Vulnerability-Lookup

ALSA-2026:18134

Vulnerability from osv_almalinux – Published: 2026-05-19 00:00 – Updated: 2026-06-08 10:12 – Source website

Summary

Moderate: kernel security update

Details

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg (CVE-2024-56633)
kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839)
kernel: block: fix resource leak in blk_register_queue() error path (CVE-2025-37980)
kernel: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (CVE-2025-38015)
kernel: espintcp: remove encap socket caching to avoid reference leak (CVE-2025-38097)
kernel: bpf: fix ktls panic with sockmap (CVE-2025-38166)
kernel: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (CVE-2025-38202)
kernel: bpf: Do not include stack ptr register in precision backtracking bookkeeping (CVE-2025-38279)
kernel: ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (CVE-2025-38267)
kernel: phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (CVE-2025-38275)
kernel: ftrace: Fix UAF when lookup kallsym after ftrace disabled (CVE-2025-38346)
kernel: ACPICA: fix acpi operand cache leak in dswstate.c (CVE-2025-38345)
kernel: nvmet: fix memory leak of bio integrity (CVE-2025-38405)
kernel: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (CVE-2025-38441)
kernel: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (CVE-2025-38470)
kernel: fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866)
kernel: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (CVE-2025-40034)
kernel: dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134)
kernel: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" (CVE-2025-40210)
kernel: Linux kernel MPTCP: Privilege escalation or denial of service via use-after-free in timer handling (CVE-2025-40257)
kernel: smb: client: fix potential cfid UAF in smb2_query_info_compound (CVE-2025-40320)
kernel: wifi: mac80211_hwsim: fix typo in frequency notification (CVE-2026-23040)
kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check (CVE-2026-23111)
kernel: Linux kernel: Denial of Service in ice driver due to race condition during VSI rebuild (CVE-2026-23210)
kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:18134	ADVISORY
	https://access.redhat.com/security/cve/CVE-2024-56633	REPORT
	https://access.redhat.com/security/cve/CVE-2025-21839	REPORT
	https://access.redhat.com/security/cve/CVE-2025-37980	REPORT
	https://access.redhat.com/security/cve/CVE-2025-38015	REPORT
	https://access.redhat.com/security/cve/CVE-2025-38097	REPORT
	https://access.redhat.com/security/cve/CVE-2025-38166	REPORT
	https://access.redhat.com/security/cve/CVE-2025-38202	REPORT
	https://access.redhat.com/security/cve/CVE-2025-38267	REPORT
	https://access.redhat.com/security/cve/CVE-2025-38275	REPORT
	https://access.redhat.com/security/cve/CVE-2025-38279	REPORT
	https://access.redhat.com/security/cve/CVE-2025-38345	REPORT
	https://access.redhat.com/security/cve/CVE-2025-38346	REPORT
	https://access.redhat.com/security/cve/CVE-2025-38405	REPORT
	https://access.redhat.com/security/cve/CVE-2025-38441	REPORT
	https://access.redhat.com/security/cve/CVE-2025-38470	REPORT
	https://access.redhat.com/security/cve/CVE-2025-39866	REPORT
	https://access.redhat.com/security/cve/CVE-2025-40034	REPORT
	https://access.redhat.com/security/cve/CVE-2025-40134	REPORT
	https://access.redhat.com/security/cve/CVE-2025-40210	REPORT
	https://access.redhat.com/security/cve/CVE-2025-40257	REPORT
	https://access.redhat.com/security/cve/CVE-2025-40320	REPORT
	https://access.redhat.com/security/cve/CVE-2026-23040	REPORT
	https://access.redhat.com/security/cve/CVE-2026-23111	REPORT
	https://access.redhat.com/security/cve/CVE-2026-23210	REPORT
	https://access.redhat.com/security/cve/CVE-2026-23243	REPORT
	https://bugzilla.redhat.com/2334549	REPORT
	https://bugzilla.redhat.com/2350585	REPORT
	https://bugzilla.redhat.com/2367614	REPORT
	https://bugzilla.redhat.com/2373343	REPORT
	https://bugzilla.redhat.com/2376060	REPORT
	https://bugzilla.redhat.com/2376065	REPORT
	https://bugzilla.redhat.com/2376382	REPORT
	https://bugzilla.redhat.com/2379178	REPORT
	https://bugzilla.redhat.com/2379187	REPORT
	https://bugzilla.redhat.com/2379199	REPORT
	https://bugzilla.redhat.com/2379237	REPORT
	https://bugzilla.redhat.com/2379239	REPORT
	https://bugzilla.redhat.com/2383399	REPORT
	https://bugzilla.redhat.com/2383478	REPORT
	https://bugzilla.redhat.com/2383906	REPORT
	https://bugzilla.redhat.com/2396940	REPORT
	https://bugzilla.redhat.com/2406782	REPORT
	https://bugzilla.redhat.com/2414468	REPORT
	https://bugzilla.redhat.com/2416307	REPORT
	https://bugzilla.redhat.com/2418880	REPORT
	https://bugzilla.redhat.com/2419945	REPORT
	https://bugzilla.redhat.com/2436806	REPORT
	https://bugzilla.redhat.com/2439687	REPORT
	https://bugzilla.redhat.com/2439895	REPORT
	https://bugzilla.redhat.com/2448594	REPORT
	https://errata.almalinux.org/10/ALSA-2026-18134.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-debug-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-64k-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-abi-stablelists"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-cross-headers"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-debug-uki-virt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-doc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-headers"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-modules-extra-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-debug-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-64k-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-debug-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-rt-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-tools"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-tools-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-tools-libs-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-uki-virt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-uki-virt-addons"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-devel-matched"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-modules-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "kernel-zfcpdump-modules-extra"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "libperf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "perf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "python3-perf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "rtla"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "rv"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.0-211.7.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "The kernel packages contain the Linux kernel, the core of any Linux operating system.  \n\nSecurity Fix(es):  \n\n  * kernel: tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg (CVE-2024-56633)\n  * kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839)\n  * kernel: block: fix resource leak in blk_register_queue() error path (CVE-2025-37980)\n  * kernel: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (CVE-2025-38015)\n  * kernel: espintcp: remove encap socket caching to avoid reference leak (CVE-2025-38097)\n  * kernel: bpf: fix ktls panic with sockmap (CVE-2025-38166)\n  * kernel: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (CVE-2025-38202)\n  * kernel: bpf: Do not include stack ptr register in precision backtracking bookkeeping (CVE-2025-38279)\n  * kernel: ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (CVE-2025-38267)\n  * kernel: phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (CVE-2025-38275)\n  * kernel: ftrace: Fix UAF when lookup kallsym after ftrace disabled (CVE-2025-38346)\n  * kernel: ACPICA: fix acpi operand cache leak in dswstate.c (CVE-2025-38345)\n  * kernel: nvmet: fix memory leak of bio integrity (CVE-2025-38405)\n  * kernel: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (CVE-2025-38441)\n  * kernel: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (CVE-2025-38470)\n  * kernel: fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866)\n  * kernel: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (CVE-2025-40034)\n  * kernel: dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134)\n  * kernel: Revert \"NFSD: Remove the cap on number of operations per NFSv4 COMPOUND\" (CVE-2025-40210)\n  * kernel: Linux kernel MPTCP: Privilege escalation or denial of service via use-after-free in timer handling (CVE-2025-40257)\n  * kernel: smb: client: fix potential cfid UAF in smb2_query_info_compound (CVE-2025-40320)\n  * kernel: wifi: mac80211_hwsim: fix typo in frequency notification (CVE-2026-23040)\n  * kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check (CVE-2026-23111)\n  * kernel: Linux kernel: Denial of Service in ice driver due to race condition during VSI rebuild (CVE-2026-23210)\n  * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.\n",
  "id": "ALSA-2026:18134",
  "modified": "2026-06-08T10:12:39Z",
  "published": "2026-05-19T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:18134"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-56633"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-21839"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-37980"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-38015"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-38097"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-38166"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-38202"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-38267"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-38275"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-38279"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-38345"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-38346"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-38405"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-38441"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-38470"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-39866"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-40034"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-40134"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-40210"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-40257"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2025-40320"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-23040"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-23111"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-23210"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-23243"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2334549"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2350585"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2367614"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2373343"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2376060"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2376065"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2376382"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2379178"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2379187"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2379199"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2379237"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2379239"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2383399"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2383478"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2383906"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2396940"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2406782"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2414468"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2416307"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2418880"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2419945"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2436806"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2439687"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2439895"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2448594"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/10/ALSA-2026-18134.html"
    }
  ],
  "related": [
    "CVE-2024-56633",
    "CVE-2025-21839",
    "CVE-2025-37980",
    "CVE-2025-38015",
    "CVE-2025-38097",
    "CVE-2025-38166",
    "CVE-2025-38202",
    "CVE-2025-38279",
    "CVE-2025-38267",
    "CVE-2025-38275",
    "CVE-2025-38346",
    "CVE-2025-38345",
    "CVE-2025-38405",
    "CVE-2025-38441",
    "CVE-2025-38470",
    "CVE-2025-39866",
    "CVE-2025-40034",
    "CVE-2025-40134",
    "CVE-2025-40210",
    "CVE-2025-40257",
    "CVE-2025-40320",
    "CVE-2026-23040",
    "CVE-2026-23111",
    "CVE-2026-23210",
    "CVE-2026-23243"
  ],
  "summary": "Moderate: kernel security update"
}

CVE-2024-56633 (GCVE-0-2024-56633)

Vulnerability from cvelistv5 – Published: 2024-12-27 15:02 – Updated: 2026-05-11 20:56

