Vulnerability feed

Executive summary

A flaw in the Linux kernel's dm-integrity device-mapper component causes a NULL pointer dereference (a crash) when a device with a dirty bitmap flag is activated in 'R' mode. The advisory describes this as a kernel fix in the stable tree; it does not state a severity rating. The fix is a kernel patch that skips writes to the device during resume when 'R' mode is used.

Technical summary

The vulnerability class is a NULL pointer dereference, leading to a crash in dm_integrity_resume when the SB_FLAG_DIRTY_BITMAP flag is set and the device is activated in 'R' mode. The advisory does not state the attack vector or required privileges. The fix adds a check for ic->mode == 'R' that skips superblock write operations during resume. Affected and fixed kernel version numbers are not stated in the advisory text provided. No workaround, exploitation status, CVSS score, or detection guidance is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/2e25842f0e4423e…43f56153d842ed6b933f

Score

No CVSS score published.

Affects

LinuxLinuxLinux kernel

Executive summary

This advisory describes a fix in the Linux kernel's dm-integrity device-mapper driver, where the superblock could be altered on disk while the device was suspended and the driver would then resume using values that no longer matched its in-memory structures. The advisory does not state a severity rating or exploitation status. The fix makes the driver refuse to resume if the geometry-defining superblock fields changed, and the advisory points to a kernel stable tree commit as the remedy.

Technical summary

The flaw is an input validation issue (inconsistent state after superblock modification) in dm-integrity's resume path, which re-reads the superblock without validating it. According to the commit message, an increased log2_sectors_per_block can push a journal index past the end of the journal and cause a 512-byte write through lowmem_page_address(NULL). The precondition is that the superblock on the underlying device is modified while the dm-integrity device is suspended. The fix snapshots the validated superblock in the constructor and rejects resume when geometry fields change. The advisory does not state affected or fixed version numbers, a CVSS score, workarounds, or detection guidance beyond the commit diff.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/454b67fcc28c185…dfb9f067b04c28628ada

Score

No CVSS score published.

Affects

LinuxLinuxLinux kernelLinux dm-integrity

Executive summary

A flaw in the Linux kernel's sched_ext scheduler can cause a CPU hotplug hang, where taking a CPU offline never finishes when that CPU's tasks are held by the BPF scheduler. The advisory does not state a severity rating or a CVSS score. The advisory describes a fix in the kernel but does not state any recommended action beyond the patch itself.

Technical summary

This is a hang (denial of service) caused by a logic error in the kernel's CPU hotplug handling for the sched_ext scheduler. A task on a user DSQ or held by the BPF scheduler stays counted on a dying CPU's run queue, so the hotplug thread is never woken and cpu_down() can block while holding cpu_hotplug_lock, or the offline stalls until the watchdog ejects the BPF scheduler. The fix re-enqueues tasks on a run queue going offline to the local DSQ and tests SCX_RQ_ONLINE so ops.dispatch() keeps running until the rq goes offline. The advisory does not state affected or fixed kernel versions, a CVSS score, a workaround, or any detection guidance.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Score

No CVSS score published.

Affects

LinuxLinuxLinux kernel

Executive summary

The advisory concerns the Linux kernel, specifically the readdir path for the directory of the nullfs instance used by empty and kernel thread mount namespaces. A user holding a directory read lock for a long time could block other users of that shared directory, stalling lookups, creates, and mounts. The advisory does not state a severity score, and it describes a fix that skips the lock for this directory type.

Technical summary

The flaw is a lock-ordering and availability problem: iterate_dir() holds the directory's i_rwsem shared across ->iterate_shared() even for directories that never change, so a reader stalled inside getdents() (for example, by a FUSE-backed user buffer that faults and waits) can block exclusive takers queued behind it. The advisory describes a local user triggering this on a shared nullfs directory, but it does not state a CVSS score or attack complexity. The described fix adds a FOP_IMMUTABLE flag to file operations for never-changing, never-removed directories and makes iterate_dir() skip the lock for them, applied to the nullfs directory. The advisory does not state affected or fixed kernel version numbers, workarounds, or detection guidance.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Score

No CVSS score published.

