CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-50616 – regulator: core: Use different devices for resource allocation and DT lookup
https://notcve.org/view.php?id=CVE-2022-50616
08 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: regulator: core: Use different devices for resource allocation and DT lookup Following by the below discussion, there's the potential UAF issue between regulator and mfd. https://lore.kernel.org/all/20221128143601.1698148-1-yangyingliang@huawei.com/ From the analysis of Yingliang CPU A |CPU B mt6370_probe() | devm_mfd_add_devices() | |mt6370_regulator_probe() | regulator_register() | //allocate init_data and add it to devres | regulator_of_... • https://git.kernel.org/stable/c/a0c7b164ad115ec0556dc0904ee2218cbc5cedfa •
CVSS: 6.6EPSS: 0%CPEs: 5EXPL: 0CVE-2022-50614 – misc: pci_endpoint_test: Fix pci_endpoint_test_{copy,write,read}() panic
https://notcve.org/view.php?id=CVE-2022-50614
08 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: misc: pci_endpoint_test: Fix pci_endpoint_test_{copy,write,read}() panic The dma_map_single() doesn't permit zero length mapping. It causes a follow panic. A panic was reported on arm64: [ 60.137988] ------------[ cut here ]------------ [ 60.142630] kernel BUG at kernel/dma/swiotlb.c:624! [ 60.147508] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 60.152992] Modules linked in: dw_hdmi_cec crct10dif_ce simple_bridge rcar_fdp1 vsp1 rcar_vin... • https://git.kernel.org/stable/c/343dc693f7b79885197f9d37dd8b711b0e3ffc8f •
CVSS: 6.9EPSS: 0%CPEs: 5EXPL: 0CVE-2025-40323 – fbcon: Set fb_display[i]->mode to NULL when the mode is released
https://notcve.org/view.php?id=CVE-2025-40323
08 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: fbcon: Set fb_display[i]->mode to NULL when the mode is released Recently, we discovered the following issue through syzkaller: BUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0 Read of size 4 at addr ff11000001b3c69c by task syz.xxx ... Call Trace:
CVSS: 7.1EPSS: 0%CPEs: 8EXPL: 0CVE-2025-40322 – fbdev: bitblit: bound-check glyph index in bit_putcs*
https://notcve.org/view.php?id=CVE-2025-40322
08 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_putcs* bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and read past the end of the built-in font array. Clamp the index to the actual glyph count before computing the address. This fixes a global out-of-bounds read reported by syzbot. In the Linux kernel, the following vulnerability has been... • https://git.kernel.org/stable/c/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 •
CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0CVE-2025-40321 – wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
https://notcve.org/view.php?id=CVE-2025-40321
08 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode Currently, whenever there is a need to transmit an Action frame, the brcmfmac driver always uses the P2P vif to send the "actframe" IOVAR to firmware. The P2P interfaces were available when wpa_supplicant is managing the wlan interface. However, the P2P interfaces are not created/initialized when only hostapd is managing the wlan interface. And if hostapd receives a... • https://git.kernel.org/stable/c/18e2f61db3b708e0a22ccc403cb6ab2203d6faab •
CVSS: 7.2EPSS: 0%CPEs: 8EXPL: 0CVE-2025-40317 – regmap: slimbus: fix bus_context pointer in regmap init calls
https://notcve.org/view.php?id=CVE-2025-40317
08 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: regmap: slimbus: fix bus_context pointer in regmap init calls Commit 4e65bda8273c ("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()") revealed the problem in the slimbus regmap. That commit breaks audio playback, for instance, on sdm845 Thundercomm Dragonboard 845c board: Unable to handle kernel paging request at virtual address ffff8000847cbad4 ... CPU: 5 UID: 0 PID: 776 Comm: aplay Not tainted 6.18.0-rc1-00028-g7ea30958b30... • https://git.kernel.org/stable/c/7d6f7fb053ad543da74119df3c4cd7bb46220471 •
CVSS: 5.5EPSS: 0%CPEs: 11EXPL: 0CVE-2025-40315 – usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
https://notcve.org/view.php?id=CVE-2025-40315
08 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix epfile null pointer access after ep enable. A race condition occurs when ffs_func_eps_enable() runs concurrently with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset() sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading to a NULL pointer dereference when accessing epfile->ep in ffs_func_eps_enable() after successful usb_ep_enable(). The ffs->epfiles pointer is set to NULL in both ff... • https://git.kernel.org/stable/c/c9fc422c9a43e3d58d246334a71f3390401781dc •
CVSS: 7.1EPSS: 0%CPEs: 8EXPL: 0CVE-2025-40312 – jfs: Verify inode mode when loading from disk
https://notcve.org/view.php?id=CVE-2025-40312
08 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: jfs: Verify inode mode when loading from disk The inode mode loaded from corrupted disk can be invalid. Do like what commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk") does. In the Linux kernel, the following vulnerability has been resolved: jfs: Verify inode mode when loading from disk The inode mode loaded from corrupted disk can be invalid. Do like what commit 0a9e74051313 ("isofs: Verify inode mode when loading from... • https://git.kernel.org/stable/c/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 •
CVSS: 5.6EPSS: 0%CPEs: 8EXPL: 0CVE-2025-40306 – orangefs: fix xattr related buffer overflow...
https://notcve.org/view.php?id=CVE-2025-40306
08 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: orangefs: fix xattr related buffer overflow... Willy Tarreau
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2025-40304 – fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
https://notcve.org/view.php?id=CVE-2025-40304
08 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if the Y position is off-screen and clip image height to screen boundary. Break from the rendering loop if the X position is off-screen. When clipping image width to fit the screen, update the character count to match the clipped width to prevent buffer siz... • https://git.kernel.org/stable/c/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 •