Title

tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg

Summary

In the Linux kernel, the following vulnerability has been resolved: tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg The current sk memory accounting logic in __SK_REDIRECT is pre-uncharging tosend bytes, which is either msg->sg.size or a smaller value apply_bytes. Potential problems with this strategy are as follows: - If the actual sent bytes are smaller than tosend, we need to charge some bytes back, as in line 487, which is okay but seems not clean. - When tosend is set to apply_bytes, as in line 417, and (ret < 0), we may miss uncharging (msg->sg.size - apply_bytes) bytes. [...] 415 tosend = msg->sg.size; 416 if (psock->apply_bytes && psock->apply_bytes < tosend) 417 tosend = psock->apply_bytes; [...] 443 sk_msg_return(sk, msg, tosend); 444 release_sock(sk); 446 origsize = msg->sg.size; 447 ret = tcp_bpf_sendmsg_redir(sk_redir, redir_ingress, 448 msg, tosend, flags); 449 sent = origsize - msg->sg.size; [...] 454 lock_sock(sk); 455 if (unlikely(ret < 0)) { 456 int free = sk_msg_free_nocharge(sk, msg); 458 if (!cork) 459 *copied -= free; 460 } [...] 487 if (eval == __SK_REDIRECT) 488 sk_mem_charge(sk, tosend - sent); [...] When running the selftest test_txmsg_redir_wait_sndmem with txmsg_apply, the following warning will be reported: ------------[ cut here ]------------ WARNING: CPU: 6 PID: 57 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x190/0x1a0 Modules linked in: CPU: 6 UID: 0 PID: 57 Comm: kworker/6:0 Not tainted 6.12.0-rc1.bm.1-amd64+ #43 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Workqueue: events sk_psock_destroy RIP: 0010:inet_sock_destruct+0x190/0x1a0 RSP: 0018:ffffad0a8021fe08 EFLAGS: 00010206 RAX: 0000000000000011 RBX: ffff9aab4475b900 RCX: ffff9aab481a0800 RDX: 0000000000000303 RSI: 0000000000000011 RDI: ffff9aab4475b900 RBP: ffff9aab4475b990 R08: 0000000000000000 R09: ffff9aab40050ec0 R10: 0000000000000000 R11: ffff9aae6fdb1d01 R12: ffff9aab49c60400 R13: ffff9aab49c60598 R14: ffff9aab49c60598 R15: dead000000000100 FS: 0000000000000000(0000) GS:ffff9aae6fd80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffec7e47bd8 CR3: 00000001a1a1c004 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __warn+0x89/0x130 ? inet_sock_destruct+0x190/0x1a0 ? report_bug+0xfc/0x1e0 ? handle_bug+0x5c/0xa0 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? inet_sock_destruct+0x190/0x1a0 __sk_destruct+0x25/0x220 sk_psock_destroy+0x2b2/0x310 process_scheduled_works+0xa3/0x3e0 worker_thread+0x117/0x240 ? __pfx_worker_thread+0x10/0x10 kthread+0xcf/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x40 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> ---[ end trace 0000000000000000 ]--- In __SK_REDIRECT, a more concise way is delaying the uncharging after sent bytes are finalized, and uncharge this value. When (ret < 0), we shall invoke sk_msg_free. Same thing happens in case __SK_DROP, when tosend is set to apply_bytes, we may miss uncharging (msg->sg.size - apply_bytes) bytes. The same warning will be reported in selftest. [...] 468 case __SK_DROP: 469 default: 470 sk_msg_free_partial(sk, msg, tosend); 471 sk_msg_apply_bytes(psock, tosend); 472 *copied -= (tosend + delta); 473 return -EACCES; [...] So instead of sk_msg_free_partial we can do sk_msg_free here.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/905d82e6e77d16ec3…
https://git.kernel.org/stable/c/dbedc7e142df5ea23…
https://git.kernel.org/stable/c/0d6cd1151e26fc7c2…
https://git.kernel.org/stable/c/456f08d24afa51b5e…
https://git.kernel.org/stable/c/206d56f41a1509cad…
https://git.kernel.org/stable/c/5c9e3bb43a354a224…
https://git.kernel.org/stable/c/ca70b8baf2bd125b2…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < 905d82e6e77d16ec3e089c92b7b59a14899dfc1a (git) Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < dbedc7e142df5ea238a46fdd7462c1c42cd36a10 (git) Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < 0d6cd1151e26fc7c2d5daa85e8984aaa685a1a12 (git) Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < 456f08d24afa51b5eb816c42e4ca1c44a247bd42 (git) Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < 206d56f41a1509cadd06e2178c26cb830e45057d (git) Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < 5c9e3bb43a354a2245caebbbbb4a5b8c034fdd56 (git) Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < ca70b8baf2bd125b2a4d96e76db79375c07d7ff2 (git)
Linux	Linux	Affected: 4.20 Unaffected: 0 , < 4.20 (semver) Unaffected: 5.4.287 , ≤ 5.4.* (semver) Unaffected: 5.10.231 , ≤ 5.10.* (semver) Unaffected: 5.15.174 , ≤ 5.15.* (semver) Unaffected: 6.1.120 , ≤ 6.1.* (semver) Unaffected: 6.6.66 , ≤ 6.6.* (semver) Unaffected: 6.12.5 , ≤ 6.12.* (semver) Unaffected: 6.13 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:51:30.092Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_bpf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "905d82e6e77d16ec3e089c92b7b59a14899dfc1a",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "dbedc7e142df5ea238a46fdd7462c1c42cd36a10",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "0d6cd1151e26fc7c2d5daa85e8984aaa685a1a12",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "456f08d24afa51b5eb816c42e4ca1c44a247bd42",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "206d56f41a1509cadd06e2178c26cb830e45057d",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "5c9e3bb43a354a2245caebbbbb4a5b8c034fdd56",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "ca70b8baf2bd125b2a4d96e76db79375c07d7ff2",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_bpf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.287",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.231",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.287",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.231",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.66",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg\n\nThe current sk memory accounting logic in __SK_REDIRECT is pre-uncharging\ntosend bytes, which is either msg-\u003esg.size or a smaller value apply_bytes.\n\nPotential problems with this strategy are as follows:\n\n- If the actual sent bytes are smaller than tosend, we need to charge some\n  bytes back, as in line 487, which is okay but seems not clean.\n\n- When tosend is set to apply_bytes, as in line 417, and (ret \u003c 0), we may\n  miss uncharging (msg-\u003esg.size - apply_bytes) bytes.\n\n[...]\n415 tosend = msg-\u003esg.size;\n416 if (psock-\u003eapply_bytes \u0026\u0026 psock-\u003eapply_bytes \u003c tosend)\n417   tosend = psock-\u003eapply_bytes;\n[...]\n443 sk_msg_return(sk, msg, tosend);\n444 release_sock(sk);\n446 origsize = msg-\u003esg.size;\n447 ret = tcp_bpf_sendmsg_redir(sk_redir, redir_ingress,\n448                             msg, tosend, flags);\n449 sent = origsize - msg-\u003esg.size;\n[...]\n454 lock_sock(sk);\n455 if (unlikely(ret \u003c 0)) {\n456   int free = sk_msg_free_nocharge(sk, msg);\n458   if (!cork)\n459     *copied -= free;\n460 }\n[...]\n487 if (eval == __SK_REDIRECT)\n488   sk_mem_charge(sk, tosend - sent);\n[...]\n\nWhen running the selftest test_txmsg_redir_wait_sndmem with txmsg_apply,\nthe following warning will be reported:\n\n------------[ cut here ]------------\nWARNING: CPU: 6 PID: 57 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x190/0x1a0\nModules linked in:\nCPU: 6 UID: 0 PID: 57 Comm: kworker/6:0 Not tainted 6.12.0-rc1.bm.1-amd64+ #43\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nWorkqueue: events sk_psock_destroy\nRIP: 0010:inet_sock_destruct+0x190/0x1a0\nRSP: 0018:ffffad0a8021fe08 EFLAGS: 00010206\nRAX: 0000000000000011 RBX: ffff9aab4475b900 RCX: ffff9aab481a0800\nRDX: 0000000000000303 RSI: 0000000000000011 RDI: ffff9aab4475b900\nRBP: ffff9aab4475b990 R08: 0000000000000000 R09: ffff9aab40050ec0\nR10: 0000000000000000 R11: ffff9aae6fdb1d01 R12: ffff9aab49c60400\nR13: ffff9aab49c60598 R14: ffff9aab49c60598 R15: dead000000000100\nFS:  0000000000000000(0000) GS:ffff9aae6fd80000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007ffec7e47bd8 CR3: 00000001a1a1c004 CR4: 0000000000770ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n\u003cTASK\u003e\n? __warn+0x89/0x130\n? inet_sock_destruct+0x190/0x1a0\n? report_bug+0xfc/0x1e0\n? handle_bug+0x5c/0xa0\n? exc_invalid_op+0x17/0x70\n? asm_exc_invalid_op+0x1a/0x20\n? inet_sock_destruct+0x190/0x1a0\n__sk_destruct+0x25/0x220\nsk_psock_destroy+0x2b2/0x310\nprocess_scheduled_works+0xa3/0x3e0\nworker_thread+0x117/0x240\n? __pfx_worker_thread+0x10/0x10\nkthread+0xcf/0x100\n? __pfx_kthread+0x10/0x10\nret_from_fork+0x31/0x40\n? __pfx_kthread+0x10/0x10\nret_from_fork_asm+0x1a/0x30\n\u003c/TASK\u003e\n---[ end trace 0000000000000000 ]---\n\nIn __SK_REDIRECT, a more concise way is delaying the uncharging after sent\nbytes are finalized, and uncharge this value. When (ret \u003c 0), we shall\ninvoke sk_msg_free.\n\nSame thing happens in case __SK_DROP, when tosend is set to apply_bytes,\nwe may miss uncharging (msg-\u003esg.size - apply_bytes) bytes. The same\nwarning will be reported in selftest.\n\n[...]\n468 case __SK_DROP:\n469 default:\n470 sk_msg_free_partial(sk, msg, tosend);\n471 sk_msg_apply_bytes(psock, tosend);\n472 *copied -= (tosend + delta);\n473 return -EACCES;\n[...]\n\nSo instead of sk_msg_free_partial we can do sk_msg_free here."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:56:15.744Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/905d82e6e77d16ec3e089c92b7b59a14899dfc1a"
        },
        {
          "url": "https://git.kernel.org/stable/c/dbedc7e142df5ea238a46fdd7462c1c42cd36a10"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d6cd1151e26fc7c2d5daa85e8984aaa685a1a12"
        },
        {
          "url": "https://git.kernel.org/stable/c/456f08d24afa51b5eb816c42e4ca1c44a247bd42"
        },
        {
          "url": "https://git.kernel.org/stable/c/206d56f41a1509cadd06e2178c26cb830e45057d"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c9e3bb43a354a2245caebbbbb4a5b8c034fdd56"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca70b8baf2bd125b2a4d96e76db79375c07d7ff2"
        }
      ],
      "title": "tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56633",
    "datePublished": "2024-12-27T15:02:31.273Z",
    "dateReserved": "2024-12-27T15:00:39.838Z",
    "dateUpdated": "2026-05-11T20:56:15.744Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-21839 (GCVE-0-2025-21839)

Vulnerability from cvelistv5 – Published: 2025-03-07 09:09 – Updated: 2026-08-05 11:54

Title

KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop

Summary

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop Move the conditional loading of hardware DR6 with the guest's DR6 value out of the core .vcpu_run() loop to fix a bug where KVM can load hardware with a stale vcpu->arch.dr6. When the guest accesses a DR and host userspace isn't debugging the guest, KVM disables DR interception and loads the guest's values into hardware on VM-Enter and saves them on VM-Exit. This allows the guest to access DRs at will, e.g. so that a sequence of DR accesses to configure a breakpoint only generates one VM-Exit. For DR0-DR3, the logic/behavior is identical between VMX and SVM, and also identical between KVM_DEBUGREG_BP_ENABLED (userspace debugging the guest) and KVM_DEBUGREG_WONT_EXIT (guest using DRs), and so KVM handles loading DR0-DR3 in common code, _outside_ of the core kvm_x86_ops.vcpu_run() loop. But for DR6, the guest's value doesn't need to be loaded into hardware for KVM_DEBUGREG_BP_ENABLED, and SVM provides a dedicated VMCB field whereas VMX requires software to manually load the guest value, and so loading the guest's value into DR6 is handled by {svm,vmx}_vcpu_run(), i.e. is done _inside_ the core run loop. Unfortunately, saving the guest values on VM-Exit is initiated by common x86, again outside of the core run loop. If the guest modifies DR6 (in hardware, when DR interception is disabled), and then the next VM-Exit is a fastpath VM-Exit, KVM will reload hardware DR6 with vcpu->arch.dr6 and clobber the guest's actual value. The bug shows up primarily with nested VMX because KVM handles the VMX preemption timer in the fastpath, and the window between hardware DR6 being modified (in guest context) and DR6 being read by guest software is orders of magnitude larger in a nested setup. E.g. in non-nested, the VMX preemption timer would need to fire precisely between #DB injection and the #DB handler's read of DR6, whereas with a KVM-on-KVM setup, the window where hardware DR6 is "dirty" extends all the way from L1 writing DR6 to VMRESUME (in L1). L1's view: ========== <L1 disables DR interception> CPU 0/KVM-7289 [023] d.... 2925.640961: kvm_entry: vcpu 0 A: L1 Writes DR6 CPU 0/KVM-7289 [023] d.... 2925.640963: <hack>: Set DRs, DR6 = 0xffff0ff1 B: CPU 0/KVM-7289 [023] d.... 2925.640967: kvm_exit: vcpu 0 reason EXTERNAL_INTERRUPT intr_info 0x800000ec D: L1 reads DR6, arch.dr6 = 0 CPU 0/KVM-7289 [023] d.... 2925.640969: <hack>: Sync DRs, DR6 = 0xffff0ff0 CPU 0/KVM-7289 [023] d.... 2925.640976: kvm_entry: vcpu 0 L2 reads DR6, L1 disables DR interception CPU 0/KVM-7289 [023] d.... 2925.640980: kvm_exit: vcpu 0 reason DR_ACCESS info1 0x0000000000000216 CPU 0/KVM-7289 [023] d.... 2925.640983: kvm_entry: vcpu 0 CPU 0/KVM-7289 [023] d.... 2925.640983: <hack>: Set DRs, DR6 = 0xffff0ff0 L2 detects failure CPU 0/KVM-7289 [023] d.... 2925.640987: kvm_exit: vcpu 0 reason HLT L1 reads DR6 (confirms failure) CPU 0/KVM-7289 [023] d.... 2925.640990: <hack>: Sync DRs, DR6 = 0xffff0ff0 L0's view: ========== L2 reads DR6, arch.dr6 = 0 CPU 23/KVM-5046 [001] d.... 3410.005610: kvm_exit: vcpu 23 reason DR_ACCESS info1 0x0000000000000216 CPU 23/KVM-5046 [001] ..... 3410.005610: kvm_nested_vmexit: vcpu 23 reason DR_ACCESS info1 0x0000000000000216 L2 => L1 nested VM-Exit CPU 23/KVM-5046 [001] ..... 3410.005610: kvm_nested_vmexit_inject: reason: DR_ACCESS ext_inf1: 0x0000000000000216 CPU 23/KVM-5046 [001] d.... 3410.005610: kvm_entry: vcpu 23 CPU 23/KVM-5046 [001] d.... 3410.005611: kvm_exit: vcpu 23 reason VMREAD CPU 23/KVM-5046 [001] d.... 3410.005611: kvm_entry: vcpu 23 CPU 23/KVM-5046 [001] d.... 3410. ---truncated---

