CVSS: 7.8EPSS: %CPEs: 5EXPL: 0CVE-2025-37924 – ksmbd: fix use-after-free in kerberos authentication
https://notcve.org/view.php?id=CVE-2025-37924
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in kerberos authentication Setting sess->user = NULL was introduced to fix the dangling pointer created by ksmbd_free_user. However, it is possible another thread could be operating on the session and make use of sess->user after it has been passed to ksmbd_free_user but before sess->user is set to NULL. In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in kerberos authen... • https://git.kernel.org/stable/c/e34a33d5d7e87399af0a138bb32f6a3e95dd83d2 •
CVSS: 7.8EPSS: %CPEs: 6EXPL: 0CVE-2025-37923 – tracing: Fix oob write in trace_seq_to_buffer()
https://notcve.org/view.php?id=CVE-2025-37923
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: tracing: Fix oob write in trace_seq_to_buffer() syzbot reported this bug: ================================================================== BUG: KASAN: slab-out-of-bounds in trace_seq_to_buffer kernel/trace/trace.c:1830 [inline] BUG: KASAN: slab-out-of-bounds in tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822 Write of size 4507 at addr ffff888032b6b000 by task syz.2.320/7260 CPU: 1 UID: 0 PID: 7260 Comm: syz.2.320 Not tainte... • https://git.kernel.org/stable/c/3c56819b14b00dd449bd776303e61f8532fad09f •
CVSS: 5.5EPSS: %CPEs: 4EXPL: 0CVE-2025-37922 – book3s64/radix : Align section vmemmap start address to PAGE_SIZE
https://notcve.org/view.php?id=CVE-2025-37922
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: book3s64/radix : Align section vmemmap start address to PAGE_SIZE A vmemmap altmap is a device-provided region used to provide backing storage for struct pages. For each namespace, the altmap should belong to that same namespace. If the namespaces are created unaligned, there is a chance that the section vmemmap start address could also be unaligned. If the section vmemmap start address is unaligned, the altmap page allocated from the curre... • https://git.kernel.org/stable/c/368a0590d954a659b16ab945328ada0cc10f93a0 •
CVSS: 7.1EPSS: %CPEs: 5EXPL: 0CVE-2025-37921 – vxlan: vnifilter: Fix unlocked deletion of default FDB entry
https://notcve.org/view.php?id=CVE-2025-37921
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: Fix unlocked deletion of default FDB entry When a VNI is deleted from a VXLAN device in 'vnifilter' mode, the FDB entry associated with the default remote (assuming one was configured) is deleted without holding the hash lock. This is wrong and will result in a warning [1] being generated by the lockdep annotation that was added by commit ebe642067455 ("vxlan: Create wrappers for FDB lookup"). Reproducer: # ip link add vx0... • https://git.kernel.org/stable/c/f9c4bb0b245cee35ef66f75bf409c9573d934cf9 •
CVSS: 5.4EPSS: %CPEs: 5EXPL: 0CVE-2025-37920 – xsk: Fix race condition in AF_XDP generic RX path
https://notcve.org/view.php?id=CVE-2025-37920
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: xsk: Fix race condition in AF_XDP generic RX path Move rx_lock from xsk_socket to xsk_buff_pool. Fix synchronization for shared umem mode in generic RX path where multiple sockets share single xsk_buff_pool. RX queue is exclusive to xsk_socket, while FILL queue can be shared between multiple sockets. This could result in race condition where two CPU cores access RX path of two different sockets sharing the same umem. Protect both queues by ... • https://git.kernel.org/stable/c/bf0bdd1343efbbf65b4d53aef1fce14acbd79d50 •
CVSS: 5.7EPSS: %CPEs: 4EXPL: 0CVE-2025-37918 – Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue()
https://notcve.org/view.php?id=CVE-2025-37918
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() A NULL pointer dereference can occur in skb_dequeue() when processing a QCA firmware crash dump on WCN7851 (0489:e0f3). [ 93.672166] Bluetooth: hci0: ACL memdump size(589824) [ 93.672475] BUG: kernel NULL pointer dereference, address: 0000000000000008 [ 93.672517] Workqueue: hci0 hci_devcd_rx [bluetooth] [ 93.672598] RIP: 0010:skb_dequeue+0x50/0x80 The issue stems from handle... • https://git.kernel.org/stable/c/20981ce2d5a5f79d17da1ace3a93df7b3c6ba3d6 •
CVSS: 5.6EPSS: %CPEs: 5EXPL: 0CVE-2025-37917 – net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll
https://notcve.org/view.php?id=CVE-2025-37917
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll Use spin_lock_irqsave and spin_unlock_irqrestore instead of spin_lock and spin_unlock in mtk_star_emac driver to avoid spinlock recursion occurrence that can happen when enabling the DMA interrupts again in rx/tx poll. ``` BUG: spinlock recursion on CPU#0, swapper/0/0 lock: 0xffff00000db9cf20, .magic: dead4ead, .owner: swapper/0/0, .owner_cpu: 0 CPU: 0 UID: 0 PID: 0 C... • https://git.kernel.org/stable/c/0a8bd81fd6aaace14979152e0540da8ff158a00a •
CVSS: 8.4EPSS: %CPEs: 4EXPL: 0CVE-2025-37916 – pds_core: remove write-after-free of client_id
https://notcve.org/view.php?id=CVE-2025-37916
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: pds_core: remove write-after-free of client_id A use-after-free error popped up in stress testing: [Mon Apr 21 21:21:33 2025] BUG: KFENCE: use-after-free write in pdsc_auxbus_dev_del+0xef/0x160 [pds_core] [Mon Apr 21 21:21:33 2025] Use-after-free write at 0x000000007013ecd1 (in kfence-#47): [Mon Apr 21 21:21:33 2025] pdsc_auxbus_dev_del+0xef/0x160 [pds_core] [Mon Apr 21 21:21:33 2025] pdsc_remove+0xc0/0x1b0 [pds_core] [Mon Apr 21 21:21:33 2... • https://git.kernel.org/stable/c/10659034c622738bc1bfab8a76fc576c52d5acce •
CVSS: 7.8EPSS: %CPEs: 6EXPL: 0CVE-2025-37915 – net_sched: drr: Fix double list add in class with netem as child qdisc
https://notcve.org/view.php?id=CVE-2025-37915
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: net_sched: drr: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of drr, there won't be a UAF, but the code will add the same classifier to the list twice, which will cause memory corruption. In addition to checking for qlen being zero, this patch checks whether the class was already ... • https://git.kernel.org/stable/c/37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea •
CVSS: 7.8EPSS: %CPEs: 6EXPL: 0CVE-2025-37914 – net_sched: ets: Fix double list add in class with netem as child qdisc
https://notcve.org/view.php?id=CVE-2025-37914
20 May 2025 — In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant. In the case of ets, there won't be a UAF, but the code will add the same classifier to the list twice, which will cause memory corruption. In addition to checking for qlen being zero, this patch checks whether the class was already ... • https://git.kernel.org/stable/c/37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea •