CVSS: 8.5EPSS: 0%CPEs: 7EXPL: 0CVE-2025-23160 – media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization
https://notcve.org/view.php?id=CVE-2025-23160
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization On Mediatek devices with a system companion processor (SCP) the mtk_scp structure has to be removed explicitly to avoid a resource leak. Free the structure in case the allocation of the firmware structure fails during the firmware initialization. In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix a resour... • https://git.kernel.org/stable/c/f066882293b5ad359e44c4ed24ab1811ffb0b354 •
CVSS: 7.1EPSS: 0%CPEs: 9EXPL: 0CVE-2025-23159 – media: venus: hfi: add a check to handle OOB in sfr region
https://notcve.org/view.php?id=CVE-2025-23159
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add a check to handle OOB in sfr region sfr->buf_size is in shared memory and can be modified by malicious user. OOB write is possible when the size is made higher than actual sfr data buffer. Cap the size to allocated size for such cases. In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add a check to handle OOB in sfr region sfr->buf_size is in shared memory and can be modified by m... • https://git.kernel.org/stable/c/d96d3f30c0f2f564f6922bf4ccdf4464992e31fb •
CVSS: 8.5EPSS: 0%CPEs: 9EXPL: 0CVE-2025-23158 – media: venus: hfi: add check to handle incorrect queue size
https://notcve.org/view.php?id=CVE-2025-23158
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add check to handle incorrect queue size qsize represents size of shared queued between driver and video firmware. Firmware can modify this value to an invalid large value. In such situation, empty_space will be bigger than the space actually available. Since new_wr_idx is not checked, so the following code will result in an OOB write. ... qsize = qhdr->q_size if (wr_idx >= rd_idx) empty_space = qsize - (wr_idx - rd_idx) ... • https://git.kernel.org/stable/c/d96d3f30c0f2f564f6922bf4ccdf4464992e31fb •
CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 0CVE-2025-23157 – media: venus: hfi_parser: add check to avoid out of bound access
https://notcve.org/view.php?id=CVE-2025-23157
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi_parser: add check to avoid out of bound access There is a possibility that init_codecs is invoked multiple times during manipulated payload from video firmware. In such case, if codecs_count can get incremented to value more than MAX_CODEC_NUM, there can be OOB access. Reset the count so that it always starts from beginning. In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi_parser: add c... • https://git.kernel.org/stable/c/1a73374a04e555103e5369429a30999114001dda •
CVSS: 7.1EPSS: 0%CPEs: 8EXPL: 0CVE-2025-23156 – media: venus: hfi_parser: refactor hfi packet parsing logic
https://notcve.org/view.php?id=CVE-2025-23156
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi_parser: refactor hfi packet parsing logic words_count denotes the number of words in total payload, while data points to payload of various property within it. When words_count reaches last word, data can access memory beyond the total payload. This can lead to OOB access. With this patch, the utility api for handling individual properties now returns the size of data consumed. Accordingly remaining bytes are calculated be... • https://git.kernel.org/stable/c/1a73374a04e555103e5369429a30999114001dda •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2025-23155 – net: stmmac: Fix accessing freed irq affinity_hint
https://notcve.org/view.php?id=CVE-2025-23155
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Fix accessing freed irq affinity_hint The cpumask should not be a local variable, since its pointer is saved to irq_desc and may be accessed from procfs. To fix it, use the persistent mask cpumask_of(cpu#). In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Fix accessing freed irq affinity_hint The cpumask should not be a local variable, since its pointer is saved to irq_desc and may be accessed fr... • https://git.kernel.org/stable/c/8deec94c6040bb4a767f6e9456a0a44c7f2e713e •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2025-23154 – io_uring/net: fix io_req_post_cqe abuse by send bundle
https://notcve.org/view.php?id=CVE-2025-23154
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix io_req_post_cqe abuse by send bundle [ 114.987980][ T5313] WARNING: CPU: 6 PID: 5313 at io_uring/io_uring.c:872 io_req_post_cqe+0x12e/0x4f0 [ 114.991597][ T5313] RIP: 0010:io_req_post_cqe+0x12e/0x4f0 [ 115.001880][ T5313] Call Trace: [ 115.002222][ T5313]
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2025-23153 – arm/crc-t10dif: fix use of out-of-scope array in crc_t10dif_arch()
https://notcve.org/view.php?id=CVE-2025-23153
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: arm/crc-t10dif: fix use of out-of-scope array in crc_t10dif_arch() Fix a silly bug where an array was used outside of its scope. • https://git.kernel.org/stable/c/1684e8293605062dee45a5e4118fe8db6cd0d9d9 •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2025-23152 – arm64/crc-t10dif: fix use of out-of-scope array in crc_t10dif_arch()
https://notcve.org/view.php?id=CVE-2025-23152
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: arm64/crc-t10dif: fix use of out-of-scope array in crc_t10dif_arch() Fix a silly bug where an array was used outside of its scope. • https://git.kernel.org/stable/c/2051da858534a73589cdb27af914fe1c03b9ee98 •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2025-23151 – bus: mhi: host: Fix race between unprepare and queue_buf
https://notcve.org/view.php?id=CVE-2025-23151
01 May 2025 — In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Fix race between unprepare and queue_buf A client driver may use mhi_unprepare_from_transfer() to quiesce incoming data during the client driver's tear down. The client driver might also be processing data at the same time, resulting in a call to mhi_queue_buf() which will invoke mhi_gen_tre(). If mhi_gen_tre() runs after mhi_unprepare_from_transfer() has torn down the channel, a panic will occur due to an invalid dereferenc... • https://git.kernel.org/stable/c/176ed1727badd2fad2158e2b214dcbc24f4be7a1 •