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/9efb2b99b96c86664…
https://git.kernel.org/stable/c/93eeb6df1605b3a24…
https://git.kernel.org/stable/c/a1723e9c53fe64314…
https://git.kernel.org/stable/c/4eb063de686bfcdfd…
https://git.kernel.org/stable/c/d456de38d9eb753a4…
https://git.kernel.org/stable/c/c2fee09fc167c74a6…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: d67668e9dd76d98136048935723947156737932b , < 9efb2b99b96c86664bbdbdd2cdb354ac9627eb20 (git) Affected: d67668e9dd76d98136048935723947156737932b , < 93eeb6df1605b3a24f38afdba7ab903ba6b64133 (git) Affected: d67668e9dd76d98136048935723947156737932b , < a1723e9c53fe6431415be19302a56543daf503f5 (git) Affected: d67668e9dd76d98136048935723947156737932b , < 4eb063de686bfcdfd03a8c801d1bbe87d2d5eb55 (git) Affected: d67668e9dd76d98136048935723947156737932b , < d456de38d9eb753a4e9fde053c18d4ef8e485339 (git) Affected: d67668e9dd76d98136048935723947156737932b , < c2fee09fc167c74a64adb08656cb993ea475197e (git)
Linux	Linux	Affected: 5.7 Unaffected: 0 , < 5.7 (semver) Unaffected: 5.15.182 , ≤ 5.15.* (semver) Unaffected: 6.1.138 , ≤ 6.1.* (semver) Unaffected: 6.6.90 , ≤ 6.6.* (semver) Unaffected: 6.12.16 , ≤ 6.12.* (semver) Unaffected: 6.13.4 , ≤ 6.13.* (semver) Unaffected: 6.14 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:37:57.827Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/include/asm/kvm-x86-ops.h",
            "arch/x86/include/asm/kvm_host.h",
            "arch/x86/kvm/svm/svm.c",
            "arch/x86/kvm/vmx/main.c",
            "arch/x86/kvm/vmx/vmx.c",
            "arch/x86/kvm/vmx/x86_ops.h",
            "arch/x86/kvm/x86.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9efb2b99b96c86664bbdbdd2cdb354ac9627eb20",
              "status": "affected",
              "version": "d67668e9dd76d98136048935723947156737932b",
              "versionType": "git"
            },
            {
              "lessThan": "93eeb6df1605b3a24f38afdba7ab903ba6b64133",
              "status": "affected",
              "version": "d67668e9dd76d98136048935723947156737932b",
              "versionType": "git"
            },
            {
              "lessThan": "a1723e9c53fe6431415be19302a56543daf503f5",
              "status": "affected",
              "version": "d67668e9dd76d98136048935723947156737932b",
              "versionType": "git"
            },
            {
              "lessThan": "4eb063de686bfcdfd03a8c801d1bbe87d2d5eb55",
              "status": "affected",
              "version": "d67668e9dd76d98136048935723947156737932b",
              "versionType": "git"
            },
            {
              "lessThan": "d456de38d9eb753a4e9fde053c18d4ef8e485339",
              "status": "affected",
              "version": "d67668e9dd76d98136048935723947156737932b",
              "versionType": "git"
            },
            {
              "lessThan": "c2fee09fc167c74a64adb08656cb993ea475197e",
              "status": "affected",
              "version": "d67668e9dd76d98136048935723947156737932b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/include/asm/kvm-x86-ops.h",
            "arch/x86/include/asm/kvm_host.h",
            "arch/x86/kvm/svm/svm.c",
            "arch/x86/kvm/vmx/main.c",
            "arch/x86/kvm/vmx/vmx.c",
            "arch/x86/kvm/vmx/x86_ops.h",
            "arch/x86/kvm/x86.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.182",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.138",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.182",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.138",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.90",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.16",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.4",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop\n\nMove the conditional loading of hardware DR6 with the guest\u0027s DR6 value\nout of the core .vcpu_run() loop to fix a bug where KVM can load hardware\nwith a stale vcpu-\u003earch.dr6.\n\nWhen the guest accesses a DR and host userspace isn\u0027t debugging the guest,\nKVM disables DR interception and loads the guest\u0027s values into hardware on\nVM-Enter and saves them on VM-Exit.  This allows the guest to access DRs\nat will, e.g. so that a sequence of DR accesses to configure a breakpoint\nonly generates one VM-Exit.\n\nFor DR0-DR3, the logic/behavior is identical between VMX and SVM, and also\nidentical between KVM_DEBUGREG_BP_ENABLED (userspace debugging the guest)\nand KVM_DEBUGREG_WONT_EXIT (guest using DRs), and so KVM handles loading\nDR0-DR3 in common code, _outside_ of the core kvm_x86_ops.vcpu_run() loop.\n\nBut for DR6, the guest\u0027s value doesn\u0027t need to be loaded into hardware for\nKVM_DEBUGREG_BP_ENABLED, and SVM provides a dedicated VMCB field whereas\nVMX requires software to manually load the guest value, and so loading the\nguest\u0027s value into DR6 is handled by {svm,vmx}_vcpu_run(), i.e. is done\n_inside_ the core run loop.\n\nUnfortunately, saving the guest values on VM-Exit is initiated by common\nx86, again outside of the core run loop.  If the guest modifies DR6 (in\nhardware, when DR interception is disabled), and then the next VM-Exit is\na fastpath VM-Exit, KVM will reload hardware DR6 with vcpu-\u003earch.dr6 and\nclobber the guest\u0027s actual value.\n\nThe bug shows up primarily with nested VMX because KVM handles the VMX\npreemption timer in the fastpath, and the window between hardware DR6\nbeing modified (in guest context) and DR6 being read by guest software is\norders of magnitude larger in a nested setup.  E.g. in non-nested, the\nVMX preemption timer would need to fire precisely between #DB injection\nand the #DB handler\u0027s read of DR6, whereas with a KVM-on-KVM setup, the\nwindow where hardware DR6 is \"dirty\" extends all the way from L1 writing\nDR6 to VMRESUME (in L1).\n\n    L1\u0027s view:\n    ==========\n    \u003cL1 disables DR interception\u003e\n           CPU 0/KVM-7289    [023] d....  2925.640961: kvm_entry: vcpu 0\n A:  L1 Writes DR6\n           CPU 0/KVM-7289    [023] d....  2925.640963: \u003chack\u003e: Set DRs, DR6 = 0xffff0ff1\n\n B:        CPU 0/KVM-7289    [023] d....  2925.640967: kvm_exit: vcpu 0 reason EXTERNAL_INTERRUPT intr_info 0x800000ec\n\n D: L1 reads DR6, arch.dr6 = 0\n           CPU 0/KVM-7289    [023] d....  2925.640969: \u003chack\u003e: Sync DRs, DR6 = 0xffff0ff0\n\n           CPU 0/KVM-7289    [023] d....  2925.640976: kvm_entry: vcpu 0\n    L2 reads DR6, L1 disables DR interception\n           CPU 0/KVM-7289    [023] d....  2925.640980: kvm_exit: vcpu 0 reason DR_ACCESS info1 0x0000000000000216\n           CPU 0/KVM-7289    [023] d....  2925.640983: kvm_entry: vcpu 0\n\n           CPU 0/KVM-7289    [023] d....  2925.640983: \u003chack\u003e: Set DRs, DR6 = 0xffff0ff0\n\n    L2 detects failure\n           CPU 0/KVM-7289    [023] d....  2925.640987: kvm_exit: vcpu 0 reason HLT\n    L1 reads DR6 (confirms failure)\n           CPU 0/KVM-7289    [023] d....  2925.640990: \u003chack\u003e: Sync DRs, DR6 = 0xffff0ff0\n\n    L0\u0027s view:\n    ==========\n    L2 reads DR6, arch.dr6 = 0\n          CPU 23/KVM-5046    [001] d....  3410.005610: kvm_exit: vcpu 23 reason DR_ACCESS info1 0x0000000000000216\n          CPU 23/KVM-5046    [001] .....  3410.005610: kvm_nested_vmexit: vcpu 23 reason DR_ACCESS info1 0x0000000000000216\n\n    L2 =\u003e L1 nested VM-Exit\n          CPU 23/KVM-5046    [001] .....  3410.005610: kvm_nested_vmexit_inject: reason: DR_ACCESS ext_inf1: 0x0000000000000216\n\n          CPU 23/KVM-5046    [001] d....  3410.005610: kvm_entry: vcpu 23\n          CPU 23/KVM-5046    [001] d....  3410.005611: kvm_exit: vcpu 23 reason VMREAD\n          CPU 23/KVM-5046    [001] d....  3410.005611: kvm_entry: vcpu 23\n          CPU 23/KVM-5046    [001] d....  3410.\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reaching the flaw requires executing code inside a KVM guest (or local access to /dev/kvm to start one); the DR access, the DR6 write, and the fastpath-inducing WRMSR/HLT are all local CPU instructions with no network component.\nAC:L - A guest at CPL0 controls both halves deterministically \u2014 it writes DR6, then forces a fastpath exit via WRMSR TSC_DEADLINE, an x2APIC self-IPI, or HLT, guaranteeing the stale reload on re-entry; under nested virt the dirty-DR6 window is enormous, and the bug also fires spontaneously under ordinary timer/idle activity.\nPR:L - Only an unprivileged local account is needed \u2014 on the host, /dev/kvm access lets a normal user run arbitrary ring-0 guest code; inside a guest, unprivileged userspace reaches the same state via ptrace POKEUSER on u_debugreg or perf_event_open hardware breakpoints, which make the guest kernel touch DRs and set KVM_DEBUGREG_WONT_EXIT.\nUI:N - The DR access, DR6 write, and fastpath exit are all attacker-initiated; no victim action is required, and the condition additionally arises during normal guest timer and idle operation.\nS:C - The defect is in the host hypervisor (arch/x86/kvm), but the corrupted resource is guest architectural register state, so the impact lands in the guest OS \u2014 a security authority distinct from the host KVM component that contains the bug.\nC:N - The clobbering value is the guest\u0027s own previously saved vcpu-\u003earch.dr6, and vmx_sync_dirty_debug_regs() resets hardware DR6 to DR6_RESERVED before host code runs, so no host or cross-VM data is disclosed.\nI:L - The host silently overwrites a guest architectural register with a stale value, letting an in-guest attacker clear DR_TRAPn bits to hide hardware-breakpoint hits from guest-side debuggers and integrity monitors, or inject spurious trap bits; the modification is confined to DR6 and is not an arbitrary write.\nA:H - Losing a DR_TRAPn bit means the guest\u0027s hw_breakpoint_handler() never sets X86_EFLAGS_RF for an execute breakpoint, so the faulting instruction re-triggers #DB forever and the vCPU hangs; a stale DR_STEP bit trips WARN_ON_ONCE in the guest\u0027s exc_debug_kernel(), panicking the guest under panic_on_warn, and nested hypervisors malfunction outright."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:54:50.771Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9efb2b99b96c86664bbdbdd2cdb354ac9627eb20"
        },
        {
          "url": "https://git.kernel.org/stable/c/93eeb6df1605b3a24f38afdba7ab903ba6b64133"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1723e9c53fe6431415be19302a56543daf503f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/4eb063de686bfcdfd03a8c801d1bbe87d2d5eb55"
        },
        {
          "url": "https://git.kernel.org/stable/c/d456de38d9eb753a4e9fde053c18d4ef8e485339"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2fee09fc167c74a64adb08656cb993ea475197e"
        }
      ],
      "title": "KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21839",
    "datePublished": "2025-03-07T09:09:58.220Z",
    "dateReserved": "2024-12-29T08:45:45.777Z",
    "dateUpdated": "2026-08-05T11:54:50.771Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-37980 (GCVE-0-2025-37980)

Vulnerability from cvelistv5 – Published: 2025-05-20 16:58 – Updated: 2026-09-08 08:41

Title

block: fix resource leak in blk_register_queue() error path

Summary

In the Linux kernel, the following vulnerability has been resolved: block: fix resource leak in blk_register_queue() error path When registering a queue fails after blk_mq_sysfs_register() is successful but the function later encounters an error, we need to clean up the blk_mq_sysfs resources. Add the missing blk_mq_sysfs_unregister() call in the error path to properly clean up these resources and prevent a memory leak.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/6af6d5feebf9423ab…
https://git.kernel.org/stable/c/549cbbd14bbec1246…
https://git.kernel.org/stable/c/41e43134ddda35949…
https://git.kernel.org/stable/c/55a7bb2708f7c7c5b…
https://git.kernel.org/stable/c/40f2eb9b531475dd0…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

