CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2025-38292 – wifi: ath12k: fix invalid access to memory
https://notcve.org/view.php?id=CVE-2025-38292
10 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix invalid access to memory In ath12k_dp_rx_msdu_coalesce(), rxcb is fetched from skb and boolean is_continuation is part of rxcb. Currently, after freeing the skb, the rxcb->is_continuation accessed again which is wrong since the memory is already freed. This might lead use-after-free error. Hence, fix by locally defining bool is_continuation from rxcb, so that after freeing skb, is_continuation can be used. Compile tested o... • https://git.kernel.org/stable/c/d889913205cf7ebda905b1e62c5867ed4e39f6c2 •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2025-38291 – wifi: ath12k: Prevent sending WMI commands to firmware during firmware crash
https://notcve.org/view.php?id=CVE-2025-38291
10 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Prevent sending WMI commands to firmware during firmware crash Currently, we encounter the following kernel call trace when a firmware crash occurs. This happens because the host sends WMI commands to the firmware while it is in recovery, causing the commands to fail and resulting in the kernel call trace. Set the ATH12K_FLAG_CRASH_FLUSH and ATH12K_FLAG_RECOVERY flags when the host driver receives the firmware crash notificati... • https://git.kernel.org/stable/c/a9b46dd2e483bf99fa09e6aeea7701960abaa902 •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2025-38290 – wifi: ath12k: fix node corruption in ar->arvifs list
https://notcve.org/view.php?id=CVE-2025-38290
10 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix node corruption in ar->arvifs list In current WLAN recovery code flow, ath12k_core_halt() only reinitializes the "arvifs" list head. This will cause the list node immediately following the list head to become an invalid list node. Because the prev of that node still points to the list head "arvifs", but the next of the list head "arvifs" no longer points to that list node. When a WLAN recovery occurs during the execution o... • https://git.kernel.org/stable/c/d889913205cf7ebda905b1e62c5867ed4e39f6c2 •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2025-38289 – scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk
https://notcve.org/view.php?id=CVE-2025-38289
10 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk Smatch detected a potential use-after-free of an ndlp oject in dev_loss_tmo_callbk during driver unload or fatal error handling. Fix by reordering code to avoid potential use-after-free if initial nodelist reference has been previously removed. In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_... • https://git.kernel.org/stable/c/e4913d4bc59227fbdfe6b8f5541f49aaea1cb41c •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2025-38288 – scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels
https://notcve.org/view.php?id=CVE-2025-38288
10 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels Correct kernel call trace when calling smp_processor_id() when called in preemptible kernels by using raw_smp_processor_id(). smp_processor_id() checks to see if preemption is disabled and if not, issue an error message followed by a call to dump_stack(). Brief example of call trace: kernel: check_preemption_disabled: 436 callbacks suppressed kernel: BUG: using smp_pr... • https://git.kernel.org/stable/c/283dcc1b142ebd60786f8f5e3fbbd53a51035739 •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2025-38287 – IB/cm: Drop lockdep assert and WARN when freeing old msg
https://notcve.org/view.php?id=CVE-2025-38287
10 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: IB/cm: Drop lockdep assert and WARN when freeing old msg The send completion handler can run after cm_id has advanced to another message. The cm_id lock is not needed in this case, but a recent change re-used cm_free_priv_msg(), which asserts that the lock is held and WARNs if the cm_id's currently outstanding msg is different than the one being freed. In the Linux kernel, the following vulnerability has been resolved: IB/cm: Drop lockdep a... • https://git.kernel.org/stable/c/1e5159219076ddb2e44338c667c83fd1bd43dfef •
CVSS: 8.5EPSS: 0%CPEs: 8EXPL: 0CVE-2025-38286 – pinctrl: at91: Fix possible out-of-boundary access
https://notcve.org/view.php?id=CVE-2025-38286
10 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: pinctrl: at91: Fix possible out-of-boundary access at91_gpio_probe() doesn't check that given OF alias is not available or something went wrong when trying to get it. This might have consequences when accessing gpio_chips array with that value as an index. Note, that BUG() can be compiled out and hence won't actually perform the required checks. In the Linux kernel, the following vulnerability has been resolved: pinctrl: at91: Fix possible ... • https://git.kernel.org/stable/c/6732ae5cb47c4f9a72727585956f2a5e069d1637 •
CVSS: 7.1EPSS: 0%CPEs: 10EXPL: 0CVE-2025-38285 – bpf: Fix WARN() in get_bpf_raw_tp_regs
https://notcve.org/view.php?id=CVE-2025-38285
10 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: bpf: Fix WARN() in get_bpf_raw_tp_regs syzkaller reported an issue: WARNING: CPU: 3 PID: 5971 at kernel/trace/bpf_trace.c:1861 get_bpf_raw_tp_regs+0xa4/0x100 kernel/trace/bpf_trace.c:1861 Modules linked in: CPU: 3 UID: 0 PID: 5971 Comm: syz-executor205 Not tainted 6.15.0-rc5-syzkaller-00038-g707df3375124 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:get_bpf_raw_... • https://git.kernel.org/stable/c/9594dc3c7e71b9f52bee1d7852eb3d4e3aea9e99 •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2025-38284 – wifi: rtw89: pci: configure manual DAC mode via PCI config API only
https://notcve.org/view.php?id=CVE-2025-38284
10 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: pci: configure manual DAC mode via PCI config API only To support 36-bit DMA, configure chip proprietary bit via PCI config API or chip DBI interface. However, the PCI device mmap isn't set yet and the DBI is also inaccessible via mmap, so only if the bit can be accessible via PCI config API, chip can support 36-bit DMA. Otherwise, fallback to 32-bit DMA. With NULL mmap address, kernel throws trace: BUG: unable to handle page f... • https://git.kernel.org/stable/c/1fd4b3fe52efd5ad1647966f619c10988e7a4457 •
CVSS: 7.1EPSS: 0%CPEs: 4EXPL: 0CVE-2025-38283 – hisi_acc_vfio_pci: bugfix live migration function without VF device driver
https://notcve.org/view.php?id=CVE-2025-38283
10 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: hisi_acc_vfio_pci: bugfix live migration function without VF device driver If the VF device driver is not loaded in the Guest OS and we attempt to perform device data migration, the address of the migrated data will be NULL. The live migration recovery operation on the destination side will access a null address value, which will cause access errors. Therefore, live migration of VMs without added VF device drivers does not require device da... • https://git.kernel.org/stable/c/b0eed085903e7758532696d64397901a75bba8ba •