CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2025-38611 – vmci: Prevent the dispatching of uninitialized payloads
https://notcve.org/view.php?id=CVE-2025-38611
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: vmci: Prevent the dispatching of uninitialized payloads The reproducer executes the host's unlocked_ioctl call in two different tasks. When init_context fails, the struct vmci_event_ctx is not fully initialized when executing vmci_datagram_dispatch() to send events to all vm contexts. This affects the datagram taken from the datagram queue of its context by another task, because the datagram payload is not initialized according to the size ... • https://git.kernel.org/stable/c/28d6692cd8fb2a900edba5e5983be4478756ef6f •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2025-38610 – powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()
https://notcve.org/view.php?id=CVE-2025-38610
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() The get_pd_power_uw() function can crash with a NULL pointer dereference when em_cpu_get() returns NULL. This occurs when a CPU becomes impossible during runtime, causing get_cpu_device() to return NULL, which propagates through em_cpu_get() and leads to a crash when em_span_cpus() dereferences the NULL pointer. Add a NULL check after em_cpu_get() and return 0 if unavaila... • https://git.kernel.org/stable/c/eb82bace893169b319c563b7f813c58a0a5a9f76 •
CVSS: 6.6EPSS: 0%CPEs: 7EXPL: 0CVE-2025-38609 – PM / devfreq: Check governor before using governor->name
https://notcve.org/view.php?id=CVE-2025-38609
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Check governor before using governor->name Commit 96ffcdf239de ("PM / devfreq: Remove redundant governor_name from struct devfreq") removes governor_name and uses governor->name to replace it. But devfreq->governor may be NULL and directly using devfreq->governor->name may cause null pointer exception. Move the check of governor to before using governor->name. In the Linux kernel, the following vulnerability has been resolved:... • https://git.kernel.org/stable/c/96ffcdf239de6f9970178bb7d643e16fd9e68ab9 •
CVSS: 7.1EPSS: 0%CPEs: 9EXPL: 0CVE-2025-38608 – bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
https://notcve.org/view.php?id=CVE-2025-38608
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls When sending plaintext data, we initially calculated the corresponding ciphertext length. However, if we later reduced the plaintext data length via socket policy, we failed to recalculate the ciphertext length. This results in transmitting buffers containing uninitialized data during ciphertext transmission. This causes uninitialized bytes to be appended after a complete ... • https://git.kernel.org/stable/c/d3b18ad31f93d0b6bae105c679018a1ba7daa9ca •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2025-38604 – wifi: rtl818x: Kill URBs before clearing tx status queue
https://notcve.org/view.php?id=CVE-2025-38604
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: rtl818x: Kill URBs before clearing tx status queue In rtl8187_stop() move the call of usb_kill_anchored_urbs() before clearing b_tx_status.queue. This change prevents callbacks from using already freed skb due to anchor was not killed before freeing such skb. BUG: kernel NULL pointer dereference, address: 0000000000000080 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000... • https://git.kernel.org/stable/c/c1db52b9d27ee6e15a7136e67e4a21dc916cd07f •
CVSS: 6.6EPSS: 0%CPEs: 9EXPL: 0CVE-2025-38602 – iwlwifi: Add missing check for alloc_ordered_workqueue
https://notcve.org/view.php?id=CVE-2025-38602
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: iwlwifi: Add missing check for alloc_ordered_workqueue Add check for the return value of alloc_ordered_workqueue since it may return NULL pointer. In the Linux kernel, the following vulnerability has been resolved: iwlwifi: Add missing check for alloc_ordered_workqueue Add check for the return value of alloc_ordered_workqueue since it may return NULL pointer. • https://git.kernel.org/stable/c/b481de9ca074528fe8c429604e2777db8b89806a •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2025-38601 – wifi: ath11k: clear initialized flag for deinit-ed srng lists
https://notcve.org/view.php?id=CVE-2025-38601
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: clear initialized flag for deinit-ed srng lists In a number of cases we see kernel panics on resume due to ath11k kernel page fault, which happens under the following circumstances: 1) First ath11k_hal_dump_srng_stats() call Last interrupt received for each group: ath11k_pci 0000:01:00.0: group_id 0 22511ms before ath11k_pci 0000:01:00.0: group_id 1 14440788ms before [..] ath11k_pci 0000:01:00.0: failed to receive control resp... • https://git.kernel.org/stable/c/5118935b1bc28d0bce9427e584e11e905e68ee9a •
CVSS: 7.0EPSS: 0%CPEs: 4EXPL: 0CVE-2025-38595 – xen: fix UAF in dmabuf_exp_from_pages()
https://notcve.org/view.php?id=CVE-2025-38595
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: xen: fix UAF in dmabuf_exp_from_pages() [dma_buf_fd() fixes; no preferences regarding the tree it goes through - up to xen folks] As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is returning that descriptor to userland (it's a race, but it's a userland race and there's nothing the kernel can do about it). However, if we follow fd_install() with an... • https://git.kernel.org/stable/c/a240d6e42e28c34fdc34b3a98ca838a31c939901 •
CVSS: 6.6EPSS: 0%CPEs: 4EXPL: 0CVE-2025-38593 – Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'
https://notcve.org/view.php?id=CVE-2025-38593
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' Function 'hci_discovery_filter_clear()' frees 'uuids' array and then sets it to NULL. There is a tiny chance of the following race: 'hci_cmd_sync_work()' 'update_passive_scan_sync()' 'hci_update_passive_scan_sync()' 'hci_discovery_filter_clear()' kfree(uuids); <-------------------------preempted--------------------------------> 'start_service_discovery()' 'hci_discovery_... • https://git.kernel.org/stable/c/ad383c2c65a5baf16e334cd40a013cc302176891 •
CVSS: 6.6EPSS: 0%CPEs: 2EXPL: 0CVE-2025-38591 – bpf: Reject narrower access to pointer ctx fields
https://notcve.org/view.php?id=CVE-2025-38591
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: bpf: Reject narrower access to pointer ctx fields The following BPF program, simplified from a syzkaller repro, causes a kernel warning: r0 = *(u8 *)(r1 + 169); exit; With pointer field sk being at offset 168 in __sk_buff. This access is detected as a narrower read in bpf_skb_is_valid_access because it doesn't match offsetof(struct __sk_buff, sk). It is therefore allowed and later proceeds to bpf_convert_ctx_access. Note that for the "is_na... • https://git.kernel.org/stable/c/f96da09473b52c09125cc9bf7d7d4576ae8229e0 •