Affects

LinuxLinuxLinux kernel

Executive summary

The advisory describes a heap out-of-bounds write in the ksmbd component of the Linux kernel, reached through Kerberos session setup in compounded SMB2 requests. The advisory does not state a severity rating or a CVSS score. The fix is a one-line kernel patch that corrects the buffer-space calculation.

Technical summary

The flaw is a heap out-of-bounds write (CWE class not named, but described as memcpy writing past the end of response_buf) in krb5_authenticate() in fs/smb/server/smb2pdu.c. It occurs when SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, because the out_len calculation omits work->next_smb2_rsp_hdr_off, overstating remaining buffer space. The advisory does not state the attack vector in detail, the authentication requirements, or the affected kernel version ranges. The fix subtracts work->next_smb2_rsp_hdr_off from out_len, and the advisory references commit 23a0be6a84a38ac169eeab49017934e8e27c65f0. No workaround, detection guidance, or exploitation status is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/23a0be6a84a38ac…ab49017934e8e27c65f0

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affects

LinuxLinuxLinux kernelLinux ksmbd

Executive summary

A flaw in the Linux kernel's KVM virtualization code for x86 processors could let a guest cause memory writes that bypass KVM's write tracking. The advisory does not give a severity score, and it says the fix is to use the vCPU's active memslots when caching MMIO entries.

Technical summary

This is an incorrect-resource-selection flaw in the KVM per-vCPU MMIO cache, where the fill and validation paths use address space 0 even when the vCPU runs in SMM and uses address space 1. A stale cache entry can remain valid after an SMM memslot update, so an access to valid RAM can be returned to userspace as KVM_EXIT_MMIO, and completing that exit can write a nested EPT backing page without write-tracking, risking stale shadow translations. The advisory names commits 56f17dd3fbc4 and 699023e23965 as background. The fix is to use active memslots (kvm_vcpu_memslots()) for caching and validation. Affected and fixed kernel versions, a CVSS score, workarounds, and exploitation status are not stated. Detection guidance is not stated beyond a WARN_ON_ONCE() in kvm_mmu_write_protect_fault() that the advisory says catches the invalid combination.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Changed

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affects

LinuxKVMLinuxLinux kernelKVM

Executive summary

The advisory describes a flaw in the Linux kernel's bnxt_en network driver, which supports Broadcom BCM57412 NetXtreme-E network cards. Small packets sent on VLAN or macvlan interfaces can cause the network card to read memory beyond the buffer it was given, leading to IOMMU DMA faults and transmit timeouts. The advisory does not state a severity rating, and it does not state a fix version or any vendor recommendation beyond the kernel patch described.

Technical summary

The weakness is a DMA mapping length error (buffer overrun during DMA read) in the bnxt_en driver's bnxt_start_xmit() function. Small frames shorter than BNXT_MIN_PKT_SIZE (52 bytes) are padded, but the DMA mapping and tracked length still use the original unpadded length, so the hardware reads 52 bytes from a 42-byte mapping, and a read near a 4KB page boundary faults in the IOMMU. The triggering condition described is transmitting small packets such as untagged ARP frames on VLAN or macvlan interfaces. The advisory states the fix as calling skb_put_padto(skb, BNXT_MIN_PKT_SIZE) before the fragment count is sampled. Affected and fixed kernel version numbers, a CVSS score, workarounds, and detection guidance are not stated in the advisory.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Dropped extracted product not named in the source: Broadcom BCM57412 NetXtreme-E

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affects

LinuxLinuxLinux kernel

Executive summary

The advisory describes a fix in the Linux kernel's filesystem inode handling that stops a long-standing leak of internal xarray nodes. It does not state a severity rating or describe an active attack. The advisory presents this as a kernel stable tree commit rather than a vendor security bulletin.

