[Git][security-tracker-team/security-tracker][master] Merge Linux CVEs from kernel-sec
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Wed Jul 9 12:15:48 BST 2025
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
8bab0259 by Salvatore Bonaccorso at 2025-07-09T13:15:11+02:00
Merge Linux CVEs from kernel-sec
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,96 @@
+CVE-2025-38264 [nvme-tcp: sanitize request list handling]
+ - linux <unfixed>
+ NOTE: https://git.kernel.org/linus/0bf04c874fcb1ae46a863034296e4b33d8fbd66c (6.16-rc1)
+CVE-2025-38263 [bcache: fix NULL pointer in cache_set_flush()]
+ - linux <unfixed>
+ NOTE: https://git.kernel.org/linus/1e46ed947ec658f89f1a910d880cd05e42d3763e (6.16-rc1)
+CVE-2025-38262 [tty: serial: uartlite: register uart driver in init]
+ - linux <unfixed>
+ NOTE: https://git.kernel.org/linus/6bd697b5fc39fd24e2aa418c7b7d14469f550a93 (6.16-rc1)
+CVE-2025-38261 [riscv: save the SR_SUM status over switches]
+ - linux <unfixed>
+ NOTE: https://git.kernel.org/linus/788aa64c01f1262310b4c1fb827a36df170d86ea (6.16-rc1)
+CVE-2025-38260 [btrfs: handle csum tree error with rescue=ibadroots correctly]
+ - linux <unfixed>
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/547e836661554dcfa15c212a3821664e85b4191a (6.16-rc4)
+CVE-2025-38259 [ASoC: codecs: wcd9335: Fix missing free of regulator supplies]
+ - linux <unfixed>
+ NOTE: https://git.kernel.org/linus/9079db287fc3e38e040b0edeb0a25770bb679c8e (6.16-rc1)
+CVE-2025-38258 [mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write]
+ - linux <unfixed>
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/4f489fe6afb395dbc79840efa3c05440b760d883 (6.16-rc4)
+CVE-2025-38257 [s390/pkey: Prevent overflow in size calculation for memdup_user()]
+ - linux <unfixed>
+ NOTE: https://git.kernel.org/linus/7360ee47599af91a1d5f4e74d635d9408a54e489 (6.16-rc4)
+CVE-2025-38256 [io_uring/rsrc: fix folio unpinning]
+ - linux <unfixed>
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/5afb4bf9fc62d828647647ec31745083637132e4 (6.16-rc4)
+CVE-2025-38255 [lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()]
+ - linux <unfixed>
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/df831e97739405ecbaddb85516bc7d4d1c933d6b (6.16-rc4)
+CVE-2025-38254 [drm/amd/display: Add sanity checks for drm_edid_raw()]
+ - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/6847b3b6e84ef37451c074e6a8db3fbd250c8dbf (6.16-rc4)
+CVE-2025-38253 [HID: wacom: fix crash in wacom_aes_battery_handler()]
+ - linux <unfixed>
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/f3054152c12e2eed1e72704aff47b0ea58229584 (6.16-rc4)
+CVE-2025-38252 [cxl/ras: Fix CPER handler device confusion]
+ - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/3c70ec71abdaf4e4fa48cd8fdfbbd864d78235a8 (6.16-rc4)
+CVE-2025-38251 [atm: clip: prevent NULL deref in clip_push()]
+ - linux <unfixed>
+ NOTE: https://git.kernel.org/linus/b993ea46b3b601915ceaaf3c802adf11e7d6bac6 (6.16-rc4)
+CVE-2025-38250 [Bluetooth: hci_core: Fix use-after-free in vhci_flush()]
+ - linux <unfixed>
+ NOTE: https://git.kernel.org/linus/1d6123102e9fbedc8d25bf4731da6d513173e49e (6.16-rc4)
+CVE-2025-38249 [ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()]
+ - linux <unfixed>
+ NOTE: https://git.kernel.org/linus/fb4e2a6e8f28a3c0ad382e363aeb9cd822007b8a (6.16-rc4)
+CVE-2025-38248 [bridge: mcast: Fix use-after-free during router port configuration]
+ - linux <unfixed>
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/7544f3f5b0b58c396f374d060898b5939da31709 (6.16-rc4)
+CVE-2025-38247 [userns and mnt_idmap leak in open_tree_attr(2)]
+ - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/0748e553df0225754c316a92af3a77fdc057b358 (6.16-rc4)
+CVE-2025-38246 [bnxt: properly flush XDP redirect lists]
+ - linux <unfixed>
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/9caca6ac0e26cd20efd490d8b3b2ffb1c7c00f6f (6.16-rc4)
+CVE-2025-38245 [atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().]
+ - linux <unfixed>
+ NOTE: https://git.kernel.org/linus/a433791aeaea6e84df709e0b9584b9bbe040cd1c (6.16-rc4)
+CVE-2025-38244 [smb: client: fix potential deadlock when reconnecting channels]
+ - linux <unfixed>
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/711741f94ac3cf9f4e3aa73aa171e76d188c0819 (6.16-rc4)
+CVE-2025-38243 [btrfs: fix invalid inode pointer dereferences during log replay]
+ - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/2dcf838cf5c2f0f4501edaa1680fcad03618d760 (6.16-rc4)
+CVE-2025-38242 [mm: userfaultfd: fix race of userfaultfd_move and swap cache]
+ - linux <unfixed>
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/0ea148a799198518d8ebab63ddd0bb6114a103bc (6.16-rc4)
+CVE-2025-38241 [mm/shmem, swap: fix softlockup with mTHP swapin]
+ - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/a05dd8ae5cbb1cb45f349922cfea4f548a5e5d6f (6.16-rc4)
+CVE-2025-38239 [scsi: megaraid_sas: Fix invalid node index]
+ - linux <unfixed>
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/752eb816b55adb0673727ba0ed96609a17895654 (6.16-rc4)
+CVE-2025-38238 [scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out]
+ - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/a35b29bdedb4d2ae3160d4d6684a6f1ecd9ca7c2 (6.16-rc4)
CVE-2025-7378 (Improper Input Validation vulnerability allows injecting arbitrary v ...)
NOT-FOR-US: Asustor
CVE-2025-7220 (A vulnerability was found in Campcodes Payroll Management System 1.0. ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8bab02592debf8328bab46ea665b85206f18ae3f
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8bab02592debf8328bab46ea665b85206f18ae3f
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20250709/5a48c6dc/attachment.htm>
More information about the debian-security-tracker-commits
mailing list