CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2025-37804 – io_uring: always do atomic put from iowq
https://notcve.org/view.php?id=CVE-2025-37804
08 May 2025 — In the Linux kernel, the following vulnerability has been resolved: io_uring: always do atomic put from iowq io_uring always switches requests to atomic refcounting for iowq execution before there is any parallilism by setting REQ_F_REFCOUNT, and the flag is not cleared until the request completes. That should be fine as long as the compiler doesn't make up a non existing value for the flags, however KCSAN still complains when the request owner changes oter flag bits: BUG: KCSAN: data-race in io_req_task_ca... • https://git.kernel.org/stable/c/c5d4d103005d8926cdad344f9fc947e651c9f2f7 •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2025-37803 – udmabuf: fix a buf size overflow issue during udmabuf creation
https://notcve.org/view.php?id=CVE-2025-37803
08 May 2025 — In the Linux kernel, the following vulnerability has been resolved: udmabuf: fix a buf size overflow issue during udmabuf creation by casting size_limit_mb to u64 when calculate pglimit. • https://git.kernel.org/stable/c/e84a08fc7e25cdad5d9a3def42cc770ff711193f •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-37802 – ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING"
https://notcve.org/view.php?id=CVE-2025-37802
08 May 2025 — In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" wait_event_timeout() will set the state of the current task to TASK_UNINTERRUPTIBLE, before doing the condition check. This means that ksmbd_durable_scavenger_alive() will try to acquire the mutex while already in a sleeping state. The scheduler warns us by giving the following warning: do not call blocking ops when !TASK_RUNNING; state=2 set at [<0000000061515a6f>] prepare_to... • https://git.kernel.org/stable/c/8f805b3746d2f41702c77cba22f94f8415fadd1a •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2025-37801 – spi: spi-imx: Add check for spi_imx_setupxfer()
https://notcve.org/view.php?id=CVE-2025-37801
08 May 2025 — In the Linux kernel, the following vulnerability has been resolved: spi: spi-imx: Add check for spi_imx_setupxfer() Add check for the return value of spi_imx_setupxfer(). spi_imx->rx and spi_imx->tx function pointer can be NULL when spi_imx_setupxfer() return error, and make NULL pointer dereference. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Call trace: 0x0 spi_imx_pio_transfer+0x50/0xd8 spi_imx_transfer_one+0x18c/0x858 spi_transfer_one_message+0x43c/0x790 __spi_pu... • https://git.kernel.org/stable/c/2fea0d6d7b5d27fbf55512d51851ba0a346ede52 •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2025-37800 – driver core: fix potential NULL pointer dereference in dev_uevent()
https://notcve.org/view.php?id=CVE-2025-37800
08 May 2025 — In the Linux kernel, the following vulnerability has been resolved: driver core: fix potential NULL pointer dereference in dev_uevent() If userspace reads "uevent" device attribute at the same time as another threads unbinds the device from its driver, change to dev->driver from a valid pointer to NULL may result in crash. Fix this by using READ_ONCE() when fetching the pointer, and take bus' drivers klist lock to make sure driver instance will not disappear while we access it. Use WRITE_ONCE() when setting... • https://git.kernel.org/stable/c/abe56be73eb10a677d16066f65ff9d30251f5eee •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2025-37799 – vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp
https://notcve.org/view.php?id=CVE-2025-37799
03 May 2025 — In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp vmxnet3 driver's XDP handling is buggy for packet sizes using ring0 (that is, packet sizes between 128 - 3k bytes). We noticed MTU-related connectivity issues with Cilium's service load- balancing in case of vmxnet3 as NIC underneath. A simple curl to a HTTP backend service where the XDP LB was doing IPIP encap led to overly large packet sizes but only for *some* of the packets (e.... • https://git.kernel.org/stable/c/aba8659caf88017507419feea06069f529329ea6 •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2025-37798 – codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
https://notcve.org/view.php?id=CVE-2025-37798
02 May 2025 — In the Linux kernel, the following vulnerability has been resolved: codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() After making all ->qlen_notify() callbacks idempotent, now it is safe to remove the check of qlen!=0 from both fq_codel_dequeue() and codel_qdisc_dequeue(). In the Linux kernel, the following vulnerability has been resolved: codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() After making all ->qlen_notify() callbacks idempotent, now it is safe to remove the c... • https://git.kernel.org/stable/c/76e3cc126bb223013a6b9a0e2a51238d1ef2e409 •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2025-37797 – net_sched: hfsc: Fix a UAF vulnerability in class handling
https://notcve.org/view.php?id=CVE-2025-37797
02 May 2025 — In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class handling This patch fixes a Use-After-Free vulnerability in the HFSC qdisc class handling. The issue occurs due to a time-of-check/time-of-use condition in hfsc_change_class() when working with certain child qdiscs like netem or codel. The vulnerability works as follows: 1. hfsc_change_class() checks if a class has packets (q.qlen != 0) 2. It then calls qdisc_peek_len(), which for certain qd... • https://git.kernel.org/stable/c/21f4d5cc25ec0e6e8eb8420dd2c399e6d2fc7d14 •
CVSS: 7.1EPSS: 0%CPEs: 8EXPL: 0CVE-2025-37796 – wifi: at76c50x: fix use after free access in at76_disconnect
https://notcve.org/view.php?id=CVE-2025-37796
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x: fix use after free access in at76_disconnect The memory pointed to by priv is freed at the end of at76_delete_device function (using ieee80211_free_hw). But the code then accesses the udev field of the freed object to put the USB device. This may also lead to a memory leak of the usb device. Fix this by using udev from interface. In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x: fix use afte... • https://git.kernel.org/stable/c/29e20aa6c6aff35c81d4da2e2cd516dadb569061 •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2025-37795 – wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()
https://notcve.org/view.php?id=CVE-2025-37795
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() The ieee80211 skb control block key (set when skb was queued) could have been removed before ieee80211_tx_dequeue() call. ieee80211_tx_dequeue() already called ieee80211_tx_h_select_key() to get the current key, but the latter do not update the key in skb control block in case it is NULL. Because some drivers actually use this key in their TX callbacks (e.g. ath1{1,2}k... • https://git.kernel.org/stable/c/bb42f2d13ffcd0baed7547b37d05add51fcd50e1 •