Vulnerability-Lookup

RHSA-2025:22854

Vulnerability from csaf_redhat - Published: 2025-12-09 08:51 - Updated: 2026-07-30 08:52

Summary

Red Hat Security Advisory: kernel security update

Severity

Moderate

Notes

Topic: An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: cifs: Fix oops due to uninitialised variable (CVE-2025-38737) * kernel: can: j1939: implement NETDEV_UNREGISTER notification handler (CVE-2025-39925) * kernel: Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (CVE-2025-39982) * kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981) * kernel: net/mlx5: fs, fix UAF in flow counter release (CVE-2025-39979) * kernel: Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue (CVE-2025-39983) * kernel: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (CVE-2025-40047) * kernel: iommu/vt-d: Disallow dirty tracking if incoherent page walk (CVE-2025-40058) * kernel: ice: ice_adapter: release xa entry on adapter allocation failure (CVE-2025-40185) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2025-38737

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix oops due to uninitialised variable Fix smb3_init_transform_rq() to initialise buffer to NULL before calling netfs_alloc_folioq_buffer() as netfs assumes it can append to the buffer it is given. Setting it to NULL means it should start a fresh buffer, but the value is currently undefined.

6.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H

CWE-908 - Use of Uninitialized Resource

Affected products

Fixed 309 products

Product	Version	Remediation
Unresolved product id: AppStream-10.1.Z:kernel-64k-debug-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-64k-debug-devel-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-64k-debug-devel-matched-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-64k-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-64k-devel-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-64k-devel-matched-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-debug-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-debug-debuginfo-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-debug-debuginfo-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-debug-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-debug-devel-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-debug-devel-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-debug-devel-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-debug-devel-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-debug-devel-matched-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-debug-devel-matched-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-debug-devel-matched-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-debug-devel-matched-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-debuginfo-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-debuginfo-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-debuginfo-common-aarch64-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-debuginfo-common-ppc64le-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-debuginfo-common-s390x-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-debuginfo-common-x86_64-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-devel-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-devel-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-devel-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-devel-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-devel-matched-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-devel-matched-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-devel-matched-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-devel-matched-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-doc-0:6.12.0-124.20.1.el10_1.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-rt-64k-debug-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-rt-64k-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-rt-debug-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-rt-debug-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-rt-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-rt-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-tools-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-tools-debuginfo-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-tools-debuginfo-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-tools-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-zfcpdump-debuginfo-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-zfcpdump-devel-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:kernel-zfcpdump-devel-matched-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:libperf-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:libperf-debuginfo-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:libperf-debuginfo-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:libperf-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:perf-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:perf-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:perf-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:perf-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:perf-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:perf-debuginfo-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:perf-debuginfo-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:perf-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:python3-perf-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:python3-perf-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:python3-perf-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:python3-perf-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:python3-perf-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:python3-perf-debuginfo-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:python3-perf-debuginfo-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:python3-perf-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:rtla-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:rtla-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:rtla-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:rtla-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:rv-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:rv-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:rv-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-10.1.Z:rv-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-0:6.12.0-124.20.1.el10_1.src	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-64k-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-64k-core-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-64k-debug-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-64k-debug-core-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-64k-debug-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-64k-debug-modules-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-64k-debug-modules-core-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-64k-debug-modules-extra-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-64k-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-64k-modules-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-64k-modules-core-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-64k-modules-extra-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-abi-stablelists-0:6.12.0-124.20.1.el10_1.noarch	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-core-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-core-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-core-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-core-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-core-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-core-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-core-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-core-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-debuginfo-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-debuginfo-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-modules-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-modules-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-modules-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-modules-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-modules-core-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-modules-core-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-modules-core-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-modules-core-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-modules-extra-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-modules-extra-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-modules-extra-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-modules-extra-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debug-uki-virt-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debuginfo-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debuginfo-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debuginfo-common-aarch64-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debuginfo-common-ppc64le-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debuginfo-common-s390x-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-debuginfo-common-x86_64-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-modules-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-modules-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-modules-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-modules-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-modules-core-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-modules-core-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-modules-core-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-modules-core-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-modules-extra-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-modules-extra-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-modules-extra-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-modules-extra-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-modules-extra-matched-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-modules-extra-matched-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-modules-extra-matched-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-modules-extra-matched-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-rt-64k-debug-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-rt-64k-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-rt-debug-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-rt-debug-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-rt-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-rt-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-tools-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-tools-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-tools-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-tools-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-tools-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-tools-debuginfo-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-tools-debuginfo-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-tools-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-tools-libs-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-tools-libs-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-tools-libs-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-uki-virt-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-uki-virt-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-uki-virt-addons-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-uki-virt-addons-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-zfcpdump-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-zfcpdump-core-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-zfcpdump-debuginfo-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-zfcpdump-modules-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-zfcpdump-modules-core-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:kernel-zfcpdump-modules-extra-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:libperf-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:libperf-debuginfo-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:libperf-debuginfo-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:libperf-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:perf-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:perf-debuginfo-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:perf-debuginfo-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:perf-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:python3-perf-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:python3-perf-debuginfo-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:python3-perf-debuginfo-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-10.1.Z:python3-perf-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-64k-debug-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-64k-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-debug-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-debug-debuginfo-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-debug-debuginfo-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-debug-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-debuginfo-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-debuginfo-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-debuginfo-common-aarch64-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-debuginfo-common-ppc64le-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-debuginfo-common-s390x-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-debuginfo-common-x86_64-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-rt-64k-debug-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-rt-64k-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-rt-debug-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-rt-debug-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-rt-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-rt-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-tools-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-tools-debuginfo-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-tools-debuginfo-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-tools-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-tools-libs-devel-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-tools-libs-devel-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-tools-libs-devel-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:kernel-zfcpdump-debuginfo-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:libperf-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:libperf-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:libperf-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:libperf-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:libperf-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:libperf-debuginfo-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:libperf-debuginfo-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:libperf-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:perf-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:perf-debuginfo-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:perf-debuginfo-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:perf-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:python3-perf-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:python3-perf-debuginfo-0:6.12.0-124.20.1.el10_1.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:python3-perf-debuginfo-0:6.12.0-124.20.1.el10_1.s390x	—	Vendor Fix fix
Unresolved product id: CRB-10.1.Z:python3-perf-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.1.Z:kernel-debug-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.1.Z:kernel-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.1.Z:kernel-debuginfo-common-x86_64-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.1.Z:kernel-rt-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.1.Z:kernel-rt-core-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.1.Z:kernel-rt-debug-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.1.Z:kernel-rt-debug-core-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.1.Z:kernel-rt-debug-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.1.Z:kernel-rt-debug-devel-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.1.Z:kernel-rt-debug-modules-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.1.Z:kernel-rt-debug-modules-core-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.1.Z:kernel-rt-debug-modules-extra-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.1.Z:kernel-rt-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.1.Z:kernel-rt-devel-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.1.Z:kernel-rt-modules-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.1.Z:kernel-rt-modules-core-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.1.Z:kernel-rt-modules-extra-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.1.Z:kernel-tools-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.1.Z:libperf-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.1.Z:perf-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-10.1.Z:python3-perf-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-64k-debug-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-64k-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-debug-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-debug-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-debuginfo-common-aarch64-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-debuginfo-common-x86_64-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-64k-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-64k-core-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-64k-debug-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-64k-debug-core-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-64k-debug-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-64k-debug-devel-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-64k-debug-modules-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-64k-debug-modules-core-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-64k-debug-modules-extra-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-64k-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-64k-devel-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-64k-modules-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-64k-modules-core-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-64k-modules-extra-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-core-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-core-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-debug-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-debug-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-debug-core-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-debug-core-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-debug-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-debug-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-debug-devel-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-debug-devel-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-debug-modules-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-debug-modules-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-debug-modules-core-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-debug-modules-core-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-debug-modules-extra-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-debug-modules-extra-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-devel-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-devel-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-modules-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-modules-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-modules-core-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-modules-core-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-modules-extra-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-rt-modules-extra-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-tools-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:kernel-tools-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:libperf-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:libperf-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:perf-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:perf-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:python3-perf-debuginfo-0:6.12.0-124.20.1.el10_1.aarch64	—	Vendor Fix fix
Unresolved product id: RT-10.1.Z:python3-perf-debuginfo-0:6.12.0-124.20.1.el10_1.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2025-39925

A flaw was discovered in the J1939 protocol implementation in the Linux kernel. The NETDEV_UNREGISTER notification handler was missing for undoing changes performed by j1939_sk_bind(). As a result, an extra reference remains on the j1939_priv structure when unregistering a network device, preventing its usage count from dropping and thus blocking the unregister_netdevice() call

4.9 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE-911 - Improper Update of Reference Count

Affected products

Fixed 309 products, the same list as for CVE-2025-38737

Threats

Impact Moderate

CVE-2025-39979

A use-after-free flaw was discovered in the Linux kernel’s mlx5 (Net/MLX5) subsystem: within the function mlx5_cmd_hws_delete_fte() the HWS action reference count and mutex for a local flow counter were not initialized, meaning the flow-counter structure could already be freed while deleting the rule. This may lead to memory corruption or kernel instability.

7.6 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

CWE-911 - Improper Update of Reference Count

Affected products

Fixed 309 products, the same list as for CVE-2025-38737

Threats

Impact Moderate

CVE-2025-39981

A flaw was found in the Linux kernel’s Bluetooth management subsystem (net/bluetooth/mgmt*.c). The mgmt_pending structure may be freed while still being processed, or remain on the pending command list, which allows a use-after-free or double-free scenario. An attacker with local access to the system and the ability to interact with the Bluetooth subsystem could exploit this to trigger memory corruption, potentially leading to elevated privileges or denial of service.

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 309 products, the same list as for CVE-2025-38737

Threats

Impact Moderate

CVE-2025-39982

A flaw was found in the Linux kernel’s Bluetooth subsystem (HCI). Specifically, in the function hci_acl_create_conn_sync() (and related path hci_le_create_conn_sync()), a connection object in state BT_OPEN that is still pending command submission may be freed prematurely, leading to a use-after-free condition. An attacker with network privileges could exploit this to trigger memory corruption, a denial of service, or a potential escalation of privileges.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 309 products, the same list as for CVE-2025-38737

Threats

Impact Moderate

CVE-2025-39983

A flaw was discovered in the Bluetooth subsystem of the Linux kernel. When processing a HCI_EV_NUM_COMP_PKTS event, the function hci_conn_tx_dequeue() did not properly hold or release the hdev device lock, which may lead to a use-after-free of the connection structure.

6.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

CWE-416 - Use After Free

Affected products

Fixed 309 products, the same list as for CVE-2025-38737

Threats

Impact Moderate

CVE-2025-40047

A flaw use after free in the Linux kernel IO_URING subsystem was found in the way local user uses io_uring interface (using IORING_OP_WAITID). A local user could use this flaw to crash the system or potentially escalate their privileges on the system.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-662 - Improper Synchronization

Affected products

Fixed 309 products, the same list as for CVE-2025-38737

Threats

Impact Moderate

CVE-2025-40058

A flaw was found in the Intel VT-d IOMMU support in the Linux kernel. When an IOMMU is configured to perform dirty-page tracking, but the page-walk memory region is incoherent between the IOMMU and CPU, the hardware may attempt to atomically update the bits in a paging-structure entry that is not properly snooped. The resulting fault could lead to a system hang and a non-recoverable state.

5.3 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Affected products

Fixed 309 products, the same list as for CVE-2025-38737

Threats

Impact Moderate

CVE-2025-40185

A NULL pointer dereference exists in the Linux kernel such that (ice: ice_adapter) fails to release a reserved XArray entry when ice_adapter_new() fails. As a result, subsequent insertions at the same index may return -EBUSY, which can lead to damage to system availability, integrity, and confidentiality.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 309 products, the same list as for CVE-2025-38737

Threats

Impact Moderate

References

57 references

URL	Category
https://access.redhat.com/errata/RHSA-2025:22854	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2393527	external
https://bugzilla.redhat.com/show_bug.cgi?id=2400629	external
https://bugzilla.redhat.com/show_bug.cgi?id=2404100	external
https://bugzilla.redhat.com/show_bug.cgi?id=2404105	external
https://bugzilla.redhat.com/show_bug.cgi?id=2404109	external
https://bugzilla.redhat.com/show_bug.cgi?id=2404117	external
https://bugzilla.redhat.com/show_bug.cgi?id=2406758	external
https://bugzilla.redhat.com/show_bug.cgi?id=2406776	external
https://bugzilla.redhat.com/show_bug.cgi?id=2414741	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2025-38737	self
https://bugzilla.redhat.com/show_bug.cgi?id=2393527	external
https://www.cve.org/CVERecord?id=CVE-2025-38737	external
https://nvd.nist.gov/vuln/detail/CVE-2025-38737	external
https://lore.kernel.org/linux-cve-announce/202509…	external
https://access.redhat.com/security/cve/CVE-2025-39925	self
https://bugzilla.redhat.com/show_bug.cgi?id=2400629	external
https://www.cve.org/CVERecord?id=CVE-2025-39925	external
https://nvd.nist.gov/vuln/detail/CVE-2025-39925	external
https://lore.kernel.org/linux-cve-announce/202510…	external
https://access.redhat.com/security/cve/CVE-2025-39979	self
https://bugzilla.redhat.com/show_bug.cgi?id=2404109	external
https://www.cve.org/CVERecord?id=CVE-2025-39979	external
https://nvd.nist.gov/vuln/detail/CVE-2025-39979	external
https://lore.kernel.org/linux-cve-announce/202510…	external
https://access.redhat.com/security/cve/CVE-2025-39981	self
https://bugzilla.redhat.com/show_bug.cgi?id=2404105	external
https://www.cve.org/CVERecord?id=CVE-2025-39981	external
https://nvd.nist.gov/vuln/detail/CVE-2025-39981	external
https://lore.kernel.org/linux-cve-announce/202510…	external
https://access.redhat.com/security/cve/CVE-2025-39982	self
https://bugzilla.redhat.com/show_bug.cgi?id=2404100	external
https://www.cve.org/CVERecord?id=CVE-2025-39982	external
https://nvd.nist.gov/vuln/detail/CVE-2025-39982	external
https://lore.kernel.org/linux-cve-announce/202510…	external
https://access.redhat.com/security/cve/CVE-2025-39983	self
https://bugzilla.redhat.com/show_bug.cgi?id=2404117	external
https://www.cve.org/CVERecord?id=CVE-2025-39983	external
https://nvd.nist.gov/vuln/detail/CVE-2025-39983	external
https://lore.kernel.org/linux-cve-announce/202510…	external
https://access.redhat.com/security/cve/CVE-2025-40047	self
https://bugzilla.redhat.com/show_bug.cgi?id=2406758	external
https://www.cve.org/CVERecord?id=CVE-2025-40047	external
https://nvd.nist.gov/vuln/detail/CVE-2025-40047	external
https://lore.kernel.org/linux-cve-announce/202510…	external
https://access.redhat.com/security/cve/CVE-2025-40058	self
https://bugzilla.redhat.com/show_bug.cgi?id=2406776	external
https://www.cve.org/CVERecord?id=CVE-2025-40058	external
https://nvd.nist.gov/vuln/detail/CVE-2025-40058	external
https://lore.kernel.org/linux-cve-announce/202510…	external
https://access.redhat.com/security/cve/CVE-2025-40185	self
https://bugzilla.redhat.com/show_bug.cgi?id=2414741	external
https://www.cve.org/CVERecord?id=CVE-2025-40185	external
https://nvd.nist.gov/vuln/detail/CVE-2025-40185	external
https://lore.kernel.org/linux-cve-announce/202511…	external

JSON

To clipboard

Loading 1.1 MB of JSON…

BDU:2026-03910 (CVE-2025-39983)

Vulnerability from fstec – Published: 2026-03-26 – Updated: 2026-03-26 – View on bdu.fstec.ru Fixed

Title

Уязвимость функции hci_num_comp_pkts_evt() модуля net/bluetooth/hci_event.c подсистемы Bluetooth ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Summary

Уязвимость функции hci_num_comp_pkts_evt() модуля net/bluetooth/hci_event.c подсистемы Bluetooth ядра операционной системы Linux связана с повторным использованием ранее освобожденной памяти. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Severity

6.0 (Medium) CVSS 2.0


                      
                        AV:L/AC:H/Au:S/C:C/I:C/A:C

7.0 (High) CVSS 3.1


                      
                        CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Data structure manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-416 - Использование после освобождения

Aliases

CVE-2025-39983, RHSA-2025:21469, RHSA-2025:22854, RHSA-2026:0271, RHSA-2026:0457

References

5 references

URL
https://www.cve.org/CVERecord?id=CVE-2025-39983
https://git.kernel.org/stable/c/dde33124f17cf3bab4dc5e18d1b4dee128361061
https://git.kernel.org/linus/2e128683176a56459cef8705fc7c35f438f88abd
https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.10
https://access.redhat.com/security/cve/cve-2025-39983

Impacted products

2 products from 3 vendors

Vendors

Red Hat, Inc., Сообщество свободного программного обеспечения

Products

Red Hat Enterprise Linux, Linux

Versions

9 (Red Hat Enterprise Linux), 10 (Red Hat Enterprise Linux), 9.6 Extended Update Support (Red Hat Enterprise Linux), 10.0 Extended Update Support (Red Hat Enterprise Linux), от 6.15 до 6.16.9 включительно (Linux)

Product types

Operating system

Platforms

Red Hat, Inc. Red Hat Enterprise Linux 9, Inc. Red Hat Enterprise Linux 10, Inc. Red Hat Enterprise Linux 9.6 Extended Update Support, Inc. Red Hat Enterprise Linux 10.0 Extended Update Support, Сообщество свободного программного обеспечения Linux от 6.15 до 6.16.9 включительно

Mitigations

В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года. Использование рекомендаций: Для Linux: https://git.kernel.org/stable/c/dde33124f17cf3bab4dc5e18d1b4dee128361061 https://git.kernel.org/linus/2e128683176a56459cef8705fc7c35f438f88abd Для программных продуктов Red Hat Inc.: https://access.redhat.com/security/cve/cve-2025-39983

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:H/Au:S/C:C/I:C/A:C",
  "CVSS 3.0": "AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Red Hat, Inc., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "9 (Red Hat Enterprise Linux), 10 (Red Hat Enterprise Linux), 9.6 Extended Update Support (Red Hat Enterprise Linux), 10.0 Extended Update Support (Red Hat Enterprise Linux), \u043e\u0442 6.15 \u0434\u043e 6.16.9 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0412 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \"\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c LINUX\", \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043c\u0435\u0442\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435 \u0424\u0421\u0422\u042d\u041a \u0420\u043e\u0441\u0441\u0438\u0438, \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u043c 25 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Linux:\nhttps://git.kernel.org/stable/c/dde33124f17cf3bab4dc5e18d1b4dee128361061\nhttps://git.kernel.org/linus/2e128683176a56459cef8705fc7c35f438f88abd\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\nhttps://access.redhat.com/security/cve/cve-2025-39983",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "20.09.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "26.03.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "26.03.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-03910",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-39983, RHSA-2025:21469, RHSA-2025:22854, RHSA-2026:0271, RHSA-2026:0457",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Red Hat Enterprise Linux, Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Red Hat, Inc. Red Hat Enterprise Linux 9 , Red Hat, Inc. Red Hat Enterprise Linux 10 , Red Hat, Inc. Red Hat Enterprise Linux 9.6 Extended Update Support , Red Hat, Inc. Red Hat Enterprise Linux 10.0 Extended Update Support , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.15 \u0434\u043e 6.16.9 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 hci_num_comp_pkts_evt() \u043c\u043e\u0434\u0443\u043b\u044f net/bluetooth/hci_event.c \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b Bluetooth \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0441\u043b\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f (CWE-416)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 hci_num_comp_pkts_evt() \u043c\u043e\u0434\u0443\u043b\u044f net/bluetooth/hci_event.c \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b Bluetooth \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u044b\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0440\u0430\u043d\u0435\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.cve.org/CVERecord?id=CVE-2025-39983\nhttps://git.kernel.org/stable/c/dde33124f17cf3bab4dc5e18d1b4dee128361061\nhttps://git.kernel.org/linus/2e128683176a56459cef8705fc7c35f438f88abd\nhttps://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.10\nhttps://access.redhat.com/security/cve/cve-2025-39983",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-416",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7)"
}

CVE-2025-38737 (GCVE-0-2025-38737)

Vulnerability from cvelistv5 – Published: 2025-09-05 17:20 – Updated: 2026-08-05 12:04