8 products

Vendor	Product	Version
Linux	Linux	Affected: 320ae51feed5c2f13664aa05a76bec198967e04d , < 6af6d5feebf9423ab3b252831d1f52de31a8b5e0 (git) Affected: 320ae51feed5c2f13664aa05a76bec198967e04d , < 549cbbd14bbec12469ceb279b79c763c8a24224e (git) Affected: 320ae51feed5c2f13664aa05a76bec198967e04d , < 41e43134ddda35949974be40520460a12dda3502 (git) Affected: 320ae51feed5c2f13664aa05a76bec198967e04d , < 55a7bb2708f7c7c5b366d4e40916113168a3824c (git) Affected: 320ae51feed5c2f13664aa05a76bec198967e04d , < 40f2eb9b531475dd01b683fdaf61ca3cfd03a51e (git)
Linux	Linux	Affected: 3.13 Unaffected: 0 , < 3.13 (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.88 , ≤ 6.6.* (semver) Unaffected: 6.12.25 , ≤ 6.12.* (semver) Unaffected: 6.14.4 , ≤ 6.14.* (semver) Unaffected: 6.15 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:41:41.835Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/blk-sysfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6af6d5feebf9423ab3b252831d1f52de31a8b5e0",
              "status": "affected",
              "version": "320ae51feed5c2f13664aa05a76bec198967e04d",
              "versionType": "git"
            },
            {
              "lessThan": "549cbbd14bbec12469ceb279b79c763c8a24224e",
              "status": "affected",
              "version": "320ae51feed5c2f13664aa05a76bec198967e04d",
              "versionType": "git"
            },
            {
              "lessThan": "41e43134ddda35949974be40520460a12dda3502",
              "status": "affected",
              "version": "320ae51feed5c2f13664aa05a76bec198967e04d",
              "versionType": "git"
            },
            {
              "lessThan": "55a7bb2708f7c7c5b366d4e40916113168a3824c",
              "status": "affected",
              "version": "320ae51feed5c2f13664aa05a76bec198967e04d",
              "versionType": "git"
            },
            {
              "lessThan": "40f2eb9b531475dd01b683fdaf61ca3cfd03a51e",
              "status": "affected",
              "version": "320ae51feed5c2f13664aa05a76bec198967e04d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/blk-sysfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.25",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.88",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.25",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.4",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: fix resource leak in blk_register_queue() error path\n\nWhen registering a queue fails after blk_mq_sysfs_register() is\nsuccessful but the function later encounters an error, we need\nto clean up the blk_mq_sysfs resources.\n\nAdd the missing blk_mq_sysfs_unregister() call in the error path\nto properly clean up these resources and prevent a memory leak."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:18:58.108Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6af6d5feebf9423ab3b252831d1f52de31a8b5e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/549cbbd14bbec12469ceb279b79c763c8a24224e"
        },
        {
          "url": "https://git.kernel.org/stable/c/41e43134ddda35949974be40520460a12dda3502"
        },
        {
          "url": "https://git.kernel.org/stable/c/55a7bb2708f7c7c5b366d4e40916113168a3824c"
        },
        {
          "url": "https://git.kernel.org/stable/c/40f2eb9b531475dd01b683fdaf61ca3cfd03a51e"
        }
      ],
      "title": "block: fix resource leak in blk_register_queue() error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37980",
    "datePublished": "2025-05-20T16:58:22.720Z",
    "dateReserved": "2025-04-16T04:51:23.975Z",
    "dateUpdated": "2026-09-08T08:41:41.835Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-38015 (GCVE-0-2025-38015)

Vulnerability from cvelistv5 – Published: 2025-06-18 09:28 – Updated: 2026-05-23 15:58

Title

dmaengine: idxd: fix memory leak in error handling path of idxd_alloc

Summary

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc Memory allocated for idxd is not freed if an error occurs during idxd_alloc(). To fix it, free the allocated memory in the reverse order of allocation before exiting the function in case of an error.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/64afd9a1f644b2766…
https://git.kernel.org/stable/c/6e94a2c3e4c166cd2…
https://git.kernel.org/stable/c/868dbce755ec92855…
https://git.kernel.org/stable/c/4f005eb68890698e5…
https://git.kernel.org/stable/c/46a5cca76c76c8606…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: a8563a33a5e26064061f2fb34215c97f0e2995f4 , < 64afd9a1f644b27661420257dcc007d5009c99dd (git) Affected: a8563a33a5e26064061f2fb34215c97f0e2995f4 , < 6e94a2c3e4c166cd2736ac225fba5889fb1e8ac0 (git) Affected: a8563a33a5e26064061f2fb34215c97f0e2995f4 , < 868dbce755ec92855362d213f47e045a8388361a (git) Affected: a8563a33a5e26064061f2fb34215c97f0e2995f4 , < 4f005eb68890698e5abc6a3af04dab76f175c50c (git) Affected: a8563a33a5e26064061f2fb34215c97f0e2995f4 , < 46a5cca76c76c86063000a12936f8e7875295838 (git) Affected: 9526f051bedde01baa50081afe143a8bc5b8e6be (git) Affected: 6.0.9 , < 6.1 (semver)
Linux	Linux	Affected: 6.1 Unaffected: 0 , < 6.1 (semver) Unaffected: 6.1.140 , ≤ 6.1.* (semver) Unaffected: 6.6.92 , ≤ 6.6.* (semver) Unaffected: 6.12.30 , ≤ 6.12.* (semver) Unaffected: 6.14.8 , ≤ 6.14.* (semver) Unaffected: 6.15 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:58:17.911Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/idxd/init.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "64afd9a1f644b27661420257dcc007d5009c99dd",
              "status": "affected",
              "version": "a8563a33a5e26064061f2fb34215c97f0e2995f4",
              "versionType": "git"
            },
            {
              "lessThan": "6e94a2c3e4c166cd2736ac225fba5889fb1e8ac0",
              "status": "affected",
              "version": "a8563a33a5e26064061f2fb34215c97f0e2995f4",
              "versionType": "git"
            },
            {
              "lessThan": "868dbce755ec92855362d213f47e045a8388361a",
              "status": "affected",
              "version": "a8563a33a5e26064061f2fb34215c97f0e2995f4",
              "versionType": "git"
            },
            {
              "lessThan": "4f005eb68890698e5abc6a3af04dab76f175c50c",
              "status": "affected",
              "version": "a8563a33a5e26064061f2fb34215c97f0e2995f4",
              "versionType": "git"
            },
            {
              "lessThan": "46a5cca76c76c86063000a12936f8e7875295838",
              "status": "affected",
              "version": "a8563a33a5e26064061f2fb34215c97f0e2995f4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9526f051bedde01baa50081afe143a8bc5b8e6be",
              "versionType": "git"
            },
            {
              "lessThan": "6.1",
              "status": "affected",
              "version": "6.0.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/idxd/init.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.140",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.92",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.30",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.8",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.0.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: fix memory leak in error handling path of idxd_alloc\n\nMemory allocated for idxd is not freed if an error occurs during\nidxd_alloc(). To fix it, free the allocated memory in the reverse order\nof allocation before exiting the function in case of an error."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:58:49.570Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/64afd9a1f644b27661420257dcc007d5009c99dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e94a2c3e4c166cd2736ac225fba5889fb1e8ac0"
        },
        {
          "url": "https://git.kernel.org/stable/c/868dbce755ec92855362d213f47e045a8388361a"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f005eb68890698e5abc6a3af04dab76f175c50c"
        },
        {
          "url": "https://git.kernel.org/stable/c/46a5cca76c76c86063000a12936f8e7875295838"
        }
      ],
      "title": "dmaengine: idxd: fix memory leak in error handling path of idxd_alloc",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38015",
    "datePublished": "2025-06-18T09:28:24.235Z",
    "dateReserved": "2025-04-16T04:51:23.977Z",
    "dateUpdated": "2026-05-23T15:58:49.570Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-38097 (GCVE-0-2025-38097)

Vulnerability from cvelistv5 – Published: 2025-07-03 08:13 – Updated: 2026-09-14 11:58

Title

espintcp: remove encap socket caching to avoid reference leak

Summary

In the Linux kernel, the following vulnerability has been resolved: espintcp: remove encap socket caching to avoid reference leak The current scheme for caching the encap socket can lead to reference leaks when we try to delete the netns. The reference chain is: xfrm_state -> enacp_sk -> netns Since the encap socket is a userspace socket, it holds a reference on the netns. If we delete the espintcp state (through flush or individual delete) before removing the netns, the reference on the socket is dropped and the netns is correctly deleted. Otherwise, the netns may not be reachable anymore (if all processes within the ns have terminated), so we cannot delete the xfrm state to drop its reference on the socket. This patch results in a small (~2% in my tests) performance regression. A GC-type mechanism could be added for the socket cache, to clear references if the state hasn't been used "recently", but it's a lot more complex than just not caching the socket.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/e32bafd08ee35feac…
https://git.kernel.org/stable/c/9673ca00e6c550306…
https://git.kernel.org/stable/c/e4cde54b46a87231c…
https://git.kernel.org/stable/c/b58a295d10065960b…
https://git.kernel.org/stable/c/9cbca30102028f9ad…
https://git.kernel.org/stable/c/74fd327767fb784c5…
https://git.kernel.org/stable/c/028363685bd0b7a19…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 , < e32bafd08ee35feacd47b05cc5bfe9cd9659cd25 (git) Affected: e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 , < 9673ca00e6c5503069dc98780e2e89db0e663c16 (git) Affected: e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 , < e4cde54b46a87231c77256a633be1bef62687d69 (git) Affected: e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 , < b58a295d10065960bcb9d60cb8ca6ead9837cd27 (git) Affected: e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 , < 9cbca30102028f9ad3d2098f935c4368f581fd07 (git) Affected: e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 , < 74fd327767fb784c5875cf7c4ba1217f26020943 (git) Affected: e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 , < 028363685bd0b7a19b4a820f82dd905b1dc83999 (git)
Linux	Linux	Affected: 5.6 Unaffected: 0 , < 5.6 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.141 , ≤ 6.1.* (semver) Unaffected: 6.6.93 , ≤ 6.6.* (semver) Unaffected: 6.12.31 , ≤ 6.12.* (semver) Unaffected: 6.14.9 , ≤ 6.14.* (semver) Unaffected: 6.15 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:34:02.117Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/xfrm.h",
            "net/ipv4/esp4.c",
            "net/ipv6/esp6.c",
            "net/xfrm/xfrm_state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e32bafd08ee35feacd47b05cc5bfe9cd9659cd25",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "9673ca00e6c5503069dc98780e2e89db0e663c16",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "e4cde54b46a87231c77256a633be1bef62687d69",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "b58a295d10065960bcb9d60cb8ca6ead9837cd27",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "9cbca30102028f9ad3d2098f935c4368f581fd07",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "74fd327767fb784c5875cf7c4ba1217f26020943",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            },
            {
              "lessThan": "028363685bd0b7a19b4a820f82dd905b1dc83999",
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/xfrm.h",
            "net/ipv4/esp4.c",
            "net/ipv6/esp6.c",
            "net/xfrm/xfrm_state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.141",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.93",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.31",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.9",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nespintcp: remove encap socket caching to avoid reference leak\n\nThe current scheme for caching the encap socket can lead to reference\nleaks when we try to delete the netns.\n\nThe reference chain is: xfrm_state -\u003e enacp_sk -\u003e netns\n\nSince the encap socket is a userspace socket, it holds a reference on\nthe netns. If we delete the espintcp state (through flush or\nindividual delete) before removing the netns, the reference on the\nsocket is dropped and the netns is correctly deleted. Otherwise, the\nnetns may not be reachable anymore (if all processes within the ns\nhave terminated), so we cannot delete the xfrm state to drop its\nreference on the socket.\n\nThis patch results in a small (~2% in my tests) performance\nregression.\n\nA GC-type mechanism could be added for the socket cache, to clear\nreferences if the state hasn\u0027t been used \"recently\", but it\u0027s a lot\nmore complex than just not caching the socket."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The entire attack is driven through local syscalls \u2014 `socket()`+`setsockopt(TCP_ULP,\"espintcp\")` to create the encap socket, NETLINK_XFRM to add/flush the SA and policy, and local traffic to trigger `esp_output_tail_tcp()`. No remote peer input is needed to populate or tear down the cached socket reference.\nAC:L - The reference leak itself is fully deterministic \u2014 create the SA, send one packet, let the namespace go away \u2014 with no race or memory-layout dependency, and `CONFIG_INET_ESPINTCP`/`CONFIG_INET6_ESPINTCP` are enabled in mainstream distro kernels. For the dangling-`encap_sk` window the attacker drives both sides (a traffic generator feeding `xfrm_trans_queue_net()` and a concurrent `xfrm state flush` loop) and can retry indefinitely.\nPR:L - Adding the xfrm state requires CAP_NET_ADMIN, but `xfrm_user.c` uses `netlink_net_capable()`, which resolves against `sock_net(skb-\u003esk)-\u003euser_ns`, so an ordinary unprivileged user obtains it with `unshare -Urn`; attaching the espintcp ULP requires no privilege at all. No real root in the init namespace is needed.\nUI:N - The attacker performs every step \u2014 socket setup, SA installation, packet transmission, and namespace teardown \u2014 entirely on their own. No victim action or cooperating process is involved.\nS:U - The leaked netns/socket and the dangling socket dereference are all kernel objects under the same security authority as the attacking context; no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - After `__xfrm_state_delete()` drops the socket reference without RCU synchronization and leaves `x-\u003eencap_sk` non-NULL, the deferred `esp_find_tcp_sk()` reads `sk-\u003esk_state` and then operates on that released socket; because TCP sockets come from a SLAB_TYPESAFE_BY_RCU cache the slot can already hold an attacker-groomed socket, and `espintcp_getctx()` then follows a foreign `icsk_ulp_data`, giving a use-after-free read primitive over attacker-influenced kernel memory.\nI:H - The stale `x-\u003eencap_sk` also lets the slow path match `sk == nsk` and queue a second `sock_put()` through `call_rcu(esp_free_tcp_sk)`, a refcount underflow that frees a socket userspace still references by fd \u2014 a classic UAF write/heap-grooming primitive, and `bh_lock_sock()`/`espintcp_push_skb()` write into the freed object directly.\nA:H - Each leaked SA permanently pins an entire `struct net` (with all per-net subsystem allocations, sysctls, procfs entries and per-cpu data) that can never be reclaimed, and an unprivileged user can repeat this in a loop until kernel memory is exhausted or netns ucount limits break container creation; the dangling-socket dereference additionally oopses the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:58:01.146Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e32bafd08ee35feacd47b05cc5bfe9cd9659cd25"
        },
        {
          "url": "https://git.kernel.org/stable/c/9673ca00e6c5503069dc98780e2e89db0e663c16"
        },
        {
          "url": "https://git.kernel.org/stable/c/e4cde54b46a87231c77256a633be1bef62687d69"
        },
        {
          "url": "https://git.kernel.org/stable/c/b58a295d10065960bcb9d60cb8ca6ead9837cd27"
        },
        {
          "url": "https://git.kernel.org/stable/c/9cbca30102028f9ad3d2098f935c4368f581fd07"
        },
        {
          "url": "https://git.kernel.org/stable/c/74fd327767fb784c5875cf7c4ba1217f26020943"
        },
        {
          "url": "https://git.kernel.org/stable/c/028363685bd0b7a19b4a820f82dd905b1dc83999"
        }
      ],
      "title": "espintcp: remove encap socket caching to avoid reference leak",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38097",
    "datePublished": "2025-07-03T08:13:57.694Z",
    "dateReserved": "2025-04-16T04:51:23.985Z",
    "dateUpdated": "2026-09-14T11:58:01.146Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-38166 (GCVE-0-2025-38166)