Technical summary

The change modifies clear_inode() in fs/inode.c so that it calls xa_destroy() on the inode's i_pages xarray, which frees leftover empty nodes and cycles the i_pages lock, and adds a BUG_ON if nrpages is nonzero. The commit message says the leak was hard to trigger but that people and syzbot found ways to force it using madvise. The advisory does not state the attack vector beyond local madvise use, the privileges required, a CVSS score, affected or fixed version numbers, workarounds, or detection guidance. It also does not state whether the issue has been exploited in the wild. The affected kernel versions are not stated in the text provided.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/21f51434c47d862…75ae6c6ad6b573abcd02

Score

No CVSS score published.

Affects

LinuxLinuxLinux kernel

Executive summary

The advisory covers a Linux kernel fix in the mlx5e network driver for Mellanox ConnectX adapters, in its zero-copy AF_XDP receive path. A failed redirect and partial buffer refill could let a stale buffer pointer be freed again, which could publish the same packet buffer twice and corrupt receive data. The advisory describes the fix as marking the buffer as released immediately after it is freed so refill retries no longer free stale pointers; it does not state a severity rating.

Technical summary

The flaw is a use-after-release or double-publication condition in the legacy cyclic receive queue of the mlx5e driver when zero-copy AF_XDP buffers are used with XDP redirect. When the XSK receive ring is full, a partial batched refill can leave a WQE with a stale buffer pointer, which a later retry may free again after the buffer has been reallocated. The fix sets the SKIP_RELEASE flag right after the driver-side free, and the commit cites Fixes 3f93f82988bc. The advisory does not state affected or fixed kernel version numbers, a CVSS score, a workaround, or whether exploitation has been observed. It gives no detection guidance beyond noting that the failure is silent and produces no kernel warning.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/32bbb870078d467…5c21bbc4960c57eea208

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

LinuxMellanoxLinuxLinux kernelMellanox mlx5e

Executive summary

A flaw in the Linux kernel's mlx5e network driver for Mellanox ConnectX adapters can cause buffers to be released twice when AF_XDP zero-copy receive allocation fails and is retried. The advisory does not state a severity rating or a CVSS score. The fix is a kernel patch that the stable tree has merged, and the advisory does not describe any other vendor recommendation.

Technical summary

The vulnerability is a double free, or stale buffer release, in the Linux kernel net/mlx5e driver's AF_XDP striding receive queue path. When XSK buffer allocation returns -ENOMEM during a memory pool work queue element refill, a later NAPI poll retries the same WQE and can call xsk_buff_free() again through stale pointers. The fix sets all skip_release_bitmap bits in the common error path of mlx5e_xsk_alloc_rx_mpwqe(). The advisory states the fix is in commit 63811edf512584c946e5e96b100e9e280703bbb5 and the Fixes tag names commit 4c2a13236807. The advisory does not state the affected or fixed kernel version numbers, the attack vector or required privileges, exploitation status, workarounds, or detection guidance.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/3d73a1164a8c6b4…7a65cb6c022ea4fd39af

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

LinuxLinuxLinux kernel

Executive summary

The advisory covers a flaw in the Linux kernel's IPv4 UDP handling of ICMP Fragmentation Needed and Redirect messages. It allows off-path attackers to observe a cache and learn the ephemeral port of a connected UDP socket. The advisory states the fix is to always create the exception cache entry before socket matching; it does not state a severity rating or affected version ranges.

