CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2025-38516 – pinctrl: qcom: msm: mark certain pins as invalid for interrupts
https://notcve.org/view.php?id=CVE-2025-38516
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: pinctrl: qcom: msm: mark certain pins as invalid for interrupts On some platforms, the UFS-reset pin has no interrupt logic in TLMM but is nevertheless registered as a GPIO in the kernel. This enables the user-space to trigger a BUG() in the pinctrl-msm driver by running, for example: `gpiomon -c 0 113` on RB2. The exact culprit is requesting pins whose intr_detection_width setting is not 1 or 2 for interrupts. This hits a BUG() in msm_gpio... • https://git.kernel.org/stable/c/f365be0925729508fd8e62f8bdb504ef896cb6e0 •
CVSS: 6.9EPSS: 0%CPEs: 8EXPL: 0CVE-2025-38515 – drm/sched: Increment job count before swapping tail spsc queue
https://notcve.org/view.php?id=CVE-2025-38515
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/sched: Increment job count before swapping tail spsc queue A small race exists between spsc_queue_push and the run-job worker, in which spsc_queue_push may return not-first while the run-job worker has already idled due to the job count being zero. If this race occurs, job scheduling stops, leading to hangs while waiting on the job’s DMA fences. Seal this race by incrementing the job count before appending to the SPSC queue. This race w... • https://git.kernel.org/stable/c/27105db6c63a571b91d01e749d026105a1e63bcf •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2025-38514 – rxrpc: Fix oops due to non-existence of prealloc backlog struct
https://notcve.org/view.php?id=CVE-2025-38514
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix oops due to non-existence of prealloc backlog struct If an AF_RXRPC service socket is opened and bound, but calls are preallocated, then rxrpc_alloc_incoming_call() will oops because the rxrpc_backlog struct doesn't get allocated until the first preallocation is made. Fix this by returning NULL from rxrpc_alloc_incoming_call() if there is no backlog struct. This will cause the incoming call to be aborted. In the Linux kernel, the... • https://git.kernel.org/stable/c/bf0ca6a1bc4fb904b598137c6718785a107e3adf •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2025-38513 – wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()
https://notcve.org/view.php?id=CVE-2025-38513
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() There is a potential NULL pointer dereference in zd_mac_tx_to_dev(). For example, the following is possible: T0 T1 zd_mac_tx_to_dev() /* len == skb_queue_len(q) */ while (len > ZD_MAC_MAX_ACK_WAITERS) { filter_ack() spin_lock_irqsave(&q->lock, flags); /* position == skb_queue_len(q) */ for (i=1; i
CVSS: 5.7EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38512 – wifi: prevent A-MSDU attacks in mesh networks
https://notcve.org/view.php?id=CVE-2025-38512
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: prevent A-MSDU attacks in mesh networks This patch is a mitigation to prevent the A-MSDU spoofing vulnerability for mesh networks. The initial update to the IEEE 802.11 standard, in response to the FragAttacks, missed this case (CVE-2025-27558). It can be considered a variant of CVE-2020-24588 but for mesh networks. This patch tries to detect if a standard MSDU was turned into an A-MSDU by an adversary. This is done by parsing a recei... • https://git.kernel.org/stable/c/e2c8a3c0388aef6bfc4aabfba07bc7dff16eea80 •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2025-38507 – HID: nintendo: avoid bluetooth suspend/resume stalls
https://notcve.org/view.php?id=CVE-2025-38507
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: avoid bluetooth suspend/resume stalls Ensure we don't stall or panic the kernel when using bluetooth-connected controllers. This was reported as an issue on android devices using kernel 6.6 due to the resume hook which had been added for usb joycons. First, set a new state value to JOYCON_CTLR_STATE_SUSPENDED in a newly-added nintendo_hid_suspend. This makes sure we will not stall out the kernel waiting for input reports duri... • https://git.kernel.org/stable/c/2af16c1f846bd60240745bbd3afa13d5f040c61a •
CVSS: 5.0EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38503 – btrfs: fix assertion when building free space tree
https://notcve.org/view.php?id=CVE-2025-38503
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: btrfs: fix assertion when building free space tree When building the free space tree with the block group tree feature enabled, we can hit an assertion failure like this: BTRFS info (device loop0 state M): rebuilding free space tree assertion failed: ret == 0, in fs/btrfs/free-space-tree.c:1102 ------------[ cut here ]------------ kernel BUG at fs/btrfs/free-space-tree.c:1102! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP Modules li... • https://git.kernel.org/stable/c/7c77df23324f60bcff0ea44392e2c82e9486640c •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2025-38502 – bpf: Fix oob access in cgroup local storage
https://notcve.org/view.php?id=CVE-2025-38502
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: bpf: Fix oob access in cgroup local storage Lonial reported that an out-of-bounds access in cgroup local storage can be crafted via tail calls. Given two programs each utilizing a cgroup local storage with a different value size, and one program doing a tail call into the other. The verifier will validate each of the indivial programs just fine. However, in the runtime context the bpf_cg_run_ctx holds an bpf_prog_array_item which contains t... • https://git.kernel.org/stable/c/7d9c3427894fe70d1347b4820476bf37736d2ff0 •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2025-38501 – ksmbd: limit repeated connections from clients with the same IP
https://notcve.org/view.php?id=CVE-2025-38501
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: ksmbd: limit repeated connections from clients with the same IP Repeated connections from clients with the same IP address may exhaust the max connections and prevent other normal client connections. This patch limit repeated connections from clients with the same IP. In the Linux kernel, the following vulnerability has been resolved: ksmbd: limit repeated connections from clients with the same IP Repeated connections from clients with the ... • https://git.kernel.org/stable/c/0626e6641f6b467447c81dd7678a69c66f7746cf •
CVSS: 7.1EPSS: 0%CPEs: 12EXPL: 0CVE-2025-38499 – clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns
https://notcve.org/view.php?id=CVE-2025-38499
11 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns What we want is to verify there is that clone won't expose something hidden by a mount we wouldn't be able to undo. "Wouldn't be able to undo" may be a result of MNT_LOCKED on a child, but it may also come from lacking admin rights in the userns of the namespace mount belongs to. clone_private_mnt() checks the former, but not the latter. There's a number of rat... • https://git.kernel.org/stable/c/427215d85e8d1476da1a86b8d67aceb485eb3631 •