Vulnerability from cvelistv5 – Published: 2025-07-03 08:36 – Updated: 2026-08-05 11:59

Title

bpf: fix ktls panic with sockmap

Summary

In the Linux kernel, the following vulnerability has been resolved: bpf: fix ktls panic with sockmap [ 2172.936997] ------------[ cut here ]------------ [ 2172.936999] kernel BUG at lib/iov_iter.c:629! ...... [ 2172.944996] PKRU: 55555554 [ 2172.945155] Call Trace: [ 2172.945299] <TASK> [ 2172.945428] ? die+0x36/0x90 [ 2172.945601] ? do_trap+0xdd/0x100 [ 2172.945795] ? iov_iter_revert+0x178/0x180 [ 2172.946031] ? iov_iter_revert+0x178/0x180 [ 2172.946267] ? do_error_trap+0x7d/0x110 [ 2172.946499] ? iov_iter_revert+0x178/0x180 [ 2172.946736] ? exc_invalid_op+0x50/0x70 [ 2172.946961] ? iov_iter_revert+0x178/0x180 [ 2172.947197] ? asm_exc_invalid_op+0x1a/0x20 [ 2172.947446] ? iov_iter_revert+0x178/0x180 [ 2172.947683] ? iov_iter_revert+0x5c/0x180 [ 2172.947913] tls_sw_sendmsg_locked.isra.0+0x794/0x840 [ 2172.948206] tls_sw_sendmsg+0x52/0x80 [ 2172.948420] ? inet_sendmsg+0x1f/0x70 [ 2172.948634] __sys_sendto+0x1cd/0x200 [ 2172.948848] ? find_held_lock+0x2b/0x80 [ 2172.949072] ? syscall_trace_enter+0x140/0x270 [ 2172.949330] ? __lock_release.isra.0+0x5e/0x170 [ 2172.949595] ? find_held_lock+0x2b/0x80 [ 2172.949817] ? syscall_trace_enter+0x140/0x270 [ 2172.950211] ? lockdep_hardirqs_on_prepare+0xda/0x190 [ 2172.950632] ? ktime_get_coarse_real_ts64+0xc2/0xd0 [ 2172.951036] __x64_sys_sendto+0x24/0x30 [ 2172.951382] do_syscall_64+0x90/0x170 ...... After calling bpf_exec_tx_verdict(), the size of msg_pl->sg may increase, e.g., when the BPF program executes bpf_msg_push_data(). If the BPF program sets cork_bytes and sg.size is smaller than cork_bytes, it will return -ENOSPC and attempt to roll back to the non-zero copy logic. However, during rollback, msg->msg_iter is reset, but since msg_pl->sg.size has been increased, subsequent executions will exceed the actual size of msg_iter. ''' iov_iter_revert(&msg->msg_iter, msg_pl->sg.size - orig_size); ''' The changes in this commit are based on the following considerations: 1. When cork_bytes is set, rolling back to non-zero copy logic is pointless and can directly go to zero-copy logic. 2. We can not calculate the correct number of bytes to revert msg_iter. Assume the original data is "abcdefgh" (8 bytes), and after 3 pushes by the BPF program, it becomes 11-byte data: "abc?de?fgh?". Then, we set cork_bytes to 6, which means the first 6 bytes have been processed, and the remaining 5 bytes "?fgh?" will be cached until the length meets the cork_bytes requirement. However, some data in "?fgh?" is not within 'sg->msg_iter' (but in msg_pl instead), especially the data "?" we pushed. So it doesn't seem as simple as just reverting through an offset of msg_iter. 3. For non-TLS sockets in tcp_bpf_sendmsg, when a "cork" situation occurs, the user-space send() doesn't return an error, and the returned length is the same as the input length parameter, even if some data is cached. Additionally, I saw that the current non-zero-copy logic for handling corking is written as: ''' line 1177 else if (ret != -EAGAIN) { if (ret == -ENOSPC) ret = 0; goto send_end; ''' So it's ok to just return 'copied' without error when a "cork" situation occurs.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/328cac3f9f8ae3947…
https://git.kernel.org/stable/c/2e36a81d388ec9c3f…
https://git.kernel.org/stable/c/57fbbe29e86042bba…
https://git.kernel.org/stable/c/603943f022a7fe5cc…
https://git.kernel.org/stable/c/54a3ecaeeeae8176d…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: d3b18ad31f93d0b6bae105c679018a1ba7daa9ca , < 328cac3f9f8ae394748485e769a527518a9137c8 (git) Affected: d3b18ad31f93d0b6bae105c679018a1ba7daa9ca , < 2e36a81d388ec9c3f78b6223f7eda2088cd40adb (git) Affected: d3b18ad31f93d0b6bae105c679018a1ba7daa9ca , < 57fbbe29e86042bbaa31c1a30d2afa16c427e3f7 (git) Affected: d3b18ad31f93d0b6bae105c679018a1ba7daa9ca , < 603943f022a7fe5cc83ca7005faf34798fb7853f (git) Affected: d3b18ad31f93d0b6bae105c679018a1ba7daa9ca , < 54a3ecaeeeae8176da8badbd7d72af1017032c39 (git)
Linux	Linux	Affected: 4.20 Unaffected: 0 , < 4.20 (semver) Unaffected: 6.1.142 , ≤ 6.1.* (semver) Unaffected: 6.6.94 , ≤ 6.6.* (semver) Unaffected: 6.12.34 , ≤ 6.12.* (semver) Unaffected: 6.15.3 , ≤ 6.15.* (semver) Unaffected: 6.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:34:55.864Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "328cac3f9f8ae394748485e769a527518a9137c8",
              "status": "affected",
              "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca",
              "versionType": "git"
            },
            {
              "lessThan": "2e36a81d388ec9c3f78b6223f7eda2088cd40adb",
              "status": "affected",
              "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca",
              "versionType": "git"
            },
            {
              "lessThan": "57fbbe29e86042bbaa31c1a30d2afa16c427e3f7",
              "status": "affected",
              "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca",
              "versionType": "git"
            },
            {
              "lessThan": "603943f022a7fe5cc83ca7005faf34798fb7853f",
              "status": "affected",
              "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca",
              "versionType": "git"
            },
            {
              "lessThan": "54a3ecaeeeae8176da8badbd7d72af1017032c39",
              "status": "affected",
              "version": "d3b18ad31f93d0b6bae105c679018a1ba7daa9ca",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.94",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fix ktls panic with sockmap\n\n[ 2172.936997] ------------[ cut here ]------------\n[ 2172.936999] kernel BUG at lib/iov_iter.c:629!\n......\n[ 2172.944996] PKRU: 55555554\n[ 2172.945155] Call Trace:\n[ 2172.945299]  \u003cTASK\u003e\n[ 2172.945428]  ? die+0x36/0x90\n[ 2172.945601]  ? do_trap+0xdd/0x100\n[ 2172.945795]  ? iov_iter_revert+0x178/0x180\n[ 2172.946031]  ? iov_iter_revert+0x178/0x180\n[ 2172.946267]  ? do_error_trap+0x7d/0x110\n[ 2172.946499]  ? iov_iter_revert+0x178/0x180\n[ 2172.946736]  ? exc_invalid_op+0x50/0x70\n[ 2172.946961]  ? iov_iter_revert+0x178/0x180\n[ 2172.947197]  ? asm_exc_invalid_op+0x1a/0x20\n[ 2172.947446]  ? iov_iter_revert+0x178/0x180\n[ 2172.947683]  ? iov_iter_revert+0x5c/0x180\n[ 2172.947913]  tls_sw_sendmsg_locked.isra.0+0x794/0x840\n[ 2172.948206]  tls_sw_sendmsg+0x52/0x80\n[ 2172.948420]  ? inet_sendmsg+0x1f/0x70\n[ 2172.948634]  __sys_sendto+0x1cd/0x200\n[ 2172.948848]  ? find_held_lock+0x2b/0x80\n[ 2172.949072]  ? syscall_trace_enter+0x140/0x270\n[ 2172.949330]  ? __lock_release.isra.0+0x5e/0x170\n[ 2172.949595]  ? find_held_lock+0x2b/0x80\n[ 2172.949817]  ? syscall_trace_enter+0x140/0x270\n[ 2172.950211]  ? lockdep_hardirqs_on_prepare+0xda/0x190\n[ 2172.950632]  ? ktime_get_coarse_real_ts64+0xc2/0xd0\n[ 2172.951036]  __x64_sys_sendto+0x24/0x30\n[ 2172.951382]  do_syscall_64+0x90/0x170\n......\n\nAfter calling bpf_exec_tx_verdict(), the size of msg_pl-\u003esg may increase,\ne.g., when the BPF program executes bpf_msg_push_data().\n\nIf the BPF program sets cork_bytes and sg.size is smaller than cork_bytes,\nit will return -ENOSPC and attempt to roll back to the non-zero copy\nlogic. However, during rollback, msg-\u003emsg_iter is reset, but since\nmsg_pl-\u003esg.size has been increased, subsequent executions will exceed the\nactual size of msg_iter.\n\u0027\u0027\u0027\niov_iter_revert(\u0026msg-\u003emsg_iter, msg_pl-\u003esg.size - orig_size);\n\u0027\u0027\u0027\n\nThe changes in this commit are based on the following considerations:\n\n1. When cork_bytes is set, rolling back to non-zero copy logic is\npointless and can directly go to zero-copy logic.\n\n2. We can not calculate the correct number of bytes to revert msg_iter.\n\nAssume the original data is \"abcdefgh\" (8 bytes), and after 3 pushes\nby the BPF program, it becomes 11-byte data: \"abc?de?fgh?\".\nThen, we set cork_bytes to 6, which means the first 6 bytes have been\nprocessed, and the remaining 5 bytes \"?fgh?\" will be cached until the\nlength meets the cork_bytes requirement.\n\nHowever, some data in \"?fgh?\" is not within \u0027sg-\u003emsg_iter\u0027\n(but in msg_pl instead), especially the data \"?\" we pushed.\n\nSo it doesn\u0027t seem as simple as just reverting through an offset of\nmsg_iter.\n\n3. For non-TLS sockets in tcp_bpf_sendmsg, when a \"cork\" situation occurs,\nthe user-space send() doesn\u0027t return an error, and the returned length is\nthe same as the input length parameter, even if some data is cached.\n\nAdditionally, I saw that the current non-zero-copy logic for handling\ncorking is written as:\n\u0027\u0027\u0027\nline 1177\nelse if (ret != -EAGAIN) {\n\tif (ret == -ENOSPC)\n\t\tret = 0;\n\tgoto send_end;\n\u0027\u0027\u0027\n\nSo it\u0027s ok to just return \u0027copied\u0027 without error when a \"cork\" situation\noccurs."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The trigger is a local `sendmsg()`/`sendto()` syscall on a kTLS socket enrolled in a sockmap, and the data driving the bug is the calling process\u0027s own send buffer plus the sk_msg BPF verdict \u2014 not data received from a remote peer. This is the kTLS transmit path combined with BPF/sockmap, both of which are locally reachable only.\nAC:L - Exploitation is fully deterministic \u2014 no race, no memory-layout grooming, no timing window; the attacker simply issues a `send()` whose length falls below the program\u0027s `cork_bytes` threshold and the `BUG()` fires every time. The attacker additionally chooses ITER_UBUF vs ITER_IOVEC by controlling `nr_segs`, selecting between the guaranteed panic and the out-of-bounds iterator walk.\nPR:L - Enabling kTLS TX requires no capability whatsoever (net/tls contains no `capable()` checks), and in the standard sockmap deployment the `sk_msg` program is installed by the platform/service mesh with sockets auto-enrolled on connect, so an ordinary unprivileged local user needs only a socket and a `send()` call. Where the attacker supplies the BPF program, `bpf_token_capable()` also grants `CAP_BPF`/`CAP_NET_ADMIN` inside a user namespace via a delegated BPF token.\nUI:N - The attacker performs every step themselves \u2014 create socket, enable kTLS, call send(). No action by any other user or administrator is needed at exploitation time.\nS:U - The corruption and the crash are confined to the kernel\u0027s own memory and the attacking task\u0027s socket state; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - With \u22652 iovecs, `iov_iter_revert()` walks backwards off the front of `iovstack[]` in an unbounded loop, reading kernel-stack qwords as `iov_len` and leaving `i-\u003e__iov` pointing at out-of-bounds kernel memory adjacent to the attacker-seeded `sockaddr_storage`; `i-\u003ecount` is simultaneously inflated past the end of the user buffer, and the corrupted iterator is then used for further copies. This unbounded OOB kernel read plus live-iterator corruption is a disclosure primitive.\nI:H - The faulty revert writes an out-of-bounds pointer, inflated `nr_segs`, and an `iov_offset` derived from out-of-bounds kernel memory into a live kernel iterator whose neighbouring stack contents the attacker controls via `msg_name`, and the `sg.size`/`sk_mem_charge` accounting diverges from reality. Memory-safety corruption of this nature is scored High.\nA:H - The common single-buffer case hits a guaranteed `BUG()` at lib/iov_iter.c:629 while holding both `tls_ctx-\u003etx_lock` and the socket lock, so the killed task self-deadlocks in `tls_sk_proto_close()` during exit \u2014 an unkillable D-state task with a permanently wedged socket and leaked memory. On systems with `panic_on_oops` it is an immediate full system panic, and it is trivially repeatable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:59:59.787Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/328cac3f9f8ae394748485e769a527518a9137c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e36a81d388ec9c3f78b6223f7eda2088cd40adb"
        },
        {
          "url": "https://git.kernel.org/stable/c/57fbbe29e86042bbaa31c1a30d2afa16c427e3f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/603943f022a7fe5cc83ca7005faf34798fb7853f"
        },
        {
          "url": "https://git.kernel.org/stable/c/54a3ecaeeeae8176da8badbd7d72af1017032c39"
        }
      ],
      "title": "bpf: fix ktls panic with sockmap",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38166",
    "datePublished": "2025-07-03T08:36:06.372Z",
    "dateReserved": "2025-04-16T04:51:23.991Z",
    "dateUpdated": "2026-08-05T11:59:59.787Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-38202 (GCVE-0-2025-38202)