Technical summary

The weakness is a side-channel information leak in the IPv4 FIB nexthop exception (FNHE) cache, which lets an off-path attacker discover the ephemeral port of a connected UDP socket. The attack requires sending ICMP Fragmentation Needed or Redirect messages that quote a UDP packet, and the exception is only created when the quoted packet matches an existing socket. The fix always creates the exception by calling ipv4_update_pmtu() and ipv4_redirect() with an oif of 0. Affected and fixed kernel versions are not stated in the advisory, and no workaround, CVSS score, or detection guidance is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affects

LinuxLinuxLinux kernel

Executive summary

The advisory concerns the Linux kernel's handling of ICMPv6 Packet Too Big and Redirect messages that quote UDP packets. An off-path attacker could use this to learn the ephemeral port of a connected UDP socket. The advisory does not state a severity rating, and it describes a fix that always creates an exception in the cache before socket matching.

Technical summary

The weakness is a side-channel information leak in the IPv6 exception cache, triggered when locally delivered ICMPv6 Packet Too Big or Redirect messages quote a UDP packet. Exceptions were previously created only when the quoted packet matched an existing socket, letting an off-path attacker observe the cache to infer the ephemeral port of a connected UDP socket. The fix always creates an exception by calling ip6_update_pmtu() and ip6_redirect() before socket matching, and passes the ingress ifindex and default uid. The advisory states that the fix adds an extra route lookup and may create two exceptions for the same destination in some cases. Affected and fixed kernel version numbers, CVSS score, workarounds, and detection guidance are not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Score

No CVSS score published.

Affects

LinuxLinuxLinux kernel

Executive summary

The advisory describes a flaw in the Linux kernel's rust_binder driver, which handles Android inter-process communication. When a thread exits, a pending node reference count update could be dropped, leaving a node that is never freed from a process's node tree. The advisory does not state a severity rating, and the fix is a kernel patch that reschedules the update so another thread delivers it.

Technical summary

The flaw is a logic error in the rust_binder driver where Node::cancel() and NodeWrapper::cancel() were no-ops, so a pending node refcount increment was dropped when a thread exited via BINDER_THREAD_EXIT. This desynchronizes delivery and count state and can prevent a node from being freed. The fix implements DeliverToRead::cancel() for Node and NodeWrapper to move the pending update to the process work queue. The advisory does not state the attack vector, required privileges, or exploitability, and it does not give a CVSS score. It does not list affected or fixed version numbers beyond the commit reference and the Fixes tag eafedbc7c050, and it gives no workaround or detection guidance.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/2a74ccd1bcc170e…f34e9de8652b57e2cf3d

Score

No CVSS score published.

Affects

LinuxLinuxLinux kernel

Executive summary

A flaw in the Linux kernel's IPv4 route handling can crash the system through a null pointer dereference when a multipath nexthop group shrinks during a path MTU update. The advisory describes the replacement as requiring CAP_NET_ADMIN in the network namespace, which a local user may obtain where unprivileged user namespaces are allowed. The advisory does not state a severity score, and the fix is a two-line check in net/ipv4/route.c.

Technical summary

The vulnerability is a race condition that leads to a NULL pointer dereference (KASAN null-ptr-deref in update_or_create_fnhe) in the Linux kernel IPv4 PMTU update path. When a nexthop group is replaced by one with fewer members after the PMTU loop accepts an index, fib_info_nhc() returns NULL and the code dereferences it. The attack requires CAP_NET_ADMIN in the network namespace to replace the nexthop group, which a local user can gain in a new user and network namespace where unprivileged user namespaces are permitted. The fix adds a check that breaks out of the loop when the indexed path is absent, and the advisory states it is in commit 6619e01855e65ef35723685a557e3eb106f4ecf5. The advisory identifies the fixing commit as affecting the Fixes tag 7d3f3b4367f3 and says it is tagged for stable, but it does not state specific affected or fixed version numbers beyond a mention of v7.2 as the kernel where the oops was observed. A CVSS score, workarounds, and detection guidance are not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/6619e01855e65ef…685a557e3eb106f4ecf5

Score

No CVSS score published.

