https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 16:33:13 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-06459 bdu:2025-06459 https://cve.radiocsirt.org/vuln/bdu:2025-06459 https://cve.radiocsirt.org/vuln/bell-cve-2024-57929 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2024-57929 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0088 certfr-2025-avi-0088 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0088 https://cve.radiocsirt.org/vuln/euvd-2026-346564 EUVD-2026-346564 https://cve.radiocsirt.org/vuln/euvd-2026-346564 https://cve.radiocsirt.org/vuln/fkie_cve-2024-57929 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>dm array: fix releasing a faulty array block twice in dm_array_cursor_end</p> <p>When dm_bm_read_lock() fails due to locking or checksum errors, it releases the faulty block implicitly while leaving an invalid output pointer behind. The caller of dm_bm_read_lock() should not operate on this invalid dm_block pointer, or it will lead to undefined result. For example, the dm_array_cursor incorrectly caches the invalid pointer on reading a faulty array block, causing a double release in dm_array_cursor_end(), then hitting the BUG_ON in dm-bufio cache_put().</p> <p>Reproduce steps:</p> <p>1. initialize a cache device</p> <p>dmsetup create cmeta --table &#34;0 8192 linear /dev/sdc 0&#34; dmsetup create cdata --table &#34;0 65536 linear /dev/sdc 8192&#34; dmsetup create corig --table &#34;0 524288 linear /dev/sdc $262144&#34; dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 dmsetup create cache --table &#34;0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0&#34;</p> <p>2. wipe the second array block offline</p> <p>dmsteup remove cache cmeta cdata corig mapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \ 2&gt;/dev/null | hexdump -e &#39;1/8 &#34;%u\n&#34;&#39;) ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \ 2&gt;/dev/null | hexdump -e &#39;1/8 &#34;%u\n&#34;&#39;) dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock</p> <p>3. try reopen the cache device</p> <p>dmsetup create cmeta --table &#34;0 8192 linear /dev/sdc 0&#34; dmsetup create cdata --table…</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>dm array: fix releasing a faulty array block twice in dm_array_cursor_end</p> <p>When dm_bm_read_lock() fails due to locking or checksum errors, it releases the faulty block implicitly while leaving an invalid output pointer behind. The caller of dm_bm_read_lock() should not operate on this invalid dm_block pointer, or it will lead to undefined result. For example, the dm_array_cursor incorrectly caches the invalid pointer on reading a faulty array block, causing a double release in dm_array_cursor_end(), then hitting the BUG_ON in dm-bufio cache_put().</p> <p>Reproduce steps:</p> <p>1. initialize a cache device</p> <p>dmsetup create cmeta --table &#34;0 8192 linear /dev/sdc 0&#34; dmsetup create cdata --table &#34;0 65536 linear /dev/sdc 8192&#34; dmsetup create corig --table &#34;0 524288 linear /dev/sdc $262144&#34; dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 dmsetup create cache --table &#34;0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0&#34;</p> <p>2. wipe the second array block offline</p> <p>dmsteup remove cache cmeta cdata corig mapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \ 2&gt;/dev/null | hexdump -e &#39;1/8 &#34;%u\n&#34;&#39;) ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \ 2&gt;/dev/null | hexdump -e &#39;1/8 &#34;%u\n&#34;&#39;) dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock</p> <p>3. try reopen the cache device</p> <p>dmsetup create cmeta --table &#34;0 8192 linear /dev/sdc 0&#34; dmsetup create cdata --table…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-57929 https://cve.radiocsirt.org/vuln/ghsa-q6w5-274c-4fj8 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>dm array: fix releasing a faulty array block twice in dm_array_cursor_end</p> <p>When dm_bm_read_lock() fails due to locking or checksum errors, it releases the faulty block implicitly while leaving an invalid output pointer behind. The caller of dm_bm_read_lock() should not operate on this invalid dm_block pointer, or it will lead to undefined result. For example, the dm_array_cursor incorrectly caches the invalid pointer on reading a faulty array block, causing a double release in dm_array_cursor_end(), then hitting the BUG_ON in dm-bufio cache_put().