Title

cifs: Fix oops due to uninitialised variable

Summary

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/4931fe2dbe1cc0e7d…
https://git.kernel.org/stable/c/6adaa9fae36f848af…
https://git.kernel.org/stable/c/453a6d2a68e54a483…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: a2906d3316fc19bf0ade84618bb73eab604c447e , < 4931fe2dbe1cc0e7d350a4b51b0b330e43971d98 (git) Affected: a2906d3316fc19bf0ade84618bb73eab604c447e , < 6adaa9fae36f848afa7278945d725e197e33c496 (git) Affected: a2906d3316fc19bf0ade84618bb73eab604c447e , < 453a6d2a68e54a483d67233c6e1e24c4095ee4be (git)
Linux	Linux	Affected: 6.12 Unaffected: 0 , < 6.12 (semver) Unaffected: 6.12.44 , ≤ 6.12.* (semver) Unaffected: 6.16.4 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4931fe2dbe1cc0e7d350a4b51b0b330e43971d98",
              "status": "affected",
              "version": "a2906d3316fc19bf0ade84618bb73eab604c447e",
              "versionType": "git"
            },
            {
              "lessThan": "6adaa9fae36f848afa7278945d725e197e33c496",
              "status": "affected",
              "version": "a2906d3316fc19bf0ade84618bb73eab604c447e",
              "versionType": "git"
            },
            {
              "lessThan": "453a6d2a68e54a483d67233c6e1e24c4095ee4be",
              "status": "affected",
              "version": "a2906d3316fc19bf0ade84618bb73eab604c447e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.44",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix oops due to uninitialised variable\n\nFix smb3_init_transform_rq() to initialise buffer to NULL before calling\nnetfs_alloc_folioq_buffer() as netfs assumes it can append to the buffer it\nis given.  Setting it to NULL means it should start a fresh buffer, but the\nvalue is currently undefined."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable path is the SMB3 client transport-encryption routine, and whether it is entered is dictated by server-supplied SESSION_SETUP/TREE_CONNECT flags (SMB2_SESSION_FLAG_ENCRYPT_DATA / SHI1005_FLAGS_ENCRYPT_DATA), so a remote or MITM SMB server across the network selects the vulnerable path and receives the leaked plaintext of the corrupted buffer.\nAC:L - Once encryption is negotiated, every write with a payload runs the uninitialised pointer through netfs_alloc_folioq_buffer(); the stack slot is reachable and groomable via ordinary syscall sequences on the writing task\u0027s kernel stack, with no condition outside the attacker\u0027s influence.\nPR:N - The remote SMB server presents no credentials to the client and needs none to set the encryption flags that gate the path; on the local side, any user holding a normal write handle to the mounted share triggers it with no elevated privileges.\nUI:N - An already-mounted share reaches the path through routine writeback and automatic reconnect (which re-runs session setup and tree connect), so no victim action beyond normal use of an existing mount is required.\nS:U - The wild reads, writes and bogus folio_put()s all occur within the kernel\u0027s own memory and the same security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - Because *_buffer is never reassigned, the garbage folio_queue is used as the ITER_SOURCE for crypt_message(), so arbitrary kernel memory pointed to by the stale chain is encrypted and sent to the remote peer, and freeing the chain yields further use-after-free read primitives.\nI:H - netfs_alloc_folioq_buffer() writes through the garbage pointer (tail-\u003enext = p, p-\u003eprev = tail, folioq_append_mark()), and cifs_copy_iter_to_folioq() then copies attacker-supplied write() data into folios derived from that chain, giving a content-controlled kernel write suitable for control-flow hijacking.\nA:H - The commit is titled \"Fix oops due to uninitialised variable\" \u2014 dereferencing the indeterminate pointer oopses the kernel, and the resulting folio_queue/folio refcount corruption and bogus frees cause further panics."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:04:26.998Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4931fe2dbe1cc0e7d350a4b51b0b330e43971d98"
        },
        {
          "url": "https://git.kernel.org/stable/c/6adaa9fae36f848afa7278945d725e197e33c496"
        },
        {
          "url": "https://git.kernel.org/stable/c/453a6d2a68e54a483d67233c6e1e24c4095ee4be"
        }
      ],
      "title": "cifs: Fix oops due to uninitialised variable",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38737",
    "datePublished": "2025-09-05T17:20:37.719Z",
    "dateReserved": "2025-04-16T04:51:24.034Z",
    "dateUpdated": "2026-08-05T12:04:26.998Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-39925 (GCVE-0-2025-39925)

Vulnerability from cvelistv5 – Published: 2025-10-01 08:07 – Updated: 2026-09-02 12:49

Title

can: j1939: implement NETDEV_UNREGISTER notification handler

Summary

In the Linux kernel, the following vulnerability has been resolved: can: j1939: implement NETDEV_UNREGISTER notification handler syzbot is reporting unregister_netdevice: waiting for vcan0 to become free. Usage count = 2 problem, for j1939 protocol did not have NETDEV_UNREGISTER notification handler for undoing changes made by j1939_sk_bind(). Commit 25fe97cb7620 ("can: j1939: move j1939_priv_put() into sk_destruct callback") expects that a call to j1939_priv_put() can be unconditionally delayed until j1939_sk_sock_destruct() is called. But we need to call j1939_priv_put() against an extra ref held by j1939_sk_bind() call (as a part of undoing changes made by j1939_sk_bind()) as soon as NETDEV_UNREGISTER notification fires (i.e. before j1939_sk_sock_destruct() is called via j1939_sk_release()). Otherwise, the extra ref on "struct j1939_priv" held by j1939_sk_bind() call prevents "struct net_device" from dropping the usage count to 1; making it impossible for unregister_netdevice() to continue. [mkl: remove space in front of label]

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-14 17:39 UTC

CWE

CWE-noinfo Not enough information

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/479d8a2aedcc1db16…
https://git.kernel.org/stable/c/2c88069fac2c792e2…
https://git.kernel.org/stable/c/76957b618ce729c3b…
https://git.kernel.org/stable/c/4e154cb5e7681c291…
https://git.kernel.org/stable/c/da9e8f42913992857…
https://git.kernel.org/stable/c/7fcbe5b2c6a4b5407…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 9d71dd0c70099914fcd063135da3c580865e924c , < 479d8a2aedcc1db16f14c1a8a9c74b5bdf18b9ac (git) Affected: 9d71dd0c70099914fcd063135da3c580865e924c , < 2c88069fac2c792e228e6a4ae71c9b9b5b9a87a6 (git) Affected: 9d71dd0c70099914fcd063135da3c580865e924c , < 76957b618ce729c3bd1e782fbc9d9991af653925 (git) Affected: 9d71dd0c70099914fcd063135da3c580865e924c , < 4e154cb5e7681c2910e2dfa09f05e3469e333745 (git) Affected: 9d71dd0c70099914fcd063135da3c580865e924c , < da9e8f429139928570407e8f90559b5d46c20262 (git) Affected: 9d71dd0c70099914fcd063135da3c580865e924c , < 7fcbe5b2c6a4b5407bf2241fdb71e0a390f6ab9a (git)
Linux	Linux	Affected: 5.4 Unaffected: 0 , < 5.4 (semver) Unaffected: 5.15.220 , ≤ 5.15.* (semver) Unaffected: 6.1.187 , ≤ 6.1.* (semver) Unaffected: 6.6.156 , ≤ 6.6.* (semver) Unaffected: 6.12.108 , ≤ 6.12.* (semver) Unaffected: 6.16.8 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-39925",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T17:39:05.628974Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T17:42:45.107Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/can/j1939/j1939-priv.h",
            "net/can/j1939/main.c",
            "net/can/j1939/socket.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "479d8a2aedcc1db16f14c1a8a9c74b5bdf18b9ac",
              "status": "affected",
              "version": "9d71dd0c70099914fcd063135da3c580865e924c",
              "versionType": "git"
            },
            {
              "lessThan": "2c88069fac2c792e228e6a4ae71c9b9b5b9a87a6",
              "status": "affected",
              "version": "9d71dd0c70099914fcd063135da3c580865e924c",
              "versionType": "git"
            },
            {
              "lessThan": "76957b618ce729c3bd1e782fbc9d9991af653925",
              "status": "affected",
              "version": "9d71dd0c70099914fcd063135da3c580865e924c",
              "versionType": "git"
            },
            {
              "lessThan": "4e154cb5e7681c2910e2dfa09f05e3469e333745",
              "status": "affected",
              "version": "9d71dd0c70099914fcd063135da3c580865e924c",
              "versionType": "git"
            },
            {
              "lessThan": "da9e8f429139928570407e8f90559b5d46c20262",
              "status": "affected",
              "version": "9d71dd0c70099914fcd063135da3c580865e924c",
              "versionType": "git"
            },
            {
              "lessThan": "7fcbe5b2c6a4b5407bf2241fdb71e0a390f6ab9a",
              "status": "affected",
              "version": "9d71dd0c70099914fcd063135da3c580865e924c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/can/j1939/j1939-priv.h",
            "net/can/j1939/main.c",
            "net/can/j1939/socket.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.220",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.187",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.220",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.187",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.156",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.108",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.8",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: j1939: implement NETDEV_UNREGISTER notification handler\n\nsyzbot is reporting\n\n  unregister_netdevice: waiting for vcan0 to become free. Usage count = 2\n\nproblem, for j1939 protocol did not have NETDEV_UNREGISTER notification\nhandler for undoing changes made by j1939_sk_bind().\n\nCommit 25fe97cb7620 (\"can: j1939: move j1939_priv_put() into sk_destruct\ncallback\") expects that a call to j1939_priv_put() can be unconditionally\ndelayed until j1939_sk_sock_destruct() is called. But we need to call\nj1939_priv_put() against an extra ref held by j1939_sk_bind() call\n(as a part of undoing changes made by j1939_sk_bind()) as soon as\nNETDEV_UNREGISTER notification fires (i.e. before j1939_sk_sock_destruct()\nis called via j1939_sk_release()). Otherwise, the extra ref on \"struct\nj1939_priv\" held by j1939_sk_bind() call prevents \"struct net_device\" from\ndropping the usage count to 1; making it impossible for\nunregister_netdevice() to continue.\n\n[mkl: remove space in front of label]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T12:49:23.677Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/479d8a2aedcc1db16f14c1a8a9c74b5bdf18b9ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c88069fac2c792e228e6a4ae71c9b9b5b9a87a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/76957b618ce729c3bd1e782fbc9d9991af653925"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e154cb5e7681c2910e2dfa09f05e3469e333745"
        },
        {
          "url": "https://git.kernel.org/stable/c/da9e8f429139928570407e8f90559b5d46c20262"
        },
        {
          "url": "https://git.kernel.org/stable/c/7fcbe5b2c6a4b5407bf2241fdb71e0a390f6ab9a"
        }
      ],
      "title": "can: j1939: implement NETDEV_UNREGISTER notification handler",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39925",
    "datePublished": "2025-10-01T08:07:13.123Z",
    "dateReserved": "2025-04-16T07:20:57.147Z",
    "dateUpdated": "2026-09-02T12:49:23.677Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-39979 (GCVE-0-2025-39979)

Vulnerability from cvelistv5 – Published: 2025-10-15 07:55 – Updated: 2026-08-05 12:06