Affects

LinuxLinuxLinux kernel

Executive summary

A flaw in the Linux kernel's IPv4 routing code can crash the system when a route dump runs at the same time as a nexthop group is replaced with a smaller one. The advisory does not state a severity rating or exploitation status. The advisory provides a kernel patch that stops the dump loop when the indexed path is missing, and it is shared through the Linux stable tree.

Technical summary

The flaw is a NULL pointer dereference in fib_dump_info_fnhe() in net/ipv4/route.c, a race between the RCU-protected IPv4 FIB dump and RTM_NEWNEXTHOP replacing a nexthop group with fewer paths. The loop bound comes from fib_info_num_path() while fib_info_nhc() reloads the group separately, so fib_info_nhc() can return NULL and the code dereferences it through nhc_flags. The fix adds a check that breaks out of the loop when nhc is NULL. The advisory does not state affected or fixed version numbers, a CVSS score, attack vector or privilege requirements beyond the race described, workarounds, or detection guidance.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/21cba134c30c17a…68b5809336437df5d7e6

Score

No CVSS score published.

Affects

LinuxLinuxLinux kernel

Executive summary

A fix in the Linux kernel's IPv4 routing code addresses a crash that can occur when a nexthop group shrinks during a route notification. The advisory does not state how severe the flaw is, and it does not give a CVSS score or say whether it is being exploited. The advisory names the Linux kernel stable tree as the affected product and points to the upstream fix commit.

Technical summary

The flaw is a NULL pointer dereference in the IPv4 route notification sizing function fib_nlmsg_size() in net/ipv4/fib_semantics.c. It occurs when an RTM_NEWNEXTHOP message replaces a nexthop group with fewer paths between two separate reads of the group, causing fib_info_nhc() to return NULL, which fib_nexthop_nlmsg_size() then dereferences. The advisory does not state the attack vector or privileges required. The fix adds a check that stops sizing when the indexed path is absent. The advisory does not give affected or fixed version numbers, and it does not state any workaround or detection guidance. The commit is marked for stable backport, and the advisory does not list specific kernel version ranges.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/72d9d17092bb37b…12042a0817d01a1f9e78

Score

No CVSS score published.

Affects

LinuxLinuxLinux kernel

Executive summary

A Linux kernel change removes a warning in the IPv4 routing code that could fire during a rare timing race when hardware flags on a route change. The advisory describes this as a fix to a false warning rather than a security flaw, and it does not state a severity rating. The recommended action is to apply the upstream kernel stable update that contains this change.

Technical summary

The advisory describes removing a WARN_ON in fib_alias_hw_flags_set() in net/ipv4/fib_trie.c that fired when fib_dump_info() returned -EMSGSIZE. The race occurs when nexthop compatibility mode is enabled and a concurrent replacement grows a nexthop group between the size calculation and the message fill, which happen under RCU only. The change keeps the existing error path, which frees the skb and reports the error to listeners. The advisory names commit 680aea08e78c as the fixed-by reference and gives the stable commit 088ba80eef85fa7a5ad8f9e7c82b403c99242b56, but it does not state affected or fixed kernel version numbers, a CVSS score, exploitation status, or any workaround. Detection guidance is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/088ba80eef85fa7…f9e7c82b403c99242b56

Score

No CVSS score published.

Affects

LinuxLinuxLinux kernel

Executive summary

This advisory concerns a change to the Linux kernel's IPv6 routing code that removes a kernel warning triggered by a rare timing race. The advisory describes the change as a fix to a warning, not as a security vulnerability with a stated severity. The vendor-style recommendation is not stated in the text, beyond applying the stable kernel update that includes the commit.

Technical summary

The issue is a sizing race in fib6_info_hw_flags_set(), where the notification skb is sized with rt6_nlmsg_size() and filled later with rt6_fill_node(). With nexthop compatibility mode enabled, a concurrent group replacement can make rt6_fill_node() return -EMSGSIZE, which previously triggered a WARN_ON. The fix removes that warning while keeping the existing error path that frees the skb and reports the error. The advisory does not state a CVSS score, attack vector or required privileges, exploitation status, affected or fixed version numbers, workarounds, or detection guidance. The commit is marked for stable backport and references the Fixes tag 907eea486888.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/291fe0bafee78c9…e7f579f17793fd5a1e5a

Score

No CVSS score published.