Vulnerability from cvelistv5 – Published: 2025-07-04 13:37 – Updated: 2026-05-11 21:23

Title

bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()

Summary

In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() bpf_map_lookup_percpu_elem() helper is also available for sleepable bpf program. When BPF JIT is disabled or under 32-bit host, bpf_map_lookup_percpu_elem() will not be inlined. Using it in a sleepable bpf program will trigger the warning in bpf_map_lookup_percpu_elem(), because the bpf program only holds rcu_read_lock_trace lock. Therefore, add the missed check.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/2f8c69a72e8ad87b3…
https://git.kernel.org/stable/c/7bf4461f1c97207fd…
https://git.kernel.org/stable/c/2d834477bbc1e8b8a…
https://git.kernel.org/stable/c/b522d4d334f206284…
https://git.kernel.org/stable/c/d4965578267e2e81f…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 07343110b293456d30393e89b86c4dee1ac051c8 , < 2f8c69a72e8ad87b36b8052f789da3cc2b2e186c (git) Affected: 07343110b293456d30393e89b86c4dee1ac051c8 , < 7bf4461f1c97207fda757014690d55a447ce859f (git) Affected: 07343110b293456d30393e89b86c4dee1ac051c8 , < 2d834477bbc1e8b8a59ff8b0c081529d6bed7b22 (git) Affected: 07343110b293456d30393e89b86c4dee1ac051c8 , < b522d4d334f206284b1a44b0b0b2f99fd443b39b (git) Affected: 07343110b293456d30393e89b86c4dee1ac051c8 , < d4965578267e2e81f67c86e2608481e77e9c8569 (git)
Linux	Linux	Affected: 5.19 Unaffected: 0 , < 5.19 (semver) Unaffected: 6.1.142 , ≤ 6.1.* (semver) Unaffected: 6.6.95 , ≤ 6.6.* (semver) Unaffected: 6.12.35 , ≤ 6.12.* (semver) Unaffected: 6.15.4 , ≤ 6.15.* (semver) Unaffected: 6.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:35:24.781Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/helpers.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2f8c69a72e8ad87b36b8052f789da3cc2b2e186c",
              "status": "affected",
              "version": "07343110b293456d30393e89b86c4dee1ac051c8",
              "versionType": "git"
            },
            {
              "lessThan": "7bf4461f1c97207fda757014690d55a447ce859f",
              "status": "affected",
              "version": "07343110b293456d30393e89b86c4dee1ac051c8",
              "versionType": "git"
            },
            {
              "lessThan": "2d834477bbc1e8b8a59ff8b0c081529d6bed7b22",
              "status": "affected",
              "version": "07343110b293456d30393e89b86c4dee1ac051c8",
              "versionType": "git"
            },
            {
              "lessThan": "b522d4d334f206284b1a44b0b0b2f99fd443b39b",
              "status": "affected",
              "version": "07343110b293456d30393e89b86c4dee1ac051c8",
              "versionType": "git"
            },
            {
              "lessThan": "d4965578267e2e81f67c86e2608481e77e9c8569",
              "status": "affected",
              "version": "07343110b293456d30393e89b86c4dee1ac051c8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/helpers.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.95",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()\n\nbpf_map_lookup_percpu_elem() helper is also available for sleepable bpf\nprogram. When BPF JIT is disabled or under 32-bit host,\nbpf_map_lookup_percpu_elem() will not be inlined. Using it in a\nsleepable bpf program will trigger the warning in\nbpf_map_lookup_percpu_elem(), because the bpf program only holds\nrcu_read_lock_trace lock. Therefore, add the missed check."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:23:13.711Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2f8c69a72e8ad87b36b8052f789da3cc2b2e186c"
        },
        {
          "url": "https://git.kernel.org/stable/c/7bf4461f1c97207fda757014690d55a447ce859f"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d834477bbc1e8b8a59ff8b0c081529d6bed7b22"
        },
        {
          "url": "https://git.kernel.org/stable/c/b522d4d334f206284b1a44b0b0b2f99fd443b39b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4965578267e2e81f67c86e2608481e77e9c8569"
        }
      ],
      "title": "bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38202",
    "datePublished": "2025-07-04T13:37:23.347Z",
    "dateReserved": "2025-04-16T04:51:23.994Z",
    "dateUpdated": "2026-05-11T21:23:13.711Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-38267 (GCVE-0-2025-38267)

Vulnerability from cvelistv5 – Published: 2025-07-10 07:41 – Updated: 2026-05-11 21:24

Title

ring-buffer: Do not trigger WARN_ON() due to a commit_overrun

Summary

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not trigger WARN_ON() due to a commit_overrun When reading a memory mapped buffer the reader page is just swapped out with the last page written in the write buffer. If the reader page is the same as the commit buffer (the buffer that is currently being written to) it was assumed that it should never have missed events. If it does, it triggers a WARN_ON_ONCE(). But there just happens to be one scenario where this can legitimately happen. That is on a commit_overrun. A commit overrun is when an interrupt preempts an event being written to the buffer and then the interrupt adds so many new events that it fills and wraps the buffer back to the commit. Any new events would then be dropped and be reported as "missed_events". In this case, the next page to read is the commit buffer and after the swap of the reader page, the reader page will be the commit buffer, but this time there will be missed events and this triggers the following warning: ------------[ cut here ]------------ WARNING: CPU: 2 PID: 1127 at kernel/trace/ring_buffer.c:7357 ring_buffer_map_get_reader+0x49a/0x780 Modules linked in: kvm_intel kvm irqbypass CPU: 2 UID: 0 PID: 1127 Comm: trace-cmd Not tainted 6.15.0-rc7-test-00004-g478bc2824b45-dirty #564 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:ring_buffer_map_get_reader+0x49a/0x780 Code: 00 00 00 48 89 fe 48 c1 ee 03 80 3c 2e 00 0f 85 ec 01 00 00 4d 3b a6 a8 00 00 00 0f 85 8a fd ff ff 48 85 c0 0f 84 55 fe ff ff <0f> 0b e9 4e fe ff ff be 08 00 00 00 4c 89 54 24 58 48 89 54 24 50 RSP: 0018:ffff888121787dc0 EFLAGS: 00010002 RAX: 00000000000006a2 RBX: ffff888100062800 RCX: ffffffff8190cb49 RDX: ffff888126934c00 RSI: 1ffff11020200a15 RDI: ffff8881010050a8 RBP: dffffc0000000000 R08: 0000000000000000 R09: ffffed1024d26982 R10: ffff888126934c17 R11: ffff8881010050a8 R12: ffff888126934c00 R13: ffff8881010050b8 R14: ffff888101005000 R15: ffff888126930008 FS: 00007f95c8cd7540(0000) GS:ffff8882b576e000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f95c8de4dc0 CR3: 0000000128452002 CR4: 0000000000172ef0 Call Trace: <TASK> ? __pfx_ring_buffer_map_get_reader+0x10/0x10 tracing_buffers_ioctl+0x283/0x370 __x64_sys_ioctl+0x134/0x190 do_syscall_64+0x79/0x1c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f95c8de48db Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 RSP: 002b:00007ffe037ba110 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffe037bb2b0 RCX: 00007f95c8de48db RDX: 0000000000000000 RSI: 0000000000005220 RDI: 0000000000000006 RBP: 00007ffe037ba180 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe037bb6f8 R14: 00007f95c9065000 R15: 00005575c7492c90 </TASK> irq event stamp: 5080 hardirqs last enabled at (5079): [<ffffffff83e0adb0>] _raw_spin_unlock_irqrestore+0x50/0x70 hardirqs last disabled at (5080): [<ffffffff83e0aa83>] _raw_spin_lock_irqsave+0x63/0x70 softirqs last enabled at (4182): [<ffffffff81516122>] handle_softirqs+0x552/0x710 softirqs last disabled at (4159): [<ffffffff815163f7>] __irq_exit_rcu+0x107/0x210 ---[ end trace 0000000000000000 ]--- The above was triggered by running on a kernel with both lockdep and KASAN as well as kmemleak enabled and executing the following command: # perf record -o perf-test.dat -a -- trace-cmd record --nosplice -e all -p function hackbench 50 With perf interjecting a lot of interrupts and trace-cmd enabling all events as well as function tracing, with lockdep, KASAN and kmemleak enabled, it could cause an interrupt preempting an event being written to add enough event ---truncated---

Severity

No CVSS data available.

