempt to access skb->next, triggerin... • https://git.kernel.org/stable/c/b80aacfea6e8d6ed6e430aa13922d6ccf044415a •
CVSS: -EPSS: %CPEs: 6EXPL: 0CVE-2025-22049 – LoongArch: Increase ARCH_DMA_MINALIGN up to 16
https://notcve.org/view.php?id=CVE-2025-22049
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: LoongArch: Increase ARCH_DMA_MINALIGN up to 16 ARCH_DMA_MINALIGN is 1 by default, but some LoongArch-specific devices (such as APBDMA) require 16 bytes alignment. When the data buffer length is too small, the hardware may make an error writing cacheline. Thus, it is dangerous to allocate a small memory buffer for DMA. It's always safe to define ARCH_DMA_MINALIGN as L1_CACHE_BYTES but unnecessary (kmalloc() need small memory objects). Theref... • https://git.kernel.org/stable/c/f39af67f03b564b763b06e44cb960c10a382d54a •
CVSS: -EPSS: %CPEs: 9EXPL: 0CVE-2025-22045 – x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
https://notcve.org/view.php?id=CVE-2025-22045
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs On the following path, flush_tlb_range() can be used for zapping normal PMD entries (PMD entries that point to page tables) together with the PTE entries in the pointed-to page table: collapse_pte_mapped_thp pmdp_collapse_flush flush_tlb_range The arm64 version of flush_tlb_range() has a comment describing that it can be used for page table removal, and does not use any last-le... • https://git.kernel.org/stable/c/016c4d92cd16f569c6485ae62b076c1a4b779536 •