CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-22052 – staging: gpib: Fix Oops after disconnect in ni_usb
https://notcve.org/view.php?id=CVE-2025-22052
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: staging: gpib: Fix Oops after disconnect in ni_usb If the usb dongle is disconnected subsequent calls to the driver cause a NULL dereference Oops as the bus_interface is set to NULL on disconnect. This problem was introduced by setting usb_dev from the bus_interface for dev_xxx messages. Previously bus_interface was checked for NULL only in the the functions directly calling usb_fill_bulk_urb or usb_control_msg. Check for valid bus_interfac... • https://git.kernel.org/stable/c/4934b98bb24327c32ed55c96012f019932383da5 •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-22051 – staging: gpib: Fix Oops after disconnect in agilent usb
https://notcve.org/view.php?id=CVE-2025-22051
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: staging: gpib: Fix Oops after disconnect in agilent usb If the agilent usb dongle is disconnected subsequent calls to the driver cause a NULL dereference Oops as the bus_interface is set to NULL on disconnect. This problem was introduced by setting usb_dev from the bus_interface for dev_xxx messages. Previously bus_interface was checked for NULL only in the functions directly calling usb_fill_bulk_urb or usb_control_msg. Check for valid bus... • https://git.kernel.org/stable/c/fbae7090f30c1bd5a351d0c8f82b6a635718b8d8 •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2025-22050 – usbnet:fix NPE during rx_complete
https://notcve.org/view.php?id=CVE-2025-22050
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: usbnet:fix NPE during rx_complete Missing usbnet_going_away Check in Critical Path. The usb_submit_urb function lacks a usbnet_going_away validation, whereas __usbnet_queue_skb includes this check. This inconsistency creates a race condition where: A URB request may succeed, but the corresponding SKB data fails to be queued. Subsequent processes: (e.g., rx_complete → defer_bh → __skb_unlink(skb, list)) attempt to access skb->next, triggerin... • https://git.kernel.org/stable/c/b80aacfea6e8d6ed6e430aa13922d6ccf044415a •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2025-22049 – LoongArch: Increase ARCH_DMA_MINALIGN up to 16
https://notcve.org/view.php?id=CVE-2025-22049
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: LoongArch: Increase ARCH_DMA_MINALIGN up to 16 ARCH_DMA_MINALIGN is 1 by default, but some LoongArch-specific devices (such as APBDMA) require 16 bytes alignment. When the data buffer length is too small, the hardware may make an error writing cacheline. Thus, it is dangerous to allocate a small memory buffer for DMA. It's always safe to define ARCH_DMA_MINALIGN as L1_CACHE_BYTES but unnecessary (kmalloc() need small memory objects). Theref... • https://git.kernel.org/stable/c/f39af67f03b564b763b06e44cb960c10a382d54a •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2025-22048 – LoongArch: BPF: Don't override subprog's return value
https://notcve.org/view.php?id=CVE-2025-22048
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Don't override subprog's return value The verifier test `calls: div by 0 in subprog` triggers a panic at the ld.bu instruction. The ld.bu insn is trying to load byte from memory address returned by the subprog. The subprog actually set the correct address at the a5 register (dedicated register for BPF return values). But at commit 73c359d1d356 ("LoongArch: BPF: Sign-extend return values") we also sign extended a5 to the a0 r... • https://git.kernel.org/stable/c/0c8d50501bc13cacecc19caaddc10db372592a39 •
CVSS: 7.1EPSS: 0%CPEs: 5EXPL: 0CVE-2025-22047 – x86/microcode/AMD: Fix __apply_microcode_amd()'s return value
https://notcve.org/view.php?id=CVE-2025-22047
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: x86/microcode/AMD: Fix __apply_microcode_amd()'s return value When verify_sha256_digest() fails, __apply_microcode_amd() should propagate the failure by returning false (and not -1 which is promoted to true). In the Linux kernel, the following vulnerability has been resolved: x86/microcode/AMD: Fix __apply_microcode_amd()'s return value When verify_sha256_digest() fails, __apply_microcode_amd() should propagate the failure by returning fals... • https://git.kernel.org/stable/c/bef830144febedb7de86863ae99d8f53bed76e95 •
CVSS: 7.1EPSS: 0%CPEs: 4EXPL: 0CVE-2025-22046 – uprobes/x86: Harden uretprobe syscall trampoline check
https://notcve.org/view.php?id=CVE-2025-22046
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Harden uretprobe syscall trampoline check Jann reported a possible issue when trampoline_check_ip returns address near the bottom of the address space that is allowed to call into the syscall if uretprobes are not set up: https://lore.kernel.org/bpf/202502081235.5A6F352985@keescook/T/#m9d416df341b8fbc11737dacbcd29f0054413cbbf Though the mmap minimum address restrictions will typically prevent creating mappings there, let's make... • https://git.kernel.org/stable/c/ff474a78cef5cb5f32be52fe25b78441327a2e7c •
CVSS: 6.6EPSS: 0%CPEs: 9EXPL: 0CVE-2025-22045 – x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
https://notcve.org/view.php?id=CVE-2025-22045
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs On the following path, flush_tlb_range() can be used for zapping normal PMD entries (PMD entries that point to page tables) together with the PTE entries in the pointed-to page table: collapse_pte_mapped_thp pmdp_collapse_flush flush_tlb_range The arm64 version of flush_tlb_range() has a comment describing that it can be used for page table removal, and does not use any last-le... • https://git.kernel.org/stable/c/016c4d92cd16f569c6485ae62b076c1a4b779536 •
CVSS: 8.5EPSS: 0%CPEs: 8EXPL: 0CVE-2025-22044 – acpi: nfit: fix narrowing conversion in acpi_nfit_ctl
https://notcve.org/view.php?id=CVE-2025-22044
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: acpi: nfit: fix narrowing conversion in acpi_nfit_ctl Syzkaller has reported a warning in to_nfit_bus_uuid(): "only secondary bus families can be translated". This warning is emited if the argument is equal to NVDIMM_BUS_FAMILY_NFIT == 0. Function acpi_nfit_ctl() first verifies that a user-provided value call_pkg->nd_family of type u64 is not equal to 0. Then the value is converted to int, and only after that is compared to NVDIMM_BUS_FAMIL... • https://git.kernel.org/stable/c/6450ddbd5d8e83ea9927c7f9076a21f829699e0f •
CVSS: 8.5EPSS: 0%CPEs: 5EXPL: 0CVE-2025-22043 – ksmbd: add bounds check for durable handle context
https://notcve.org/view.php?id=CVE-2025-22043
16 Apr 2025 — In the Linux kernel, the following vulnerability has been resolved: ksmbd: add bounds check for durable handle context Add missing bounds check for durable handle context. • https://git.kernel.org/stable/c/8d4848c45943c9cf5e86142fd7347efa97f497db •