Title

net/mlx5: fs, fix UAF in flow counter release

Summary

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fs, fix UAF in flow counter release Fix a kernel trace [1] caused by releasing an HWS action of a local flow counter in mlx5_cmd_hws_delete_fte(), where the HWS action refcount and mutex were not initialized and the counter struct could already be freed when deleting the rule. Fix it by adding the missing initializations and adding refcount for the local flow counter struct. [1] Kernel log: Call Trace: <TASK> dump_stack_lvl+0x34/0x48 mlx5_fs_put_hws_action.part.0.cold+0x21/0x94 [mlx5_core] mlx5_fc_put_hws_action+0x96/0xad [mlx5_core] mlx5_fs_destroy_fs_actions+0x8b/0x152 [mlx5_core] mlx5_cmd_hws_delete_fte+0x5a/0xa0 [mlx5_core] del_hw_fte+0x1ce/0x260 [mlx5_core] mlx5_del_flow_rules+0x12d/0x240 [mlx5_core] ? ttwu_queue_wakelist+0xf4/0x110 mlx5_ib_destroy_flow+0x103/0x1b0 [mlx5_ib] uverbs_free_flow+0x20/0x50 [ib_uverbs] destroy_hw_idr_uobject+0x1b/0x50 [ib_uverbs] uverbs_destroy_uobject+0x34/0x1a0 [ib_uverbs] uobj_destroy+0x3c/0x80 [ib_uverbs] ib_uverbs_run_method+0x23e/0x360 [ib_uverbs] ? uverbs_finalize_object+0x60/0x60 [ib_uverbs] ib_uverbs_cmd_verbs+0x14f/0x2c0 [ib_uverbs] ? do_tty_write+0x1a9/0x270 ? file_tty_write.constprop.0+0x98/0xc0 ? new_sync_write+0xfc/0x190 ib_uverbs_ioctl+0xd7/0x160 [ib_uverbs] __x64_sys_ioctl+0x87/0xc0 do_syscall_64+0x59/0x90

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

2 references

URL	Tags
https://git.kernel.org/stable/c/3c77f6d244188c3fb…
https://git.kernel.org/stable/c/6043819e707cefb1c…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: b581f4266928d3b5d1bbe711e39623d9a1696091 , < 3c77f6d244188c3fb11f6aec40bbfe884f1803b5 (git) Affected: b581f4266928d3b5d1bbe711e39623d9a1696091 , < 6043819e707cefb1c9e59d6e431dcfa735c4f975 (git)
Linux	Linux	Affected: 6.14 Unaffected: 0 , < 6.14 (semver) Unaffected: 6.16.10 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/fs_core.c",
            "drivers/net/ethernet/mellanox/mlx5/core/fs_core.h",
            "drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c",
            "drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws_pools.c",
            "include/linux/mlx5/fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3c77f6d244188c3fb11f6aec40bbfe884f1803b5",
              "status": "affected",
              "version": "b581f4266928d3b5d1bbe711e39623d9a1696091",
              "versionType": "git"
            },
            {
              "lessThan": "6043819e707cefb1c9e59d6e431dcfa735c4f975",
              "status": "affected",
              "version": "b581f4266928d3b5d1bbe711e39623d9a1696091",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/fs_core.c",
            "drivers/net/ethernet/mellanox/mlx5/core/fs_core.h",
            "drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c",
            "drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws_pools.c",
            "include/linux/mlx5/fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.10",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fs, fix UAF in flow counter release\n\nFix a kernel trace [1] caused by releasing an HWS action of a local flow\ncounter in mlx5_cmd_hws_delete_fte(), where the HWS action refcount and\nmutex were not initialized and the counter struct could already be freed\nwhen deleting the rule.\n\nFix it by adding the missing initializations and adding refcount for the\nlocal flow counter struct.\n\n[1] Kernel log:\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x34/0x48\n  mlx5_fs_put_hws_action.part.0.cold+0x21/0x94 [mlx5_core]\n  mlx5_fc_put_hws_action+0x96/0xad [mlx5_core]\n  mlx5_fs_destroy_fs_actions+0x8b/0x152 [mlx5_core]\n  mlx5_cmd_hws_delete_fte+0x5a/0xa0 [mlx5_core]\n  del_hw_fte+0x1ce/0x260 [mlx5_core]\n  mlx5_del_flow_rules+0x12d/0x240 [mlx5_core]\n  ? ttwu_queue_wakelist+0xf4/0x110\n  mlx5_ib_destroy_flow+0x103/0x1b0 [mlx5_ib]\n  uverbs_free_flow+0x20/0x50 [ib_uverbs]\n  destroy_hw_idr_uobject+0x1b/0x50 [ib_uverbs]\n  uverbs_destroy_uobject+0x34/0x1a0 [ib_uverbs]\n  uobj_destroy+0x3c/0x80 [ib_uverbs]\n  ib_uverbs_run_method+0x23e/0x360 [ib_uverbs]\n  ? uverbs_finalize_object+0x60/0x60 [ib_uverbs]\n  ib_uverbs_cmd_verbs+0x14f/0x2c0 [ib_uverbs]\n  ? do_tty_write+0x1a9/0x270\n  ? file_tty_write.constprop.0+0x98/0xc0\n  ? new_sync_write+0xfc/0x190\n  ib_uverbs_ioctl+0xd7/0x160 [ib_uverbs]\n  __x64_sys_ioctl+0x87/0xc0\n  do_syscall_64+0x59/0x90"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The only route to the vulnerable code is the `MLX5_IB_METHOD_CREATE_FLOW`/destroy-flow uverbs ioctl on the local `/dev/infiniband/uverbsN` character device (created world-accessible at mode 0666), as shown by the `__x64_sys_ioctl` \u2192 `ib_uverbs_ioctl` \u2192 `mlx5_ib_destroy_flow` call trace. No remote packet or peer data reaches this path.\nAC:L - This is not a race \u2014 `mlx5_del_flow_rules()` frees the local counter in `del_sw_hw_rule()` and then unconditionally reuses it in `del_hw_fte()` \u2192 `mlx5_cmd_hws_delete_fte()` within the same call, so every teardown of a DEVX-counter flow rule deterministically triggers the UAF, and the attacker fully controls both the create and destroy ioctls plus any heap-spray thread.\nPR:L - The attacker needs only the partial CAP_NET_RAW capability, not real root/admin \u2014 it is granted by default to Docker/OCI containers in the initial user namespace, is routinely handed to DPDK/RDMA and HPC workloads, and the uverbs device node itself is world-readable/writable at 0666. This is a limited privilege on the vulnerable component, not full administrative control.\nUI:N - The attacker performs the entire sequence (create DEVX flow counter, create raw flow rule, destroy the flow uobject) from its own process with ordinary ioctls. No victim action or interaction is needed.\nS:U - The use-after-free corrupts kernel slab memory and is exploited to gain kernel privileges within the same security authority as the attacking process. No hypervisor, IOMMU, or other security-authority boundary is crossed.\nC:H - `mlx5_fs_put_hws_action()` reads `counter-\u003ebulk` and then `fs_hws_data-\u003ehws_action` out of freed slab memory; once the object is reclaimed by a sprayed allocation the attacker controls those reads and the subsequent `action-\u003etype`/`action-\u003ectx` dereferences in `mlx5hws_action_destroy()`, yielding an arbitrary-pointer read primitive and full kernel memory disclosure.\nI:H - The freed object is written after free \u2014 an atomic RMW via `refcount_dec_not_one()`, a `mutex_lock()`, and `fs_hws_data-\u003ehws_action = NULL` \u2014 corrupting whatever structure now occupies the slot, and `mlx5hws_action_destroy()` performs a `kfree()` on a pointer read from attacker-controlled freed memory, an arbitrary-free primitive that is a well-established route to control-flow hijack and privilege escalation.\nA:H - Even without exploitation the bug reliably produces a refcount_t saturation splat, slab corruption, and kernel oops/panic on every flow-rule teardown, and the uninitialized `hws_data.lock` mutex (zeroed `wait_list` with NULL next/prev) causes a NULL dereference or list corruption on any contended `mutex_lock()`."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:48.313Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3c77f6d244188c3fb11f6aec40bbfe884f1803b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/6043819e707cefb1c9e59d6e431dcfa735c4f975"
        }
      ],
      "title": "net/mlx5: fs, fix UAF in flow counter release",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39979",
    "datePublished": "2025-10-15T07:55:59.609Z",
    "dateReserved": "2025-04-16T07:20:57.150Z",
    "dateUpdated": "2026-08-05T12:06:48.313Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-39981 (GCVE-0-2025-39981)

Vulnerability from cvelistv5 – Published: 2025-10-15 07:56 – Updated: 2026-08-05 12:06

Title

Bluetooth: MGMT: Fix possible UAFs

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix possible UAFs This attemps to fix possible UAFs caused by struct mgmt_pending being freed while still being processed like in the following trace, in order to fix mgmt_pending_valid is introduce and use to check if the mgmt_pending hasn't been removed from the pending list, on the complete callbacks it is used to check and in addtion remove the cmd from the list while holding mgmt_pending_lock to avoid TOCTOU problems since if the cmd is left on the list it can still be accessed and freed. BUG: KASAN: slab-use-after-free in mgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223 Read of size 8 at addr ffff8880709d4dc0 by task kworker/u11:0/55 CPU: 0 UID: 0 PID: 55 Comm: kworker/u11:0 Not tainted 6.16.4 #2 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Workqueue: hci0 hci_cmd_sync_work Call Trace: <TASK> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 mgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223 hci_cmd_sync_work+0x210/0x3a0 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3321 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402 kthread+0x711/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16.4/arch/x86/entry/entry_64.S:245 </TASK> Allocated by task 12210: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4364 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] mgmt_pending_new+0x65/0x1e0 net/bluetooth/mgmt_util.c:269 mgmt_pending_add+0x35/0x140 net/bluetooth/mgmt_util.c:296 __add_adv_patterns_monitor+0x130/0x200 net/bluetooth/mgmt.c:5247 add_adv_patterns_monitor+0x214/0x360 net/bluetooth/mgmt.c:5364 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:729 sock_write_iter+0x258/0x330 net/socket.c:1133 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x5c9/0xb30 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 12221: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2381 [inline] slab_free mm/slub.c:4648 [inline] kfree+0x18e/0x440 mm/slub.c:4847 mgmt_pending_free net/bluetooth/mgmt_util.c:311 [inline] mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257 __mgmt_power_off+0x169/0x350 net/bluetooth/mgmt.c:9444 hci_dev_close_sync+0x754/0x1330 net/bluetooth/hci_sync.c:5290 hci_dev_do_close net/bluetooth/hci_core.c:501 [inline] hci_dev_close+0x108/0x200 net/bluetooth/hci_core.c:526 sock_do_ioctl+0xd9/0x300 net/socket.c:1192 sock_ioctl+0x576/0x790 net/socket.c:1313 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf ---truncated---

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/0b60eb04b8524e1b4…
https://git.kernel.org/stable/c/d71b98f253b079cba…
https://git.kernel.org/stable/c/87a1f16f07c6c4377…
https://git.kernel.org/stable/c/302a1f674c00dd558…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: cf75ad8b41d2aa06f98f365d42a3ae8b059daddd , < 0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a (git) Affected: cf75ad8b41d2aa06f98f365d42a3ae8b059daddd , < d71b98f253b079cbadc83266383f26fe7e9e103b (git) Affected: cf75ad8b41d2aa06f98f365d42a3ae8b059daddd , < 87a1f16f07c6c43771754075e08f45b41d237421 (git) Affected: cf75ad8b41d2aa06f98f365d42a3ae8b059daddd , < 302a1f674c00dd5581ab8e493ef44767c5101aab (git)
Linux	Linux	Affected: 5.17 Unaffected: 0 , < 5.17 (semver) Unaffected: 6.6.140 , ≤ 6.6.* (semver) Unaffected: 6.12.59 , ≤ 6.12.* (semver) Unaffected: 6.16.10 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/mgmt.c",
            "net/bluetooth/mgmt_util.c",
            "net/bluetooth/mgmt_util.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a",
              "status": "affected",
              "version": "cf75ad8b41d2aa06f98f365d42a3ae8b059daddd",
              "versionType": "git"
            },
            {
              "lessThan": "d71b98f253b079cbadc83266383f26fe7e9e103b",
              "status": "affected",
              "version": "cf75ad8b41d2aa06f98f365d42a3ae8b059daddd",
              "versionType": "git"
            },
            {
              "lessThan": "87a1f16f07c6c43771754075e08f45b41d237421",
              "status": "affected",
              "version": "cf75ad8b41d2aa06f98f365d42a3ae8b059daddd",
              "versionType": "git"
            },
            {
              "lessThan": "302a1f674c00dd5581ab8e493ef44767c5101aab",
              "status": "affected",
              "version": "cf75ad8b41d2aa06f98f365d42a3ae8b059daddd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/mgmt.c",
            "net/bluetooth/mgmt_util.c",
            "net/bluetooth/mgmt_util.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.59",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.10",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix possible UAFs\n\nThis attemps to fix possible UAFs caused by struct mgmt_pending being\nfreed while still being processed like in the following trace, in order\nto fix mgmt_pending_valid is introduce and use to check if the\nmgmt_pending hasn\u0027t been removed from the pending list, on the complete\ncallbacks it is used to check and in addtion remove the cmd from the list\nwhile holding mgmt_pending_lock to avoid TOCTOU problems since if the cmd\nis left on the list it can still be accessed and freed.\n\nBUG: KASAN: slab-use-after-free in mgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223\nRead of size 8 at addr ffff8880709d4dc0 by task kworker/u11:0/55\n\nCPU: 0 UID: 0 PID: 55 Comm: kworker/u11:0 Not tainted 6.16.4 #2 PREEMPT(full)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014\nWorkqueue: hci0 hci_cmd_sync_work\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xca/0x240 mm/kasan/report.c:482\n kasan_report+0x118/0x150 mm/kasan/report.c:595\n mgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223\n hci_cmd_sync_work+0x210/0x3a0 net/bluetooth/hci_sync.c:332\n process_one_work kernel/workqueue.c:3238 [inline]\n process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3321\n worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402\n kthread+0x711/0x8a0 kernel/kthread.c:464\n ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148\n ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16.4/arch/x86/entry/entry_64.S:245\n \u003c/TASK\u003e\n\nAllocated by task 12210:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3e/0x80 mm/kasan/common.c:68\n poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4364\n kmalloc_noprof include/linux/slab.h:905 [inline]\n kzalloc_noprof include/linux/slab.h:1039 [inline]\n mgmt_pending_new+0x65/0x1e0 net/bluetooth/mgmt_util.c:269\n mgmt_pending_add+0x35/0x140 net/bluetooth/mgmt_util.c:296\n __add_adv_patterns_monitor+0x130/0x200 net/bluetooth/mgmt.c:5247\n add_adv_patterns_monitor+0x214/0x360 net/bluetooth/mgmt.c:5364\n hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719\n hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839\n sock_sendmsg_nosec net/socket.c:714 [inline]\n __sock_sendmsg+0x219/0x270 net/socket.c:729\n sock_write_iter+0x258/0x330 net/socket.c:1133\n new_sync_write fs/read_write.c:593 [inline]\n vfs_write+0x5c9/0xb30 fs/read_write.c:686\n ksys_write+0x145/0x250 fs/read_write.c:738\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 12221:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3e/0x80 mm/kasan/common.c:68\n kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576\n poison_slab_object mm/kasan/common.c:247 [inline]\n __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264\n kasan_slab_free include/linux/kasan.h:233 [inline]\n slab_free_hook mm/slub.c:2381 [inline]\n slab_free mm/slub.c:4648 [inline]\n kfree+0x18e/0x440 mm/slub.c:4847\n mgmt_pending_free net/bluetooth/mgmt_util.c:311 [inline]\n mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257\n __mgmt_power_off+0x169/0x350 net/bluetooth/mgmt.c:9444\n hci_dev_close_sync+0x754/0x1330 net/bluetooth/hci_sync.c:5290\n hci_dev_do_close net/bluetooth/hci_core.c:501 [inline]\n hci_dev_close+0x108/0x200 net/bluetooth/hci_core.c:526\n sock_do_ioctl+0xd9/0x300 net/socket.c:1192\n sock_ioctl+0x576/0x790 net/socket.c:1313\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:907 [inline]\n __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xf\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Both sides of the race are local syscalls \u2014 `write()` of an MGMT command on an AF_BLUETOOTH/BTPROTO_HCI socket bound to HCI_CHANNEL_CONTROL, and `ioctl(HCIDEVDOWN)` \u2014 with no over-the-air component; a remote or adjacent Bluetooth peer cannot inject MGMT commands.\nAC:L - The attacker owns both sides of the race, spawning one thread that queues mgmt commands (widening the window via the hci_cmd_sync workqueue dispatch latency) and another that closes the device, and can retry in a tight loop until the free lands inside the worker\u0027s dereference.\nPR:L - Reaching the affected opcodes requires HCI_SOCK_TRUSTED, granted by CAP_NET_ADMIN, which is a delegable capability commonly held by non-root service accounts (bluetoothd, Android\u0027s Bluetooth process) rather than full init-namespace root \u2014 so compromising that already-network-exposed daemon yields this primitive.\nUI:N - The attacker performs every step itself \u2014 queueing the mgmt command and tearing the HCI device down \u2014 with no victim action required.\nS:U - The corruption stays within the kernel\u0027s own security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The freed cmd\u0027s `user_data` is dereferenced as an `adv_monitor`, so a heap-sprayed replacement lets msft_add_monitor_pattern() walk an attacker-supplied pattern list and read arbitrary kernel memory back through the mgmt event socket, and `cmd-\u003esk`/`cmd-\u003eparam` reads leak further kernel data.\nI:H - `monitor-\u003ehandle = handle` after `idr_alloc()` writes a controlled value at an attacker-chosen address, and the stale `list_del` in mgmt_pending_remove(), dangling `kfree_skb(cmd-\u003eskb)`, and spurious `sock_put(cmd-\u003esk)` add double-free and refcount-underflow primitives sufficient for control-flow hijack.\nA:H - Even unweaponized, dereferencing the freed mgmt_pending_cmd oopses the kernel \u2014 as reproduced by the KASAN slab-use-after-free in mgmt_add_adv_patterns_monitor_sync \u2014 and can be triggered repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:49.384Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d71b98f253b079cbadc83266383f26fe7e9e103b"
        },
        {
          "url": "https://git.kernel.org/stable/c/87a1f16f07c6c43771754075e08f45b41d237421"
        },
        {
          "url": "https://git.kernel.org/stable/c/302a1f674c00dd5581ab8e493ef44767c5101aab"
        }
      ],
      "title": "Bluetooth: MGMT: Fix possible UAFs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39981",
    "datePublished": "2025-10-15T07:56:00.959Z",
    "dateReserved": "2025-04-16T07:20:57.150Z",
    "dateUpdated": "2026-08-05T12:06:49.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-39982 (GCVE-0-2025-39982)

Vulnerability from cvelistv5 – Published: 2025-10-15 07:56 – Updated: 2026-08-05 12:06

Title

Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync This fixes the following UFA in hci_acl_create_conn_sync where a connection still pending is command submission (conn->state == BT_OPEN) maybe freed, also since this also can happen with the likes of hci_le_create_conn_sync fix it as well: BUG: KASAN: slab-use-after-free in hci_acl_create_conn_sync+0x5ef/0x790 net/bluetooth/hci_sync.c:6861 Write of size 2 at addr ffff88805ffcc038 by task kworker/u11:2/9541 CPU: 1 UID: 0 PID: 9541 Comm: kworker/u11:2 Not tainted 6.16.0-rc7 #3 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Workqueue: hci3 hci_cmd_sync_work Call Trace: <TASK> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x230 mm/kasan/report.c:480 kasan_report+0x118/0x150 mm/kasan/report.c:593 hci_acl_create_conn_sync+0x5ef/0x790 net/bluetooth/hci_sync.c:6861 hci_cmd_sync_work+0x210/0x3a0 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245 </TASK> Allocated by task 123736: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4359 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] __hci_conn_add+0x233/0x1b30 net/bluetooth/hci_conn.c:939 hci_conn_add_unset net/bluetooth/hci_conn.c:1051 [inline] hci_connect_acl+0x16c/0x4e0 net/bluetooth/hci_conn.c:1634 pair_device+0x418/0xa70 net/bluetooth/mgmt.c:3556 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:727 sock_write_iter+0x258/0x330 net/socket.c:1131 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x54b/0xa90 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 103680: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2381 [inline] slab_free mm/slub.c:4643 [inline] kfree+0x18e/0x440 mm/slub.c:4842 device_release+0x9c/0x1c0 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x22b/0x480 lib/kobject.c:737 hci_conn_cleanup net/bluetooth/hci_conn.c:175 [inline] hci_conn_del+0x8ff/0xcb0 net/bluetooth/hci_conn.c:1173 hci_conn_complete_evt+0x3c7/0x1040 net/bluetooth/hci_event.c:3199 hci_event_func net/bluetooth/hci_event.c:7477 [inline] hci_event_packet+0x7e0/0x1200 net/bluetooth/hci_event.c:7531 hci_rx_work+0x46a/0xe80 net/bluetooth/hci_core.c:4070 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 home/kwqcheii/sour ---truncated---

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/6243bda271a628c48…
https://git.kernel.org/stable/c/bcce99f613163a43d…
https://git.kernel.org/stable/c/484c7d571a3d1b3fd…
https://git.kernel.org/stable/c/a78fd4fc5694ecb3b…
https://git.kernel.org/stable/c/9e622804d57e2d08f…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: aef2aa4fa98e18ea5d9345bf777ee698c8598728 , < 6243bda271a628c48875e3e473206e7f584892ce (git) Affected: aef2aa4fa98e18ea5d9345bf777ee698c8598728 , < bcce99f613163a43de24674b717e7a6c135fc879 (git) Affected: aef2aa4fa98e18ea5d9345bf777ee698c8598728 , < 484c7d571a3d1b3fd298fa691b660438c4548a53 (git) Affected: aef2aa4fa98e18ea5d9345bf777ee698c8598728 , < a78fd4fc5694ecb3b97deb2ad9eaebd67b4d2b08 (git) Affected: aef2aa4fa98e18ea5d9345bf777ee698c8598728 , < 9e622804d57e2d08f0271200606bd1270f75126f (git)
Linux	Linux	Affected: 5.18 Unaffected: 0 , < 5.18 (semver) Unaffected: 6.1.155 , ≤ 6.1.* (semver) Unaffected: 6.6.109 , ≤ 6.6.* (semver) Unaffected: 6.12.50 , ≤ 6.12.* (semver) Unaffected: 6.16.10 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/bluetooth/hci_core.h",
            "net/bluetooth/hci_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6243bda271a628c48875e3e473206e7f584892ce",
              "status": "affected",
              "version": "aef2aa4fa98e18ea5d9345bf777ee698c8598728",
              "versionType": "git"
            },
            {
              "lessThan": "bcce99f613163a43de24674b717e7a6c135fc879",
              "status": "affected",
              "version": "aef2aa4fa98e18ea5d9345bf777ee698c8598728",
              "versionType": "git"
            },
            {
              "lessThan": "484c7d571a3d1b3fd298fa691b660438c4548a53",
              "status": "affected",
              "version": "aef2aa4fa98e18ea5d9345bf777ee698c8598728",
              "versionType": "git"
            },
            {
              "lessThan": "a78fd4fc5694ecb3b97deb2ad9eaebd67b4d2b08",
              "status": "affected",
              "version": "aef2aa4fa98e18ea5d9345bf777ee698c8598728",
              "versionType": "git"
            },
            {
              "lessThan": "9e622804d57e2d08f0271200606bd1270f75126f",
              "status": "affected",
              "version": "aef2aa4fa98e18ea5d9345bf777ee698c8598728",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/bluetooth/hci_core.h",
            "net/bluetooth/hci_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.155",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.155",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.109",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.50",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.10",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync\n\nThis fixes the following UFA in hci_acl_create_conn_sync where a\nconnection still pending is command submission (conn-\u003estate == BT_OPEN)\nmaybe freed, also since this also can happen with the likes of\nhci_le_create_conn_sync fix it as well:\n\nBUG: KASAN: slab-use-after-free in hci_acl_create_conn_sync+0x5ef/0x790 net/bluetooth/hci_sync.c:6861\nWrite of size 2 at addr ffff88805ffcc038 by task kworker/u11:2/9541\n\nCPU: 1 UID: 0 PID: 9541 Comm: kworker/u11:2 Not tainted 6.16.0-rc7 #3 PREEMPT(full)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014\nWorkqueue: hci3 hci_cmd_sync_work\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xca/0x230 mm/kasan/report.c:480\n kasan_report+0x118/0x150 mm/kasan/report.c:593\n hci_acl_create_conn_sync+0x5ef/0x790 net/bluetooth/hci_sync.c:6861\n hci_cmd_sync_work+0x210/0x3a0 net/bluetooth/hci_sync.c:332\n process_one_work kernel/workqueue.c:3238 [inline]\n process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321\n worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402\n kthread+0x70e/0x8a0 kernel/kthread.c:464\n ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148\n ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245\n \u003c/TASK\u003e\n\nAllocated by task 123736:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3e/0x80 mm/kasan/common.c:68\n poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4359\n kmalloc_noprof include/linux/slab.h:905 [inline]\n kzalloc_noprof include/linux/slab.h:1039 [inline]\n __hci_conn_add+0x233/0x1b30 net/bluetooth/hci_conn.c:939\n hci_conn_add_unset net/bluetooth/hci_conn.c:1051 [inline]\n hci_connect_acl+0x16c/0x4e0 net/bluetooth/hci_conn.c:1634\n pair_device+0x418/0xa70 net/bluetooth/mgmt.c:3556\n hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719\n hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839\n sock_sendmsg_nosec net/socket.c:712 [inline]\n __sock_sendmsg+0x219/0x270 net/socket.c:727\n sock_write_iter+0x258/0x330 net/socket.c:1131\n new_sync_write fs/read_write.c:593 [inline]\n vfs_write+0x54b/0xa90 fs/read_write.c:686\n ksys_write+0x145/0x250 fs/read_write.c:738\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 103680:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3e/0x80 mm/kasan/common.c:68\n kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576\n poison_slab_object mm/kasan/common.c:247 [inline]\n __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264\n kasan_slab_free include/linux/kasan.h:233 [inline]\n slab_free_hook mm/slub.c:2381 [inline]\n slab_free mm/slub.c:4643 [inline]\n kfree+0x18e/0x440 mm/slub.c:4842\n device_release+0x9c/0x1c0\n kobject_cleanup lib/kobject.c:689 [inline]\n kobject_release lib/kobject.c:720 [inline]\n kref_put include/linux/kref.h:65 [inline]\n kobject_put+0x22b/0x480 lib/kobject.c:737\n hci_conn_cleanup net/bluetooth/hci_conn.c:175 [inline]\n hci_conn_del+0x8ff/0xcb0 net/bluetooth/hci_conn.c:1173\n hci_conn_complete_evt+0x3c7/0x1040 net/bluetooth/hci_event.c:3199\n hci_event_func net/bluetooth/hci_event.c:7477 [inline]\n hci_event_packet+0x7e0/0x1200 net/bluetooth/hci_event.c:7531\n hci_rx_work+0x46a/0xe80 net/bluetooth/hci_core.c:4070\n process_one_work kernel/workqueue.c:3238 [inline]\n process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321\n worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402\n kthread+0x70e/0x8a0 kernel/kthread.c:464\n ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148\n ret_from_fork_asm+0x1a/0x30 home/kwqcheii/sour\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The freeing side of the race is driven by HCI Connection Complete / LE Connection Complete events that a nearby Bluetooth device causes the controller to generate by paging or connecting to the victim and then failing the link. This is Bluetooth radio range, i.e. an adjacent network attacker, not a remote internet attacker.\nAC:L - The attacker drives both halves \u2014 it chooses when to page/connect and when to abort so the error-status Connection Complete lands while the hci_conn is still BT_OPEN, and the window is very wide because hci_acl_create_conn_sync first blocks on an HCI_OP_INQUIRY_CANCEL round-trip while the freeing runs on a different workqueue with no shared lock. The attempt is freely repeatable until it wins.\nPR:N - The adjacent attacker needs no credentials or pairing on the target \u2014 hci_conn_request_evt accepts pages from a connectable/accept-listed device before any authentication, and the outgoing connection it collides with comes from BlueZ auto-reconnect or an unprivileged L2CAP connect() with no capability check.\nUI:N - No victim action is required; background auto-connect to a previously paired device or a listening L2CAP/RFCOMM service creates the pending BT_OPEN hci_conn automatically, and the attacker can induce it by advertising as a device on the victim\u0027s accept list.\nS:U - The corruption is confined to kernel slab memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - After the free the worker reads conn-\u003epkt_type, conn-\u003edst, and conn-\u003econn_timeout out of the reclaimed slab object and emits them in an HCI Create Connection command, and the UAF permits heap grooming for controlled reads of adjacent kernel data.\nI:H - The worker writes into the freed object at fixed offsets \u2014 conn-\u003estate, conn-\u003eout, conn-\u003erole, an attempt counter, link_policy, a refcount increment via hci_conn_get(), and a 3-byte memcpy of the attacker\u0027s own Class-of-Device \u2014 giving a groomable write primitive into a reclaimed kmalloc slot suitable for control-flow hijack.\nA:H - The KASAN report shows a slab-use-after-free write from hci_cmd_sync_work, which reliably oopses or panics the kernel and can be re-triggered by the attacker at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:50.448Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6243bda271a628c48875e3e473206e7f584892ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/bcce99f613163a43de24674b717e7a6c135fc879"
        },
        {
          "url": "https://git.kernel.org/stable/c/484c7d571a3d1b3fd298fa691b660438c4548a53"
        },
        {
          "url": "https://git.kernel.org/stable/c/a78fd4fc5694ecb3b97deb2ad9eaebd67b4d2b08"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e622804d57e2d08f0271200606bd1270f75126f"
        }
      ],
      "title": "Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39982",
    "datePublished": "2025-10-15T07:56:02.024Z",
    "dateReserved": "2025-04-16T07:20:57.150Z",
    "dateUpdated": "2026-08-05T12:06:50.448Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-39983 (GCVE-0-2025-39983)

Vulnerability from cvelistv5 – Published: 2025-10-15 07:56 – Updated: 2026-08-05 12:06

Title

Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue This fixes the following UAF caused by not properly locking hdev when processing HCI_EV_NUM_COMP_PKTS: BUG: KASAN: slab-use-after-free in hci_conn_tx_dequeue+0x1be/0x220 net/bluetooth/hci_conn.c:3036 Read of size 4 at addr ffff8880740f0940 by task kworker/u11:0/54 CPU: 1 UID: 0 PID: 54 Comm: kworker/u11:0 Not tainted 6.16.0-rc7 #3 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Workqueue: hci1 hci_rx_work Call Trace: <TASK> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x230 mm/kasan/report.c:480 kasan_report+0x118/0x150 mm/kasan/report.c:593 hci_conn_tx_dequeue+0x1be/0x220 net/bluetooth/hci_conn.c:3036 hci_num_comp_pkts_evt+0x1c8/0xa50 net/bluetooth/hci_event.c:4404 hci_event_func net/bluetooth/hci_event.c:7477 [inline] hci_event_packet+0x7e0/0x1200 net/bluetooth/hci_event.c:7531 hci_rx_work+0x46a/0xe80 net/bluetooth/hci_core.c:4070 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245 </TASK> Allocated by task 54: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4359 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] __hci_conn_add+0x233/0x1b30 net/bluetooth/hci_conn.c:939 le_conn_complete_evt+0x3d6/0x1220 net/bluetooth/hci_event.c:5628 hci_le_enh_conn_complete_evt+0x189/0x470 net/bluetooth/hci_event.c:5794 hci_event_func net/bluetooth/hci_event.c:7474 [inline] hci_event_packet+0x78c/0x1200 net/bluetooth/hci_event.c:7531 hci_rx_work+0x46a/0xe80 net/bluetooth/hci_core.c:4070 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245 Freed by task 9572: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2381 [inline] slab_free mm/slub.c:4643 [inline] kfree+0x18e/0x440 mm/slub.c:4842 device_release+0x9c/0x1c0 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x22b/0x480 lib/kobject.c:737 hci_conn_cleanup net/bluetooth/hci_conn.c:175 [inline] hci_conn_del+0x8ff/0xcb0 net/bluetooth/hci_conn.c:1173 hci_abort_conn_sync+0x5d1/0xdf0 net/bluetooth/hci_sync.c:5689 hci_cmd_sync_work+0x210/0x3a0 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