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/b8df8cb8f7eef52ba…
https://git.kernel.org/stable/c/e018053632bad8ee0…
https://git.kernel.org/stable/c/4fc78a7c9ca994e1d…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: fe832be05a8eee5f1488cbcc2c562dd82d079fd6 , < b8df8cb8f7eef52baa9ac5bf36a405ca67945a91 (git) Affected: fe832be05a8eee5f1488cbcc2c562dd82d079fd6 , < e018053632bad8ee0752242c7d2cffb0bbf45404 (git) Affected: fe832be05a8eee5f1488cbcc2c562dd82d079fd6 , < 4fc78a7c9ca994e1da5d3940704d4e8f0ea8c5e4 (git)
Linux	Linux	Affected: 6.10 Unaffected: 0 , < 6.10 (semver) Unaffected: 6.12.34 , ≤ 6.12.* (semver) Unaffected: 6.15.3 , ≤ 6.15.* (semver) Unaffected: 6.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b8df8cb8f7eef52baa9ac5bf36a405ca67945a91",
              "status": "affected",
              "version": "fe832be05a8eee5f1488cbcc2c562dd82d079fd6",
              "versionType": "git"
            },
            {
              "lessThan": "e018053632bad8ee0752242c7d2cffb0bbf45404",
              "status": "affected",
              "version": "fe832be05a8eee5f1488cbcc2c562dd82d079fd6",
              "versionType": "git"
            },
            {
              "lessThan": "4fc78a7c9ca994e1da5d3940704d4e8f0ea8c5e4",
              "status": "affected",
              "version": "fe832be05a8eee5f1488cbcc2c562dd82d079fd6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Do not trigger WARN_ON() due to a commit_overrun\n\nWhen reading a memory mapped buffer the reader page is just swapped out\nwith the last page written in the write buffer. If the reader page is the\nsame as the commit buffer (the buffer that is currently being written to)\nit was assumed that it should never have missed events. If it does, it\ntriggers a WARN_ON_ONCE().\n\nBut there just happens to be one scenario where this can legitimately\nhappen. That is on a commit_overrun. A commit overrun is when an interrupt\npreempts an event being written to the buffer and then the interrupt adds\nso many new events that it fills and wraps the buffer back to the commit.\nAny new events would then be dropped and be reported as \"missed_events\".\n\nIn this case, the next page to read is the commit buffer and after the\nswap of the reader page, the reader page will be the commit buffer, but\nthis time there will be missed events and this triggers the following\nwarning:\n\n ------------[ cut here ]------------\n WARNING: CPU: 2 PID: 1127 at kernel/trace/ring_buffer.c:7357 ring_buffer_map_get_reader+0x49a/0x780\n Modules linked in: kvm_intel kvm irqbypass\n CPU: 2 UID: 0 PID: 1127 Comm: trace-cmd Not tainted 6.15.0-rc7-test-00004-g478bc2824b45-dirty #564 PREEMPT\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n RIP: 0010:ring_buffer_map_get_reader+0x49a/0x780\n Code: 00 00 00 48 89 fe 48 c1 ee 03 80 3c 2e 00 0f 85 ec 01 00 00 4d 3b a6 a8 00 00 00 0f 85 8a fd ff ff 48 85 c0 0f 84 55 fe ff ff \u003c0f\u003e 0b e9 4e fe ff ff be 08 00 00 00 4c 89 54 24 58 48 89 54 24 50\n RSP: 0018:ffff888121787dc0 EFLAGS: 00010002\n RAX: 00000000000006a2 RBX: ffff888100062800 RCX: ffffffff8190cb49\n RDX: ffff888126934c00 RSI: 1ffff11020200a15 RDI: ffff8881010050a8\n RBP: dffffc0000000000 R08: 0000000000000000 R09: ffffed1024d26982\n R10: ffff888126934c17 R11: ffff8881010050a8 R12: ffff888126934c00\n R13: ffff8881010050b8 R14: ffff888101005000 R15: ffff888126930008\n FS:  00007f95c8cd7540(0000) GS:ffff8882b576e000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f95c8de4dc0 CR3: 0000000128452002 CR4: 0000000000172ef0\n Call Trace:\n  \u003cTASK\u003e\n  ? __pfx_ring_buffer_map_get_reader+0x10/0x10\n  tracing_buffers_ioctl+0x283/0x370\n  __x64_sys_ioctl+0x134/0x190\n  do_syscall_64+0x79/0x1c0\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n RIP: 0033:0x7f95c8de48db\n Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 \u003c89\u003e c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00\n RSP: 002b:00007ffe037ba110 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n RAX: ffffffffffffffda RBX: 00007ffe037bb2b0 RCX: 00007f95c8de48db\n RDX: 0000000000000000 RSI: 0000000000005220 RDI: 0000000000000006\n RBP: 00007ffe037ba180 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n R13: 00007ffe037bb6f8 R14: 00007f95c9065000 R15: 00005575c7492c90\n  \u003c/TASK\u003e\n irq event stamp: 5080\n hardirqs last  enabled at (5079): [\u003cffffffff83e0adb0\u003e] _raw_spin_unlock_irqrestore+0x50/0x70\n hardirqs last disabled at (5080): [\u003cffffffff83e0aa83\u003e] _raw_spin_lock_irqsave+0x63/0x70\n softirqs last  enabled at (4182): [\u003cffffffff81516122\u003e] handle_softirqs+0x552/0x710\n softirqs last disabled at (4159): [\u003cffffffff815163f7\u003e] __irq_exit_rcu+0x107/0x210\n ---[ end trace 0000000000000000 ]---\n\nThe above was triggered by running on a kernel with both lockdep and KASAN\nas well as kmemleak enabled and executing the following command:\n\n # perf record -o perf-test.dat -a -- trace-cmd record --nosplice  -e all -p function hackbench 50\n\nWith perf interjecting a lot of interrupts and trace-cmd enabling all\nevents as well as function tracing, with lockdep, KASAN and kmemleak\nenabled, it could cause an interrupt preempting an event being written to\nadd enough event\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:24:34.104Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b8df8cb8f7eef52baa9ac5bf36a405ca67945a91"
        },
        {
          "url": "https://git.kernel.org/stable/c/e018053632bad8ee0752242c7d2cffb0bbf45404"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fc78a7c9ca994e1da5d3940704d4e8f0ea8c5e4"
        }
      ],
      "title": "ring-buffer: Do not trigger WARN_ON() due to a commit_overrun",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38267",
    "datePublished": "2025-07-10T07:41:50.551Z",
    "dateReserved": "2025-04-16T04:51:23.998Z",
    "dateUpdated": "2026-05-11T21:24:34.104Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-38275 (GCVE-0-2025-38275)

Vulnerability from cvelistv5 – Published: 2025-07-10 07:41 – Updated: 2026-05-23 15:59

Title

phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug

Summary

In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug The qmp_usb_iomap() helper function currently returns the raw result of devm_ioremap() for non-exclusive mappings. Since devm_ioremap() may return a NULL pointer and the caller only checks error pointers with IS_ERR(), NULL could bypass the check and lead to an invalid dereference. Fix the issue by checking if devm_ioremap() returns NULL. When it does, qmp_usb_iomap() now returns an error pointer via IOMEM_ERR_PTR(-ENOMEM), ensuring safe and consistent error handling.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/0b979a409e40457ca…
https://git.kernel.org/stable/c/127dfb4f1c5a2b622…
https://git.kernel.org/stable/c/5072c1749197fc28b…
https://git.kernel.org/stable/c/0c33117f00c8c5363…
https://git.kernel.org/stable/c/d14402a38c2d868ca…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: a5d6b1ac56cbd6b5850a3a54e35f1cb71e8e8cdd , < 0b979a409e40457ca1b5cb48755d1f34eee58805 (git) Affected: a5d6b1ac56cbd6b5850a3a54e35f1cb71e8e8cdd , < 127dfb4f1c5a2b622039c5d203f321380ea36665 (git) Affected: a5d6b1ac56cbd6b5850a3a54e35f1cb71e8e8cdd , < 5072c1749197fc28b27d7efc0d80320d7cac9572 (git) Affected: a5d6b1ac56cbd6b5850a3a54e35f1cb71e8e8cdd , < 0c33117f00c8c5363c22676931b22ae5041f7603 (git) Affected: a5d6b1ac56cbd6b5850a3a54e35f1cb71e8e8cdd , < d14402a38c2d868cacb1facaf9be908ca6558e59 (git) Affected: 368ea32e0ad0335bdf3180067875a928e35387c6 (git) Affected: 5.15.93 , < 5.16 (semver)
Linux	Linux	Affected: 6.1 Unaffected: 0 , < 6.1 (semver) Unaffected: 6.1.142 , ≤ 6.1.* (semver) Unaffected: 6.6.94 , ≤ 6.6.* (semver) Unaffected: 6.12.34 , ≤ 6.12.* (semver) Unaffected: 6.15.3 , ≤ 6.15.* (semver) Unaffected: 6.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:36:09.044Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/phy/qualcomm/phy-qcom-qmp-usb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0b979a409e40457ca1b5cb48755d1f34eee58805",
              "status": "affected",
              "version": "a5d6b1ac56cbd6b5850a3a54e35f1cb71e8e8cdd",
              "versionType": "git"
            },
            {
              "lessThan": "127dfb4f1c5a2b622039c5d203f321380ea36665",
              "status": "affected",
              "version": "a5d6b1ac56cbd6b5850a3a54e35f1cb71e8e8cdd",
              "versionType": "git"
            },
            {
              "lessThan": "5072c1749197fc28b27d7efc0d80320d7cac9572",
              "status": "affected",
              "version": "a5d6b1ac56cbd6b5850a3a54e35f1cb71e8e8cdd",
              "versionType": "git"
            },
            {
              "lessThan": "0c33117f00c8c5363c22676931b22ae5041f7603",
              "status": "affected",
              "version": "a5d6b1ac56cbd6b5850a3a54e35f1cb71e8e8cdd",
              "versionType": "git"
            },
            {
              "lessThan": "d14402a38c2d868cacb1facaf9be908ca6558e59",
              "status": "affected",
              "version": "a5d6b1ac56cbd6b5850a3a54e35f1cb71e8e8cdd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "368ea32e0ad0335bdf3180067875a928e35387c6",
              "versionType": "git"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.93",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/phy/qualcomm/phy-qcom-qmp-usb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.94",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.93",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nphy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug\n\nThe qmp_usb_iomap() helper function currently returns the raw result of\ndevm_ioremap() for non-exclusive mappings. Since devm_ioremap() may return\na NULL pointer and the caller only checks error pointers with IS_ERR(),\nNULL could bypass the check and lead to an invalid dereference.\n\nFix the issue by checking if devm_ioremap() returns NULL. When it does,\nqmp_usb_iomap() now returns an error pointer via IOMEM_ERR_PTR(-ENOMEM),\nensuring safe and consistent error handling."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:59:19.082Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0b979a409e40457ca1b5cb48755d1f34eee58805"
        },
        {
          "url": "https://git.kernel.org/stable/c/127dfb4f1c5a2b622039c5d203f321380ea36665"
        },
        {
          "url": "https://git.kernel.org/stable/c/5072c1749197fc28b27d7efc0d80320d7cac9572"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c33117f00c8c5363c22676931b22ae5041f7603"
        },
        {
          "url": "https://git.kernel.org/stable/c/d14402a38c2d868cacb1facaf9be908ca6558e59"
        }
      ],
      "title": "phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38275",
    "datePublished": "2025-07-10T07:41:55.658Z",
    "dateReserved": "2025-04-16T04:51:23.998Z",
    "dateUpdated": "2026-05-23T15:59:19.082Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-38279 (GCVE-0-2025-38279)

Vulnerability from cvelistv5 – Published: 2025-07-10 07:41 – Updated: 2026-05-23 15:59

