CVSS: -EPSS: 0%CPEs: 8EXPL: 0CVE-2025-38387 – RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
https://notcve.org/view.php?id=CVE-2025-38387
25 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert The obj_event may be loaded immediately after inserted, then if the list_head is not initialized then we may get a poisonous pointer. This fixes the crash below: mlx5_core 0000:03:00.0: MLX5E: StrdRq(1) RqSz(8) StrdSz(2048) RxCqeCmprss(0 enhanced) mlx5_core.sf mlx5_core.sf.4: firmware version: 32.38.3056 mlx5_core 0000:03:00.0 en3f0pf0sf2002: renamed from eth0 mlx5_core.sf mlx5_... • https://git.kernel.org/stable/c/7597385371425febdaa8c6a1da3625d4ffff16f5 •
CVSS: -EPSS: 0%CPEs: 8EXPL: 0CVE-2025-38386 – ACPICA: Refuse to evaluate a method if arguments are missing
https://notcve.org/view.php?id=CVE-2025-38386
25 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: ACPICA: Refuse to evaluate a method if arguments are missing As reported in [1], a platform firmware update that increased the number of method parameters and forgot to update a least one of its callers, caused ACPICA to crash due to use-after-free. Since this a result of a clear AML issue that arguably cannot be fixed up by the interpreter (it cannot produce missing data out of thin air), address it by making ACPICA refuse to evaluate a me... • https://git.kernel.org/stable/c/b49d224d1830c46e20adce2a239c454cdab426f1 •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38385 – net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect
https://notcve.org/view.php?id=CVE-2025-38385
25 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect Remove redundant netif_napi_del() call from disconnect path. A WARN may be triggered in __netif_napi_del_locked() during USB device disconnect: WARNING: CPU: 0 PID: 11 at net/core/dev.c:7417 __netif_napi_del_locked+0x2b4/0x350 This happens because netif_napi_del() is called in the disconnect path while NAPI is still enabled. However, it is not necessary to call netif_napi_... • https://git.kernel.org/stable/c/ec4c7e12396b1a30fbacfa68425118f5b46ea878 •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2025-38384 – mtd: spinand: fix memory leak of ECC engine conf
https://notcve.org/view.php?id=CVE-2025-38384
25 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: fix memory leak of ECC engine conf Memory allocated for the ECC engine conf is not released during spinand cleanup. Below kmemleak trace is seen for this memory leak: unreferenced object 0xffffff80064f00e0 (size 8): comm "swapper/0", pid 1, jiffies 4294937458 hex dump (first 8 bytes): 00 00 00 00 00 00 00 00 ........ backtrace (crc 0): kmemleak_alloc+0x30/0x40 __kmalloc_cache_noprof+0x208/0x3c0 spinand_ondie_ecc_init_ctx+0x114... • https://git.kernel.org/stable/c/68d3417305ee100dcad90fd6e5846b22497aa394 •
CVSS: 6.3EPSS: 0%CPEs: 3EXPL: 0CVE-2025-38383 – mm/vmalloc: fix data race in show_numa_info()
https://notcve.org/view.php?id=CVE-2025-38383
25 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: fix data race in show_numa_info() The following data-race was found in show_numa_info(): ================================================================== BUG: KCSAN: data-race in vmalloc_info_show / vmalloc_info_show read to 0xffff88800971fe30 of 4 bytes by task 8289 on cpu 0: show_numa_info mm/vmalloc.c:4936 [inline] vmalloc_info_show+0x5a8/0x7e0 mm/vmalloc.c:5016 seq_read_iter+0x373/0xb40 fs/seq_file.c:230 proc_reg_read_iter... • https://git.kernel.org/stable/c/8e1d743f2c2671aa54f6f91a2b33823f92512870 •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38382 – btrfs: fix iteration of extrefs during log replay
https://notcve.org/view.php?id=CVE-2025-38382
25 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: btrfs: fix iteration of extrefs during log replay At __inode_add_ref() when processing extrefs, if we jump into the next label we have an undefined value of victim_name.len, since we haven't initialized it before we did the goto. This results in an invalid memory access in the next iteration of the loop since victim_name.len was not initialized to the length of the name of the current extref. Fix this by initializing victim_name.len with th... • https://git.kernel.org/stable/c/1cf474cd474bc5d3ef63086ffd009a87a5b7bb2e •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-38381 – Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt()
https://notcve.org/view.php?id=CVE-2025-38381
25 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: Input: cs40l50-vibra - fix potential NULL dereference in cs40l50_upload_owt() The cs40l50_upload_owt() function allocates memory via kmalloc() without checking for allocation failure, which could lead to a NULL pointer dereference. Return -ENOMEM in case allocation fails. In the Linux kernel, the following vulnerability has been resolved: Input: cs40l50-vibra - fix... • https://git.kernel.org/stable/c/c38fe1bb5d21c2ce0857965ee06174ee587d6b42 •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2025-38380 – i2c/designware: Fix an initialization issue
https://notcve.org/view.php?id=CVE-2025-38380
25 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: i2c/designware: Fix an initialization issue The i2c_dw_xfer_init() function requires msgs and msg_write_idx from the dev context to be initialized. amd_i2c_dw_xfer_quirk() inits msgs and msgs_num, but not msg_write_idx. This could allow an out of bounds access (of msgs). Initialize msg_write_idx before calling i2c_dw_xfer_init(). • https://git.kernel.org/stable/c/17631e8ca2d3421090e54b39d9a1402091019ba1 •
CVSS: 5.9EPSS: 0%CPEs: 3EXPL: 0CVE-2025-38379 – smb: client: fix warning when reconnecting channel
https://notcve.org/view.php?id=CVE-2025-38379
25 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: smb: client: fix warning when reconnecting channel When reconnecting a channel in smb2_reconnect_server(), a dummy tcon is passed down to smb2_reconnect() with ->query_interface uninitialized, so we can't call queue_delayed_work() on it. Fix the following warning by ensuring that we're queueing the delayed worker from correct tcon. WARNING: CPU: 4 PID: 1126 at kernel/workqueue.c:2498 __queue_delayed_work+0x1d2/0x200 Modules linked in: cifs ... • https://git.kernel.org/stable/c/202d7e838967dda02855cd925db7fd8c52c56af7 •
CVSS: 7.3EPSS: 0%CPEs: 2EXPL: 0CVE-2025-38378 – HID: appletb-kbd: fix slab use-after-free bug in appletb_kbd_probe
https://notcve.org/view.php?id=CVE-2025-38378
25 Jul 2025 — In the Linux kernel, the following vulnerability has been resolved: HID: appletb-kbd: fix slab use-after-free bug in appletb_kbd_probe In probe appletb_kbd_probe() a "struct appletb_kbd *kbd" is allocated via devm_kzalloc() to store touch bar keyboard related data. Later on if backlight_device_get_by_name() finds a backlight device with name "appletb_backlight" a timer (kbd->inactivity_timer) is setup with appletb_inactivity_timer() and the timer is armed to run after appletb_tb_dim_timeout (60) seconds. A ... • https://git.kernel.org/stable/c/93a0fc48948107e0cc34e1de22c3cb363a8f2783 •