2 references

URL	Tags
https://git.kernel.org/stable/c/dde33124f17cf3bab…
https://git.kernel.org/stable/c/2e128683176a56459…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 134f4b39df7b77225a80ef585c15d46f964f5e6f , < dde33124f17cf3bab4dc5e18d1b4dee128361061 (git) Affected: 134f4b39df7b77225a80ef585c15d46f964f5e6f , < 2e128683176a56459cef8705fc7c35f438f88abd (git)
Linux	Linux	Affected: 6.15 Unaffected: 0 , < 6.15 (semver) Unaffected: 6.16.10 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dde33124f17cf3bab4dc5e18d1b4dee128361061",
              "status": "affected",
              "version": "134f4b39df7b77225a80ef585c15d46f964f5e6f",
              "versionType": "git"
            },
            {
              "lessThan": "2e128683176a56459cef8705fc7c35f438f88abd",
              "status": "affected",
              "version": "134f4b39df7b77225a80ef585c15d46f964f5e6f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.10",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue\n\nThis fixes the following UAF caused by not properly locking hdev when\nprocessing HCI_EV_NUM_COMP_PKTS:\n\nBUG: KASAN: slab-use-after-free in hci_conn_tx_dequeue+0x1be/0x220 net/bluetooth/hci_conn.c:3036\nRead of size 4 at addr ffff8880740f0940 by task kworker/u11:0/54\n\nCPU: 1 UID: 0 PID: 54 Comm: kworker/u11:0 Not tainted 6.16.0-rc7 #3 PREEMPT(full)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014\nWorkqueue: hci1 hci_rx_work\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xca/0x230 mm/kasan/report.c:480\n kasan_report+0x118/0x150 mm/kasan/report.c:593\n hci_conn_tx_dequeue+0x1be/0x220 net/bluetooth/hci_conn.c:3036\n hci_num_comp_pkts_evt+0x1c8/0xa50 net/bluetooth/hci_event.c:4404\n hci_event_func net/bluetooth/hci_event.c:7477 [inline]\n hci_event_packet+0x7e0/0x1200 net/bluetooth/hci_event.c:7531\n hci_rx_work+0x46a/0xe80 net/bluetooth/hci_core.c:4070\n process_one_work kernel/workqueue.c:3238 [inline]\n process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321\n worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402\n kthread+0x70e/0x8a0 kernel/kthread.c:464\n ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148\n ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245\n \u003c/TASK\u003e\n\nAllocated by task 54:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3e/0x80 mm/kasan/common.c:68\n poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4359\n kmalloc_noprof include/linux/slab.h:905 [inline]\n kzalloc_noprof include/linux/slab.h:1039 [inline]\n __hci_conn_add+0x233/0x1b30 net/bluetooth/hci_conn.c:939\n le_conn_complete_evt+0x3d6/0x1220 net/bluetooth/hci_event.c:5628\n hci_le_enh_conn_complete_evt+0x189/0x470 net/bluetooth/hci_event.c:5794\n hci_event_func net/bluetooth/hci_event.c:7474 [inline]\n hci_event_packet+0x78c/0x1200 net/bluetooth/hci_event.c:7531\n hci_rx_work+0x46a/0xe80 net/bluetooth/hci_core.c:4070\n process_one_work kernel/workqueue.c:3238 [inline]\n process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321\n worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402\n kthread+0x70e/0x8a0 kernel/kthread.c:464\n ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148\n ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245\n\nFreed by task 9572:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3e/0x80 mm/kasan/common.c:68\n kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576\n poison_slab_object mm/kasan/common.c:247 [inline]\n __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264\n kasan_slab_free include/linux/kasan.h:233 [inline]\n slab_free_hook mm/slub.c:2381 [inline]\n slab_free mm/slub.c:4643 [inline]\n kfree+0x18e/0x440 mm/slub.c:4842\n device_release+0x9c/0x1c0\n kobject_cleanup lib/kobject.c:689 [inline]\n kobject_release lib/kobject.c:720 [inline]\n kref_put include/linux/kref.h:65 [inline]\n kobject_put+0x22b/0x480 lib/kobject.c:737\n hci_conn_cleanup net/bluetooth/hci_conn.c:175 [inline]\n hci_conn_del+0x8ff/0xcb0 net/bluetooth/hci_conn.c:1173\n hci_abort_conn_sync+0x5d1/0xdf0 net/bluetooth/hci_sync.c:5689\n hci_cmd_sync_work+0x210/0x3a0 net/bluetooth/hci_sync.c:332\n process_one_work kernel/workqueue.c:3238 [inline]\n process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321\n worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402\n kthread+0x70e/0x8a0 kernel/kthread.c:464\n ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148\n ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable code processes the HCI event stream produced by Bluetooth link activity, and the race is driven by an attacker within Bluetooth radio range who establishes an LE/ACL connection, generates traffic to produce Number of Completed Packets events, and forces host-side connection teardown. Bluetooth is a same-radio-segment vector, not routable, so Adjacent.\nAC:L - The attacker controls both sides of the race \u2014 the traffic that generates completion events and the connect/disconnect churn that drives hci_abort_conn_sync() into hci_conn_del() on the separate req_workqueue \u2014 and can retry indefinitely. The dequeue loop runs up to `count` (0xFFFF) iterations on the freed object, making the window very wide on any SMP system.\nPR:N - An adjacent Bluetooth peer needs no credentials on the target; LE connection establishment requires no pairing or authentication, and the event processing path has no capability check. No local account on the victim is needed at all.\nUI:N - Triggering requires only that the victim\u0027s Bluetooth adapter be up and connectable, which is the default state on phones, laptops, and IoT devices. No victim action is needed.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed hci_conn is read after free, and skb_dequeue() on the freed tx_q returns an attacker-controllable pointer that is then dereferenced through __skb_tstamp_tx()/skb-\u003esk, giving an arbitrary-read primitive over kernel memory once the slab object is reclaimed.\nI:H - The path performs multiple writes into freed memory (conn-\u003esent, comp-\u003eextra, comp-\u003etracked, spinlock and list-head mutation in skb_dequeue) plus a controlled kfree_skb() and an indirect call via sk_error_report(sk), yielding arbitrary write and control-flow hijack potential.\nA:H - The KASAN report shows a slab-use-after-free in the hci_rx_work kernel thread; dereferencing freed/reclaimed memory and looping thousands of times over a stale queue reliably produces an oops or panic, taking down the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:51.513Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dde33124f17cf3bab4dc5e18d1b4dee128361061"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e128683176a56459cef8705fc7c35f438f88abd"
        }
      ],
      "title": "Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39983",
    "datePublished": "2025-10-15T07:56:02.752Z",
    "dateReserved": "2025-04-16T07:20:57.150Z",
    "dateUpdated": "2026-08-05T12:06:51.513Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-40047 (GCVE-0-2025-40047)

Vulnerability from cvelistv5 – Published: 2025-10-28 11:48 – Updated: 2026-08-05 12:07

Title

io_uring/waitid: always prune wait queue entry in io_waitid_wait()

Summary

In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: always prune wait queue entry in io_waitid_wait() For a successful return, always remove our entry from the wait queue entry list. Previously this was skipped if a cancelation was in progress, but this can race with another invocation of the wait queue entry callback.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/696ba6032081e6175…
https://git.kernel.org/stable/c/3e2205db2f0608898…
https://git.kernel.org/stable/c/2f8229d53d984c6a0…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f31ecf671ddc498f20219453395794ff2383e06b , < 696ba6032081e617564a8113a001b8d7943cb928 (git) Affected: f31ecf671ddc498f20219453395794ff2383e06b , < 3e2205db2f0608898d535da1964e1b376aacfdaa (git) Affected: f31ecf671ddc498f20219453395794ff2383e06b , < 2f8229d53d984c6a05b71ac9e9583d4354e3b91f (git)
Linux	Linux	Affected: 6.7 Unaffected: 0 , < 6.7 (semver) Unaffected: 6.12.53 , ≤ 6.12.* (semver) Unaffected: 6.17.3 , ≤ 6.17.* (semver) Unaffected: 6.18 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "io_uring/waitid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "696ba6032081e617564a8113a001b8d7943cb928",
              "status": "affected",
              "version": "f31ecf671ddc498f20219453395794ff2383e06b",
              "versionType": "git"
            },
            {
              "lessThan": "3e2205db2f0608898d535da1964e1b376aacfdaa",
              "status": "affected",
              "version": "f31ecf671ddc498f20219453395794ff2383e06b",
              "versionType": "git"
            },
            {
              "lessThan": "2f8229d53d984c6a05b71ac9e9583d4354e3b91f",
              "status": "affected",
              "version": "f31ecf671ddc498f20219453395794ff2383e06b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "io_uring/waitid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.53",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/waitid: always prune wait queue entry in io_waitid_wait()\n\nFor a successful return, always remove our entry from the wait queue\nentry list. Previously this was skipped if a cancelation was in\nprogress, but this can race with another invocation of the wait queue\nentry callback."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the io_uring syscall interface (`io_uring_setup`/`io_uring_enter` submitting an `IORING_OP_WAITID` SQE) plus process-management signals, all of which require local access to the system. Per kernel scoring guidance, io_uring bugs are Local.\nAC:L - The attacker controls both sides of the race: it drives the wait-queue wakeups at arbitrary rate by forking children and looping SIGSTOP/SIGCONT (`do_notify_parent_cldstop` \u2192 `__wake_up_parent`), while concurrently submitting `IORING_OP_ASYNC_CANCEL` or tearing down the ring from another thread to grab the competing reference. syzbot produced a working reproducer and confirmed the fix, showing the window is hit reliably.\nPR:L - Any unprivileged local user can create an io_uring ring \u2014 `sysctl_io_uring_disabled` defaults to 0 and `IORING_OP_WAITID` carries no capability check \u2014 and waiting on one\u0027s own forked children needs no privilege at all. No capabilities, user namespaces, or root are required.\nUI:N - The attacker\u0027s own process performs every step: submitting the waitid SQE, forking and signalling the children that generate wakeups, and issuing the concurrent cancel. No action by any other user is needed.\nS:U - The use-after-free corrupts kernel heap memory and control flow within the same kernel security authority, yielding standard local privilege escalation. No VM, IOMMU, or other security-boundary crossing is involved.\nC:H - This is a use-after-free on a `struct io_waitid_async` allocated from a general-purpose kmalloc slab, which the attacker can reclaim and shape via heap spraying. The stale wait-queue entry is then dereferenced by `__wake_up_common()` and `list_del_init()`, giving a read primitive over reclaimed kernel memory that can be leveraged for arbitrary kernel memory disclosure.\nI:H - `list_del_init()` on the freed entry performs `prev-\u003enext = next; next-\u003eprev = prev` using pointers read from attacker-reclaimed memory, yielding a controlled write of a controlled pointer to a controlled address. Additionally `__wake_up_common()` calls `curr-\u003efunc(...)` on the freed entry, providing a direct indirect-call/control-flow hijack primitive leading to kernel code execution.\nA:H - Even without weaponization, the dangling wait-queue entry and the list-corrupting `list_del_init()` on freed memory produce KASAN splats, list debug BUGs, and kernel oopses/panics \u2014 this is exactly how syzbot detected it. The race can be re-triggered in a tight loop, so an unprivileged user can crash the machine at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:20.600Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/696ba6032081e617564a8113a001b8d7943cb928"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e2205db2f0608898d535da1964e1b376aacfdaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f8229d53d984c6a05b71ac9e9583d4354e3b91f"
        }
      ],
      "title": "io_uring/waitid: always prune wait queue entry in io_waitid_wait()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40047",
    "datePublished": "2025-10-28T11:48:24.625Z",
    "dateReserved": "2025-04-16T07:20:57.156Z",
    "dateUpdated": "2026-08-05T12:07:20.600Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-40058 (GCVE-0-2025-40058)

