CVSS: -EPSS: %CPEs: 2EXPL: 0CVE-2025-38128 – Bluetooth: MGMT: reject malformed HCI_CMD_SYNC commands
https://notcve.org/view.php?id=CVE-2025-38128
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject malformed HCI_CMD_SYNC commands In 'mgmt_hci_cmd_sync()', check whether the size of parameters passed in 'struct mgmt_cp_hci_cmd_sync' matches the total size of the data (i.e. 'sizeof(struct mgmt_cp_hci_cmd_sync)' plus trailing bytes). Otherwise, large invalid 'params_len' will cause 'hci_cmd_sync_alloc()' to do 'skb_put_data()' from an area beyond the one actually passed to 'mgmt_hci_cmd_sync()'. • https://git.kernel.org/stable/c/827af4787e74e8df9e8e0677a69fbb15e0856d2f •
CVSS: -EPSS: %CPEs: 4EXPL: 0CVE-2025-38127 – ice: fix Tx scheduler error handling in XDP callback
https://notcve.org/view.php?id=CVE-2025-38127
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: ice: fix Tx scheduler error handling in XDP callback When the XDP program is loaded, the XDP callback adds new Tx queues. This means that the callback must update the Tx scheduler with the new queue number. In the event of a Tx scheduler failure, the XDP callback should also fail and roll back any changes previously made for XDP preparation. The previous implementation had a bug that not all changes made by the XDP callback were rolled back... • https://git.kernel.org/stable/c/efc2214b6047b6f5b4ca53151eba62521b9452d6 •
CVSS: -EPSS: %CPEs: 5EXPL: 0CVE-2025-38126 – net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping
https://notcve.org/view.php?id=CVE-2025-38126
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping The stmmac platform drivers that do not open-code the clk_ptp_rate value after having retrieved the default one from the device-tree can end up with 0 in clk_ptp_rate (as clk_get_rate can return 0). It will eventually propagate up to PTP initialization when bringing up the interface, leading to a divide by 0: Division by zero in kernel. CPU: 1 UID: 0 PID: 1 Comm: ... • https://git.kernel.org/stable/c/19d857c9038e5c07db8f8cc02b5ad0cd0098714f •
CVSS: -EPSS: %CPEs: 3EXPL: 0CVE-2025-38125 – net: stmmac: make sure that ptp_rate is not 0 before configuring EST
https://notcve.org/view.php?id=CVE-2025-38125
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: net: stmmac: make sure that ptp_rate is not 0 before configuring EST If the ptp_rate recorded earlier in the driver happens to be 0, this bogus value will propagate up to EST configuration, where it will trigger a division by 0. Prevent this division by 0 by adding the corresponding check and error code. • https://git.kernel.org/stable/c/8572aec3d0dc43045254fd1bf581fb980bfdbc4b •
CVSS: -EPSS: %CPEs: 7EXPL: 0CVE-2025-38124 – net: fix udp gso skb_segment after pull from frag_list
https://notcve.org/view.php?id=CVE-2025-38124
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: net: fix udp gso skb_segment after pull from frag_list Commit a1e40ac5b5e9 ("net: gso: fix udp gso fraglist segmentation after pull from frag_list") detected invalid geometry in frag_list skbs and redirects them from skb_segment_list to more robust skb_segment. But some packets with modified geometry can also hit bugs in that code. We don't know how many such cases exist. Addressing each one by one also requires touching the complex skb_seg... • https://git.kernel.org/stable/c/080e6c9a3908de193a48f646c5ce1bfb15676ffc •
CVSS: -EPSS: %CPEs: 4EXPL: 0CVE-2025-38123 – net: wwan: t7xx: Fix napi rx poll issue
https://notcve.org/view.php?id=CVE-2025-38123
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: Fix napi rx poll issue When driver handles the napi rx polling requests, the netdev might have been released by the dellink logic triggered by the disconnect operation on user plane. However, in the logic of processing skb in polling, an invalid netdev is still being used, which causes a panic. BUG: kernel NULL pointer dereference, address: 00000000000000f1 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:dev_gro_receive+0x3a/0x... • https://git.kernel.org/stable/c/5545b7b9f294de7f95ec6a7cb1de0db52296001c •
CVSS: -EPSS: %CPEs: 6EXPL: 0CVE-2025-38122 – gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO
https://notcve.org/view.php?id=CVE-2025-38122
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO gve_alloc_pending_packet() can return NULL, but gve_tx_add_skb_dqo() did not check for this case before dereferencing the returned pointer. Add a missing NULL check to prevent a potential NULL pointer dereference when allocation fails. This improves robustness in low-memory scenarios. • https://git.kernel.org/stable/c/a57e5de476be0b4b7f42beb6a21c19ad9c577aa3 •
CVSS: -EPSS: %CPEs: 2EXPL: 0CVE-2025-38121 – wifi: iwlwifi: mld: avoid panic on init failure
https://notcve.org/view.php?id=CVE-2025-38121
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: avoid panic on init failure In case of an error during init, in_hw_restart will be set, but it will never get cleared. Instead, we will retry to init again, and then we will act like we are in a restart when we are actually not. This causes (among others) to a NULL pointer dereference when canceling rx_omi::finished_work, that was not even initialized, because we thought that we are in hw_restart. Set in_hw_restart to tr... • https://git.kernel.org/stable/c/7391b2a4f7dbb7be7dd763bc87506c10f570a8d3 •
CVSS: -EPSS: %CPEs: 7EXPL: 0CVE-2025-38120 – netfilter: nf_set_pipapo_avx2: fix initial map fill
https://notcve.org/view.php?id=CVE-2025-38120
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_set_pipapo_avx2: fix initial map fill If the first field doesn't cover the entire start map, then we must zero out the remainder, else we leak those bits into the next match round map. The early fix was incomplete and did only fix up the generic C implementation. A followup patch adds a test case to nft_concat_range.sh. • https://git.kernel.org/stable/c/957a4d1c4c5849e4515c9fb4db21bf85318103dc •
CVSS: -EPSS: %CPEs: 6EXPL: 0CVE-2025-38119 – scsi: core: ufs: Fix a hang in the error handler
https://notcve.org/view.php?id=CVE-2025-38119
03 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: scsi: core: ufs: Fix a hang in the error handler ufshcd_err_handling_prepare() calls ufshcd_rpm_get_sync(). The latter function can only succeed if UFSHCD_EH_IN_PROGRESS is not set because resuming involves submitting a SCSI command and ufshcd_queuecommand() returns SCSI_MLQUEUE_HOST_BUSY if UFSHCD_EH_IN_PROGRESS is set. Fix this hang by setting UFSHCD_EH_IN_PROGRESS after ufshcd_rpm_get_sync() has been called instead of before. Backtrace: ... • https://git.kernel.org/stable/c/62694735ca95c74dac4eb9068d59801ac0ddebaf •