Affects

LinuxLinuxLinux kernel

Executive summary

The advisory describes a flaw in the Linux kernel's ati_remote2 input driver, where device attribute handlers treat a USB interface device as a USB device. The advisory does not state a severity rating or an exploitation status. The fix is a kernel patch that changes the handlers to use the correct interface type, which is provided in the stable tree commit.

Technical summary

The weakness is a type confusion in the show and store callbacks for the channel_mask and mode_mask sysfs attributes in the ati_remote2 driver, which call to_usb_device() on a usb_interface device, producing an invalid pointer. The advisory does not state the attack vector, required privileges, or exploitation conditions. The fix replaces to_usb_device() and usb_ifnum_to_if() with to_usb_interface() in the attribute handlers, and the commit is tagged for stable backport. Affected and fixed kernel version numbers are not stated in the advisory text. No workaround and no detection guidance are stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/2caae9d1977beea…4b3d86639262801fd116

Score

No CVSS score published.

Affects

LinuxLinuxLinux kernel

Executive summary

A memory leak in the Linux kernel's ALSA ctxfi sound driver was fixed in a stable kernel update. The advisory describes it as a leak that occurs each time DAO input mappers are cleared, and it does not state a severity rating or any active exploitation.

Technical summary

The flaw is a memory leak (CWE class not stated) in the ALSA ctxfi driver, where dao_clear_input() removed mapper entries from a list and cleared their pointers without freeing the allocated array, so memory leaked on each call. The fix stores the base pointer of the allocation before clearing entries and frees it afterward, as shown in the included diff to sound/pci/ctxfi/ctdaio.c. The advisory does not state attack vector, preconditions, CVSS score, or the affected and fixed kernel version numbers beyond the referenced commits. No workaround or detection guidance is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/0919d8dd19f92e1…55c75fced9a454d644bf

Score

No CVSS score published.

Affects

LinuxLinuxLinux kernel

Executive summary

This advisory describes a reference leak in the Linux kernel's btrfs file system code, in the scrub warning routine that runs when the kernel reports corrupted files. The advisory does not state a severity rating or any effect beyond the leak itself. The fix, applied in the Linux kernel stable tree, releases a root reference on an error path that previously skipped it.

Technical summary

The flaw is a reference leak (a resource management bug) in fs/btrfs/scrub.c, function scrub_print_warning_inode(). When paths_from_inode() fails, the function jumped to its err label without dropping the reference taken by btrfs_get_fs_root(), so a root reference leaked each time path resolution failed while printing scrub warnings. The fix adds a btrfs_put_root(local_root) call on that failure path, consistent with the other paths of the function. The advisory does not state an attack vector, preconditions, a CVSS score, or whether the issue is exploitable beyond a resource leak. Affected and fixed version numbers are not stated in the text provided. No workaround or detection guidance is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/12ba7d8b9cd45a2…f37c3f4b8a50422fb549

Score

No CVSS score published.

Affects

LinuxLinuxLinux kernel

Executive summary

A fix has been committed to the Linux kernel's CAN networking code, where received CAN frame buffers were not properly initialized, which could let a machine crash. The advisory describes the issue as a kernel panic that takes down the whole machine, but it does not state a severity score or whether it is being exploited.

Technical summary

The flaw is an uninitialized header in socket buffers created by the CAN device layer (init_can_skb), introduced by commit 9f10374bb024 which removed the header reset calls. The mac_header is left at 0xFFFF, so when packet_rcv_spkt() handles a SOCK_PACKET socket, the push length calculation overflows and triggers skb_under_panic, leading to a kernel BUG and full machine panic. The advisory does not state the attack vector or what preconditions an attacker needs, such as whether local access or a specific socket type is required. The fix restores the skb_reset_mac_header, skb_reset_network_header and skb_reset_transport_header calls in init_can_skb. Affected and fixed kernel version numbers are not stated in the advisory text. No workaround and no detection guidance are stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/0a04c0cb8606ff8…89d03ef255afe90d0d5f

Score

No CVSS score published.

