CVSS: -EPSS: %CPEs: 3EXPL: 0CVE-2025-38564 – perf/core: Handle buffer mapping fail correctly in perf_mmap()
https://notcve.org/view.php?id=CVE-2025-38564
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: perf/core: Handle buffer mapping fail correctly in perf_mmap() After successful allocation of a buffer or a successful attachment to an existing buffer perf_mmap() tries to map the buffer read only into the page table. If that fails, the already set up page table entries are zapped, but the other perf specific side effects of that failure are not handled. The calling code just cleans up the VMA and does not invoke perf_mmap_close(). This le... • https://git.kernel.org/stable/c/b709eb872e19a19607bbb6d2975bc264d59735cf •
CVSS: -EPSS: %CPEs: 6EXPL: 0CVE-2025-38563 – perf/core: Prevent VMA split of buffer mappings
https://notcve.org/view.php?id=CVE-2025-38563
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: perf/core: Prevent VMA split of buffer mappings The perf mmap code is careful about mmap()'ing the user page with the ringbuffer and additionally the auxiliary buffer, when the event supports it. Once the first mapping is established, subsequent mapping have to use the same offset and the same size in both cases. The reference counting for the ringbuffer and the auxiliary buffer depends on this being correct. Though perf does not prevent th... • https://git.kernel.org/stable/c/45bfb2e50471abbbfd83d40d28c986078b0d24ff •
CVSS: -EPSS: %CPEs: 6EXPL: 0CVE-2025-38562 – ksmbd: fix null pointer dereference error in generate_encryptionkey
https://notcve.org/view.php?id=CVE-2025-38562
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference error in generate_encryptionkey If client send two session setups with krb5 authenticate to ksmbd, null pointer dereference error in generate_encryptionkey could happen. sess->Preauth_HashValue is set to NULL if session is valid. So this patch skip generate encryption key if session is valid. • https://git.kernel.org/stable/c/96a82e19434a2522525baab59c33332658bc7653 •
CVSS: -EPSS: %CPEs: 6EXPL: 0CVE-2025-38561 – ksmbd: fix Preauh_HashValue race condition
https://notcve.org/view.php?id=CVE-2025-38561
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix Preauh_HashValue race condition If client send multiple session setup requests to ksmbd, Preauh_HashValue race condition could happen. There is no need to free sess->Preauh_HashValue at session setup phase. It can be freed together with session at connection termination phase. • https://git.kernel.org/stable/c/fbf5c0845ed15122a770bca9be1d9b60b470d3aa •
CVSS: -EPSS: %CPEs: 6EXPL: 0CVE-2025-38560 – x86/sev: Evict cache lines during SNP memory validation
https://notcve.org/view.php?id=CVE-2025-38560
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: x86/sev: Evict cache lines during SNP memory validation An SNP cache coherency vulnerability requires a cache line eviction mitigation when validating memory after a page state change to private. The specific mitigation is to touch the first and last byte of each 4K page that is being validated. There is no need to perform the mitigation when performing a page state change to shared and rescinding validation. CPUID bit Fn8000001F_EBX[31] de... • https://git.kernel.org/stable/c/1fec416c03d0a64cc21aa04ce4aa14254b017e6a •
CVSS: -EPSS: %CPEs: 4EXPL: 0CVE-2025-38559 – platform/x86/intel/pmt: fix a crashlog NULL pointer access
https://notcve.org/view.php?id=CVE-2025-38559
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/pmt: fix a crashlog NULL pointer access Usage of the intel_pmt_read() for binary sysfs, requires a pcidev. The current use of the endpoint value is only valid for telemetry endpoint usage. Without the ep, the crashlog usage causes the following NULL pointer exception: BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:intel_pmt_read+0x3b/0x70 [pmt_class] Code: Call Tr... • https://git.kernel.org/stable/c/045a513040cc0242d364c05c3791594e2294f32d •
CVSS: -EPSS: %CPEs: 3EXPL: 0CVE-2025-38558 – usb: gadget: uvc: Initialize frame-based format color matching descriptor
https://notcve.org/view.php?id=CVE-2025-38558
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Initialize frame-based format color matching descriptor Fix NULL pointer crash in uvcg_framebased_make due to uninitialized color matching descriptor for frame-based format which was added in commit f5e7bdd34aca ("usb: gadget: uvc: Allow creating new color matching descriptors") that added handling for uncompressed and mjpeg format. Crash is seen when userspace configuration (via configfs) does not explicitly define the co... • https://git.kernel.org/stable/c/7b5a58952fc3b51905c2963647485565df1e5e26 •
CVSS: -EPSS: %CPEs: 4EXPL: 0CVE-2025-38557 – HID: apple: validate feature-report field count to prevent NULL pointer dereference
https://notcve.org/view.php?id=CVE-2025-38557
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: HID: apple: validate feature-report field count to prevent NULL pointer dereference A malicious HID device with quirk APPLE_MAGIC_BACKLIGHT can trigger a NULL pointer dereference whilst the power feature-report is toggled and sent to the device in apple_magic_backlight_report_set(). The power feature-report is expected to have two data fields, but if the descriptor declares one field then accessing field[1] and dereferencing it in apple_mag... • https://git.kernel.org/stable/c/394ba612f9419ec5bfebbffb72212fd3b2094986 •
CVSS: -EPSS: %CPEs: 3EXPL: 0CVE-2025-38556 – HID: core: Harden s32ton() against conversion to 0 bits
https://notcve.org/view.php?id=CVE-2025-38556
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: HID: core: Harden s32ton() against conversion to 0 bits Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity to a 0-bit quantity. Ideally this should never occur, but there are buggy devices and some might have a report field with size set to zero; we shouldn't reject the report or the device just because of that. Instead, harden the s32ton() routine so that it... • https://git.kernel.org/stable/c/dde5845a529ff753364a6d1aea61180946270bfa •
CVSS: -EPSS: %CPEs: 6EXPL: 0CVE-2025-38555 – usb: gadget : fix use-after-free in composite_dev_cleanup()
https://notcve.org/view.php?id=CVE-2025-38555
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: usb: gadget : fix use-after-free in composite_dev_cleanup() 1. In func configfs_composite_bind() -> composite_os_desc_req_prepare(): if kmalloc fails, the pointer cdev->os_desc_req will be freed but not set to NULL. Then it will return a failure to the upper-level function. 2. in func configfs_composite_bind() -> composite_dev_cleanup(): it will checks whether cdev->os_desc_req is NULL. If it is not NULL, it will attempt to use it.This will... • https://git.kernel.org/stable/c/37a3a533429ef9b3cc9f15a656c19623f0e88df7 •