CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2025-38611 – vmci: Prevent the dispatching of uninitialized payloads
https://notcve.org/view.php?id=CVE-2025-38611
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: vmci: Prevent the dispatching of uninitialized payloads The reproducer executes the host's unlocked_ioctl call in two different tasks. When init_context fails, the struct vmci_event_ctx is not fully initialized when executing vmci_datagram_dispatch() to send events to all vm contexts. This affects the datagram taken from the datagram queue of its context by another task, because the datagram payload is not initialized according to the size ... • https://git.kernel.org/stable/c/28d6692cd8fb2a900edba5e5983be4478756ef6f •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2025-38610 – powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()
https://notcve.org/view.php?id=CVE-2025-38610
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() The get_pd_power_uw() function can crash with a NULL pointer dereference when em_cpu_get() returns NULL. This occurs when a CPU becomes impossible during runtime, causing get_cpu_device() to return NULL, which propagates through em_cpu_get() and leads to a crash when em_span_cpus() dereferences the NULL pointer. Add a NULL check after em_cpu_get() and return 0 if unavaila... • https://git.kernel.org/stable/c/eb82bace893169b319c563b7f813c58a0a5a9f76 •
CVSS: 6.6EPSS: 0%CPEs: 6EXPL: 0CVE-2025-38609 – PM / devfreq: Check governor before using governor->name
https://notcve.org/view.php?id=CVE-2025-38609
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Check governor before using governor->name Commit 96ffcdf239de ("PM / devfreq: Remove redundant governor_name from struct devfreq") removes governor_name and uses governor->name to replace it. But devfreq->governor may be NULL and directly using devfreq->governor->name may cause null pointer exception. Move the check of governor to before using governor->name. In the Linux kernel, the following vulnerability has been resolved:... • https://git.kernel.org/stable/c/96ffcdf239de6f9970178bb7d643e16fd9e68ab9 •
CVSS: 7.1EPSS: 0%CPEs: 6EXPL: 0CVE-2025-38608 – bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
https://notcve.org/view.php?id=CVE-2025-38608
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls When sending plaintext data, we initially calculated the corresponding ciphertext length. However, if we later reduced the plaintext data length via socket policy, we failed to recalculate the ciphertext length. This results in transmitting buffers containing uninitialized data during ciphertext transmission. This causes uninitialized bytes to be appended after a complete ... • https://git.kernel.org/stable/c/d3b18ad31f93d0b6bae105c679018a1ba7daa9ca •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-38605 – wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()
https://notcve.org/view.php?id=CVE-2025-38605
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() In ath12k_dp_tx_get_encap_type(), the arvif parameter is only used to retrieve the ab pointer. In vdev delete sequence the arvif->ar could become NULL and that would trigger kernel panic. Since the caller ath12k_dp_tx() already has a valid ab pointer, pass it directly to avoid panic and unnecessary dereferencing. PC points to "ath12k_dp_tx+0x228/0x988 [ath12k]" LR point... • https://git.kernel.org/stable/c/e93bbd65547ea8073b707c9034c3f051f8018614 •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2025-38604 – wifi: rtl818x: Kill URBs before clearing tx status queue
https://notcve.org/view.php?id=CVE-2025-38604
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: rtl818x: Kill URBs before clearing tx status queue In rtl8187_stop() move the call of usb_kill_anchored_urbs() before clearing b_tx_status.queue. This change prevents callbacks from using already freed skb due to anchor was not killed before freeing such skb. BUG: kernel NULL pointer dereference, address: 0000000000000080 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000... • https://git.kernel.org/stable/c/c1db52b9d27ee6e15a7136e67e4a21dc916cd07f •
CVSS: 6.6EPSS: 0%CPEs: 6EXPL: 0CVE-2025-38602 – iwlwifi: Add missing check for alloc_ordered_workqueue
https://notcve.org/view.php?id=CVE-2025-38602
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: iwlwifi: Add missing check for alloc_ordered_workqueue Add check for the return value of alloc_ordered_workqueue since it may return NULL pointer. In the Linux kernel, the following vulnerability has been resolved: iwlwifi: Add missing check for alloc_ordered_workqueue Add check for the return value of alloc_ordered_workqueue since it may return NULL pointer. • https://git.kernel.org/stable/c/b481de9ca074528fe8c429604e2777db8b89806a •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2025-38601 – wifi: ath11k: clear initialized flag for deinit-ed srng lists
https://notcve.org/view.php?id=CVE-2025-38601
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: clear initialized flag for deinit-ed srng lists In a number of cases we see kernel panics on resume due to ath11k kernel page fault, which happens under the following circumstances: 1) First ath11k_hal_dump_srng_stats() call Last interrupt received for each group: ath11k_pci 0000:01:00.0: group_id 0 22511ms before ath11k_pci 0000:01:00.0: group_id 1 14440788ms before [..] ath11k_pci 0000:01:00.0: failed to receive control resp... • https://git.kernel.org/stable/c/5118935b1bc28d0bce9427e584e11e905e68ee9a •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-38597 – drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port
https://notcve.org/view.php?id=CVE-2025-38597
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port Each window of a vop2 is usable by a specific set of video ports, so while binding the vop2, we look through the list of available windows trying to find one designated as primary-plane and usable by that specific port. The code later wants to use drm_crtc_init_with_planes with that found primary plane, but nothing has checked so far if a primary plane was actually... • https://git.kernel.org/stable/c/604be85547ce4d61b89292d2f9a78c721b778c16 •
CVSS: 7.0EPSS: 0%CPEs: 4EXPL: 0CVE-2025-38595 – xen: fix UAF in dmabuf_exp_from_pages()
https://notcve.org/view.php?id=CVE-2025-38595
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: xen: fix UAF in dmabuf_exp_from_pages() [dma_buf_fd() fixes; no preferences regarding the tree it goes through - up to xen folks] As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is returning that descriptor to userland (it's a race, but it's a userland race and there's nothing the kernel can do about it). However, if we follow fd_install() with an... • https://git.kernel.org/stable/c/a240d6e42e28c34fdc34b3a98ca838a31c939901 •