CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2025-37804 – io_uring: always do atomic put from iowq
https://notcve.org/view.php?id=CVE-2025-37804
08 May 2025 — In the Linux kernel, the following vulnerability has been resolved: io_uring: always do atomic put from iowq io_uring always switches requests to atomic refcounting for iowq execution before there is any parallilism by setting REQ_F_REFCOUNT, and the flag is not cleared until the request completes. That should be fine as long as the compiler doesn't make up a non existing value for the flags, however KCSAN still complains when the request owner changes oter flag bits: BUG: KCSAN: data-race in io_req_task_ca... • https://git.kernel.org/stable/c/c5d4d103005d8926cdad344f9fc947e651c9f2f7 •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2025-37803 – udmabuf: fix a buf size overflow issue during udmabuf creation
https://notcve.org/view.php?id=CVE-2025-37803
08 May 2025 — In the Linux kernel, the following vulnerability has been resolved: udmabuf: fix a buf size overflow issue during udmabuf creation by casting size_limit_mb to u64 when calculate pglimit. • https://git.kernel.org/stable/c/e84a08fc7e25cdad5d9a3def42cc770ff711193f •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-37802 – ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING"
https://notcve.org/view.php?id=CVE-2025-37802
08 May 2025 — In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" wait_event_timeout() will set the state of the current task to TASK_UNINTERRUPTIBLE, before doing the condition check. This means that ksmbd_durable_scavenger_alive() will try to acquire the mutex while already in a sleeping state. The scheduler warns us by giving the following warning: do not call blocking ops when !TASK_RUNNING; state=2 set at [<0000000061515a6f>] prepare_to... • https://git.kernel.org/stable/c/8f805b3746d2f41702c77cba22f94f8415fadd1a •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2025-37801 – spi: spi-imx: Add check for spi_imx_setupxfer()
https://notcve.org/view.php?id=CVE-2025-37801
08 May 2025 — In the Linux kernel, the following vulnerability has been resolved: spi: spi-imx: Add check for spi_imx_setupxfer() Add check for the return value of spi_imx_setupxfer(). spi_imx->rx and spi_imx->tx function pointer can be NULL when spi_imx_setupxfer() return error, and make NULL pointer dereference. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Call trace: 0x0 spi_imx_pio_transfer+0x50/0xd8 spi_imx_transfer_one+0x18c/0x858 spi_transfer_one_message+0x43c/0x790 __spi_pu... • https://git.kernel.org/stable/c/2fea0d6d7b5d27fbf55512d51851ba0a346ede52 •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2025-37800 – driver core: fix potential NULL pointer dereference in dev_uevent()
https://notcve.org/view.php?id=CVE-2025-37800
08 May 2025 — In the Linux kernel, the following vulnerability has been resolved: driver core: fix potential NULL pointer dereference in dev_uevent() If userspace reads "uevent" device attribute at the same time as another threads unbinds the device from its driver, change to dev->driver from a valid pointer to NULL may result in crash. Fix this by using READ_ONCE() when fetching the pointer, and take bus' drivers klist lock to make sure driver instance will not disappear while we access it. Use WRITE_ONCE() when setting... • https://git.kernel.org/stable/c/abe56be73eb10a677d16066f65ff9d30251f5eee •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-36791 – net_sched: keep alloc_hash updated after hash allocation
https://notcve.org/view.php?id=CVE-2020-36791
07 May 2025 — In the Linux kernel, the following vulnerability has been resolved: net_sched: keep alloc_hash updated after hash allocation In commit 599be01ee567 ("net_sched: fix an OOB access in cls_tcindex") I moved cp->hash calculation before the first tcindex_alloc_perfect_hash(), but cp->alloc_hash is left untouched. This difference could lead to another out of bound access. cp->alloc_hash should always be the size allocated, we should update it after this tcindex_alloc_perfect_hash(). In the Linux kernel, the follo... • https://git.kernel.org/stable/c/73c29d2f6f8ae731b1e09051b69ed3ba2319482b •
CVSS: 8.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-58237 – bpf: consider that tail calls invalidate packet pointers
https://notcve.org/view.php?id=CVE-2024-58237
05 May 2025 — In the Linux kernel, the following vulnerability has been resolved: bpf: consider that tail calls invalidate packet pointers Tail-called programs could execute any of the helpers that invalidate packet pointers. Hence, conservatively assume that each tail call invalidates packet pointers. Making the change in bpf_helper_changes_pkt_data() automatically makes use of check_cfg() logic that computes 'changes_pkt_data' effect for global sub-programs, such that the following program could be rejected: int tail_c... • https://git.kernel.org/stable/c/51c39bb1d5d105a02e29aa7960f0a395086e6342 •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2024-58100 – bpf: check changes_pkt_data property for extension programs
https://notcve.org/view.php?id=CVE-2024-58100
05 May 2025 — In the Linux kernel, the following vulnerability has been resolved: bpf: check changes_pkt_data property for extension programs When processing calls to global sub-programs, verifier decides whether to invalidate all packet pointers in current state depending on the changes_pkt_data property of the global sub-program. Because of this, an extension program replacing a global sub-program must be compatible with changes_pkt_data property of the sub-program being replaced. This commit: - adds changes_pkt_data f... • https://git.kernel.org/stable/c/be8704ff07d2374bcc5c675526f95e70c6459683 •
CVSS: 9.4EPSS: 0%CPEs: 2EXPL: 0CVE-2024-58098 – bpf: track changes_pkt_data property for global functions
https://notcve.org/view.php?id=CVE-2024-58098
05 May 2025 — In the Linux kernel, the following vulnerability has been resolved: bpf: track changes_pkt_data property for global functions When processing calls to certain helpers, verifier invalidates all packet pointers in a current state. For example, consider the following program: __attribute__((__noinline__)) long skb_pull_data(struct __sk_buff *sk, __u32 len) { return bpf_skb_pull_data(sk, len); } SEC("tc") int test_invalidate_checks(struct __sk_buff *sk) { int *p = (void *)(long)sk->data; if ((void *)(p + 1) > (... • https://git.kernel.org/stable/c/51c39bb1d5d105a02e29aa7960f0a395086e6342 •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2025-37799 – vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp
https://notcve.org/view.php?id=CVE-2025-37799
03 May 2025 — In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp vmxnet3 driver's XDP handling is buggy for packet sizes using ring0 (that is, packet sizes between 128 - 3k bytes). We noticed MTU-related connectivity issues with Cilium's service load- balancing in case of vmxnet3 as NIC underneath. A simple curl to a HTTP backend service where the XDP LB was doing IPIP encap led to overly large packet sizes but only for *some* of the packets (e.... • https://git.kernel.org/stable/c/aba8659caf88017507419feea06069f529329ea6 •