</p> <p>Reproduce steps:</p> <p>1. initialize a cache device</p> <p>dmsetup create cmeta --table &#34;0 8192 linear /dev/sdc 0&#34; dmsetup create cdata --table &#34;0 65536 linear /dev/sdc 8192&#34; dmsetup create corig --table &#34;0 524288 linear /dev/sdc $262144&#34; dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 dmsetup create cache --table &#34;0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0&#34;</p> <p>2. wipe the second array block offline</p> <p>dmsteup remove cache cmeta cdata corig mapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \ 2&gt;/dev/null | hexdump -e &#39;1/8 &#34;%u\n&#34;&#39;) ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \ 2&gt;/dev/null | hexdump -e &#39;1/8 &#34;%u\n&#34;&#39;) dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock</p> <p>3. try reopen the cache device</p> <p>dmsetup create cmeta --table &#34;0 8192 linear /dev/sdc 0&#34; dmsetup create cdata --table…</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>dm array: fix releasing a faulty array block twice in dm_array_cursor_end</p> <p>When dm_bm_read_lock() fails due to locking or checksum errors, it releases the faulty block implicitly while leaving an invalid output pointer behind. The caller of dm_bm_read_lock() should not operate on this invalid dm_block pointer, or it will lead to undefined result. For example, the dm_array_cursor incorrectly caches the invalid pointer on reading a faulty array block, causing a double release in dm_array_cursor_end(), then hitting the BUG_ON in dm-bufio cache_put().</p> <p>Reproduce steps:</p> <p>1. initialize a cache device</p> <p>dmsetup create cmeta --table &#34;0 8192 linear /dev/sdc 0&#34; dmsetup create cdata --table &#34;0 65536 linear /dev/sdc 8192&#34; dmsetup create corig --table &#34;0 524288 linear /dev/sdc $262144&#34; dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 dmsetup create cache --table &#34;0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0&#34;</p> <p>2. wipe the second array block offline</p> <p>dmsteup remove cache cmeta cdata corig mapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \ 2&gt;/dev/null | hexdump -e &#39;1/8 &#34;%u\n&#34;&#39;) ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \ 2&gt;/dev/null | hexdump -e &#39;1/8 &#34;%u\n&#34;&#39;) dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock</p> <p>3. try reopen the cache device</p> <p>dmsetup create cmeta --table &#34;0 8192 linear /dev/sdc 0&#34; dmsetup create cdata --table…</p> https://cve.radiocsirt.org/vuln/ghsa-q6w5-274c-4fj8 https://cve.radiocsirt.org/vuln/icsa-24-102-01 <p>An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat. fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd. SUNRPC: null pointer dereference in svc_rqst_free(). When alloc_pages_node() returns null in svc_rqst_alloc(), the null rq_scratch_page pointer will be dereferenced when calling put_page() in svc_rqst_free(). NFSD: READDIR buffer overflow. If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write beyond the actual buffer. This calculation has always been suspect. NFSD has never sanity- checked the READDIR count argument, but the old entry encoders managed the problem correctly. With the commits below, entry encoding changed, exposing the underflow to the pointer arithmetic in xdr_reserve_space(). Modern NFS clients attempt to retrieve as much data as possible for each READDIR request. nfsd: NULL dereference in nfs3svc_encode_getaclres. A NULL pointer dereference vulnerability…</p> <p>An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat. fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd. SUNRPC: null pointer dereference in svc_rqst_free(). When alloc_pages_node() returns null in svc_rqst_alloc(), the null rq_scratch_page pointer will be dereferenced when calling put_page() in svc_rqst_free(). NFSD: READDIR buffer overflow. If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write beyond the actual buffer. This calculation has always been suspect. NFSD has never sanity- checked the READDIR count argument, but the old entry encoders managed the problem correctly. With the commits below, entry encoding changed, exposing the underflow to the pointer arithmetic in xdr_reserve_space(). Modern NFS clients attempt to retrieve as much data as possible for each READDIR request. nfsd: NULL dereference in nfs3svc_encode_getaclres. A NULL pointer dereference vulnerability…</p> https://cve.radiocsirt.org/vuln/icsa-24-102-01 https://cve.radiocsirt.org/vuln/oesa-2025-1446 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es):</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans</p> <p>There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative.</p> <p>[ 23.734156] switchtec switchtec0: MW 0: part 0 addr 0x0000000000000000 size 0x0000000000000000 [ 23.734158] ================================================================================ [ 23.734172] UBSAN: shift-out-of-bounds in drivers/ntb/hw/mscc/ntb_hw_switchtec.c:293:7 [ 23.734418] shift exponent -1 is negative</p> <p>Ensuring xlate_pos is a positive or zero before BIT.(CVE-2023-53034)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()</p> <p>The &amp;quot;submit-&amp;gt;cmd[i].size&amp;quot; and &amp;quot;submit-&amp;gt;cmd[i].offset&amp;quot; variables are u32 values that come from the user via the submit_lookup_cmds() function. This addition could lead to an integer wrapping bug so use size_add() to prevent that.</p> <p>Patchwork: https://patchwork.freedesktop.org/patch/624696/(CVE-2024-52559)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()</p> <p>Extended the `mi_enum_attr()` function interface with an additional parameter, `struct ntfs_inode *ni`, to allow marking the inode as bad as soon as an error i…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es):</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans</p> <p>There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative.</p> <p>[ 23.734156] switchtec switchtec0: MW 0: part 0 addr 0x0000000000000000 size 0x0000000000000000 [ 23.734158] ================================================================================ [ 23.734172] UBSAN: shift-out-of-bounds in drivers/ntb/hw/mscc/ntb_hw_switchtec.c:293:7 [ 23.734418] shift exponent -1 is negative</p> <p>Ensuring xlate_pos is a positive or zero before BIT.(CVE-2023-53034)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()</p> <p>The &amp;quot;submit-&amp;gt;cmd[i].size&amp;quot; and &amp;quot;submit-&amp;gt;cmd[i].offset&amp;quot; variables are u32 values that come from the user via the submit_lookup_cmds() function. This addition could lead to an integer wrapping bug so use size_add() to prevent that.</p> <p>Patchwork: https://patchwork.freedesktop.org/patch/624696/(CVE-2024-52559)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()</p> <p>Extended the `mi_enum_attr()` function interface with an additional parameter, `struct ntfs_inode *ni`, to allow marking the inode as bad as soon as an error i…</p> https://cve.radiocsirt.org/vuln/oesa-2025-1446 https://cve.radiocsirt.org/vuln/rhsa-2025:6966 <p>kernel: xen-netfront: Fix NULL sring after live migration kernel: fscache: Fix oops due to race with cookie_lru and use_cookie kernel: tracing: Free buffers when a used dynamic event is removed kernel: net: tun: Fix use-after-free in tun_detach() kernel: hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails kernel: erofs/zmap.c: Fix incorrect offset calculation kernel: arm64/mm: fix incorrect file_map_count for non-leaf pmd/pud kernel: s390: avoid using global register for current_stack_pointer kernel: erofs: fix missing xas_retry() in fscache mode kernel: rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge kernel: remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init kernel: of: check previous kernel&#39;s ima-kexec-buffer against memory bounds kernel: coresight: Clear the connection field properly kernel: Linux kernel: Denial of Service in coresight: trbe kernel: rpmsg: char: Avoid double destroy of default endpoint kernel: coresight: cti: Fix hang in cti_disable_hw() kernel: lib/fonts: fix undefined behavior in bit shift for get_default_font kernel: Kernel: Denial of Service in pci_endpoint_test due to zero-length DMA mapping kernel: Linux kernel: Denial of Service in erofs due to memory leak kernel: erofs: fix missing unmap if z_erofs_get_extent_compressedlen() fails kernel: pipe: wakeup wr_wait after setting max_usage kernel: ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir() kernel: qed/qed_sriov: guard against NULL derefs from qed_…</p> <p>kernel: xen-netfront: Fix NULL sring after live migration kernel: fscache: Fix oops due to race with cookie_lru and use_cookie kernel: tracing: Free buffers when a used dynamic event is removed kernel: net: tun: Fix use-after-free in tun_detach() kernel: hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails kernel: erofs/zmap.c: Fix incorrect offset calculation kernel: arm64/mm: fix incorrect file_map_count for non-leaf pmd/pud kernel: s390: avoid using global register for current_stack_pointer kernel: erofs: fix missing xas_retry() in fscache mode kernel: rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge kernel: remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init kernel: of: check previous kernel&#39;s ima-kexec-buffer against memory bounds kernel: coresight: Clear the connection field properly kernel: Linux kernel: Denial of Service in coresight: trbe kernel: rpmsg: char: Avoid double destroy of default endpoint kernel: coresight: cti: Fix hang in cti_disable_hw() kernel: lib/fonts: fix undefined behavior in bit shift for get_default_font kernel: Kernel: Denial of Service in pci_endpoint_test due to zero-length DMA mapping kernel: Linux kernel: Denial of Service in erofs due to memory leak kernel: erofs: fix missing unmap if z_erofs_get_extent_compressedlen() fails kernel: pipe: wakeup wr_wait after setting max_usage kernel: ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir() kernel: qed/qed_sriov: guard against NULL derefs from qed_…</p> https://cve.radiocsirt.org/vuln/rhsa-2025:6966 https://cve.radiocsirt.org/vuln/ssa-265688 <p>An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat. fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd. SUNRPC: null pointer dereference in svc_rqst_free(). When alloc_pages_node() returns null in svc_rqst_alloc(), the null rq_scratch_page pointer will be dereferenced when calling put_page() in svc_rqst_free(). NFSD: READDIR buffer overflow. If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write beyond the actual buffer. This calculation has always been suspect. NFSD has never sanity- checked the READDIR count argument, but the old entry encoders managed the problem correctly. With the commits below, entry encoding changed, exposing the underflow to the pointer arithmetic in xdr_reserve_space(). Modern NFS clients attempt to retrieve as much data as possible for each READDIR request. nfsd: NULL dereference in nfs3svc_encode_getaclres. A NULL pointer dereference vulnerability…</p> <p>An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat. fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd. SUNRPC: null pointer dereference in svc_rqst_free(). When alloc_pages_node() returns null in svc_rqst_alloc(), the null rq_scratch_page pointer will be dereferenced when calling put_page() in svc_rqst_free(). NFSD: READDIR buffer overflow. If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write beyond the actual buffer. This calculation has always been suspect. NFSD has never sanity- checked the READDIR count argument, but the old entry encoders managed the problem correctly. With the commits below, entry encoding changed, exposing the underflow to the pointer arithmetic in xdr_reserve_space(). Modern NFS clients attempt to retrieve as much data as possible for each READDIR request. nfsd: NULL dereference in nfs3svc_encode_getaclres. A NULL pointer dereference vulnerability…</p> https://cve.radiocsirt.org/vuln/ssa-265688 https://cve.radiocsirt.org/vuln/suse-su-2025:0289-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/suse-su-2025:0289-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-57929 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe, Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:Pro:16.04:LTS: linux-oracle, Ubuntu:Pro:18.04:LTS: linux, Ubuntu:Pro:18.04:LTS: linux-aws, Ubuntu:18.04:LTS: linux-aws-5.0 and 188 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: dm array: fix releasing a faulty array block twice in dm_array_cursor_end When dm_bm_read_lock() fails due to locking or checksum errors, it releases the faulty block implicitly while leaving an invalid output pointer behind. The caller of dm_bm_read_lock() should not operate on this invalid dm_block pointer, or it will lead to undefined result. For example, the dm_array_cursor incorrectly caches the invalid pointer on reading a faulty array block, causing a double release in dm_array_cursor_end(), then hitting the BUG_ON in dm-bufio cache_put(). Reproduce steps: 1. initialize a cache device dmsetup create cmeta --table &#34;0 8192 linear /dev/sdc 0&#34; dmsetup create cdata --table &#34;0 65536 linear /dev/sdc 8192&#34; dmsetup create corig --table &#34;0 524288 linear /dev/sdc $262144&#34; dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 dmsetup create cache --table &#34;0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0&#34; 2. wipe the second array block offline dmsteup remove cache cmeta cdata corig mapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \ 2&gt;/dev/null | hexdump -e &#39;1/8 &#34;%u\n&#34;&#39;) ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \ 2&gt;/dev/null | hexdump -e &#39;1/8 &#34;%u\n&#34;&#39;) dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock 3. try reopen the cache device dmsetup create cmeta --table &#34;0 8192 linear /dev/sdc 0&#34; dmsetup create cdata --table &#34;0 65536…</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe, Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:Pro:16.04:LTS: linux-oracle, Ubuntu:Pro:18.04:LTS: linux, Ubuntu:Pro:18.04:LTS: linux-aws, Ubuntu:18.04:LTS: linux-aws-5.0 and 188 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: dm array: fix releasing a faulty array block twice in dm_array_cursor_end When dm_bm_read_lock() fails due to locking or checksum errors, it releases the faulty block implicitly while leaving an invalid output pointer behind. The caller of dm_bm_read_lock() should not operate on this invalid dm_block pointer, or it will lead to undefined result. For example, the dm_array_cursor incorrectly caches the invalid pointer on reading a faulty array block, causing a double release in dm_array_cursor_end(), then hitting the BUG_ON in dm-bufio cache_put(). Reproduce steps: 1. initialize a cache device dmsetup create cmeta --table &#34;0 8192 linear /dev/sdc 0&#34; dmsetup create cdata --table &#34;0 65536 linear /dev/sdc 8192&#34; dmsetup create corig --table &#34;0 524288 linear /dev/sdc $262144&#34; dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 dmsetup create cache --table &#34;0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0&#34; 2. wipe the second array block offline dmsteup remove cache cmeta cdata corig mapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \ 2&gt;/dev/null | hexdump -e &#39;1/8 &#34;%u\n&#34;&#39;) ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \ 2&gt;/dev/null | hexdump -e &#39;1/8 &#34;%u\n&#34;&#39;) dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock 3. try reopen the cache device dmsetup create cmeta --table &#34;0 8192 linear /dev/sdc 0&#34; dmsetup create cdata --table &#34;0 65536…</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-57929 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0119 <p>Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen oder andere nicht spezifizierte Auswirkungen zu verursachen.</p> <p>Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen oder andere nicht spezifizierte Auswirkungen zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0119