CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2025-38556 – HID: core: Harden s32ton() against conversion to 0 bits
https://notcve.org/view.php?id=CVE-2025-38556
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: HID: core: Harden s32ton() against conversion to 0 bits Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity to a 0-bit quantity. Ideally this should never occur, but there are buggy devices and some might have a report field with size set to zero; we shouldn't reject the report or the device just because of that. Instead, harden the s32ton() routine so that it... • https://git.kernel.org/stable/c/dde5845a529ff753364a6d1aea61180946270bfa •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2025-38555 – usb: gadget : fix use-after-free in composite_dev_cleanup()
https://notcve.org/view.php?id=CVE-2025-38555
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: usb: gadget : fix use-after-free in composite_dev_cleanup() 1. In func configfs_composite_bind() -> composite_os_desc_req_prepare(): if kmalloc fails, the pointer cdev->os_desc_req will be freed but not set to NULL. Then it will return a failure to the upper-level function. 2. in func configfs_composite_bind() -> composite_dev_cleanup(): it will checks whether cdev->os_desc_req is NULL. If it is not NULL, it will attempt to use it.This will... • https://git.kernel.org/stable/c/37a3a533429ef9b3cc9f15a656c19623f0e88df7 •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2025-38553 – net/sched: Restrict conditions for adding duplicating netems to qdisc tree
https://notcve.org/view.php?id=CVE-2025-38553
19 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: net/sched: Restrict conditions for adding duplicating netems to qdisc tree netem_enqueue's duplication prevention logic breaks when a netem resides in a qdisc tree with other netems - this can lead to a soft lockup and OOM loop in netem_dequeue, as seen in [1]. Ensure that a duplicating netem cannot exist in a tree with other netems. Previous approaches suggested in discussions in chronological order: 1) Track duplication status or ttl in t... • https://git.kernel.org/stable/c/0afb51e72855971dba83b3c6b70c547c2d1161fd •
CVSS: 7.1EPSS: 0%CPEs: 4EXPL: 0CVE-2025-38552 – mptcp: plug races between subflow fail and subflow creation
https://notcve.org/view.php?id=CVE-2025-38552
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: mptcp: plug races between subflow fail and subflow creation We have races similar to the one addressed by the previous patch between subflow failing and additional subflow creation. They are just harder to trigger. The solution is similar. Use a separate flag to track the condition 'socket state prevent any additional subflow creation' protected by the fallback lock. The socket fallback makes such flag true, and also receiving or sending an... • https://git.kernel.org/stable/c/478d770008b03ed9d74bdc8add2315b7fd124ecc •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2025-38551 – virtio-net: fix recursived rtnl_lock() during probe()
https://notcve.org/view.php?id=CVE-2025-38551
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix recursived rtnl_lock() during probe() The deadlock appears in a stack trace like: virtnet_probe() rtnl_lock() virtio_config_changed_work() netdev_notify_peers() rtnl_lock() It happens if the VMM sends a VIRTIO_NET_S_ANNOUNCE request while the virtio-net driver is still probing. The config_work in probe() will get scheduled until virtnet_open() enables the config change notification via virtio_config_driver_enable(). In the L... • https://git.kernel.org/stable/c/df28de7b00502761eba62490f413c65c9b175ed9 •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38550 – ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
https://notcve.org/view.php?id=CVE-2025-38550
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec() does, the reference should be put after ip6_mc_clear_src() return. In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec() does, the reference should be put after ip6_mc_clear_src() ... • https://git.kernel.org/stable/c/63ed8de4be81b699ca727e9f8e3344bd487806d7 •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-38549 – efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths
https://notcve.org/view.php?id=CVE-2025-38549
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths When processing mount options, efivarfs allocates efivarfs_fs_info (sfi) early in fs_context initialization. However, sfi is associated with the superblock and typically freed when the superblock is destroyed. If the fs_context is released (final put) before fill_super is called—such as on error paths or during reconfiguration—the sfi structure would leak, as ownership ... • https://git.kernel.org/stable/c/5329aa5101f73c451bcd48deaf3f296685849d9c •
CVSS: 7.2EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38548 – hwmon: (corsair-cpro) Validate the size of the received input buffer
https://notcve.org/view.php?id=CVE-2025-38548
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Validate the size of the received input buffer Add buffer_recv_size to store the size of the received bytes. Validate buffer_recv_size in send_usb_cmd(). In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Validate the size of the received input buffer Add buffer_recv_size to store the size of the received bytes. Validate buffer_recv_size in send_usb_cmd(). • https://git.kernel.org/stable/c/40c3a445422579db8ad96c234dbe6c0ab3f6b936 •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2025-38546 – atm: clip: Fix memory leak of struct clip_vcc.
https://notcve.org/view.php?id=CVE-2025-38546
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix memory leak of struct clip_vcc. ioctl(ATMARP_MKIP) allocates struct clip_vcc and set it to vcc->user_back. The code assumes that vcc_destroy_socket() passes NULL skb to vcc->push() when the socket is close()d, and then clip_push() frees clip_vcc. However, ioctl(ATMARPD_CTRL) sets NULL to vcc->push() in atm_init_atmarp(), resulting in memory leak. Let's serialise two ioctl() by lock_sock() and check vcc->push() in atm_init_atm... • https://git.kernel.org/stable/c/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 •
CVSS: 6.6EPSS: 0%CPEs: 3EXPL: 0CVE-2025-38545 – net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info
https://notcve.org/view.php?id=CVE-2025-38545
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info While transitioning from netdev_alloc_ip_align() to build_skb(), memory for the "skb_shared_info" member of an "skb" was not allocated. Fix this by allocating "PAGE_SIZE" as the skb length, accounting for the packet length, headroom and tailroom, thereby including the required memory space for skb_shared_info. In the Linux kernel, the following vulnerability h... • https://git.kernel.org/stable/c/8acacc40f7337527ff84cd901ed2ef0a2b95b2b6 •