CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 0CVE-2023-4515 – ksmbd: validate command request size
https://notcve.org/view.php?id=CVE-2023-4515
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate command request size In commit 2b9b8f3b68ed ("ksmbd: validate command payload size"), except for SMB2_OPLOCK_BREAK_HE command, the request size of other commands is not checked, it's not expected. Fix it by add check for request size of other commands. In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate command request size In commit 2b9b8f3b68ed ("ksmbd: validate command payload size"), excep... • https://git.kernel.org/stable/c/35f450f54dca1519bb24faacd0428db09f89a11f •
CVSS: 7.1EPSS: 0%CPEs: 4EXPL: 0CVE-2025-38552 – mptcp: plug races between subflow fail and subflow creation
https://notcve.org/view.php?id=CVE-2025-38552
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: mptcp: plug races between subflow fail and subflow creation We have races similar to the one addressed by the previous patch between subflow failing and additional subflow creation. They are just harder to trigger. The solution is similar. Use a separate flag to track the condition 'socket state prevent any additional subflow creation' protected by the fallback lock. The socket fallback makes such flag true, and also receiving or sending an... • https://git.kernel.org/stable/c/478d770008b03ed9d74bdc8add2315b7fd124ecc •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38550 – ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
https://notcve.org/view.php?id=CVE-2025-38550
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec() does, the reference should be put after ip6_mc_clear_src() return. In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec() does, the reference should be put after ip6_mc_clear_src() ... • https://git.kernel.org/stable/c/63ed8de4be81b699ca727e9f8e3344bd487806d7 •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-38549 – efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths
https://notcve.org/view.php?id=CVE-2025-38549
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths When processing mount options, efivarfs allocates efivarfs_fs_info (sfi) early in fs_context initialization. However, sfi is associated with the superblock and typically freed when the superblock is destroyed. If the fs_context is released (final put) before fill_super is called—such as on error paths or during reconfiguration—the sfi structure would leak, as ownership ... • https://git.kernel.org/stable/c/5329aa5101f73c451bcd48deaf3f296685849d9c •
CVSS: 7.2EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38548 – hwmon: (corsair-cpro) Validate the size of the received input buffer
https://notcve.org/view.php?id=CVE-2025-38548
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Validate the size of the received input buffer Add buffer_recv_size to store the size of the received bytes. Validate buffer_recv_size in send_usb_cmd(). In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Validate the size of the received input buffer Add buffer_recv_size to store the size of the received bytes. Validate buffer_recv_size in send_usb_cmd(). • https://git.kernel.org/stable/c/40c3a445422579db8ad96c234dbe6c0ab3f6b936 •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2025-38546 – atm: clip: Fix memory leak of struct clip_vcc.
https://notcve.org/view.php?id=CVE-2025-38546
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix memory leak of struct clip_vcc. ioctl(ATMARP_MKIP) allocates struct clip_vcc and set it to vcc->user_back. The code assumes that vcc_destroy_socket() passes NULL skb to vcc->push() when the socket is close()d, and then clip_push() frees clip_vcc. However, ioctl(ATMARPD_CTRL) sets NULL to vcc->push() in atm_init_atmarp(), resulting in memory leak. Let's serialise two ioctl() by lock_sock() and check vcc->push() in atm_init_atm... • https://git.kernel.org/stable/c/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 •
CVSS: 6.6EPSS: 0%CPEs: 3EXPL: 0CVE-2025-38545 – net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info
https://notcve.org/view.php?id=CVE-2025-38545
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info While transitioning from netdev_alloc_ip_align() to build_skb(), memory for the "skb_shared_info" member of an "skb" was not allocated. Fix this by allocating "PAGE_SIZE" as the skb length, accounting for the packet length, headroom and tailroom, thereby including the required memory space for skb_shared_info. In the Linux kernel, the following vulnerability h... • https://git.kernel.org/stable/c/8acacc40f7337527ff84cd901ed2ef0a2b95b2b6 •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2025-38544 – rxrpc: Fix bug due to prealloc collision
https://notcve.org/view.php?id=CVE-2025-38544
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix bug due to prealloc collision When userspace is using AF_RXRPC to provide a server, it has to preallocate incoming calls and assign to them call IDs that will be used to thread related recvmsg() and sendmsg() together. The preallocated call IDs will automatically be attached to calls as they come in until the pool is empty. To the kernel, the call IDs are just arbitrary numbers, but userspace can use the call ID to hold a pointer... • https://git.kernel.org/stable/c/00e907127e6f86d0f9b122d9b4347a8aa09a8b61 •
CVSS: 6.6EPSS: 0%CPEs: 5EXPL: 0CVE-2025-38543 – drm/tegra: nvdec: Fix dma_alloc_coherent error check
https://notcve.org/view.php?id=CVE-2025-38543
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/tegra: nvdec: Fix dma_alloc_coherent error check Check for NULL return value with dma_alloc_coherent, in line with Robin's fix for vic.c in 'drm/tegra: vic: Fix DMA API misuse'. In the Linux kernel, the following vulnerability has been resolved: drm/tegra: nvdec: Fix dma_alloc_coherent error check Check for NULL return value with dma_alloc_coherent, in line with Robin's fix for vic.c in 'drm/tegra: vic: Fix DMA API misuse'. • https://git.kernel.org/stable/c/46f226c93d35b936aeec6eb31da932dc2e86f413 •
CVSS: 6.6EPSS: 0%CPEs: 8EXPL: 0CVE-2025-38542 – net: appletalk: Fix device refcount leak in atrtr_create()
https://notcve.org/view.php?id=CVE-2025-38542
16 Aug 2025 — In the Linux kernel, the following vulnerability has been resolved: net: appletalk: Fix device refcount leak in atrtr_create() When updating an existing route entry in atrtr_create(), the old device reference was not being released before assigning the new device, leading to a device refcount leak. Fix this by calling dev_put() to release the old device reference before holding the new one. In the Linux kernel, the following vulnerability has been resolved: net: appletalk: Fix device refcount leak in atrtr_... • https://git.kernel.org/stable/c/c7f905f0f6d49ed8c1aa4566c31f0383a0ba0c9d •