CVSS: 7.8EPSS: %CPEs: 4EXPL: 0CVE-2025-37935 – net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM
https://notcve.org/view.php?id=CVE-2025-37935
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM If the mtk_poll_rx() function detects the MTK_RESETTING flag, it will jump to release_desc and refill the high word of the SDP on the 4GB RFB. Subsequently, mtk_rx_clean will process an incorrect SDP, leading to a panic. Add patch from MediaTek's SDK to resolve this. In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ ... • https://git.kernel.org/stable/c/2d75891ebc09ba9cf30697dfd54497ef0220308f •
CVSS: 7.1EPSS: %CPEs: 3EXPL: 0CVE-2025-37934 – ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction
https://notcve.org/view.php?id=CVE-2025-37934
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction Actually check if the passed pointers are valid, before writing to them. This also fixes a USBAN warning: UBSAN: invalid-load in ../sound/soc/fsl/imx-card.c:687:25 load of value 255 is not a valid value for type '_Bool' This is because playback_only is uninitialized and is not written to, as the playback-only property is absent. In the Linux kernel, the following ... • https://git.kernel.org/stable/c/844de7eebe97a1c277f8a408457712086c957195 •
CVSS: 5.5EPSS: %CPEs: 4EXPL: 0CVE-2025-37933 – octeon_ep: Fix host hang issue during device reboot
https://notcve.org/view.php?id=CVE-2025-37933
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: octeon_ep: Fix host hang issue during device reboot When the host loses heartbeat messages from the device, the driver calls the device-specific ndo_stop function, which frees the resources. If the driver is unloaded in this scenario, it calls ndo_stop again, attempting to free resources that have already been freed, leading to a host hang issue. To resolve this, dev_close should be called instead of the device-specific stop function.dev_cl... • https://git.kernel.org/stable/c/5cb96c29aa0ea359e4f5d30585538dc6a847d69d •
CVSS: 5.5EPSS: %CPEs: 5EXPL: 0CVE-2025-37932 – sch_htb: make htb_qlen_notify() idempotent
https://notcve.org/view.php?id=CVE-2025-37932
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: sch_htb: make htb_qlen_notify() idempotent htb_qlen_notify() always deactivates the HTB class and in fact could trigger a warning if it is already deactivated. Therefore, it is not idempotent and not friendly to its callers, like fq_codel_dequeue(). Let's make it idempotent to ease qdisc_tree_reduce_backlog() callers' life. In the Linux kernel, the following vulnerability has been resolved: sch_htb: make htb_qlen_notify() idempotent htb_qle... • https://git.kernel.org/stable/c/73cf6af13153d62f9b76eff422eea79dbc70f15e •
CVSS: 7.8EPSS: %CPEs: 3EXPL: 0CVE-2025-37931 – btrfs: adjust subpage bit start based on sectorsize
https://notcve.org/view.php?id=CVE-2025-37931
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: btrfs: adjust subpage bit start based on sectorsize When running machines with 64k page size and a 16k nodesize we started seeing tree log corruption in production. This turned out to be because we were not writing out dirty blocks sometimes, so this in fact affects all metadata writes. When writing out a subpage EB we scan the subpage bitmap for a dirty range. If the range isn't dirty we do bit_start++; to move onto the next bit. The probl... • https://git.kernel.org/stable/c/c4aec299fa8f73f0fd10bc556f936f0da50e3e83 •
CVSS: 7.1EPSS: %CPEs: 6EXPL: 0CVE-2025-37930 – drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill()
https://notcve.org/view.php?id=CVE-2025-37930
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() Nouveau is mostly designed in a way that it's expected that fences only ever get signaled through nouveau_fence_signal(). However, in at least one other place, nouveau_fence_done(), can signal fences, too. If that happens (race) a signaled fence remains in the pending list for a while, until it gets removed by nouveau_fence_update(). Should nouveau_fence_context_kill() run in the mean... • https://git.kernel.org/stable/c/ea13e5abf807ea912ce84eef6a1946b9a38c6508 •
CVSS: 7.1EPSS: %CPEs: 7EXPL: 0CVE-2025-37929 – arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays
https://notcve.org/view.php?id=CVE-2025-37929
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays Commit a5951389e58d ("arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists") added some additional CPUs to the Spectre-BHB workaround, including some new arrays for designs that require new 'k' values for the workaround to be effective. Unfortunately, the new arrays omitted the sentinel entry and so is_midr_in_range_list() will walk off the end when it do... • https://git.kernel.org/stable/c/46e22de65eb45a67a68ddfe9301f79b0c3821ca8 •
CVSS: 5.5EPSS: %CPEs: 5EXPL: 0CVE-2025-37928 – dm-bufio: don't schedule in atomic context
https://notcve.org/view.php?id=CVE-2025-37928
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: dm-bufio: don't schedule in atomic context A BUG was reported as below when CONFIG_DEBUG_ATOMIC_SLEEP and try_verify_in_tasklet are enabled. [ 129.444685][ T934] BUG: sleeping function called from invalid context at drivers/md/dm-bufio.c:2421 [ 129.444723][ T934] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 934, name: kworker/1:4 [ 129.444740][ T934] preempt_count: 201, expected: 0 [ 129.444756][ T934] RCU nest depth: 0, expected:... • https://git.kernel.org/stable/c/7cd326747f46ffe1c7bff5682e97dfbcb98990ec •
CVSS: 7.8EPSS: %CPEs: 6EXPL: 0CVE-2025-37927 – iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
https://notcve.org/view.php?id=CVE-2025-37927
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid There is a string parsing logic error which can lead to an overflow of hid or uid buffers. Comparing ACPIID_LEN against a total string length doesn't take into account the lengths of individual hid and uid buffers so the check is insufficient in some cases. For example if the length of hid string is 4 and the length of the uid string is 260, the length of str will be equal to AC... • https://git.kernel.org/stable/c/ca3bf5d47cec8b7614bcb2e9132c40081d6d81db •
CVSS: 7.8EPSS: %CPEs: 3EXPL: 0CVE-2025-37926 – ksmbd: fix use-after-free in ksmbd_session_rpc_open
https://notcve.org/view.php?id=CVE-2025-37926
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_session_rpc_open A UAF issue can occur due to a race condition between ksmbd_session_rpc_open() and __session_rpc_close(). Add rpc_lock to the session to protect it. In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_session_rpc_open A UAF issue can occur due to a race condition between ksmbd_session_rpc_open() and __session_rpc_close(). Add rpc_lock to t... • https://git.kernel.org/stable/c/8fb3b6c85b7e3127161623586b62abcc366caa20 •