Affects

LinuxLinuxLinux kernel

Executive summary

A fix in the Linux kernel's cpuset code addresses a race during CPU hotplug (taking CPUs offline) that can cause a NULL pointer dereference. The advisory does not state a severity rating, and it describes the change as a fix for a kernel crash rather than a confirmed security exploit.

Technical summary

The flaw is a NULL pointer dereference in guarantee_active_cpus() in kernel/cgroup/cpuset.c, caused by a race between CPU hotplug offline processing and cpuset hotplug handling. During the window after cpu_active_mask is updated but before cpuset_handle_hotplug() updates the top cpuset's effective_cpus, the top cpuset may have no active CPU and the walk up the cpuset hierarchy can reach a NULL cs. The fix adds a NULL check that returns the filtered cpu_active_mask. The advisory states the bug was introduced by commit 7a0aabd9ce69 and references commit 2125c0034c5d, with the fix tagged for stable v6.16+. Attack vector, required privileges, and CVSS score are not stated. Workarounds and detection guidance are not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/23b1ab15ca91f2c…49d9bb0fafeb700c7db2

Score

No CVSS score published.

Affects

LinuxLinuxLinux kernel

Executive summary

The advisory describes a flaw in the Linux kernel's handling of CIPSO network options, where removing a CIPSO option leaves cached offsets for later IP options pointing at the wrong bytes. The advisory does not state how severe the flaw is, and it does not state a CVSS score. The advisory's fix is a kernel patch that adjusts those offsets, which is what the upstream stable tree carries.

Technical summary

The flaw is an incorrect offset adjustment in cipso_v4_skbuff_delattr(), which removes CIPSO bytes but does not update cached offsets for the srr, rr, ts and router_alert options that follow them. Consumers such as ip_forward_options() and __ip_options_echo() can then read the wrong bytes, and the advisory notes the latter may interpret packet data as an option length and copy it into fixed-size storage, which suggests a memory-safety impact, though a specific impact class is not explicitly stated. The advisory does not state the attack vector or preconditions beyond the description of the code path. Affected and fixed version ranges are not stated in the advisory. No workaround and no detection guidance are stated. The advisory gives the upstream commit 2200fe1d6148b78e1b8f00f4b2bd47760015077f and the fix adds four conditional offset subtractions in net/ipv4/cipso_ipv4.c.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/2200fe1d6148b78…00f4b2bd47760015077f

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

LinuxLinuxLinux kernel

Executive summary

A flaw in the Linux kernel's device-mapper ioctl handling can cause the kernel to read a few bytes past the end of a buffer. The advisory says the out-of-bounds read can only be triggered by root, and it is not described as a security bug. The fix is a kernel stable tree patch that clamps the data start offset to the buffer size.

Technical summary

The flaw is an out-of-bounds read in the dm ioctl code, where get_result_buffer() sets data_start to sizeof(struct dm_ioctl) without checking the actual buffer size, so a minimal buffer can leave data_start seven bytes past the end. The advisory shows a KASAN slab-out-of-bounds report triggered by a DM_LIST_DEVICES call with data_size set to 305. The attack precondition is local root access, and the advisory states the issue is not a security bug. The patch clamps data_start to param_size and sets the length to zero in that case. The advisory does not state a CVSS score, a workaround, or any detection guidance, and it does not state exploitation in the wild. Fixed versions beyond the referenced upstream commit are not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/5680b6fb3054677…5d3baba24b649f1b430e

Score

No CVSS score published.

Affects

LinuxLinuxLinux kernel