CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2025-37855 – drm/amd/display: Guard Possible Null Pointer Dereference
https://notcve.org/view.php?id=CVE-2025-37855
09 May 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Guard Possible Null Pointer Dereference [WHY] In some situations, dc->res_pool may be null. [HOW] Check if pointer is null before dereference. In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Guard Possible Null Pointer Dereference [WHY] In some situations, dc->res_pool may be null. [HOW] Check if pointer is null before dereference. • https://git.kernel.org/stable/c/dc2de1ac7145f882f3c03d2d6f84583ae7e35d41 •
CVSS: 4.7EPSS: 0%CPEs: 6EXPL: 0CVE-2025-37854 – drm/amdkfd: Fix mode1 reset crash issue
https://notcve.org/view.php?id=CVE-2025-37854
09 May 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix mode1 reset crash issue If HW scheduler hangs and mode1 reset is used to recover GPU, KFD signal user space to abort the processes. After process abort exit, user queues still use the GPU to access system memory before h/w is reset while KFD cleanup worker free system memory and free VRAM. There is use-after-free race bug that KFD allocate and reuse the freed system memory, and user queue write to the same system memory to c... • https://git.kernel.org/stable/c/57c9dabda80ac167de8cd71231baae37cc2f442d •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2025-37853 – drm/amdkfd: debugfs hang_hws skip GPU with MES
https://notcve.org/view.php?id=CVE-2025-37853
09 May 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: debugfs hang_hws skip GPU with MES debugfs hang_hws is used by GPU reset test with HWS, for MES this crash the kernel with NULL pointer access because dqm->packet_mgr is not setup for MES path. Skip GPU with MES for now, MES hang_hws debugfs interface will be supported later. In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: debugfs hang_hws skip GPU with MES debugfs hang_hws is used by GPU reset te... • https://git.kernel.org/stable/c/a36f8d544522a19ef06ed9e84667d154dcb6be52 •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2025-37852 – drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create()
https://notcve.org/view.php?id=CVE-2025-37852
09 May 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() Add error handling to propagate amdgpu_cgs_create_device() failures to the caller. When amdgpu_cgs_create_device() fails, release hwmgr and return -ENOMEM to prevent null pointer dereference. [v1]->[v2]: Change error code from -EINVAL to -ENOMEM. Free hwmgr. In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: handle amdgpu_cgs_create_d... • https://git.kernel.org/stable/c/55ef52c30c3e747f145a64de96192e37a8fed670 •
CVSS: 8.5EPSS: 0%CPEs: 9EXPL: 0CVE-2025-37851 – fbdev: omapfb: Add 'plane' value check
https://notcve.org/view.php?id=CVE-2025-37851
09 May 2025 — In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: Add 'plane' value check Function dispc_ovl_setup is not intended to work with the value OMAP_DSS_WB of the enum parameter plane. The value of this parameter is initialized in dss_init_overlays and in the current state of the code it cannot take this value so it's not a real problem. For the purposes of defensive coding it wouldn't be superfluous to check the parameter value, because some functions down the call stack process ... • https://git.kernel.org/stable/c/559d67018950ced65c73358cd69c4bdd2b0c5dd6 •
CVSS: 5.6EPSS: 0%CPEs: 6EXPL: 0CVE-2025-37849 – KVM: arm64: Tear down vGIC on failed vCPU creation
https://notcve.org/view.php?id=CVE-2025-37849
09 May 2025 — In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Tear down vGIC on failed vCPU creation If kvm_arch_vcpu_create() fails to share the vCPU page with the hypervisor, we propagate the error back to the ioctl but leave the vGIC vCPU data initialised. Note only does this leak the corresponding memory when the vCPU is destroyed but it can also lead to use-after-free if the redistributor device handling tries to walk into the vCPU. Add the missing cleanup to kvm_arch_vcpu_create(), e... • https://git.kernel.org/stable/c/07476e0d932afc53c05468076393ac35d0b4999e •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2025-37841 – pm: cpupower: bench: Prevent NULL dereference on malloc failure
https://notcve.org/view.php?id=CVE-2025-37841
09 May 2025 — In the Linux kernel, the following vulnerability has been resolved: pm: cpupower: bench: Prevent NULL dereference on malloc failure If malloc returns NULL due to low memory, 'config' pointer can be NULL. Add a check to prevent NULL dereference. In the Linux kernel, the following vulnerability has been resolved: pm: cpupower: bench: Prevent NULL dereference on malloc failure If malloc returns NULL due to low memory, 'config' pointer can be NULL. Add a check to prevent NULL dereference. • https://git.kernel.org/stable/c/34a9394794b0f97af6afedc0c9ee2012c24b28ed •
CVSS: 8.5EPSS: 0%CPEs: 9EXPL: 0CVE-2025-37839 – jbd2: remove wrong sb->s_sequence check
https://notcve.org/view.php?id=CVE-2025-37839
09 May 2025 — In the Linux kernel, the following vulnerability has been resolved: jbd2: remove wrong sb->s_sequence check Journal emptiness is not determined by sb->s_sequence == 0 but rather by sb->s_start == 0 (which is set a few lines above). Furthermore 0 is a valid transaction ID so the check can spuriously trigger. Remove the invalid WARN_ON. In the Linux kernel, the following vulnerability has been resolved: jbd2: remove wrong sb->s_sequence check Journal emptiness is not determined by sb->s_sequence == 0 but rath... • https://git.kernel.org/stable/c/cf30432f5b3064ff85d85639c2f0106f89c566f6 •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-37834 – mm/vmscan: don't try to reclaim hwpoison folio
https://notcve.org/view.php?id=CVE-2025-37834
08 May 2025 — In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: don't try to reclaim hwpoison folio Syzkaller reports a bug as follows: Injecting memory failure for pfn 0x18b00e at process virtual address 0x20ffd000 Memory failure: 0x18b00e: dirty swapcache page still referenced by 2 users Memory failure: 0x18b00e: recovery action for dirty swapcache page: Failed page: refcount:2 mapcount:0 mapping:0000000000000000 index:0x20ffd pfn:0x18b00e memcg:ffff0000dd6d9000 anon flags: 0x5ffffe00482011... • https://git.kernel.org/stable/c/1c9798bf8145a92abf45aa9d38a6406d9eb8bdf0 •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2025-37823 – net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
https://notcve.org/view.php?id=CVE-2025-37823
08 May 2025 — In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too Similarly to the previous patch, we need to safe guard hfsc_dequeue() too. But for this one, we don't have a reliable reproducer. In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too Similarly to the previous patch, we need to safe guard hfsc_dequeue() too. But for this one, we don't have a reliable reproducer... • https://git.kernel.org/stable/c/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 •