Title

bpf: Do not include stack ptr register in precision backtracking bookkeeping

Summary

In the Linux kernel, the following vulnerability has been resolved: bpf: Do not include stack ptr register in precision backtracking bookkeeping Yi Lai reported an issue ([1]) where the following warning appears in kernel dmesg: [ 60.643604] verifier backtracking bug [ 60.643635] WARNING: CPU: 10 PID: 2315 at kernel/bpf/verifier.c:4302 __mark_chain_precision+0x3a6c/0x3e10 [ 60.648428] Modules linked in: bpf_testmod(OE) [ 60.650471] CPU: 10 UID: 0 PID: 2315 Comm: test_progs Tainted: G OE 6.15.0-rc4-gef11287f8289-dirty #327 PREEMPT(full) [ 60.654385] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE [ 60.656682] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 60.660475] RIP: 0010:__mark_chain_precision+0x3a6c/0x3e10 [ 60.662814] Code: 5a 30 84 89 ea e8 c4 d9 01 00 80 3d 3e 7d d8 04 00 0f 85 60 fa ff ff c6 05 31 7d d8 04 01 48 c7 c7 00 58 30 84 e8 c4 06 a5 ff <0f> 0b e9 46 fa ff ff 48 ... [ 60.668720] RSP: 0018:ffff888116cc7298 EFLAGS: 00010246 [ 60.671075] RAX: 54d70e82dfd31900 RBX: ffff888115b65e20 RCX: 0000000000000000 [ 60.673659] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 00000000ffffffff [ 60.676241] RBP: 0000000000000400 R08: ffff8881f6f23bd3 R09: 1ffff1103ede477a [ 60.678787] R10: dffffc0000000000 R11: ffffed103ede477b R12: ffff888115b60ae8 [ 60.681420] R13: 1ffff11022b6cbc4 R14: 00000000fffffff2 R15: 0000000000000001 [ 60.684030] FS: 00007fc2aedd80c0(0000) GS:ffff88826fa8a000(0000) knlGS:0000000000000000 [ 60.686837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 60.689027] CR2: 000056325369e000 CR3: 000000011088b002 CR4: 0000000000370ef0 [ 60.691623] Call Trace: [ 60.692821] <TASK> [ 60.693960] ? __pfx_verbose+0x10/0x10 [ 60.695656] ? __pfx_disasm_kfunc_name+0x10/0x10 [ 60.697495] check_cond_jmp_op+0x16f7/0x39b0 [ 60.699237] do_check+0x58fa/0xab10 ... Further analysis shows the warning is at line 4302 as below: 4294 /* static subprog call instruction, which 4295 * means that we are exiting current subprog, 4296 * so only r1-r5 could be still requested as 4297 * precise, r0 and r6-r10 or any stack slot in 4298 * the current frame should be zero by now 4299 */ 4300 if (bt_reg_mask(bt) & ~BPF_REGMASK_ARGS) { 4301 verbose(env, "BUG regs %x\n", bt_reg_mask(bt)); 4302 WARN_ONCE(1, "verifier backtracking bug"); 4303 return -EFAULT; 4304 } With the below test (also in the next patch): __used __naked static void __bpf_jmp_r10(void) { asm volatile ( "r2 = 2314885393468386424 ll;" "goto +0;" "if r2 <= r10 goto +3;" "if r1 >= -1835016 goto +0;" "if r2 <= 8 goto +0;" "if r3 <= 0 goto +0;" "exit;" ::: __clobber_all); } SEC("?raw_tp") __naked void bpf_jmp_r10(void) { asm volatile ( "r3 = 0 ll;" "call __bpf_jmp_r10;" "r0 = 0;" "exit;" ::: __clobber_all); } The following is the verifier failure log: 0: (18) r3 = 0x0 ; R3_w=0 2: (85) call pc+2 caller: R10=fp0 callee: frame1: R1=ctx() R3_w=0 R10=fp0 5: frame1: R1=ctx() R3_w=0 R10=fp0 ; asm volatile (" \ @ verifier_precision.c:184 5: (18) r2 = 0x20202000256c6c78 ; frame1: R2_w=0x20202000256c6c78 7: (05) goto pc+0 8: (bd) if r2 <= r10 goto pc+3 ; frame1: R2_w=0x20202000256c6c78 R10=fp0 9: (35) if r1 >= 0xffe3fff8 goto pc+0 ; frame1: R1=ctx() 10: (b5) if r2 <= 0x8 goto pc+0 mark_precise: frame1: last_idx 10 first_idx 0 subseq_idx -1 mark_precise: frame1: regs=r2 stack= before 9: (35) if r1 >= 0xffe3fff8 goto pc+0 mark_precise: frame1: regs=r2 stack= before 8: (bd) if r2 <= r10 goto pc+3 mark_preci ---truncated---

Severity

No CVSS data available.

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/4265682c29c92f52c…
https://git.kernel.org/stable/c/ac49b7560b4b08b1e…
https://git.kernel.org/stable/c/e2d2115e56c4a0237…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 407958a0e980b9e1842ab87b5a1040521e1e24e9 , < 4265682c29c92f52c0da6fad5a79b5801462c8de (git) Affected: 407958a0e980b9e1842ab87b5a1040521e1e24e9 , < ac49b7560b4b08b1e4043a29214cc7ad77644c00 (git) Affected: 407958a0e980b9e1842ab87b5a1040521e1e24e9 , < e2d2115e56c4a02377189bfc3a9a7933552a7b0f (git) Affected: fc2778c42f99c7de52fc004157b3c3ee4dcc208a (git) Affected: 6.4.4 , < 6.5 (semver)
Linux	Linux	Affected: 6.5 Unaffected: 0 , < 6.5 (semver) Unaffected: 6.12.37 , ≤ 6.12.* (semver) Unaffected: 6.15.3 , ≤ 6.15.* (semver) Unaffected: 6.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf_verifier.h",
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4265682c29c92f52c0da6fad5a79b5801462c8de",
              "status": "affected",
              "version": "407958a0e980b9e1842ab87b5a1040521e1e24e9",
              "versionType": "git"
            },
            {
              "lessThan": "ac49b7560b4b08b1e4043a29214cc7ad77644c00",
              "status": "affected",
              "version": "407958a0e980b9e1842ab87b5a1040521e1e24e9",
              "versionType": "git"
            },
            {
              "lessThan": "e2d2115e56c4a02377189bfc3a9a7933552a7b0f",
              "status": "affected",
              "version": "407958a0e980b9e1842ab87b5a1040521e1e24e9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fc2778c42f99c7de52fc004157b3c3ee4dcc208a",
              "versionType": "git"
            },
            {
              "lessThan": "6.5",
              "status": "affected",
              "version": "6.4.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf_verifier.h",
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Do not include stack ptr register in precision backtracking bookkeeping\n\nYi Lai reported an issue ([1]) where the following warning appears\nin kernel dmesg:\n  [   60.643604] verifier backtracking bug\n  [   60.643635] WARNING: CPU: 10 PID: 2315 at kernel/bpf/verifier.c:4302 __mark_chain_precision+0x3a6c/0x3e10\n  [   60.648428] Modules linked in: bpf_testmod(OE)\n  [   60.650471] CPU: 10 UID: 0 PID: 2315 Comm: test_progs Tainted: G           OE       6.15.0-rc4-gef11287f8289-dirty #327 PREEMPT(full)\n  [   60.654385] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n  [   60.656682] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n  [   60.660475] RIP: 0010:__mark_chain_precision+0x3a6c/0x3e10\n  [   60.662814] Code: 5a 30 84 89 ea e8 c4 d9 01 00 80 3d 3e 7d d8 04 00 0f 85 60 fa ff ff c6 05 31 7d d8 04\n                       01 48 c7 c7 00 58 30 84 e8 c4 06 a5 ff \u003c0f\u003e 0b e9 46 fa ff ff 48 ...\n  [   60.668720] RSP: 0018:ffff888116cc7298 EFLAGS: 00010246\n  [   60.671075] RAX: 54d70e82dfd31900 RBX: ffff888115b65e20 RCX: 0000000000000000\n  [   60.673659] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 00000000ffffffff\n  [   60.676241] RBP: 0000000000000400 R08: ffff8881f6f23bd3 R09: 1ffff1103ede477a\n  [   60.678787] R10: dffffc0000000000 R11: ffffed103ede477b R12: ffff888115b60ae8\n  [   60.681420] R13: 1ffff11022b6cbc4 R14: 00000000fffffff2 R15: 0000000000000001\n  [   60.684030] FS:  00007fc2aedd80c0(0000) GS:ffff88826fa8a000(0000) knlGS:0000000000000000\n  [   60.686837] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [   60.689027] CR2: 000056325369e000 CR3: 000000011088b002 CR4: 0000000000370ef0\n  [   60.691623] Call Trace:\n  [   60.692821]  \u003cTASK\u003e\n  [   60.693960]  ? __pfx_verbose+0x10/0x10\n  [   60.695656]  ? __pfx_disasm_kfunc_name+0x10/0x10\n  [   60.697495]  check_cond_jmp_op+0x16f7/0x39b0\n  [   60.699237]  do_check+0x58fa/0xab10\n  ...\n\nFurther analysis shows the warning is at line 4302 as below:\n\n  4294                 /* static subprog call instruction, which\n  4295                  * means that we are exiting current subprog,\n  4296                  * so only r1-r5 could be still requested as\n  4297                  * precise, r0 and r6-r10 or any stack slot in\n  4298                  * the current frame should be zero by now\n  4299                  */\n  4300                 if (bt_reg_mask(bt) \u0026 ~BPF_REGMASK_ARGS) {\n  4301                         verbose(env, \"BUG regs %x\\n\", bt_reg_mask(bt));\n  4302                         WARN_ONCE(1, \"verifier backtracking bug\");\n  4303                         return -EFAULT;\n  4304                 }\n\nWith the below test (also in the next patch):\n  __used __naked static void __bpf_jmp_r10(void)\n  {\n\tasm volatile (\n\t\"r2 = 2314885393468386424 ll;\"\n\t\"goto +0;\"\n\t\"if r2 \u003c= r10 goto +3;\"\n\t\"if r1 \u003e= -1835016 goto +0;\"\n\t\"if r2 \u003c= 8 goto +0;\"\n\t\"if r3 \u003c= 0 goto +0;\"\n\t\"exit;\"\n\t::: __clobber_all);\n  }\n\n  SEC(\"?raw_tp\")\n  __naked void bpf_jmp_r10(void)\n  {\n\tasm volatile (\n\t\"r3 = 0 ll;\"\n\t\"call __bpf_jmp_r10;\"\n\t\"r0 = 0;\"\n\t\"exit;\"\n\t::: __clobber_all);\n  }\n\nThe following is the verifier failure log:\n  0: (18) r3 = 0x0                      ; R3_w=0\n  2: (85) call pc+2\n  caller:\n   R10=fp0\n  callee:\n   frame1: R1=ctx() R3_w=0 R10=fp0\n  5: frame1: R1=ctx() R3_w=0 R10=fp0\n  ; asm volatile (\"                                 \\ @ verifier_precision.c:184\n  5: (18) r2 = 0x20202000256c6c78       ; frame1: R2_w=0x20202000256c6c78\n  7: (05) goto pc+0\n  8: (bd) if r2 \u003c= r10 goto pc+3        ; frame1: R2_w=0x20202000256c6c78 R10=fp0\n  9: (35) if r1 \u003e= 0xffe3fff8 goto pc+0         ; frame1: R1=ctx()\n  10: (b5) if r2 \u003c= 0x8 goto pc+0\n  mark_precise: frame1: last_idx 10 first_idx 0 subseq_idx -1\n  mark_precise: frame1: regs=r2 stack= before 9: (35) if r1 \u003e= 0xffe3fff8 goto pc+0\n  mark_precise: frame1: regs=r2 stack= before 8: (bd) if r2 \u003c= r10 goto pc+3\n  mark_preci\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:59:20.262Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4265682c29c92f52c0da6fad5a79b5801462c8de"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac49b7560b4b08b1e4043a29214cc7ad77644c00"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2d2115e56c4a02377189bfc3a9a7933552a7b0f"
        }
      ],
      "title": "bpf: Do not include stack ptr register in precision backtracking bookkeeping",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38279",
    "datePublished": "2025-07-10T07:41:58.184Z",
    "dateReserved": "2025-04-16T04:51:23.998Z",
    "dateUpdated": "2026-05-23T15:59:20.262Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

ALSA-2026:18134

CVE-2024-56633 (GCVE-0-2024-56633)

CVE-2025-21839 (GCVE-0-2025-21839)

CVE-2025-37980 (GCVE-0-2025-37980)

CVE-2025-38015 (GCVE-0-2025-38015)

CVE-2025-38097 (GCVE-0-2025-38097)

CVE-2025-38166 (GCVE-0-2025-38166)

CVE-2025-38202 (GCVE-0-2025-38202)

CVE-2025-38267 (GCVE-0-2025-38267)

CVE-2025-38275 (GCVE-0-2025-38275)

CVE-2025-38279 (GCVE-0-2025-38279)

Tags

Sightings

Nomenclature

Related by attack behaviour