CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2025-38261 – riscv: save the SR_SUM status over switches
https://notcve.org/view.php?id=CVE-2025-38261
09 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: riscv: save the SR_SUM status over switches When threads/tasks are switched we need to ensure the old execution's SR_SUM state is saved and the new thread has the old SR_SUM state restored. The issue was seen under heavy load especially with the syz-stress tool running, with crashes as follows in schedule_tail: Unable to handle kernel access to user memory without uaccess routines at virtual address 000000002749f0d0 Oops [#1] Modules linked... • https://git.kernel.org/stable/c/76d2a0493a17d4c8ecc781366850c3c4f8e1a446 •
CVSS: 6.9EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38260 – btrfs: handle csum tree error with rescue=ibadroots correctly
https://notcve.org/view.php?id=CVE-2025-38260
09 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: btrfs: handle csum tree error with rescue=ibadroots correctly [BUG] There is syzbot based reproducer that can crash the kernel, with the following call trace: (With some debug output added) DEBUG: rescue=ibadroots parsed BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop0 (7:0) scanned by repro (1010) BTRFS info (device loop0): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 BTRFS info (device... • https://git.kernel.org/stable/c/abed4aaae4f71a7bcdbe90a65319b6e772a2689d •
CVSS: 7.1EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38259 – ASoC: codecs: wcd9335: Fix missing free of regulator supplies
https://notcve.org/view.php?id=CVE-2025-38259
09 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd9335: Fix missing free of regulator supplies Driver gets and enables all regulator supplies in probe path (wcd9335_parse_dt() and wcd9335_power_on_reset()), but does not cleanup in final error paths and in unbind (missing remove() callback). This leads to leaked memory and unbalanced regulator enable count during probe errors or unbind. Fix this by converting entire code into devm_regulator_bulk_get_enable() which also grea... • https://git.kernel.org/stable/c/20aedafdf4926e7a957f8b302a18c8fb75c7e332 •
CVSS: 7.1EPSS: 0%CPEs: 4EXPL: 0CVE-2025-38258 – mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write
https://notcve.org/view.php?id=CVE-2025-38258
09 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write memcg_path_store() assigns a newly allocated memory buffer to filter->memcg_path, without deallocating the previously allocated and assigned memory buffer. As a result, users can leak kernel memory by continuously writing a data to memcg_path DAMOS sysfs file. Fix the leak by deallocating the previously set memory buffer. In the Linux kernel, the following vulne... • https://git.kernel.org/stable/c/7ee161f18b5da5170b5d6a51aace49d312099128 •
CVSS: 7.1EPSS: 0%CPEs: 6EXPL: 0CVE-2025-38257 – s390/pkey: Prevent overflow in size calculation for memdup_user()
https://notcve.org/view.php?id=CVE-2025-38257
09 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Prevent overflow in size calculation for memdup_user() Number of apqn target list entries contained in 'nr_apqns' variable is determined by userspace via an ioctl call so the result of the product in calculation of size passed to memdup_user() may overflow. In this case the actual size of the allocated area and the value describing it won't be in sync leading to various types of unpredictable behaviour later. Use a proper memdup_... • https://git.kernel.org/stable/c/f2bbc96e7cfad3891b7bf9bd3e566b9b7ab4553d •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2025-38256 – io_uring/rsrc: fix folio unpinning
https://notcve.org/view.php?id=CVE-2025-38256
09 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: fix folio unpinning syzbot complains about an unmapping failure: [ 108.070381][ T14] kernel BUG at mm/gup.c:71! [ 108.070502][ T14] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 108.123672][ T14] Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20250221-8.fc42 02/21/2025 [ 108.127458][ T14] Workqueue: iou_exit io_ring_exit_work [ 108.174205][ T14] Call trace: [ 108.175649][ T14] sanity_check_pinned_pages+0x7cc/0x7... • https://git.kernel.org/stable/c/a8edbb424b1391b077407c75d8f5d2ede77aa70d •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2025-38255 – lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()
https://notcve.org/view.php?id=CVE-2025-38255
09 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() While testing null_blk with configfs, echo 0 > poll_queues will trigger following panic: BUG: kernel NULL pointer dereference, address: 0000000000000010 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 27 UID: 0 PID: 920 Comm: bash Not tainted 6.15.0-02023-gadbdb95c8696-dirty #1238 PREEMPT(undef) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP... • https://git.kernel.org/stable/c/6a6dcae8f486c3f3298d0767d34505121c7b0b81 •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-38253 – HID: wacom: fix crash in wacom_aes_battery_handler()
https://notcve.org/view.php?id=CVE-2025-38253
09 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix crash in wacom_aes_battery_handler() Commit fd2a9b29dc9c ("HID: wacom: Remove AES power_supply after extended inactivity") introduced wacom_aes_battery_handler() which is scheduled as a delayed work (aes_battery_work). In wacom_remove(), aes_battery_work is not canceled. Consequently, if the device is removed while aes_battery_work is still pending, then hard crashes or "Oops: general protection fault..." are experienced whe... • https://git.kernel.org/stable/c/fd2a9b29dc9c4c35def91d5d1c5b470843539de6 •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2025-38251 – atm: clip: prevent NULL deref in clip_push()
https://notcve.org/view.php?id=CVE-2025-38251
09 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: atm: clip: prevent NULL deref in clip_push() Blamed commit missed that vcc_destroy_socket() calls clip_push() with a NULL skb. If clip_devs is NULL, clip_push() then crashes when reading skb->truesize. In the Linux kernel, the following vulnerability has been resolved: atm: clip: prevent NULL deref in clip_push() Blamed commit missed that vcc_destroy_socket() calls clip_push() with a NULL skb. If clip_devs is NULL, clip_push() then crashes ... • https://git.kernel.org/stable/c/93a2014afbace907178afc3c9c1e62c9a338595a •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2025-38250 – Bluetooth: hci_core: Fix use-after-free in vhci_flush()
https://notcve.org/view.php?id=CVE-2025-38250
09 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix use-after-free in vhci_flush() syzbot reported use-after-free in vhci_flush() without repro. [0] From the splat, a thread close()d a vhci file descriptor while its device was being used by iotcl() on another thread. Once the last fd refcnt is released, vhci_release() calls hci_unregister_dev(), hci_free_dev(), and kfree() for struct vhci_data, which is set to hci_dev->dev->driver_data. The problem is that there is n... • https://git.kernel.org/stable/c/bf18c7118cf83ad4b9aa476354b4a06bcb9d0c4f •