Vulnerability from cvelistv5 – Published: 2025-10-28 11:48 – Updated: 2026-08-05 12:07

Title

iommu/vt-d: Disallow dirty tracking if incoherent page walk

Summary

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Disallow dirty tracking if incoherent page walk Dirty page tracking relies on the IOMMU atomically updating the dirty bit in the paging-structure entry. For this operation to succeed, the paging- structure memory must be coherent between the IOMMU and the CPU. In another word, if the iommu page walk is incoherent, dirty page tracking doesn't work. The Intel VT-d specification, Section 3.10 "Snoop Behavior" states: "Remapping hardware encountering the need to atomically update A/EA/D bits in a paging-structure entry that is not snooped will result in a non- recoverable fault." To prevent an IOMMU from being incorrectly configured for dirty page tracking when it is operating in an incoherent mode, mark SSADS as supported only when both ecap_slads and ecap_smpwc are supported.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/ebe16d245a00626bb…
https://git.kernel.org/stable/c/8d096ce0e87bdc361…
https://git.kernel.org/stable/c/57f55048e564dedd8…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f35f22cc760eb2c7034bf53251399685d611e03f , < ebe16d245a00626bb87163862a1b07daf5475a3e (git) Affected: f35f22cc760eb2c7034bf53251399685d611e03f , < 8d096ce0e87bdc361f0b25d7943543bc53aa0b9e (git) Affected: f35f22cc760eb2c7034bf53251399685d611e03f , < 57f55048e564dedd8a4546d018e29d6bbfff0a7e (git)
Linux	Linux	Affected: 6.7 Unaffected: 0 , < 6.7 (semver) Unaffected: 6.12.53 , ≤ 6.12.* (semver) Unaffected: 6.17.3 , ≤ 6.17.* (semver) Unaffected: 6.18 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/intel/iommu.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ebe16d245a00626bb87163862a1b07daf5475a3e",
              "status": "affected",
              "version": "f35f22cc760eb2c7034bf53251399685d611e03f",
              "versionType": "git"
            },
            {
              "lessThan": "8d096ce0e87bdc361f0b25d7943543bc53aa0b9e",
              "status": "affected",
              "version": "f35f22cc760eb2c7034bf53251399685d611e03f",
              "versionType": "git"
            },
            {
              "lessThan": "57f55048e564dedd8a4546d018e29d6bbfff0a7e",
              "status": "affected",
              "version": "f35f22cc760eb2c7034bf53251399685d611e03f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/intel/iommu.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.53",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Disallow dirty tracking if incoherent page walk\n\nDirty page tracking relies on the IOMMU atomically updating the dirty bit\nin the paging-structure entry. For this operation to succeed, the paging-\nstructure memory must be coherent between the IOMMU and the CPU. In\nanother word, if the iommu page walk is incoherent, dirty page tracking\ndoesn\u0027t work.\n\nThe Intel VT-d specification, Section 3.10 \"Snoop Behavior\" states:\n\n\"Remapping hardware encountering the need to atomically update A/EA/D bits\n in a paging-structure entry that is not snooped will result in a non-\n recoverable fault.\"\n\nTo prevent an IOMMU from being incorrectly configured for dirty page\ntracking when it is operating in an incoherent mode, mark SSADS as\nsupported only when both ecap_slads and ecap_smpwc are supported."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable configuration is reached only through local ioctls on /dev/iommu (IOMMU_HWPT_ALLOC with IOMMU_HWPT_ALLOC_DIRTY_TRACKING, then IOMMU_HWPT_SET_DIRTY_TRACKING) against a bound VFIO device fd. There is no network-facing path into the VT-d dirty-tracking code.\nAC:L - On an affected IOMMU the attacker deterministically allocates the dirty-tracking hwpt and enables SSADE with two ioctls \u2014 no race to win and no memory layout to groom. Where the IOMMU is emulated for a guest, the ecap_slads=1/ecap_smpwc=0 combination is itself under attacker or hypervisor control.\nPR:L - Access to /dev/iommu plus a VFIO device fd is required, which in standard device-assignment deployments is delegated to the unprivileged VMM user (qemu/libvirt) rather than requiring real root. A compromised VMM process or a user in a device-assignment group can drive the entire sequence.\nUI:N - The full sequence \u2014 hwpt allocation, dirty-tracking enable, and the subsequent device DMA \u2014 is driven entirely by the attacker\u0027s own process and the device it already controls. No victim action is needed.\nS:C - The defect is in the IOMMU\u0027s own DMA-isolation enforcement: SSADE is programmed on hardware that cannot coherently update paging-structure entries, and the unflushed cached RMW in intel_iommu_read_and_clear_dirty() can resurrect stale second-stage PTEs. An assigned device\u0027s DMA then reaches memory outside its authorized translation, crossing the IOMMU security boundary.\nC:H - Stale or incorrectly-updated second-stage paging entries leave a device-visible mapping to host pages that have been unmapped and potentially reassigned, giving the controlled device DMA reads of arbitrary host memory. Dirty-bitmap results are also unreliable, leaking incorrect state across a migration boundary.\nI:H - The same stale-translation window gives the assigned device DMA writes into host memory outside its mapping \u2014 an arbitrary write primitive from the device side that defeats IOMMU containment. Silently missed dirty pages additionally corrupt guest memory state on live migration.\nA:H - The VT-d specification mandates a non-recoverable fault whenever the hardware must atomically update A/EA/D bits in a non-snooped paging-structure entry, so the assigned device\u0027s DMA is blocked outright and the DMAR fault handler is driven repeatedly. The device and any VM depending on it are rendered inoperable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:25.986Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ebe16d245a00626bb87163862a1b07daf5475a3e"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d096ce0e87bdc361f0b25d7943543bc53aa0b9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/57f55048e564dedd8a4546d018e29d6bbfff0a7e"
        }
      ],
      "title": "iommu/vt-d: Disallow dirty tracking if incoherent page walk",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40058",
    "datePublished": "2025-10-28T11:48:31.567Z",
    "dateReserved": "2025-04-16T07:20:57.158Z",
    "dateUpdated": "2026-08-05T12:07:25.986Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-40185 (GCVE-0-2025-40185)

Vulnerability from cvelistv5 – Published: 2025-11-12 21:56 – Updated: 2026-05-11 21:44

Title

ice: ice_adapter: release xa entry on adapter allocation failure

Summary

In the Linux kernel, the following vulnerability has been resolved: ice: ice_adapter: release xa entry on adapter allocation failure When ice_adapter_new() fails, the reserved XArray entry created by xa_insert() is not released. This causes subsequent insertions at the same index to return -EBUSY, potentially leading to NULL pointer dereferences. Reorder the operations as suggested by Przemek Kitszel: 1. Check if adapter already exists (xa_load) 2. Reserve the XArray slot (xa_reserve) 3. Allocate the adapter (ice_adapter_new) 4. Store the adapter (xa_store)

Severity

No CVSS data available.

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/7b9269de9815fc34d…
https://git.kernel.org/stable/c/794abb265de3e7921…
https://git.kernel.org/stable/c/2db687f3469dbc5c5…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 0f0023c649c7bc50543fbe6e1801eb6357b8bd63 , < 7b9269de9815fc34d93dab90bd5169bacbe78e70 (git) Affected: 0f0023c649c7bc50543fbe6e1801eb6357b8bd63 , < 794abb265de3e792167fe3ea0440c064c722bb84 (git) Affected: 0f0023c649c7bc50543fbe6e1801eb6357b8bd63 , < 2db687f3469dbc5c59bc53d55acafd75d530b497 (git)
Linux	Linux	Affected: 6.11 Unaffected: 0 , < 6.11 (semver) Unaffected: 6.12.54 , ≤ 6.12.* (semver) Unaffected: 6.17.4 , ≤ 6.17.* (semver) Unaffected: 6.18 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_adapter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7b9269de9815fc34d93dab90bd5169bacbe78e70",
              "status": "affected",
              "version": "0f0023c649c7bc50543fbe6e1801eb6357b8bd63",
              "versionType": "git"
            },
            {
              "lessThan": "794abb265de3e792167fe3ea0440c064c722bb84",
              "status": "affected",
              "version": "0f0023c649c7bc50543fbe6e1801eb6357b8bd63",
              "versionType": "git"
            },
            {
              "lessThan": "2db687f3469dbc5c59bc53d55acafd75d530b497",
              "status": "affected",
              "version": "0f0023c649c7bc50543fbe6e1801eb6357b8bd63",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice_adapter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.54",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.4",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: ice_adapter: release xa entry on adapter allocation failure\n\nWhen ice_adapter_new() fails, the reserved XArray entry created by\nxa_insert() is not released. This causes subsequent insertions at\nthe same index to return -EBUSY, potentially leading to\nNULL pointer dereferences.\n\nReorder the operations as suggested by Przemek Kitszel:\n1. Check if adapter already exists (xa_load)\n2. Reserve the XArray slot (xa_reserve)\n3. Allocate the adapter (ice_adapter_new)\n4. Store the adapter (xa_store)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:44:24.259Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7b9269de9815fc34d93dab90bd5169bacbe78e70"
        },
        {
          "url": "https://git.kernel.org/stable/c/794abb265de3e792167fe3ea0440c064c722bb84"
        },
        {
          "url": "https://git.kernel.org/stable/c/2db687f3469dbc5c59bc53d55acafd75d530b497"
        }
      ],
      "title": "ice: ice_adapter: release xa entry on adapter allocation failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40185",
    "datePublished": "2025-11-12T21:56:28.561Z",
    "dateReserved": "2025-04-16T07:20:57.177Z",
    "dateUpdated": "2026-05-11T21:44:24.259Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2025:22854

BDU:2026-03910 (CVE-2025-39983)

CVE-2025-38737 (GCVE-0-2025-38737)

CVE-2025-39925 (GCVE-0-2025-39925)

CVE-2025-39979 (GCVE-0-2025-39979)

CVE-2025-39981 (GCVE-0-2025-39981)

CVE-2025-39982 (GCVE-0-2025-39982)

CVE-2025-39983 (GCVE-0-2025-39983)

CVE-2025-40047 (GCVE-0-2025-40047)

CVE-2025-40058 (GCVE-0-2025-40058)

CVE-2025-40185 (GCVE-0-2025-40185)

Tags

Sightings

Nomenclature

Related by attack behaviour